Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

Managing Third-Party Data Risks: Red Flags Compliance and Service Provider Oversight

19 Jun 2026 · 1 min

Watch on YouTube

1:02

In this instructional video, the presenter explains how the Red Flags Rule applies to third‑party vendors. He first differentiates between service providers that directly interact with covered accounts (e.g., call centers, collection agencies) and support vendors that only have data access (e.g., IT, facilities). Service providers must either follow the organization’s Red Flags Program or have an approved independent program, while support vendors are subject only to data‑security requirements. The speaker then walks through a practical vendor‑audit scenario with a collection agency, highlighting the need for robust identity‑verification questions (e.g., last‑4 SSN, birthdate) and recommending the inclusion of a “Red Flags Compliance Addendum” in contracts to obligate vendors to report suspicious activity. He stresses that failures can expose the company’s compliance program to scrutiny. A brief promotional break introduces Atlantic Training’s Wave platform for HR and soft‑skill training. The overall message is that outsourcing does not eliminate risk; managers must actively oversee vendor practices and embed compliance controls in contracts.

Chapters

This next bit is one that catches a lot of managers off guard: service providers. In the modern world, we outsource a lot. But under the Red Flags Rule, you can't just outsource the risk. Now, we need to make a distinction here between types of providers. First, you have service providers who directly interact with your covered accounts, like a third-party call center handling customer support or an outside collection agency. These vendors must either follow your Red Flags Program or you must approve their own independent program as meeting the rule's requirements. Second, you have support vendors—IT providers or facilities management—who who might have access to data but don't perform detection duties. They still fall under data security rules, but the red flags requirements are different. Focus on the ones touching the accounts.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
Let's look at a vendor audit scenario. Suppose you hire a collection agency, ABC Collections, to chase down bad debt. They have access to your customer names, addresses, and balances. That's prime data for identity thieves. You can't just shake hands and walk away. You need to verify their security. Ask them, "How do you verify the identity of the person you're calling before you discuss the debt?" If they say, "We just ask if they are John Smith," that's not enough. Anyone can say, "Yes, I am John Smith." You need to make sure they are asking for verification, like the last 4 digits of the SSN or a birthdate. I recommend adding a "Red Flags Compliance Addendum" to your contracts with vendors who handle covered accounts. This document should explicitly state that the vendor acknowledges the red flags rule and agrees to report any suspicious activity back to you immediately. If ABC Collections discovers that the "John Smith" they are calling is actually a victim of identity theft, they need to tell you so you can flag the account on your end. Don't let that information die in a silo. And if they screw up? If they let a fraudster through? It's your company's name on the headline, and it's your compliance program that will be under the microscope. Review your vendor contracts. Add a red flags addendum if you need to.