Law / United States / 
Mississippi
Data Security for Money Transmitters Act, licensee information security program
Data Security for Money Transmitters Act, sections 2 to 4 and 6, House Bill 1596 (2026)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under the Data Security for Money Transmitters Act, which you declare by stating that you are a payment provider (a money transmitter) or a crypto-asset provider (a virtual currency kiosk): a money transmitter or virtual currency kiosk licensed under Mississippi's Money Transmission Modernization Act.
- Develop, implement and maintain a comprehensive, written information security program with administrative, technical and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
- Designate a qualified individual, who may be employed by you, an affiliate or a service provider, to oversee, implement and enforce the program; you remain responsible for compliance, and you must designate a senior member of your personnel to direct and oversee that individual if the individual works for an affiliate or service provider.
- Base the program on a written risk assessment, and periodically perform additional risk assessments that reexamine the risks and reassess the sufficiency of your safeguards.
- Design and implement safeguards that include access controls, encryption of all customer information in transit over external networks and at rest (or effective alternative compensating controls approved by your qualified individual where encryption is infeasible), secure development practices, multi-factor authentication for anyone accessing an information system unless your qualified individual approves in writing a reasonably equivalent or more secure control, change management procedures, and monitoring and logging of authorized users' activity.
- Securely dispose of customer information in any format no later than two years after it was last used to provide a financial product or service to the customer, unless it is necessary for business operations or other legitimate business purposes, required to be retained by law, or targeted disposal is not reasonably feasible; periodically review your data retention policy.
- Test or monitor the effectiveness of your safeguards; absent effective continuous monitoring, conduct annual penetration testing of your information systems and vulnerability assessments at least every six months and whenever there are material changes to your operations or circumstances that may materially affect the program.
- Provide security awareness training, use qualified information security personnel, and take reasonable steps to select and retain service providers that can maintain appropriate safeguards, requiring them by contract to implement those safeguards and periodically assessing them.
- Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in your control, and a written business continuity and disaster recovery plan.
- Have your qualified individual report in writing at least annually to your board of directors or equivalent governing body (or, if none exists, a senior officer responsible for the program) on the status of the program, your compliance and material matters.
- If you maintain customer information concerning fewer than 5,000 consumers, the risk assessment writing requirement, the testing requirement, the incident response plan requirement and the annual board report requirement do not apply to you.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Banking and Consumer Finance, who may take action that is necessary or appropriate to enforce the Act when the Commissioner has reason to believe a licensee has violated it (section 7(2)).
What this law does
The Data Security for Money Transmitters Act defines a licensee as a money transmitter or virtual currency kiosk licensed under the Money Transmission Modernization Act. A licensee shall develop, implement and maintain a comprehensive information security program. A licensee shall designate a qualified individual to be responsible for implementing, overseeing and enforcing its information security program.
A licensee shall protect by encryption all customer information held or transmitted by the licensee, both in transit over external networks and at rest. A licensee shall implement multi-factor authentication for an individual accessing an information system, unless its qualified individual has approved in writing the use of reasonably equivalent or more secure access controls.
A licensee shall develop procedures for the secure disposal of customer information in any format no later than two years after the last date the information was used in connection with the provision of a financial product or service to the customer, subject to three listed exceptions. Absent effective continuous monitoring, a licensee shall conduct annual penetration testing of its information systems.
A licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in its control. The qualified individual shall report in writing, at least annually, to the licensee's board of directors or equivalent governing body.
A licensee that maintains customer information concerning fewer than five thousand consumers is exempt from several of the program duties. The Act takes effect .
When LexLint raises it
When your app profile says your app is a payment provider or is a crypto-asset provider.