§ 10-733. Cybersecurity investment incentive tax credit.(Abrogation of section effective June 30, 2019.)

   (a) Definitions. --

   (1) In this section the following words have the meanings indicated.

   (2) (i) "Company" means any entity of any form duly organized and existing under the laws of any jurisdiction for the purpose of conducting business for profit.

      (ii) "Company" does not include a sole proprietorship.

   (3) "Cybersecurity company" means a company organized for profit that is engaged primarily in the development of innovative and proprietary cybersecurity technology.

   (4) "Cybersecurity technology" means products or goods intended to detect or prevent activity intended to result in unauthorized access to, exfiltration of, manipulation of, or impairment to the integrity, confidentiality, or availability of an information system or information stored on or transiting an information system.

   (5) "Department" means the Department of Business and Economic Development.

   (6) (i) "Investment" means the contribution of money in cash or cash equivalents expressed in United States dollars, at a risk of loss, to a qualified Maryland cybersecurity company in exchange for stock, a partnership or membership interest, or any other ownership interest in the equity of the qualified Maryland cybersecurity company, title to which ownership interest shall vest in the qualified investor.

      (ii) "Investment" does not include debt.

      (iii) For purposes of this section, an investment is at risk of loss when repayment entirely depends on the success of the business operations of the qualified company.

   (7) "Panel" means the panel that the Department may establish under subsection (e) of this section composed of experts in the area of cybersecurity technology.

   (8) (i) "Qualified investor" means any individual or entity that invests at least $ 25,000 in a qualified Maryland cybersecurity company and that is required to file an income tax return in any jurisdiction.

      (ii) "Qualified investor" does not include a qualified pension plan, an individual retirement account, or any other qualified retirement plan under the Employee Retirement Income Security Act of 1974, as amended, or fiduciaries or custodians under such plans, or similar tax-favored plans or entities under the laws of other countries.

   (9) "Qualified Maryland cybersecurity company" means a cybersecurity company that has met the criteria set forth in subsection (c)(2) of this section and been determined under subsection (c)(3)(ii)2 of this section to qualify for the tax credit under this section.

   (10) "Secretary" means the Secretary of Business and Economic Development.

(b) In general. --

   (1) Subject to paragraph (2) of this subsection and subsections (d) and (f) of this section, for the taxable year in which an investment in a qualified Maryland cybersecurity company is made, a qualified Maryland cybersecurity company may claim a credit against the State income tax in an amount equal to the amount of tax credit stated in the final credit certificate approved by the Secretary for the investment as provided under this section.

   (2) For purposes of the tax credit described in paragraph (1) of this subsection, the qualified investor:

      (i) may not, after making the proposed investment, own or control more than 25% of the equity interests in the qualified Maryland cybersecurity company in which the investment is made; and

      (ii) shall submit an application to the Department containing the following:

         1. evidence that the investor is:

            A. if a company, duly organized and in good standing in the jurisdiction under the laws under which it is organized;

            B. current in the payment of all tax obligations to a state or any unit or subdivision of a state; and

            C. not in default under the terms of any contract with, indebtedness to, or grant from a state or any unit or subdivision of a state; and

         2. any other information the Department may require.

(c) Application and approval process. --

   (1) At least 30 days prior to receiving an investment in a qualified Maryland cybersecurity company for which a qualified Maryland cybersecurity company would be eligible for an initial tax credit certificate, the qualified Maryland cybersecurity company shall submit an application to the Department.

   (2) The application shall evidence that the qualified Maryland cybersecurity company has satisfied the following minimum requirements for consideration as a qualified Maryland cybersecurity company:

      (i) has its headquarters and base of operations in this State;

      (ii) has not participated in the tax credit program under this section for more than 1 prior fiscal year;

      (iii) has been in active business no longer than 5 years;

      (iv) has an aggregate capitalization of at least $ 100,000;

      (v) owns or has properly licensed any proprietary technology;

      (vi) has fewer than 50 full-time employees;

      (vii) does not have its securities publicly traded on any exchange;

      (viii) is in good standing;

      (ix) is current in the payment of all tax obligations to the State or any unit or subdivision of the State;

      (x) is not in default under the terms of any contract with, indebtedness to, or grant from the State or any unit or subdivision of the State; and

      (xi) meets any other reasonable requirements of the Department evidencing that the company is a going concern primarily engaged in the development of innovative and proprietary cybersecurity technology.

   (3) The Department shall:

      (i) approve all applications that qualify for credits under this section on a first-come, first-served basis; and

      (ii) within 30 calendar days of receipt of an application:

         1. certify the amount of any approved tax credits to a qualified Maryland cybersecurity company; and

         2. determine whether a cybersecurity company qualifies for investments that are eligible for the tax credit under this section.

   (4) (i) After the date on which the Department issues an initial tax credit certificate under this section, a qualified investor shall have 30 calendar days to make an investment in a qualified Maryland cybersecurity company under this section.

      (ii) Within 10 calendar days after the date on which a qualified investor makes the investment, the qualified Maryland cybersecurity company shall provide to the Department notice and proof of the making of the investment, including:

         1. the date of the investment;

         2. the amount invested;

         3. proof of the receipt of the invested funds by the qualified Maryland cybersecurity company;

         4. a complete description of the nature of the ownership interest in the equity of the qualified Maryland cybersecurity company acquired in consideration of the investment; and

         5. any reasonable supporting documentation the Department may require.

      (iii) If a qualified Maryland cybersecurity company does not provide the notice and proof of the making of the investment required in subparagraph (ii) of this paragraph within 40 calendar days after the date on which the Department issues an initial tax credit certificate under this section:

         1. the Department shall rescind the initial tax credit certificate; and

         2. the credit amount allocated to the rescinded certificate shall revert to the Maryland Cybersecurity Investment Tax Credit Reserve Fund and shall be available in the applicable fiscal year for allocation by the Department to other initial tax credit certificates in accordance with the provisions of this section.

(d) Amount; refunds. --

   (1) The tax credit allowed in an initial tax credit certificate issued under this section is 33% of the investment in a qualified Maryland cybersecurity company, not to exceed $ 250,000.

   (2) During any fiscal year, the Secretary may not certify eligibility for tax credits for investments in a single qualified Maryland cybersecurity company that in the aggregate exceed 15% of the total appropriations to the Maryland Cybersecurity Investment Tax Credit Reserve Fund for that fiscal year.

   (3) If the credit allowed under this section in any taxable year exceeds the State income tax for that taxable year, an individual or a corporation may claim a refund in the amount of the excess.

(e) Panel of experts in cybersecurity technology. --

   (1) The Department may establish a panel composed of experts in the area of cybersecurity technology.

   (2) The Department may establish the panel under service contracts with independent reviewers.

   (3) The panel shall assist the Department in its determination as to whether a company is a qualified Maryland cybersecurity company.

   (4) A member of the panel is not eligible to receive any benefit, direct or indirect, from the tax credit under this section.

   (5) (i) Except as provided in subparagraph (ii) of this paragraph, Division II of the State Finance and Procurement Article does not apply to a service that the Department obtains under this section.

      (ii) The Department is subject to Title 12, Subtitle 4 of the State Finance and Procurement Article for services the Department obtains under this section.

(f) Maryland Cybersecurity Investment Tax Credit Reserve Fund. --

   (1) In this subsection, "Reserve Fund" means the Maryland Cybersecurity Investment Tax Credit Reserve Fund established under paragraph (2) of this subsection.

   (2) (i) There is a Maryland Cybersecurity Investment Tax Credit Reserve Fund which is a special continuing, nonlapsing fund that is not subject to § 7-302 of the State Finance and Procurement Article.

      (ii) The money in the Reserve Fund shall be invested and reinvested by the Treasurer, and interest and earnings shall be credited to the General Fund.

      (iii) The money in the Reserve Fund may be used by the Department to pay the costs of administering the tax credit program under this section.

   (3) (i) Subject to the provisions of this subsection, the Secretary shall issue an initial tax credit certificate to a qualified Maryland cybersecurity company for each approved investment in a qualified Maryland cybersecurity company eligible for a tax credit.

      (ii) An initial tax credit certificate issued under this subsection shall state the maximum amount of tax credit for which the qualified Maryland cybersecurity company is eligible.

      (iii) 1. Except as otherwise provided in this subparagraph, for any fiscal year, the Secretary may not issue initial tax credit certificates for credit amounts in the aggregate totaling more than the amount appropriated to the Reserve Fund for that fiscal year in the State budget as approved by the General Assembly, as reduced by the amount needed to pay the costs of administering the tax credit program under this section.

         2. If the aggregate credit amounts under initial tax credit certificates issued in a fiscal year total less than the amount appropriated to the Reserve Fund for that fiscal year, any excess amount shall remain in the Reserve Fund and may be issued under initial tax credit certificates for the next fiscal year.

         3. For any fiscal year, if funds are transferred from the Reserve Fund under the authority of any provision of law other than under paragraph (4) of this subsection, the maximum credit amounts in the aggregate for which the Secretary may issue initial tax credit certificates shall be reduced by the amount transferred.

      (iv) For each fiscal year, the Governor shall include in the budget bill an appropriation of at least $ 2,000,000 to the Reserve Fund.

      (v) Notwithstanding the provisions of § 7-213 of the State Finance and Procurement Article, the Governor may not reduce an appropriation to the Reserve Fund in the State budget as approved by the General Assembly.

      (vi) Based on the actual amount of an investment made by a qualified investor, the Secretary shall issue a final tax credit certificate to the qualified Maryland cybersecurity company.

   (4) (i) Except as otherwise provided in this paragraph, money appropriated to the Reserve Fund shall remain in the Reserve Fund.

      (ii) 1. Within 15 days after the end of each calendar quarter, the Department shall notify the Comptroller as to each final credit certificate issued during the quarter:

            A. the maximum credit amount stated in the initial tax credit certificate for the investment in the qualified Maryland cybersecurity company; and

            B. the final certified credit amount for the investment in the qualified Maryland cybersecurity company.

         2. On notification that an investment has been certified, the Comptroller shall transfer an amount equal to the credit amount stated in the initial tax credit certificate for the investment from the Reserve Fund to the General Fund.

      (iii) 1. Periodically, but not more frequently than quarterly, the Department may submit invoices for costs that have been incurred or are anticipated to be incurred in administering the tax credit program under this section.

         2. The Comptroller shall transfer money from the Reserve Fund to the Department to pay for costs that have been incurred or are anticipated to be incurred in administering the tax credit program under this section.

(g) Recapture of credit. --

   (1) The credit claimed under this section shall be recaptured as provided in paragraph (2) of this subsection if within 2 years from the close of the taxable year for which the credit is claimed:

      (i) the qualified investor sells, transfers, or otherwise disposes of the ownership interest in the qualified Maryland cybersecurity company that gave rise to the credit; or

      (ii) the qualified Maryland cybersecurity company that received the credit:

         1. ceases operating as an active business with its headquarters and base of operations in the State; or

         2. pays out as dividends or otherwise distributes the equity investment.

   (2) The amount required to be recaptured under this subsection is the product of multiplying:

      (i) the total amount of the credit claimed or, in the case of an event described in paragraph (1)(i) of this subsection, the portion of the credit attributable to the ownership interest disposed of; and

      (ii) 1. 100%, if the event requiring recapture of the credit occurs during the taxable year for which the tax credit is claimed;

         2. 67%, if the event requiring recapture of the credit occurs during the first year after the close of the taxable year for which the tax credit is claimed; or

         3. 33%, if the event requiring recapture of the credit occurs more than 1 year but not more than 2 years after the close of the taxable year for which the tax credit is claimed.

   (3) The qualified Maryland cybersecurity company that claimed the credit shall pay the amount to be recaptured as determined under paragraph (2) of this subsection as taxes payable to the State for the taxable year in which the event requiring recapture of the credit occurs.

(h) Revocation of certification. --

   (1) The Department may revoke its initial or final certification of an approved credit under this section if any representation made in connection with the application for the certification is determined by the Department to have been false.

   (2) The revocation may be in full or in part as the Department may determine and, subject to paragraph (3) of this subsection, shall be communicated to the qualified investor, the qualified Maryland cybersecurity company, and the Comptroller.

   (3) The qualified Maryland cybersecurity company shall have an opportunity to appeal any revocation to the Department prior to notification of the Comptroller.

   (4) The Comptroller may make an assessment against the qualified Maryland cybersecurity company to recapture any amount of tax credit that the qualified Maryland cybersecurity company has already claimed.

(i) Reports. --

   (1) On or before January 10 of each year, the Department shall report to the Governor and, subject to § 2-1246 of the State Government Article, the General Assembly, on the initial tax credit certificates awarded under this section for the prior calendar year.

   (2) The report required under paragraph (1) of this subsection shall include for each initial tax credit certificate awarded:

      (i) the name of the qualified investor and the amount of credit awarded or allocated to each qualified Maryland cybersecurity company;

      (ii) the name and address of the qualified Maryland cybersecurity company that received the credit under this section and the county where the qualified Maryland cybersecurity company is located; and

      (iii) the dates of receipt and approval by the Department of all applications for initial tax credit certificates.

   (3) The report required under paragraph (1) of this subsection shall summarize for the categories of qualified investors and qualified Maryland cybersecurity companies:

      (i) the total number of applicants for initial tax credit certificates under this section in each calendar year;

      (ii) the number of applications for which initial tax credit certificates were issued in each calendar year; and

      (iii) the total initial tax credit certificates authorized under this section for all calendar years under this section.

(j) Regulations. -- The Department and the Comptroller jointly shall adopt regulations to carry out the provisions of this section and to specify criteria and procedures for application for, approval of, and monitoring continuing eligibility for the tax credit under this section.