Department of Financial Institutions seeks state authority to enforce federal data‑security rules, clarifies licensing and enforcement powers

Bismarck — Lisa Cruz, commissioner of the North Dakota Department of Financial Institutions, told the Senate Industry and Business Committee she supports House Bill 11‑27, a multi‑section measure she described as “really a modernization bill” that would revise chapters of the North Dakota Century Code and create a new chapter to address data security for non‑depository financial corporations.

The bill would amend multiple provisions in Chapters 6 and 13 to align procedures between bank and nonbank supervision, give the commissioner authority parallel to the State Banking Board in some enforcement actions, and create Chapter 1301.2 to adopt a model data‑security law for nonbanks, Cruz said. “Safeguarding customers’ data is of utmost importance,” she said, arguing that adoption of the model law would give the state the same cybersecurity enforcement authority available to federal regulators.

Why it matters: The change would allow the state to address failures discovered during exams of nonbank licensees and require consistent breach‑notification and data‑security enforcement at the state level rather than relying solely on federal action. Cruz told the committee the model law mirrors a 2023 Federal Trade Commission safeguards rule and has been enacted in several other states, which she said reduces regulatory burden for companies operating nationwide.

Key provisions and agency rationale: Cruz outlined several specific changes. One would clarify that the State Banking Board or the commissioner may issue prohibition orders where an individual has been convicted of offenses that bear on fitness to work in a financial institution; another would permit the commissioner, in addition to the Board, to issue orders or rules about permissible activities for banks to improve timeliness. The bill would also update notice, renewal and appeal timelines for money transmitters and other licensees, and add a broader definition of “loan of money” to capture emerging alternative financing products.

Cruz said the department originally sought to remove statutory language that allows a person to petition for termination of a final prohibition order after three years; the House reinstated a three‑year reinstatement option. Cruz told senators she accepted that restoration to keep the larger bill moving, but that the department remains concerned about reinstating individuals who previously engaged in embezzlement or fraud into positions that give access to customer funds and personal data.

Industry and consumer groups: Rick Kleberg, president and CEO of the North Dakota Bankers Association, and John Alexander of Dakota Credit Unions both told the committee they support the bill’s modernization and the data‑security provisions. Kleberg and Alexander both urged alignment between state and federal practice on employee‑removal rules, with Kleberg noting some state‑federal differences on reinstatement windows.

Questions from committee members focused on whether the bill reflects continuing statutory housekeeping or a response to new technology and fraud. Cruz said the nonbank sector has grown rapidly and that the department recently created a deputy position to oversee non‑depository supervision and to address emerging fraud, including in the crypto space. She described revocations and denials of renewal as a consumer‑protection tool for non‑FDIC‑insured firms.

What's next: The committee received testimony in support and no formal vote was recorded during the hearing. Cruz said the department will continue to work with federal partners to tailor enforcement and said staff are available to respond to committee questions on specific sections.

The bill text, Cruz’s proposed amendment language, and the department’s list of affected Century Code sections are available in the committee packet.