On April 11, North Dakota enacted HB 1127 (the “Act”), amending the regulatory framework for financial institutions within the state by establishing a new chapter focused on data security programs. The Act amends various sections of the North Dakota Century Code related to the Department of Financial Institutions, including aspects of financial institution operations, license renewals, and compliance requirements. The Act sets forth security measures, improves the response to departmental requests, and supports processes for issuing, renewing, and revoking licenses. The Act also amends sections related to the removal of officers, directors or employees of financial institutions convicted of dishonesty or breach of trust. The bill also modified the process for cease and desist orders, allowing for emergency orders to be issued without a prior hearing if there is a significant risk to the financial institution’s stability.

The amendments include the creation of Chapter 13-01.2, which among other things, mandates financial corporations to maintain comprehensive information security programs with administrative, technical and physical safeguards appropriate to their size. It specifies requirements for monitoring authorized user activities, conducting annual penetrative testing, requiring encryption and multifactor authentication, implementing training for employees involved in information security, and conducting regular testing of security measures.

Further amendments address the renewal of licenses, setting specific fees and deadlines, and clarifying the conditions under which licenses can be denied or revoked. The Act also updates definitions related to mortgage servicing and exempts certain entities from licensing requirements.

Finally, existing law requires persons making loans or leases to obtain a money broker license. The Act gives the Department of Financial Institutions authority to specify “alternative financing products” that are considered loans for purposes of the licensing statute, effectively expanding the scope of the licensing requirement.