Cybersecurity compliance for regulated firms in Michigan

Three parts

What a complete answer covers in Michigan

In Michigan, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Michigan. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Michigan mortgage licensing is overseen by the Michigan Department of Insurance and Financial Services (DIFS). Anyone acting as a mortgage servicer on Michigan first mortgages must first obtain a license or register with the Department of Insurance and Financial Services under the Mortgage Brokers, Lenders, and Servicers Licensing Act (MCL 445.1651 et seq.), with applications handled through NMLS. Banks and other depository institutions are generally exempt, though certain out-of-state depository subsidiaries and affiliates register rather than license. Second-mortgage activity is covered separately by the Secondary Mortgage Loan Act. Other licenses are overseen by other regulators and carry conditions of their own.
• What Michigan law says about protecting data. Michigan has no general reasonable-safeguards mandate for businesses, but the Identity Theft Protection Act requires data containing personal information to be destroyed by shredding, erasing or otherwise making it unreadable when it is removed from a database and no longer retained (MCL 445.72a).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Michigan: Michigan is one of the few states that never requires notice to the Attorney General after a breach. Failing to notify consumers is costly, however: knowingly failing to notify carries civil fines of up to $250 per notice not sent, capped at $750,000 for a single breach (MCL 445.72(13)-(14)).

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.