§ 1033.441. Policies and procedures for third party record retention.
272 words·~1 min read·
/us/cfr/t12/s§ 1033.441·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
(a)General requirement. A third party that is a covered person or service provider, as defined in 12 U.S.C. 5481(6) and (26), must establish and maintain written policies and procedures that are reasonably designed to ensure retention of records that are evidence of compliance with the requirements of subpart D of this part.
(b)Retention period. Records required under paragraph
(a)of this section must be retained for a reasonable period of time, not less than three years after a third party obtains the consumer's most recent authorization under § 1033.401(a).
(c)Flexibility. A third party covered under paragraph
(a)of this section has flexibility to determine its policies and procedures in light of the size, nature, and complexity of its activities.
(d)Periodic review. A third party covered under paragraph
(a)of this section must periodically review its policies and procedures and update them as appropriate to ensure their continued effectiveness to evidence compliance with the requirements of subpart D of this part.
(e)Certain records retained pursuant to policies and procedures. Records retained pursuant to policies and procedures required under this section must include, without limitation:
(1)A copy of the authorization disclosure that is signed by the consumer electronically or in writing and reflects the date of the consumer's signature and a record of actions taken by the consumer, including actions taken through a data provider or another third party, to revoke the third party's authorization; and
(2)With respect to a data aggregator covered under paragraph
(a)of this section, a copy of any data aggregator certification statement that was provided to the consumer pursuant to § 1033.431(c)(2).
Connectionstraces to 1
Traces to 1 document
U.S. Code
Citation graph
cites case law
§ 1033.441
Policies and procedures for third party record retention.
Cites 1Cited by 0 across 0 sources