In November 2007, US bank regulators issued the Red Flags Rules requiring financial institutions to implement a program to prevent identity theft by November 1, 2008. Many institutions believe they already comply because they implemented measures from prior regulations; they think complying with the Red Flags Rules is just documenting procedures now in place. TowerGroup believes that most institutions lack some aspect of the new rules and must do far more than "document documentation." In fact, only one-third of US banks will likely be fully compliant with Red Flags by the deadline. This Research Note offers commentary, clarification, and insights for institutions that must comply.