SB 540 — CS/CS/CS/SB 540: Office of Financial Regulation

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 with respect to a surrendered or repossessed motor vehicle are exclusively governed by certain provisions;

specifying requirements for emergency suspension orders that suspend money services business licenses;

providing that an emergency suspension order is effective when the licensee against whom the order is directed has actual or constructive knowledge of the order;

requiring the office to institute timely proceedings after issuance of an emergency suspension order;

authorizing a licensee subject to an emergency suspension order to seek judicial review;

specifyingproviding requirements for such programs;

specifyingproviding requirements for such plans;

specifyingproviding compliance requirements under specified circumstances;

requiring Pagemoney 3services businesses to maintain copies of 48information CODING:security programs for a specified timeframe and to make them available to the office under certain circumstances;

requiring money services Page 2 of 39 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 money services businesses toand maintaincertain copiesentities of information security programs for a specified timeframe and to makeconduct theminvestigations availableof tocybersecurity theevents office under certain circumstances;

specifyingproviding requirements for noticessuch ofinvestigations; security breaches;

providing requirements for records and documentation maintenance;

providing requirements for notices of security breaches;

requiringproviding therulemaking commissionauthority; to adopt rules;

amending s.

560.309, F.S.;

providing that licensees must comply with the Fair Debt Collections Practices Act only if the licensees meet certain criteria;

amending s.

560.405, F.S.;

specifying that redemption in cash must be treated in the same manner as redemption through debt card transactions;

prohibiting redemption through a credit card transaction;

amending s.

560.406, F.S.;

providing that licensees must comply with the Fair Debt Collections Practices Act only if the licensees meet certain criteria;

655.032, F.S.;

authorizing the office to consider or use certain information as part of certain investigations;

amending s.

authorizingrevising the officetimeline tofor considerthe ormailing useof certainpayment informationfor assalary partand travel expenses of certain investigations;field staff;

revising the timeline for the mailing of payment for salary and travel expenses of certain Page 4 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 field staff;

662.141,Page F.S.;3 of 39 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 662.141, F.S.;

94 Be It Enacted by the Legislature of the State of Florida:

96 Section 1.

Subsection (4) is added to section 415.106, Florida Statutes, to read:

415.106 Cooperation by the department and criminal justice and other agencies.— (4) To the fullest extent possible, the department shall cooperate with and seek cooperation from the Office of Financial Regulation concerning protective investigations of suspected financial exploitation of specified adults, as defined in s.

Page 5 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 415.10341, which are reported to the central abuse hotline and which the department is responsible for conducting pursuant to s.

415.104.

(a) In accordance with s.

415.107, the department must provide copies of all suspected financial exploitation reports received by the central abuse hotline pursuant to s.

415.1034 from any financial institution as defined in s.

655.005(1), securities dealer as defined in s.

517.021(12), or investment adviser as defined in s.

517.021(20) to the Office of Financial Regulation within 15 days after receiving the report.

The department may provide copies of any records generated as a result of such reports at the request of the Office of Financial Regulation within 15 days after such request.

1.

The Office of Financial Regulation may use the reports or records obtained as required or authorized in this subsection during an investigation or examination conducted pursuant to chapter 517 or chapter 655.

2.

Except as provided in this chapter and chapters 517 and 655, all confidentiality provisions that apply to the department continue to apply to the records made available to the Office of Financial Regulation and its officials, employees, and agents under s.

415.107.

(b) The department and the Office of Financial Regulation may enter into a memorandum of agreement that specifies how the Office of Financial Regulation, in the agency’s role as the regulator of financial institutions, may assist the department with effectively and efficiently conducting a protective investigation of any vulnerable adult abuse report received by the central abuse hotline, and that specifies how such Page 6 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 assistance will be implemented.

Section 2.

Paragraph (m) is added to subsection (3) of section 415.107, Florida Statutes, to read:

415.107 Confidentiality of reports and records.— (3) Access to all records, excluding the name of the reporter which shall be released only as provided in subsection (6), shall be granted only to the following persons, officials, and agencies:

(m) Any appropriate officials, employees, or agents of the Office of Financial Regulation who are responsible for conducting investigations pursuant to chapters 517 and 655.

Section 3.

494.00123 Information security programs.—programs; (1) DEFINITIONS.—As used in this section, the term:

cybersecurity event investigations.— (1) DEFINITIONS.—As used in this section, the term:

(c) “Cybersecurity event” means an event resulting in unauthorized access to, or disruption or misuse of, an information systemsystem, or customer information stored on such information system.system, or customer information held in physical form.

The(d) term“Financial doesproduct not include the unauthorized acquisition of encrypted customer information if the encryption process or keyservice” ismeans notany alsoproduct acquired, released, or usedservice withoutoffered Pageby 7a oflicensee 48under CODING:this chapter.

(e) “Information security program” means the administrative, technical, or physical safeguards used to Page 4 of 39 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 authorization.access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.

The(f) term“Information doessystem” notmeans includea andiscrete eventset withof regardelectronic toinformation whichresources organized for the licenseecollection, hasprocessing, determinedmaintenance, thatuse, thesharing, customerdissemination, informationor accesseddisposition byof electronic information, as well as any specialized system such as an unauthorizedindustrial personprocess hascontrol notsystem, beentelephone usedswitching and private branch exchange system, or releasedenvironmental andcontrol hassystem, beenwhich returnedcontain customer information or destroyed.which are connected to a system that contains customer information.

(d)(g) “Encrypted”“Licensee” means the transformation of data into a formperson thatlicensed resultsunder inthis achapter. low probability of assigning meaning without the use of a protective process or key.

(e) “Financial product or service” means any product or service offered by a licensee under this chapter.

(f) “Information security program” means the administrative, technical, or physical safeguards used to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.

(g) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information, as well as any specialized system such as an industrial process control system, telephone switching and private branch exchange system, or environmental control system, which contain customer information or which are connected to a system that contains customer information.

Any list, description, or other grouping of customers which is derived using any personally identifiable financial information that is not publicly available, such as account numbers, including any list of individuals’ names and street addresses which is derived, in whole or in part, using personally identifiable financial information that is not Pagepublicly 8available. of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 publicly available.

or c.Page 5 of 39 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 c.

or (C) A licensee otherwise obtains about a customer in Pageconnection 9with providing a financial product or service to the customer, such as the fact that an individual is or has been one of 48the CODING:licensee’s customers or has obtained a financial product or service from the licensee.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 connection with providing a financial product or service to the customer, such as the fact that an individual is or has been one of the licensee’s customers or has obtained a financial product or service from the licensee.

or (B) Information that does not identify a customer, such as blind data or aggregate information that does not contain personalPage identifiers6 suchof as39 accountCODING: numbers, names, or addresses.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 personal identifiers such as account numbers, names, or addresses.

(II) As used in this sub-subparagraph, the term “reasonable basis to believe is lawfully made available to the general public” relating to any information means that the person has Pagetaken 10steps ofto 48determine: CODING:

(A) That the information is of the type that is available to the general public, such as information included on the public record in the jurisdiction where the mortgage would be recorded;

and (B) Whether an individual can direct that the information not be made available to the general public and, if so, the customer to whom the information relates has not done so, such as when a telephone number is listed in a telephone directory and the customer has informed the licensee that the telephone Page 7 of 39 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 takennumber stepsis tonot determine:unlisted.

(A) That the information is of the type that is available to the general public, such as information included on the public record in the jurisdiction where the mortgage would be recorded;

and (B) Whether an individual can direct that the information not be made available to the general public and, if so, the customer to whom the information relates has not done so, such as when a telephone number is listed in a telephone directory and the customer has informed the licensee that the telephone number is not unlisted.

Sensitivity of nonpublic personal information that is Pageused 11by ofthe 48licensee CODING:or that is in the licensee’s possession, custody, or control.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 used by the licensee or that is in the licensee’s possession, custody, or control.

Protect against unauthorized access to or the use of nonpublicPage personal8 information and minimize the likelihood of harm39 toCODING: any customer.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 nonpublic personal information and minimize the likelihood of harm to any customer.

MitigateEliminate any internal or external threats to nonpublic Pagepersonal 12information. of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 personal information.

Amend the licensee’s information security program for any materialof changes to the licensee’s changing business arrangements, including, but not limited to, mergers and acquisitions, alliances and joint ventures, and outsourcing arrangements.

The confidentiality, integrity, or availability of nonpublicPage personal9 informationof in39 theCODING: licensee’s possession;

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 nonpublic personal information in the licensee’s possession;

Pageg. 13 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 g.

The process by which notice must be given as required under subsection (3)(4) and s.

A licensee that no longer qualifies for exemption under subparagraphPage 1.10 of 39 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 subparagraph 1.

(3) NOTICECYBERSECURITY TOEVENT OFFICEINVESTIGATION.— OF(a) SECURITYIf BREACH.—Eacha licensee shalldiscovers providethat noticea tocybersecurity event has occurred or that a cybersecurity event may have occurred, the officelicensee, ofor anyan breachoutside ofvendor security,or asthird-party definedservice inprovider s.that the licensee has designated to act on its behalf, shall conduct a prompt investigation of the cybersecurity event.

501.171,(b) affectingDuring 500the investigation, the licensee, or morethe individualsoutside invendor thisor statethird-party service provider that the licensee has designated to act on its behalf, shall, at a timeminimum, anddetermine inas themuch mannerof prescribedthe byfollowing commissionas rule.possible:

(4)1. CONSTRUCTION.—This section may not be construed to relieve a covered entity from complying with s.

Confirm that a cybersecurity event has occurred.

2.

Identify the date that the cybersecurity event first occurred.

3.

Assess the nature and scope of the cybersecurity event.

4.

Identify all nonpublic personal information that may have been compromised by the cybersecurity event.

5.

Perform or oversee reasonable measures to restore the security of any compromised information system in order to prevent further unauthorized acquisition, release, or use of nonpublic personal information that is in the licensee’s, outside vendor’s, or third-party service provider’s possession, custody, or control.

(c) If a licensee learns that a cybersecurity event has Page 11 of 39 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 occurred, or may have occurred, in an information system maintained by a third-party service provider of the licensee, the licensee shall complete an investigation in compliance with this section or confirm and document that the third-party service provider has completed an investigation in compliance with this section.

(d) A licensee shall maintain all records and documentation related to the licensee’s investigation of a cybersecurity event for a minimum of 5 years after the date of the cybersecurity event and shall produce the records and documentation to the office upon request.

(4) NOTICE TO OFFICE OF SECURITY BREACH.— (a) Each licensee shall provide notice to the office of any breach of security affecting 500 or more individuals in this state at a time and in the manner prescribed by commission rule.

(b) Each licensee shall, upon the office’s request, provide a quarterly update of a cybersecurity event investigation under subsection (3) until conclusion of the investigation.

(5) CONSTRUCTION.—This section may not be construed to relieve a covered entity from complying with s.

(5)(6) RULES.—The commission shallmay adopt rules to administer this section, including rules that allow a licensee that is in full compliance with the Federal Trade Commission’s Standards for Safeguarding Customer Information, 16 C.F.R.

part 314, to be deemed in substantial compliance with subsection (2).

PageSection 142. of 48 CODING:

Paragraph (z) is added to subsection (1) of section 494.00255, Florida Statutes, to read:

Page 12 of 39 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 Section494.00255 4.Administrative penalties and fines;

Paragraph (z) is added to subsection (1) of section 494.00255, Florida Statutes, to read:

494.00255 Administrative penalties and fines;

Section 5.3.

A dealer or an associated person of a dealer whose performance of services in paragraph (a) is solely incidental to the conduct of the dealer’s or associated person’s business as a dealer and who does not receive special compensation for those Page 1513 of 4839 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 the conduct of the dealer’s or associated person’s business as a dealer and who does not receive special compensation for those services.

As used in this subparagraph, the term “client” has the same meaning as provided in Securities and Exchange Commission Rule Page222-2 16275.222-2, of17 48C.F.R. CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 222-2 275.222-2, 17 C.F.R.

9.Page 14 of 39 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 9.

In determining whether a person meets the definition of a family office under this subparagraph, the terms “affiliated family office,” “control,” “executive officer,” “family client,” “family entity,” “family member,” “former family member,” “key employee,” and “spousal equivalent” have the same meaning as in Securities and Exchange Commission Rule 202(a)(11)(G)-1(d)202(a)(11)(G)-1(d), under the Investment Advisers Act of 1940, 17 C.F.R.

275.202(a)(11)(G)-1(d),275.202(a)(11)(G)-1(d). as amended.

Section 6.4.

517.061 Exempt transactions.—Except as otherwise provided Pagein 17subsection of(11), 48the CODING:exemptions provided herein from the registration requirements of s.

517.07 are self-executing and do not require any filing with the office before being claimed.

Any Page 15 of 39 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 inperson subsectionwho (11),claims theentitlement exemptionsto providedan hereinexemption fromunder thethis registrationsection requirementsbears the burden of s.proving such entitlement in any proceeding brought under this chapter.

517.07 are self-executing and do not require any filing with the office before being claimed.

Any person who claims entitlement to an exemption under this section bears the burden of proving such entitlement in any proceeding brought under this chapter.

In determining whether a person meets the definition of a family office under this paragraph, the terms “affiliated family office,” “control,” “executive officer,” “family client,” “family entity,” “family member,” “former family member,” “key employee,” and “spousal equivalent” have the same meaning as in Securities and Exchange Commission Rule 202(a)(11)(G)-1(d)202(a)(11)(G)-1(d), under17 PageC.F.R. 18 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 the Investment Advisers Act of 1940, 17 C.F.R.

275.202(a)(11)(G)-1(d),275.202(a)(11)(G)-1(d). as amended.

Section 7.5.

Paragraph (a) of subsection (1) of section 517.201, Florida Statutes, is amended, and paragraph (c) is added to that subsection, to read:

517.201 Investigations;

examinations;

subpoenas;

hearings;

witnesses.— (1) The office:

(a) May make investigations and examinations within or outside of this state as it deems necessary:

1.

To determine whether a person has violated or is about to violate any provision of this chapter or a rule or order hereunder;

or 2.

To aid in the enforcement of this chapter;

or 3.

In accordance with a memorandum of understanding pursuant to s.

415.106(4)(b), to aid the Department of Children and Families with any protective investigations the Department of Children and Families is required to conduct under s.

415.104.

(c) May consider or use as part of any investigation or examination pursuant to this section the information contained in any suspected financial exploitation report or any records generated as a result of such report which is obtained pursuant to s.

415.106(4).

Section 8.

Paragraphs (b) and (c) of subsection (3) and subsection (6) of section 517.34, Florida Statutes, are amended to read:

517.34 Protection of specified adults.— (3) A dealer or investment adviser may delay a disbursement Page 19 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 or transaction of funds or securities from an account of a specified adult or an account for which a specified adult is a beneficiary or beneficial owner if all of the following apply:

(b) Not later than 3 business days after the date on which the delay was first placed, the dealer or investment adviser complies with all of the following conditions:

1.

Notifies in writing all parties authorized to transact business on the account and any trusted contact on the account, using the contact information provided for the account, with the exception of any party the dealer or investment adviser reasonably believes has engaged in, is engaging in, has attempted to engage in, or will attempt to engage in the suspected financial exploitation of the specified adult.

The notice, which may be provided electronically, must provide the reason for the delay.

2.

Notifies the office of the delay electronically on a form prescribed by commission rule.

The form must be consistent with the purposes of this section and must contain, but need not be limited to, the following information:

a.

The date on which the delay was first placed.

b.

The name, age, and address, or location, if different, of the specified adult.

c.

The business location of the dealer or investment adviser.

d.

The name, address, and telephone number and title of the employee who reported suspected financial exploitation of the specified adult.

e.

The facts and circumstances that caused the employee to report suspected financial exploitation.

Page 20 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 f.

The names, addresses, and telephone numbers of the specified adult’s family members.

g.

The name, address, and telephone number of each person suspected of engaging in financial exploitation.

h.

The name, address, and telephone number of the caregiver of the specified adult, if different from the person or persons suspected of engaging in financial exploitation.

i.

A description of actions taken by the dealer or investment adviser, if any, such as notification to a criminal justice agency.

j.

Any other information available to the reporting person which may establish the cause of financial exploitation that occurred or is occurring.

(c) Not later than 3 business days after the date on which the delay was first placed, the dealer or investment adviser Notifies the office of the delay electronically on a form prescribed by commission rule.

The form must be consistent with the purposes of this section and may include only the following information:

1.

The date on which the notice is submitted to the office.

2.

The date on which the delay was first placed.

3.

The following information about the specified adult:

a.

Gender.

b.

Age.

c.

Zip code of residence address.

4.

The following information about the dealer or investment adviser who placed the delay:

a.

Name.

b.

Title.

Page 21 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 c.

Firm name.

d.

Business address.

5.

A section with the following questions for which the only allowable responses are “Yes” or “No”:

a.

Is financial exploitation of a specified adult suspected in connection with a disbursement or transaction? b.

Are funds currently at risk of being lost? The form must contain substantially the following statement in conspicuous type:

“The office may take disciplinary action against any person making a knowing and willful misrepresentation on this form.” (6) A dealer, an investment adviser, or an associated person who in good faith and exercising reasonable care complies with this section is immune from any administrative or civil liability that might otherwise arise from such delay in a disbursement or transaction in accordance with this section.

This subsection does not supersede or diminish any immunity granted under chapter 415, nor does it substitute for the duty to report to the central abuse hotline as required under s.

415.1034.

Section 9.

520.135Page Surrendered16 or repossessed vehicles.—The rights and obligations of parties39 withCODING: respect to a surrendered or repossessed motor vehicle are exclusively governed by part VI of chapter 679.

Section 10.

Subsections (1) and (2) of section 560.114, Florida Statutes, are amended to read:

Page 22 of 48 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 560.114520.135 DisciplinarySurrendered actions;or repossessed vehicles.—The rights and obligations of parties with respect to a surrendered or repossessed motor vehicle are exclusively governed by part VI of chapter 679.

Section 6.

Subsections (1) and (2) of section 560.114, Florida Statutes, are amended to read:

560.114 Disciplinary actions;

1010.306, 1010.311, 1010.312, 1010.340, 1010.410,Page 1010.415,17 1022.210,of 1022.320,39 1022.380,CODING: and 1022.410, or by an agreement entered into with the office.

(f) Refusing to allow the examination or inspection of books, accounts, files, or other documents by the office pursuant to this chapter, or to comply with a subpoena issued by the office.

Page 23 of 48 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 (g)1010.410, Failure1010.415, to1022.210, pay1022.320, a1022.380, judgmentand recovered1022.410, inor any court by a claimant in an actionagreement arisingentered outinto ofwith a money transmission transaction within 30 days after the judgmentoffice. becomes final.

(f) Refusing to allow the examination or inspection of books, accounts, files, or other documents by the office pursuant to this chapter, or to comply with a subpoena issued by the office.

(g) Failure to pay a judgment recovered in any court by a claimant in an action arising out of a money transmission transaction within 30 days after the judgment becomes final.

(n)Page Committing18 any act resulting in a license or its equivalent to practice any profession or occupation being denied, suspended, revoked, or otherwise acted against by a licensing authority in any jurisdiction for a violation of 1839 U.S.C.CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 (n) Committing any act resulting in a license or its equivalent to practice any profession or occupation being denied, suspended, revoked, or otherwise acted against by a licensing authority in any jurisdiction for a violation of 18 U.S.C.

5324, or any other law or rule of another state or of the PageUnited 24States relating to a money services business, deferred presentment provider, or usury that may cause the denial, suspension, or revocation of 48a CODING:money services business or deferred presentment provider license or its equivalent in such jurisdiction.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 United States relating to a money services business, deferred presentment provider, or usury that may cause the denial, suspension, or revocation of a money services business or deferred presentment provider license or its equivalent in such jurisdiction.

(s)(r) Failure to inform the office in writing within 30 days after having pled guilty or nolo contendere to, or being convicted of, any felony or crime punishable by imprisonment of 1Page year19 or more under the law of any39 stateCODING: or the United States, or any crime involving fraud, moral turpitude, or dishonest dealing.

(t)(s) Aiding, assisting, procuring, advising, or abetting any person in violating a provision of this chapter or any order or rule of the office or commission.

Page 25 of 48 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 (u)(t)1 Failureyear toor paymore anyunder fee,the charge,law of any state or costthe imposedUnited States, or assessedany undercrime thisinvolving chapter.fraud, moral turpitude, or dishonest dealing.

(t)(s) Aiding, assisting, procuring, advising, or abetting any person in violating a provision of this chapter or any order or rule of the office or commission.

(u)(t) Failure to pay any fee, charge, or cost imposed or assessed under this chapter.

(cc)(bb)Page Failure20 of a39 checkCODING: casher to deposit into its own federally insured depository account any payment instrument cashed as required by s.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 (cc)(bb) Failure of a check casher to deposit into its own federally insured depository account any payment instrument cashed as required by s.

part 232, in connection with a deferred presentment Pagetransaction 26conducted under part IV of 48this CODING:chapter.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 transaction conducted under part IV of this chapter.

120.60(6), The office shall issue an emergency suspension order suspending may summarily suspend the license of a money services business if the office finds that a licensee poses a danger deemed by the Legislature to be an immediateimmediate, and, serious danger to the public health, safety, and welfare.

(a)The Anfollowing emergencyacts suspensionare orderdeemed underby thisthe subsectionLegislature to constitute an immediate and serious danger to the public health, safety, and welfare, and the office shall may beimmediately issuedsuspend the license of a money services business without priormaking noticeany andfurther anfindings opportunityof toimmediate bedanger, heard.necessity, and procedural fairness if:

An(a) emergencyThe suspensionmoney orderservices must:business fails to provide to the office, upon written request, any of the records required by s.

1.

State the grounds on which the order is based;

2.

Advise the licensee against whom the order is directed that the order takes effect immediately and, to the extent applicable, requires the licensee to immediately cease and desist from the conduct or violation that is the subject of the order or to take the affirmative action stated in the order as necessary to correct a condition resulting from the conduct or violation or as otherwise appropriate;

3.

Be delivered by personal delivery or sent by certified mail, return receipt requested, to the licensee against whom the order is directed at the licensee’s last known address;

and 4.

Include a notice that the licensee subject to the emergency suspension order may seek judicial review pursuant to s.

120.68.

Page 27 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 (b) An emergency suspension order is effective as soon as the licensee against whom the order is directed has actual or constructive knowledge of the issuance of the order.

(c) The office shall institute timely proceedings under ss.

120.569 and 120.57 after issuance of an emergency suspension order.

(d) A licensee subject to an emergency suspension order may seek judicial review pursuant to s.

120.68.

(e) The following acts are deemed by the Legislature to constitute an immediate and serious danger to the public health, safety, and welfare, and the office shall may immediately issue an emergency suspension order to suspend the license of a money services business if:

1.(a) The money services business fails to provide to the office, upon written request, any of the records required by s.

2.(b)(b) The money services business fails to maintain a federally insured depository account as required by s.

560.208(4)Page or21 s.of 39 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 560.208(4) or s.

3.(c)(c) A natural person required to be listed on the license application for a money services business pursuant to s.

Section 11.7.

560.1311 Information security programs.—programs; Page 28 of 48 CODING:

Wordscybersecurity strickenevent areinvestigations.— deletions;(1) DEFINITIONS.—As used in this section, the term:

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 (1) DEFINITIONS.—As used in this section, the term:

(c) “Cybersecurity event” means an event resulting in unauthorized access to, or disruption or misuse of, an information systemsystem, or customer information stored on such information system.system, or customer information held in physical form.

The(d) term“Financial doesproduct notor includeservice” themeans unauthorizedany acquisitionproduct of encrypted customer information if the encryption process or keyservice isoffered notby alsoa acquired,licensee released,under orthis usedchapter. without authorization.

The(e) term“Information doessecurity notprogram” includemeans an event with regard to which the licenseeadministrative, hastechnical, determinedor thatphysical thesafeguards customerused informationto accessedaccess, bycollect, andistribute, unauthorizedprocess, personprotect, hasstore, notuse, beentransmit, useddispose of, or releasedotherwise andhandle hascustomer beeninformation. returned or destroyed.

(d)Page “Encrypted”22 means the transformation of data39 intoCODING: a form that results in a low probability of assigning meaning without the use of a protective process or key.

(e) “Financial product or service” means any product or service offered by a licensee under this chapter.

(f) “Information security program” means the administrative, technical, or physical safeguards used to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.

(g) “Information system” means a discrete set of electronic Page 29 of 48 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 (f) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information, as well as any specialized system such as an industrial process control system, telephone switching and private branch exchange system, or environmental control system, which contain customer information or which are connected to a system that contains customer information.

(h)(g)1. “Licensee” means a person licensed under this chapter.

(i)1.

Any list of individuals’ names and addresses which contains only publicly available information, is not derived, in whole or in part, using personally identifiable financial Page 3023 of 4839 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 information that is not publicly available, and is not disclosed in a manner that indicates that any of the individuals on the list is a customer of a licensee.

b.(I) “Publicly available information” means any Page 3124 of 4839 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 information that a licensee has a reasonable basis to believe is lawfully made available to the general public from:

(j)(h) “Third-party service provider” means a person, other than a licensee, which contracts with a licensee to maintain, Page 3225 of 4839 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 process, or store nonpublic personal information, or is otherwise permitted access to nonpublic personal information through its provision of services to a licensee.

Define and periodically reevaluate the retention Page 3326 of 4839 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 schedule and the mechanism for the destruction of nonpublic personal information if retention is no longer necessary for the licensee’s business operations or is no longer required by applicable law.

MitigateEliminate any internal or external threats to nonpublic personal information.

Amend the licensee’s information security program for any materialof changes to the licensee’s changing business arrangements, including, but not limited to, mergers and acquisitions, alliances and joint ventures, and outsourcing arrangements.

The continuing functionality of any aspect of the Page 3427 of 4839 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 licensee’s operations.

The process by which notice must be given as required under subsection (3)(4) and s.

(e) Each licensee shall maintain a copy of the information Page 3528 of 4839 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 security program for a minimum of 5 years and shall make it available to the office upon request or as part of an examination.

(3) NOTICECYBERSECURITY TOEVENT OFFICEINVESTIGATION.— OF(a) SECURITYIf BREACH.—Eacha licensee shalldiscovers providethat noticea tocybersecurity event has occurred or that a cybersecurity event may have occurred, the officelicensee, ofor anyan breachoutside ofvendor security,or asthird-party definedservice inprovider s.that the licensee has designated to act on its behalf, shall conduct a prompt investigation of the cybersecurity event.

501.171(1),(b) affectingDuring 500the investigation, the licensee, or morethe individualsoutside invendor thisor statethird-party service provider that the licensee has designated to act on its behalf, shall, at a timeminimum, anddetermine inas themuch mannerof prescribedthe byfollowing commissionas rule.possible:

(4)1. CONSTRUCTION.—This section may not be construed to relieve a covered entity from complying with s.

Confirm that a cybersecurity event has occurred.

2.

Identify the date that the cybersecurity event first occurred.

3.

Assess the nature and scope of the cybersecurity event.

4.

Identify all nonpublic personal information that may have been compromised by the cybersecurity event.

5.

Perform or oversee reasonable measures to restore the security of any compromised information system in order to prevent further unauthorized acquisition, release, or use of nonpublic personal information that is in the licensee’s, outside vendor’s, or third-party service provider’s possession, custody, or control.

(c) If a licensee learns that a cybersecurity event has occurred, or may have occurred, in an information system maintained by a third-party service provider of the licensee, the licensee shall complete an investigation in compliance with Page 29 of 39 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 this section or confirm and document that the third-party service provider has completed an investigation in compliance with this section.

(d) A licensee shall maintain all records and documentation related to the licensee’s investigation of a cybersecurity event for a minimum of 5 years after the date of the cybersecurity event and shall produce the records and documentation to the office upon request.

(4) NOTICE TO OFFICE OF SECURITY BREACH.— (a) Each licensee shall provide notice to the office of any breach of security affecting 500 or more individuals in this state at a time and in the manner prescribed by commission rule.

(b) Each licensee shall, upon the office’s request, provide a quarterly update of a cybersecurity event investigation under subsection (3) until conclusion of the investigation.

(5) CONSTRUCTION.—This section may not be construed to relieve a covered entity from complying with s.

(5)(6) RULES.—The commission shallmay adopt rules to administer this section, including rules that allow a licensee that is in full compliance with the Federal Trade Commission’s Standards for Safeguarding Customer Information, 16 C.F.R.

Section 12.8.

Subsection (10) of section 560.309, Florida Statutes, is amended to read:

560.309 Conduct of business.— (10) If a check is returned to a licensee from a payor financial institution due to lack of funds, a closed account, or a stop-payment order, the licensee may seek collection pursuant to s.

68.065.

In seeking collection, the licensee must comply with the prohibitions against harassment or abuse, false or misleading representations, and unfair practices in the Florida Consumer Collection Practices Act under part VI of chapter 559, including s.

559.77.

The licensee must also comply with the Fair Debt Collections Practices Act, 15 U.S.C.

ss.

1692d, 1692e, and Page 36 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 1692f if the licensee uses a third-party debt collector or any name other than its own to collect such debts.

A violation of this subsection is a deceptive and unfair trade practice and constitutes a violation of the Deceptive and Unfair Trade Practices Act under part II of chapter 501.

In addition, a licensee must comply with the applicable provisions of the Consumer Collection Practices Act under part VI of chapter 559, including s.

559.77.

Section 13.

Subsection (3) of section 560.405, Florida Statutes, is amended to read:

560.405 Deposit;

redemption.— (3) Notwithstanding subsection (1), in lieu of presentment, a deferred presentment provider may allow the check to be redeemed at any time upon payment of the outstanding transaction balance and earned fees.

Redemption in cash must be treated in the same manner as redemption through a debit card transaction.

However, payment may not be made in the form of a personal check or through a credit card transaction.

Upon redemption, the deferred presentment provider must return the drawer’s check and provide a signed, dated receipt showing that the drawer’s check has been redeemed.

Section 14.

Subsection (2) of section 560.406, Florida Statutes, is amended to read:

560.406 Worthless checks.— (2) If a check is returned to a deferred presentment provider from a payor financial institution due to insufficient funds, a closed account, or a stop-payment order, the deferred presentment provider may pursue all legally available civil remedies to collect the check, including, but not limited to, Page 37 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 the imposition of all charges imposed on the deferred presentment provider by the financial institution.

In its collection practices, a deferred presentment provider must comply with the prohibitions against harassment or abuse, false or misleading representations, and unfair practices that are contained in the Florida Consumer Collection Practices Act under part VI of chapter 559, including s.

559.77.

A deferred presentment provider must also comply with the Fair Debt Collections Practices Act, 15 U.S.C.

ss.

1692d, 1692e, and 1692f if the deferred presentment provider uses a third-party debt collector or any name other than its own to collect such debts.

A violation of this act is a deceptive and unfair trade practice and constitutes a violation of the Deceptive and Unfair Trade Practices Act under part II of chapter 501.

In addition, a deferred presentment provider must comply with the applicable provisions of the Consumer Collection Practices Act under part VI of chapter 559, including s.

559.77.

Section 15.

(a)Page “Breach30 of security”39 orCODING: “breach” means unauthorized access of data in electronic form containing personal information.

Good faith access of personal information by an employee or agent of a financial institution does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use.

As used in this paragraph, the term “data in Page 38 of 48 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 electronic(a) form”“Breach meansof anysecurity” data stored electronically or digitally“breach” onmeans anyunauthorized computeraccess systemof ordata otherin databaseelectronic andform includescontaining recordablepersonal tapesinformation. and other mass storage devices.

Good faith access of personal information by an employee or agent of a financial institution does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use.

As used in this paragraph, the term “data in electronic form” means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices.

A username or e-mail address, in combination with a passwordPage or31 securityof question39 andCODING: answer that would permit access to an online account.

2.

The term does not include information about an individual which has been made publicly available by a federal, state, or local governmental entity.

The term also does not include information that is encrypted, secured, or modified by any other method or technology that removes elements that Page 39 of 48 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 personallypassword identifyor ansecurity individualquestion orand answer that otherwisewould renderspermit theaccess informationto unusable.an online account.

2.

The term does not include information about an individual which has been made publicly available by a federal, state, or local governmental entity.

The term also does not include information that is encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable.

A financial institution may provide the office with supplementalPage information32 regardingof a39 breachCODING: at any time.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 540 597-01923-26 2026540c1 supplemental information regarding a breach at any time.

(4) NOTICE TO INDIVIDUALS OF SECURITY BREACH.—Each financial institution shall give notice to each individual in Pagethis 40state whose personal information was, or the financial institution reasonably believes to have been, accessed as a result of 48the CODING:breach in accordance with s.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 this state whose personal information was, or the financial institution reasonably believes to have been, accessed as a result of the breach in accordance with s.

Section 16.9.

PresentParagraph subsections(d) (3),of (4),subsection and(1) (5) of section 655.032,655.045, Florida Statutes, are redesignated as subsections (4), (5), and (6), respectively, and a new subsection (3) is addedamended to that section, to read:

655.032655.045 Investigations,Examinations, subpoenas,reports, hearings, and witnesses.—internal (3)audits; The office may consider or use as part of any investigation pursuant to this section the information contained in any suspected financial exploitation report or any records generated as a result of such report which is obtained pursuant Page 41 of 48 CODING:

Page 33 of 39 CODING:

Florida Senate - 2026 CS for CS for SB 540 601-02832-26597-01923-26 2026540c22026540c1 topenalty.— s.(1) The office shall conduct an examination of the condition of each state financial institution at least every 18 months.

415.106(4).

Section 17.

Present paragraphs (c) through (f) of subsection (1) of section 655.045, Florida Statutes, are redesignated as paragraphs (d) through (g), respectively, a new paragraph (c) is added to that subsection, and present paragraph (d) of that subsection is amended, to read:

655.045 Examinations, reports, and internal audits;

penalty.— (1) The office shall conduct an examination of the condition of each state financial institution at least every 18 months.

(c)(d) TheAs officeused mayin considerthis orsection, usethe asterm part“costs” ofmeans anythe examinationsalary conductedand pursuanttravel toexpenses thisdirectly sectionattributable to the informationfield containedstaff inexamining anythe suspectedstate financial exploitationinstitution, reportsubsidiary, or anyservice recordscorporation, generatedand asthe atravel resultexpenses of suchany reportsupervisory whichstaff isrequired obtainedas pursuanta toresult s.of examination findings.

415.106(4).

(e)(d) As used in this section, the term “costs” means the salary and travel expenses directly attributable to the field staff examining the state financial institution, subsidiary, or service corporation, and the travel expenses of any supervisory Page 42 of 48 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 540 601-02832-26 2026540c2 staff required as a result of examination findings.