Is a payment provider, in Mississippi

Data Security for Money Transmitters Act, section 5, House Bill 1596 (2026) · Read the law's page

• Applies to a licensee under the Data Security for Money Transmitters Act, which you declare by stating that you are a payment provider (a money transmitter) or a crypto-asset provider (a virtual currency kiosk): a money transmitter or virtual currency kiosk licensed under Mississippi's Money Transmission Modernization Act.
• Notify the Commissioner of Banking and Consumer Finance as soon as possible, and no later than 72 hours after discovery, of a notification event (the acquisition of unencrypted customer information without the authorization of the affected individual) that involves the information of any consumers in Mississippi, in the format the Commissioner specifies.
• Treat unauthorized access to unencrypted customer information as an acquisition unless you have reliable evidence that there has not been, or could not reasonably have been, unauthorized acquisition, and treat customer information as unencrypted if its encryption key was accessed by an unauthorized person.
• Include in the notice your name and contact information, the types of information involved, the date or date range of the event if it can be determined, the number of consumers affected or potentially affected, a general description of the event, and whether a law enforcement official has determined in writing that public notice would impede a criminal investigation or damage national security.
• Treat an event as discovered on the first day it is known to you, which includes knowledge of any of your employees, officers or other agents other than the person committing the event.
• If a notification event occurs in a system a service provider maintains, treat it as you would under the 72-hour notice requirement, with your deadlines running from the day after the service provider notifies you or you otherwise have actual knowledge, whichever is sooner.

Data Security for Money Transmitters Act, sections 2 to 4 and 6, House Bill 1596 (2026) · Read the law's page

• Applies to a licensee under the Data Security for Money Transmitters Act, which you declare by stating that you are a payment provider (a money transmitter) or a crypto-asset provider (a virtual currency kiosk): a money transmitter or virtual currency kiosk licensed under Mississippi's Money Transmission Modernization Act.
• Develop, implement and maintain a comprehensive, written information security program with administrative, technical and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
• Designate a qualified individual, who may be employed by you, an affiliate or a service provider, to oversee, implement and enforce the program; you remain responsible for compliance, and you must designate a senior member of your personnel to direct and oversee that individual if the individual works for an affiliate or service provider, and you must require that affiliate or service provider to maintain an information security program that protects you as the Act requires.
• Base the program on a written risk assessment, and periodically perform additional risk assessments that reexamine the risks and reassess the sufficiency of your safeguards.
• Design and implement safeguards that include access controls, encryption of all customer information in transit over external networks and at rest (or effective alternative compensating controls approved by your qualified individual where encryption is infeasible), secure development practices for in-house applications and procedures for evaluating, assessing or testing the security of externally developed applications you use to transmit, access or store customer information, multi-factor authentication for anyone accessing an information system unless your qualified individual approves in writing a reasonably equivalent or more secure control, change management procedures, and monitoring and logging of authorized users' activity.
• Securely dispose of customer information in any format no later than two years after it was last used to provide a financial product or service to the customer, unless it is necessary for business operations or other legitimate business purposes, required to be retained by law, or targeted disposal is not reasonably feasible; periodically review your data retention policy.
• Test or monitor the effectiveness of your safeguards; absent effective continuous monitoring, conduct annual penetration testing of your information systems and vulnerability assessments at least every six months and whenever there are material changes to your operations or circumstances that may materially affect the program.
• Provide security awareness training, use qualified information security personnel, and take reasonable steps to select and retain service providers that can maintain appropriate safeguards, requiring them by contract to implement those safeguards and periodically assessing them.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in your control, and a written business continuity and disaster recovery plan.
• Have your qualified individual report in writing at least annually to your board of directors or equivalent governing body (or, if none exists, a senior officer responsible for the program) on the status of the program, your compliance and material matters.
• If you maintain customer information concerning fewer than 5,000 consumers, the requirement that the risk assessment be written and include the listed criteria, the continuous monitoring or penetration testing and vulnerability assessment requirement, the incident response plan requirement and the annual board report requirement do not apply to you.