Law / United States / 
Texas
Texas money services business regulation, notice of a cybersecurity incident to the banking commissioner
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=7&pt=2&ch=33&rl=30In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a holder of a money transmission or currency exchange license issued under Finance Code chapter 152; declare provides_financial_services if your organization holds one.
- Notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice or report to another state or federal regulatory or law enforcement agency or a self-regulatory body, require a data breach notification to customers under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect transactions for customers, report transactions accurately, or conduct your business.
- Include in the notice, to the extent known, a description of the incident with its approximate date, discovery date and the data involved, a list of the regulators and bodies notified (leaving out any suspicious activity report), and the name, address, telephone number and email address of your employee or agent who can give more information.
- Build the notice requirement into the written incident response plan you maintain as part of your information security program.
These lines are LexLint's reading of the law's text, as of .
What this law does
A holder of a money transmission or currency exchange license issued under Finance Code chapter 152 must notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days following its determination that a cybersecurity incident regarding its information system will likely trigger a listed consequence.
The listed consequences are a required notice to another regulator or law enforcement agency, a data breach notification to customers, or a substantive impact on its ability to effect or report transactions or conduct its business. "You" in section 33.30 means a holder of a money transmission or currency exchange license issued under Finance Code chapter 152.
The notice must include, to the extent known, a description of the incident, a list of the regulators notified, and the name and contact details of an employee or agent from whom additional information may be obtained. The notice requirement must be incorporated into the written incident response plan the licensee maintains as part of its information security program. Section 33.30 was adopted to be effective , and amended to be effective .
When LexLint raises it
When your app profile says your app provides financial services.