GLBA and money transmitter testing requirements

What GLBA and state money transmission laws require

GLBA Safeguards Rule. For nonbank financial institutions, the FTC implements Title V of the Gramm-Leach-Bliley Act (GLBA) in 16 CFR Part 314 (checked on 2026-09-16, eCFR current to 2026-09-14). Section 314.1(b) names check cashers, wire transferors, and payday lenders among covered entities; institutions under another regulator's GLBA section 505 authority, such as banks, are outside Part 314. Section 314.4 lists the elements of the written information security program:

• 314.4(a) and (b). A Qualified Individual (the person who oversees the program) and a written risk assessment.
• 314.4(c)(1). Access controls that limit authorized users to the customer information they need, and customers to their own information.
• 314.4(c)(3). Encryption of customer information at rest and in transit over external networks; where encryption is infeasible, compensating controls the Qualified Individual reviews and approves.
• 314.4(c)(5). Multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves an equivalent control in writing.
• 314.4(c)(6) to (c)(8). Disposal no later than two years after last use, with listed exceptions, change management, and logging of authorized users' activity.
• 314.4(d)(2). Without effective continuous monitoring, annual penetration testing and vulnerability assessments at least every six months and after material changes.
• 314.4(h) to (j). A written incident response plan, an annual written report to the board, and notice to the FTC within 30 days of discovering a notification event that involves at least 500 consumers (effective 13 May 2024, Section 314.5).

Section 314.6 exempts institutions with customer information on fewer than 5,000 consumers from 314.4(b)(1), (d)(2), (h), and (i).

Regulation P. The CFPB privacy rule, 12 CFR Part 1016 (checked on 2026-09-16), covers individuals who obtain products for personal, family, or household purposes (1016.1(b)(1)). Section 1016.4(a)(1) requires an initial privacy notice no later than the start of the customer relationship, and 1016.5(a) an annual notice unless the 1016.5(e) exception applies. Section 1016.10(a) forbids disclosure to a nonaffiliated third party before an initial notice, an opt-out notice, and a reasonable opportunity to opt out. Section 1016.12(a) forbids disclosing account data such as a deposit or credit card account number to a nonaffiliated third party for marketing.

State money transmission laws. States license money transmitters under their own statutes. The Conference of State Bank Supervisors (CSBS) publishes the Money Transmission Modernization Act model law (MTMA, checked on 2026-09-16), which states enact in full, in part, or not at all. In the model text:

• Section 2.01(q) defines money transmission as selling or issuing payment instruments or stored value, or receiving money for transmission, including payroll processing services.
• Sections 7.01 and 7.06 require a report of condition within 45 days of quarter end, with a permissible investments report, and records for at least [three] years, including bank reconciliation records.
• Sections 9.02 and 9.03 require a refund within 10 days of a written request unless a listed exception applies, and a receipt with listed fields. Both exclude transfers under the federal Remittance Rule.
• Section 10.01 sets tangible net worth at the greater of $100,000 or 3 percent of the first $100 million of total assets plus lower rates above it. Section 10.02 sets a surety bond of the greater of [$100,000] or average daily money transmission liability in the state, up to [$500,000].
• Section 10.03(a) requires permissible investments of not less than all outstanding money transmission obligations at all times.

Bracketed values vary by state; commentary to Section 10.02 notes states with a bond maximum above $500,000. The enacted state statute is the test oracle. The Nationwide Multistate Licensing System (NMLS) receives the quarterly MSB Call Report (checked on 2026-09-16).