What definitions are applicable to these rules? In addition to the definitions herein, the definitions in ((RCW 19.230.010 and this section)) chapter 19.230 RCW apply throughout this chapter unless the context clearly requires otherwise.

"Act" means the Uniform Money Services Act, chapter 19.230 RCW.

"Advertise, advertising, or advertising material" means any form of sales or promotional materials used in connection with the business. Advertising material includes, but is not limited to, newspapers, magazines, leaflets, flyers, direct mail, indoor or outdoor signs or displays, point-of-sale literature or educational materials, other printed materials; radio, television, public address system, or other audio broadcasts; internet pages, social media pages, instant messages, or electronic bulletin boards.

"AML compliance officer" means the individual(s) employed by the licensee or licensee's parent or affiliate designated to implement the anti-money laundering (AML) program.

"Audited financial statement" means a statement prepared by an independent accountant according to generally accepted accounting principles.

(("Authorized delegate" means a person a licensee designates to provide money services on behalf of the licensee. A person that is exempt from licensing under this chapter cannot have an authorized delegate. An authorized delegate must only perform the contractual duties as authorized by the licensee in the contract between the licensee and the authorized delegate.))

"Bill payment" service means a type of money transmission when an intermediary accepts funds from a consumer for transmission to a merchant for payment on a consumer's account. The intermediary may or may not charge a fee for this service.

"Department" means the department of financial institutions.

(("Executive officer" means a president, chairperson of the executive committee, chief financial officer, responsible individual, or other individual who performs similar functions.))

"Funds" means money or its equivalent value.

(("Material litigation" means the same as in RCW 19.230.010.

"Money transmission" means receiving money or its equivalent value to transmit, deliver, or instruct to be delivered the money or its equivalent value to another location, inside or outside the United States, by any means including, but not limited to, by wire, facsimile, or electronic transfer. Money transmission does not include the provision solely of connection services to the internet, telecommunications services, or network access. Money transmission includes selling, issuing, or acting as an intermediary for open-loop stored value devices and payment instruments, but not closed-loop stored value devices.))

"NMLS" means a multistate licensing system developed and maintained by the Conference of State Bank Supervisors for licensing and registration.

(("Payment instrument" means a check, draft, money order, or traveler's check for the transmission or payment of money or its equivalent value, whether or not negotiable. Payment instrument does not include a credit card voucher, letter of credit, or instrument that is redeemable by the issuer in goods or services.)) "Online currency exchanger" means a currency exchanger who transacts business over the internet or other electronic medium, regardless of whether the currency exchanger also has a physical location in Washington state.

"Principal" means any person who controls, directly or indirectly through one or more intermediaries, alone or in concert with others, a ten percent or greater interest in a partnership, company, corporation, or association, or the owner of a sole proprietorship.

"RCW" means the Revised Code of Washington.

(("Stored value" means the recognition of value or credit stored on a device. Stored value is either open loop, meaning the value is redeemable at multiple, unaffiliated merchants or service providers, or closed loop meaning the value is primarily intended to be redeemed for a limited universe of goods, intangibles, services, or other items provided by the issuer of the stored value, its affiliates, or others involved in transactions functionally related to the issuer or its affiliates.

"Unsafe or unsound practice" means a practice or conduct by a person licensed or required to be licensed by the act to provide money services, or an authorized delegate of such a person, which creates the likelihood of material loss, insolvency, or dissipation of the licensee's assets, or otherwise materially prejudices the financial condition of the licensee or the interests of its customers.))

PART B

APPLICATION OF CHAPTER—EXEMPTIONS

(1) See also RCW 19.230.020.

(2) The issuance, sale, use, redemption, or exchange of closed-loop ((stored value devices)) prepaid access.

(((2))) (3) The issuance or sale of open-loop ((stored value devices)) prepaid access when the value ((on the devices are)) is covered by federal deposit insurance immediately upon sale or issue. See the Federal Deposit Insurance Corporation (FDIC) Financial Institution Letter 129-2008 dated November 13, 2008, to determine if the underlying funds ((of stored value devices)) are covered by FDIC insurance immediately upon sale or issue.

(((3) See also RCW 19.230.020.)) (4) Storage of virtual currency by a person when the virtual currency is owned by others and the person storing the virtual currency does not have the unilateral ability to transmit the value being stored.

The following are excluded:

(1) Pursuant to RCW 19.230.020 (6) and (7):

(a) Activities regulated by the Commodities Futures Trading Commission (CFTC) or exempt from registration with the CFTC;

(b) Clearance or settlement services provided by a person to a board of trade as designated by the CFTC.

(2) Pursuant to RCW 19.230.020(8), activities by persons providing clearance or settlement services under a registration as a clearing agency, or an exemption from that registration granted under the federal securities laws. The exclusion applies only to those activities.

(3) Payment processing by a person meeting the requirements in RCW 19.230.020(9), but not persons engaged in payment processing activities:

(a) Using virtual currencies;

(b) For the marijuana industry; or

(c) Holding consumer funds with no direction from the consumer to pay the funds to a payee.

What must I do to apply for a license? You must file:

(1) A completed application in a form and in a medium prescribed by the director through the NMLS. See RCW 19.230.040 for the required contents of the application. In addition, the application must contain:

(a) ((The legal name, business and email address, and residential address, if applicable, of the applicant and any fictitious or trade name used by the applicant in conducting its business;

(b) The legal name, residential and business address, date of birth, Social Security number, employment history for the five-year period preceding the submission of the application of the applicant's proposed responsible individual, and documentation that the proposed responsible individual is a citizen of the United States or has obtained legal immigration status to work in the United States. In addition, the applicant must provide)) The fingerprints of the proposed responsible individual and a personal credit report from a recognized independent credit reporting agency on the proposed responsible individual;

(((c) For the ten-year period preceding submission of the application, a list of any criminal convictions of the proposed responsible individual of the applicant, any material litigation in which the applicant has been involved, and any litigation involving the proposed responsible individual relating to the provision of money services;

(e))) (b) A list of the applicant's proposed authorized delegates including the business name and any additional names by which the business may be known, the business address and name of the primary contact person for each authorized delegate, and the locations in this state where the applicant and its authorized delegates propose to engage in the provision of money services;

(((f) A list of other states in which the applicant is licensed to engage in money transmission, or provide other money services, and any license revocations, suspensions, restrictions, or other disciplinary action taken against the applicant in another state;

(k))) (c) A full description of the screening process used by the applicant in selecting authorized delegates, including a sample of any forms used, and the method used to screen for criminal history; and

(((l))) (d) Identification of the bank account established for the business including, but not limited to, the bank name, address, account number, and account type.

(2) If the applicant is a corporation, limited liability company, partnership, or other entity, the applicant must also provide:

(a) ((The date of the applicant's incorporation or formation and the state or country of incorporation or formation;

(d))) The legal name, any fictitious or trade name, all business and residential addresses, date of birth, Social Security number, and employment history in the ten-year period preceding the submission of the application for each ((executive officer, board director,)) AML compliance officer ((or other person that has control of the applicant));

(((e))) (b) If the applicant or its corporate parent is not a publicly traded entity, the fingerprints of each executive officer, board director, AML compliance officer or other person that has control of the applicant; and

(((f))) (c) A list of any criminal convictions, material litigation, and any litigation related to the provision of money services, in the ten-year period preceding the submission of the application in which any ((executive officer, board director,)) AML compliance officer ((or other person in control of the applicant)) has been involved((;

(ii) A corporation publicly traded outside the United States, a copy of similar documentation filed with the regulator of the parent corporation's domicile outside the United States;

(k) If the applicant has a registered agent in this state, the name and address of the applicant's registered agent in this state)).

(3) ((If the application is for money transmission, a)) Surety bonds as required by WAC 208-690-040 or ((an assignment of a certificate of deposit, as required by WAC 208-690-045)) 208-690-041.

(4) An application fee as prescribed by WAC 208-690-130(1). The application fee is not refundable. The director may require all fees to be paid through the NMLS.

(5) An additional license fee as prescribed by WAC 208-690-130(2).

(6) If the application is for money transmission, a certification that the applicant's investment portfolio, if maintained as permissible investments for outstanding transmission liabilities, includes only the permissible investments under RCW 19.230.200 and 19.230.210.

The director may waive one or more requirements of this section or permit an applicant to submit other information in lieu of the required information.

(1) Only a licensee may designate an authorized delegate.

(2) A person accepting consumers' funds for transmission through an exempt or excluded entity under RCW 19.230.020 is not an authorized delegate but is a money transmitter and must be licensed under the act.

(3) ((An authorized delegate, or any other person exempt or excluded from the licensing requirements of chapter 19.230 RCW, cannot have an authorized delegate.

(4))) Any person you designate to provide money services on your behalf is an authorized delegate, regardless of whether that person would be exempt or excluded from the application of chapter 19.230 RCW if they provided money services on their own behalf.

(((5))) (4) Your authorized delegates must be physically located in the state of Washington unless you have received prior approval from the director to designate an authorized delegate physically located outside of the state of Washington.

(((6))) (5) The licensee has supervisory authority over the actions of the authorized delegate when providing services on behalf of the licensee. The department may take action against a licensee and/or the authorized delegate for any actions by the authorized delegate on behalf of the licensee in violation of the act or rules.

(((7))) (6) A written contract between you and an authorized delegate must contain, among all the other contract provisions, provisions with language substantially similar to the following:

(a) The authorized delegate must operate in full compliance with chapter 19.230 RCW and the rules adopted under this chapter.

(b) The authorized delegate is prohibited from using subdelegates or conducting business from locations not authorized by the department.

(c) A description of the specific money services you authorize the delegate to perform on your behalf.

(((8))) (7) The authorized delegate may only conduct activities authorized by you in the written agreement, unless the authorized delegate is also a licensee.

(((9))) (8) You may contract with another licensee to use that other licensee's existing authorized delegates to load funds onto your existing open-loop ((stored value cards)) prepaid access product. If the shared authorized delegate sells new open-loop ((stored value cards)) prepaid access product for you, you must add the authorized delegate to your authorized delegate roster.

(((10))) (9) The authorized delegate must include the licensee's name along with the other applicable requirements of RCW 19.230.330(2) on any disclosures or receipts.

(((11))) (10) The licensee's bond covers the actions of the authorized delegate while the authorized delegate is providing money services on behalf of the licensee pursuant to the written contract.

(((12))) (11) You must maintain your authorized delegate agreements and contracts with other licensees to share existing authorized delegates as part of your books and records pursuant to RCW 19.230.170 and make them available to the department upon request.

(1) You must continuously maintain a surety bond as required by RCW 19.230.050, issued by a company authorized to do surety business in this state, as a surety. The surety may not be a wholly owned subsidiary or affiliate of the applicant or licensee.

(2) The penal sum of the bond must be calculated quarterly during the first year of licensing and thereafter annually. The calculation must be based on the previous twelve months' money transmission and payment instrument dollar volume. The bond amount must be calculated at ten thousand dollars for every one million dollars of money transmission and payment instrument dollar volume. The minimum surety bond amount is ten thousand dollars. The maximum surety bond amount is five hundred fifty thousand dollars.

(3) The initial bond amount will be ten thousand dollars and must be reevaluated based on the schedule set forth in subsection (2) of this section.

(4) ((The bond must be held for at least)) Depending on the financial services you provide, you may be required to hold the bond for up to five years after the date ((the licensee violates the chapter or the licensee)) you cease((s)) to provide money services in this state((, whichever is longer)).

(1) You must continuously maintain a surety bond as required by RCW 19.230.055, issued by a company authorized to do surety business in this state, as a surety. The surety may not be a wholly owned subsidiary or affiliate of the applicant or licensee.

(2) The penal sum of the bond must be calculated quarterly during the first year of licensing and thereafter annually. The calculation must be based on the previous twelve months' online currency exchange dollar volume. The bond amount must be calculated at ten thousand dollars for every one million dollars of currency exchange dollar volume. The minimum surety bond amount is ten thousand dollars. The maximum surety bond amount is fifty thousand dollars.

(3) The initial bond amount will be ten thousand dollars and must be reevaluated based on the schedule set forth in subsection (2) of this section.

(4) The bond must cover claims for at least one year after the date of an online currency exchanger licensee's violation of the chapter or the licensee ceases to provide online currency exchange services in this state, whichever is longer.

(5) The director may provide an alternative to a bond under certain circumstances.

Will the department ever require an increase in the amount of the surety bond ((or alternative))? The director may increase the amount of the surety bond ((or alternative)), to a maximum of one million dollars, if the financial condition of a money transmitter or online currency exchanger applicant or licensee so requires. The director may consider, without limitation, the following criteria:

(1) Significant reduction of net worth.

(2) Financial losses.

(3) Potential losses resulting from violations of chapter 19.230 RCW, or these rules.

(4) Licensee filing for bankruptcy.

(5) The initiation of any proceedings against the licensee in any state, by any federal agency, or in any foreign country. This includes the filing of material litigation.

(6) The filing of a state or federal criminal charge against the licensee, person in control, responsible individual, executive officer, board director, AML compliance officer, employee, authorized delegate or principal, based on conduct related to providing money services or money laundering.

(7) A licensee, executive officer, board director, AML compliance officer, other person in control, responsible individual, principal or authorized delegate being convicted of a crime.

(8) Any unsafe or unsound practice.

(9) A judicial or administrative finding against a money transmitter licensee under chapter 19.86 RCW, or an examination report finding that the money transmitter licensee engaged in an unfair or deceptive act or practice in the conduct of its business.

(10) The nature and volume of the projected or established business activities.

(11) Other events and circumstances that, in the judgment of the director, impair the ability of the licensee to meet its obligations to its money services customers.

(1) A money transmitter applicant or licensee must demonstrate and maintain tangible net worth calculated at ten thousand dollars for every one million dollars of total company-wide money transmission and payment instrument dollar volume over the previous twelve months. The minimum tangible net worth is ten thousand dollars; the maximum required amount is three million dollars.

(2) The minimum tangible net worth if the company ((stores)) provides virtual currency ((on behalf of others)) storage is one hundred thousand dollars. See the definition of virtual currency storage.

(3) The director may increase the amounts specified in subsections (1) and (2) of this section up to a maximum of three million dollars if the director determines that a higher net worth is necessary to achieve the purposes of this chapter based on the:

(a) Nature and volume of the projected or established business activities;

(b) Amount, nature, quality, and liquidity of the company's assets;

(c) Amount and nature of the company's liabilities;

(d) History of the company's operations and prospects for earning and retaining income;

(e) Quality of the company's operations;

(f) Quality of the company's management;

(g) Nature and quality of the company's principals, responsible individuals, and persons in control;

(h) History of the company's compliance with applicable state and federal law; and

(i) Any other factor the director considers relevant.

(4) Determinations of tangible net worth must be made according to generally accepted accounting principles.

(1) You are required to have an audited financial statement prepared annually by a licensed or certified individual or firm in accordance with generally accepted accounting principles. The financials must be submitted prior to or with the annual assessment. The financials may be submitted through the NMLS. The director may waive the requirements of this subsection for licensees with minimal or no business activity conducted under their license.

(2) Applicants with no business operations prior to application must submit a copy of unconsolidated financial statements for the current fiscal year, whether audited or not. Audited annual financial statements are required in all future years of operation.

(1) You must maintain permissible investment levels pursuant to RCW 19.230.200.

(2) In addition to the permissible investments allowed in RCW 19.230.210(2), a permissible investment may also include receivables from banks and credit cards.

(3) Monthly reports about permissible investments must include the monthly calculation of the average ((outstanding)) daily transmission liability. Average daily transmission liability means the sum of the daily amounts of a licensee's outstanding money transmission, as computed each day of the month divided by the number of days in the month.

What are the annual report and assessment requirements? Every licensee must submit a completed annual report and annual license assessment fee prescribed by WAC 208-690-140. The completed report and the fee must be received in the department office no later than 5:00 p.m. July 1, or 5:00 p.m. the next business day if July 1 is not a business day. A form for the preparation of the annual report and license assessment will be made available by the department by electronic transmission or mailed upon request. The report must include the following:

(1) If the licensee is a money transmitter, a copy of the licensee's most recent audited annual financial statement or, if the licensee is a wholly owned subsidiary of another corporation, the most recent audited consolidated annual financial statement of the parent company.

(2) ((A list of current)) Verification that authorized delegate((s in a form and in a medium prescribed by the director.)) information in the NMLS is current.

(3) If the licensee is a money transmitter, ((a certification)) verification that the ((licensee's investment portfolio includes only)) licensee meets permissible investment((s)) requirements under RCW 19.230.200 and 19.230.210 ((and covers average outstanding daily transmission liability)).

(4) If the licensee is a money transmitter((, proof)) or online currency exchanger, verification that the licensee has an adequate surety bond ((or assignment of a certificate of deposit and net worth)) as required by WAC 208-690-040 through ((208-690-060)) 208-690-050.

(5) ((A description of each)) Verification that material changes, as defined by WAC 208-690-110, ((which has not)) have been ((previously)) reported ((to the director.)) through the NMLS and are current.

(6) The annual report and assessment fee may be submitted through the NMLS.

(1) If you fail to submit the required annual report and annual assessment fee by July 1, each year, the director may suspend your license and assess a late fee. The late fee is ten percent of the annual assessment if ((paid)) submitted thirty or fewer days late and twenty-five percent of the annual assessment if ((paid)) submitted more than thirty days late. The annual report and annual assessment fee are not considered to be submitted until the date both have been submitted. If your license has been suspended under this section and you submit a completed annual report, the annual assessment and the late fee to the department office no later than 5:00 p.m., thirty calendar days after the original due date, the license suspension may be removed. If the delay extends past thirty days, your license has expired effective thirty-one days after the original due date.

(2) The director may reinstate an expired license under this section if, within twenty days after the license expiration, you:

(a) File the complete annual report and pay both the annual license assessment and the late fee; and

(b) You or your delegates did not engage in providing money services during the period the license was expired.

(3) If any of the deadlines in this section occur on a day that is not a business day, the deadline shall be the next business day.

(1) The annual assessment is calculated by multiplying 0.0004 by the previous year's adjusted Washington volume of money transmission, currency exchange, prepaid access sales, and payment instrument sales, with a minimum assessment of one thousand dollars and a maximum assessment of one hundred thousand dollars.

For purposes of this section, "adjusted Washington volume" means:

(a) For money transmission, ninety-five percent of all funds transmitted;

(b) For currency exchange, five percent of all currency exchanged;

(c) For prepaid access sales, ninety-five percent of all funds loaded onto open-loop prepaid access; and

(d) For payment instrument sales, seventy percent of the first ten million dollars of payment instrument sales, twenty percent of the volume over ten million through five hundred million dollars, and one percent of any amount over five hundred million dollars.

(2) The annual assessment is due no later than 5:00 p.m. July 1st each year or the next business day if July 1st is not a business day.

(3) If thirty days after the due date the annual assessment or any late fee for failure to report or pay the annual assessment is not paid, the department may make a claim against the surety bond.

You are required to file accurate and complete call reports on the dates and in a form prescribed by the NMLS.

What must I report to the department if something about my business changes? Material changes described in this section must be reported to the director through the NMLS within thirty ((business)) days of the occurrence of the change. "Material change" means any change that is not trivial, and that, if not reported, would cause an investigation or examination to be misled or delayed. Such changes include, but are not limited to:

(1) A change of the licensee's physical, mailing, or email address. Additionally, a change to the physical, mailing, or emailing address of authorized delegates;

(2) A change of the responsible individual, AML compliance officer, executive officers or board members, or other person in control;

(3) A change of the licensee's name or DBA (doing business as);

(4) A change in the location where the records of the licensee that are required to be retained under RCW 19.230.170 are kept;

(5) The obtaining, revocation or surrender of a money services license in any other jurisdiction;

(6) The conviction of the licensee, an executive officer, responsible individual, board director, AML compliance officer, principal, or other person in control of a misdemeanor or gross misdemeanor involving a financial transaction;

(7) A change in your business bank account including its closure or a change in the location or identity of the bank holding the account;

(8) A change in the business plan from that submitted at application; ((and))

(9) Other similar activities or events affecting the business or executive officers or other persons in control((.));

(10) ((Other. Within forty-five days of a)) Changes of control. See WAC 208-690-115; and

(11) Data breach ((you must notify the director in writing)). This notification requirement may change based on directives or recommendations from law enforcement. See also WAC 208-690-270.

What fees must I pay to make changes to my license?

(1) You must pay fifty dollars to add an authorized delegate to your ((quarterly)) roster of authorized delegates. The fee for adding authorized delegates is capped at five thousand dollars per quarter.

(2) You must pay thirty dollars for the following changes to your license:

(a) Change of physical address, name or trade name (DBA or doing business as);

(b) Request for approval of a change in control;

(c) Change of the responsible individual or AML compliance officer;

(d) Addition of principal, executive officer, board member, or other person in control; or

(e) Change in registered agent.

(3) Transaction fees are separate, distinct from, and in addition to investigation and examination fees under WAC 208-690-170.

(1) When may the department examine or investigate my business? ((For the purposes of discovering violations of chapter 19.230 RCW or these rules, discovering unsafe and unsound practices, or securing information lawfully required under chapter 19.230 RCW, the director may at any time, either personally or by designee, investigate or examine your business and, wherever located, the books, accounts, records, papers, documents, files, and other information used in your business or authorized delegates, and of every person who is engaged in the business of providing money services, whether the person acts or claims to act under or without the authority of chapter 19.230 RCW. For these purposes, the director or designated representative must have free access to the offices and places of business, books, accounts, papers, documents, other information, records, files, safes, and vaults of all such persons. The director may require the attendance of and examine under oath all persons whose testimony may be required about the business or the subject matter of any investigation, examination, or hearing and may require such person to produce books, accounts, papers, documents, records, files and any other information the director or designated person declares is relevant to the inquiry. The director may require the production of original books, accounts, papers, documents, records, files, and other information; may require that such original books, accounts, papers, documents, records, files, and other information be copied; or make copies himself or herself or by designee of such original books, accounts, papers, documents, records, files, or other information.)) See RCW 19.230.130(1).

(2) If the director determines that there is a danger that original records may be destroyed, altered, or removed to deny access, or hinder an examination or investigation, or that original documents are necessary for the preparation of a criminal referral, the director may take possession of originals of any items described in this section, regardless of the source of such items. Originals and copies taken by the director may be held, returned, or forwarded to other regulatory or law enforcement officials as determined necessary by the director((. The director or designated person may issue a subpoena or subpoena duces tecum requiring attendance or compelling production of the books, accounts, papers, documents, records, files, or other information)).

(((2))) (3) The licensee, applicant, or person subject to licensing under this chapter must pay the cost of examinations and investigations as specified in RCW 19.230.320 and WAC 208-690-170.

(((3) Information obtained during an examination or investigation under these rules may be disclosed only as provided in RCW 19.230.190.))

(4) The director may retain attorneys, accountants, or other professionals and specialists as examiners, auditors or investigators, to conduct or assist in the conduct or examinations or investigations. The cost of these services must be borne by the person who is the subject of the examination or investigation.

PART G

RECEIPTS AND DISCLOSURES

(1) For general money transmission transactions, the receipt must include your name, physical or mailing address, and phone number in addition to the fee and exchange rate disclosure information as required by RCW 19.230.330 (2)(a). A web site address may be used in lieu of a physical or mailing address for transactions conducted solely over the internet.

(2) For ((stored value)) prepaid access transactions the receipt may include the name, address, and telephone number of the authorized delegate, provided that your contact information is provided in or on the ((stored value device)) prepaid access packaging or on the ((stored value device itself)) prepaid access product.

(3) For bill payment transactions, the receipt may include the name, address, and telephone number of the authorized delegate; provided your name accompanies the authorized delegate's information on the receipt.

(1) Disclosures may be provided electronically.

(2) For all transactions. You must disclose to the consumer prior to the transaction that fraudulent transactions may result in the loss of their money with no recourse.

(3) For virtual currency transactions. When applicable, you must make the following disclosures in a clear and conspicuous manner:

(a) A schedule of all fees and charges you may assess on a transaction, how the fees and charges will be calculated if not set in advance and disclosed, and the timing of the fees and charges.

(b) Whether the product or service provided is insured or guaranteed by an agency of the United States, such as the federal deposit insurance corporation or the securities investor protection corporation or by private insurance against theft or loss, including cyber theft or theft by other means.

(c) A notice that the transfer of virtual currency or digital units is irrevocable and any exception to the irrevocability of transfer.

(d) A notice describing your liability for unauthorized, mistaken, or accidental transfers and, describing the consumer's responsibility for providing notice of such mistake to you, and the general error-resolution rights applicable to any transaction.

(e) A disclosure prior to the transaction that informs the consumer that the nature of virtual currency may lead to an increased risk of fraud or cyber attack and the consumer's virtual currency value may be irretrievably stolen. See also WAC 208-690-270.

(f) The disclosures required in (a) through (e) of this subsection may be disclosed together but must be disclosed separately from any other information required.

(4) For currency exchange transactions. If the currency being sought has limited convertibility, you must provide a disclosure to the consumer indicating the limited convertibility.

Each licensee shall establish and maintain ((a cyber)) an information security program to ensure the availability and functionality of the licensee's electronic systems and to protect those systems and any sensitive data stored on those systems from unauthorized access, use, or tampering. The program may be established and maintained by a parent or affiliate as long as the licensee has adopted the program and it is available to the department for review.

(1) Generally, applicants and licensees must have a written program appropriate to the company's size and complexity, the activity conducted, and the sensitivity of information at issue. The program must ensure the information's security and confidentiality, protect against anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of the information.

(2) The information security plan must be maintained as part of your books and records.

(3) ((Compliance with GLBA and Regulation P, 12 C.F.R. Part 1016, will be deemed compliance with this subsection.

(4))) For more information access the FTC web site on the Safeguards Rule at: https://www.ftc.gov/tips-advice/business-center/guidance/financial-institutions-customer-information-complying and see 16 C.F.R. 314.

You must have a written plan that details the company's response and recovery to any event that results in damage to or destruction of books and records or a data breach. The plan must be maintained as part of your books and records.