Money Services Act (Ark. Code § 23-55-101 et seq.), compiled, effective August 5, 2025 (Part 1 of 2)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
MONEY SERVICES ACT
EFFECTIVE AUGUST 5, 2025
Published By:
ARKANSAS SECURITIES DEPARTMENT
1 Commerce Way
Suite 402
Little Rock, Arkansas 72202
Table of Contents
ARTICLE 1 General Provisions 1
23-55-101. Short title. 1
23-55-102. Definitions. 1
23-55-103. Exclusions. 6
23-55-104. Administration and rules. 8
ARTICLE 2 Money Transmission Licenses 9
23-55-201. License required. 9
23-55-202. Application for license. 9
23-55-203. [Repealed.]
23-55-204. Surety bonds. 14
23-55-205. Issuance of license. 15
23-55-206. Renewal of license. 17
23-55-207. Net worth. 17
ARTICLE 3 [Reserved]
ARTICLE 4 Currency Exchange Licenses 19
23-55-401. License required. 19
23-55-402. Application for license. 19
23-55-403. Issuance of license. 20
23-55-404. Renewal of license 22
ARTICLE 5 Authorized Delegates 23
23-55-501. Relationship between licensee and authorized delegate. 23
23-55-502. Unauthorized activities. 24
23-55-503. Training materials provided to authorized delegates. 24
ARTICLE 6 Examinations — Reports — Records 25
23-55-601. Authority to conduct examinations and investigations. 25
23-55-602. Cooperation. 27
23-55-603. Reports. 27
23-55-604. Acquisition of control. 29
23-55-605. Records. 33
23-55-606. Anti-money laundering program and reports. 34
23-55-607. Confidentiality. 35
23-55-608. Disclosure requirements. 38
23-55-609. Policy and procedure — Physical security and cybersecurity. 39
23-55-610. Timely transmission. 39
i
23-55-611. Refunds. 39
23-55-612. Receipts. 40
ARTICLE 7 Permissible Investments 43
23-55-701. Maintenance of permissible investments. 43
23-55-702. Types of permissible investments. 44
ARTICLE 8 Enforcement 50
23-55-801. Suspension and revocation. 50
23-55-802. Suspension and revocation of authorized delegates. 51
23-55-803. Orders to cease and desist. 52
23-55-804. Consent orders. 52
23-55-805. Civil penalties. 52
23-55-806. Criminal penalties. 53
23-55-807. Unlicensed persons. 53
23-55-808. Receivership. 54
ARTICLE 9 Administrative Procedures 55
23-55-901. Administrative proceedings. 55
23-55-902. Hearings. 55
ARTICLE 10 Miscellaneous Provisions 56
23-55-1001. Uniformity of application and construction. 56
23-55-1002. Severability clause. 56
23-55-1003. Effective date. 56
23-55-1004. [Reserved.]
23-55-1005. [Repealed.]
23-55-1006. [Repealed.]
23-55-1007. Multistate automated licensing system. 57
23-55-1008. Virtual currency kiosk requirements. 57
ARTICLE 11 Data Security for Money Services 65
23-55-1101. Definitions. 65
23-55-1102. Standards for safeguarding customer information. 70
23-55-1103. Information security program required elements. 70
23-55-1104. Exceptions. 77
ii
ARTICLE 1 General Provisions
23-55-101. Short title.
23-55-102. Definitions.
23-55-103. Exclusions.
23-55-104. Administration and rules.
23-55-101. Short title.
This chapter may be cited as the Uniform Money Services Act.
History. Acts 2007, No. 1595, § 1.
23-55-102. Definitions.
In this chapter:
(1) “Applicant” means a person that files an application for a license under this
chapter.
(2) “Authorized delegate” means a person a licensee designates to provide money
services on behalf of the licensee.
(3) “Bank” means an institution organized under federal or state law which:
(A) accepts demand deposits or deposits that the depositor may use for
payment to third parties and engages in the business of making
commercial loans; or
(B) engages in credit card operations and maintains only one office that
accepts deposits, does not accept demand deposits or deposits that the
depositor may use for payments to third parties, does not accept a savings
or time deposit less than $100,000, and does not engage in the business of
making commercial loans.
(4) “Commissioner” means the Securities Commissioner.
(5) (A) “Control” means:
(i) the power to vote, directly or indirectly, at least 25 percent of a
class of voting securities or voting interests of a licensee or person
in control of a licensee;
(ii) power to elect or appoint a majority of key individuals or executive
officers, managers, directors, trustees, or other persons exercising
1
managerial authority of a licensee or person in control of a
licensee; or
(iii) the power to exercise directly or indirectly, a controlling influence
over the management or policies of a licensee or person in control
of a licensee.
(B) (i) A person:
(a) is presumed to exercise a controlling influence if the person
holds the power to vote, directly or indirectly, at least 10
percent of the outstanding voting shares or voting interests
of a licensee or person in control of a licensee; and
(b) that is presumed to exercise a controlling influence may
rebut the presumption of control if the person is a passive
investor.
(ii) For purposes of determining the percentage of a person controlled
by any other person, the person's interest shall be aggregated with
the interest of any other immediate family member, including
without limitation the person's spouse, parents, children, siblings,
mothers-in law, fathers-in law, sons-in law, daughters-in law,
brothers-in law, sisters-in law, and any other person who shares the
person's home.
(6) “Currency exchange” means receipt of revenues from the exchange of money of
one government for money of another government.
(7) “Elder adult” means a person who is 60 years of age or older.
(8) “Existing customer” means a consumer who:
(A) is engaging in a transaction at a virtual currency kiosk in the state; and
(B) has been registered for more than 72 hours as a customer of the:
(i) owner of the virtual currency kiosk; or
(ii) virtual currency kiosk operator.
(9) “Executive officer” means a president, chairperson of the executive committee,
chief financial officer, responsible individual, or other individual who performs
similar functions.
(10) “Key individual” means an individual who is ultimately responsible for
establishing or directing policies and procedures of a licensee, including without
limitation an executive officer, manager, director, or trustee.
(11) “Licensee” means a person licensed under this chapter.
2
(12) “Monetary value” means a medium of exchange, whether or not redeemable in
money.
(13) “Money” means a medium of exchange that is authorized or adopted by the
United States or a foreign government. The term includes a monetary unit of
account established by an intergovernmental organization or by agreement
between two or more governments.
(14) “Money services” means money transmission or currency exchange.
(15) (A) “Money transmission” means any of the following:
(i) selling or issuing payment instruments to a person located in this
state;
(ii) selling or issuing stored value to a person located in this state;
(iii) facilitating, selling, trading, transferring, or converting virtual
currency or monetary value in this state; or
(iv) receiving money for transmission from a person located in this
state.
(B) “Money transmission” does not include:
(i) providing:
(a) online services;
(b) telecommunication services;
(c) network access;
(d) delivery services such as courier or package delivery
services; or
(ii) acting as a mere conduit for the transmission of data.
(16) (A) “Money transmission kiosk” or “virtual currency kiosk” means an
automated, unstaffed electronic machine that allows users to engage in
money transmission, including any machine that is capable of accepting or
dispensing cash in exchange for virtual currency.
(B) “Money transmission kiosk” or “virtual currency kiosk” does not
include consumer cellular telephones and other similar personal devices.
(17) “New customer” means a consumer who:
(A) is engaging in a transaction at a virtual currency kiosk in this state; and
(B) has been registered for less than 72 hours as a customer of the:
3
(i) owner of the virtual currency kiosk; or
(ii) virtual currency kiosk operator.
(18) “Outstanding,” with respect to a payment instrument, means issued or sold by or
for the licensee and reported as sold but not yet paid by or for the licensee.
(19) “Passive investor” means a person that:
(A) does not have the power to elect:
(i) a majority of key individuals;
(ii) a majority of executive officers, managers, directors, or trustees; or
(iii) other persons exercising managerial authority of a person in
control of a licensee;
(B) is not employed by and does not have any managerial duties of the
licensee or person in control of a licensee;
(C) does not have the power to exercise, directly or indirectly, a controlling
influence over the management or policies of a licensee or person in
control of a licensee; and
(D) either:
(i) attests to subdivisions (19)(A)-(C), in a form and in a medium
prescribed by the commissioner; or
(ii) commits to the passivity characteristics of subdivisions (19)(A)-
(C), in a written document.
(20) “Payment instrument” means a written or electronic check, draft, money order,
traveler's check, or other written or electronic instrument for the transmission or
payment of money or monetary value, whether or not negotiable. The term does
not include stored value or any instrument that:
(A) is redeemable by the issuer only for goods or services provided by the
issuer or its affiliate or franchisees of the issuer or its affiliate, except to
the extent required by applicable law to be redeemable in cash for its cash
value; or
(B) is not sold to the public but issued and distributed as part of a loyalty,
rewards, or promotional program.
(21) “Person” means an individual, corporation, business trust, estate, trust,
partnership, limited liability company, association, joint venture, government;
governmental subdivision, agency or instrumentality; public corporation; or any
other legal or commercial entity.
4
(22) “Record” means information that is inscribed on a tangible medium or that is
stored in an electronic or other medium and is retrievable in perceivable form.
(23) “State” means a State of the United States, the District of Columbia, the
Commonwealth of Puerto Rico, the United States Virgin Islands, or any territory
or insular possession subject to the jurisdiction of the United States.
(24) (A) “Stored value” means monetary value representing a claim against the
issuer evidenced by an electronic or digital record, and that is intended and
accepted for use as a means of redemption for money or monetary value,
or payment for goods or services.
(B) “Stored value” includes without limitation prepaid access as defined by
31 C.F.R. § 1010.100, as it existed on January 1, 2023.
(C) “Stored value” does not include a payment instrument or closed loop
stored value or stored value not sold to the public but issued and
distributed as part of a loyalty, rewards, or promotional program.
(25) “Tangible net worth” means the aggregate assets of a licensee excluding all
intangible assets, less liabilities, as determined according to generally accepted
accounting principles.
(26) “Unique identifier” means a number or other identifier that is assigned by a
protocol established by the automated licensing system approved by the
commissioner.
(27) “Unsafe or unsound practice” means a practice or conduct by a person licensed
to engage in money transmission or an authorized delegate of such a person which
creates the likelihood of material loss, insolvency, or dissipation of the licensee's
assets, or otherwise materially prejudices the interests of its customers.
(28) (A) “Virtual currency” means a digital representation of value that:
(i) is used as a medium of exchange, a unit of account, or a store of
value; and
(ii) does not have legal tender status as recognized by the United
States Department of the Treasury.
(B) “Virtual currency” does not include the software or protocols governing
the transfer of a digital representation of value or other uses of a virtual
distributed ledger system to verify ownership or authenticity in a digital
capacity when the virtual currency is not used as a medium of exchange.
(29) “Virtual currency kiosk operator” means a person that engages in virtual
currency business activity through a money transmission kiosk located in this
state or a person that owns, operates, or manages a money transmission kiosk
located in this state through which virtual currency business activity is offered.
5
(30) “Virtual currency storage” means:
(A) maintaining possession, custody, or control over virtual currency on behalf
of another person, including as a virtual currency control-services vendor;
(B) issuing, transferring, or otherwise granting or providing to any person in
this state any claim or right or any physical, digital, or electronic
instrument, receipt, certificate, or record representing any claim or right to
receive, redeem, withdraw, transfer, exchange, or control any virtual
currency or amount of virtual currency; or
(C) receiving possession, custody, or control over virtual currency from a
person in this state in return for a promise or obligation to return, repay,
exchange, or transfer such virtual currency or a like amount of such virtual
currency.
(31) “Virtual currency wallet” means a software application or other mechanism
providing a means for holding, storing, and transferring virtual currency.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, §§ 1-3; 2011, No. 733, § 1; 2013, No. 531,
§ 1; 2021, No. 532, §§ 1-3; 2023, No. 442, § 1; 2025, No. 557, § 1.
23-55-103. Exclusions.
This chapter does not apply to:
(1) the United States or a department, agency, or instrumentality thereof;
(2) money transmission by the United States Postal Service or by a contractor on
behalf of the United States Postal Service;
(3) a state, county, city, or any other governmental agency or governmental
subdivision of a State;
(4) a bank, bank holding company, office of an international banking corporation,
branch of a foreign bank, corporation organized pursuant to the Bank Service
Company Act, 12 U.S.C. §§ 1861-1867 (Supp. V 1999), or corporation organized
under the Edge Act, 12 U.S.C. §§ 611-633 (1994 & Supp. V 1999) under the laws
of a State or the United States if it does not issue, sell, or provide payment
instruments, stored value, prepaid access, or virtual currency through an
authorized delegate that is not such a person;
(5) electronic funds transfer of governmental benefits for a federal, state, county, or
governmental agency by a contractor on behalf of the United States or a
department, agency, or instrumentality thereof, or a State or governmental
subdivision, agency, or instrumentality thereof;
6
(6) a board of trade designated as a contract market under the federal Commodity
Exchange Act, 7 U.S.C. §§ 1-25 (1994), or a person that, in the ordinary course of
business, provides clearance and settlement services for a board of trade to the
extent of its operation as or for such a board;
(7) a registered futures commission merchant under the federal commodities laws to
the extent of its operation as such a merchant;
(8) a person that provides clearance or settlement services pursuant to a registration
as a clearing agency or an exemption from such registration granted under the
federal securities laws to the extent of its operation as such a provider;
(9) an operator of a payment system to the extent that it provides processing, clearing,
or settlement services, between or among persons excluded by this section, in
connection with wire transfers, credit card transactions, debit card transactions,
stored-value transactions, automated clearing house transfers, similar funds
transfers, prepaid access, or virtual currency;
(10) a person registered as a securities broker-dealer under federal or state securities
laws to the extent of its operation as such a broker-dealer;
(11) a credit union regulated and insured by the National Credit Union Administration;
(12) an agent appointed by a payee to collect and process payment as the agent of the
payee, if the agent can demonstrate that:
(A) there exists a written agreement between the payee and the agent directing
the agent to collect and process payments on behalf of the payee;
(B) the payee holds the agent out to the public as accepting payments on
behalf of the payee; and
(C) payment is treated as received by the payee upon receipt by the agent so
that there is no risk of loss to the individual initiating the transaction if the
agent fails to remit the funds to the payee;
(13) virtual currency or other digital representation of value redeemable exclusively
for goods or services and limited to transactions involving a defined merchant,
including without limitation a rewards program;
(14) a digital representation of value issued by or on behalf of a publisher and used
solely within an online game, game platform, or family of games sold by the same
publisher or offered on the same game platform;
(15) uses of a virtual distributed ledger system to verify ownership or authenticity in a
digital capacity when the virtual currency is not used as a medium of exchange; or
(16) the exchange, transfer, or storage of virtual currency or to virtual currency
administration if any of the following apply to the transaction:
7
(A) the Electronic Fund Transfer Act, 15 U.S.C. § 1693 et seq., as it existed on
January 1, 2023;
(B) the Securities Exchange Act of 1934, 15 U.S.C. § 78a et seq., as it existed
on January 1, 2023;
(C) the Commodity Exchange Act, 7 U.S.C. § 1 et seq., as it existed on
January 1, 2023; or
(D) the Arkansas Securities Act, § 23-42-101 et seq.
History. Acts 2007, No. 1595, § 1; 2013, No. 531, §§ 2, 3; 2021, No. 532, §§ 4-6; 2023, No.
442, § 2.
23-55-104. Administration and rules.
(a) The Securities Commissioner shall administer this chapter.
(b) The commissioner may:
(1) Make, amend, and rescind any rules, forms, and orders that the
commissioner deems necessary or appropriate to carry out this chapter,
including without limitation rules and forms governing applications and
reports; and
(2) Define any terms, whether or not used in this chapter, if consistent with
this chapter.
(c) A rule, form, or order shall not be made, amended, or rescinded unless the
commissioner finds that the action is:
(1) Necessary or appropriate in the public interest or for the protection of
consumers; and
(2) Consistent with the purposes fairly intended by the policy and provisions
of this chapter.
(d) All rules and forms of the commissioner shall be published.
History. Acts 2009, No. 486, § 4.
8
ARTICLE 2 Money Transmission Licenses
23-55-201. License required.
23-55-202. Application for license.
23-55-203. [Repealed.]
23-55-204. Surety bonds.
23-55-205. Issuance of license.
23-55-206. Renewal of license.
23-55-207. Net worth.
23-55-201. License required.
(a) A person may not engage in the business of money transmission or advertise,
solicit, or hold itself out as providing money transmission unless the person:
(1) is licensed under this article;
(2) is an authorized delegate of a person licensed under this article; or
(3) is excluded under § 23-55-103.
(b) A license under this article is not transferable or assignable.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 5; 2011, No. 733, § 2.
23-55-202. Application for license.
(a) In this section, “material litigation” means litigation that according to generally
accepted accounting principles or international financial reporting standards is
significant to an applicant's or a licensee's financial health and would be required
to be disclosed in the applicant's or licensee's annual audited financial statements,
report to shareholders, or similar records.
(b) A person applying for a license under this article shall do so in a form and in a
medium prescribed by the commissioner. The application must state or contain:
(1) the legal name and residential and business addresses of the applicant and
any fictitious or trade name used by the applicant in conducting its
business;
(2) a list of any criminal convictions of the applicant and any material
litigation in which the applicant has been involved in the 10-year period
next preceding the submission of the application;
(3) a description of any money services previously provided by the applicant
and the money services that the applicant seeks to provide in this State;
9
(4) a list of the applicant's proposed authorized delegates and the locations,
including money transmission kiosks and virtual currency kiosks, located
in this State where the applicant and its authorized delegates propose to
engage in money transmission or provide other money services;
(5) a list of other States in which the applicant is licensed to engage in money
transmission or provide other money services and any license revocations,
suspensions, or other disciplinary action taken against the applicant in
another State;
(6) information concerning any bankruptcy or receivership proceedings
affecting the licensee;
(7) a sample form of contract for authorized delegates, if applicable, and a
sample form of payment instrument or instrument upon which stored value
or prepaid access is recorded, if applicable;
(8) the name and address of any bank through which the applicant's payment
instruments, stored value, or prepaid access will be paid;
(9) a description of the source of money and credit to be used by the applicant
to provide money services;
(10) any other information the commissioner reasonably requires with respect
to the applicant;
(11) the name of a person submitted by the applicant as the responsible
individual and information on that person to include:
(A) legal name;
(B) residential and business addresses;
(C) date of birth;
(D) Social Security number;
(E) employment history for the five-year period preceding the
submission of the application; and
(F) documentation that the proposed responsible individual is a citizen
of the United States or has obtained legal immigration status to
work in the United States;
(12) for the ten-year period preceding submission of the application, a list of:
(A) any criminal convictions of the proposed responsible individual of
the applicant;
10
(B) any litigation involving the proposed responsible individual
relating to the provision of money services; and
(C) any material litigation in which the applicant has been involved;
(13) a list of any license revocations, suspensions, restrictions, or other
disciplinary action taken against any money services business involving
the proposed responsible individual of the applicant; and
(14) information concerning any bankruptcy or receivership proceedings
involving or affecting the applicant or the proposed responsible individual
of the applicant.
(c) If an applicant is a corporation, limited liability company, partnership, or other
entity, the applicant shall also provide:
(1) the date of the applicant's incorporation or formation and State or country
of incorporation or formation;
(2) if applicable, a certificate of good standing from the State or country in
which the applicant is incorporated or formed;
(3) a brief description of the structure or organization of the applicant,
including any parent or subsidiary of the applicant, and whether any parent
or subsidiary is publicly traded;
(4) the legal name, any fictitious or trade name, all business and residential
addresses, and the employment, in the 10-year period next preceding the
submission of the application of each executive officer, manager, director,
or person that has control, of the applicant;
(5) a list of any criminal convictions and material litigation in which any
executive officer, manager, director, or person in control of, the applicant
has been involved in the 10-year period next preceding the submission of
the application;
(6) a copy of the applicant's audited financial statements for the most recent
fiscal year and, if available, for the two-year period next preceding the
submission of the application;
(7) a copy of the applicant's unconsolidated financial statements for the
current fiscal year, whether audited or not, and, if available, for the two-
year period next preceding the submission of the application;
(8) if the applicant is publicly traded, a copy of the most recent report filed
with the United States Securities and Exchange Commission under § 13 of
the federal Securities Exchange Act of 1934, 15 U.S.C. § 78m (1994 &
Supp. V 1999);
11
(9) evidence of the applicant's registration or qualification to do business in
this state;
(10) if the applicant is a wholly owned subsidiary of:
(A) a corporation publicly traded in the United States, a copy of
audited financial statements for the parent corporation for the most
recent fiscal year or a copy of the parent corporation's most recent
report filed under § 13 of the federal Securities Exchange Act of
1934, 15 U.S.C. § 78m (1994 & Supp. V 1999); or
(B) a corporation publicly traded outside the United States, a copy of
similar documentation filed with the regulator of the parent
corporation's domicile outside the United States;
(11) if the applicant has a registered agent in this State, the name and address
of the applicant's registered agent in this State; and
(12) any other information the commissioner reasonably requires with respect
to the applicant.
(d) A nonrefundable application fee of $1,500 and a license fee of $750 must
accompany an application for a license under this article. The license fee must be
refunded if the application is denied.
(e) The commissioner may waive one or more requirements of subsections (b) and (c)
or permit an applicant to submit other information in lieu of the required
information.
(f) The application shall be accompanied by the surety bond required by § 23-55-
204.
(g) An individual in control of a licensee or applicant, an individual who seeks to
acquire control of a licensee, and each key individual shall furnish to the
commissioner, through the Nationwide Multistate Licensing System and Registry,
the following:
(1) the individual's fingerprints for submission to the Federal Bureau of
Investigation and the commissioner for purposes of a national criminal
history background check, unless the person currently resides outside of
the United States and has resided outside of the United States for the last
10 years.
(2) personal history and experience in a form and in a medium prescribed by
the commissioner to obtain the following information:
(A) (i) a credit report from an independent consumer reporting
agency, unless the individual does not have a Social
Security number.
12
(ii) If an individual does not have a Social Security number,
then the requirement for a credit report from an
independent consumer reporting agency under subdivision
(g)(2)(A)(i) is waived;
(B) information related to any criminal convictions or pending criminal
charges; and
(C) information related to any regulatory or administrative action or
any civil litigation involving claims of fraud, misrepresentation,
conversion, mismanagement of funds, breach of fiduciary duty, or
breach of contract.
(3) if an individual has resided outside of the United States at any time in the
last 10 years, an investigative background report prepared by an
independent search firm that meets the following requirements:
(A) at a minimum, the independent search firm shall:
(i) demonstrate that it has sufficient knowledge, resources, and
employs accepted and reasonable methodologies to conduct
the research for a background report; and
(ii) not be affiliated with or have an interest with the individual
the independent search firm is researching; and
(B) at a minimum, the investigative background report shall:
(i) be written in the English language; and
(ii) contain the following:
(a) if available in the individual's current jurisdiction of
residency, a comprehensive credit report, or any
equivalent information obtained or generated by the
independent search firm to accomplish the report,
including without limitation a search of the court
data in the countries, provinces, states, cities, towns,
and contiguous areas where the individual resided
and worked;
(b) criminal records information for the past 10 years,
including without limitation felonies,
misdemeanors, or similar convictions for violations
of law in the countries, provinces, states, cities,
towns, and contiguous areas where the individual
resided and worked;
(c) employment history;
13
(d) media history, including an electronic search of
national and local publications, wire services, and
business applications; and
(e) financial services-related regulatory history,
including without limitation money transmissions,
securities, banking, insurance, and mortgage-related
industries.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, §§ 6, 7; 2013, No. 531, § 4; 2019, No. 111,
§ 1; 2021, No. 532, §§ 7, 8; 2023, No. 442, § 3; 2025, No. 557, § 2.
23-55-203. [Repealed.]
23-55-204. Surety bonds.
(a) An applicant for a money transmission license shall provide, and a licensee at all
times shall maintain, security consisting of a surety bond.
(b) (1) The surety bond under subsection (a) shall be in a form satisfactory to the
Securities Commissioner and shall run to the State of Arkansas for the
benefit of any claimants against the licensee to secure the faithful
performance of the obligations of the licensee with respect to the receipt,
handling, transmission, and payment of money in connection with money
transmission.
(2) The commissioner has the discretion to require the applicant to obtain
additional security coverage to address related cybersecurity risks inherent
in the applicant's business model as it relates to virtual currency
transmission and to the extent the risks are not within the scope of the
required surety bond.
(c) The amount of the required security under this section shall be:
(1) the greater of $100,000 or an amount equal to 100 percent of the licensee's
average daily money transmission liability in this state, calculated for the
most recently completed three-month period, up to a maximum of
$500,000; or
(2) if the licensee's tangible net worth exceeds 10 percent of total assets, then
the licensee shall maintain a surety bond of $100,000.
(d) A licensee that maintains a bond in the maximum amount provided for in
subsection (c), as applicable, is not required to calculate its average daily money
transmission liability in this state for purposes of § 23-55-702.
14
(e) A licensee may exceed the maximum required bond amount under § 23-55-
702(a)(6).
(f) (1) A party having a claim against the licensee may bring suit directly on the
surety bond, or the commissioner may bring suit on behalf of any
claimants, either in one action or in successive actions.
(2) Consumer claims shall be given priority in recovering from the surety
bond.
(3) Every bond shall provide for suit on the surety bond by a person who has a
cause of action under this article.
(g) (1) The surety bond shall remain in effect until cancellation, which may occur
only after 60 days' written notice to the commissioner.
(2) Cancellation shall not affect any liability incurred or accrued during that
period.
(h) (1) Except as provided by subdivision (h)(2), the surety bond shall remain in
place for no less than 5 years after the licensee ceases money transmission
operations in this state.
(2) The commissioner may permit the surety bond to be reduced or eliminated
before that time to the extent that the amount of the licensee's outstanding
payment instruments, stored value obligations, and money transmitted in
this state is reduced.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 9; 2011, No. 733, § 4; 2013, No. 531, §
5; 2017, No. 620, § 1; 2019, No. 111, § 2; 2023, No. 442, § 4; 2025, No. 557, § 3.
23-55-205. Issuance of license.
(a) When an application is filed under this article, the commissioner shall investigate
the applicant's financial condition and responsibility, financial and business
experience, character, and general fitness. The commissioner may conduct an on-
site investigation of the applicant, the reasonable cost of which the applicant must
pay. The commissioner shall issue a license to an applicant under this article if the
commissioner finds that all of the following conditions have been fulfilled:
(1) the applicant has complied with §§ 23-55-202, 23-55-204, and 23-55-207;
(2) the financial condition and responsibility, financial and business
experience, competence, character, and general fitness of the applicant;
and the competence, experience, character, and general fitness of the
executive officers, managers, directors, and persons in control of, the
15
applicant indicate that it is in the interest of the public to permit the
applicant to engage in money transmission; and
(3) an applicant, an officer, a person who exercises control over the applicant,
or a responsible individual shall not be listed on a specially designated
nationals and blocked persons list prepared by the United States
Department of the Treasury or as an individual or entity designated by the
United States Department of State under Exec. Order No. 13224, issued on
September 23, 2001, 66 Fed. Reg. 49079.
(b) When an application for an original license under this article is complete, the
commissioner shall promptly notify the applicant in a record of the date on which
the application was determined to be complete and:
(1) the commissioner shall approve or deny the application within 120 days
after that date; or
(2) if the application is not approved or denied within 120 days after that date:
(A) the application is deemed approved; and
(B) the commissioner shall issue the license under this article, to take
effect as of the first business day after expiration of the 120-day
period.
(c) The commissioner may for good cause extend the application period.
(d) An applicant whose application is denied by the commissioner under this article
may appeal, within 30 days after receipt of the notice of the denial, from the
denial and request a hearing before the commissioner.
(e) A license issued under this article expires annually at the close of business on
December 31 unless the license is:
(1) renewed according to this article;
(2) surrendered by the license holder;
(3) suspended; or
(4) revoked by the commissioner.
(f) (1) A money transmitter licensee may surrender a license by providing the
commissioner with a written notice of surrender through the automated
licensing system approved by the commissioner.
(2) The written notice of surrender shall include notice of where the records of
the money transmitter licensee will be stored and the name, address,
telephone number, and other contact information of a responsible party
who is authorized to provide access to the records.
16
(3) The surrender of a license does not reduce or eliminate the civil or
criminal liability of a money transmitter licensee arising from acts or
omissions occurring before the surrender of the license, including any
administrative actions undertaken by the commissioner to revoke or
suspend a license, to assess fines, to order payment of restitution, or to
exercise any other authority authorized under this chapter.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 10; 2011, No. 733, § 5; 2021, No. 532, §§
9, 10.
23-55-206. Renewal of license.
(a) A licensee under this article shall pay an annual renewal fee of $750 no later than
December 31 in order to be licensed for the next calendar year.
(b) A licensee under this article shall submit a renewal report with the renewal fee, in
a form prescribed by the commissioner. The renewal report must state or contain:
(1) a list of the licensee's permissible investments and a certification that the
licensee continues to maintain permissible investments according to the
requirements set forth in §§ 23-55-701 and 23-55-702; and
(2) proof that the licensee continues to maintain an adequate surety bond as
required by § 23-55-204.
(c) A licensee shall comply with subsections (a) and (b) within thirty (30) days of the
renewal date.
(d) The commissioner for good cause may grant an extension of the renewal date.
History. Acts 2007, No. 1595, § 1; 2011, No. 733, § 6; 2013, No. 531, § 6; 2017, No. 620, § 2;
2019, No. 111, § 3; 2021, No. 532, §§ 11, 12.
23-55-207. Net worth.
(a) A licensee shall maintain at all times a tangible net worth that is the greater of:
(1) $100,000 or 3 percent of total assets for the first $100,000,000;
(2) 2 percent of additional assets for $100,000,000 to $1,000,000,000; and
(3) 0.5 percent of additional assets for any amount over $1,000,000,000.
(b) Tangible net worth shall be demonstrated at initial application by the applicant's
most recent audited or unaudited financial statements under § 23-55-202(c)(6).
17
(c) Notwithstanding the other provisions of this section, the Securities Commissioner,
for good cause shown, may exempt an applicant or licensee, in part or in whole,
from the requirements of this section.
History. Acts 2007, No. 1595, § 1; 2019, No. 111, § 4; 2023, No. 442, § 5.
18
ARTICLE 3 [Reserved]
ARTICLE 4 Currency Exchange Licenses
23-55-401. License required.
23-55-402. Application for license.
23-55-403. Issuance of license.
23-55-404. Renewal of license.
23-55-401. License required.
(a) A person may not engage in currency exchange or advertise, solicit, or hold itself
out as providing currency exchange for which the person receives revenues equal
or greater than five percent of total revenues unless the person:
(1) is licensed under this article;
(2) is licensed for money transmission under § 23-55-201 et seq.; or
(3) is an authorized delegate of a person licensed under § 23-55-201 et seq.
(b) A license under this article is not transferable or assignable.
History. Acts 2007, No. 1595, § 1; 2011, No. 733, § 7.
23-55-402. Application for license.
(a) A person applying for a license under this article shall do so in a form and in a
medium prescribed by the commissioner. The application must state or contain:
(1) the legal name and residential and business addresses of the applicant, if
the applicant is an individual or, if the applicant is not an individual, the
name of each partner, executive officer, manager, and director;
(2) the location of the principal office of the applicant;
(3) complete addresses of other locations in this State where the applicant
proposes to engage in currency exchange, including all limited stations
and mobile locations;
(4) a description of the source of money and credit to be used by the applicant
to engage in currency exchange;
(5) other information the commissioner reasonably requires with respect to
the applicant, but not more than the commissioner may require under § 23-
55-201 et seq.;
19
(6) the name of a person submitted by the applicant as the responsible
individual and information on that person to include:
(A) legal name;
(B) residential and business addresses;
(C) date of birth;
(D) Social Security number;
(E) employment history for the five-year period preceding the
submission of the application; and
(F) documentation that the proposed responsible individual is a citizen
of the United States or has obtained legal immigration status to
work in the United States;
(7) for the ten-year period preceding the submission of the application, a list
of any criminal convictions of the proposed responsible individual of the
applicant, any litigation involving the proposed responsible individual
relating to the provision of money services, and any material litigation in
which the applicant has been involved;
(8) a list of other states in which the applicant engages in currency exchange
or provides other money services and any license revocations,
suspensions, restrictions, or other disciplinary action taken against the
applicant in another state;
(9) a list of any license revocations, suspensions, restrictions, or other
disciplinary action taken against any money services business involving
the responsible individual of the applicant; and
(10) information concerning any bankruptcy or receivership proceedings
involving or affecting the applicant or the responsible individual of the
applicant.
(b) A nonrefundable application fee of $1,500 and a license fee of $375 must
accompany an application for a license under this article. The license fee must be
refunded if the application is denied.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 11; 2019, No. 111, § 5; 2021, No. 532, §
13.
23-55-403. Issuance of license.
(a) When an application for a license is made under this article, the commissioner
shall investigate the applicant's financial condition and responsibility, financial
20
and business experience, character, and general fitness. The commissioner may
conduct an on-site investigation of the applicant, the reasonable cost of which the
applicant must pay. The commissioner shall issue a license to an applicant under
this article if the commissioner finds that all of the following conditions have
been fulfilled:
(1) the applicant has complied with § 23-55-402; and
(2) the financial condition and responsibility, financial and business
experience, competence, character, and general fitness of the applicant;
and the competence, experience, character, and general fitness of the
executive officers, managers, directors, and persons in control of, the
applicant indicate that it is in the interest of the public to permit the
applicant to engage in currency exchange.
(b) When an application for an original license under this article is complete, the
commissioner shall promptly notify the applicant in a record of the date on which
the application was determined to be complete and:
(1) the commissioner shall approve or deny the application within 120 days
after that date; or
(2) if the application is not approved or denied within 120 days after that date:
(A) the application is deemed approved; and
(B) the commissioner shall issue the license under this article, to take
effect as of the first business day after expiration of the period.
(c) The commissioner may for good cause extend the application period.
(d) An applicant whose application is denied a license by the commissioner under this
article may appeal, within 30 days after receipt of the notice of the denial, from
the denial and request a hearing.
(e) A license issued under this chapter expires at the close of business on December
31 of the calendar year unless the license is:
(1) renewed according to this chapter;
(2) surrendered by the license holder;
(3) suspended; or
(4) revoked by the commissioner.
History. Acts 2007, No. 1595, § 1; 2009, No. 164, § 13; 2011, No. 733, § 8; 2019, No. 111, §
6.
21
23-55-404. Renewal of license.
(a) A licensee under this article shall pay an annual renewal fee of $375 no later than
December 31 in order to be licensed for the next calendar year.
(b) A licensee under this article shall submit a renewal report with the renewal fee, in
a form and in a medium prescribed by the commissioner. The renewal report must
contain a list of the locations in this State where the licensee or an authorized
delegate of the licensee engages in currency exchange, including limited stations,
mobile locations, money transmission kiosks, and virtual currency kiosks.
(c) A licensee may renew a license after the time specified in subsection (a) if the
licensee renews within thirty (30) days of the renewal date by:
(1) paying $375 as required under subsection (a);
(2) complying with the requirements in subsection (b); and
(3) paying a late fee of $250 so long as the complete renewal application is
received.
(d) (1) The commissioner for good cause may grant an extension of the renewal
date.
(2) If a licensee has not renewed a license within thirty (30) days of the
renewal date and has not shown good cause to receive an extension of the
renewal date as described under subdivision (d)(1), then it shall be
necessary for the licensee to submit a new application to engage in the
business of currency exchange.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 12; 2011, No. 733, § 9; 2019, No. 111, §
7; 2021, No. 532, § 14; 2025, No. 557, § 4.
22
ARTICLE 5 Authorized Delegates
23-55-501. Relationship between licensee and authorized delegate.
23-55-502. Unauthorized activities.
23-55-503. Training materials provided to authorized delegates.
23-55-501. Relationship between licensee and authorized delegate.
(a) In this section, “remit” means to make direct payments of money to a licensee or
its representative authorized to receive money or to deposit money in a bank in an
account specified by the licensee.
(b) (1) A contract between a licensee and an authorized delegate must require the
authorized delegate to operate in full compliance with this chapter.
(2) (A) The licensee shall furnish in a record to each authorized delegate
policies and procedures sufficient for compliance with this chapter.
(B) The policies and procedures under subdivision (b)(2)(A) shall be
updated on a reasonably periodic basis.
(c) An authorized delegate shall remit all money owing to the licensee in accordance
with the terms of the contract between the licensee and the authorized delegate.
(d) If a license is suspended or revoked, the commissioner shall notify all authorized
delegates of the licensee whose names are in a record filed with the commissioner
of the suspension, revocation, or non-renewal. After notice is sent or publication
is made, an authorized delegate shall immediately cease to provide money
services as a delegate of the licensee.
(e) An authorized delegate may not provide money services outside the scope of
activity permissible under the contract between the authorized delegate and the
licensee, except activity in which the authorized delegate is authorized to engage
under § 23-55-201 et seq. or § 23-55-401 et seq. An authorized delegate of a
licensee holds in trust for the benefit of the licensee all money net of fees received
from money transmission.
(f) An authorized delegate may not use a subdelegate to conduct money services on
behalf of a licensee.
(g) A copy of a contract required under this section shall be made available to the
commissioner, upon request.
History. Acts 2007, No. 1595, § 1; 2021, No. 532, § 15; 2025, No. 557, §§ 5, 6.
23
23-55-502. Unauthorized activities.
A person may not provide money services on behalf of a person not licensed under this chapter.
A person that engages in that activity provides money services to the same extent as if the person
were a licensee.
History. Acts 2007, No. 1595, § 1.
23-55-503. Training materials provided to authorized delegates.
(a) On or before April 1 of each year, a licensee shall provide to each authorized
delegate through which it engages in the business of money transmission training
materials on how to:
(1) recognize financial abuse and financial exploitation of an elder adult; and
(2) respond appropriately if the authorized delegate suspects that the
authorized delegate is being asked to engage in the business of money
transmission for a fraudulent transaction in which an elder adult is the
victim of financial abuse or financial exploitation.
(b) A licensee shall provide the training materials required under subsection (a) to
each newly appointed authorized delegate within one month after appointment of
the authorized delegate.
History. Acts 2025, No. 557, § 7.
24
ARTICLE 6 Examinations — Reports — Records
23-55-601. Authority to conduct examinations and investigations.
23-55-602. Cooperation.
23-55-603. Reports.
23-55-604. Acquisition of control.
23-55-605. Records.
23-55-606. Anti-money laundering program and reports.
23-55-607. Confidentiality.
23-55-608. Disclosure requirements.
23-55-609. Policy and procedure — Physical security and cybersecurity.
23-55-610. Timely transmission.
23-55-611. Refunds.
23-55-612. Receipts.
23-55-601. Authority to conduct examinations and investigations.
(a) The Securities Commissioner or the commissioner's designee may conduct an
annual examination of a licensee or of any of its authorized delegates upon 45
days' notice in a record to the licensee.
(b) The commissioner may examine a licensee or its authorized delegate, at any time,
without notice, if the commissioner has reason to believe that the licensee or
authorized delegate is engaging in an unsafe or unsound practice or has violated
or is violating this chapter or a rule adopted or an order issued under this chapter.
(c) (1) The licensee, applicant, or person subject to licensing under this chapter
shall pay a fee for each examination, not to exceed one hundred fifty
dollars ($150) per examiner for each day or for part of a day during which
the examiner is conducting the examination.
(2) In addition to the fee prescribed under subdivision (c)(1) of this section,
the licensee, applicant, or person subject to licensing under this chapter
may be required to pay the actual hotel and traveling expenses of each
examiner traveling to and from the office of the commissioner while the
examiner is conducting the examination.
(d) Information obtained during an examination under this chapter may be disclosed
only as provided in § 23-55-607.
(e) The commissioner may:
(1) Make any investigations within or outside of this state that he or she
deems necessary to determine whether a person has violated or is about to
violate this chapter or any rule or order under this chapter, or to aid in the
enforcement of this chapter;
25
(2) Require or permit a person to file a sworn, written statement or submit any
other form of evidence concerning the matter to be investigated; and
(3) Publish information concerning a violation of this chapter or a rule or
order issued under this chapter.
(f) For the purpose of an investigation or proceeding under this chapter, the
commissioner or the commissioner's designee may:
(1) Administer oaths and affirmations;
(2) Subpoena and compel the attendance of witnesses;
(3) Take evidence; and
(4) Require the production of books, papers, correspondence, memoranda,
agreements, or other documents or records that the commissioner deems
relevant or material to the inquiry.
(g) (1) In case of contumacy by or the refusal to obey a subpoena issued to a
person, the Pulaski County Circuit Court upon application by the
commissioner may order the person to appear before the commissioner or
the commissioner's designee to testify or produce documentary or other
evidence concerning the matter under investigation or in question.
(2) Failure to obey the order of the court may be punished by the court as a
contempt of court.
(h) (1) A person shall not refuse to appear, testify, or produce evidence before the
commissioner or the commissioner's designee on the ground that the
testimony or evidence may tend to incriminate the person or subject the
person to a penalty or forfeiture.
(2) (A) After claiming a privilege against self-incrimination, an individual
shall not be prosecuted or subjected to a penalty or forfeiture for or
on account of a transaction, matter, or thing concerning which the
individual is compelled to testify or produce evidence,
documentary or otherwise.
(B) However, an individual is not exempt from prosecution and
punishment for perjury or contempt committed while testifying or
producing evidence, documentary or otherwise.
(i) (1) To aid an examination or investigation under this chapter, the
commissioner or the commissioner's designee may at any time examine:
(A) The business of a licensee, an authorized delegate of a licensee, or
any other person engaged in the business of providing money
26
services, whether the person acts or claims to act under or without
the authority of this chapter; and
(B) Wherever located, the books, accounts, records, papers,
documents, files, and other information used in the business of a
licensee, an authorized delegate of a licensee, or any other person
engaged in the business of providing money services, whether the
person acts or claims to act under or without the authority of this
chapter.
(2) The commissioner or the commissioner's designee shall have free access
to the offices and places of business, books, accounts, papers, documents,
other information, records, files, safes, and vaults to conduct the
examination or investigation under this section.
(3) The commissioner or the commissioner's designee may request through a
record the books, accounts, papers, documents, other information, records,
and files to be provided to the commissioner on 7 business-days' notice.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 13; 2011, No. 733, § 10; 2021, No. 532, §
16; 2023, No. 442, § 6.
23-55-602. Cooperation.
The Securities Commissioner may consult and cooperate with other state money services
regulators and agencies of the United States Government in enforcing and administering this
chapter. They may jointly pursue examinations and take other official action that they are
otherwise empowered to take.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 14.
23-55-603. Reports.
(a) A licensee shall file with the commissioner within 15 business days any material
changes in information provided in a licensee's application as prescribed by the
commissioner.
(b) A licensee shall file with the commissioner within 45 days after the end of each
calendar quarter a current list of all authorized delegates, and locations in this
State where the licensee or an authorized delegate of the licensee provides money
services, including limited stations, mobile locations, money transmission kiosks,
and virtual currency kiosks. The licensee shall state the name and street address of
each location and authorized delegate.
27
(c) A money transmission licensee shall file with the commissioner within 90 days
after the end of the money transmission licensee's fiscal year a copy of the money
transmission licensee's audited financial statement from the most recently
completed fiscal year or, if the money transmission licensee is a wholly owned
subsidiary of another corporation, the consolidated audited financial statement of
the parent corporation from the most recently completed fiscal year or the money
transmission licensee's consolidated audited annual financial statement from the
most recently completed fiscal year.
(d) A licensee shall file a report with the commissioner within 3 business days after
the licensee has reason to know of the occurrence of the following events:
(1) the filing of a petition by or against the licensee under the United States
Bankruptcy Code, 11 U.S.C. §§ 101-110 (1994 & Supp. V 1999), for
bankruptcy or reorganization;
(2) the filing of a petition by or against the licensee for receivership, the
commencement of judicial or administrative proceedings for its
dissolution or reorganization, or the making of a general assignment for
the benefit of its creditors;
(3) the commencement of a proceeding to revoke or suspend its license in a
state or country that the licensee engages in business or is licensed;
(4) the cancellation or impairment of the licensee's bond or other security;
(5) a charge or conviction of the licensee or of an executive officer, manager,
director, or person in control of the licensee, for a felony; or
(6) a charge or conviction of an authorized delegate for a felony.
(e) A licensee shall file with the commissioner within 45 days after the end of each
calendar quarter, in a form acceptable to the commissioner, a report of the number
and monetary amount of payment instruments, stored-value, prepaid access, and
virtual currency sold by the licensee in this State for that quarter, and the
monetary amount of payment instruments, stored-value, prepaid access, and
virtual currency currently outstanding.
(f) The commissioner may for good cause grant an extension of the reporting date.
History. Acts 2007, No. 1595, § 1; 2011, No. 733, §§ 11, 12; 2017, No. 620, §§ 3, 4; 2021,
No. 532, § 17; 2025, No. 557, § 8.
28
23-55-604. Acquisition of control.
(a) (1) A person, or a group of persons acting in concert, seeking to acquire
control of a licensee shall obtain the written approval of the Securities
Commissioner before acquiring control.
(2) If an individual becomes a key individual of the licensee in the ordinary
course of business, then the individual is not deemed to have acquired
control of a licensee and is not subject to this section.
(b) A person or a group of persons acting in concert seeking to acquire control of a
licensee shall submit, in cooperation with the licensee:
(1) an application in a form and in a medium prescribed by the commissioner;
and
(2) a nonrefundable fee of $1,000 with a request for approval.
(c) Upon request, the commissioner may permit a licensee or the person or group of
persons acting in concert to submit some or all information required under
subdivision (b)(1) without using the Nationwide Multistate Licensing System and
Registry.
(d) The application under subdivision (b)(1) shall include information required by §
23-55-202(g) for a new key individual who has not previously completed the
requirements of § 23-55-202(g) for a licensee.
(e) (1) If an application for acquisition of control under this section appears to
include all the items and address all of the matters that are required, then
the application shall be considered complete, and the commissioner shall
promptly notify the applicant in a record of the date that the application
was determined to be complete.
(2) The commissioner shall approve or deny the application within 60 days
after the completion date.
(3) If the application is not approved or denied within 60 days after the
completion date, then:
(i) the application is approved; and
(ii) the person or group of persons acting in concert are not prohibited
from acquiring control.
(4) The commissioner may for good cause extend the application period.
(f) A determination by the commissioner that an application is complete and the
application is accepted for processing means that the application, on its face,
appears to include all of the items and address all of the matters that are required
29
but is not an assessment of the substance of the application or of the sufficiency of
the information provided.
(g) (1) If an application is filed and considered complete under subsection (e),
then the commissioner shall investigate the financial condition and
responsibility, financial and business experience, character, and general
fitness of the person or group of persons acting in concert seeking to
acquire control.
(2) The commissioner shall approve an application for acquisition of control
under this section if the commissioner finds that all of the following
conditions have been fulfilled:
(A) the requirements of subsections (b) and (d) have been met, as
applicable; and
(B) the financial condition and responsibility, financial and business
experience, competence, character, and general fitness of the
person or group of persons acting in concert seeking to acquire
control, and the competence, experience, character, and general
fitness of the key individuals and persons that would be in control
of the licensee after the acquisition of control indicate that it is in
the interest of the public to permit the person or group of persons
acting in concert to control the licensee.
(h) (1) The commissioner shall issue a formal written notice of the denial of an
application to acquire control within 30 days of the decision to deny the
application.
(2) The commissioner shall state in the notice of denial the specific reasons
for the denial of the application.
(3) An applicant whose application is denied by the commissioner under this
subsection (h) may appeal within 30 days after receipt of the written notice
of the denial.
(i) The requirements of subsections (a) and (b) do not apply to:
(1) a person that acts as a proxy for the sole purpose of voting:
(A) at a designated meeting of the shareholders or
holders of voting shares; or
(B) interests of a licensee or a person in control of a
licensee;
(2) a person that acquires control of a licensee by devise or
descent;
30
(3) a person that acquires control of a licensee:
(A) as a personal representative, custodian, guardian,
conservator, or trustee;
(B) as an officer appointed by a court of competent
jurisdiction; or
(C) by operation of law;
(4) a person that is exempt under § 23-55-103;
(5) a person that the commissioner determines is not subject to
subsection (a) based on the public interest;
(6) a public offering of securities of a licensee or a person in
control of a licensee; or
(7) an internal reorganization of a person in control of the
licensee if the ultimate person in control of the licensee
remains the same.
(j) Persons in subdivisions (i)(2)-(4) and subdivisions (i)(6) and (7), in cooperation
with the licensee, shall notify the commissioner within 15 days after the
acquisition of control.
(k) (1) The requirements of subsections (a) and (b) do not apply to a person that
has complied with and received approval to engage in money transmission
under this chapter or was identified as a person in control in a prior
application filed with and approved by the commissioner or by a money
services business accredited state under a multistate licensing process if:
(A) the person has not had a license revoked or suspended or
controlled a licensee that has had a license revoked or suspended
while the person was in control of the licensee in the previous 5
years;
(B) the person is a licensee, and the person is well managed and has
received at least a satisfactory rating for compliance at its most
recent examination by a money services business accredited state if
the rating was given;
(C) the licensee to be acquired is projected to meet the requirements of
§§ 23-55-204, 23-55-207, and 23-55-701 after the acquisition of
control is completed, and if the person acquiring control is a
licensee, then that licensee is also projected to meet the
requirements of §§ 23-55-204, 23-55-207, and 23-55-701 after the
acquisition of control is completed;
31
(D) the licensee to be acquired shall not implement any material
changes to its business plan as a result of the acquisition of control,
and if the person acquiring control is a licensee, then that licensee
also shall not implement any material changes to its business plan
as a result of the acquisition of control; and
(E) the person provides notice of the acquisition in cooperation with
the licensee and attests to subdivisions (k)(1)(A)-(D) in a form and
in a medium prescribed by the commissioner.
(2) If the notice is not disapproved within 30 days after the date that the notice
was determined to be complete, then the notice is approved.
(l) (1) Before filing an application for approval to acquire control of a licensee, a
person may request in writing a determination from the commissioner as
to whether or not the person would be considered a person in control of a
licensee upon consummation of a proposed transaction.
(2) If the commissioner determines that the person would not be a person in
control of a licensee, then the proposed person and transaction are not
subject to the requirements of subsections (a) and (b).
(m) (1) A licensee adding or replacing a key individual shall:
(A) provide notice in a manner prescribed by the commissioner within
15 days after the effective date of the key individual's appointment;
and
(B) provide information as required by this section within 45 days of
the effective date of the key individual's appointment.
(2) Within 90 days of the date that the notice provided under subdivision
(m)(1) was determined to be complete, the commissioner may issue a
notice of disapproval of a key individual if the competence, experience,
character, or integrity of the individual are such that it would not be in the
best interests of the public or the customers of the licensee to permit the
individual to be a key individual of the licensee.
(3) (A) A notice of disapproval shall:
(i) contain a statement of the basis for disapproval; and
(ii) be sent to the licensee and the disapproved individual.
(B) A licensee may appeal a notice of disapproval within 30 days after
receipt of the notice of disapproval.
32
(4) If the notice provided under subdivision (m)(1) is not disapproved within
90 days after the date that the notice was determined to be complete, then
the key individual is approved.
History. Acts 2007, No. 1595, § 1; 2009, No. 164, § 14; 2021, No. 532, § 18; 2023, No. 442, §
7.
23-55-605. Records.
(a) A licensee shall maintain the following records for determining its compliance
with this chapter for at least five years:
(1) a record of each payment instrument, stored-value, virtual currency, or
prepaid access obligation sold;
(2) a general ledger posted at least monthly containing all asset, liability,
capital, income, and expense accounts;
(3) bank statements and bank reconciliation records;
(4) records of outstanding payment instruments and stored-value and prepaid
access obligations;
(5) records of each payment instrument, stored-value, virtual currency, and
prepaid access obligation paid within the five-year period;
(6) a list of the last known names and addresses of all of the licensee's
authorized delegates; and
(7) any other records the commissioner reasonably requires by rule.
(b) The items specified in subsection (a) may be maintained photographically,
electronically, or in any other form of record allowed by the commissioner.
(c) Records may be maintained outside this State if they are made accessible and
available to the commissioner on seven business-days' notice that is sent in a
record.
(d) All records maintained by the licensee as required in subsections (a) through (c)
are open to inspection by the commissioner pursuant to § 23-55-601.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 15; 2013, No. 531, § 7; 2021, No. 532, §
19; 2023, No. 442, § 8.
33
23-55-606. Anti-money laundering program and reports.
(a) Every licensee shall comply with all state and federal laws, rules, and regulations
relating to the detection and prevention of money laundering.
(b) Every licensee shall maintain an anti-money laundering program in accordance
with 31 C.F.R. § 103.125. The program shall be reviewed and updated as
necessary to ensure that the program continues to be effective in detecting and
deterring money laundering activities.
(c) At a minimum, the program shall include:
(1) A system of internal controls to ensure ongoing compliance;
(2) Independent testing for compliance to be conducted by bank personnel or
by an outside party;
(3) Designation of an individual or individuals who are responsible for
coordinating and monitoring day-to-day compliance;
(4) Training for appropriate personnel; and
(5) Appropriate risk-based procedures for conducting ongoing customer due
diligence to include without limitation:
(A) Understanding the nature and purpose of customer relationships for
the purpose of developing a customer risk profile; and
(B) (i) Conducting ongoing monitoring to identify and report
suspicious transactions and, on a risk basis, to maintain and
update customer information.
(ii) For purposes of subdivision (c)(5)(B)(i) of this section,
customer information shall include information regarding
the beneficial owners of legal entity customers.
(d) Every licensee shall comply with the regulations of its federal functional regulator
governing such programs.
(e) A licensee and an authorized delegate shall file with the commissioner all reports
required by federal currency reporting, record keeping, and suspicious transaction
reporting requirements as set forth in 31 U.S.C. § 5311 (1994), 31 C.F.R. § 103
(2000), and other federal and state laws pertaining to money laundering.
(f) The timely filing of a complete and accurate report required under subsection (e)
of this section with the appropriate federal agency satisfies compliance with the
requirements of subsection (e) of this section, unless the commissioner notifies
the licensee that reports of this type are not being regularly and comprehensively
transmitted by the federal agency to the commissioner.
34
History. Acts 2007, No. 1595, § 1; 2017, No. 620, § 5.
23-55-607. Confidentiality.
(a) Unless otherwise specified in this section, all information filed with the
commissioner shall be available for public inspection under rules promulgated by
the commissioner consistent with state and federal law governing the disclosure
of public information.
(b) Except for reasonably segregable portions of information and records that by law
would routinely be made available to a party other than an agency in litigation
with the commissioner, the commissioner shall not publish or make available:
(1) Information contained in reports, summaries, analyses, letters, or
memoranda arising out of, in anticipation of, or in connection with an
investigation, examination, or inspection of the books and records of any
person;
(2) Interagency or intra-agency memoranda or letters, including without
limitation:
(A) Records that reflect discussions between or consideration by the
commissioner or members of the staff of the State Securities
Department or the staff of the Department of Commerce working
for the State Securities Department, or both, of any action taken or
proposed to be taken by the commissioner or by any members of
the staff of the State Securities Department or the staff of the
Department of Commerce working for the State Securities
Department; and
(B) Reports, summaries, analyses, conclusions, or any other work
product of the commissioner or of attorneys, accountants, analysts,
or other members of the commissioner's staff, prepared in the
course of an:
(i) Inspection of the books or records of a person whose affairs
are regulated by the commissioner; or
(ii) Examination, investigation, or litigation conducted by or on
behalf of the commissioner;
(3) Personnel files, medical files, and similar files if disclosure would
constitute a clearly unwarranted invasion of personal privacy, including
without limitation:
(A) Information concerning employees of the State Securities
Department or employees of the Department of Commerce
35
working for the State Securities Department and all persons subject
to rule by the State Securities Department; and
(B) Personal information reported to the commissioner under the
department's rules concerning registration about employees of
applicants, licensees, or their agents;
(4) (A) Investigatory records compiled for law enforcement purposes to
the extent that production of the records would:
(i) Interfere with enforcement proceedings;
(ii) Deprive a person of a right to a fair trial or an impartial
adjudication; or
(iii) Disclose the identity of a confidential source.
(B) The commissioner may also withhold investigatory records that
would:
(i) Constitute an unwarranted invasion of personal privacy;
(ii) Disclose investigative techniques and procedures; or
(iii) Endanger the life or physical safety of law enforcement
personnel.
(C) As used in this section, “investigatory records” includes:
(i) All documents, records, transcripts, correspondence, and
related memoranda and work products concerning
examinations and other investigations and related litigation
as authorized by law that pertain to or may disclose the
possible violation by any person of any provision of the
statutes or rules administered by the commissioner; and
(ii) All written communications from or to any person
confidentially complaining or otherwise furnishing
information about a possible violation, as well as all
correspondence and memoranda in connection with the
confidential complaint or information;
(5) Information contained in or related to examinations, operating reports, or
condition reports prepared by, on behalf of, or for the use of any agency
responsible for the regulation or supervision of financial institutions,
check issuers, money transmitters, money services providers, or money
service businesses;
36
(6) (A) Financial records of any applicant, licensee, or the agent of an
applicant or licensee obtained during or as a result of an
examination by the commissioner.
(B) However, when a record under this article is required to be filed
with the commissioner as part of an application for license, annual
renewal, or otherwise, the record, including financial statements
prepared by certified public accountants, shall be public
information unless sections of the information are bound separately
and are marked “confidential” by the applicant, licensee, or agent
upon filing.
(C) Information under subdivision (b)(6)(B) of this section bound
separately and marked “confidential” shall be deemed nonpublic
until ten (10) days after the commissioner has given the applicant,
licensee, or agent notice that an order will be entered deeming the
material public information.
(D) An applicant, licensee, or agent may seek an injunction from the
Pulaski County Circuit Court ordering the commissioner to
withhold the information as nonpublic pending a final order from a
court of competent jurisdiction if the order of the commissioner
under subdivision (b)(6)(C) of this section is appealed under
applicable law;
(7) Trade secrets obtained from any person; or
(8) Any other records that are required to be closed to the public and are not
deemed open to public inspection under other law.
(c) The commissioner may disclose information not otherwise subject to disclosure
under subsection (a) to representatives of state or federal agencies who promise in
a record that they will maintain the confidentiality of the information; or the
commissioner finds that the release is reasonably necessary for the protection of
the public and in the interests of justice, and the licensee has been given previous
notice by the commissioner of its intent to release the information.
(d) This section does not prohibit the commissioner from disclosing to the public a
list of persons licensed under this chapter or the aggregated financial data
concerning those licensees.
History. Acts 2007, No. 1595, § 1; 2019, No. 315, § 2607; 2019, No. 910, §§ 588, 589.
37
23-55-608. Disclosure requirements.
(a) A licensee shall provide its name and mailing address or telephone number to the
purchaser in connection with each money transmission or currency exchange
transaction conducted by the licensee directly or through an authorized delegate.
(b) An authorized delegate shall display prominently in a form and in a medium
prescribed by the Securities Commissioner a notice that states or contains the
following information:
(1) The name, mailing address, and telephone number of the authorized
delegate;
(2) For each licensee of the authorized delegate:
(A) A statement that the authorized delegate is an agent conducting
business on behalf of the licensee under this chapter; and
(B) The name, mailing address, and telephone number of the licensee;
and
(3) A statement:
(A) Directing consumers with complaints to contact the State
Securities Department; and
(B) Containing the current mailing address and telephone number of
the department.
(c) (1) Except as required by § 23-55-1008(a), a licensee or authorized delegate
shall include a clear, concise, and conspicuous fraud warning that is posted
in a conspicuous area or included on a transmittal form used by a
consumer to send money to another individual.
(2) The fraud warning required under subdivision (c)(1) shall:
(A) include a toll-free telephone number for consumers to call to report
fraud or suspected fraud; and
(B) be in clear, conspicuous, and legible writing in English and in the
language principally used by the licensee or authorized delegate to
advertise, solicit, or negotiate, either orally or in writing, for a
transaction conducted in person, electronically, or by telephone, if
other than English.
(3) A licensee shall monitor the activities of its authorized delegates relating
to transmittals by consumers.
(4) If a licensee or authorized delegate conducts money transmission activity
through a website or a mobile application that is not in a physical location,
38
the commissioner may authorize an alternative form of the fraud notice
required under subdivision (c)(1).
History. Acts 2009, No. 486, § 16; 2025, No. 557, § 9.
23-55-609. Policy and procedure — Physical security and cybersecurity.
(a) A money transmitter or currency exchanger licensed or required to be licensed
under this chapter shall establish, implement, update, and enforce written physical
security and cybersecurity policies and procedures reasonably designed to ensure
the confidentiality, integrity, and availability of physical and electronic records
and information.
(b) A policy or procedure described in subsection (a) of this section shall be tailored
to the size and sophistication of the money transmitter or currency exchanger.
(c) The Securities Commissioner may impose additional conditions by rule or order
to clarify the requirements of a policy or procedure described in subsection (a) of
this section.
History. Acts 2021, No. 532, § 20.
23-55-610. Timely transmission.
(a) Every licensee shall forward all money received for transmission according to the
terms of the agreement between the licensee and the sender unless the licensee
has a reasonable belief or a reasonable basis to believe that the sender may be a
victim of fraud or that a crime or violation of law, rule, or regulation has occurred,
is occurring, or may occur.
(b) If a licensee fails to forward money received for transmission under this section,
then the licensee shall respond to inquiries by the sender with the reason for the
failure unless providing a response would violate a state or federal law, rule, or
regulation.
History. Acts 2023, No. 442, § 9.
23-55-611. Refunds.
(a) This section does not apply to:
(1) money received for transmission subject to the federal remittance transfer
definitions, 12 C.F.R. Part 1005.30, as it existed on January 1, 2023; or
39
(2) money received for transmission under a written agreement between the
licensee and payee to process payments for goods or services provided by
the payee.
(b) Every licensee shall refund all money received for transmission to the sender
within 10 days of receipt of the sender's written request for a refund of all money
received for transmission unless any of the following occurs:
(1) the money has been forwarded within 10 days of the date that the money
was received for transmission;
(2) instructions have been given committing an equivalent amount of money
to the person designated by the sender within 10 days of the date that the
money was received for transmission;
(3) (A) the agreement between the licensee and the sender instructs the
licensee to forward the money at a time that is beyond 10 days of
the date that the money was received for transmission.
(B) If funds have not yet been forwarded according to the terms of the
agreement between the licensee and the sender, then the licensee
shall issue a refund under this section;
(4) the refund is requested for a transaction that the licensee has not
completed based on a reasonable belief or a reasonable basis to believe
that a crime or violation of law, rule, or regulation has occurred, is
occurring, or may occur; or
(5) the refund request does not enable the licensee to:
(A) identify the sender's name and address or telephone number; or
(B) identify the particular transaction to be refunded in the event the
sender has multiple transactions outstanding.
History. Acts 2023, No. 442, § 9; 2025, No. 177, § 2.
23-55-612. Receipts.
(a) This section does not apply to:
(1) money received for transmission subject to the federal remittance transfer
definitions, 12 C.F.R. Part 1005.30, as it existed on January 1, 2023;
(2) money received for transmission that is not primarily for personal, family,
or household purposes;
40
(3) money received for transmission under a written agreement between the
licensee and payee to process payments for goods or services provided by
the payee; or
(4) payroll processing services.
(b) In this section, “receipt” means a paper receipt, electronic record, or other written
confirmation.
(c) (1) For a transaction conducted in person, the receipt may be provided
electronically if the sender requests or agrees to receive an electronic
receipt.
(2) For a transaction conducted electronically or by phone, a receipt may be
provided electronically.
(3) All electronic receipts shall be provided in a retainable form.
(d) (1) Every licensee or its authorized delegate shall provide the sender a receipt
for money received for transmission.
(2) The receipt shall contain the following information, as applicable:
(A) the name of the sender, to the extent the licensee or its authorized
delegate is required to capture this information before
transmission;
(B) the name of the designated recipient, unless the licensee can
determine the name of the recipient by the unique transaction or
identification number described in subdivision (d)(2)(D), in which
case the name of the recipient is not required;
(C) the date of the transaction;
(D) the unique transaction or identification number;
(E) the name of the licensee, Nationwide Multistate Licensing System
and Registry Unique ID, the licensee's business address, and the
licensee's customer service telephone number;
(F) the amount of the transaction in United States dollars;
(G) any fee charged by the licensee to the sender for the transaction;
and
(H) any taxes collected by the licensee from the sender for the
transaction.
(e) The receipt required by this section shall be in English and in the language
principally used by the licensee or authorized delegate to advertise, solicit, or
41
negotiate, either orally or in writing, for a transaction conducted in person,
electronically, or by phone, if other than English.
History. Acts 2023, No. 442, § 9.
42
ARTICLE 7 Permissible Investments
23-55-701. Maintenance of permissible investments.
23-55-702. Types of permissible investments.
23-55-701. Maintenance of permissible investments.
(a) A licensee shall maintain at all times permissible investments that have a market
value computed in accordance with generally accepted accounting principles or
international financial reporting standards of not less than the aggregate amount
of all of its outstanding money transmission obligations.
(b) A licensee transmitting virtual currency shall hold like-kind virtual currency of
the same volume as that held by the licensee but which is obligated to consumers
in lieu of the permissible investments required in subsection (a).
(c) A licensee conducting activities as described in subsections (a) and (b) shall
maintain applicable levels and types of permissible investments as described in
subsections (a) and (b).
(d) Except for permissible investments enumerated in § 23-55-702(a), the
commissioner, with respect to any licensee, may by rule or order limit the extent
to which a specific investment maintained by a licensee within a class of
permissible investments may be considered a permissible investment if the
specific investment represents undue risk to customers that is not reflected in the
market value of investments.
(e) (1) Permissible investments, even if commingled with other assets of the
licensee, are held in trust for the benefit of the purchasers and holders of
the licensee's outstanding money transmission obligations in the event of:
(A) insolvency;
(B) the filing of a petition by or against the licensee under the United
States Bankruptcy Code, 11 U.S.C. § 101 et seq., as it existed on
January 1, 2023, for bankruptcy or reorganization;
(C) the filing of a petition by or against the licensee for receivership;
(D) the commencement of any other judicial or administrative
proceeding for the licensee's dissolution or reorganization; or
(E) an action by a creditor against the licensee who is not a beneficiary
of the statutory trust under this subsection.
(2) Permissible investments impressed with a trust under this section shall not
be subject to attachment, levy of execution, or sequestration by order of
any court, except for a beneficiary of the statutory trusts under this section.
43
(f) (1) Upon the establishment of a statutory trust under subsection (e) or if any
funds are drawn on a letter of credit under § 23-55-702(a)(5), then the
commissioner shall notify the applicable regulator of each state in which
the licensee is licensed to engage in money transmission, if any, of the
establishment of the statutory trust or the funds drawn on the letter of
credit, as applicable.
(2) Notice shall be deemed satisfied if performed under a multistate
agreement or through the Nationwide Multistate Licensing System and
Registry.
(3) Funds drawn on a letter of credit, and any other permissible investments
held in trust for the benefit of the purchasers and holders of the licensee's
outstanding money transmission obligations, are deemed held in trust for
the benefit of the purchasers and holders on a pro rata and equitable basis
according to statutes under which permissible investments are required to
be held in this state, and other states, as applicable.
(4) Any statutory trust established under this subchapter shall be terminated
upon extinguishment of all of the licensee's outstanding money
transmission obligations.
(g) (1) The commissioner by rule or by order may allow other types of
investments that the commissioner determines are of sufficient liquidity
and quality to be a permissible investment.
(2) The commissioner may participate in efforts with other state regulators to
determine that other types of investments are of sufficient liquidity and
quality to be a permissible investment.
History. Acts 2007, No. 1595, § 1; 2013, No. 531, § 8; 2019, No. 111, § 8; 2021, No. 532, §
21; 2023, No. 442, § 10.
23-55-702. Types of permissible investments.
(a) Except to the extent otherwise limited by the commissioner pursuant to § 23-55-
701, the following investments are permissible under § 23-55-701:
(1) cash, including demand deposits, savings deposits, and funds in such
accounts held for the benefit of the licensee's customers in a federally
insured depository financial institution, and cash equivalents including
Automated Clearing House network items in transit to the licensee and
Automated Clearing House network items or international wires in transit
to a payee, cash in transit via armored car, cash in smart safes, cash in
licensee-owned locations, debit card or credit card-funded transmission
receivables owed by any bank, or money market mutual funds rated
44
“AAA” by S & P Global Ratings, or the equivalent from any eligible
rating service;
(2) certificates of deposit or senior debt obligations of an insured depository
institution, as defined in Section 3 of the Federal Deposit Insurance Act,
12 U.S.C. § 1813, as it existed on January 1, 2023, or a federal credit
union as defined under the Federal Credit Union Act, 12 U.S.C. § 1751 et
seq., as it existed on January 1, 2023;
(3) an obligation of the United States or a commission, agency, or
instrumentality thereof; an obligation that is guaranteed fully as to
principal and interest by the United States; or an obligation of a state or a
governmental subdivision, agency, or instrumentality thereof;
(4) an investment security that is an obligation of the United States or a
department, agency, or instrumentality thereof; an investment in an
obligation that is guaranteed fully as to principal and interest by the United
States; or an investment in an obligation of a State or a governmental
subdivision, agency, or instrumentality thereof;
(5) the full drawable amount of an irrevocable standby letter of credit for
which the stated beneficiary is the commissioner that stipulates that the
beneficiary need only draw a sight draft under the letter of credit and
present it to obtain funds up to the letter of credit amount within 7 days of
presentation of the items required under subdivision (b)(3); and
(6) 100 percent of the surety bond provided for under § 23-55-204 that
exceeds the average daily money transmission liability in this state.
(b) (1) The letter of credit shall:
(A) be issued by a:
(i) federally insured depository financial institution;
(ii) foreign bank that is authorized under federal law to
maintain a federal agency or federal branch office in a state
or states; or
(iii) foreign bank that is authorized under state law to maintain a
branch in a state that:
(a) bears an eligible rating or whose parent company
bears an eligible rating; and
(b) is regulated, supervised, and examined by United
States federal or state authorities having regulatory
authority over banks, credit unions, and trust
companies;
45
(B) be irrevocable, unconditional, and indicate that it is not subject to
any condition or qualifications outside of the letter of credit;
(C) not contain reference to any other agreements, documents, or
entities, or otherwise provide for any security interest in the
licensee; and
(D) contain an issue date and expiration date, and expressly provide for
automatic extension, without a written amendment, for an
additional period of 1 year from the present or each future
expiration date, unless the issuer of the letter of credit notifies the
commissioner in writing by certified or registered mail or courier
mail or other receipted means, at least 60 days before any
expiration date, that the irrevocable letter of credit will not be
extended.
(2) (A) Upon any notice of expiration or nonextension of a letter of credit
issued under subdivision (b)(1)(D), then the licensee shall be
required to demonstrate to the satisfaction of the commissioner, 15
days before expiration, that the licensee maintains and will
maintain permissible investments under § 23-55-701(a) upon the
expiration of the letter of credit.
(B) If the licensee is not able to do so, then the commissioner may
draw on the letter of credit in an amount up to the amount
necessary to meet the licensee's requirements to maintain
permissible investments under § 23-55-703(a).
(C) Any such draw shall be offset against the licensee's outstanding
money transmission obligations.
(D) The drawn funds shall be held in trust by the commissioner or the
commissioner's designee, to the extent authorized by law, as agent
for the benefit of the purchasers and holders of the licensee's
outstanding money transmission obligations.
(3) The letter of credit shall provide that the issuer of the letter of credit will
honor, at sight, a presentation made by the beneficiary to the issuer of the
following documents on or before the expiration date of the letter of
credit:
(A) the original letter of credit, including any amendments; and
(B) a written statement from the beneficiary stating that any of the
following events have occurred:
(i) the filing of a petition by or against the licensee under the
United States Bankruptcy Code, 11 U.S.C. § 101 et seq., as
46
it existed on January 1, 2023, for bankruptcy or
reorganization;
(ii) the filing of a petition by or against the licensee for
receivership, or the commencement of any other judicial or
administrative proceeding for its dissolution or
reorganization;
(iii) the seizure of assets of a licensee by the commissioner
under an emergency order issued according to applicable
law on the basis of an action, violation, or condition that
has caused or is likely to cause the insolvency of the
licensee; or
(iv) the beneficiary has received notice of expiration or
nonextension of a letter of credit and the licensee failed to
demonstrate to the satisfaction of the beneficiary that the
licensee will maintain permissible investments under § 23-
55-701(a) upon the expiration or nonextension of the letter
of credit.
(4) (A) The commissioner may designate an agent to serve on the
commissioner's behalf as beneficiary to a letter of credit so long as
the agent and letter of credit meet requirements established by the
commissioner.
(B) The commissioner's agent may serve as agent for multiple
licensing authorities for a single irrevocable letter of credit if the
proceeds of the drawable amount for the purposes of this section
are assigned to the commissioner.
(5) The commissioner is authorized and encouraged to participate in
multistate processes designed to facilitate the issuance and administration
of letters of credit, including without limitation services provided by the
Nationwide Multistate Licensing System and Registry.
(c) Unless permitted by the commissioner by rule or by order to exceed the limit as
stated, the following investments are permissible under § 23-55-701 to the extent
specified:
(1) receivables that are payable to a licensee from its authorized delegates in
the ordinary course of business that are less than 7 days old, up to 50
percent of the aggregate value of the licensee's total permissible
investments;
(2) of the receivables permissible under subdivision (c)(1), receivables that
are payable to a licensee from a single authorized delegate in the ordinary
47
course of business may not exceed 10 percent of the aggregate value of the
licensee's total permissible investments;
(3) the following investments are permissible up to 20 percent per category
and combined up to 50 percent of the aggregate value of the licensee's
total permissible investments:
(A) a short-term investment, up to 6 months, bearing an eligible rating;
(B) commercial paper bearing an eligible rating;
(C) a bill, note, bond, or debenture bearing an eligible rating;
(D) United States tri-party repurchase agreements collateralized at 100
percent or more with United States Government or agency
securities, municipal bonds, or other securities bearing an eligible
rating;
(E) money market mutual funds rated less than “AAA” and equal to or
higher than “A-” by S & P Global Ratings, or the equivalent from
any other eligible rating service; and
(F) a mutual fund or other investment fund composed solely and
exclusively of one or more permissible investments listed in
subdivisions (a)(1)-(3); and
(4) cash, including demand deposits, savings deposits, and funds in such
accounts held for the benefit of the licensee's customers, at foreign
depository institutions are permissible up to 10 percent of the aggregate
value of the licensee's total permissible investments if the licensee has
received a satisfactory rating in its most recent examination and the
foreign depository institution:
(A) has an eligible rating;
(B) is registered under the Foreign Account Tax Compliance Act, Pub.
L. No. 111-147;
(C) is not located in any country subject to sanctions from the Office of
Foreign Assets Control; and
(D) is not located in a high-risk or noncooperative jurisdiction as
designated by the international Financial Action Task Force.
(d) A savings deposit, a demand deposit, or a certificate of deposit at a foreign
depository is permissible under § 23-55-701 if the investment does not exceed 10
percent.
(e) Any other investment is permissible under § 23-55-701 if the commissioner
designates, to the extent specified by the commissioner.
48
(f) The aggregate of investments under subsections (b)-(e) may not exceed 50
percent of the total permissible investments of a licensee calculated in accordance
with § 23-55-701.
History. Acts 2007, No. 1595, § 1; 2021, No. 532, § 22; 2023, No. 442, § 11; 2025, No. 177,
§§ 3, 4.
49
ARTICLE 8 Enforcement
23-55-801. Suspension and revocation.
23-55-802. Suspension and revocation of authorized delegates.
23-55-803. Orders to cease and desist.
23-55-804. Consent orders.
23-55-805. Civil penalties.
23-55-806. Criminal penalties.
23-55-807. Unlicensed persons.
23-55-808. Receivership.
23-55-801. Suspension and revocation.
(a) The commissioner may suspend or revoke a license or order a licensee to revoke
the designation of an authorized delegate if:
(1) the licensee violates this chapter or a rule adopted or an order issued under
this chapter;
(2) the licensee does not cooperate with an examination or investigation by
the commissioner;
(3) the licensee engages in fraud, intentional misrepresentation, or gross
negligence;
(4) an authorized delegate is convicted of a violation of a state or federal anti-
money laundering statute, or violates a rule adopted or an order issued
under this chapter, as a result of the licensee's willful misconduct or willful
blindness;
(5) the competence, experience, character, or general fitness of the licensee,
authorized delegate, person in control of a licensee, or responsible person
of the licensee or authorized delegate indicates that it is not in the public
interest to permit the person to provide money services;
(6) the licensee engages in an unsafe or unsound practice;
(7) the licensee is insolvent, suspends payment of its obligations, or makes a
general assignment for the benefit of its creditors;
(8) the licensee does not remove an authorized delegate after the
commissioner issues and serves upon the licensee a final order including a
finding that the authorized delegate has violated this chapter; or
(9) the licensee is the subject of an order, including a denial, suspension, or
revocation, by this or any other state or federal authority that was entered
against the person within the past 5 years, including without limitation the
money services industry.
50
(b) In determining whether a licensee is engaging in an unsafe or unsound practice,
the commissioner may consider the size and condition of the licensee's money
transmission, the magnitude of the loss, the gravity of the violation of this chapter,
and the previous conduct of the person involved.
History. Acts 2007, No. 1595, § 1; 2011, No. 733, § 13.
23-55-802. Suspension and revocation of authorized delegates.
(a) The commissioner may issue an order suspending or revoking the designation of
an authorized delegate, if the commissioner finds that:
(1) the authorized delegate violated this chapter or a rule adopted or an order
issued under this chapter;
(2) the authorized delegate did not cooperate with an examination or
investigation by the commissioner;
(3) the authorized delegate engaged in fraud, intentional misrepresentation, or
gross negligence;
(4) the authorized delegate is convicted of a violation of a state or federal
anti-money laundering statute;
(5) the competence, experience, character, or general fitness of the authorized
delegate or a person in control of the authorized delegate indicates that it
is not in the public interest to permit the authorized delegate to provide
money services; or
(6) the authorized delegate is engaging in an unsafe or unsound practice.
(b) In determining whether an authorized delegate is engaging in an unsafe or
unsound practice, the commissioner may consider the size and condition of the
authorized delegate's provision of money services, the magnitude of the loss, the
gravity of the violation of this chapter or a rule adopted or order issued under this
chapter, and the previous conduct of the authorized delegate.
(c) An authorized delegate may apply for relief from a suspension or revocation of
designation as an authorized delegate according to procedures prescribed by the
commissioner.
History. Acts 2007, No. 1595, § 1.
51
23-55-803. Orders to cease and desist.
(a) If the Securities Commissioner determines that a violation of this chapter or of a
rule adopted or an order issued under this chapter by a licensee, authorized
delegate, or any other person is likely to cause immediate and irreparable harm to
the licensee, its customers, or the public as a result of the violation or cause
insolvency or significant dissipation of assets of the licensee, the commissioner
may issue a summary order requiring the licensee, authorized delegate, or any
other person to cease and desist from the violation. The order becomes effective
upon service of it upon the licensee, authorized delegate, or any other person.
(b) The commissioner may issue a summary order against a licensee to cease and
desist from providing money services through an authorized delegate that is the
subject of a separate order by the commissioner.
(c) An order to cease and desist remains effective and enforceable pending the
completion of an administrative proceeding pursuant to § 23-55-901 or § 23-55-
902 and the entry of a subsequent order to affirm, modify, or vacate the order by
the commissioner.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 17.
23-55-804. Consent orders.
The commissioner may enter into a consent order at any time with a person to resolve a matter
arising under this chapter or a rule adopted or order issued under this chapter. A consent order
must be signed by the person to whom it is issued or by the person's authorized representative,
and must indicate agreement with the terms contained in the order. A consent order may provide
that it does not constitute an admission by a person that this chapter or a rule adopted or an order
issued under this chapter has been violated.
History. Acts 2007, No. 1595, § 1.
23-55-805. Civil penalties.
The commissioner may assess a civil penalty against a person that violates this chapter or a rule
adopted or an order issued under this chapter in an amount not to exceed $1,000 per day for each
day the violation is outstanding, plus this State's costs and expenses for the investigation and
prosecution of the matter, including reasonable attorney's fees.
History. Acts 2007, No. 1595, § 1.
52
23-55-806. Criminal penalties.
(a) A person that intentionally makes a false statement, misrepresentation, or false
certification in a record filed or required to be maintained under this chapter, that
intentionally makes a false entry or omits a material entry in such a record, or
violates any rule promulgated or order issued hereunder is guilty of a Class B
felony.
(b) A person that knowingly engages in an activity for which a license is required
under this chapter without being licensed under this chapter and who receives
more than $500 in compensation within a 30-day period from this activity is
guilty of a Class B felony.
(c) A person that knowingly engages in an activity for which a license is required
under this chapter without being licensed under this chapter and who receives no
more than $500 in compensation within a 30-day period from this activity is
guilty of a Class A misdemeanor.
History. Acts 2007, No. 1595, § 1.
23-55-807. Unlicensed persons.
(a) (1) [Repealed.]
(2) If as a result of an investigation or examination the Securities
Commissioner finds that a person has engaged or is about to engage in an
act or practice constituting a violation of this chapter or a rule or order
under this chapter, the commissioner may summarily issue:
(A) A cease and desist order under § 23-55-803; or
(B) An order to prohibit the person from continuing to engage in
providing money services.
(b) [Repealed.]
(c) (1) An order to cease and desist becomes effective upon service of it upon the
person.
(2) A hearing shall be held on the written request of the person aggrieved by
the order to cease and desist if the request is received by the commissioner
within thirty (30) days of the date of the entry of the order to cease and
desist or if ordered by the commissioner.
(d) An order to cease and desist remains effective and enforceable pending the
completion of an administrative proceeding pursuant to §§ 23-55-901 and 23-55-
902 and the entry of a subsequent order by the commissioner to affirm, modify, or
vacate the order.
53
(e) The commissioner may apply to the Pulaski County Circuit Court to:
(1) Temporarily or permanently enjoin an act or practice that violates this
chapter or a rule or order under this chapter; or
(2) Enforce compliance with this chapter or a rule or order under this chapter.
History. Acts 2007, No. 1595, § 1; 2009, No. 486, § 18.
23-55-808. Receivership.
(a) (1) Whenever a licensee has refused or is unable to pay its obligations
generally as they become due or whenever it appears to the commissioner
that a licensee is in an unsafe or unsound condition, the commissioner, or
the Attorney General representing the commissioner, may apply to the
Pulaski County Circuit Court or to the circuit court of any county in which
the licensee is located for the appointment of a receiver for the licensee.
The court may require the receiver to post a bond in such amount as may
appear necessary to protect claimants of the licensee.
(2) The receiver, subject to the approval of the court, shall take possession of
the books, records, and assets of the licensee and shall take such action
with respect to employees, agents, or representatives of the licensee or
such other action as may be necessary to conserve the assets of the
licensee or ensure payment of instruments issued by the licensee pending
further disposition of its business as provided by law. The receiver shall
sue and defend, compromise, and settle all claims involving the licensee
and exercise such powers and duties as may be necessary and consistent
with the laws of this state applicable to the appointment of receivers.
(3) The receiver, from time to time, but in no event less frequently than once
each calendar quarter, shall report to the court with respect to all acts and
proceedings in connection with the receivership.
History. Acts 2007, No. 1595, § 1.
54
ARTICLE 9 Administrative Procedures
23-55-901. Administrative proceedings.
23-55-902. Hearings.
23-55-901. Administrative proceedings.
All administrative proceedings under this chapter must be conducted in accordance with the
Arkansas Administrative Procedure Act, § 25-15-201 et seq.
History. Acts 2007, No. 1595, § 1.
23-55-902. Hearings.
(a) Except as otherwise provided in §§ 23-55-803 and 23-55-807, the commissioner
may not suspend or revoke a license, issue an order to cease and desist, suspend
or revoke the designation of an authorized delegate, or assess a civil penalty
without notice and an opportunity to be heard.
(b) The commissioner shall also hold a hearing when requested to do so by an
applicant whose application for a license is denied.
History. Acts 2007, No. 1595, § 1; 2011, No. 733, § 14.
55
ARTICLE 10 Miscellaneous Provisions
23-55-1001. Uniformity of application and construction.
23-55-1002. Severability clause.
23-55-1003. Effective date.
23-55-1004. [Reserved.]
23-55-1005. [Repealed.]
23-55-1006. [Repealed.]
23-55-1007. Multistate automated licensing system.
23-55-1008. Virtual currency kiosk requirements.
23-55-1001. Uniformity of application and construction.
In applying and construing this Uniform Act, consideration must be given to the need to promote
uniformity of the law with respect to its subject matter among States that enact it.
History. Acts 2007, No. 1595, § 1.
23-55-1002. Severability clause.
If any provision of this chapter or its application to any person or circumstance is held invalid,
the invalidity does not affect other provisions or applications of this chapter which can be given
effect without the invalid provision or application, and to this end the provisions of this chapter
are severable.
History. Acts 2007, No. 1595, § 1.
23-55-1003. Effective date.
This chapter takes effect January 1, 2008.
History. Acts 2007, No. 1595, § 1.
23-55-1004. [Reserved.]
History. Acts 2007, No. 1595, § 1.
23-55-1005. [Repealed.]
23-55-1006. [Repealed.]
56
23-55-1007. Multistate automated licensing system.
(a) The Securities Commissioner may:
(1) Enter into an arrangement, agreement, or other working relationship with
federal, state, or self-regulatory authorities, the Conference of State Bank
Supervisors, or a subsidiary entity owned by the Conference of State Bank
Supervisors to file and maintain documents in a multistate automated
licensing system or other central depository system;
(2) Waive or modify in whole or in part by rule or by order any requirement of
this chapter if necessary to implement this section; and
(3) Establish new requirements under this chapter to carry out the purpose of
this section.
(b) It is the intent of this section that the commissioner be provided the authority to
reduce duplication of filings, reduce administrative costs, and establish uniform
procedures, forms, and administration with other states and federal authorities.
(c) (1) The commissioner may permit or require initial and renewal registration
filings required under this chapter to be filed with the Conference of State
Bank Supervisors, a subsidiary entity owned by the Conference of State
Bank Supervisors, the Financial Industry Regulatory Authority, or another
entity maintaining or operating a multistate automated licensing system.
(2) The applicant or the licensee shall pay any fee charged for the applicant or
the licensee to participate in the automated licensing system.
(d) The commissioner may accept uniform procedures and forms designed to:
(1) Implement a multistate automated licensing system;
(2) Implement a uniform national regulatory system; or
(3) Facilitate common practices and procedures among the states.
History. Acts 2017, No. 620, § 6.
23-55-1008. Virtual currency kiosk requirements.
(a) (1) The owner of a virtual currency kiosk or a virtual currency kiosk operator,
in establishing a relationship with a customer and before entering into an
initial virtual currency transaction on behalf of or with the customer, shall
disclose in clear, conspicuous, and legible writing in English and in the
language principally used by the licensee or authorized delegate to
advertise, solicit, or negotiate, either orally or in writing, for a transaction
57
conducted in person, electronically, or by phone, if other than English, all
material risks associated with virtual currency generally.
(2) The material risks associated with virtual currency required to be disclosed
under subdivision (a)(1) include without limitation:
(A) a disclosure that is acknowledged by the customer and provided
separately from the disclosures provided under subdivision
(a)(2)(B) and subdivision (a)(2)(G), and written prominently and in
bold type, stating the following:
“WARNING: LOSSES DUE TO FRAUDULENT OR
ACCIDENTAL TRANSACTIONS MAY NOT BE
RECOVERABLE AND TRANSACTIONS IN VIRTUAL
CURRENCY ARE IRREVERSIBLE.”;
(B) virtual currency is not backed or insured by the government and
accounts and value balances are not subject to protections of the
Federal Deposit Insurance Corporation, National Credit Union
Administration, or Securities Investor Protection Corporation;
(C) a virtual currency transaction may be deemed to be made when
recorded on a public ledger which may not be the date or time
when the customer initiates the virtual currency transaction;
(D) the value of virtual currency may be derived from the continued
willingness of market participants to exchange fiat currency for
virtual currency which may result in the permanent and total loss
of the value of a particular virtual currency if the market for that
virtual currency disappears;
(E) the volatility and unpredictability of the price of virtual currency
relative to fiat currency may result in a significant loss over a short
period of time;
(F) a bond maintained by the owner of a virtual currency kiosk or a
virtual currency kiosk operator for the benefit of the customers of
the owner of a virtual currency kiosk or a virtual currency kiosk
operator may not be sufficient to cover all losses incurred by
customers; and
(G) (i) virtual currency transactions are irreversible and may be
used by a person seeking to defraud customers.
(ii) As used in subdivision (a)(2)(G)(i), “seeking to defraud
customers” includes without limitation a person:
(a) impersonating a customer's family or friends;
58
(b) threatening jail time;
(c) stating that a customer's identity has been stolen;
(d) insisting that a customer withdraw money from the
customer's bank account and purchase virtual
currency; or
(e) alleging that a customer's personal computer has
been hacked.
(b) (1) An owner of a virtual currency kiosk or a virtual currency kiosk operator,
when opening an account for a new customer and before entering into an
initial virtual currency transaction for, on behalf of, or with the customer,
shall disclose in clear, conspicuous, and legible writing in English and in
the language principally used by the licensee or authorized delegate to
advertise, solicit, or negotiate, either orally or in writing, for a transaction
conducted in person, electronically, or by phone, if other than English,
using not less than 24-point sans-serif-type font, all relevant terms and
conditions associated with the products, services, and activities of the
owner of a virtual currency kiosk or a virtual currency kiosk operator and
virtual currency generally.
(2) The disclosure required under subdivision (b)(1) shall include without
limitation:
(A) the customer's liability for unauthorized virtual currency
transactions;
(B) the customer's right to stop payment of a preauthorized virtual
currency transfer and the procedure used to initiate a stop-payment
order;
(C) the circumstances under which the owner of a virtual currency
kiosk or a virtual currency kiosk operator, absent a court or
government order, will disclose information concerning the
customer's account to third parties;
(D) the requirement that the owner of a virtual currency kiosk or a
virtual currency kiosk operator communicate to the customer what
customer information may be disclosed to third parties;
(E) the customer's right to receive a receipt for a virtual currency
transaction at the time of the transaction;
(F) upon a change in the rules or policies of the owner or operator, the
customer's right to consent to the changed rules or policies before
performing a transaction after the change; and
59
(G) any other disclosures that are customarily provided in connection
with opening a person's account.
(c) (1) An owner of a virtual currency kiosk or a virtual currency kiosk operator,
before each transaction in virtual currency for, on behalf of, or with a
customer, shall disclose to the customer in an easily readable manner that
is in clear, conspicuous, and legible writing in English and in the language
principally used by the licensee or authorized delegate to advertise, solicit,
or negotiate, either orally or in writing, for a transaction conducted in
person, electronically, or by phone, if other than English, using not less
than 24-point sans-serif-type font, the terms and conditions of the virtual
currency transaction.
(2) The terms and conditions required under subdivision (c)(1) shall include
without limitation:
(A) the amount of the transaction;
(B) any fees, expenses, and charges borne by the customer, including
without limitation applicable exchange rates;
(C) the type and nature of the virtual currency transaction;
(D) a warning that, once executed, the virtual currency transaction may
not be undone, if applicable;
(E) a daily virtual currency transaction limit according to subsection
(g);
(F) the difference in the sale price of the virtual currency versus the
current market price; and
(G) any other disclosures that are customarily given in connection with
a virtual currency transaction.
(d) An owner of a virtual currency kiosk or a virtual currency kiosk operator shall
ensure that each customer acknowledges receipt of all disclosures required under
this section.
(e) (1) An owner of a virtual currency kiosk or a virtual currency kiosk operator,
upon the completion of a virtual currency transaction, shall provide to the
customer a receipt containing:
(A) the name of, and contact information for, the owner of the virtual
currency kiosk or the virtual currency kiosk operator, including
without limitation the owner of the virtual currency kiosk's or the
virtual currency kiosk operator's business address and a customer
service telephone number established by the owner of a virtual
60
currency kiosk or the virtual currency kiosk operator to answer
questions and register complaints;
(B) the name of the customer;
(C) the type, value, date, and precise time of the virtual currency
transaction, transaction hash or identification number, and each
virtual currency address;
(D) the amount of the virtual currency transaction expressed in United
States currency;
(E) the public virtual currency address of the customer;
(F) the unique identifier of the virtual currency kiosk operator;
(G) a fee charged, including without limitation a fee charged directly or
indirectly by the owner of the virtual currency kiosk or the virtual
currency kiosk operator, or a third party involved in the virtual
currency transaction;
(H) the exchange rate, if applicable;
(I) any tax collected by the owner of the virtual currency kiosk or the
virtual currency kiosk operator for the virtual currency transaction;
(J) a statement of the liability of the owner of the virtual currency
kiosk or the virtual currency kiosk operator for nondelivery or
delayed delivery;
(K) a statement of the refund policy of the owner of the virtual
currency kiosk or the virtual currency kiosk operator;
(L) the name and telephone number of the State Securities Department
and a statement disclosing that the owner of the virtual currency
kiosk's or the virtual currency kiosk operator's customers may
contact the department with questions or complaints about the
owner of the virtual currency kiosk's or the virtual currency kiosk
operator's virtual currency kiosk services; and
(M) any additional information the commissioner may require.
(2) The receipt required under subdivision (e)(1):
(A) shall be provided in:
(i) a retainable form;
(ii) English; and
61
(iii) the language principally used by the owner of the virtual
currency kiosk or the virtual currency kiosk operator to
advertise, solicit, or negotiate, orally or in writing; and
(B) may be provided electronically if the customer requests or agrees
to receive an electronic receipt.
(f) The total amount of a fee and commission charged by an owner of the virtual
currency kiosk or a virtual currency kiosk operator for a virtual currency
transaction shall not exceed:
(1) $5.00; or
(2) 18 percent of the amount of the virtual currency transaction.
(g) There are established the following maximum daily virtual currency kiosk
transaction limits:
(1) $2,000 for each new customer of a virtual currency kiosk; and
(2) $7,500 for each existing customer of a virtual currency kiosk.
(h) The owner of a virtual currency kiosk or a virtual currency kiosk operator shall
allow a new customer, upon the request of the new customer, to cancel and
receive a full refund for any fraudulent virtual currency transactions that occurred
not later than 72 hours after the new customer registered as a customer of the
owner of the virtual currency kiosk or the virtual currency kiosk operator if, not
later than 14 days after the last virtual currency transaction that occurred during
the 72-hour period, the new customer:
(1) contacts the owner of the virtual currency kiosk or the virtual currency
kiosk operator and a government or law enforcement agency to inform the
owner of the virtual currency kiosk or the virtual currency kiosk operator
and government or law enforcement agency of the fraudulent nature of the
virtual currency transaction; and
(2) files a report with a government or law enforcement agency memorializing
the fraudulent nature of the virtual currency transaction.
(i) Each owner of a virtual currency kiosk or a virtual currency kiosk operator shall:
(1) obtain a copy of a government-issued identification card that identifies
each customer of the owner of the virtual currency kiosk or the virtual
currency kiosk operator;
(2) maintain restrictions that prevent more than one customer of the owner of
the virtual currency kiosk or the virtual currency kiosk operator from
using the same virtual currency wallet;
62
(3) be able to prevent designated virtual currency wallets from being used at a
virtual currency kiosk owned or operated by the owner of the virtual
currency kiosk or the virtual currency kiosk operator;
(4) use an established third party that specializes in performing blockchain
analyses to preemptively perform the analyses to identify and prevent high
risk or sanctioned virtual currency wallets from being used by customers
at virtual currency kiosks owned or operated by the owner of the virtual
currency kiosk or the virtual currency kiosk operator;
(5) define, in the owner of the virtual currency kiosk's or the virtual currency
kiosk operator's policies and procedures, a risk-based method of
monitoring customers of the owner of the virtual currency kiosk or the
virtual currency kiosk operator on a post-transaction basis;
(6) offer, during the hours of operation of the virtual currency kiosks owned
or operated by the owner of the virtual currency kiosk or the virtual
currency kiosk operator, live customer support by telephone from a
telephone number prominently displayed at or on the virtual currency
kiosks;
(7) (A) identify and speak by telephone with an elder adult who is a new
customer before the elder adult who is a new customer completes
his or her first virtual currency transaction with the owner of the
virtual currency kiosk or the virtual currency kiosk operator.
(B) During the communication, which shall be recorded and retained
by the owner of the virtual currency kiosk or the virtual currency
kiosk operator, the owner of the virtual currency kiosk or the
virtual currency kiosk operator shall:
(i) reconfirm any attestations made by the new customer at a
virtual currency kiosk owned or operated by the owner of
the virtual currency kiosk or the virtual currency kiosk
operator;
(ii) discuss the transaction; and
(iii) (a) discuss types of fraudulent schemes relating to
virtual currency.
(b) The owner of the virtual currency kiosk's or the
virtual currency kiosk operator's approval of the
transaction shall be dependent upon the owner of
the virtual currency kiosk's or the virtual currency
kiosk operator's assessment of the communication;
(8) designate and employ a chief compliance officer who shall:
63
(A) be qualified to coordinate and monitor a compliance program to
ensure compliance with this section and all other applicable federal
laws and regulations and state laws and rules; and
(B) not own more than 20 percent of the owner of the virtual currency
kiosk or the virtual currency kiosk operator that employs the
officer; and
(9) use full-time employees to fulfill the owner of the virtual currency kiosk's
or the virtual currency kiosk operator's compliance responsibilities under
federal laws and regulations and state laws and rules.
History. Acts 2025, No. 557, § 10.
64
ARTICLE 11 Data Security for Money Services
23-55-1101. Definitions.
23-55-1102. Standards for safeguarding customer information.
23-55-1103. Information security program required elements.
23-55-1104. Exceptions.
23-55-1101. Definitions.
In this article:
(1) “Authorized user” means an employee, contractor, agent, or other person that
participates in a financial institution's business operations and is authorized to
access and use a financial institution's information systems and data.
(2) “Consumer” means an individual who obtains or has obtained a financial product
or service from a financial institution that is to be used primarily for personal,
family, or household purposes, or that individual's legal representative.
(3) “Customer” means a consumer who has a customer relationship with a financial
institution.
(4) “Customer information” means a record containing nonpublic personal
information about a customer of a financial institution, whether in paper,
electronic, or other form, that is handled or maintained by or on behalf of a
financial institution or the financial institution's affiliates.
(5) “Customer relationship” means a continuing relationship between a consumer
and a financial institution under which the financial institution provides to the
consumer one or more financial products or services that are used primarily for
personal, family, or household purposes.
(6) “Encryption” means the transformation of data into a form that results in a low
probability of assigning meaning without the use of a protective process or key,
consistent with current cryptographic standards and accompanied by appropriate
safeguards for cryptographic key material.
(7) “Financial institution” means a money services business licensed under this
chapter.
(8) (A) “Financial product or service” means a product or service that a
financial holding company could offer by engaging in a financial activity
under section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C.
§ 1843(k), as it existed on January 1, 2025.
(B) “Financial product or service” includes a financial institution's
evaluation or brokerage of information that a financial institution collects
in connection with a request or an application from a consumer for a
financial product or service.
65
(9) “Information security program” means the administrative, technical, or
physical safeguards a financial institution uses to access, collect, distribute,
process, protect, store, use, transmit, dispose of, or otherwise handle customer
information.
(10) “Information system” means a discrete set of electronic information resources
organized for the collection, processing, maintenance, use, sharing, dissemination,
or disposition of electronic information, including any specialized system such as
an industrial controls system or process controls system, telephone switching and
private branch exchange system, and environmental controls system, that contains
customer information or that is connected to a system that contains customer
information.
(11) “Multi-factor authentication” means authentication through verification of at
least 2 of the following types of authentication factors:
(A) knowledge factors, including without limitation a password;
(B) possession factors, including without limitation a token; or
(C) inherence factors, including without limitation biometric characteristics.
(12) (A) “Nonpublic personal information” means:
(i) personally identifiable financial information; and
(ii) a list, description, or other grouping of consumers, and publicly
available information pertaining to a consumer, that is derived
using personally identifiable financial information that is not
publicly available.
(B) “Nonpublic personal information” includes without limitation a list of
individuals' names and street addresses that is derived in whole or in part
using personally identifiable financial information that is not publicly
available.
(C) “Nonpublic personal information” does not include:
(i) publicly available information except as included on a list
described in subdivision (12)(A)(ii);
(ii) a list, description, or other grouping of consumers, and publicly
available information pertaining to the list, description, or other
grouping of consumers, that is derived without using personally
identifiable financial information that is not publicly available; or
(iii) a list of individuals' names and addresses that contains only
publicly available information and is not:
66
(a) derived, in whole or in part, using personally identifiable
financial information that is not publicly available; and
(b) disclosed in a manner that indicates that any of the
individuals on the list is a consumer of a financial
institution.
(13) (A) “Notification event” means acquisition of unencrypted customer
information without the authorization of an individual to which the
information pertains.
(B) For purposes of subdivision (13)(A):
(i) customer information is considered unencrypted if the encryption
key was accessed by an unauthorized person; and
(ii) unauthorized acquisition will be presumed to include unauthorized
access to unencrypted customer information unless a financial
institution has reliable evidence showing that there has not been, or
could not reasonably have been, unauthorized acquisition of the
customer information.
(14) “Penetration testing” means a test methodology in which assessors attempt to
circumvent or defeat the security features of an information system by attempting
penetration of databases or controls from outside or inside a financial institution's
information systems.
(15) (A) “Personally identifiable financial information” means information:
(i) a consumer provides to a financial institution to obtain a financial
product or service from a financial institution;
(ii) about a consumer resulting from a transaction involving a financial
product or service between a financial institution and a consumer;
or
(iii) a financial institution otherwise obtains about a consumer in
connection with providing a financial product or service to that
consumer.
(B) “Personally identifiable financial information” includes:
(i) information a consumer provides to a financial institution on an
application to obtain a loan, credit card, or other financial product
or service;
(ii) account balance information, payment history, overdraft history,
and credit or debit card purchase information;
67
(iii) the fact that an individual is or has been a financial institution's
customer or has obtained a financial product or service from a
financial institution;
(iv) information about a financial institution's consumer if the
information is disclosed in a manner that indicates that the
individual is or has been the financial institution's consumer;
(v) information that a consumer provides to a financial institution or
that a financial institution or a financial institution's agent
otherwise obtains in connection with collecting on, or servicing, a
credit account;
(vi) information a financial institution collects through an internet
cookie or the information collecting device from a computer
server; and
(vii) information from a consumer report.
(C) “Personally identifiable financial information” does not include:
(i) a list of names and addresses of customers of an entity that is not a
financial institution; and
(ii) information that does not identify a consumer, including aggregate
information or blind data that does not contain personal identifiers
such as account numbers, names, or addresses.
(16) (A) “Publicly available information” means information that a financial
institution has a reasonable basis to believe is lawfully made available to
the public from:
(i) federal, state, or local government records;
(ii) widely distributed media; or
(iii) disclosures to the public that are required to be made by federal,
state, or local law.
(B) “Publicly available information” includes without limitation:
(i) information in government records, including information in
government real estate records and security interest filings; and
(ii) (a) information from widely distributed media, including
information from a telephone book, a television or radio
program, a newspaper, or a website that is available to the
public on an unrestricted basis.
68
(b) A website is not restricted under subdivision (16)(B)(ii)(a)
merely because an internet service provider or a site
operator requires a fee or a password, so long as access is
available to the public.
(C) For purposes of this subdivision (16), a financial institution has a
reasonable basis to believe that:
(i) information is lawfully made available to the public if the financial
institution has taken steps to determine:
(a) that the information is of the type that is available to the
public; and
(b) whether an individual can direct that the information not be
made available to the public and, if so, that the financial
institution's consumer has not directed that the information
not be made available to the public;
(ii) mortgage information is lawfully made available to the public if
the financial institution determines that the information is of the
type included on the public record in the jurisdiction where the
mortgage would be recorded; and
(iii) an individual's telephone number is lawfully made available to the
public if the financial institution has located the telephone number
in a telephone directory or the consumer has informed the financial
institution that the telephone number is not unlisted.
(17) “Qualified individual” means an individual designated by a financial institution
to oversee, implement, and enforce the financial institution's information security
program.
(18) “Security event” means an event resulting in unauthorized access to, or
disruption or misuse of:
(A) an information system or information stored on the information system; or
(B) customer information held in physical form.
(19) “Service provider” means a person or entity that receives, maintains, processes,
or otherwise is permitted access to customer information through its provision of
services directly to a financial institution that is subject to this article.
History. Acts 2025, No. 557, § 11.
69
23-55-1102. Standards for safeguarding customer information.
(a) A financial institution shall develop, implement, and maintain a comprehensive
information security program.
(b) The information security program under subsection (a) shall:
(1) be written in one or more readily accessible parts; and
(2) contain administrative, technical, and physical safeguards that are
appropriate to the financial institution's size and complexity, the nature
and scope of the financial institution's activities, and the sensitivity of any
customer information at issue.
(c) The information security program shall include the information required under §
23-55-1103.
History. Acts 2025, No. 557, § 11.
23-55-1103. Information security program required elements.
(a) In order for a financial institution to develop, implement, and maintain an
information security program, the financial institution shall comply with this
section.
(b) (1) A financial institution shall designate a qualified individual responsible for
overseeing and implementing the financial institution's information
security program and enforcing an information security program.
(2) (A) The qualified individual may be employed by the financial
institution, an affiliate, or a service provider.
(B) If a financial institution designates an individual employed by an
affiliate or service provider, the financial institution shall:
(i) retain responsibility for compliance with this section;
(ii) designate a senior member of the financial institution's
personnel to be responsible for direction and oversight of
the qualified individual; and
(iii) require the service provider or affiliate to maintain an
information security program that protects the financial
institution in accordance with the requirements of this
section.
(c) (1) A financial institution shall base the financial institution's information
security program on a risk assessment that:
70
(A) identifies reasonably foreseeable internal and external risks to the
security, confidentiality, and integrity of customer information that
could result in the unauthorized disclosure, misuse, alteration,
destruction, or other compromise of the information; and
(B) assesses the sufficiency of any safeguards in place to control these
risks.
(2) The risk assessment shall be written and include:
(A) criteria for the evaluation and categorization of identified security
risks or threats the financial institution faces;
(B) criteria for the assessment of the confidentiality, integrity, and
availability of the financial institution's information systems and
customer information, including the adequacy of the existing
controls in the context of the identified risks or threats the financial
institution faces; and
(C) requirements describing how identified risks will be mitigated or
accepted based on the risk assessment and how the information
security program will address the risks.
(3) A financial institution shall periodically perform additional risk
assessments that:
(A) reexamine the reasonably foreseeable internal and external risks to
the security, confidentiality, and integrity of customer information
that could result in the unauthorized disclosure, misuse, alteration,
destruction, or other compromise of customer information; and
(B) reassess the sufficiency of any safeguards in place to control these
risks.
(d) A financial institution shall design and implement safeguards to control the risks
the financial institution identifies through the risk assessment as required under
subsection (c), including without limitation:
(1) implementing and periodically reviewing access controls, including
technical and, as appropriate, physical controls, to:
(A) authenticate and permit access only to authorized users to protect
against the unauthorized acquisition of customer information; and
(B) limit authorized users' access only to customer information that the
authorized user needs to perform the authorized user's duties and
functions, or in the case of customers, to access the customer's own
customer information;
71
(2) identifying and managing the data, personnel, devices, systems, and
facilities that enable the financial institution to achieve business purposes
according to the financial institution's relative importance to business
objectives and the financial institution's risk strategy;
(3) (A) protecting by encryption all customer information held or
transmitted by the financial institution both in transit over external
networks and at rest.
(B) To the extent the financial institution determines that encryption of
customer information, either in transit over external networks or at
rest, is infeasible, the financial institution may instead secure the
customer information using effective alternative compensating
controls reviewed and approved by the financial institution's
qualified individual;
(4) adopting secure development practices for in-house developed
applications utilized by the financial institution for transmitting, accessing,
or storing customer information and procedures for evaluating, assessing,
or testing the security of externally developed applications the financial
institution utilizes to transmit, access, or store customer information;
(5) implementing multi-factor authentication for an individual accessing an
information system, unless the financial institution's qualified individual
has approved in writing the use of reasonably equivalent or more secure
access controls;
(6) developing, implementing, and maintaining procedures for the secure
disposal of customer information in any format no later than 2 years after
the last date the customer information is used in connection with the
provision of a financial product or service to the customer, unless:
(A) the customer information is:
(i) necessary for business operations or for other legitimate
business purposes; or
(ii) otherwise required to be retained by state law or rule, or
federal law or regulation; or
(B) targeted disposal is not reasonably feasible due to the manner in
which the customer information is maintained;
(7) periodically reviewing the financial institution's data retention policy to
minimize the unnecessary retention of data;
(8) adopting procedures for change management; and
72
(9) implementing policies, procedures, and controls designed to monitor and
log the activity of authorized users and detect unauthorized access or use
of, or tampering with, customer information by these users.
(e) (1) A financial institution shall regularly test or otherwise monitor the
effectiveness of the safeguards' key controls, systems, and procedures of
the safeguards required under this section, including those to detect actual
and attempted attacks on or intrusions into information systems.
(2) (A) For information systems, monitoring and testing shall include
continuous monitoring or periodic penetration testing and
vulnerability assessments.
(B) Absent effective continuous monitoring or other systems to detect,
on an ongoing basis, changes in information systems that may
create vulnerabilities, the financial institution shall conduct:
(i) annual penetration testing of a financial institution's
information systems determined each given year based on
relevant identified risks according to the risk assessment;
and
(ii) vulnerability assessments, including a systemic scan or
review of an information system reasonably designed to
identify publicly known security vulnerabilities in the
financial institution's information systems based on the risk
assessment, at least every 6 months, and whenever there
are:
(a) material changes to the financial institution's
operations or business arrangements; and
(b) circumstances the financial institution knows or has
reason to know may have a material impact on the
financial institution's information security program.
(f) A financial institution shall implement policies and procedures to ensure that
personnel are able to enact the financial institution's information security program
by:
(1) providing the financial institution's personnel with security awareness
training that is updated as necessary to reflect risks identified by the risk
assessment;
(2) utilizing qualified information security personnel employed by the
financial institution or an affiliate or service provider sufficient to manage
the financial institution's information security risks and to perform or
oversee the information security program;
73
(3) providing information security personnel with security updates and
training sufficient to address relevant security risks; and
(4) verifying that key information security personnel take steps to maintain
current knowledge of changing information security threats and
countermeasures.
(g) A financial institution shall oversee service providers by:
(1) taking reasonable steps to select and retain service providers that are
capable of maintaining appropriate safeguards for the customer
information at issue;
(2) requiring the financial institution's service providers by contract to
implement and maintain the safeguards referenced under subdivision
(g)(1); and
(3) periodically assessing the financial institution's service providers based on
the risk they present and the continued adequacy of their safeguards.
(h) A financial institution shall evaluate and adjust the financial institution's
information security program to reflect:
(1) the results of the testing and monitoring required by subsection (e);
(2) any material change to the financial institution's operations or business
arrangements or other circumstances;
(3) the results of risk assessments performed under subdivision (c)(3); and
(4) any other circumstances that the financial institution knows or has reason
to know may have a material impact on the financial institution's
information security program.
(i) (1) A financial institution shall establish a written incident response plan
designed to promptly respond to, and recover from, any security event
materially affecting the confidentiality, integrity, or availability of
customer information in the financial institution's control.
(2) The incident response plan under subdivision (i)(1) shall address:
(A) the goals of the incident response plan;
(B) the internal processes for responding to a security event;
(C) the definition of clear roles, responsibilities, and levels of decision-
making authority;
(D) external and internal communications and information sharing;
74
(E) identification of requirements for the remediation of any identified
weaknesses in information systems and associated controls;
(F) documentation and reporting regarding security events and related
incident response activities; and
(G) the evaluation and revision as necessary of the incident response
plan following a security event.
(j) (1) The financial institution's qualified individual shall report in writing at
least annually to the financial institution's board of directors or equivalent