Law / United States / 
Mississippi
Data Security for Money Transmitters Act, notice of a notification event to the Commissioner
Data Security for Money Transmitters Act, section 5, House Bill 1596 (2026)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a licensee under the Data Security for Money Transmitters Act, which you declare by stating that you are a payment provider (a money transmitter) or a crypto-asset provider (a virtual currency kiosk): a money transmitter or virtual currency kiosk licensed under Mississippi's Money Transmission Modernization Act.
- Notify the Commissioner of Banking and Consumer Finance as soon as possible, and no later than 72 hours after discovery, of a notification event (the acquisition of unencrypted customer information without the authorization of the affected individual) that involves the information of any consumers in Mississippi, in the format the Commissioner specifies.
- Include in the notice your name and contact information, the types of information involved, the date or date range of the event if it can be determined, the number of consumers affected or potentially affected, a general description of the event, and whether a law enforcement official has determined in writing that public notice would impede a criminal investigation or damage national security.
- Treat an event as discovered on the first day it is known to you, which includes knowledge of any of your employees, officers or other agents other than the person committing the event.
- If a notification event occurs in a system a service provider maintains, treat it as you would under the 72-hour notice requirement, with your deadlines running from the day after the service provider notifies you or you otherwise have actual knowledge, whichever is sooner.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Banking and Consumer Finance, who may take action that is necessary or appropriate to enforce the Act when the Commissioner has reason to believe a licensee has violated it (section 7(2)).
What this law does
A notification event is the acquisition of unencrypted customer information without the authorization of the affected individual. Upon discovery of a notification event involving the information of any consumers in Mississippi, the licensee shall notify the commissioner as soon as possible, but in no event later than seventy-two hours after discovery.
The notice shall be made in a format specified by the commissioner and include six listed items of information, beginning with the name and contact information of the reporting licensee. A law enforcement official may request an initial delay of up to thirty days following the date when notice was provided to the commissioner. A licensee that becomes aware of a notification event in a system maintained by a service provider shall treat the event as it would under the notice subsection.
When LexLint raises it
When your app profile says your app is a payment provider or is a crypto-asset provider.