Code of Maryland Regulations
Title 09 - MARYLAND DEPARTMENT OF LABOR
Subtitle 03 - COMMISSIONER OF FINANCIAL REGULATION
Chapter 09.03.02 - General Regulations
Section 09.03.02.08 - Remote Work for Employees of Licensees
Universal Citation: MD Code Reg 09.03.02.08
Current through Register Vol. 51, No. 19, September 20, 2024
A. Scope.
(1) This regulation governs the conduct of
any employee operating from a location other than that which appears on the
employer's license or licenses.
(2)
Notwithstanding §A(1) of this regulation, this regulation does not apply
to the conduct of an employee if:
(a) The
employer is licensed under Financial Institutions Article, Title 11, Subtitle
5, Annotated Code of Maryland;
(b)
The employee is licensed under Financial Institutions Article, Title 11,
Subtitle 6, Annotated Code of Maryland; and
(c) The employee is taking a loan application
or offering or negotiating the terms of a loan in compliance with COMAR
09.03.09.07.
(3)
Nothing contained in this regulation shall be deemed to prohibit an employee of
a licensee from conducting any business for which a license is required at a
location other than the locations set forth on the employer's license or
licenses if applicable law or regulation does not limit that conduct to the
location shown on the license.
(4)
A licensee may not use this regulation to evade the requirements of any
applicable law or regulation.
B. Definitions.
(1) Terms Defined.
(2) In this regulation, the following terms
have the meanings indicated.
(a) "Affiliate"
means a person that directly or indirectly, through one or more intermediaries,
controls, is controlled by, or is under common control with another
person.
(b) "Authorized delegate"
has the meaning stated in Financial Institutions Article, §12-401,
Annotated Code of Maryland.
(c)
"Board" has the meaning stated in Business Regulation Article, §7-101, Annotated
Code of Maryland.
(d) "Breach of
the security of a system" has the meaning stated in Commercial Law Article,
§14-3504, Annotated
Code of Maryland.
(e) "Consumer"
means an individual who resides in Maryland.
(f) "Employee" means an employee of a
licensee who is not an independent contractor or an authorized
delegate.
(g) "Independent
contractor" has the meaning stated in Financial Institutions Article, §11-601,
Annotated Code of Maryland.
(h)
"License" means any of the following:
(a) A
license issued by the Board under Business Regulation Article, Title 7,
Annotated Code of Maryland, to do business as a collection agency;
(b) A license issued by the Commissioner
under Commercial Law Article, Title 14, Subtitle 19, Annotated Code of
Maryland, to engage in the business of a credit services business;
(c) A license issued by the Commissioner
under Financial Institutions Article, Title 11, Subtitle 2, Annotated Code of
Maryland, to make loans under the Maryland Consumer Loan Law;
(d) A license issued by the Commissioner
under Financial Institutions Article, Title 11, Subtitle 3, Annotated Code of
Maryland, to make installment loans;
(e) A license issued by the Commissioner
under Financial Institutions Article, Title 11, Subtitle 4, Annotated Code of
Maryland, to engage in business as a sales finance company;
(f) A license issued by the Commissioner
under Financial Institutions Article, Title 11, Subtitle 5, Annotated Code of
Maryland, to engage in business as a mortgage lender;
(g) A license issued by the Commissioner
under Financial Institutions Article, Title 12, Subtitle 1, Annotated Code of
Maryland, to provide check cashing services;
(h) A license issued by the Commissioner
under Financial Institutions Article, Title 12, Subtitle 4, Annotated Code of
Maryland, to engage in the business of money transmission; or
(i) A license issued by the Commissioner
under Financial Institutions Article, Title 12, Subtitle 9, Annotated Code of
Maryland, to provide debt management services.
(i) "Licensee" means a person issued a
license or licenses for the purpose of conducting the business for which the
license or licenses are issued.
(j)
"Personal information" has the meaning stated in Commercial Law Article, §14-3501, Annotated
Code of Maryland.
(k) "Records" has
the meaning stated in Commercial Law Article, §14-3501, Annotated
Code of Maryland.
(l) "Security
program" means a written program created by or on behalf of a licensee for the
purpose of allowing the licensee's employees to safely and securely access the
licensee's information technology systems, other systems, and data from a
location authorized by this section.
C. Certain Remote Work Permitted. An employee of a licensee may work remotely and is not considered conducting business for which a license is required at a location other than the address that appears on the license or licenses of that licensee if the conditions set forth in this regulation are met.
D. Locations. The location from which the employee is working:
(1) May not be owned or leased by the
licensee or an affiliate of a licensee, or for the benefit of the licensee or
an affiliate of the licensee;
(2)
May not be a location that offers temporary office space unless the employee is
using the location on a temporary basis due to the unavailability of the
employee's regular work location;
(3) May not be held out to the public by use
of signage, advertisement, or other means, as a location at which the licensee
conducts business for which a license is required;
(4) May not provide work space, telephone
service, or internet service maintained in the name of the licensee or an
affiliate and that is not intended primarily for the purpose of conducting
business for which a license is required;
(5) May not be a location where the employee
will meet in person with nonemployees in connection with the business for which
a license is required;
(6) May not
be a location that will receive or dispense cash, negotiable instruments, or
other monetary value in connection with the business for which a license is
required, other than compensation paid to the employee by the
licensee;
(7) May not be used for
the receipt of mail relating to business for which a license is
required;
(8) May not be used for
storage of books or records, in any form, relating to business for which a
license is required unless:
(a) The records
were produced or used in the normal course of employment by the employee
working at that location and the licensee maintains and administers procedures
for the employee to promptly and securely transmit those records to its
location for the storage of books and records; or
(b) The licensee is permitted by applicable
law or regulation to store the books or records of the licensee at that
location;
(9) Shall
provide a workspace that is secure, provide for appropriate protection of
personal information as required under applicable law, and have the appropriate
technological security measures and physical safeguards in place to protect
personal information;
(10) Shall be
a location used only by a single employee unless:
(a) Other employees using the location
maintain a common household with each other; or
(b) The location is used for a period not
exceeding 2 weeks every calendar quarter to facilitate business or nonbusiness
travel;
(11) May not be
used to conduct a specific act that applicable law or regulation requires be
conducted only at specified locations; and
(12) Shall be authorized by the licensee as a
location from which the employee may work.
E. Security Standards.
(1) A licensee that allows any employee to
work at a location authorized by this section shall develop, implement, and
maintain a security program that is consistent with all applicable laws and
regulations, meets or exceed standards of the industry in which the licensee
conducts its business, addresses known vulnerabilities, and is commensurate
with the licensee's size and complexity.
(2) The licensee's security program may be
part of the licensee's comprehensive data and cyber security program.
(3) A licensee's security program shall
consider the following objectives:
(a)
Allowing employees working at locations authorized by this section to access
the licensee's information technology system, other systems, and data needed to
perform the employee's job functions in a safe and secure manner;
(b) Ensuring the security and confidentiality
of the licensee's data containing personal information and other sensitive
information;
(c) Protecting the
licensee's information technology systems, other systems, and data against
security breaches and unauthorized access, including unauthorized access by
employees;
(d) Identifying the
types of devices an employee may use to access the licensee's information
technology systems, other systems, and data, and protecting those devices from
security breaches and unauthorized access; and
(e) Providing training and support of the
licensee's employees necessary to ensure compliance with the security program
and establishing appropriate sanctions for failures to comply.
(4) A licensee shall have an
established governance process in place to control and monitor the security
program which shall include, as appropriate for the size and complexity of the
licensee and its information technology systems, other systems, and data:
(a) The approval of the security program by
the board of directors, ownership, or most senior level of management;
and
(b) A management structure that
encompasses:
(i) Assigning responsibilities
and authorities for ensuring adherence to the security program;
(ii) Documenting accountability for functions
to ensure compliance with the security program; and
(iii) Reporting to the board of directors,
ownership, or most senior level of management, no less than annually, regarding
the effectiveness of the security program.
(5) In connection with the security program,
a licensee shall complete a comprehensive remote access and data security risk
assessment, including:
(a) Identification and
assessment of risks and vulnerabilities created by allowing employees to work
at locations authorized by this section and to access the licensee's
information technology systems, other systems, and data from such locations;
and
(b) Identification of the
devices, data, information technology system, and other systems that need to be
protected.
(6) A
licensee shall perform periodic testing and monitoring of the security program
as appropriate for the size and complexity of the licensee's information
technology and other systems, including:
(a)
Evaluating the effectiveness of the security program;
(b) Evaluating employee compliance with the
security program;
(c) Taking
corrective action to address any significant deficiencies identified during the
course of licensee's evaluation of the effectiveness of the security
program;
(d) Monitoring of external
sources for new vulnerabilities;
(e) Updating, as appropriate, its remote
access and data security risk assessment; and
(f) Developing and implementing additional
control frame works for any new or changed threats or risks identified by the
licensee.
(7) A licensee
shall review the security program at least annually and make changes necessary
to achieve the objectives of the security program.
(8) A licensee that adequately demonstrates
compliance with standards issued by the National Institute of Standards and
Technology, United States Department of Commerce, relating to remote workers
and remote access, as such may be revised from time to time, shall be deemed to
be in compliance with this section.
F. Supervision of Employees.
(1) A licensee shall at all times reasonably
and adequately supervise the work-related activities of each employee working
at a location authorized by this section.
(2) If the Commissioner determines that the
licensee does not provide reasonable and adequate supervision of the employee,
after written notice from the Commissioner, and within 5 business days of
receiving such notice, the licensee will terminate the employee's eligibility
to work at a location provided for under this regulation.
(3) A licensee shall maintain and update, as
appropriate, written records with respect to an employee working from locations
provided for in this section, including the initial authorization to work from
any such location, any updated authorization, and information regarding the
location and any due diligence the license has undertaken to ensure compliance
with this regulation.
(4) The
licensee shall retain the records required by §F(3) of this regulation for
the greater of 2 years from the date the employee ceases using such location in
connection with the business for which a license is required or any retention
period required by applicable law or regulation.
G. Identification of Licensee. The employee may not, in connection with the business for which a license is required, conceal, misrepresent or otherwise mislead any person with respect to the identity of the licensee.
H. Principal Executive Office. The licensee shall, at a minimum, maintain a principal executive office.
I. Security Breach. If a breach of the security of a system occurs at a location provided for in this regulation, the following steps shall be taken:
(1) Upon learning of the breach of the
security of a system, the employee shall immediately notify the
licensee;
(2) Upon learning of the
breach of the security of a system, the licensee shall within 72 hours notify
the Commissioner and make any other notifications that may be required under
applicable law or regulation;
(3)
The licensee shall investigate the breach of the security of a system and
document its findings, including the remedial steps, if any, that have been
undertaken by the licensee to remediate any harm to consumers and to update
policies, procedures, and processes as a result of the findings; and
(4) If requested by the Commissioner, the
licensee shall provide a copy of the documentation of the investigation
required in this section.
Disclaimer: These regulations may not be the most recent version. Maryland may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
