(50 ILCS 355/5-35)
    Sec. 5-35. Third party registration.
    (a) Beginning on January 1, 2021, no person shall engage in business as a third party pursuant to this Act in this State without first having registered with the Department. Application for registration or renewal of registration shall be made to the Department, by electronic means, in a form and at the time prescribed by the Department. Each applicant for registration or renewal of registration under this Section shall furnish to the Department, in an electronic format established by the Department, the following information:
        (1) the name and address of the applicant;
        (2) the address of the location at which the
    
applicant proposes to engage in business as a third party in this State;
        (3) valid and updated contact information;
        (4) attestation of good standing to do business in
    
Illinois;
        (5) a copy of each contract it has entered into with
    
a municipality or county; if an applicant has a contract with a municipality or county prior to the effective date of this Act, a copy of all existing contracts must be provided;
        (6) an annual certification of process letter that:
            (A) is signed by an attorney or certified public
        
accountant licensed and authorized to practice in the State of Illinois;
            (B) contains findings that, after due diligence,
        
the author is of the opinion that:
                (i) the third party's confidentiality
            
standards for storing encrypted data at rest, using a cryptographic algorithm, conform to Security Level 1 of the Federal Information Processing Standard (FIPS) Publication 140-2, or conform to similar security requirements contained in any successor publication;
                (ii) the third party uses multi-factor
            
authentication;
                (iii) the third party uses HTTPS with at
            
least TLS 1.2 or its successor to protect the data files while in transit between a browser and server;
                (iv) the third party adheres to best
            
practices as recommended by the Open Web Application Security Project (OWASP);
                (v) the third party has a firewall which
            
protects against unauthorized use of the data; and
                (vi) the third party shall maintain a
            
physical location in this State at all times; if, at any time, the third party fails to have a physical location in this State, the third party's registration shall be revoked; and
        (7) such other additional information as the
    
Department may require by rule.
    The annual registration fee payable to the Department for each third party shall be $15,000. The fee shall be deposited into the Tax Compliance and Administration Fund and shall be used for the cost of administering the certified audit pilot project under Article 10.
    Each applicant shall pay the fee to the Department at the time of submitting its application or renewal to the Department. The Department may require an applicant under this Section to electronically file and pay the fee.
    (b) The following are ineligible to register as a third party under this Act:
        (1) a person who has been convicted of a felony
    
related to financial crimes under any federal or State law, if the Department, after investigation and a hearing if requested by the applicant, determines that the person has not been sufficiently rehabilitated to warrant the public trust, including an individual or any employee, officer, manager, member, partner, or director of an entity that has been convicted as provided in this paragraph (1);
        (2) a person, if any employee, contractual employee,
    
officer, manager, or director thereof, or any person or persons owning in the aggregate more than 5% thereof, is employed by or appointed or elected to the corporate authorities of any municipality or county in this State;
        (3) a person, if any employee, contractual employee,
    
officer, manager, or director thereof, or any person or persons owning in the aggregate more than 5% thereof, is not or would not be eligible to receive a certificate of registration under this Act or a license under the Illinois Public Accounting Act for any reason;
        (4) a person who is a family member of any person who
    
is employed by or appointed or elected to the corporate authorities of any municipality or county in the State;
        (5) a person who is a qualified practitioner, as
    
defined by Section 10-15 of this Act;
        (6) a third party owned, in whole or in part, by any
    
entity that competes directly or indirectly with any taxpayer whose financial information they are seeking or receiving; and
        (7) a third party owning in whole or in part,
    
directly or indirectly, any entity that competes, directly or indirectly, with any taxpayer whose financial information they are seeking or receiving.
    (c) The Department shall begin accepting applications no later than January 1, 2021. Upon receipt of an application and registration fee in proper form from a person who is eligible to register as a third party under this Act, the Department shall issue, within 60 days after receipt of an application, a certificate of registration to such applicant in such form as prescribed by the Department. That certificate of registration shall permit the applicant to whom it is issued to engage in business as a third party under this Act. All certificates of registration issued by the Department under this Section shall be valid for a period not to exceed one year after issuance unless sooner revoked or suspended as provided in this Act. No certificate of registration issued under this Section is transferable or assignable. A person who obtains a certificate of registration as a third party who ceases to do business as specified in the certificate of registration, or who never commenced business, or whose certificate of registration is suspended or revoked, shall immediately surrender the certificate of registration to the Department.
    (d) Any person aggrieved by any decision of the Department under this Section may, within 60 days after notice of the decision, protest and request a hearing. Upon receiving a request for a hearing, the Department shall give written notice to the person requesting the hearing of the time and place fixed for the hearing and shall hold a hearing and then issue its final administrative decision in the matter to that person within 60 days after the date of the hearing or at a later date upon agreement of all of the parties. In the absence of a protest and request for a hearing within 60 days, the Department's decision shall become final without any further determination being made or notice given.
    (e) All final decisions by the Department under this Section are subject to judicial review under the provisions of the Administrative Review Law.
(Source: P.A. 101-628, eff. 6-1-20; 102-40, eff. 6-25-21.)