Sec. 09.03.07.03. Annual Registration

A. During the time period established by the Commissioner under §B of this regulation, each consumer reporting agency shall:

(1) Obtain and maintain a valid unique identifier issued by NMLS when an account is created with NMLS; and

(2) Transfer registration information to NMLS.

B. The Commissioner shall establish a time period that is not less than 2 months after the effective date of these regulations within which a registrant must transfer registration information to NMLS.

C. At least 30 days before the transfer period begins, the Commissioner shall:

(1) Notify all registrants of the transfer period; and

(2) Provide instructions for the transfer of registration information to NMLS.

D. Subject to §A of this regulation, a consumer credit reporting agency submitting an initial registration or a registration renewal shall apply for the initial registration or registration renewal through NMLS on or after November 1 of the year in which these regulations are effective and annually thereafter.

E. To register, the consumer reporting agency shall provide all information required by the Commissioner through NMLS, including:

(1) The address of the principal executive office;

(2) The name of a responsible official of the consumer reporting agency who is available to respond expeditiously to inquiries or complaints referred by the Commissioner or the Commissioner's designee;

(3) A toll-free telephone number for use by the Commissioner or the Commissioner's designee, at which the responsible official required to be identified in this section may be reached;

(4) A toll-free telephone number or numbers maintained by the consumer reporting agency which is available to all Maryland residents for making inquiries;

(5) A certification by a control person that the consumer reporting agency has trained personnel sufficient to promptly and properly investigate and respond to consumer complaints and inquiries available;

(6) The mailing address or addresses to which a consumer may correspond with the consumer reporting agency in order to:

(a) Obtain a copy of their consumer report, and

(b) File written complaints or disputes about the accuracy of information contained in their consumer report;

(7) A certification by a control person who has primary oversight responsibility for the consumer reporting agency’s technology system that the consumer reporting agency is in compliance with all applicable data security requirements, including the requirements of the Fair Credit Reporting Act (15 U.S.C. §1681 et seq.) and, if applicable, the Gramm-Leach-Bliley Act (15 U.S.C. §6801 et seq.) and their respective implementing regulations;

(8) A copy of the declaration page, certificate of liability, or similarly summarized coverage page of the consumer reporting agency’s cyber risk insurance policy, if applicable;

(9) A list of all websites and web applications where there is consumer access to a service offered by the consumer reporting agency;

(10) The total number of consumer reports the consumer reporting agency assembled or evaluated over the previous 12 months; and

(11) The name of any third-party technology vendor that the consumer reporting agency utilizes to assemble, evaluate, or store consumer reports prepared by the consumer reporting agency.

F. If, except for the information required in §E(10) and (11) of this regulation, the information supplied in a consumer reporting agency's registration becomes inaccurate at any time during the calendar year, the consumer reporting agency shall immediately submit the changes to the Commissioner through NMLS.