Ill. Admin. Code tit. 86, § 850.130 – Registration of Third Parties

a) Every third party must apply to the Department for a certificate of registration. Application for registration or renewal of registration shall be made to the Department, by electronic means, in a form and at the time prescribed by the Department. Applications to register (Form REG-1, Illinois Business Registration Application) may be found and must be submitted electronically on the Department's website at www.tax.illinois.gov. [50 ILCS 355/5-35(a)]
b) Each application shall be signed and verified. Applicants must provide, in an electronic format established by the Department, the following information and documents with the registration application:
1. 1) the name and address of the applicant;
2. 2) the address of the location at which the applicant proposes to engage in business as a third party in this State and the addresses of all other places of business, if any (enumerating such addresses, if any, in a separate list attached to and made a part of the application) from which the applicant will engage in business as a third party in this State;
3. 3) valid and updated contact information;
4. 4) a copy of each contract it has entered into with a municipality or county; if an applicant has a contract with a municipality or county prior to the effective date of the Act, a copy of all existing contracts must be provided;
5. 5) an attestation of good standing to do business in Illinois from the Illinois Secretary of State;
6. 6) an annual certification of process letter signed by an attorney or certified public accountant licensed and authorized to practice in Illinois certifying that, after due diligence, the author is of the opinion that the applicant meets the following:
  1. A) the third party's confidentiality standards for storing encrypted data at rest, using a cryptographic algorithm, conform to Security Level 1 of the Federal Information Processing Standard (FIPS) Publication 140-2, or conform to similar security requirements contained in any successor publication;
  2. B) the third party uses multi-factor authentication;
  3. C) the third party uses HTTPS with at least TLS 1.2 or its successor to protect the data files while in transit between a browser and server;
  4. D) the third party adheres to best practices as recommended by the Open Web Application Security Project (OWASP);
  5. E) the third party has a firewall which protects against unauthorized use of the data; and
  6. F) the third party shall maintain a physical location in this State at all times; if, at any time, the third party fails to have a physical location in this State, the third party's registration shall be revoked; [50 ILCS 355/5-35] and
7. 7) an insurance policy, issued by an insurance company authorized to transact fidelity and surety business in the State of Illinois, which shall be for coverage of potential legal claims, including, but not limited to, penalties set forth in the Act, embezzlement, dishonesty, fraud, omissions or errors, or other financial wrongdoing in the course of providing third party services. The policy shall be continuous in form and run concurrently with the original and each renewal certification period unless terminated by the insurance company. [50 ILCS 355/5-37]
c) Each applicant shall pay an annual registration fee of $15,000 to register as a third party. (See 50 ILCS 355/5-35). This fee must be paid to the Department at the time of initial application or renewal.
d) Third parties also must submit to the Department copies of all contracts for all local governments for which the third party will make referrals to the Department under the Act. These contracts may be submitted electronically at the time the third party registers with the Department, or the third party may submit the contract electronically after registering.
e) The Department may, after notice and a hearing, revoke or suspend the certificate of registration of any third party for a violation of any provision of the Act, for noncompliance with any provision contained in the Act, or because the Department determines that the third party is ineligible for a certificate of registration for any one or more of the reasons provided for in this Section. The decision whether to suspend or revoke and, if a suspension is in order, the duration of the suspension shall be made by taking into account factors that include but are not limited to, the registrant's previous history of compliance with the Act as of its creation, the number, seriousness, and duration of the violations, and the registrant's cooperation in discontinuing and correcting violations. [50 ILCS 355/5-40]
f) Any person aggrieved by any decision of the Department under Section 5-35 of the Act may, within 60 days after notice of the decision, protest and request a hearing pursuant to procedures outlined in 86 Ill. Adm. Code 200.120. Upon receiving a request for a hearing, the Department shall give written notice to the person requesting the hearing of the time and place fixed for the hearing and shall hold a hearing and then issue its final administrative decision in the matter to that person within 60 days after the date of the hearing or at a later date upon agreement of all of the parties. In the absence of a protest and request for hearing within 60 days, the Department's decision shall become final without any further determination being made or notice given. [50 ILCS 355/5-35(d)]