Cybersecurity compliance for regulated firms in South Carolina

Three parts

What a complete answer covers in South Carolina

In South Carolina, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in South Carolina. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in South Carolina mortgage licensing is overseen by the South Carolina State Board of Financial Institutions, Consumer Finance Division (Office of the Commissioner of Consumer Finance). South Carolina treats servicing as mortgage lending. The Mortgage Lending Act's definition of "mortgage lender" expressly includes anyone who "engages in the business of servicing mortgage loans for others" or collects payments from borrowers for distribution to another person (S.C. Code § 37-22-110), and § 37-22-120(A) makes it unlawful to do so without a license. Servicers therefore need a Mortgage Lender/Servicer License from the State Board of Financial Institutions' Consumer Finance Division through NMLS, unless an exemption applies. Other licenses are overseen by other regulators and carry conditions of their own.
• What South Carolina law says about protecting data. South Carolina's identity-theft law requires a business disposing of records that contain a customer's personal identifying information to shred, erase, or otherwise render the information unreadable or undecipherable (S.C. Code § 37-20-190), though banks and financial institutions already complying with GLBA privacy and security provisions are exempt.
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in South Carolina: When a South Carolina breach requires notice to more than 1,000 residents at once, the business must also inform the Consumer Protection Division of the S.C. Department of Consumer Affairs and the nationwide credit bureaus. In South Carolina, regulator notice goes to the consumer-affairs agency rather than to the Attorney General.

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.