Cybersecurity compliance for regulated firms in Arkansas

Three parts

What a complete answer covers in Arkansas

In Arkansas, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Arkansas. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Arkansas mortgage licensing is overseen by the Arkansas Securities Department. Companies servicing Arkansas residential mortgage loans need a Mortgage Servicer license from the Arkansas Securities Department through NMLS under the Fair Mortgage Lending Act (Ark. Code Ann. §23-39-501 et seq.), which makes it unlawful to act directly or indirectly as a mortgage servicer without a license unless an exemption applies, such as for banks and credit unions. The trigger is broad: a servicer is anyone who receives funds from or on behalf of a borrower in payment of a mortgage loan or its associated taxes and insurance. Other licenses are overseen by other regulators and carry conditions of their own.
• What Arkansas law says about protecting data. The Personal Information Protection Act requires any business that acquires, owns, or licenses Arkansans' personal information to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, and to shred, erase, or otherwise render unreadable customer records it no longer needs (Ark. Code Ann. §4-110-104).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Arkansas: Arkansas requires records as well as notice. Businesses must keep their written breach determination and supporting documentation for five years and produce them to the Attorney General within 30 days of a request. This is in addition to notifying the Attorney General within 45 days (or at the time of consumer notice, if earlier) when a breach affects more than 1,000 residents.

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.