Law / United States / 
Washington
Regulation of money services providers: information security program and business resumption plan
WAC 208-690-240, 208-690-250 and 208-690-280
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds a licensee under the Uniform Money Services Act, chapter 19.230 RCW: a person licensed to engage in money transmission or currency exchange, and a person who fails to obtain a license the chapter requires; declare provides_financial_services if your organization is one. The written-program duty in section 208-690-250 also binds an applicant.
- Establish and maintain an information security program to ensure the availability and functionality of your electronic systems and to protect those systems and any sensitive data stored on them from unauthorized access, use, or tampering. A parent or affiliate may establish and maintain the program as long as you have adopted it and it is available to the Department of Financial Institutions for review.
- Have a written program appropriate to your size and complexity, the activity you conduct, and the sensitivity of the information at issue, that ensures the information's security and confidentiality, protects against anticipated threats or hazards to its security or integrity, and protects against unauthorized access to or use of it, and keep the written plan as part of your books and records.
- Keep, as part of your books and records, a written plan that details your response and recovery to any event that results in damage to or destruction of books and records or a data breach.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
RCW 19.230.290: a civil penalty not to exceed $100 per violation per day for each day the violation is outstanding, plus the state's costs and expenses for the investigation and prosecution of the matter, including reasonable attorneys' fees, for a violation of the chapter or a rule adopted under it.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 100
Over one month of continuous breach, USD 3,044.
Who enforces it
Enforcement body
The director of financial institutions, who may assess a civil penalty under RCW 19.230.290 against a licensee that violates the chapter or a rule adopted under it.
What this law does
Each licensee must establish and maintain an information security program to ensure the availability and functionality of its electronic systems and to protect those systems and any sensitive data stored on them from unauthorized access, use, or tampering. Generally, applicants and licensees must have a written program appropriate to the company's size and complexity, the activity conducted, and the sensitivity of the information at issue.
The program must ensure the information's security and confidentiality, protect against anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of the information. A licensee must have a written plan that details the company's response and recovery to any event that results in damage to or destruction of books and records or a data breach. A licensee is a person licensed under chapter 19.230 RCW.
When LexLint raises it
When your app profile says your app provides financial services.