(a) Program required. An MSP issuer must conduct a program to assess its vulnerability to fraud and abuse as well as to address such vulnerabilities.

(b) Fraud detection system. An MSP issuer must operate a system designed to detect and eliminate fraud and abuse by employees and subcontractors of the MSP issuer, by providers furnishing goods or services to MSP enrollees, and by MSP enrollees.

(c) Submission of information. An MSP issuer must provide to OPM such information or assistance as may be necessary for the agency to carry out the duties and responsibilities, including those of the Office of Inspector General as specified in sections 4 and 6 of the Inspector General Act of 1978 (5 U.S.C. App.). An MSP issuer must provide any requested information in the form, manner, and timeline prescribed by OPM.