In this chapter, the following terms have the meanings indicated. Terms Defined. “Assessment” means the annual assessment authorized under Financial Institutions Article, §2-120, Annotated Code of Maryland. “Commissioner” has the meaning stated in Financial Institutions Article, §1-101(g), Annotated Code of Maryland. “Licensed location” means any location listed by the licensee in NMLS. “Licensed person” has the meaning stated in Financial Institutions Article, §2-120, Annotated Code of Maryland. “Mobile unit” has the meaning stated in Financial Institutions Article, §12-101, Annotated Code of Maryland. “NMLS” has the meaning stated in Financial Institutions Article, §1-101, Annotated Code of Maryland. “Regulated person” has the meaning stated in Financial Institutions Article, §2-120, Annotated Code of Maryland. Definition. In this regulation the following term has the meaning indicated. Term Defined. “Loan” means: A loan as defined in Financial Institutions Article, §11-201, Annotated Code of Maryland; An installment loan as defined in Financial Institutions Article, §11-301, Annotated Code of Maryland; An installment sale agreement as defined in Financial Institutions Article, §11-401, Annotated Code of Maryland; A retail credit account transaction as defined in Commercial Law Article, §12-501, Annotated Code of Maryland; and A transaction that deals with home improvement, as defined in Business Regulation Article, §8-101, Annotated Code of Maryland, made between other parties, if collateral security is required by and given to the contractor as a condition to the transaction. Each regulated person required to hold a license issued under Financial Institutions Article, Subtitles 2, 3, and 4, Annotated Code of Maryland, shall maintain the following records: Loan Register. All loans shall be listed in a register in numerical order showing, in addition to the loan number, the date of loan, name of principal borrower, and amount of loan. Individual Ledger Record. A separate ledger record shall be maintained for each borrower, showing the loan number, borrower's name and address, names of endorsers, comakers, guarantors or sureties, the amount of loan, the schedule of payments, and the type of security. In addition, the record shall show the date and amount of all payments of interest and principal as well as the principal balance due. File of Original Papers. For each borrower or loan account, a separate file shall be maintained containing all papers relating to the borrower or the loan, except that promissory notes and security instruments may be kept in a separate legal paper file bearing the same account number. If notes have been hypothecated, the file shall reveal where and to whom these notes are hypothecated. Receipts and Disbursement Record. All receipts from or for the account of borrowers and all disbursements to or for the account of borrowers shall be clearly recorded in a manner that makes the transactions readily identifiable. Index of Obligors. An alphabetical index of all borrowers, endorsers, guarantors, or comakers shall be maintained, showing the related loan numbers. Litigation and Repossession Records. The records of the licensee (individual ledger record or similar record) shall show all essential details with respect to litigation or repossession, or both. This detail with respect to litigation shall include the amount and date of judgments and any costs charged to the borrowers. With respect to repossession, the record shall include the date, amount then due, type of security repossessed, and the amount realized from sale of the security. Acceptance of Equivalent Records. Records and accounting systems maintained in whole or in part by mechanical or electronic data processing methods may be used instead of the books and records required by this regulation if they contain equivalent information. Credit Life Claim Register. Each licensee shall maintain a register of death claims showing the following minimum information: Loan or account number; Name of insured borrower; Date of death of insured; Date of official notification to licensee; Date claim submitted to insurer; Date settlement received from insurer; Amount of settlement received by principal beneficiary; Amount of settlement, if any, received by second beneficiary; Amount of refund of unearned accident and health premium, if any. Accident and Health Claim Register. Each license shall maintain a register of claims involving accident and health insurance showing the following minimum information: Loan or account number; Name of insured borrower; Waiting period, if any, in order to qualify for payment; Date disability began; Date disability ended; Date of doctor's certificate certifying disability and date certificate received by licensee; Date claim submitted to insurer by licensee; Dates and amount of payments received from insurer by licensee. Purchased Loan Account Register. Within 30 days after the purchase of loan accounts from another licensee, the purchasing licensee shall maintain a list of these purchased accounts. The licensee shall also keep a list of “double loan” accounts resulting from the purchase, including the borrower's name, address, account number, and the amount of loan outstanding. The licensee shall maintain this register in compliance with Financial Institutions Article, §11-213, Annotated Code of Maryland. Advertising. Each consumer loan licensee shall comply with all provisions of Regulation Z, promulgated under the Federal Consumer Credit Protection Act, Truth-in-Lending, that relate to the advertising of credit terms. A consumer loan licensee may not use blind advertisements, such as giving only telephone numbers or box number addresses. A licensee may not advertise that any loan business will be conducted at any place other than the licensed address. A consumer loan licensee may not advertise or otherwise communicate to any borrower that payments will be waived for any contingency without also advising the borrower that daily interest charges will continue during the waiver period, if this is the fact. Filing of Suits and Legal Process. In connection with any debt arising out of a consumer loan, a licensee may not file suit against a debtor in a foreign jurisdiction when the debtor is domiciled and regularly employed in the State. This prohibition extends to any proceedings in attachment against the debtor. Merchant Referral Loans. Loans may not be contracted for by a licensee who knows that the borrower is purchasing the merchandise under duress or misrepresentation connected with the financing of the merchandise. A licensee may not compel the borrower to use the proceeds of the loan for the prospective purchase. A check will not be made payable to the merchant, or endorsed payable to the merchant at the direction of the licensee. A licensee may not pay to or accept from a merchant anything of value for making a loan to a borrower referred to the licensee by a merchant. Except as otherwise provided in §§C, D, and E of this regulation, all contested case hearings before the Commissioner are governed by COMAR 09.01.02. For a hearing under Financial Institutions Article, §11-415, Annotated Code of Maryland, the Commissioner shall send the hearing notice described in COMAR 09.01.02.07B: At least 10 days before the hearing; or If the parties have agreed to a date for which 10 days notice cannot be given, at the earliest time possible. For a hearing under Financial Institutions Article, §11-518, Annotated Code of Maryland, the Commissioner shall send the hearing notice described in COMAR 09.01.02.07B: At least 30 days before the hearing; or If the parties have agreed to a date for which 30 days notice cannot be given, at the earliest time possible. For a hearing under Financial Institutions Article, §12-428, Annotated Code of Maryland, the Commissioner shall send the hearing notice described in COMAR 09.01.02.07B: At least 15 days before the hearing; or If the parties have agreed to a date for which 15 days notice cannot be given, at the earliest time possible. All contested case hearings delegated to the Office of Administrative Hearings are governed by COMAR 09.01.03. Scope. This regulation governs the conduct of any employee operating from a location other than that which appears on the employer’s license or licenses. Notwithstanding §A(1) of this regulation, this regulation does not apply to the conduct of an employee if: The employer is licensed under Financial Institutions Article, Title 11, Subtitle 5, Annotated Code of Maryland; The employee is licensed under Financial Institutions Article, Title 11, Subtitle 6, Annotated Code of Maryland; and The employee is taking a loan application or offering or negotiating the terms of a loan in compliance with COMAR 09.03.09.07. Nothing contained in this regulation shall be deemed to prohibit an employee of a licensee from conducting any business for which a license is required at a location other than the locations set forth on the employer’s license or licenses if applicable law or regulation does not limit that conduct to the location shown on the license. A licensee may not use this regulation to evade the requirements of any applicable law or regulation. Definitions. Terms Defined. In this regulation, the following terms have the meanings indicated. “Affiliate” means a person that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with another person. “Authorized delegate” has the meaning stated in Financial Institutions Article, §12-401, Annotated Code of Maryland. “Board” has the meaning stated in Business Regulation Article, §7-101, Annotated Code of Maryland. “Breach of the security of a system” has the meaning stated in Commercial Law Article, §14-3504, Annotated Code of Maryland. “Consumer” means an individual who resides in Maryland. “Employee” means an employee of a licensee who is not an independent contractor or an authorized delegate. “Independent contractor” has the meaning stated in Financial Institutions Article, §11-601, Annotated Code of Maryland. “License” means any of the following: A license issued by the Board under Business Regulation Article, Title 7, Annotated Code of Maryland, to do business as a collection agency; A license issued by the Commissioner under Commercial Law Article, Title 14, Subtitle 19, Annotated Code of Maryland, to engage in the business of a credit services business; A license issued by the Commissioner under Financial Institutions Article, Title 11, Subtitle 2, Annotated Code of Maryland, to make loans under the Maryland Consumer Loan Law; A license issued by the Commissioner under Financial Institutions Article, Title 11, Subtitle 3, Annotated Code of Maryland, to make installment loans; A license issued by the Commissioner under Financial Institutions Article, Title 11, Subtitle 4, Annotated Code of Maryland, to engage in business as a sales finance company; A license issued by the Commissioner under Financial Institutions Article, Title 11, Subtitle 5, Annotated Code of Maryland, to engage in business as a mortgage lender; A license issued by the Commissioner under Financial Institutions Article, Title 12, Subtitle 1, Annotated Code of Maryland, to provide check cashing services; A license issued by the Commissioner under Financial Institutions Article, Title 12, Subtitle 4, Annotated Code of Maryland, to engage in the business of money transmission; or A license issued by the Commissioner under Financial Institutions Article, Title 12, Subtitle 9, Annotated Code of Maryland, to provide debt management services. “Licensee” means a person issued a license or licenses for the purpose of conducting the business for which the license or licenses are issued. “Personal information” has the meaning stated in Commercial Law Article, §14-3501, Annotated Code of Maryland. “Records” has the meaning stated in Commercial Law Article, §14-3501, Annotated Code of Maryland. “Security program” means a written program created by or on behalf of a licensee for the purpose of allowing the licensee’s employees to safely and securely access the licensee’s information technology systems, other systems, and data from a location authorized by this section. Certain Remote Work Permitted. An employee of a licensee may work remotely and is not considered conducting business for which a license is required at a location other than the address that appears on the license or licenses of that licensee if the conditions set forth in this regulation are met. Locations. The location from which the employee is working: May not be owned or leased by the licensee or an affiliate of a licensee, or for the benefit of the licensee or an affiliate of the licensee; May not be a location that offers temporary office space unless the employee is using the location on a temporary basis due to the unavailability of the employee’s regular work location; May not be held out to the public by use of signage, advertisement, or other means, as a location at which the licensee conducts business for which a license is required; May not provide work space, telephone service, or internet service maintained in the name of the licensee or an affiliate and that is not intended primarily for the purpose of conducting business for which a license is required; May not be a location where the employee will meet in person with nonemployees in connection with the business for which a license is required; May not be a location that will receive or dispense cash, negotiable instruments, or other monetary value in connection with the business for which a license is required, other than compensation paid to the employee by the licensee; May not be used for the receipt of mail relating to business for which a license is required; May not be used for storage of books or records, in any form, relating to business for which a license is required unless: The records were produced or used in the normal course of employment by the employee working at that location and the licensee maintains and administers procedures for the employee to promptly and securely transmit those records to its location for the storage of books and records; or The licensee is permitted by applicable law or regulation to store the books or records of the licensee at that location; Shall provide a workspace that is secure, provide for appropriate protection of personal information as required under applicable law, and have the appropriate technological security measures and physical safeguards in place to protect personal information; Shall be a location used only by a single employee unless: Other employees using the location maintain a common household with each other; or The location is used for a period not exceeding 2 weeks every calendar quarter to facilitate business or nonbusiness travel; May not be used to conduct a specific act that applicable law or regulation requires be conducted only at specified locations; and Shall be authorized by the licensee as a location from which the employee may work. Security Standards. A licensee that allows any employee to work at a location authorized by this section shall develop, implement, and maintain a security program that is consistent with all applicable laws and regulations, meets or exceed standards of the industry in which the licensee conducts its business, addresses known vulnerabilities, and is commensurate with the licensee’s size and complexity. The licensee’s security program may be part of the licensee’s comprehensive data and cyber security program. A licensee’s security program shall consider the following objectives: Allowing employees working at locations authorized by this section to access the licensee’s information technology system, other systems, and data needed to perform the employee’s job functions in a safe and secure manner; Ensuring the security and confidentiality of the licensee’s data containing personal information and other sensitive information; Protecting the licensee’s information technology systems, other systems, and data against security breaches and unauthorized access, including unauthorized access by employees; Identifying the types of devices an employee may use to access the licensee’s information technology systems, other systems, and data, and protecting those devices from security breaches and unauthorized access; and Providing training and support of the licensee’s employees necessary to ensure compliance with the security program and establishing appropriate sanctions for failures to comply. A licensee shall have an established governance process in place to control and monitor the security program which shall include, as appropriate for the size and complexity of the licensee and its information technology systems, other systems, and data: The approval of the security program by the board of directors, ownership, or most senior level of management; and A management structure that encompasses: Assigning responsibilities and authorities for ensuring adherence to the security program; Documenting accountability for functions to ensure compliance with the security program; and Reporting to the board of directors, ownership, or most senior level of management, no less than annually, regarding the effectiveness of the security program. In connection with the security program, a licensee shall complete a comprehensive remote access and data security risk assessment, including: Identification and assessment of risks and vulnerabilities created by allowing employees to work at locations authorized by this section and to access the licensee’s information technology systems, other systems, and data from such locations; and Identification of the devices, data, information technology system, and other systems that need to be protected. A licensee shall perform periodic testing and monitoring of the security program as appropriate for the size and complexity of the licensee’s information technology and other systems, including: Evaluating the effectiveness of the security program; Evaluating employee compliance with the security program; Taking corrective action to address any significant deficiencies identified during the course of licensee’s evaluation of the effectiveness of the security program; Monitoring of external sources for new vulnerabilities; Updating, as appropriate, its remote access and data security risk assessment; and Developing and implementing additional control frame works for any new or changed threats or risks identified by the licensee. A licensee shall review the security program at least annually and make changes necessary to achieve the objectives of the security program. A licensee that adequately demonstrates compliance with standards issued by the National Institute of Standards and Technology, United States Department of Commerce, relating to remote workers and remote access, as such may be revised from time to time, shall be deemed to be in compliance with this section. Supervision of Employees. A licensee shall at all times reasonably and adequately supervise the work-related activities of each employee working at a location authorized by this section. If the Commissioner determines that the licensee does not provide reasonable and adequate supervision of the employee, after written notice from the Commissioner, and within 5 business days of receiving such notice, the licensee will terminate the employee’s eligibility to work at a location provided for under this regulation. A licensee shall maintain and update, as appropriate, written records with respect to an employee working from locations provided for in this section, including the initial authorization to work from any such location, any updated authorization, and information regarding the location and any due diligence the license has undertaken to ensure compliance with this regulation. The licensee shall retain the records required by §F(3) of this regulation for the greater of 2 years from the date the employee ceases using such location in connection with the business for which a license is required or any retention period required by applicable law or regulation. Identification of Licensee. The employee may not, in connection with the business for which a license is required, conceal, misrepresent or otherwise mislead any person with respect to the identity of the licensee. Principal Executive Office. The licensee shall, at a minimum, maintain a principal executive office. Security Breach. If a breach of the security of a system occurs at a location provided for in this regulation, the following steps shall be taken: Upon learning of the breach of the security of a system, the employee shall immediately notify the licensee; Upon learning of the breach of the security of a system, the licensee shall within 72 hours notify the Commissioner and make any other notifications that may be required under applicable law or regulation; The licensee shall investigate the breach of the security of a system and document its findings, including the remedial steps, if any, that have been undertaken by the licensee to remediate any harm to consumers and to update policies, procedures, and processes as a result of the findings; and If requested by the Commissioner, the licensee shall provide a copy of the documentation of the investigation required in this section. Approval to Add, Delete, or Change a Licensed Location. A regulated person who wishes to add, delete, or change the address of a licensed location shall provide the Commissioner notice of the addition, deletion, or change of address through NMLS. Any addition, deletion, or change of address of a licensed location will be deemed approved by the Commissioner no less than 30 days after it is provided through NMLS unless the Commissioner has either requested additional information or denied the addition, deletion, or change of address. A regulated person may not delete or change the address of its principal executive office as designated within the person’s NMLS Form MU1 except by amending the address within the person’s NMLS Form MU1, or such form as NMLS may prescribe to replace Form MU1 for this purpose, in the manner prescribed by NMLS. The licensee has 15 days after the Commissioner requests any additional information to provide that information or the regulated person’s application to add, delete, or change an address may be deemed withdrawn. Approval to Add, Delete, or Change a Trade Name. A regulated person who wishes to add, delete, or change a trade name shall provide the Commissioner with notice of the addition, deletion, or change through NMLS and comply with the provisions of Financial Institutions Article, §2-121, Annotated Code of Maryland. No later than 30 days after the information is provided through NMLS, the Commissioner shall respond to the regulated person with an approval, denial, or request for additional information. The licensee has 15 days after the Commissioner requests any additional information to provide that information or the regulated person’s application to add, delete or change a trade name may be deemed withdrawn. Timing of Assessment. The Commissioner shall notify licensed persons of an assessment no earlier than May 1 or later than June 1 of each year regardless of whether any sum is due. The assessment shall be based on information available to the Commissioner at the time of the assessment. Information Included in the Assessment Notice. The Commissioner shall include the following information in each notice of Assessment: The amount of the assessment, if any, due that year; The means the Commissioner used in calculating the licensed person’s assessment; and How the licensee can dispute the amount of assessment if they believe it was calculated incorrectly. Impact of License Surrender Prior to Assessment. A licensee incurs an obligation to pay an assessment on January 1 of the year in which the assessment is imposed or on the date in which the licensee becomes licensed, if not licensed on January 1. Surrender of a license does not relieve a licensee of their obligation to pay an assessment. Information on Assessment. In conjunction with the assessment, the Commissioner shall provide licensees with information regarding the manner in which the assessment was calculated. Definition. In this regulation, the following term has the meaning indicated. Term Defined. “Licensee” has the meaning stated in Financial Institutions Article, §12-101, Annotated Code of Maryland. Any licensee listing a mobile unit as a licensed location shall provide information identifying the geographic area the mobile unit will serve. The Commissioner shall deem a licensee compliant with §B of this regulation if the person makes a reasonable and good faith effort to identify the Maryland counties or cities the mobile unit will serve. Definitions. In this regulation, the following terms have the meanings indicated. Terms Defined. “Licensee” has the meaning stated in Financial Institutions Article, §12-401, Annotated Code of Maryland. “Self-service financial kiosk” has the meaning stated in Financial Institutions Article, §12-401, Annotated Code of Maryland . Any licensee listing a self-service financial kiosk as a licensed location shall provide information identifying the geographic area the self-service financial kiosk will serve. The Commissioner shall deem a licensee compliant with §B of this regulation if the person makes a reasonable and good faith effort to identify the Maryland counties or cities the self-service financial kiosk will serve. Upon written request by any person the Commissioner shall provide the list of Licensed Locations that any Licensed Person has provided. Business Regulation Article §2-105; Financial Institutions Article, §§2-105.1, 11-203, 11-503, 12-104, and 12-403; Annotated Code of Maryland Effective dates: Regulations .01—.11 effective July 1, 1970 Regulation .12 effective May 19, 1971 Regulations .13—.15 effective July 1, 1970 Regulation .16 effective December 22, 1971 Regulation .17 effective November 16, 1970 Regulation .18 effective May 19, 1971 Regulation .19 effective December 25, 1974 (1:6 Md. R. 298) Chapter revised effective August 25, 1978 (5:17 Md. R. 1327) Regulations .01—.03 repealed effective June 16, 1997 (24:12 Md. R. 863) Chapter recodified from COMAR 09.04.01 to COMAR 09.03.02, April, 1998 Regulation .01 adopted effective August 18, 2003 (30:16 Md. R. 1704) Regulation .01 amended effective February 3, 2025 (52:2 Md. R. 67) Regulation .04 amended effective February 3, 2025 (52:2 Md. R. 67) Regulation .06 adopted effective August 18, 2003 (30:16 Md. R. 1704) Regulation .07 adopted effective August 18, 2003 (30:16 Md. R. 1704) Regulation .08 adopted as an emergency provision effective January 5, 2021 (48:03 Md. R. 92); adopted permanently effective April 19, 2021 (48:8 Md. R. 308) Regulation .09 adopted effective February 3, 2025 (52:2 Md. R. 67) Regulation .10 adopted effective February 3, 2025 (52:2 Md. R. 67) Regulation .11 adopted effective February 3, 2025 (52:2 Md. R. 67) Regulation .12 adopted effective February 3, 2025 (52:2 Md. R. 67) Regulation .13 adopted effective February 3, 2025 (52:2 Md. R. 67)