In order to be certified to be eligible to access the Limited Access DMF under the certification program established under this part, a Person shall certify, in the manner set forth in this part and pursuant to section 1001 of title 18, United States Code, that

(a) Such Person's access to the Limited Access DMF is appropriate because:

(1) Such Person has a legitimate fraud prevention interest, or has a legitimate business purpose pursuant to a law, governmental rule, regulation, or fiduciary duty, and shall specify the basis for so certifying;

(2) Such Person has systems, facilities, and procedures in place to safeguard the accessed information, and experience in maintaining the confidentiality, security, and appropriate use of accessed information, pursuant to requirements reasonably similar to the requirements of section 6103(p)(4) of the Internal Revenue Code of 1986;

(3) Such Person agrees to satisfy such similar requirements; and

(4) Such Person shall not, with respect to Limited Access DMF of any deceased individual:

(i) Disclose such deceased individual's Limited Access DMF to any person other than a person who meets the requirements of paragraphs (a)(1) through (3) of this section;

(ii) Disclose such deceased individual's Limited Access DMF to any person who uses the information for any purpose other than a legitimate fraud prevention interest or a legitimate business purpose pursuant to a law, governmental rule, regulation, or fiduciary duty;

(iii) Disclose such deceased individual's Limited Access DMF to any person who further discloses the information to any person other than a person who meets the requirements of paragraphs (a)(1) through (3) of this section; or

(iv) Use any such deceased individual's Limited Access DMF for any purpose other than a legitimate fraud prevention interest or a legitimate business purpose pursuant to a law, governmental rule, regulation, or fiduciary duty.

(b) The certification required in this section shall state whether such Person intends to disclose such deceased individual's DMF to any person, and if so, shall state the manner of such disclosure and how such Person will ensure compliance with paragraphs (a)(4)(i) through (iii) of this section.

[79 FR 16670, Mar. 26, 2014, as amended at 81 FR 34892, June 1, 2016]