Cybersecurity compliance for regulated firms in Minnesota

Three parts

What a complete answer covers in Minnesota

In Minnesota, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Minnesota. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Minnesota mortgage licensing is overseen by the Minnesota Department of Commerce. Companies servicing Minnesota residential mortgage loans need a Residential Mortgage Servicer license from the Minnesota Department of Commerce under the state's mortgage licensing chapter (Minn. Stat. § 58.04, subd. 2). It is a separate license from the Residential Mortgage Originator license that lenders and brokers hold, with exemptions for financial institutions and certain other entities. Company applications and renewals run through NMLS. Other licenses are overseen by other regulators and carry conditions of their own.
• What Minnesota law says about protecting data. The Minnesota Consumer Data Privacy Act requires covered controllers, generally businesses processing the personal data of 100,000 or more Minnesota consumers, to maintain reasonable administrative, technical and physical data security practices (Minn. Stat. §325M.16, effective July 31, 2025). Its GLBA exemption applies to data rather than to entities, so a nonbank mortgage firm's non-GLBA data can remain in scope, although chartered banks and credit unions are exempt as entities (§325M.12).
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Minnesota: Minnesota's breach law includes a 48-hour deadline: when more than 500 residents are being notified at one time, all nationwide consumer reporting agencies must be informed within 48 hours. An incident-response plan that tracks only consumer notice can miss it.

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.