No. CS/HB 381
Office of Financial Regulation; Requires loan originators, mortgage brokers, & mortgage lenders & money services businesses to develop, implement, & maintain comprehensive written information security programs for protection of information systems & nonpublic personal information & to establish written incident response plans; provides requirements for notices of security breaches; revises list of actions by money services businesses which constitute grounds for disciplinary actions & penalties; provides requirements for emergency orders that suspend money services business licenses; provides that debit card transaction shall be treated same as cash transactions & prohibits redemption through credit card transaction; requires financial institutions to take measures to protect & secure certain data that contain personal information; provides requirements for notices of security breaches to office, DLA, certain individuals, & certain credit reporting agencies; revises timeline for mailing of payment for salary & travel expenses of certain field staff; revises requirements for permission to organize credit unions; removes provisions that impose limitations on investments in real estate & equipment for credit unions; revises requirements & factors for approving applications for organizing banks & trust companies; revises requirements for directors of certain banks & trust companies.
Plain English Summary
AI-GENERATEDMortgage brokers, lenders, loan originators, and money services businesses must build a written cybersecurity program and an incident-response plan, with an exemption for operations under 20 workers or 500 yearly customers.
Banks, credit unions, and trust companies get a nearly identical duty to protect personal data and report breaches, but face no size exemption and must also notify the Department of Legal Affairs.
Money services businesses face mandatory license suspension for the most serious violations, while failing to keep a federally insured account or violating federal military-lending rules is dropped from the list of disciplinable conduct.
Credit unions lose their real-estate investment cap and can meet entirely online. Payday lenders can no longer accept credit cards for loan redemption, and repossessed-vehicle disputes move exclusively under the state's UCC law.
AILoan originators, mortgage brokers, mortgage lenders, and money services businesses must develop, implement, and maintain a written information security program covering how they protect and dispose of customer data, plus a written incident-response plan for cyberattacks. Operations under 20 workers or 500 yearly customers are exempt.
AIState-chartered banks, trust companies, and credit unions must take reasonable measures to secure electronic data containing personal information such as Social Security numbers, account numbers, and biometric data, and must report breaches affecting 500 or more people to state regulators and the Department of Legal Affairs.
AIWhen the Office of Financial Regulation finds a money services business poses a serious public danger, it must now issue an emergency suspension order instead of merely being allowed to. New procedural rules require notice of the grounds, a hearing within 20 days, and a right to judicial review.
AICredit unions no longer face a statutory 5-percent-of-capital ceiling on what they can invest in real estate, furniture, fixtures, and equipment, and the office's approval process for exceeding that ceiling is deleted along with it.
AIThree specific violations no longer appear on the list of acts that can trigger discipline against a money services business: a check casher failing to keep a federally insured account, failing to deposit cashed instruments into that account, and violating the federal Military Lending Act in payday-loan transactions.
AIA borrower redeeming a deferred-presentment (payday) loan check may now pay with a debit card, which counts the same as cash, but paying with a credit card is explicitly forbidden alongside the existing ban on personal checks.
AIAn investment adviser with an office in Florida can no longer claim the small-adviser exemption from state registration just by having fewer than six Florida clients; it must also have zero clients located outside Florida, a stricter test than out-of-state advisers face.
AIRights and obligations connected to a surrendered or repossessed motor vehicle are now governed exclusively by the state's UCC secured-transactions law, a new provision the Legislature's own summary of this bill does not mention.