WSR 16-10-046
PERMANENT RULES
DEPARTMENT OF
FINANCIAL INSTITUTIONS
(Division of Consumer Services)
[Filed April 29, 2016, 9:30 a.m., effective June 1, 2016]
Effective Date of Rule: June 1, 2016.
Purpose: The rules implementing the Check Cashers and Sellers Act, chapter 208-630 WAC are being amended to aid the regulated industry by putting them on notice of federal laws they must comply with, to have consistent rules, and to make technical changes for clarity and consistency.
The rules are being amended under the authority of OFM Guidelines 3.a. and e. dated October 12, 2011.
Citation of Existing Rules Affected by this Order: Repealing WAC 208-630-711; and amending WAC 208-630-110, 208-630-130, 208-630-135, 208-630-501, 208-630-520, 208-630-532, 208-630-545, 208-630-555, 208-630-556, 208-630-835, and 208-630-836.
Statutory Authority for Adoption: Chapter 43.320 RCW, RCW 31.45.200.
Adopted under notice filed as WSR 16-05-092 on February 16, 2016.
Changes Other than Editing from Proposed to Adopted Version: 1. WAC 208-630-501(5), the proposed language was amended to clarify that early payoff of a loan is permitted.
2. WAC 208-630-520(4), the proposed language was amended to clarify installment plan repayment periods.
3. WAC 208-630-556(11), the proposed language was amended to accommodate the electronic transfer of funds.
4. WAC 208-630-556 (12)(d), the proposed language was amended to clarify receipt of formal notice of a bankruptcy before closing the loan.
5. WAC 208-630-605, the proposed language was amended to tie the requirement to the business triggering the license requirement.
6. WAC 208-630-606, the proposed language was amended to tie the requirement to the business triggering the license requirement.
7. WAC 208-630-715, the proposed language was amended to clarify that the language is not a separate requirement from the federal requirement.
8. WAC 208-630-716, the proposed language was amended to clarify that the language is not a separate requirement from the federal requirement.
Number of Sections Adopted in Order to Comply with Federal Statute: New 0, Amended 0, Repealed 0; Federal Rules or Standards: New 2, Amended 0, Repealed 1; or Recently Enacted State Statutes: New 1, Amended 0, Repealed 0.
Number of Sections Adopted at Request of a Nongovernmental Entity: New 0, Amended 0, Repealed 0.
Number of Sections Adopted on the Agency's Own Initiative: New 6, Amended 11, Repealed 1.
Number of Sections Adopted in Order to Clarify, Streamline, or Reform Agency Procedures: New 0, Amended 9, Repealed 0.
Number of Sections Adopted Using Negotiated Rule Making: New 6, Amended 11, Repealed 1; Pilot Rule Making: New 0, Amended 0, Repealed 0; or Other Alternative Rule Making: New 0, Amended 0, Repealed 0.
Date Adopted: April 29, 2016.
Charles Clark, Director
Division of Consumer Services
AMENDATORY SECTION (Amending WSR 14-24-048, filed 11/25/14, effective 1/1/15)
WAC 208-630-110 What definitions are required to understand these rules?
The definitions in RCW 31.45.010 and this section apply throughout this chapter unless the context clearly requires otherwise.
"ACH" means automated clearing house, an electronic network for financial transactions that processes credit and debit transactions.
"Act" means chapter 31.45 RCW.
"Advertise, advertising, and advertising material" means any form of sales or promotional materials used in connection with the business. Advertising material includes, but is not limited to, newspapers, magazines, leaflets, flyers, direct mail, indoor or outdoor signs or displays, point-of-sale literature or educational materials, other printed materials; radio, television, public address system, or other audio broadcasts; internet pages, social media, instant messages, or electronic bulletin boards.
"Affiliate" means any person who directly or indirectly through one or more intermediaries, controls, or is controlled by, or is in common control with another person.
"Agent" for purposes of RCW 31.45.079 means a person who engages in the business of making small loans by performing small loan agent services.
"Annual percentage rate" or "APR" means the cost of credit expressed as a yearly rate, determined in accordance with the federal Truth in Lending Act (15 U.S.C. Sec. 1601 et seq.), and Regulation Z (12 C.F.R. Part 1026 et seq.), as amended.
The Office of the Comptroller of the Currency (OCC) has developed an APR calculator (APRWIN) that licensees may download and use without charge. APRWIN is available on the OCC's web site at http://www.occ.treas.gov/aprwin.htm.
"Board director" means a director of a corporation or a person occupying a similar status and performing a similar function with respect to an organization, whether incorporated or unincorporated.
"Check" means the same as defined in RCW 62A.3-104(f) and, for purposes of conducting the business of making small loans, includes other electronic forms of payment, including stored value cards, internet transfers, and automated clearing house transactions.
"Check casher" means an individual, partnership, unincorporated association, or corporation that, for compensation, engages, in whole or in part, in the business of cashing checks, drafts, money orders, or other commercial paper serving the same purpose.
"Check seller" means an individual, partnership, unincorporated association, or corporation that, for compensation, engages, in whole or in part, in the business of selling checks, drafts, money orders, or other commercial paper serving the same purpose.
"Close of business" for the purposes of RCW 31.45.86 and these regulations means the actual time a licensee closes for business at the location from which a small loan was originated or 11:59 p.m. Pacific Time, whichever is earlier.
"Default" means:
(a) The borrower's failure to repay a small loan in compliance with the terms contained in the small loan agreement or note; or
(b) Failure to pay any installment plan payment within ten days after the date upon which the installment was scheduled to be paid. See WAC 208-630-556 (12)(b).
"Department" means the department of financial institutions.
"Exempt entity" means a person described in RCW 31.45.020 that is engaged in the business of making small loans.
"Gross monthly income" means an individual's total personal income earned during a month prior to any taxes or deductions.
"Installment plan" is a contract between a licensee and borrower that provides that the loaned amount will be repaid in substantially equal installments scheduled on or after a borrower's pay dates and no less than fourteen days apart.
"Investigation" means an examination undertaken for the purpose of detecting violations of chapter 31.45 RCW or these rules or obtaining information lawfully required under chapter 31.45 RCW or these rules.
"License" means a license issued by the director to engage in the business of check cashing or check selling under the provision of chapter 31.45 RCW.
"Loaned amount" means the outstanding principal balance and any fees authorized under RCW 31.45.073 that have not been paid by the borrower.
"Monetary instrument" means a check, draft, money order or other commercial paper serving the same purpose.
"Paid" means that moment in time when the licensee deposits the borrower's check, accepts cash, or initiates an ACH withdrawal from the borrower's account for the full amount owed on a valid small loan. If the borrower's check is dishonored and returned unpaid by the borrower's bank, the loan is not paid. If an ACH authorization is denied, the loan is not paid.
"Payday advance lender" or "payday lender" means a licensee under this chapter who has obtained a small loan endorsement under RCW 31.45.073.
"Payday advance loan," "payday loan" or "deferred deposit loan" means the same as a small loan.
"Postdated check" means a check delivered prior to its date, generally payable at sight or on presentation on or after the day of its date. "Postdated check" does not include any promise or order made or submitted electronically by a borrower to a licensee.
"RCW" means the Revised Code of Washington.
"Small loan" or "loan" means a loan of up to the maximum amount and for a period of time up to the maximum term specified in RCW 31.45.073.
"Small loan agent services" include, but are not limited to:
(a) Marketing and advertising small loans;
(b) Collecting nonpublic personal information from consumers in anticipation of selling the information to potential licensed lenders or other entities providing small loan agent services;
(c) Assisting consumers in completing small loan documentation;
(d) Providing required applicable state and federal disclosures in connection with small loans; and
(e) Collecting on small loans.
Small loan agent services do not include (a) services performed by any person holding a small loan endorsement or (b) collection of small loans by a person licensed under chapter 19.16 RCW or exempt from that chapter or otherwise authorized under Washington law to act as a collection agent.
"State" means the state of Washington.
"Unsafe or unsound financial practice" means any action, or lack of action, the likely consequences of which, if continued, would materially impair the net worth of a licensee or create an abnormal risk of loss to its customers.
AMENDATORY SECTION (Amending WSR 07-23-094, filed 11/20/07, effective 12/21/07)
WAC 208-630-130 How does a business apply for a check casher's or seller's license or a small loan endorsement to a check casher's or seller's license?
Each applicant for a check casher license, or check seller license, or a small loan endorsement to a check casher's or seller's license must apply to the director by filing the following:
(1) An application in a form prescribed by the director including at least the following information:
(a) The legal name, residence, and business address of the applicant if the applicant is an individual or sole proprietorship, and in addition, if the applicant is a partnership, corporation, limited liability company, limited liability partnership, trust, company, or association, the name and address of every member, partner, officer, controlling person, and board director;
(b) The trade name or name under which the applicant will do business under the act;
The director or the director's designated representative may deny an application for a proposed license or trade name if the proposed license or trade name is similar to a currently existing licensee name, including trade names.
(c) The street and mailing address of the company headquarters and each location in which the applicant will engage in business under the act;
(d) The location at which the applicant's records will be kept; and
(e) Financial statements and any other pertinent information the director may require with respect to the applicant and its board directors, officers, trustees, members, or employees, including information regarding any civil litigation filed within the preceding ten years against the applicant or controlling person of the applicant;
(2) A surety bond and related power of attorney, or other security acceptable to the director in an amount equal to the penal sum of the required bond as set forth in this rule. In lieu of the bond, the applicant may demonstrate to the director net worth in excess of three times the amount of the penal sum of the required bond in accordance with RCW 31.45.030 (5)(b) and (e) and this rule;
(3) A current financial statement as of the most recent quarter end prepared in accordance with generally accepted accounting principles which includes a statement of assets and liabilities and a profit and loss statement;
(4) Information on the applicant's or any affiliate's current or previous small loan or related type business in this state or any other state, including, but not limited to, name, address, city, state, licensing authority, and whether any enforcement action is pending or has been taken against the applicant in any state;
(5) Upon request, a complete set of fingerprints and a recent photograph of each sole proprietor, owner, director, officer, partner, member, and controlling person; and
(6) An application fee.
Any information in the application regarding a personal residential address or telephone number, and any trade secret as defined in RCW 19.108.010 including any financial statement that is a trade secret is exempt from the public disclosure requirements of chapter 42.17 RCW.
AMENDATORY SECTION (Amending WSR 14-24-048, filed 11/25/14, effective 1/1/15)
WAC 208-630-135 What must I do to be authorized to offer small loan agent services?
(1) Persons providing small loan agent services must license with the department. To license you must provide the following information:
(a) The legal name, residence, and business address if an individual or sole proprietorship, and in addition, if a partnership, corporation, limited liability company, limited liability partnership, trust, company, or association, the name and address of every member, partner, officer, controlling person, and board director.
(b) The trade or business name under which you will do business. Please note, your request may be denied if the proposed trade or business name is similar to a currently existing licensee name, including trade names.
(c) The street and mailing address of each location where you will engage in business.
(d) The location at which your records will be kept.
(e) Whether the applicant or other person subject to the act is, or has been, subject to a cease and desist order or an injunction issued pursuant to the act or rules or any state or federal law applicable to the business activity.
(f) Whether the applicant or other person subject to the act has been charged or found through an administrative, civil, or criminal proceeding to have violated the provisions of the act or rules, or any state or federal law applicable to the business activity.
(g) Whether the applicant or other person subject to the act has been convicted of, or pled guilty or nolo contendere, in a domestic, foreign, or military court to:
(i) A gross misdemeanor involving dishonesty or financial misconduct within the prior seven years;
(ii) A felony within the prior seven years; or
(iii) A felony that involved an act of fraud, dishonesty, breach of trust, or money laundering at any time preceding the date of application.
(h) Any other pertinent information the director may require.
(2) You must also provide to the department a declaration that the company will not sell consumers' nonpublic personal information to unlicensed entities making loans or to unlicensed small loan agents.
(3) The small loan agent license expires December 31st of each year. You must pay the renewal fee prescribed by the director to renew the license.
(4) If any information about the company changes from that provided to the department at the time of licensure, you must notify the director in writing of the change within a reasonable amount of time from the change.
NEW SECTION
WAC 208-630-155 May I conduct my business from more than one location?
Yes. You may establish one or more branch offices under your license.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-501 How must I determine the due date on the loan?
(1) The earliest due date for repayment is on or after the borrower's next pay date unless the pay date is within seven days of the date of the small loan. If the pay date falls within the seven days, you must set the repayment date on or after the borrower's second pay date after the date of the small loan. With the small loan origination date being day zero, count seven days out to determine the first available due date. A borrower with pay dates on the 5th and 20th of each month has a small loan with a loan origination date of February 1st. February 1st is day zero. February 8th is day seven. The borrower's pay date of February 5th is "within" seven days from loan's origination date. So the first due date will have to be on or after the borrower's next occurring pay date, February 20th.
(2) A loan's due date must be forty-five days or fewer from the origination date on the loan unless the term of the loan is extended by written agreement between you and the borrower at no additional cost to the borrower.
(3) If a small loan's due date falls on a date your business is not open, you must automatically extend the due date to your next business day.
(4) For purposes of this section, "pay date" means the borrower's scheduled pay date or the date the borrower's account is credited with any direct deposit or other electronic transfer of funds into their bank account, whichever is later.
(5) The borrower can pay off the loan at any time before the due date at no additional charge or fee.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-520 If a borrower and licensee enter into an installment plan, what are the terms of the installment plan?
An installment plan under RCW 31.45.084 must contain the following terms:
(1) The plan must be in writing;
(2) If the small loan is four hundred dollars or less the term must be for a period of at least ninety days;
(3) If the small loan is over four hundred dollars the term must be for a period of at least one hundred eighty days;
(4)(a) Installment payments must be both substantially equal in payment amount and substantially equally distributed over the installment plan payment period.
(b) An installment plan for ninety to one hundred eighty days is in compliance if there is at least one payment in each month in the period and payments are substantially equally distributed throughout the installment plan period.
(c) The borrower and licensee may mutually agree to fewer payments as long as they are substantially equal in amount and substantially equally distributed over the installment plan payment period.
(5) The borrower may pay off the total amount due at any time without additional penalty, fee, or charge for prepayment; and
(((5))) (6) You may enter into a written installment plan with a borrower on terms other than these as long as the terms are not less favorable to the borrower and there is no charge to the borrower.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-532 May I make a small loan to a borrower who is in default on another small loan?
No. You are prohibited from making a small loan to a borrower who is in default on another small loan ((originated on or after January 1, 2010)). This prohibition expires if the small loan is paid in full or two years have passed from the origination date of the small loan, whichever occurs first.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-545 ((May I use a name or place of business other than that named on the license or small loan endorsement?)) How do I use a trade name when conducting business?
((No. You may not make any loan under authority granted by chapter 31.45 RCW under any name or at any place of business other than that named on the license and small loan endorsement.)) (1) You may add a trade or "DBA" name to your license if you first apply to the department, in a form prescribed by the department, and receive department approval. When the department has approved the trade name, you must conduct business under that trade name in at least one of the two following ways:
(a) Use your license name together with the trade name; or
(b) Use your license number together with the trade name.
(2) The director may deny an application for a proposed DBA name if the proposed DBA name is similar to a currently existing licensee name.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-555 What is the purpose of the data base?
The purpose of this data base system is to:
(1) Prevent the practice of refinancing a small loan with another small loan;
(2) Prevent multiple licensees from making simultaneous small loans to an individual borrower so that the loans' total principal balance ((is)) exceeds the lesser of seven hundred dollars or thirty percent of the borrower's gross monthly income;
(3) Prevent licensees from making more than eight loans to any one borrower in any twelve-month period;
(4) Prevent a licensee from making a loan to a borrower who already has an outstanding small loan principal balance of the lesser of seven hundred dollars or thirty percent of their gross monthly income;
(5) Prevent licensees from making a loan to a borrower who is in default on a small loan or is in an installment plan; and
(6) Ensure that licensees set the small loan due date no earlier than the borrower's next pay date that is more than seven days from the origination date.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-556 How do I use the data base system for small loan transactions?
(1) Beginning January 1, 2010, each small loan transaction must be registered with the data base system and receive a data base system-generated transaction authorization number. The transaction authorization number demonstrates that the transaction has been recorded in the data base prior to you making the small loan to the borrower.
(2) Do I have to buy any equipment, hardware, or software to use the data base system? You must have a computer with access to the internet and Microsoft Internet Explorer 6 or higher. Dial-up capacity of at least 56 kps is sufficient. DSL or broadband access will provide faster access and response. It is also possible to interface directly with the data base system; the data base vendor can provide you with information about that process.
(3) How and when may I access the data base system?
(a) The data base system is the means by which real-time access to the data is made available to you through your internet connection.
(b) You must use a computer and the internet to access the data base system.
(c) The data base system will be accessible twenty-four hours a day every day of the year, except for routine scheduled system maintenance and upgrades performed by the data base vendor.
(4) What must I do to maintain confidentiality of the borrower's information provided to the data base? In order to maintain the confidentiality and security of the borrower's information, you must not transmit information to the data base system using publicly accessible computers, computers that are not under your control, unsecured wireless connections, or other connections that are not secure. Maintaining a secure connection includes, but is not limited to, installing and regularly updating antivirus and antispyware software and a firewall.
(5) How do I use the data base system to determine a borrower's eligibility for a small loan? You must:
(a) Access the data base system using the assigned user identification and password provided by the security administrator of your company;
(b) Enter the borrower's Social Security number, individual tax identification number (ITIN), or alien identification number, and the borrower's gross monthly income into the system.
(6) What information will the data base system give me when an eligibility search is conducted? The data base system will state a borrower's eligibility or ineligibility for a small loan and will give a reason for the eligibility determination. If the borrower is eligible for a small loan, the data base system will provide the dollar amount the borrower is eligible to receive.
(7) What must I do once the initial search determines that the borrower is eligible for a small loan?
(a) If you receive an initial indication from the data base vendor that the borrower is eligible for a small loan, you must then submit all of the required borrower information necessary to register the transaction in the data base, as prescribed by the date base vendor.
(b) When the required information has been submitted to the data base, the data base system will confirm the initial borrower search. If the borrower's eligibility is confirmed, the small loan transaction will be recorded as open and assigned a transaction authorization number evidencing that the transaction has been authorized by the data base system. You must place the transaction authorization number on the small loan agreement.
(8) What must I do if the borrower is determined to be ineligible for a small loan? If the borrower is deemed ineligible you will be provided with a printable message with a reason for the determination. The message will also include the name, address, and toll-free support number of the data base vendor. You must provide a copy of the printable message to the borrower.
(9) If I make a mistake entering data and must void the transaction, what do I do? Follow the data base vendor's instructions to administratively void the transaction.
(10) If the data base system is inaccessible via the internet, how do I access the data base?
(a) You will be given at least twenty-four hours notice for scheduled maintenance or system upgrades. The notice will be by electronic mail to the designated security administrator, or by a broadcast message on the data base vendor's web site.
(b) In the event the data base system is unavailable, you must adhere to the following procedures:
(i) Confirm that the data base system remains unavailable by attempting to access the data base system with every borrower seeking a new small loan transaction. You need not comply with this procedure if you have been notified via electronic mail by the data base vendor of an expected period of time necessary to correct whatever problem is causing the data base system to remain unavailable;
(ii) Contact the data base vendor's toll-free help desk or voice response system to obtain a temporary transaction authorization number directly from the data base vendor; and
(iii) Enter the remaining transactional data into the data base system within twenty-four hours of obtaining the temporary transaction authorization number from the data base vendor.
(c) In the event that either the department of financial institutions or the data base vendor notifies you that the data base system is unavailable and that all alternative methods for registering a transaction and receiving a transaction authorization number are also unavailable:
(i) You are authorized to conduct transactions during the specific period of unavailability, after receiving written authorization, via electronic mail or facsimile from either the department of financial institutions or the data base vendor with the department of financial institutions' consent.
(ii) Copies of the written authorization for any transactions conducted during an unavailability period must be attached to the small loan agreement for those transactions. One copy of the authorization must be provided to the borrower and another copy must be kept as an audit record.
(d) Transactions created during a period of authorized unavailability must be registered with the data base within twenty-four hours of notification that the data base system is available; provided, however, that if the data base system is unavailable for more than twenty-four hours, then the period for registration shall be extended by twenty-four hours for each additional twenty-four-hour period of unavailability.
(e) Once the transaction has been registered with the data base, the transaction number assigned to that transaction must be placed on the licensee's record copy of the small loan agreement signed by the borrower for that transaction. If the borrower requests that transaction number at any time, the licensee must provide it to the borrower.
(11) Once a loan is made, how can it be canceled or rescinded as authorized under RCW 31.45.086? A borrower may rescind a small loan agreement before the close of business on the next day of business after the date of the transaction without incurring a transaction fee. If a borrower elects to cancel a small loan agreement you must close the transaction on the data base as soon as practicable after the borrower rescinds the small loan transaction. A loan that has been rescinded does not count toward the eight loan limit; nor will you incur a one dollar transaction fee on that loan. For the purpose of rescinding a loan, the date of the transaction is the date the borrower actually receives the proceeds either in person or by direct deposit or other electronic transfer of funds into the borrower's bank account.
(12) When must I update information on the data base system?
(a) When a borrower's small loan is paid (date of cash received, check deposited, or ACH authorization initiated), you must update open transactions on the data base system as soon as practicable to ensure that all identifying information regarding both the borrower and the transaction are accurate, including any comments on the transaction which you deem relevant. You must input the date and time a transaction closes, as well as the payment method, unless you previously entered the payment method.
(b) When a small loan that was in default is paid, it is considered paid when the loaned amount and default fee is paid.
(c) When a loan is in default, you must mark the loan in the data base as in default as soon as practicable after the default as follow:
(i) A small loan is in default if not paid on the date and by the time indicated in the small loan agreement. If no time is indicated the small loan is in default the first day after the due date.
(ii) A small loan in an installment plan is in default if unpaid on the 11th day after the due date, with the due date being day zero. If the due date for an installment plan payment is January 1st and is not paid, the loan is considered in default and the data base must be updated on January 11th.
(d) When you receive formal notice that a small loan has been discharged in bankruptcy you must close the loan as having been paid, leaving a comment in the comment box about the bankruptcy. Do not administratively close the loan. The loan must continue to count toward the borrower's eight loan limit.
(13) How much will each data base transaction cost me? The data base vendor's transaction fee is one dollar per loan registered. The data base vendor will assess this fee for each transaction that has been registered on the data base.
(14) What happens if I do not pay the data base fees to the data base vendor? The data base vendor will lock you out of the data base system.
(15) What happens if I do not receive training and become certified in using the data base? If you or another designated person in the company do not receive training and certification to use the data base, you will not be given an access number for the data base.
NEW SECTION
WAC 208-630-605 Must I maintain a business resumption plan?
Yes. Licensees must have a written plan that details the company's response and recovery to any event that results in damage to or destruction of the books and records relating to the licensee's business triggering the license requirement. The plan must be maintained as part of the licensee's books and records.
NEW SECTION
WAC 208-630-606 Must I have a policy that deals with records disposal?
Yes. Licensees must have written policies and procedures for the destruction of records relating to the licensee's business triggering the license requirement, including electronic records, when the two-year retention period ends. The destruction of records must be accomplished so that the information cannot be reconstructed or read. The destruction of consumer credit report information must also comply with the Federal Disposal Rule at 16 C.F.R. 682.
NEW SECTION
WAC 208-630-715 What are the minimum requirements of an information security program required by the Federal Safeguards Rule implementing the Gramm-Leach-Bliley Act?
(1) Generally, applicants and licensees must have a written program appropriate to the company's size and complexity, the activity conducted, and the sensitivity of information at issue. The program must ensure the information's security and confidentiality, protect against anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of the information.
(2) Specifically, at a minimum the plan described in subsection (1) of this section must:
(a) Designate an employee or employees to coordinate the information security program;
(b) Identify and assess the risks to customer information;
(c) Design and implement safeguards to control the risks identified in the risk assessment and regularly monitor and test the safeguards;
(d) Select service providers that can maintain appropriate safeguards and oversee their handling of customer information; and
(e) At least annually evaluate and adjust the program in light of relevant circumstances, including changes in business operations, or the results of testing and monitoring the effectiveness of the implemented safeguards.
(3) The information security plan must be maintained as part of your books and records.
(4) Compliance with the federal Gramm-Leach-Bliley Act and Regulation P, 12 C.F.R. Part 1016, will be deemed compliance with this subsection.
(5) For more information access the FTC web site on the Safeguards Rule at: https://www.ftc.gov/tips-advice/business-center/guidance/financial-institutions-customer-information-complying and see 16 C.F.R. 314.
NEW SECTION
WAC 208-630-716 What are the minimum requirements for Consumer Financial Information Privacy under the Gramm-Leach-Bliley Act (Regulation P)?
Licensees must comply with Regulation P.
(1) At a minimum, licensees must:
(a) Provide customers with initial and annual notices regarding their privacy policies. These notices describe whether and how the licensee shares consumers' nonpublic personal information, including personally identifiable financial information, with other entities; and
(b) If licensees share certain customer information with particular types of third parties, the institutions are also required to provide notice to their customers and an opportunity to opt out of the sharing. If a licensee limits its types of sharing to those which do not trigger opt-out rights, it may provide a "simplified" annual privacy notice to its customers that does not include opt-out information. If a licensee's privacy policy has not changed, additional notices may not be required.
(2) Compliance with the federal Gramm-Leach-Bliley Act and Regulation P, 12 C.F.R. Part 1016, will be deemed compliance with this subsection.
(3) See Regulation P at 12 C.F.R. 1016 for the required details.
NEW SECTION
WAC 208-630-717 Must a licensee provide notice to consumers if its data is compromised?
Maybe. If the licensee's data is compromised the licensee may be subject to chapter 19.255 RCW and may have to provide notices to consumers whose information was acquired. Under certain circumstances notice of the breach may also be required by the attorney general's office.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-835 When must I inform the director of significant changes in my business?
(1) You must notify the director in writing within five days of the occurrence of any of the following significant developments:
(a) Your company filing for a chapter 7 or 11 bankruptcy;
(b) Your company receiving notification of a license revocation procedure against it in any state;
(c) You, or a director, officer, partner, member or controlling person of the company being convicted of a crime;
(d) You, or a director, officer, partner, member or controlling person of the company receiving notification of the filing of criminal charges or a criminal indictment or information, in any way related to check cashing, check selling or small loan activities.
(2) You must notify the director in writing at least fifteen days prior to a change of control. In the case of a corporation, control is defined as a change of ownership by a person or group acting in concert to acquire fifty percent of the stock, or the ability of a person or group acting in concert to elect a majority of the board directors or otherwise effect a change in policy of the corporation. The director may require such information as deemed necessary to determine whether a new application is required. In the case of entities other than corporations, change in control means any change in controlling persons of the organization, either active or passive. Change of control investigation fees are billed to the persons or group at the rate billed for applications.
(3) Other. Post notification. Within forty-five days of a data breach you must notify the director in writing. This notification requirement may change based on directives or recommendations from law enforcement. See also WAC 208-630-717.
AMENDATORY SECTION (Amending WSR 09-24-089, filed 12/1/09, effective 1/1/10)
WAC 208-630-836 When ceasing my small loan business, what information must I file before I close the business?
(1) You must notify the department at least thirty days before ceasing operations. The notice must be in writing, signed by a principal of the small loan licensee, and include the following:
(a) The date you will cease small loan activity;
(b) A list of all open and pending transactions;
(c) Your contact address and e-mail address; and
(d) Your plan for the orderly closure of open loans on the data base system.
(2) For purposes of this section, the term "ceasing operations" means that you have closed the offices to the public or have removed public access to the web site, if such access is the sole means of communication with customers. This provision does not apply if you have given customers a reasonable alternative for communications and payments.
REPEALER
The following section of the Washington Administrative Code is repealed:
WAC 208-630-711
What are the minimum requirements of a policy that protects borrowers' nonpublic personal information (NPI) under the Gramm-Leach-Bliley Act?