DEPARTMENT OF STATE Secretary of State NOTARY PROGRAM RULES 8 CCR 1505-11 [Editor’s Notes follow the text of the rules at the end of this CCR Document.] _________________________________________________________________________ Rule 1. Definitions 1.1 “Approved course of instruction” means a live classroom or webcast course approved by the Secretary of State.

1.2 “Approved vendor” means a vendor approved by the Secretary of State who provides an approved course of instruction to notaries and prospective notaries for a fee. 1.3 “Course provider” means an entity other than an individual that uses the Secretary of State’s curriculum, in addition to any entity-specific practices, to provide notary training to its employees or members free of charge.

1.4 “DAN” means the unique document authentication number issued by the Secretary of State and required by section 24-21-520(3), C.R.S., for electronic notarizations. 1.5 “Electronic notarization” means a notary’s notarization of electronic records that includes the notary’s and the document signer’s electronic signatures. 1.6 “Electronic notarization software” means any software, coding, disk, card, certificate, or program that creates and affixes the notary’s electronic signature. 1.7 “Legal proceeding or disciplinary action based on the applicant’s or notary public’s fraud, dishonesty, or deceit” in section 24-21-523(1)(d), C.R.S., means any civil or criminal matter conducted either judicially or administratively concerning activities involving fraud, deceit, or the other violations listed in Rule 1.8.

1.8 “Misdemeanor involving dishonesty” in section 24-21-523(1)(c), C.R.S., means a violation of, or a conspiracy to violate, a civil or criminal law involving fraud, dishonesty, bribery, perjury, larceny, theft, robbery, extortion, forgery, counterfeiting, embezzlement, misappropriation of property, or any other offense adversely affecting a person’s fitness to serve as a notary public. 1.9 “New applicant” means a person seeking a commission as a Colorado notary for the first time or a formerly commissioned notary in Colorado whose commission has been expired for more than 30 days.

1 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State Rule 2. Notary Commissions 2.1 Filing and training requirements 2.1.1 An applicant must put his or her legal name on applications and renewals. The first and last name must match the name on the applicant’s government-issued identification. If the last name on the identification contains more than one name, the applicant must include all of those names in the last name field on the application and not abbreviate any part.

2.1.2 All notary filings must be submitted via the Secretary of State’s online electronic filing system.

2.1.3 No more than 90 days before applying for a commission, a new applicant must successfully complete training and pass the exam administered by the Secretary of State. 2.1.4 No more than 90 days before renewing a commission, a notary must successfully complete the renewal training and pass the exam administered by the Secretary of State. 2.1.5 The Secretary of State will grant credit only for completion of courses offered by an approved vendor, an approved course provider, or the Secretary of State. 2.1.6 The Secretary of State may require a notary who has committed misconduct meriting a disciplinary proceeding to retake and successfully complete the training and exam. 2.1.7 Examination. The Secretary of State’s open book examination will test the applicant’s understanding of notary duties contained in the following: (a) Title 24, Article 21, Part 5 (Revised Uniform Law on Notarial Acts) of the Colorado Revised Statutes;

(b) Title 38, Article 30 (Titles and Interests) of the Colorado Revised Statutes; (c) Title 1, Article 40 (Initiative and Referendum) of the Colorado Revised Statutes; and (d) The Official Notary Handbook published by the Secretary of State. 2.2 Electronic notarization 2.2.1 A notary must submit a notice of intent on the approved form and receive approval from the Secretary of State before the notary may electronically notarize a document. A new applicant may file the intent at the time of application but may only electronically notarize a document after he or she has been commissioned and approved. A notary may choose to either use a DAN as the notary’s electronic signature or adopt a different electronic signature which the notary must always use in conjunction with a DAN. If the applicant intends to use a different electronic signature than a DAN, the applicant must attach an example of the electronic signature, a description of the electronic signature technology, and contact information for the technology’s supplier or vendor. A notary must notify the Secretary of State of all electronic signature changes. 2.2.2 A notary must:

(a) Use a different DAN for each electronic notarization; 2 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (b) Take reasonable measures to secure assigned DANs against another person’s access or use and must not permit such access or use; and (c) Request new DANs to replace lost or stolen DANs after notifying the Secretary in the same manner as for a journal or seal.

2.2.3 A notary must verify that the document signer has adopted an electronic signature to function as his or her signature before electronically notarizing a document. 2.2.4 Expiration of the Secretary of State’s approval to notarize electronically (a) Approval automatically expires:

(1) Upon revocation, expiration, or resignation of the notary’s commission; (2) 30 days after the notary’s name changes unless the notary previously submitted a name change.

(3) Upon conviction of a felony;

(4) Upon conviction of a misdemeanor involving dishonesty; (5) If the notary no longer has a place of employment or practice or a residential address in the state of Colorado; or (6) Upon the expiration or revocation of the technology described in the notification.

(b) If approval expires, the notary or the notary’s authorized representative must destroy all electronic notarization software and unused DANs unless: (1) The notary’s commission expired; and (2) Within 30 days of the commission’s expiration, the Secretary of State recommissions the notary and the notary reregisters his or her electronic signature.

2.3 Communication 2.3.1 A notary public must be able to communicate with, be understood by, and understand the individual for whom the notary public is performing a notarial act. 2.3.2 In accordance with section 6-1-707(1)(e)(I), C.R.S., an interpreter for deaf, hard of hearing, or deafblind individuals must hold either:

(a) A valid certification issued by the Registry of Interpreters for the Deaf, Inc. or a successor entity; or (b) A valid certification for sign language interpretation approved by the Colorado Commission for the Deaf, Hard of Hearing, and DeafBlind. 2.4 Itemization of charges 2.4.1 If a notary public charges for performing the notarial act, or charges for any additional service provided at the time of performing the notarial act, the notary public must: 3 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (a) Inform the customer, verbally or in writing, of those charges before performing the notarial act; and (b) Provide to the customer, either before performing the notarial act, or at the time of signing, or immediately thereafter, a written document that lists the specific fee or fees charged for any notarial acts performed by the notary, or a zero charge if no fee for the notarial act is being charged, as well as any other fees the notary public is charging at the same time. This listing of fees may be included in a closing statement, itemized invoice, receipt, transaction summary, or any other similar document that lists the fee charged for the notarial acts. 2.4.2 If a notary public fails to provide a document listed in Rule 2.4.1(b) that itemizes the amount of the specific charge for any notarial act, the amount charged for those notarial acts will be presumed to exceed the statutory fee limit in section 24-21-529, C.R.S. 2.4.3 Rules 2.4.1 and 2.4.2 do not apply to notarial acts performed by an employee of a title company as part of services provided by the title company in conjunction with the business of title insurance, as defined in section 10-11-102(3), C.R.S., or closing and settlement services, as defined in section 10-11-102(3.5), C.R.S., or settlement services, as defined in section 10-11-102(6.7), C.R.S.

Rule 3. Notary Trainer Requirements 3.1 Trainer Application 3.1.1 A course provider applicant must:

(a) Submit an application that includes:

(1) Procedures to establish the identity of a person attending a live course and ensure that the person is present for the required time; (2) Procedures to ensure that the person receiving the certificate of completion is the same person who completed the course; (3) Copies of any course handout materials, workbooks, and tests; and (4) A draft copy of the certificate of successful completion as required by Rule 3.3.

(b) Attend in-person or online training provided by the Secretary of State. 3.1.2 A vendor applicant must submit an application that includes: (a) Procedures to establish the identity of a person attending a live course and ensure that the person is present for the required time; (b) Procedures to ensure that the person receiving the certificate of completion is the same person who completed the course;

(c) Copies of any course handout materials, workbooks and tests; (d) A draft copy of the certificate of successful completion as required by Rule 3.3; (e) A detailed curriculum; and 4 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (f) The required application fee.

3.1.3 Deficient application. The Secretary of State will notify an applicant of any application or curriculum deficiencies. If the applicant fails to cure the deficiency within 30 days after the mailing date of the notice, the Secretary will consider the application rejected. A rejected applicant may request a hearing in accordance with the State Administrative Procedure Act (Article 4 of Title 24, C.R.S.) and 8 CCR 1505-3, Rule 3. 3.2 Vendor-specific requirements 3.2.1 The Secretary of State must approve a vendor’s proposed curriculum before a vendor may offer a notary training course. Curriculum must be based on: (a) The Colorado Revised Uniform Law on Notarial Acts including but not limited to: the physical presence requirement, duty not to notarize a blank document, duty to use a notarial certificate, disqualifying interest, application procedures, resignation requirements, duty to maintain a journal of notarial acts, revocation proceedings, liability, identification of signers, role of the notary, and official misconduct; and (b) Widely accepted best practices, including but not limited to the role of the notary and notarizations for the elderly.

3.2.2 Seal of Accreditation (a) The Secretary of State will provide a seal of accreditation to a vendor applicant within 60 days after receipt of a subsequently approved application. (b) A vendor must prominently display the seal of accreditation on all vendor materials provided to a course attendee.

(c) A seal of accreditation expires four years after issuance. To renew accreditation, a vendor must submit for reapproval a detailed curriculum; copies of any course handout materials, workbooks, and tests; and the required form and fee. (d) A vendor may not assign or transfer a seal of accreditation to another vendor or curriculum without the Secretary of State’s approval.

(e) The seal of accreditation does not imply endorsement of a vendor’s products or services or other courses.

3.2.3 Vendor’s list of attendees. An approved vendor must maintain and, upon request, provide a list of attendees and the following information to the Secretary of State: (a) The name of the instructor or instructors who taught the approved course of instruction;

(b) The date, time, and location of the approved course of instruction; (c) Whether proof of completion was issued to each attendee; (d) Each course attendee’s full name and the type of current government-issued photo identification used to establish the course attendee’s identity. 5 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State 3.3 Certificate of completion. When a student successfully completes a course, the approved vendor or course provider must issue the graduate a certificate of successful completion. 3.3.1 Approved vendors and course providers must ensure that only a person who has completed an approved course of instruction receives a certificate of successful completion. Vendors and course providers may not issue a certificate of completion to an attendee who is absent during any substantive part of the course. 3.3.2 A certificate of successful completion of an approved course of instruction expires 90 days from the date of issuance.

3.3.3 The certificate of proof of successful completion of an approved course of instruction must contain:

(a) The name of the vendor or course provider who provided the course; (b) The name of the person who completed the course;

(c) The date of completion of the course;

(d) The statement, “This certificate of proof of completion is valid for a period of 90 days from the date of issuance.”; and (e) For vendors, the seal of accreditation.

3.4 Notification of changes. Using their letterhead, approved vendors and course providers must notify the Secretary of State within 30 days of:

3.4.1 A change in physical address or email address.

3.4.2 Substantial changes to an approved curriculum and provide copies of the changes. 3.5 Duty to revise training. Approved vendors and course providers must revise approved courses of instruction as necessary to ensure that the courses accurately reflect current Colorado law. Approved vendors and course providers must submit notice of revised training and copies of the revisions to the Secretary of State for review and approval in a format that satisfies Rule 3.4, before offering the revised training to the public.

3.6 Enforcement 3.6.1 Duty to respond to the Secretary of State’s written request. Vendors and course providers must respond in writing within 20 business days of receiving a written request from the Secretary of State for any information relating to a complaint or approved course of instruction. The Secretary of State will send a written request to the address or email address listed on the most current application.

3.6.2 Onsite inspections. Approved vendors and course providers must permit the Secretary of State or the Secretary’s designee to attend any approved course of instruction without prior notice at no charge to observe, monitor, audit, and investigate. 3.6.3 Complaints. A person may file a complaint against an approved vendor or course provider with the Secretary of State alleging a violation of these rules. The person must submit a signed and dated complaint on the Secretary of State’s standard form. 6 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State 3.6.4 Grounds for termination of accreditation or approval. The Secretary of State may terminate an approved vendor’s accreditation or approval of a course provider for any of the following reasons:

(a) Violation of any provision of these rules.

(b) Misrepresentation of a notary public’s duties and authority under Colorado law. (c) Deviation from the lesson plan for an approved course of instruction. (d) Making representations that the Secretary of State endorses, recommends, or mandates use of any of the vendor’s products, goods, or services. (e) Failure to timely respond to the Secretary of State’s request for communication or otherwise cooperate with an investigation.

3.6.5 Right to respond to and cure noncompliance and right to hearing before terminating, suspending, or imposing conditions on accreditation or approval. (a) Except in cases of deliberate and willful violation or of substantial danger to the public health and safety, the Secretary of State will provide a vendor or course provider with written notice, an opportunity to respond in writing, and a reasonable opportunity to comply with all lawful requirements that may warrant agency proceedings to terminate, suspend, or impose conditions on an existing accreditation of a vendor or approval of a course provider before instituting such proceedings in accordance with the State Administrative Procedure Act (Article 4 of Title 24, C.R.S.) and 8 CCR 1505-3, Rule 3.

(b) Except in cases of deliberate and willful violation or that the public health, safety, or welfare imperatively require emergency action, the Secretary of State will not terminate, suspend, or impose conditions on an existing accreditation of a vendor or approval of a course provider until after holding a hearing in accordance with the State Administrative Procedure Act (Article 4 of Title 24, C.R.S.) and 8 CCR 1505-3, Rule 3.

(c) Termination does not bar the Secretary of State from beginning or continuing an investigation concerning the vendor or course provider. Rule 4. Notary Journal Requirements 4.1 If a current or former notary leaves the notary journal with the notary’s firm or employer, as authorized by section 24-21-519(10)(a), C.R.S., the notary must notify the Secretary of State by electronically submitting the required form within 30 days. The notary must provide the notary’s firm or employer with a copy of the required form at the time of electronic submission to the Secretary of State.

4.2 A firm or employer in possession of a notary’s journal has the same responsibility as a notary to: 4.2.1 Keep the journal secure as detailed in section 24-21-519(4), C.R.S.; 4.2.2 Provide a copy of a requested transaction to a member of the public per section 24-21- 519(5), C.R.S, but without certifying the copy or charging a notary fee; 4.2.3 Provide the journal to the Secretary of State for auditing or inspection without restriction per section 24-21-519(6), C.R.S.;

7 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State 4.2.4 Provide the journal to a certified peace officer per section 24-21-519(7), C.R.S.; and 4.2.5 Notify the Secretary of State if the journal is lost or stolen per section 24-21-519(8), C.R.S.

4.3 A firm or employer in possession of a notary’s journal may: 4.3.1 Retain the journal indefinitely; or 4.3.2 Transmit the journal to the Colorado State Archives and notify the Secretary of State per section 24-21-519(10)(a)(I) and (b), C.R.S.

Rule 5. Remote Notarization 5.1 Definitions As used in the Revised Uniform Law on Notarial Acts (Title 24, Article 21, Part 5, C.R.S.) and this Rule 5, unless otherwise stated:

5.1.1 “Personal information” means any information or data that is collected or used in order to complete the transaction subject to remote notarization or in the remote notarization itself. The term includes but is not limited to data included in the electronic record that is being remotely notarized.

5.1.2 “Provider” refers collectively to both remote notarization system providers and remote notarization storage providers.

5.1.3 “Remote notarization system provider” means a business entity that provides a remote notarization system, as defined in section 24-21-502(11.7), C.R.S., that includes storage of both the notarized electronic records and the audio-video recordings required by section 24-21-514.5(9)(a), C.R.S.

5.1.4 “Remote notarization storage provider” means a business entity that solely provides storage of notarized electronic records and the audio-video recordings required by section 24-21-514.5(9)(a), C.R.S.

5.2 Requirements for Remote Notaries 5.2.1 Application (a) A notary public must submit a notice of intent on the approved application form and receive approval from the Secretary of State before the notary can remotely notarize a document. The notary must submit proof of successful completion of remote notarization training and examination and the required fee. (b) A notary public must already be commissioned as a Colorado notary public with Active status to be approved as a remote notary.

(c) An individual may file the notice of intent when initially applying to become a Colorado notary public but may only remotely notarize a document after being commissioned and approved.

8 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (d) A remote notary public must renew every four years or until his or her regular notary public commission requires renewal, whichever date comes first. No more than 90 days before renewing his or her remote notary status, the remote notary public must successfully complete the renewal training, pass the required exam, and pay the required fee.

(e) In applying to become a remote notary public or upon renewal, the individual must select at least one approved remote notarization system provider. An applicant may select multiple approved system providers. 5.2.2 Approved Course of Instruction/Examination (a) The Secretary will provide a remote notarization training course and examination. (b) If the Secretary determines that there is a need for additional instructors, the Secretary may designate a third-party training course or appoint certified notary public instructors to administer the remote training course and testing for applicants.

5.2.3 Requirements for Remote Notary Public Seal and Electronic Signature (a) Form of remote notary public seal and electronic signature (1) A remote notary public must affix to an electronic record a seal that in both appearance and content matches the manually applied official stamp required by section 24-21-517, C.R.S.

(2) The electronic signature used by the remote notary public for remote notarizations must match in appearance the image of the signature that the remote notary public submitted to the Secretary of State for and is on file as the notary’s most recent underlying commission as a Colorado notary public. This is the signature identified as the notary public’s “official signature” on the notary’s most recent affirmation form or on the notary’s most recent signature change form, whichever was filed later. A remote notary public may not use the remote notarization application or any update form to change the notary’s official signature. (b) Use of and access to remote notary public’s seal and electronic signature (1) The remote notary’s seal and electronic signature must: (A) Be retained under the remote notary public’s sole control and access through the authentication required by Rule 5.3.3 (a)(4). (B) Appear as images on any visual or printed representation of a remote notarial certificate regardless of the technology being used to affix the images; and (C) Be attached or logically associated with both the electronic record being notarized and the certificate of notarial act being affixed and linked such that any subsequent alteration to either item is observable through visual examination, i.e., the document must be rendered tamper-evident.

9 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (2) A remote notary public’s employer, including the employer's employees and agents, must not use or permit the use of a remote notary’s seal or electronic signature by anyone except the remote notary public. (3) On resignation from or the revocation of the notary public’s commission or on the death or adjudication of incompetency of the notary public, the notary or that notary’s personal representative or guardian must delete the notary’s seal and electronic signature from the remote notary system provider’s system.

5.2.4 Journal to record remote notarizations (a) In addition to the journal information required by section 24-21-519(3), C.R.S., the remote notary public must record the name of the remote notarization system provider used for each remote notarization.

(b) The remote notary public must retain his or her electronic journal under the remote notary public’s sole control and access and all other requirements of section 24-21-519, C.R.S. apply.

(c) The electronic journal must be securely backed up and be tamper-evident. (d) On resignation from or the revocation of the notary public’s commission or on the death or adjudication of incompetency of the notary public, the notary or that notary’s personal representative or guardian with knowledge of the existence of or knowingly in possession of the remote notarization journal and recordings must retain or dispose of the journal and the audio-video recordings in accordance with sections 24-21-514.5(9)(c) and 24-21-519, C.R.S. Only remote notarization system providers and remote notarization storage providers that have been approved by the Secretary of State may store audio-video recordings. 5.2.5 A remote notary public must stop and restart the remote notarization process from the beginning if:

(a) The remotely located individual or the remote notary public must exit the remote notarization system before completion of the notarial act; (b) The audio or visual feed is interrupted or terminated; or (c) The resolution or quality of the transmission becomes such that the remote notary public believes the process has been compromised and cannot be completed.

5.2.6 A remote notary public has an ongoing duty to verify that each remote notary provider used has Active status with the Secretary of State’s office before using that provider’s remote notarization system to perform a remote notarization. This duty extends to each remote notarization.

5.2.7 In accordance with section 24-21-529(2), C.R.S., a remote notary may charge a fee, not to exceed twenty-five dollars, for the notary’s electronic signature. 5.2.8 A remote notary public must notify the Secretary of State in writing through the Secretary of State’s online system within 30 days after changing a remote notarization system provider or remote notarization storage provider.

10 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State 5.2.9 Expiration of the Secretary of State’s approval to perform remote notarizations: (a) Approval automatically expires:

(1) Upon revocation, expiration, or resignation of the notary’s commission; (2) 30 days after the notary’s name changes unless the notary previously submitted a name change.

(3) Upon conviction of a felony;

(4) Upon conviction of a misdemeanor involving dishonesty; (5) If the notary no longer has a place of employment or practice or a residential address in the state of Colorado; or (6) Upon the revocation of approval of the remote notarization system provider or the remote notarization storage provider used by the remote notary public unless the remote notary public either notified the Secretary of State of another provider or already has alternative providers on file with the Secretary of State as authorized by Rule 5.2.1(e). (b) If approval expires, the remote notary public or the notary’s authorized representative must delete the notary’s seal and electronic signature from the remote notary provider’s system and dispose of the journal and the audio-video recordings in accordance with sections 24-21-514.5(9)(c) and 24-21-519, C.R.S. unless within 30 days of the expiration, the Secretary of State reapproves the notary.

5.3 Requirements for providers 5.3.1 Provider Protocols (a) The Colorado Secretary of State’s Provider Protocols (December 1, 2020) are hereby incorporated by reference.

(1) Material incorporated by reference in the Notary Rules does not include later amendments or editions of the incorporated material. (2) Copies of the material incorporated by reference may be obtained by contacting the Colorado Department of State, 1700 Broadway, Suite 550, Denver, CO 80290, (303) 894-2200. Copies are also available online at https://www.coloradosos.gov/pubs/notary/home.html.

(b) All providers must meet the requirements of the Provider Protocols. 5.3.2 Application (a) A provider must submit the approved application form and receive approval from the Secretary of State before the provider can provide services to a Colorado remote notary public.

(b) The applicant must provide to the Secretary of State in its application: (1) The certification required by section 24-21-514.5 (11)(a), C.R.S. 11 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (2) The following information:

(A) The names of all business entities and any of their affiliates that will have access to either personally identifying information and any non-personally identifying data gathered during the remote notarization process and procedures; and (B) A copy of the data privacy policy provided to users, which clearly specifies the permissible uses for both personally identifying and non-personally identifying data.

(3) All data and technology specifics required in the application and set forth in the Provider Protocols under Rule 5.3.1.

(c) At the time of application, the applicant must be in Good Standing status as a business entity registered to do business in Colorado and must continue to maintain that status while providing remote notarization services to Colorado remote notaries public.

(d) The Secretary of State may require an applicant to supplement its application with additional information, including an in-person demonstration or electronic demonstration of the applicant’s system.

(e) The applicant must pay the required application fee. 5.3.3 Criteria and standards for approval of remote notarization system providers. (a) In order to be approved and maintain continuing eligibility, a remote notarization system provider must:

(1) Provide a remote notarization system that complies with the technical specifications of these rules and the standards, including data security and integrity requirements, set forth in the Secretary of State’s Provider Protocols under Rule 5.3.1;

(2) Verify the authorization of a Colorado notary public to perform remote notarial acts before each remote notarization;

(3) Suspend the use of its remote notarization system for any remote notary public if the notary’s underlying commission or the Secretary of State’s approval of the notary public to perform remote notarizations has been denied, suspended, or revoked by the Secretary or when the notary has resigned;

(4) Ensure that access to a remote notary public’s electronic signature and seal is limited solely to the remote notary public and protected by the use of a password authentication, token authentication, biometric authentication, or other form of authentication that is described in the remote notarization system provider’s application;

(5) Verify that a Colorado remote notary public has Active status with the Secretary of State’s office at the time of each remote notarization; and (6) Annually renew its registration with the Secretary of State’s office and pay the required fee.

12 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (b) Communication technology provided by the remote notarization system provider must:

(1) Provide for continuous, synchronous audio-visual feeds; (2) Provide sufficient video resolution and audio clarity to enable the remote notary public and the remotely located individual to see and speak to one another simultaneously through live, real time transmission; (3) Provide sufficient captured image resolution for credential analysis to be performed in accordance with section 24-21-514.5(6)(b)(II), C.R.S., and this Rule 5;

(4) Include a means of authentication that reasonably ensures only the proper parties have access to the audio-video communication; (5) Be capable of securely creating and storing or transmitting securely to be stored an electronic recording of the audio-video communication, keeping confidential the questions asked as part of any identity proofing assessment, and the means and methods used to generate the credential analysis output; and (6) Provide reasonable security measures to prevent unauthorized access to:

(A) The live transmission of the audio-video communication; (B) A recording of the audio-video communication;

(C) The verification methods and credentials used to verify the identity of the principal; and (D) The electronic records presented for remote notarization. (c) Credential analysis provided by a remote notarization system provider must satisfy the requirements of the Secretary of State’s Provider Protocols under Rule 5.3.1.

(d) Dynamic, knowledge-based authentication assessment, if selected by a remote notarization system provider as the method of verifying the identity of the remotely located individual per section 24-21-514.5(6)(b)(II)(A), C.R.S., must satisfy the requirements of the Secretary of State’s Provider Protocols under Rule 5.3.1.

(e) Public Key Certificate or an identity verification method by a trusted third party. A remote notarization system provider may satisfy section 24-21-514.5(6)(b)(II)(B) or (c), C.R.S., by providing a method of identification of the remotely located individual that satisfies the requirements of the Secretary of State’s Provider Protocols under Rule 5.3.1.

13 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (f) Data Storage and security A remote notarization system provider must provide a storage system that complies with the technical specifications of these rules and the standards, including data security and integrity protocols, set forth in the Secretary of State’s Provider Protocols under Rule 5.3.1.

5.3.4 Criteria and standards for approval of remote notarization storage providers In order to be approved and maintain continuing eligibility, a remote notarization storage provider must provide a storage system that complies with the technical specifications of these rules and the standards, including data security and integrity protocols, set forth in the Secretary of State’s Provider Protocols under Rule 5.3.1. 5.3.5 Deficient provider application. If the Secretary of State denies approval of an applicant, the Secretary of State will notify the applicant of any application deficiencies. A rejected applicant may request a hearing in accordance with the State Administrative Procedure Act (Article 4 of Title 24, C.R.S.) and 8 CCR 1505-3, Rule 3. 5.3.6 Notifications (a) If a remote notarization system provider or storage provider becomes aware of a possible security breach involving its data, the provider must give notice to both the Secretary of State and each Colorado remote notary public using its services no later than 30 days after the date of determination that a security breach occurred. The provider must comply with any other notification requirements of Colorado’s data privacy laws.

(b) No later than 30 days before making any changes to the remote notarization system or storage system used by Colorado remote notaries that would impact any previously provided answer in its application about its system that would affect the provider’s eligibility for approval, a provider must both request approval from the Secretary of State and notify each Colorado remote notary public using its services. Changes to the system or storage must conform to statutory and rule requirements.

(c) For non-system or storage-related changes to the provider’s information on file with the Secretary of State, the provider must notify and update information provided to the Secretary of State no later than 30 days after changes to the provider’s previously supplied information. This requirement includes changes to the disclosures required by Rule 5.3.2(b)(2).

5.3.7 Complaints. A person may file a complaint with the Secretary of State against an approved provider. The complaint must allege a specific violation of Colorado’s Revised Uniform Law on Notarial Acts or these rules. The person must submit the signed and dated complaint on the Secretary of State’s standard form. 5.3.8 Grounds for termination of approval. The Secretary of State may terminate approval of a provider for any of the following reasons:

(a) Violation of any provision of Colorado’s Revised Uniform Law on Notarial Acts or these rules;

(b) Making representations that the Secretary of State endorses, recommends, or mandates use of any of the provider’s products, goods, or services; 14 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State (c) If the provider sustains a data breach; and (d) Failure to timely respond to the Secretary of State’s request for information or otherwise cooperate with an investigation, including providing requested information.

5.3.9 Right respond to and cure noncompliance and right to hearing before terminating, suspending, or imposing conditions on approval.

(a) Except in cases of deliberate and willful violation or of substantial danger to the public health and safety, the Secretary of State will provide a remote notarization system or storage provider with written notice, an opportunity to respond in writing, and a reasonable opportunity to comply with all lawful requirements that may warrant agency proceedings to terminate, suspend, or impose conditions on an existing approval before instituting such proceedings in accordance with the State Administrative Procedure Act (Article 4 of Title 24, C.R.S.) and 8 CCR 1505-3, Rule 3.

(b) Except in cases of deliberate and willful violation or that the public health, safety, or welfare imperatively require emergency action, the Secretary of State will not terminate, suspend, or impose conditions on an existing approval of a remote notarization system or storage provider until after holding a hearing in accordance with the State Administrative Procedure Act (Article 4 of Title 24, C.R.S.) and 8 CCR 1505-3, Rule 3.

(c) Termination does not bar the Secretary of State from beginning or continuing an investigation concerning the provider.

5.4 Use of personal information 5.4.1 The limited exceptions in section 24-21-514.5(11)(c)(I) through (IV), C.R.S., do not include or authorize the use of personal information for the purpose of generating additional business or marketing opportunities by or for: (a) The remote notary;

(b) The remote notary’s employer or any business for whom the remote notary may be providing contracted services; or (c) The provider or any of its affiliates.

5.4.2 Such use is prohibited and cannot be waived by the explicit consent required section 24- 21-514.5(9)(a)(II), C.R.S., or otherwise.

15 CODE OF COLORADO REGULATIONS 8 CCR 1505-11 Secretary of State _________________________________________________________________________ Editor’s Notes History Rule 7 eff. 05/01/2010.

Entire rule eff. 11/30/2014.

Rules 1.4, 1.7-1.9, 2.1.2-2.1.6, 2.2.1-2.2.4, 3.1.1(b), 3.2.1(a), 3.2.2(c), 3.5, Rule 4 eff. 07/01/2018. Rule 5 emer. rule eff. 03/30/2020.

Rule 5 emer. rule eff. 06/26/2020.

Rule 5 emer. rule eff. 10/15/2020.

Rules 2.1.1-2.1.7, 2.3-2.3.2, 3.3.2, 3.3.3, Rule 5 emer. rules eff. 12/31/2020. Rules 2.1.1-2.1.7, 2.3-2.3.2, 3.3.2, 3.3.3, Rule 5 eff. 01/30/2021. Rules 3.6.5, 5.3.5-5.3.9 eff. 03/17/2022.

Rule 2.3 emer. rule eff. 07/01/2022.

Rule 2.3 eff. 10/15/2022.

Rule 5.2.7 emer. rule eff. 05/18/2023.

Rules 2.3, 5.2.7, 5.3.1, 5.3.3 eff. 09/01/2023.

Rule 2.4 eff. 04/30/2024.

Rules 3.1.3, 3.6.5(a),(b), 5.3.5, 5.3.9(a),(b) eff. 01/01/2025. 16