Is a crypto-asset provider, in Texas

7 Tex. Admin. Code sec. 17.5 · Read the law's page

• This binds a Texas state trust company, other than one exempt under Finance Code section 182.011; declare provides_financial_services if your organization is one.
• Notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice to another state or federal regulator or a self-regulatory body, require a data breach notification to clients or beneficiaries under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect or report transactions or conduct your business.
• Include in the confidential notice, to the extent known, a description of the incident with its approximate date, discovery date and the data involved, a list of the regulators and bodies notified, and the name, address, telephone number and email address of an employee or agent who can give more information.
• Build the notice requirement into the written incident response plan you maintain as part of your information security program.

7 Tex. Admin. Code sec. 33.30 · Read the law's page

• This binds a holder of a money transmission or currency exchange license issued under Finance Code chapter 152; declare provides_financial_services if your organization holds one.
• Notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice or report to another state or federal regulatory or law enforcement agency or a self-regulatory body, require a data breach notification to customers under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect transactions for customers, report transactions accurately, or conduct your business.
• Include in the notice, to the extent known, a description of the incident with its approximate date, discovery date and the data involved, a list of the regulators and bodies notified (leaving out any suspicious activity report), and the name, address, telephone number and email address of your employee or agent who can give more information.
• Build the notice requirement into the written incident response plan you maintain as part of your information security program.