(A) Upon initial implementation of the program, and annually thereafter as a part of the annual update described in § 36.08 of this chapter, provider shall determine whether it maintains covered accounts. As part of that determination, provider shall conduct a risk assessment to determine whether it offers or maintains Covered Accounts that carry a reasonably foreseeable risk of identity theft, including financial, operational, compliance, reputation or litigation risks.
(B) The risk assessment shall take into consideration:
(1) The methods provider provides to open its accounts;
(2) The methods it provides to access its accounts; and
(3) Its previous experiences with identity theft.
(Ord. 2416, passed 7-13-2010)