Read the full stored bill text
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 1 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
A bill to be entitled 1
An act relating to the Office of Financial Regulation; 2
creating s. 494.00123, F.S.; providing definitions; 3
requiring loan originators, mortgage brokers, and 4
mortgage lenders to develop, implement, and maintain 5
comprehensive written information security programs 6
for the protection of information systems and 7
nonpublic personal information; providing requirements 8
for such programs; requiring loan originators, 9
mortgage brokers, and mortgage lenders to establish 10
written incident response plans for specified 11
purposes; providing requirements for such plans; 12
providing applicability; providing compliance 13
requirements under specified circumstances; requiring 14
loan originators, mortgage brokers, and mortgage 15
lenders to maintain copies of information security 16
programs for a specified timeframe and to make them 17
available to the Office of Financial Regulation under 18
certain circumstances; providing requirements for 19
notices of security breaches; providing construction; 20
requiring the Financial Services Commission to adopt 21
rules; amending s. 494.00255, F.S.; providing 22
additional acts that constitute a ground for specified 23
disciplinary actions against loan originators and 24
mortgage brokers; amending s. 517.021, F.S.; revising 25
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 2 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
the definition of the term "investment adviser" and 26
defining the term "place of business"; amending s. 27
517.061, F.S.; revising the definition of the term 28
"family office"; creating s. 520.135, F.S.; specifying 29
that the rights and obligations of parties with 30
respect to a surrendered or repossessed motor vehicle 31
are exclusively governed by certain provisions; 32
amending s. 560.114, F.S.; specifying the entities 33
that are subject to certain disciplinary actions and 34
penalties; revising the list of actions by money 35
services businesses which constitute grounds for 36
certain disciplinary actions and penalties; providing 37
requirements for emergency suspension orders that 38
suspend money services business licenses; providing 39
that an emergency suspension order is effective when 40
the licensee against whom the order is directed has 41
actual or constructive knowledge; requiring the office 42
to institute proceedings within a specified timeframe 43
after issuance of an emergency suspension order; 44
authorizing a licensee subject to an emergency 45
suspension order to seek judicial review; requiring, 46
rather than authorizing, the office to suspend 47
licenses of money services businesses under certain 48
circumstances; creating s. 560.1311, F.S.; providing 49
definitions; requiring money services businesses to 50
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 3 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
develop, implement, and maintain comprehensive written 51
information security programs for the protection of 52
information systems and nonpublic personal 53
information; providing requirements for such programs; 54
requiring money services businesses to establish 55
written incident response plans for specified 56
purposes; providing requirements for such plans; 57
providing applicability; providing compliance 58
requirements under specified circumstances; requiring 59
money services businesses to maintain copies of 60
information security programs for a specified 61
timeframe and to make them available to the office 62
under certain circumstances; providing requirements 63
for notices of security breaches; providing 64
construction; requiring the commission to adopt rules; 65
amending s. 560.309, F.S.; providing that licensees 66
must comply with the Fair Debt Collections Practices 67
Act only if the licensees meet certain criteria; 68
amending s. 560.405, F.S.; providing that a debit card 69
transaction shall be treated the same as cash 70
transactions and prohibiting redemption through a 71
credit card transaction; amending s. 560.406, F.S.; 72
providing that licensees must comply with the Fair 73
Debt Collections Practices Act only if the licensees 74
meet certain criteria; creating s. 655.0171, F.S.; 75
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 4 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
providing definitions; requiring financial 76
institutions to take measures to protect and secure 77
certain data that contain personal information; 78
providing requirements for notices of security 79
breaches to the office, the Department of Legal 80
Affairs, certain individuals, and certain credit 81
reporting agencies; amending s. 655.045, F.S.; 82
revising the timeline for the mailing of payment for 83
salary and travel expenses of certain field staff; 84
amending s. 657.005, F.S.; revising requirements for 85
permission to organize credit unions; amending s. 86
657.024, F.S.; authorizing meetings of credit union 87
members to be held virtually without an in-person 88
quorum and authorizing virtual attendance to satisfy 89
quorum requirements under certain circumstances; 90
amending s. 657.042, F.S.; removing provisions that 91
impose limitations on investments in real estate and 92
equipment for credit unions; amending s. 658.21, F.S.; 93
revising requirements and factors for approving 94
applications for organizing banks and trust companies; 95
amending s. 658.33, F.S.; revising requirements for 96
directors of certain banks and trust companies; 97
amending s. 662.141, F.S.; revising the timeline for 98
the mailing of payment for the salary and travel 99
expenses of certain field staff; amending s. 517.12, 100
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 5 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
F.S.; conforming a cross-reference; providing an 101
effective date. 102
103
Be It Enacted by the Legislature of the State of Florida: 104
105
Section 1. Section 494.00123, Florida Statutes, is created 106
to read: 107
494.00123 Information security programs.— 108
(1) DEFINITIONS.—As used in this section, the term: 109
(a) "Customer" means a person who seeks to obtain or who 110
obtains or has obtained a financial product or service from a 111
licensee. 112
(b) "Customer information" means any record containing 113
nonpublic personal information about a customer of a financial 114
transaction, whether on paper, electronic, or in other forms, 115
which is handled or maintained by or on behalf of the licensee 116
or its affiliates. 117
(c) "Cybersecurity event" means an event resulting in 118
unauthorized access to, or disruption or misuse of, an 119
information system, information stored on such information 120
system, or customer information held in physical form. 121
(d) "Financial product or service" means any product or 122
service offered by a licensee under this chapter. 123
(e) "Information security program" means the 124
administrative, technical, or physical safeguards used to 125
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 6 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
access, collect, distribute, process, protect, store, use, 126
transmit, dispose of, or otherwise handle customer information. 127
(f) "Information system" means a discrete set of 128
electronic information resources organized for the collection, 129
processing, maintenance, use, sharing, dissemination, or 130
disposition of electronic information, as well as any 131
specialized system such as an industrial process control system, 132
telephone switching and private branch exchange system, or 133
environmental control system, which contain customer information 134
or which are connected to a system that contains customer 135
information. 136
(g) "Licensee" means a person licensed under this chapter. 137
(h)1. "Nonpublic personal information" means: 138
a. Personally identifiable financial information; and 139
b. Any list, description, or other grouping of customers 140
that is derived using any personally identifiable financial 141
information that is not publicly available, such as account 142
numbers, including any list of individuals' names and street 143
addresses that is derived, in whole or in part, using personally 144
identifiable financial information that is not publicly 145
available. 146
2. The term does not include: 147
a. Publicly available information, except as included on a 148
list, description, or other grouping of customers described in 149
sub-subparagraph 1.b.; 150
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 7 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
b. Any list, description, or other grouping of consumers, 151
or any publicly available information pertaining to such list, 152
description, or other grouping of consumers, which is derived 153
without using any personally identifiable financial information 154
that is not publicly available; or 155
c. Any list of individuals' names and addresses that 156
contains only publicly available information, is not derived, in 157
whole or in part, using personally identifiable financial 158
information that is not publicly available, and is not disclosed 159
in a manner that indicates that any of the individuals on the 160
list is a customer of a licensee. 161
3. As used in this paragraph, the term: 162
a.(I) "Personally identifiable financial information" 163
means any information that: 164
(A) A customer provides to a licensee to obtain a 165
financial product or service, such as information that a 166
customer provides to a licensee on an application to obtain a 167
loan or other financial product or service; 168
(B) A licensee receives about a consumer that is obtained 169
during or as a result of any transaction involving a financial 170
product or service between the licensee and the customer, such 171
as information collected through an information-collecting 172
device from a web server; or 173
(C) A licensee otherwise obtains about a customer in 174
connection with providing a financial product or service to the 175
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 8 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
customer, such as the fact that an individual is or has been one 176
of the licensee's customers or has obtained a financial product 177
or service from the licensee. 178
(II) The term "personally identifiable financial 179
information" does not include: 180
(A) A list of names and addresses of customers of an 181
entity that is not a financial institution; or 182
(B) Information that does not identify a customer, such as 183
blind data or aggregate information that does not contain 184
personal identifiers such as account numbers, names, or 185
addresses. 186
b.(I) "Publicly available information" means any 187
information that a licensee has a reasonable basis to believe is 188
lawfully made available to the general public from: 189
(A) Federal, state, or local government records, such as 190
government real estate records or security interest filings; 191
(B) Widely distributed media, such as information from a 192
telephone records repository or directory, a television or radio 193
program, a newspaper, a social media platform, or a website that 194
is available to the general public on an unrestricted basis. A 195
website is not restricted merely because an Internet service 196
provider or a site operator requires a fee or a password, so 197
long as access is available to the general public; or 198
(C) Disclosures to the general public which are required 199
to be made by federal, state, or local law. 200
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 9 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
(II) As used in this sub-subparagraph, the term 201
"reasonable basis to believe is lawfully made available to the 202
general public" relating to any information means that the 203
person has taken steps to determine: 204
(A) That the information is of the type that is available 205
to the general public, such as information included on the 206
public record in the jurisdiction where the mortgage would be 207
recorded; and 208
(B) Whether an individual can direct that the information 209
not be made available to the general public and, if so, the 210
customer to whom the information relates has not done so, such 211
as when a telephone number is listed in a telephone directory 212
and the customer has informed the licensee that the telephone 213
number is not unlisted. 214
(i) "Third-party service provider" means a person, other 215
than a licensee, which contracts with a licensee to maintain, 216
process, or store nonpublic personal information, or is 217
otherwise permitted access to nonpublic personal information 218
through its provision of services to a licensee. 219
(2) INFORMATION SECURITY PROGRAM.— 220
(a) Each licensee shall develop, implement, and maintain a 221
comprehensive written information security program that contains 222
administrative, technical, and physical safeguards for the 223
protection of the licensee's information system and nonpublic 224
personal information. 225
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 10 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
(b) Each licensee shall ensure that the information 226
security program meets all of the following criteria: 227
1. Be commensurate with the following measures: 228
a. Size and complexity of the licensee. 229
b. Nature and scope of the licensee's activities, 230
including the licensee's use of third-party service providers. 231
c. Sensitivity of nonpublic personal information that is 232
used by the licensee or that is in the licensee's possession, 233
custody, or control. 234
2. Be designed to do all of the following: 235
a. Protect the security and confidentiality of nonpublic 236
personal information and the security of the licensee's 237
information system. 238
b. Protect against threats or hazards to the security or 239
integrity of nonpublic personal information and the licensee's 240
information system. 241
c. Protect against unauthorized access to or the use of 242
nonpublic personal information and minimize the likelihood of 243
harm to any customer. 244
3. Define and periodically reevaluate the retention 245
schedule and the mechanism for the destruction of nonpublic 246
personal information if retention is no longer necessary for the 247
licensee's business operations or is no longer required by 248
applicable law. 249
4. Regularly test and monitor systems and procedures for 250
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 11 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
the detection of actual and attempted attacks on, or intrusions 251
into, the licensee's information system. 252
5. Be monitored, evaluated, and adjusted, as necessary, to 253
meet all of the following requirements: 254
a. Determine whether the licensee's information security 255
program is consistent with relevant changes in technology. 256
b. Confirm the licensee's information security program 257
accounts for the sensitivity of nonpublic personal information. 258
c. Identify changes that may be necessary to the 259
licensee's information system. 260
d. Mitigate any internal or external threats to nonpublic 261
personal information. 262
e. Amend the licensee's information security program for 263
any of the licensee's changing business arrangements, including, 264
but not limited to, mergers and acquisitions, alliances and 265
joint ventures, and outsourcing arrangements. 266
(c)1. As part of a licensee's information security 267
program, the licensee shall establish a written incident 268
response plan designed to promptly respond to, and recover from, 269
a cybersecurity event that compromises: 270
a. The confidentiality, integrity, or availability of 271
nonpublic personal information in the licensee's possession; 272
b. The licensee's information system; or 273
c. The continuing functionality of any aspect of the 274
licensee's operations. 275
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 12 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
2. The written incident response plan must address all of 276
the following: 277
a. The licensee's internal process for responding to a 278
cybersecurity event. 279
b. The goals of the licensee's incident response plan. 280
c. The assignment of clear roles, responsibilities, and 281
levels of decisionmaking authority for the licensee's personnel 282
that participate in the incident response plan. 283
d. External communications, internal communications, and 284
information sharing related to a cybersecurity event. 285
e. The identification of remediation requirements for 286
weaknesses identified in information systems and associated 287
controls. 288
f. The documentation and reporting regarding cybersecurity 289
events and related incident response activities. 290
g. The evaluation and revision of the incident response 291
plan, as appropriate, following a cybersecurity event. 292
h. The process by which notice must be given as required 293
under subsection (3) and s. 501.171(3) and (4). 294
(d)1. This section does not apply to a licensee that has 295
fewer than: 296
a. Twenty individuals on its workforce, including 297
employees and independent contractors; or 298
b. Five hundred customers during a calendar year. 299
2. A licensee that no longer qualifies for exemption under 300
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 13 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
subparagraph 1. has 180 calendar days to comply with this 301
section after the date of the disqualification. 302
(e) Each licensee shall maintain a copy of the information 303
security program for a minimum of 5 years and shall make it 304
available to the office upon request or as part of an 305
examination. 306
(3) NOTICE TO OFFICE OF SECURITY BREACH.—Each licensee 307
shall provide notice to the office of any breach of security 308
affecting 500 or more individuals in this state at a time and in 309
the manner prescribed by commission rule. 310
(4) CONSTRUCTION.—This section may not be construed to 311
relieve a covered entity from complying with s. 501.171. To the 312
extent a licensee is a covered entity, as defined in s. 313
501.171(1), the licensee remains subject to s. 501.171. 314
(5) RULES.—The commission must adopt rules to administer 315
this section, including rules that allow a licensee that is in 316
compliance with the Federal Trade Commission's Standards for 317
Safeguarding Customer Information, 16 C.F.R. part 314, to be 318
deemed in compliance with subsection (2). 319
Section 2. Paragraph (z) is added to subsection (1) of 320
section 494.00255, Florida Statutes, to read: 321
494.00255 Administrative penalties and fines; license 322
violations.— 323
(1) Each of the following acts constitutes a ground for 324
which the disciplinary actions specified in subsection (2) may 325
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 14 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
be taken against a person licensed or required to be licensed 326
under part II or part III of this chapter: 327
(z) Failure to comply with the notification requirements 328
in s. 501.171(3) and (4). 329
Section 3. Subsections (28) through (36) of section 330
517.021, Florida Statutes, are renumbered as subsections (29) 331
through (37), respectively, subsection (20) is amended, and a 332
new subsection (28) is added to that section, to read: 333
517.021 Definitions.—When used in this chapter, unless the 334
context otherwise indicates, the following terms have the 335
following respective meanings: 336
(20)(a) "Investment adviser" means a person, other than an 337
associated person of an investment adviser or a federal covered 338
adviser, that receives compensation, directly or indirectly, and 339
engages for all or part of the person's time, directly or 340
indirectly, or through publications or writings, in the business 341
of advising others as to the value of securities or as to the 342
advisability of investments in, purchasing of, or selling of 343
securities. 344
(b) The term does not include any of the following: 345
1. A dealer or an associated person of a dealer whose 346
performance of services in paragraph (a) is solely incidental to 347
the conduct of the dealer's or associated person's business as a 348
dealer and who does not receive special compensation for those 349
services. 350
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 15 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
2. A licensed practicing attorney or certified public 351
accountant whose performance of such services is solely 352
incidental to the practice of the attorney's or accountant's 353
profession. 354
3. A bank authorized to do business in this state. 355
4. A bank holding company as defined in the Bank Holding 356
Company Act of 1956, as amended, authorized to do business in 357
this state. 358
5. A trust company having trust powers, as defined in s. 359
658.12, which it is authorized to exercise in this state, which 360
trust company renders or performs investment advisory services 361
in a fiduciary capacity incidental to the exercise of its trust 362
powers. 363
6. A person that renders investment advice exclusively to 364
insurance or investment companies. 365
7. A person: 366
a. Without a place of business in this state if the person 367
has had that, during the preceding 12 months, has fewer than six 368
clients who are residents of this state. 369
b. With a place of business in this state if the person 370
has had, during the preceding 12 months, fewer than six clients 371
who are residents of this state and no clients who are not 372
residents of this state. 373
374
As used in this subparagraph, the term "client" has the same 375
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 16 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
meaning as provided in Securities and Exchange Commission Rule 376
222-2 275.222-2, 17 C.F.R. s. 275.222-2, as amended. 377
8. A federal covered adviser. 378
9. The United States, a state, or any political 379
subdivision of a state, or any agency, authority, or 380
instrumentality of any such entity; a business entity that is 381
wholly owned directly or indirectly by such a governmental 382
entity; or any officer, agent, or employee of any such 383
governmental or business entity who is acting within the scope 384
of his or her official duties. 385
10. A family office as defined in Securities and Exchange 386
Commission Rule 202(a)(11)(G)-1(b) under the Investment Advisers 387
Act of 1940, 17 C.F.R. s. 275.202(a)(11)(G)-1(b), as amended. In 388
determining whether a person meets the definition of a family 389
office under this subparagraph, the terms "affiliated family 390
office," "control," "executive officer," "family client," 391
"family entity," "family member," "former family member," "key 392
employee," and "spousal equivalent" have the same meaning as in 393
Securities and Exchange Commission Rule 202(a)(11)(G)-1(d) under 394
the Investment Advisers Act of 1940, 17 C.F.R. s. 395
275.202(a)(11)(G)-1(d), as amended. 396
(28) "Place of business" of an investment adviser means an 397
office at which the investment adviser regularly provides 398
investment advisory services to, solicits, meets with, or 399
otherwise communicates with clients; and any other location that 400
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 17 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
is held out to the general public as a location at which the 401
investment adviser provides investment advisory services to, 402
solicits, meets with, or otherwise communicates with clients. 403
Section 4. Paragraph (i) of subsection (9) of section 404
517.061, Florida Statutes, is amended to read: 405
517.061 Exempt transactions.— Except as otherwise provided 406
in subsection (11), the exemptions provided herein from the 407
registration requirements of s. 517.07 are self-executing and do 408
not require any filing with the office before being claimed. Any 409
person who claims entitlement to an exemption under this section 410
bears the burden of proving such entitlement in any proceeding 411
brought under this chapter. The registration provisions of s. 412
517.07 do not apply to any of the following transactions; 413
however, such transactions are subject to s. 517.301: 414
(9) The offer or sale of securities to: 415
(i) A family office as defined in Securities and Exchange 416
Commission Rule 202(a)(11)(G)-1(b) 202(a)(11)(G)-1 under the 417
Investment Advisers Act of 1940, 17 C.F.R. s. 275.202(a)(11)(G)-418
1(b) 17 C.F.R. s. 275.202(a)(11)(G)-1, as amended, provided 419
that: 420
1. The family office has assets under management in excess 421
of $5 million; 422
2. The family office is not formed for the specific 423
purpose of acquiring the securities offered; and 424
3. The prospective investment of the family office is 425
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 18 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
directed by a person who has knowledge and experience in 426
financial and business matters that the family office is capable 427
of evaluating the merits and risks of the prospective 428
investment. 429
430
In determining whether a person meets the definition of a family 431
office under this paragraph, the terms "affiliated family 432
office," "control," "executive officer," "family client," 433
"family entity," "family member," "former family member," "key 434
employee," and "spousal equivalent" have the same meaning as in 435
Securities and Exchange Commission Rule 202(a)(11)(G)-1(d) under 436
the Investment Advisers Act of 1940, 17 C.F.R. s. 437
275.202(a)(11)(G)-1(d), as amended. 438
Section 5. Section 520.135, Florida Statutes, is created 439
to read: 440
520.135 Surrendered or repossessed vehicles.—The rights 441
and obligations of parties with respect to a surrendered or 442
repossessed motor vehicle are exclusively governed by part VI of 443
chapter 679. 444
Section 6. Subsections (1) and (2) of section 560.114, 445
Florida Statutes, are amended to read: 446
560.114 Disciplinary actions; penalties.— 447
(1) The following actions by a money services business, an 448
authorized vendor, or a affiliated party that was affiliated at 449
the time of commission of the actions constitute grounds for the 450
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 19 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
issuance of a cease and desist order; the issuance of a removal 451
order; the denial, suspension, or revocation of a license; or 452
taking any other action within the authority of the office 453
pursuant to this chapter: 454
(a) Failure to comply with any provision of this chapter 455
or related rule or order, or any written agreement entered into 456
with the office. 457
(b) Fraud, misrepresentation, deceit, or gross negligence 458
in any transaction by a money services business, regardless of 459
reliance thereon by, or damage to, a customer. 460
(c) Fraudulent misrepresentation, circumvention, or 461
concealment of any matter that must be stated or furnished to a 462
customer pursuant to this chapter, regardless of reliance 463
thereon by, or damage to, such customer. 464
(d) False, deceptive, or misleading advertising. 465
(e) Failure to maintain, preserve, keep available for 466
examination, and produce all books, accounts, files, or other 467
documents required by this chapter or related rules or orders, 468
by 31 C.F.R. ss. 1010.306, 1010.311, 1010.312, 1010.340, 469
1010.410, 1010.415, 1022.210, 1022.320, 1022.380, and 1022.410, 470
or by an agreement entered into with the office. 471
(f) Refusing to allow the examination or inspection of 472
books, accounts, files, or other documents by the office 473
pursuant to this chapter, or to comply with a subpoena issued by 474
the office. 475
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 20 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
(g) Failure to pay a judgment recovered in any court by a 476
claimant in an action arising out of a money transmission 477
transaction within 30 days after the judgment becomes final. 478
(h) Engaging in an act prohibited under s. 560.111 or s. 479
560.1115. 480
(i) Insolvency. 481
(j) Failure by a money services business to remove an 482
affiliated party after the office has issued and served upon the 483
money services business a final order setting forth a finding 484
that the affiliated party has violated a provision of this 485
chapter. 486
(k) Making a material misstatement, misrepresentation, or 487
omission in an application for licensure, any amendment to such 488
application, or application for the appointment of an authorized 489
vendor. 490
(l) Committing any act that results in a license or its 491
equivalent, to practice any profession or occupation being 492
denied, suspended, revoked, or otherwise acted against by a 493
licensing authority in any jurisdiction. 494
(m) Being the subject of final agency action or its 495
equivalent, issued by an appropriate regulator, for engaging in 496
unlicensed activity as a money services business or deferred 497
presentment provider in any jurisdiction. 498
(n) Committing any act resulting in a license or its 499
equivalent to practice any profession or occupation being 500
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 21 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
denied, suspended, revoked, or otherwise acted against by a 501
licensing authority in any jurisdiction for a violation of 18 502
U.S.C. s. 1956, 18 U.S.C. s. 1957, 18 U.S.C. s. 1960, 31 U.S.C. 503
s. 5324, or any other law or rule of another state or of the 504
United States relating to a money services business, deferred 505
presentment provider, or usury that may cause the denial, 506
suspension, or revocation of a money services business or 507
deferred presentment provider license or its equivalent in such 508
jurisdiction. 509
(o) Having been convicted of, or entered a plea of guilty 510
or nolo contendere to, any felony or crime punishable by 511
imprisonment of 1 year or more under the law of any state or the 512
United States which involves fraud, moral turpitude, or 513
dishonest dealing, regardless of adjudication. 514
(p) Having been convicted of, or entered a plea of guilty 515
or nolo contendere to, a crime under 18 U.S.C. s. 1956 or 31 516
U.S.C. s. 5318, s. 5322, or s. 5324, regardless of adjudication. 517
(q) Having been convicted of, or entered a plea of guilty 518
or nolo contendere to, misappropriation, conversion, or unlawful 519
withholding of moneys belonging to others, regardless of 520
adjudication. 521
(r) Having been convicted of, or entered a plea of guilty 522
or nolo contendere to, a violation of 31 C.F.R. chapter X, part 523
1022, regardless of adjudication. 524
(s)(r) Failure to inform the office in writing within 30 525
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 22 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
days after having pled guilty or nolo contendere to, or being 526
convicted of, any felony or crime punishable by imprisonment of 527
1 year or more under the law of any state or the United States, 528
or any crime involving fraud, moral turpitude, or dishonest 529
dealing. 530
(t)(s) Aiding, assisting, procuring, advising, or abetting 531
any person in violating a provision of this chapter or any order 532
or rule of the office or commission. 533
(u)(t) Failure to pay any fee, charge, or cost imposed or 534
assessed under this chapter. 535
(v)(u) Failing to pay a fine assessed by the office within 536
30 days after the due date as stated in a final order. 537
(w)(v) Failure to pay any judgment entered by any court 538
within 30 days after the judgment becomes final. 539
(x)(w) Engaging or advertising engagement in the business 540
of a money services business or deferred presentment provider 541
without a license, unless exempted from licensure. 542
(y)(x) Payment to the office for a license or other fee, 543
charge, cost, or fine with a check or electronic transmission of 544
funds that is dishonored by the applicant's or licensee's 545
financial institution. 546
(z)(y) Violations of 31 C.F.R. ss. 1010.306, 1010.311, 547
1010.312, 1010.340, 1010.410, 1010.415, 1022.210, 1022.320, 548
1022.380, and 1022.410, and United States Treasury Interpretive 549
Release 2004-1. 550
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 23 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
(aa)(z) Any practice or conduct that creates the 551
likelihood of a material loss, insolvency, or dissipation of 552
assets of a money services business or otherwise materially 553
prejudices the interests of its customers. 554
(bb)(aa) Failure of a check casher to maintain a federally 555
insured depository account as required by s. 560.309. 556
(cc)(bb) Failure of a check casher to deposit into its own 557
federally insured depository account any payment instrument 558
cashed as required by s. 560.309. 559
(dd)(cc) Violating any provision of the Military Lending 560
Act, 10 U.S.C. s. 987, or the regulations adopted under that act 561
in 32 C.F.R. part 232, in connection with a deferred presentment 562
transaction conducted under part IV of this chapter. 563
(ee) Failure to comply with the notification requirements 564
in s. 501.171(3) and (4). 565
(2) Pursuant to s. 120.60(6), The office shall issue an 566
emergency suspension order suspending may summarily suspend the 567
license of a money services business if the office finds that a 568
licensee poses a danger deemed by the Legislature to be an 569
immediate and, serious danger to the public health, safety, and 570
welfare. A proceeding in which the office seeks the issuance of 571
a final order for the summary suspension of a licensee shall be 572
conducted by the commissioner of the office, or his or her 573
designee, who shall issue such order. 574
(a) An emergency suspension order under this subsection 575
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 24 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
may be issued without prior notice and an opportunity to be 576
heard. An emergency suspension order must: 577
1. State the grounds on which the order is based; 578
2. Advise the licensee against whom the order is directed 579
that the order takes effect immediately and, to the extent 580
applicable, require the licensee to immediately cease and desist 581
from the conduct or violation that is the subject of the order 582
or to take the affirmative action stated in the order as 583
necessary to correct a condition resulting from the conduct or 584
violation or as otherwise appropriate; 585
3. Be delivered by personal delivery or sent by certified 586
mail, return receipt requested, to the licensee against whom the 587
order is directed at the licensee's last known address; and 588
4. Include a notice that the licensee subject to an 589
emergency suspension order may seek judicial review pursuant to 590
s. 120.68. 591
(b) An emergency suspension order is effective as soon as 592
the licensee against whom the order is directed has actual or 593
constructive knowledge of the issuance of the order. 594
(c) The office shall institute proceedings under ss. 595
120.569 and 120.57 within 20 days after issuance of an emergency 596
suspension order. 597
(d) A licensee subject to an emergency suspension order 598
may seek judicial review pursuant to s. 120.68. 599
(e) The following acts are deemed by the Legislature to 600
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 25 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
constitute an immediate and serious danger to the public health, 601
safety, and welfare, and the office shall may immediately issue 602
an emergency suspension order to suspend the license of a money 603
services business without making any further findings of 604
immediate danger, necessity, and procedural fairness if: 605
1.(a) The money services business fails to provide to the 606
office, upon written request, any of the records required by s. 607
560.123, s. 560.1235, s. 560.211, or s. 560.310 or any rule 608
adopted under those sections. The suspension may be rescinded if 609
the licensee submits the requested records to the office. 610
2.(b) The money services business fails to maintain a 611
federally insured depository account as required by s. 612
560.208(4) or s. 560.309. 613
3.(c) A natural person required to be listed on the 614
license application for a money services business pursuant to s. 615
560.141(1)(a)3. is criminally charged with, or arrested for, a 616
crime described in paragraph (1)(o), paragraph (1)(p), or 617
paragraph(1)(q). 618
Section 7. Section 560.1311, Florida Statutes, is created 619
to read: 620
560.1311 Information security programs.— 621
(1) DEFINITIONS.—As used in this section, the term: 622
(a) "Customer" means a person who seeks to obtain or who 623
obtains or has obtained a financial product or service from a 624
licensee. 625
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 26 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
(b) "Customer information" means any record containing 626
nonpublic personal information about a customer of a financial 627
transaction, whether on paper, electronic, or in other forms, 628
which is handled or maintained by or on behalf of the licensee 629
or its affiliates. 630
(c) "Cybersecurity event" means an event resulting in 631
unauthorized access to, or disruption or misuse of, an 632
information system, information stored on such information 633
system, or customer information held in physical form. 634
(d) "Financial product or service" means any product or 635
service offered by a licensee under this chapter. 636
(e) "Information security program" means the 637
administrative, technical, or physical safeguards used to 638
access, collect, distribute, process, protect, store, use, 639
transmit, dispose of, or otherwise handle customer information. 640
(f) "Information system" means a discrete set of 641
electronic information resources organized for the collection, 642
processing, maintenance, use, sharing, dissemination, or 643
disposition of electronic information, as well as any 644
specialized system such as an industrial process control system, 645
telephone switching and private branch exchange system, or 646
environmental control system, which contain customer information 647
or which are connected to a system that contains customer 648
information. 649
(g)1. "Nonpublic personal information" means: 650
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 27 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
a. Personally identifiable financial information; and 651
b. Any list, description, or other grouping of customers 652
that is derived using any personally identifiable financial 653
information that is not publicly available, such as account 654
numbers, including any list of individuals' names and street 655
addresses that is derived, in whole or in part, using personally 656
identifiable financial information that is not publicly 657
available. 658
2. The term does not include: 659
a. Publicly available information, except as included on a 660
list, description, or other grouping of customers described in 661
sub-subparagraph 1.b.; 662
b. Any list, description, or other grouping of consumers, 663
or any publicly available information pertaining to such list, 664
description, or other grouping of consumers, which is derived 665
without using any personally identifiable financial information 666
that is not publicly available; or 667
c. Any list of individuals' names and addresses that 668
contains only publicly available information, is not derived, in 669
whole or in part, using personally identifiable financial 670
information that is not publicly available, and is not disclosed 671
in a manner that indicates that any of the individuals on the 672
list is a customer of a licensee. 673
3. As used in this paragraph, the term: 674
a.(I) "Personally identifiable financial information" 675
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 28 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
means any information that: 676
(A) A customer provides to a licensee to obtain a 677
financial product or service, such as information that a 678
customer provides to a licensee on an application to obtain a 679
loan or other financial product or service; 680
(B) A licensee receives about a consumer that is obtained 681
during or as a result of any transaction involving a financial 682
product or service between the licensee and the customer, such 683
as information collected through an information-collecting 684
device from a web server; or 685
(C) A licensee otherwise obtains about a customer in 686
connection with providing a financial product or service to the 687
customer, such as the fact that an individual is or has been one 688
of the licensee's customers or has obtained a financial product 689
or service from the licensee. 690
(II) The term "personally identifiable financial 691
information" does not include: 692
(A) A list of names and addresses of customers of an 693
entity that is not a financial institution; or 694
(B) Information that does not identify a customer, such as 695
blind data or aggregate information that does not contain 696
personal identifiers such as account numbers, names, or 697
addresses. 698
b.(I) "Publicly available information" means any 699
information that a licensee has a reasonable basis to believe is 700
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 29 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
lawfully made available to the general public from: 701
(A) Federal, state, or local government records, such as 702
government real estate records or security interest filings; 703
(B) Widely distributed media, such as information from a 704
telephone records repository or directory, a television or radio 705
program, a newspaper, a social media platform, or a website that 706
is available to the general public on an unrestricted basis. A 707
website is not restricted merely because an Internet service 708
provider or a site operator requires a fee or a password, so 709
long as access is available to the general public; or 710
(C) Disclosures to the general public which are required 711
to be made by federal, state, or local law. 712
(II) As used in this sub-subparagraph, the term 713
"reasonable basis to believe is lawfully made available to the 714
general public" relating to any information means that the 715
person has taken steps to determine: 716
(A) That the information is of the type that is available 717
to the general public, such as information included on the 718
public record in the jurisdiction where the mortgage would be 719
recorded; and 720
(B) Whether an individual can direct that the information 721
not be made available to the general public and, if so, the 722
customer to whom the information relates has not done so, such 723
as when a telephone number is listed in a telephone directory 724
and the customer has informed the licensee that the telephone 725
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 30 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
number is not unlisted. 726
(h) "Third-party service provider" means a person, other 727
than a licensee, which contracts with a licensee to maintain, 728
process, or store nonpublic personal information, or is 729
otherwise permitted access to nonpublic personal information 730
through its provision of services to a licensee. 731
(2) INFORMATION SECURITY PROGRAM.— 732
(a) Each licensee shall develop, implement, and maintain a 733
comprehensive written information security program that contains 734
administrative, technical, and physical safeguards for the 735
protection of the licensee's information system and nonpublic 736
personal information. 737
(b) Each licensee shall ensure that the information 738
security program meets all of the following criteria: 739
1. Be commensurate with the following measures: 740
a. Size and complexity of the licensee. 741
b. Nature and scope of the licensee's activities, 742
including the licensee's use of third-party service providers. 743
c. Sensitivity of nonpublic personal information that is 744
used by the licensee or that is in the licensee's possession, 745
custody, or control. 746
2. Be designed to do all of the following: 747
a. Protect the security and confidentiality of nonpublic 748
personal information and the security of the licensee's 749
information system. 750
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 31 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
b. Protect against threats or hazards to the security or 751
integrity of nonpublic personal information and the licensee's 752
information system. 753
c. Protect against unauthorized access to or the use of 754
nonpublic personal information and minimize the likelihood of 755
harm to any customer. 756
3. Define and periodically reevaluate the retention 757
schedule and the mechanism for the destruction of nonpublic 758
personal information if retention is no longer necessary for the 759
licensee's business operations or is no longer required by 760
applicable law. 761
4. Regularly test and monitor systems and procedures for 762
the detection of actual and attempted attacks on, or intrusions 763
into, the licensee's information system. 764
5. Be monitored, evaluated, and adjusted, as necessary, to 765
meet all of the following requirements: 766
a. Determine whether the licensee's information security 767
program is consistent with relevant changes in technology. 768
b. Confirm the licensee's information security program 769
accounts for the sensitivity of nonpublic personal information. 770
c. Identify changes that may be necessary to the 771
licensee's information system. 772
d. Mitigate any internal or external threats to nonpublic 773
personal information. 774
e. Amend the licensee's information security program for 775
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 32 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
any of the licensee's changing business arrangements, including, 776
but not limited to, mergers and acquisitions, alliances and 777
joint ventures, and outsourcing arrangements. 778
(c)1. As part of a licensee's information security 779
program, the licensee shall establish a written incident 780
response plan designed to promptly respond to, and recover from, 781
a cybersecurity event that compromises: 782
a. The confidentiality, integrity, or availability of 783
nonpublic personal information in the licensee's possession; 784
b. The licensee's information system; or 785
c. The continuing functionality of any aspect of the 786
licensee's operations. 787
2. The written incident response plan must address all of 788
the following: 789
a. The licensee's internal process for responding to a 790
cybersecurity event. 791
b. The goals of the licensee's incident response plan. 792
c. The assignment of clear roles, responsibilities, and 793
levels of decisionmaking authority for the licensee's personnel 794
that participate in the incident response plan. 795
d. External communications, internal communications, and 796
information sharing related to a cybersecurity event. 797
e. The identification of remediation requirements for 798
weaknesses identified in information systems and associated 799
controls. 800
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 33 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
f. The documentation and reporting regarding cybersecurity 801
events and related incident response activities. 802
g. The evaluation and revision of the incident response 803
plan, as appropriate, following a cybersecurity event. 804
h. The process by which notice must be given as required 805
under subsection (3) and s. 501.171(3) and (4). 806
(d)1. This section does not apply to a licensee that has 807
fewer than: 808
a. Twenty individuals on its workforce, including 809
employees and independent contractors; or 810
b. Five hundred customers during a calendar year. 811
2. A licensee that no longer qualifies for exemption under 812
subparagraph 1. has 180 calendar days to comply with this 813
section after the date of the disqualification. 814
(e) Each licensee shall maintain a copy of the information 815
security program for a minimum of 5 years and shall make it 816
available to the office upon request or as part of an 817
examination. 818
(3) NOTICE TO OFFICE OF SECURITY BREACH.—Each licensee 819
shall provide notice to the office of any breach of security 820
affecting 500 or more individuals in this state at a time and in 821
the manner prescribed by commission rule. 822
(4) CONSTRUCTION.—This section may not be construed to 823
relieve a covered entity from complying with s. 501.171. To the 824
extent a licensee is a covered entity, as defined in s. 825
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 34 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
501.171(1), the licensee remains subject to s. 501.171. 826
(5) RULES.—The commission must adopt rules to administer 827
this section, including rules that allow a licensee that is in 828
full compliance with the Federal Trade Commission's Standards 829
for Safeguarding Customer Information, 16 C.F.R. part 314, to be 830
deemed in compliance with subsection (2). 831
Section 8. Subsection (10) of section 560.309, Florida 832
Statutes, is amended to read: 833
560.309 Conduct of business.— 834
(10) If a check is returned to a licensee from a payor 835
financial institution due to lack of funds, a closed account, or 836
a stop-payment order, the licensee may seek collection pursuant 837
to s. 68.065. In seeking collection, the licensee must comply 838
with the prohibitions against harassment or abuse, false or 839
misleading representations, and unfair practices in the Consumer 840
Collection Practices Act under part VI of chapter 559, including 841
s. 559.77. The licensee must also comply with the Fair Debt 842
Collections Practices Act, 15 U.S.C. ss. 1692d, 1692e, and 1692f 843
if the licensee uses a third-party debt collector or any name 844
other than its own to collect such debts. A violation of this 845
subsection is a deceptive and unfair trade practice and 846
constitutes a violation of the Deceptive and Unfair Trade 847
Practices Act under part II of chapter 501. In addition, a 848
licensee must comply with the applicable provisions of the 849
Consumer Collection Practices Act under part VI of chapter 559, 850
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 35 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
including s. 559.77. 851
Section 9. Subsection (3) of section 560.405, Florida 852
Statutes, is amended to read: 853
560.405 Deposit; redemption.— 854
(3) Notwithstanding subsection (1), in lieu of 855
presentment, a deferred presentment provider may allow the check 856
to be redeemed at any time upon payment of the outstanding 857
transaction balance and earned fees. Redemption in cash or 858
through a debit card transaction shall be treated the same. 859
However, payment may not be made in the form of a personal check 860
or through a credit card transaction. Upon redemption, the 861
deferred presentment provider must return the drawer's check and 862
provide a signed, dated receipt showing that the drawer's check 863
has been redeemed. 864
Section 10. Subsection (2) of section 560.406, Florida 865
Statutes, is amended to read: 866
560.406 Worthless checks.— 867
(2) If a check is returned to a deferred presentment 868
provider from a payor financial institution due to insufficient 869
funds, a closed account, or a stop-payment order, the deferred 870
presentment provider may pursue all legally available civil 871
remedies to collect the check, including, but not limited to, 872
the imposition of all charges imposed on the deferred 873
presentment provider by the financial institution. In its 874
collection practices, a deferred presentment provider must 875
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 36 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
comply with the prohibitions against harassment or abuse, false 876
or misleading representations, and unfair practices that are 877
contained in the Consumer Collection Practices Act under part VI 878
of chapter 559, including s. 559.77. A deferred presentment 879
provider must also comply with the Fair Debt Collections 880
Practices Act, 15 U.S.C. ss. 1692d, 1692e, and 1692f if the 881
deferred present provider uses a third-party debt collector or 882
any name other than its own to collect such debts. A violation 883
of this act is a deceptive and unfair trade practice and 884
constitutes a violation of the Deceptive and Unfair Trade 885
Practices Act under part II of chapter 501. In addition, a 886
deferred presentment provider must comply with the applicable 887
provisions of the Consumer Collection Practices Act under part 888
VI of chapter 559, including s. 559.77. 889
Section 11. Section 655.0171, Florida Statutes, is created 890
to read: 891
655.0171 Requirements for customer data security and for 892
notices of security breaches.— 893
(1) DEFINITIONS.—As used in this section, the term: 894
(a) "Breach of security" or "breach" means unauthorized 895
access of data in electronic form containing personal 896
information. Good faith access of personal information by an 897
employee or agent of a financial institution does not constitute 898
a breach of security, provided that the information is not used 899
for a purpose unrelated to the business or subject to further 900
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 37 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
unauthorized use. As used in this paragraph, the term "data in 901
electronic form" means any data stored electronically or 902
digitally on any computer system or other database and includes 903
recordable tapes and other mass storage devices. 904
(b) "Department" means the Department of Legal Affairs. 905
(c)1. "Personal information" means: 906
a. An individual's first name, or first initial, and last 907
name, in combination with any of the following data elements for 908
that individual: 909
(I) A social security number; 910
(II) A driver license or identification card number, 911
passport number, military identification number, or other 912
similar number issued on a government document used to verify 913
identity; 914
(III) A financial account number or credit or debit card 915
number, in combination with any required security code, access 916
code, or password that is necessary to permit access to the 917
individual's financial account; 918
(IV) The individual's biometric data as defined in s. 919
501.702; or 920
(V) Any information regarding the individual's 921
geolocation; or 922
b. A username or e-mail address, in combination with a 923
password or security question and answer that would permit 924
access to an online account. 925
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 38 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
2. The term does not include information about an 926
individual which has been made publicly available by a federal, 927
state, or local governmental entity. The term also does not 928
include information that is encrypted, secured, or modified by 929
any other method or technology that removes elements that 930
personally identify an individual or that otherwise renders the 931
information unusable. 932
(2) REQUIREMENTS FOR DATA SECURITY.—Each financial 933
institution shall take reasonable measures to protect and secure 934
data that are in electronic form and that contain personal 935
information. 936
(3) NOTICE TO OFFICE AND DEPARTMENT OF SECURITY BREACH.— 937
(a)1. Each financial institution shall provide notice to 938
the office of any breach of security affecting 500 or more 939
individuals in this state. Such notice must be provided to the 940
office as expeditiously as practicable, but no later than 30 941
days after the determination of the breach or the determination 942
of a reason to believe that a breach has occurred. 943
2. The written notice to the office must include the items 944
required under s. 501.171(3)(b). 945
3. A financial institution must provide the following 946
information to the office upon its request: 947
a. A police report, incident report, or computer forensics 948
report. 949
b. A copy of the policies in place regarding breaches. 950
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 39 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
4. Steps that have been taken to rectify the breach. 951
5. A financial institution may provide the office with 952
supplemental information regarding a breach at any time. 953
(b) Each financial institution shall provide notice to the 954
department of any breach of security affecting 500 or more 955
individuals in this state. Such notice must be provided to the 956
department in accordance with s. 501.171. 957
(4) NOTICE TO INDIVIDUALS OF SECURITY BREACH.—Each 958
financial institution shall give notice to each individual in 959
this state whose personal information was, or the financial 960
institution reasonably believes to have been, accessed as a 961
result of the breach in accordance with s. 501.171(4). The 962
notice must be provided no later than 30 days after the 963
determination of the breach or the determination of a reason to 964
believe that a breach has occurred. A financial institution may 965
receive 15 additional days to provide notice to individuals of a 966
security breach as required in this subsection if good cause for 967
delay is provided in writing to the office within 30 days after 968
determination of the breach or determination of the reason to 969
believe that a breach has occurred. 970
(5) NOTICE TO CREDIT REPORTING AGENCIES.—If a financial 971
institution discovers circumstances requiring notice pursuant to 972
this section of more than 1,000 individuals at a single time, 973
the financial institution shall also notify, without 974
unreasonable delay, all consumer reporting agencies that compile 975
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 40 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
and maintain files on consumers on a nationwide basis, as 976
defined in the Fair Credit Reporting Act, 15 U.S.C. s. 1681a(p), 977
of the timing, distribution, and content of the notices. 978
Section 12. Paragraph (d) of subsection (1) of section 979
655.045, Florida Statutes, is amended to read: 980
655.045 Examinations, reports, and internal audits; 981
penalty.— 982
(1) The office shall conduct an examination of the 983
condition of each state financial institution at least every 18 984
months. The office may conduct more frequent examinations based 985
upon the risk profile of the financial institution, prior 986
examination results, or significant changes in the institution 987
or its operations. The office may use continuous, phase, or 988
other flexible scheduling examination methods for very large or 989
complex state financial institutions and financial institutions 990
owned or controlled by a multi-financial institution holding 991
company. The office shall consider examination guidelines from 992
federal regulatory agencies in order to facilitate, coordinate, 993
and standardize examination processes. 994
(d) As used in this section, the term "costs" means the 995
salary and travel expenses directly attributable to the field 996
staff examining the state financial institution, subsidiary, or 997
service corporation, and the travel expenses of any supervisory 998
staff required as a result of examination findings. The mailing 999
of any costs incurred under this subsection must be postmarked 1000
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 41 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
within 45 30 days after the date of receipt of a notice stating 1001
that such costs are due. The office may levy a late payment of 1002
up to $100 per day or part thereof that a payment is overdue, 1003
unless excused for good cause. However, for intentional late 1004
payment of costs, the office may levy an administrative fine of 1005
up to $1,000 per day for each day the payment is overdue. 1006
Section 13. Subsection (2) of section 657.005, Florida 1007
Statutes, is amended to read: 1008
657.005 Application for authority to organize a credit 1009
union; investigation.— 1010
(2) Any five or more individuals, a majority of whom are 1011
residents of this state and all of whom who represent a limited 1012
field of membership, may apply to the office for permission to 1013
organize a credit union. The fact that individuals within the 1014
proposed limited field of membership have credit union services 1015
available to them through another limited field of membership 1016
shall not preclude the granting of a certificate of 1017
authorization to engage in the business of a credit union. 1018
Section 14. Subsection (1) of section 657.024, Florida 1019
Statutes, is amended to read: 1020
657.024 Membership meetings.— 1021
(1) The members shall receive timely notice of the annual 1022
meeting and any special meetings of the members, which shall be 1023
held at the time, place, and in the manner provided in the 1024
bylaws. The annual meeting and any special meetings of the 1025
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 42 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
members may be held virtually without an in-person quorum, and 1026
virtual attendance may satisfy quorum requirements, subject to 1027
the bylaws. 1028
Section 15. Subsections (6) and (7) of section 657.042, 1029
Florida Statutes, are renumbered as subsections (5) and (6), and 1030
paragraph (b) of subsection (3) and present subsection (5) of 1031
that section are amended, to read: 1032
657.042 Investment powers and limitations.—A credit union 1033
may invest its funds subject to the following definitions, 1034
restrictions, and limitations: 1035
(3) INVESTMENT SUBJECT TO LIMITATION OF TWO PERCENT OF 1036
CAPITAL OF THE CREDIT UNION.— 1037
(b) Commercial paper and bonds of any corporation within 1038
the United States which have a fixed maturity, as provided in 1039
subsection (6) (7), except that the total investment in all such 1040
paper and bonds may not exceed 10 percent of the capital of the 1041
credit union. 1042
(5) INVESTMENTS IN REAL ESTATE AND EQUIPMENT FOR THE 1043
CREDIT UNION.— 1044
(a) Up to 5 percent of the capital of the credit union may 1045
be invested in real estate and improvements thereon, furniture, 1046
fixtures, and equipment utilized or to be utilized by the credit 1047
union for the transaction of business. 1048
(b) The limitations provided by this subsection may be 1049
exceeded with the prior written approval of the office. The 1050
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 43 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
office shall grant such approval if it is satisfied that: 1051
1. The proposed investment is necessary. 1052
2. The amount thereof is commensurate with the size and 1053
needs of the credit union. 1054
3. The investment will be beneficial to the members. 1055
4. A reasonable plan is developed to reduce the investment 1056
to statutory limits. 1057
Section 16. Paragraphs (b) and (c) of subsection (4) of 1058
section 658.21, Florida Statutes, are amended to read: 1059
658.21 Approval of application; findings required.—The 1060
office shall approve the application if it finds that: 1061
(4) 1062
(b) At least two of the proposed directors who are not 1063
also proposed officers must have had within the 10 years before 1064
the date of the application at least 1 year of direct experience 1065
as an executive officer, regulator, or director of a financial 1066
institution as specified in the application within the 5 years 1067
before the date of the application. However, if the applicant 1068
demonstrates that at least one of the proposed directors has 1069
very substantial experience as an executive officer, director, 1070
or regulator of a financial institution more than 5 years before 1071
the date of the application, the office may modify the 1072
requirement and allow the applicant to have only one director 1073
who has direct financial institution experience within the last 1074
5 years. 1075
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 44 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
(c) The proposed president or chief executive officer must 1076
have had at least 1 year of direct experience as an executive 1077
officer, director, or regulator of a financial institution 1078
within the last 10 5 years. In making a decision, the office 1079
must also consider may waive this requirement after considering: 1080
1. The adequacy of the overall experience and expertise of 1081
the proposed president or chief executive officer; 1082
2. The likelihood of successful operation of the proposed 1083
state bank or trust company pursuant to subsection (1); 1084
3. The adequacy of the proposed capitalization under 1085
subsection (2); 1086
4. The proposed capital structure under subsection (3); 1087
5. The experience of the other proposed officers and 1088
directors; and 1089
6. Any other relevant data or information. 1090
Section 17. Subsection (2) of section 658.33, Florida 1091
Statutes, is amended to read: 1092
658.33 Directors, number, qualifications; officers.— 1093
(2) Not less than a majority of the directors must, during 1094
their whole term of service, be citizens of the United States, 1095
and at least a majority of the directors must have resided in 1096
this state for at least 1 year preceding their election and must 1097
be residents therein during their continuance in office. In the 1098
case of a bank or trust company with total assets of less than 1099
$150 million, at least one, and in the case of a bank or trust 1100
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 45 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
company with total assets of $150 million or more, two of the 1101
directors who are not also officers of the bank or trust company 1102
must have had at least 1 year of direct experience as an 1103
executive officer, regulator, or director of a financial 1104
institution within the last 10 5 years. 1105
Section 18. Subsection (4) of section 662.141, Florida 1106
Statutes, is amended to read: 1107
662.141 Examination, investigations, and fees.—The office 1108
may conduct an examination or investigation of a licensed family 1109
trust company at any time it deems necessary to determine 1110
whether the licensed family trust company or licensed family 1111
trust company-affiliated party thereof has violated or is about 1112
to violate any provision of this chapter, any applicable 1113
provision of the financial institutions codes, or any rule 1114
adopted by the commission pursuant to this chapter or the codes. 1115
The office may conduct an examination or investigation of a 1116
family trust company or foreign licensed family trust company at 1117
any time it deems necessary to determine whether the family 1118
trust company or foreign licensed family trust company has 1119
engaged in any act prohibited under s. 662.131 or s. 662.134 1120
and, if a family trust company or a foreign licensed family 1121
trust company has engaged in such act, to determine whether any 1122
applicable provision of the financial institutions codes has 1123
been violated. 1124
(4) For each examination of the books and records of a 1125
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 46 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
family trust company, licensed family trust company, or foreign 1126
licensed family trust company as authorized under this chapter, 1127
the trust company shall pay a fee for the costs of the 1128
examination by the office. As used in this section, the term 1129
"costs" means the salary and travel expenses of field staff 1130
which are directly attributable to the examination of the trust 1131
company and the travel expenses of any supervisory and support 1132
staff required as a result of examination findings. The mailing 1133
of payment for costs incurred must be postmarked within 45 30 1134
days after the receipt of a notice stating that the costs are 1135
due. The office may levy a late payment of up to $100 per day or 1136
part thereof that a payment is overdue unless waived for good 1137
cause. However, if the late payment of costs is intentional, the 1138
office may levy an administrative fine of up to $1,000 per day 1139
for each day the payment is overdue. 1140
Section 19. Subsection (21) of section 517.12, Florida 1141
Statutes, is amended to read: 1142
517.12 Registration of dealers, associated persons, 1143
intermediaries, and investment advisers.— 1144
(21) The registration requirements of this section do not 1145
apply to any general lines insurance agent or life insurance 1146
agent licensed under chapter 626, with regard to the sale of a 1147
security as defined in s. 517.021(34)(g) s. 517.021(33)(g), if 1148
the individual is directly authorized by the issuer to offer or 1149
sell the security on behalf of the issuer and the issuer is a 1150
CS/HB 381 2026
CODING: Words stricken are deletions; words underlined are additions.
hb381-01-c1
Page 47 of 47
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
federally chartered savings bank subject to regulation by the 1151
Federal Deposit Insurance Corporation. Actions under this 1152
subsection constitute activity under the insurance agent's 1153
license for purposes of ss. 626.611 and 626.621. 1154
Section 20. This act shall take effect July 1, 2026. 1155