1.1 	A bill for an act
1.2 	relating to commerce; adding and modifying various provisions governing financial 
1.3 	institutions; making technical changes;amending Minnesota Statutes 2022, sections 
1.4 	47.20, subdivision 2; 47.54, subdivisions 2, 6; 48.24, subdivision 2; 58.02, 
1.5 	subdivisions 18, 21, by adding a subdivision; 58.04, subdivisions 1, 2; 58.05, 
1.6 	subdivisions 1, 3; 58.06, by adding subdivisions; 58.08, subdivisions 1a, 2; 58.10, 
1.7 	subdivision 3; 58.115; 58.13, subdivision 1; proposing coding for new law in 
1.8 	Minnesota Statutes, chapter 58; proposing coding for new law as Minnesota 
1.9 	Statutes, chapter 46A; repealing Minnesota Statutes 2022, section 58.08, subdivision 
1.10 	3.
1.11 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.12 	Section 1. [46A.01] DEFINITIONS.
1.13 		Subdivision 1.Terms.  For the purposes of this chapter, the terms defined in this section 
1.14 	have the meanings given them.
1.15 		Subd. 2.Authorized user. "Authorized user" means any employee, contractor, agent, 
1.16 	or other person who: (1) participates in a financial institution's business operations; and (2) 
1.17 	is authorized to access and use any of the financial institution's information systems and 
1.18 	data.
1.19 		Subd. 3.Commissioner. "Commissioner" means the commissioner of commerce.
1.20 		Subd. 4.Consumer. (a) "Consumer" means an individual who obtains or has obtained 
1.21 	from a financial institution a financial product or service that is used primarily for personal, 
1.22 	family, or household purposes, or is used by the individual's legal representative. Consumer 
1.23 	includes but is not limited to an individual who:
1.24 	(1) applies to a financial institution for credit for personal, family, or household purposes, 
1.25 	regardless of whether the credit is extended;
2.1 	(2) provides nonpublic personal information to a financial institution in order to obtain 
2.2 	a determination whether the individual qualifies for a loan used primarily for personal, 
2.3 	family, or household purposes, regardless of whether the loan is extended;
2.4 	(3) provides nonpublic personal information to a financial institution in connection with 
2.5 	obtaining or seeking to obtain financial, investment, or economic advisory services, regardless 
2.6 	of whether the financial institution establishes a continuing advisory relationship with the 
2.7 	individual; or
2.8 	(4) has a loan for personal, family, or household purposes in which the financial institution 
2.9 	has ownership or servicing rights, even if the financial institution or one or more other 
2.10 	institutions that hold ownership or servicing rights in conjunction with the financial institution 
2.11 	hires an agent to collect on the loan.
2.12 	(b) Consumer does not include an individual who:
2.13 	(1) is a consumer of another financial institution that uses a different financial institution 
2.14 	to act solely as an agent for, or provide processing or other services to, the consumer's 
2.15 	financial institution;
2.16 	(2) designates a financial institution solely for the purposes to act as a trustee for a trust;
2.17 	(3) is the beneficiary of a trust for which the financial institution serves as trustee; or
2.18 	(4) is a participant or a beneficiary of an employee benefit plan that the financial 
2.19 	institution sponsors or for which the financial institution acts as a trustee or fiduciary.
2.20 		Subd. 5.Continuing relationship. (a) "Continuing relationship" means a consumer:
2.21 	(1) has a credit or investment account with a financial institution;
2.22 	(2) obtains a loan from a financial institution;
2.23 	(3) purchases an insurance product from a financial institution;
2.24 	(4) holds an investment product through a financial institution, including but not limited 
2.25 	to when the financial institution acts as a custodian for securities or for assets in an individual 
2.26 	retirement arrangement;
2.27 	(5) enters into an agreement or understanding with a financial institution whereby the 
2.28 	financial institution undertakes to arrange or broker a home mortgage loan, or credit to 
2.29 	purchase a vehicle, for the consumer;
2.30 	(6) enters into a lease of personal property on a nonoperating basis with a financial 
2.31 	institution;
3.1 	(7) obtains financial, investment, or economic advisory services from a financial 
3.2 	institution for a fee;
3.3 	(8) becomes a financial institution's client to obtain tax preparation or credit counseling 
3.4 	services from the financial institution;
3.5 	(9) obtains career counseling while: (i) seeking employment with a financial institution 
3.6 	or the finance, accounting, or audit department of any company; or (ii) employed by a 
3.7 	financial institution or department of any company;
3.8 	(10) is obligated on an account that a financial institution purchases from another financial 
3.9 	institution, regardless of whether the account is in default when purchased, unless the 
3.10 	financial institution does not locate the consumer or attempt to collect any amount from the 
3.11 	consumer on the account;
3.12 	(11) obtains real estate settlement services from a financial institution; or
3.13 	(12) has a loan for which a financial institution owns the servicing rights.
3.14 	(b) Continuing relationship does not include situations where:
3.15 	(1) the consumer obtains a financial product or service from a financial institution only 
3.16 	in isolated transactions, including but not limited to: (i) using a financial institution's 
3.17 	automated teller machine to withdraw cash from an account at another financial institution; 
3.18 	(ii) purchasing a money order from a financial institution; (iii) cashing a check with a 
3.19 	financial institution; or (iv) making a wire transfer through a financial institution;
3.20 	(2) a financial institution sells the consumer's loan and does not retain the rights to service 
3.21 	the loan;
3.22 	(3) a financial institution sells the consumer airline tickets, travel insurance, or traveler's 
3.23 	checks in isolated transactions;
3.24 	(4) the consumer obtains onetime personal or real property appraisal services from a 
3.25 	financial institution; or
3.26 	(5) the consumer purchases checks for a personal checking account from a financial 
3.27 	institution.
3.28 		Subd. 6.Customer. "Customer" means a consumer who has a customer relationship 
3.29 	with a financial institution.
3.30 		Subd. 7.Customer information. "Customer information" means any record containing 
3.31 	nonpublic personal information about a financial institution's customer, whether the record 
4.1 	is in paper, electronic, or another form, that is handled or maintained by or on behalf of the 
4.2 	financial institution or the financial institution's affiliates.
4.3 		Subd. 8.Customer relationship. "Customer relationship" means a continuing relationship 
4.4 	between a consumer and a financial institution under which the financial institution provides 
4.5 	to the consumer one or more financial products or services that are used primarily for 
4.6 	personal, family, or household purposes.
4.7 		Subd. 9.Encryption. "Encryption" means the transformation of data into a format that 
4.8 	results in a low probability of assigning meaning without the use of a protective process or 
4.9 	key, consistent with current cryptographic standards and accompanied by appropriate 
4.10 	safeguards for cryptographic key material.
4.11 		Subd. 10.Federally insured depository financial institution. "Federally insured 
4.12 	depository financial institution" means a bank, credit union, savings and loan association, 
4.13 	trust company, savings association, savings bank, industrial bank, or industrial loan company 
4.14 	organized under the laws of the United States or any state of the United States, when the 
4.15 	bank, credit union, savings and loan association, trust company, savings association, savings 
4.16 	bank, industrial bank, or industrial loan company has federally insured deposits.
4.17 		Subd. 11.Financial product or service. "Financial product or service" means any 
4.18 	product or service that a financial holding company could offer by engaging in a financial 
4.19 	activity under section 4(k) of the Bank Holding Company Act of 1956, United States Code, 
4.20 	title 12, section 1843(k). Financial product or service includes a financial institution's 
4.21 	evaluation or brokerage of information that the financial institution collects in connection 
4.22 	with a request or an application from a consumer for a financial product or service.
4.23 		Subd. 12.Financial institution. "Financial institution" means a consumer small loan 
4.24 	lender under section 47.60, a person owning or maintaining electronic financial terminals 
4.25 	under section 47.62, a trust company under chapter 48A, a loan and thrift company under 
4.26 	chapter 53, a currency exchange under chapter 53A, a money transmitter under chapter 53B, 
4.27 	a sales finance company under chapter 53C, a regulated loan lender under chapter 56, a 
4.28 	residential mortgage originator or servicer under chapter 58, a student loan servicer under 
4.29 	chapter 58B, a credit service organization under section 332.54, a debt management service 
4.30 	provider or person providing debt management services under chapter 332A, or a debt 
4.31 	settlement service provider or person providing debt settlement services under chapter 332B.
4.32 		Subd. 13.Information security program. "Information security program" means the 
4.33 	administrative, technical, or physical safeguards a financial institution uses to access, collect, 
5.1 	distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer 
5.2 	information.
5.3 		Subd. 14.Information system. "Information system" means a discrete set of electronic 
5.4 	information resources organized to collect, process, maintain, use, share, disseminate, or 
5.5 	dispose of electronic information, as well as any specialized system, including but not 
5.6 	limited to industrial process controls systems, telephone switching and private branch 
5.7 	exchange systems, and environmental controls systems, that contains customer information 
5.8 	or that is connected to a system that contains customer information.
5.9 		Subd. 15.Multifactor authentication. "Multifactor authentication" means authentication 
5.10 	through verification of at least two of the following factors:
5.11 	(1) knowledge factors, including but not limited to a password;
5.12 	(2) possession factors, including but not limited to a token; or
5.13 	(3) inherence factors, including but not limited to biometric characteristics.
5.14 		Subd. 16.Nonpublic personal information. (a) "Nonpublic personal information" 
5.15 	means:
5.16 	(1) personally identifiable financial information; or
5.17 	(2) any list, description, or other grouping of consumers, including publicly available 
5.18 	information pertaining to the list, description, or other grouping of consumers, that is derived 
5.19 	using personally identifiable financial information that is not publicly available.
5.20 	(b) Nonpublic personal information includes but is not limited to any list of individuals' 
5.21 	names and street addresses that is derived in whole or in part using personally identifiable 
5.22 	financial information that is not publicly available, including account numbers.
5.23 	(c) Nonpublic personal information does not include:
5.24 	(1) publicly available information, except as included on a list described in paragraph 
5.25 	(a), clause (2);
5.26 	(2) any list, description, or other grouping of consumers, including publicly available 
5.27 	information pertaining to the list, description, or other grouping of consumers, that is derived 
5.28 	without using any personally identifiable financial information that is not publicly available; 
5.29 	or
5.30 	(3) any list of individuals' names and addresses that contains only publicly available 
5.31 	information, is not derived in whole or in part using personally identifiable financial 
6.1 	information that is not publicly available, and is not disclosed in a manner that indicates 
6.2 	that any individual on the list is the financial institution's consumer.
6.3 		Subd. 17.Notification event. "Notification event" means the acquisition of unencrypted 
6.4 	customer information without the authorization of the individual to which the information 
6.5 	pertains. Customer information is considered unencrypted for this purpose if the encryption 
6.6 	key was accessed by an unauthorized person. Unauthorized acquisition is presumed to 
6.7 	include unauthorized access to unencrypted customer information unless the financial 
6.8 	institution has reliable evidence showing that there has not been, or could not reasonably 
6.9 	have been, unauthorized acquisition of customer information.
6.10 		Subd. 18.Penetration testing. "Penetration testing" means a test methodology in which 
6.11 	assessors attempt to circumvent or defeat the security features of an information system by 
6.12 	attempting to penetrate databases or controls from outside or inside a financial institution's 
6.13 	information systems.
6.14 		Subd. 19.Personally identifiable financial information. (a) "Personally identifiable 
6.15 	financial information" means any information:
6.16 	(1) a consumer provides to a financial institution to obtain a financial product or service;
6.17 	(2) about a consumer resulting from any transaction involving a financial product or 
6.18 	service between a financial institution and a consumer; or
6.19 	(3) a financial institution otherwise obtains about a consumer in connection with providing 
6.20 	a financial product or service to the customer.
6.21 	(b) Personally identifiable financial information includes:
6.22 	(1) information a consumer provides to a financial institution on an application to obtain 
6.23 	a loan, credit card, or other financial product or service;
6.24 	(2) account balance information, payment history, overdraft history, and credit or debit 
6.25 	card purchase information;
6.26 	(3) the fact that an individual is or has been a financial institution's customer or has 
6.27 	obtained a financial product or service from the financial institution;
6.28 	(4) any information about a financial institution's consumer, if the information is disclosed 
6.29 	in a manner that indicates that the individual is or has been the financial institution's 
6.30 	consumer;
7.1 	(5) any information that a consumer provides to a financial institution or that a financial 
7.2 	institution or a financial institution's agent otherwise obtains in connection with collecting 
7.3 	on or servicing a credit account;
7.4 	(6) any information a financial institution collects through an Internet information 
7.5 	collecting device from a web server; and
7.6 	(7) information from a consumer report.
7.7 	(c) Personally identifiable financial information does not include:
7.8 	(1) a list of customer names and addresses for an entity that is not a financial institution; 
7.9 	and
7.10 	(2) information that does not identify a consumer, including but not limited to aggregate 
7.11 	information or blind data that does not contain personal identifiers, including account 
7.12 	numbers, names, or addresses.
7.13 		Subd. 20.Publicly available information. (a) "Publicly available information" means 
7.14 	any information that a financial institution has a reasonable basis to believe is lawfully made 
7.15 	available to the general public from:
7.16 	(1) federal, state, or local government records;
7.17 	(2) widely distributed media; or
7.18 	(3) disclosures to the general public that are required under federal, state, or local law.
7.19 	(b) Publicly available information includes but is not limited to:
7.20 	(1) with respect to government records, information in government real estate records 
7.21 	and security interest filings; and
7.22 	(2) with respect to widely distributed media, information from a telephone book, a 
7.23 	television or radio program, a newspaper, or a website that is available to the general public 
7.24 	on an unrestricted basis. A website is not restricted merely because an Internet service 
7.25 	provider or a site operator requires a fee or a password, provided that access is available to 
7.26 	the general public.
7.27 	(c) For purposes of this subdivision, a financial institution has a reasonable basis to 
7.28 	believe that information is lawfully made available to the general public if the financial 
7.29 	institution has taken steps to determine: (1) that the information is of the type that is available 
7.30 	to the general public; and (2) whether an individual can direct that the information not be 
7.31 	made available to the general public and, if so, that the financial institution's consumer has 
7.32 	not directed that the information not be made available to the general public. A financial 
8.1 	institution has a reasonable basis to believe that mortgage information is lawfully made 
8.2 	available to the general public if the financial institution determines the information is of 
8.3 	the type included on the public record in the jurisdiction where the mortgage would be 
8.4 	recorded. A financial institution has a reasonable basis to believe that an individual's 
8.5 	telephone number is lawfully made available to the general public if the financial institution 
8.6 	has located the telephone number in the telephone book or the consumer has informed the 
8.7 	financial institution that the telephone number is not unlisted.
8.8 		Subd. 21.Qualified individual. "Qualified individual" means the individual designated 
8.9 	by a financial institution to oversee, implement, and enforce the financial institution's 
8.10 	information security program.
8.11 		Subd. 22.Security event. "Security event" means an event resulting in unauthorized 
8.12 	access to, or disruption or misuse of: (1) an information system or information stored on an 
8.13 	information system; or (2) customer information held in physical form.
8.14 		Subd. 23.Service provider. "Service provider" means any person or entity that receives, 
8.15 	maintains, processes, or otherwise is permitted access to customer information through the 
8.16 	service provider's provision of services directly to a financial institution that is subject to 
8.17 	this chapter.

8.18 	Sec. 2. [46A.02] SAFEGUARDING CUSTOMER INFORMATION; STANDARDS.
8.19 		Subdivision 1.Information security program. (a) A financial institution must develop, 
8.20 	implement, and maintain a comprehensive information security program.
8.21 	(b) The information security program must: (1) be written in one or more readily 
8.22 	accessible parts; and (2) contain administrative, technical, and physical safeguards that are 
8.23 	appropriate to the financial institution's size and complexity, the nature and scope of the 
8.24 	financial institution's activities, and the sensitivity of any customer information at issue.
8.25 	(c) The information security program must include the elements set forth in section 
8.26 	46A.03 and must be reasonably designed to achieve the objectives of this chapter, as 
8.27 	established under subdivision 2.
8.28 		Subd. 2.Objectives. The objectives of this chapter are to:
8.29 	(1) ensure the security and confidentiality of customer information;
8.30 	(2) protect against any anticipated threats or hazards to the security or integrity of 
8.31 	customer information; and
9.1 	(3) protect against unauthorized access to or use of customer information that might 
9.2 	result in substantial harm or inconvenience to a customer.

9.3 	Sec. 3. [46A.03] ELEMENTS.
9.4 		Subdivision 1.Generally. In order to develop, implement, and maintain an information 
9.5 	security program, a financial institution must comply with this section.
9.6 		Subd. 2.Qualified individual. (a) A financial institution must designate a qualified 
9.7 	individual responsible for overseeing, implementing, and enforcing the financial institution's 
9.8 	information security program. The qualified individual may be employed by the financial 
9.9 	institution, an affiliate, or a service provider.
9.10 	(b) If a financial institution designates an individual employed by an affiliate or service 
9.11 	provider as the financial institution's qualified individual, the financial institution must:
9.12 	(1) retain responsibility for complying with this chapter;
9.13 	(2) designate a senior member of the financial institution's personnel to be responsible 
9.14 	for directing and overseeing the qualified individual's activities; and
9.15 	(3) require the service provider or affiliate to maintain an information security program 
9.16 	that protects the financial institution in a manner that complies with the requirements of 
9.17 	this chapter.
9.18 		Subd. 3.Security risk assessment. (a) A financial institution must base the financial 
9.19 	institution's information security program on a risk assessment that:
9.20 	(1) identifies reasonably foreseeable internal and external risks to the security, 
9.21 	confidentiality, and integrity of customer information that might result in the unauthorized 
9.22 	disclosure, misuse, alteration, destruction, or other compromise of customer information; 
9.23 	and
9.24 	(2) assesses the sufficiency of any safeguards in place to control the risks identified 
9.25 	under clause (1).
9.26 	(b) The risk assessment must be made in writing and must include:
9.27 	(1) criteria to evaluate and categorize identified security risks or threats the financial 
9.28 	institution faces;
9.29 	(2) criteria to assess the confidentiality, integrity, and availability of the financial 
9.30 	institution's information systems and customer information, including the adequacy of 
10.1 	existing controls in the context of the identified risks or threats the financial institution 
10.2 	faces; and
10.3 	(3) requirements describing how:
10.4 	(i) identified risks are mitigated or accepted based on the risk assessment; and
10.5 	(ii) the information security program addresses the risks.
10.6 	(c) A financial institution must periodically perform additional risk assessments that:
10.7 	(1) reexamine the reasonably foreseeable internal and external risks to the security, 
10.8 	confidentiality, and integrity of customer information that might result in the unauthorized 
10.9 	disclosure, misuse, alteration, destruction, or other compromise of customer information; 
10.10 	and
10.11 	(2) reassess the sufficiency of any safeguards in place to control the risks identified 
10.12 	under clause (1).
10.13 		Subd. 4.Risk control. A financial institution must design and implement safeguards to 
10.14 	control the risks the financial institution identifies through the risk assessment under 
10.15 	subdivision 3, including by:
10.16 	(1) implementing and periodically reviewing access controls, including technical and, 
10.17 	as appropriate, physical controls to:
10.18 	(i) authenticate and permit access only to authorized users to protect against the 
10.19 	unauthorized acquisition of customer information; and
10.20 	(ii) limit an authorized user's access to only customer information that the authorized 
10.21 	user needs to perform the authorized user's duties and functions or, in the case of a customer, 
10.22 	to limit access to the customer's own information;
10.23 	(2) identifying and managing the data, personnel, devices, systems, and facilities that 
10.24 	enable the financial institution to achieve business purposes in accordance with the business 
10.25 	purpose's relative importance to business objectives and the financial institution's risk 
10.26 	strategy;
10.27 	(3) protecting by encryption all customer information held or transmitted by the financial 
10.28 	institution both in transit over external networks and at rest. To the extent a financial 
10.29 	institution determines that encryption of customer information either in transit over external 
10.30 	networks or at rest is infeasible, the financial institution may secure the customer information 
10.31 	using effective alternative compensating controls that have been reviewed and approved by 
10.32 	the financial institution's qualified individual;
11.1 	(4) adopting: (i) secure development practices for in-house developed applications 
11.2 	utilized by the financial institution to transmit, access, or store customer information; and 
11.3 	(ii) procedures to evaluate, assess, or test the security of externally developed applications 
11.4 	the financial institution uses to transmit, access, or store customer information;
11.5 	(5) implementing multifactor authentication for any individual that accesses any 
11.6 	information system, unless the financial institution's qualified individual has approved in 
11.7 	writing the use of a reasonably equivalent or more secure access control;
11.8 	(6) developing, implementing, and maintaining procedures to securely dispose of 
11.9 	customer information in any format no later than two years after the last date the information 
11.10 	is used in connection with providing a product or service to the customer which relates, 
11.11 	unless the information is necessary for business operations or for other legitimate business 
11.12 	purposes, is otherwise required to be retained by law or regulation, or if targeted disposal 
11.13 	is not reasonably feasible due to the manner in which the information is maintained;
11.14 	(7) periodically reviewing the financial institution's data retention policy to minimize 
11.15 	the unnecessary retention of data;
11.16 	(8) adopting procedures for change management; and
11.17 	(9) implementing policies, procedures, and controls designed to: (i) monitor and log the 
11.18 	activity of authorized users; and (ii) detect unauthorized access to, use of, or tampering with 
11.19 	customer information by authorized users.
11.20 		Subd. 5.Testing and monitoring. (a) A financial institution must regularly test or 
11.21 	otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, 
11.22 	including the controls, systems, and procedures that detect actual and attempted attacks on, 
11.23 	or intrusions into, information systems.
11.24 	(b) For information systems, monitoring and testing must include continuous monitoring 
11.25 	or periodic penetration testing and vulnerability assessments. Absent effective continuous 
11.26 	monitoring or other systems to detect on an ongoing basis any changes in information 
11.27 	systems that may create vulnerabilities, a financial institution must conduct:
11.28 	(1) annual penetration testing of the financial institution's information systems, based 
11.29 	on relevant identified risks in accordance with the risk assessment; and
11.30 	(2) vulnerability assessments, including systemic scans or information systems reviews 
11.31 	that are reasonably designed to identify publicly known security vulnerabilities in the 
11.32 	financial institution's information systems based on the risk assessment, at least every six 
11.33 	months, whenever a material change to the financial institution's operations or business 
12.1 	arrangements occurs, and whenever the financial institution knows or has reason to know 
12.2 	circumstances exist that may have a material impact on the financial institution's information 
12.3 	security program.
12.4 		Subd. 6.Internal policies and procedures. A financial institution must implement 
12.5 	policies and procedures to ensure that the financial institution's personnel are able to enact 
12.6 	the financial institution's information security program by:
12.7 	(1) providing the financial institution's personnel with security awareness training that 
12.8 	is updated as necessary to reflect risks identified by the risk assessment;
12.9 	(2) utilizing qualified information security personnel employed by the financial institution, 
12.10 	an affiliate, or a service provider sufficient to manage the financial institution's information 
12.11 	security risks and to perform or oversee the information security program;
12.12 	(3) providing information security personnel with security updates and training sufficient 
12.13 	to address relevant security risks; and
12.14 	(4) verifying that key information security personnel take steps to maintain current 
12.15 	knowledge of changing information security threats and countermeasures.
12.16 		Subd. 7.Provider oversight. A financial institution must oversee service providers by:
12.17 	(1) taking reasonable steps to select and retain service providers that are capable of 
12.18 	maintaining appropriate safeguards for the customer information at issue;
12.19 	(2) requiring by contract the financial institution's service providers to implement and 
12.20 	maintain appropriate safeguards; and
12.21 	(3) periodically assessing the financial institution's service providers based on the risk 
12.22 	the service providers present and the continued adequacy of the service providers' safeguards.
12.23 		Subd. 8.Information security program; evaluation; adjustment. A financial institution 
12.24 	must evaluate and adjust the financial institution's information security program to reflect: 
12.25 	(1) the results of the testing and monitoring required under subdivision 5; (2) any material 
12.26 	changes to the financial institution's operations or business arrangements; (3) the results of 
12.27 	risk assessments performed under subdivision 3, paragraph (c); or (4) any other circumstances 
12.28 	that the financial institution knows or has reason to know may have a material impact on 
12.29 	the financial institution's information security program.
12.30 		Subd. 9.Incident response plan. A financial institution must establish a written incident 
12.31 	response plan designed to promptly respond to and recover from any security event materially 
13.1 	affecting the confidentiality, integrity, or availability of customer information the financial 
13.2 	institution controls. An incident response plan must address:
13.3 	(1) the goals of the incident response plan;
13.4 	(2) the internal processes to respond to a security event;
13.5 	(3) clear roles, responsibilities, and levels of decision-making authority;
13.6 	(4) external and internal communications and information sharing;
13.7 	(5) requirements to remediate any identified weaknesses in information systems and 
13.8 	associated controls;
13.9 	(6) documentation and reporting regarding security events and related incident response 
13.10 	activities; and
13.11 	(7) evaluation and revision of the incident response plan as necessary after a security 
13.12 	event.
13.13 		Subd. 10.Annual report. (a) A financial institution must require the financial institution's 
13.14 	qualified individual to report at least annually in writing to the financial institution's board 
13.15 	of directors or equivalent governing body. If a board of directors or equivalent governing 
13.16 	body does not exist, the report under this subdivision must be presented in a timely manner 
13.17 	to a senior officer responsible for the financial institution's information security program.
13.18 	(b) The report made under this subdivision must include the following information:
13.19 	(1) the overall status of the financial institution's information security program, including 
13.20 	compliance with this chapter and associated administrative rules; and
13.21 	(2) material matters related to the financial institution's information security program, 
13.22 	including but not limited to addressing issues pertaining to: (i) the risk assessment; (ii) risk 
13.23 	management and control decisions; (iii) service provider arrangements; (iv) testing results; 
13.24 	(v) security events or violations and management's responses to the security event or 
13.25 	violation; and (vi) recommendations for changes in the information security program.
13.26 		Subd. 11.Business continuity; disaster recovery. A financial institution must establish 
13.27 	a written plan addressing business continuity and disaster recovery.

13.28 	Sec. 4. [46A.04] EXCEPTIONS AND EXEMPTIONS.
13.29 	(a) The requirements under section 46A.03, subdivisions 3; 5, paragraph (a); 9; and 10, 
13.30 	do not apply to financial institutions that maintain customer information concerning fewer 
13.31 	than 5,000 consumers.
14.1 	(b) This chapter does not apply to credit unions or federally insured depository 
14.2 	institutions.

14.3 	Sec. 5. [46A.05] ALTERATION OF FEDERAL REGULATION.
14.4 	(a) If an amendment to Code of Federal Regulations, title 16, part 314, results in a 
14.5 	complete lack of federal regulations in the area, the version of the state requirements in 
14.6 	effect at the time of the amendment remain in effect for two years from the date the 
14.7 	amendment becomes effective.
14.8 	(b) During the time period under paragraph (a), the department must adopt replacement 
14.9 	administrative rules as necessary and appropriate.

14.10 	Sec. 6. [46A.06] NOTIFICATION EVENT.
14.11 		Subdivision 1.Notification requirement. (a) Upon discovering a notification event as 
14.12 	described in subdivision 2, if the notification event involves the information of at least 500 
14.13 	consumers, a financial institution must notify the commissioner as soon as possible, but no 
14.14 	later than 30 days after the date the event is discovered. The notice must be made (1) in a 
14.15 	format specified by the commissioner, and (2) electronically on a form located on the 
14.16 	department's website.
14.17 	(b) The notice must include:
14.18 	(1) the name and contact information of the reporting financial institution;
14.19 	(2) a description of the types of information involved in the notification event;
14.20 	(3) if possible to determine, the date or date range of the notification event;
14.21 	(4) the number of consumers affected or potentially affected by the notification event;
14.22 	(5) a general description of the notification event; and
14.23 	(6) a statement (i) disclosing whether a law enforcement official has provided the financial 
14.24 	institution with a written determination indicating that providing notice to the public regarding 
14.25 	the breach would impede a criminal investigation or cause damage to national security, and 
14.26 	(ii) if a written determination described under item (i) was provided to the financial 
14.27 	institution, providing contact information that enables the commissioner to contact the law 
14.28 	enforcement official. A law enforcement official may request an initial delay of up to 30 
14.29 	days following the date that notice was provided to the commissioner. The delay may be 
14.30 	extended for an additional period of up to 60 days if the law enforcement official seeks an 
14.31 	extension in writing. An additional delay may be permitted only if the commissioner 
15.1 	determines that public disclosure of a security event continues to impede a criminal 
15.2 	investigation or cause damage to national security.
15.3 		Subd. 2.Notification event treated as discovered. A notification event must be treated 
15.4 	as discovered on the first day when the event is known to a financial institution. A financial 
15.5 	institution is deemed to have knowledge of a notification event if the event is known to any 
15.6 	person, other than the person committing the breach, who is the financial institution's 
15.7 	employee, officer, or other agent.

15.8 	Sec. 7. [46A.07] COMMISSIONER'S POWERS.
15.9 	(a) The commissioner has the power to examine and investigate the affairs of any covered 
15.10 	financial institution to determine whether the financial institution has been or is engaged in 
15.11 	any conduct that violates this chapter. This power is in addition to the powers granted to 
15.12 	the commissioner under section 46.01.
15.13 	(b) If the commissioner has reason to believe that a financial institution has been or is 
15.14 	engaged in conduct in Minnesota that violates this chapter, the commissioner may take 
15.15 	action necessary or appropriate to enforce this chapter.

15.16 	Sec. 8. Minnesota Statutes 2022, section 47.20, subdivision 2, is amended to read:
15.17 		Subd. 2.Definitions. For the purposes of this section the terms defined in this subdivision 
15.18 	have the meanings given them:
15.19 	(1) "Actual closing costs" mean reasonable charges for or sums paid for the following, 
15.20 	whether or not retained by the mortgagee or lender:
15.21 	(a) Any insurance premiums including but not limited to premiums for title insurance, 
15.22 	fire and extended coverage insurance, flood insurance, and private mortgage insurance, but 
15.23 	excluding any charges or sums retained by the mortgagee or lender as self-insured retention.
15.24 	(b) Abstracting, title examination and search, and examination of public records.
15.25 	(c) The preparation and recording of any or all documents required by law or custom 
15.26 	for closing a conventional or cooperative apartment loan.
15.27 	(d) Appraisal and survey of real property securing a conventional loan or real property 
15.28 	owned by a cooperative apartment corporation of which a share or shares of stock or a 
15.29 	membership certificate or certificates are to secure a cooperative apartment loan.
15.30 	(e) A single service charge, which includes any consideration, not otherwise specified 
15.31 	herein as an "actual closing cost" paid by the borrower and received and retained by the 
16.1 	lender for or related to the acquisition, making, refinancing or modification of a conventional 
16.2 	or cooperative apartment loan, and also includes any consideration received by the lender 
16.3 	for making a borrower's interest rate commitment or for making a borrower's loan 
16.4 	commitment, whether or not an actual loan follows the commitment. The term service charge 
16.5 	does not include forward commitment fees. The service charge shall not exceed one percent 
16.6 	of the original bona fide principal amount of the conventional or cooperative apartment 
16.7 	loan, except that in the case of a construction loan, the service charge shall not exceed two 
16.8 	percent of the original bona fide principal amount of the loan. That portion of the service 
16.9 	charge imposed because the loan is a construction loan shall be itemized and a copy of the 
16.10 	itemization furnished the borrower. A lender shall not collect from a borrower the additional 
16.11 	one percent service charge permitted for a construction loan if it does not perform the service 
16.12 	for which the charge is imposed or if third parties perform and charge the borrower for the 
16.13 	service for which the lender has imposed the charge.
16.14 	(f) Charges and fees necessary for or related to the transfer of real or personal property 
16.15 	securing a conventional or cooperative apartment loan or the closing of a conventional or 
16.16 	cooperative apartment loan paid by the borrower and received by any party other than the 
16.17 	lender.
16.18 	(2) "Contract for deed" means an executory contract for the conveyance of real estate, 
16.19 	the original principal amount of which is less than $300,000. A commitment for a contract 
16.20 	for deed shall include an executed purchase agreement or earnest money contract wherein 
16.21 	the seller agrees to finance any part or all of the purchase price by a contract for deed.
16.22 	(3) "Conventional loan" means a loan or advance of credit, other than a loan or advance 
16.23 	of credit made by a credit union or made pursuant to section 334.011, to a noncorporate 
16.24 	borrower in an original principal amount of less than $100,000 or equal to the conforming 
16.25 	loan limit established by the Federal Housing Finance Agency under the Housing and 
16.26 	Recovery Act of 2018, Public Law 110-289, secured by a mortgage upon real property 
16.27 	containing one or more residential units or upon which at the time the loan is made it is 
16.28 	intended that one or more residential units are to be constructed, and which is not insured 
16.29 	or guaranteed by the secretary of housing and urban development, by the administrator of 
16.30 	veterans affairs, or by the administrator of the Farmers Home Administration, and which 
16.31 	is not made pursuant to the authority granted in subdivision 1, clause (3) or (4). The term 
16.32 	mortgage does not include contracts for deed or installment land contracts.
16.33 	(4) "Cooperative apartment loan" means a loan or advance of credit, other than a loan 
16.34 	or advance of credit made by a credit union or made pursuant to section 334.011, to a 
16.35 	noncorporate borrower in an original principal amount of less than $100,000, secured by a 
17.1 	security interest on a share or shares of stock or a membership certificate or certificates 
17.2 	issued to a stockholder or member by a cooperative apartment corporation, which may be 
17.3 	accompanied by an assignment by way of security of the borrower's interest in the proprietary 
17.4 	lease or occupancy agreement in property issued by the cooperative apartment corporation 
17.5 	and which is not insured or guaranteed by the secretary of housing and urban development, 
17.6 	by the administrator of veterans affairs, or by the administrator of the Farmers Home 
17.7 	Administration.
17.8 	(5) "Cooperative apartment corporation" means a corporation or cooperative organized 
17.9 	under chapter 308A or 317A, the shareholders or members of which are entitled, solely by 
17.10 	reason of their ownership of stock or membership certificates in the corporation or 
17.11 	association, to occupy one or more residential units in a building owned or leased by the 
17.12 	corporation or association.
17.13 	(6) "Forward commitment fee" means a fee or other consideration paid to a lender for 
17.14 	the purpose of securing a binding forward commitment by or through the lender to make 
17.15 	conventional loans to two or more credit worthy purchasers, including future purchasers, 
17.16 	of residential units, or a fee or other consideration paid to a lender for the purpose of securing 
17.17 	a binding forward commitment by or through the lender to make conventional loans to two 
17.18 	or more credit worthy purchasers, including future purchasers, of units to be created out of 
17.19 	existing structures pursuant to chapter 515B, or a fee or other consideration paid to a lender 
17.20 	for the purpose of securing a binding forward commitment by or through the lender to make 
17.21 	cooperative apartment loans to two or more credit worthy purchasers, including future 
17.22 	purchasers, of a share or shares of stock or a membership certificate or certificates in a 
17.23 	cooperative apartment corporation; provided, that the forward commitment rate of interest 
17.24 	does not exceed the maximum lawful rate of interest effective as of the date the forward 
17.25 	commitment is issued by the lender.
17.26 	(7) "Borrower's interest rate commitment" means a binding commitment made by a 
17.27 	lender to a borrower wherein the lender agrees that, if a conventional or cooperative 
17.28 	apartment loan is made following issuance of and pursuant to the commitment, the 
17.29 	conventional or cooperative apartment loan shall be made at a rate of interest not in excess 
17.30 	of the rate of interest agreed to in the commitment, provided that the rate of interest agreed 
17.31 	to in the commitment is not in excess of the maximum lawful rate of interest effective as 
17.32 	of the date the commitment is issued by the lender to the borrower.
17.33 	(8) "Borrower's loan commitment" means a binding commitment made by a lender to a 
17.34 	borrower wherein the lender agrees to make a conventional or cooperative apartment loan 
17.35 	pursuant to the provisions, including the interest rate, of the commitment, provided that the 
18.1 	commitment rate of interest does not exceed the maximum lawful rate of interest effective 
18.2 	as of the date the commitment is issued and the commitment when issued and agreed to 
18.3 	shall constitute a legally binding obligation on the part of the mortgagee or lender to make 
18.4 	a conventional or cooperative apartment loan within a specified time period in the future at 
18.5 	a rate of interest not exceeding the maximum lawful rate of interest effective as of the date 
18.6 	the commitment is issued by the lender to the borrower; provided that a lender who issues 
18.7 	a borrower's loan commitment pursuant to the provisions of a forward commitment is 
18.8 	authorized to issue the borrower's loan commitment at a rate of interest not to exceed the 
18.9 	maximum lawful rate of interest effective as of the date the forward commitment is issued 
18.10 	by the lender.
18.11 	(9) "Finance charge" means the total cost of a conventional or cooperative apartment 
18.12 	loan including extensions or grant of credit regardless of the characterization of the same 
18.13 	and includes interest, finders fees, and other charges levied by a lender directly or indirectly 
18.14 	against the person obtaining the conventional or cooperative apartment loan or against a 
18.15 	seller of real property securing a conventional loan or a seller of a share or shares of stock 
18.16 	or a membership certificate or certificates in a cooperative apartment corporation securing 
18.17 	a cooperative apartment loan, or any other party to the transaction except any actual closing 
18.18 	costs and any forward commitment fee. The finance charges plus the actual closing costs 
18.19 	and any forward commitment fee, charged by a lender shall include all charges made by a 
18.20 	lender other than the principal of the conventional or cooperative apartment loan. The finance 
18.21 	charge, with respect to wraparound mortgages, shall be computed based upon the face 
18.22 	amount of the wraparound mortgage note, which face amount shall consist of the aggregate 
18.23 	of those funds actually advanced by the wraparound lender and the total outstanding principal 
18.24 	balances of the prior note or notes which have been made a part of the wraparound mortgage 
18.25 	note.
18.26 	(10) "Lender" means any person making a conventional or cooperative apartment loan, 
18.27 	or any person arranging financing for a conventional or cooperative apartment loan. The 
18.28 	term also includes the holder or assignee at any time of a conventional or cooperative 
18.29 	apartment loan.
18.30 	(11) "Loan yield" means the annual rate of return obtained by a lender over the term of 
18.31 	a conventional or cooperative apartment loan and shall be computed as the annual percentage 
18.32 	rate as computed in accordance with sections 226.5 (b), (c), and (d) of Regulation Z, Code 
18.33 	of Federal Regulations, title 12, part 226, but using the definition of finance charge provided 
18.34 	for in this subdivision. For purposes of this section, with respect to wraparound mortgages, 
18.35 	the rate of interest or loan yield shall be based upon the principal balance set forth in the 
19.1 	wraparound note and mortgage and shall not include any interest differential or yield 
19.2 	differential between the stated interest rate on the wraparound mortgage and the stated 
19.3 	interest rate on the one or more prior mortgages included in the stated loan amount on a 
19.4 	wraparound note and mortgage.
19.5 	(12) "Person" means an individual, corporation, business trust, partnership or association 
19.6 	or any other legal entity.
19.7 	(13) "Residential unit" means any structure used principally for residential purposes or 
19.8 	any portion thereof, and includes a unit in a common interest community, a nonowner 
19.9 	occupied residence, and any other type of residence regardless of whether the unit is used 
19.10 	as a principal residence, secondary residence, vacation residence, or residence of some other 
19.11 	denomination.
19.12 	(14) "Vendor" means any person or persons who agree to sell real estate and finance 
19.13 	any part or all of the purchase price by a contract for deed. The term also includes the holder 
19.14 	or assignee at any time of the vendor's interest in a contract for deed.

19.15 	Sec. 9. Minnesota Statutes 2022, section 47.54, subdivision 2, is amended to read:
19.16 		Subd. 2.Approval order. (a) If no objection is received by the commissioner within 
19.17 	15 days after the publication of the notice, the commissioner shall issue an order must 
19.18 	provide written consent approving the application without a hearing if it is found the 
19.19 	commissioner finds that (a): (1) the applicant bank meets current industry standards of 
19.20 	capital adequacy, management quality, and asset condition, (b); (2) the establishment of the 
19.21 	proposed detached facility will improve improves the quality or increase the availability of 
19.22 	banking services in the community to be served,; and (c) (3) the establishment of the proposed 
19.23 	detached facility will does not have an undue adverse effect upon the solvency of existing 
19.24 	financial institutions in the community to be served.
19.25 	Otherwise, (b) The commissioner shall must deny the an application that does not meet 
19.26 	the criteria under paragraph (a), clauses (1) to (3).
19.27 	(c) Any proceedings for judicial review of an order of written consent provided by the 
19.28 	commissioner issued under this subdivision without a contested case hearing shall be 
19.29 	conducted pursuant to the provisions of the Administrative Procedure Act relating to judicial 
19.30 	review of agency decisions, sections 14.63 to 14.69, and the scope of judicial review in 
19.31 	such proceedings shall be as provided therein. Nothing herein shall be construed as requiring 
19.32 	the commissioner to conduct a contested case hearing if no written objection is timely 
20.1 	received by the commissioner from a bank within three miles of the proposed location of 
20.2 	the detached facility.

20.3 	Sec. 10. Minnesota Statutes 2022, section 47.54, subdivision 6, is amended to read:
20.4 		Subd. 6.Expiration and extension of order approval. If a facility is not activated 
20.5 	within 18 months from the date of the order approval is granted under subdivision 2, the 
20.6 	approval order automatically expires. Upon a request of made by the applicant prior to
20.7 	before the automatic expiration date of the order approval expires, the commissioner may 
20.8 	grant reasonable extensions of time to the applicant to activate the facility as the 
20.9 	commissioner deems necessary. The extensions of time shall not exceed a total of an 
20.10 	additional 12 months. If the commissioner's order approval is the subject of an appeal in 
20.11 	accordance with chapter 14, the time period referred to in this section for activation of to 
20.12 	activate the facility and any extensions shall begin begins when all appeals or rights of 
20.13 	appeal from the commissioner's order approval have concluded or expired.

20.14 	Sec. 11. Minnesota Statutes 2022, section 48.24, subdivision 2, is amended to read:
20.15 		Subd. 2.Loan liabilities. Loans not exceeding 25 percent of such capital and surplus 
20.16 	made upon first mortgage security on improved real estate in any state in which the bank 
20.17 	or a branch established under section 49.411 detached facility of the bank is located, or in 
20.18 	any state adjoining a state in which the bank or a branch established under section 49.411
20.19 	detached facility of the bank is located, shall not constitute a liability of the maker of the 
20.20 	notes secured by such mortgages within the meaning of the foregoing provision limiting 
20.21 	liability, but shall be an actual liability of the maker. These mortgage loans shall be limited 
20.22 	to, and in no case exceed, 50 percent of the cash value of the security covered by the 
20.23 	mortgage, except mortgage loans guaranteed as provided by the Servicemen's Readjustment 
20.24 	Act of 1944, as now or hereafter amended, or for which there is a commitment to so guarantee 
20.25 	or for which a conditional guarantee has been issued, which loans shall in no case exceed 
20.26 	60 percent of the cash value of the security covered by such mortgage. For the purposes of 
20.27 	this subdivision, real estate is improved when substantial and permanent development or 
20.28 	construction has contributed substantially to its value, and agricultural land is improved 
20.29 	when farm crops are regularly raised on such land without further substantial improvements.

21.1 	Sec. 12. Minnesota Statutes 2022, section 58.02, is amended by adding a subdivision to 
21.2 	read:
21.3 		Subd. 15a.Nationwide Multistate Licensing System and Registry. "Nationwide 
21.4 	Multistate Licensing System and Registry" has the meaning given in section 58A.02, 
21.5 	subdivision 8.

21.6 	Sec. 13. Minnesota Statutes 2022, section 58.02, subdivision 18, is amended to read:
21.7 		Subd. 18.Residential mortgage loan. "Residential mortgage loan" means a loan secured 
21.8 	primarily by either: (1) a mortgage, deed of trust, or other equivalent security interest on 
21.9 	residential real property estate; or (2) certificates of stock or other evidence of ownership 
21.10 	interest in and proprietary lease from corporations, partnerships, or other forms of business 
21.11 	organizations formed for the purpose of cooperative ownership of residential real property
21.12 	estate.

21.13 	Sec. 14. Minnesota Statutes 2022, section 58.02, subdivision 21, is amended to read:
21.14 		Subd. 21.Residential real estate. "Residential real estate" means real property located 
21.15 	in Minnesota upon which a dwelling, as defined in United States Code, title 15, section 
21.16 	1602(w), is constructed or is intended to be constructed, whether or not the owner occupies 
21.17 	the real property.

21.18 	Sec. 15. Minnesota Statutes 2022, section 58.04, subdivision 1, is amended to read:
21.19 		Subdivision 1.Residential mortgage originator licensing requirements. (a) No person 
21.20 	shall act as a residential mortgage originator, or make residential mortgage loans without 
21.21 	first obtaining a license from the commissioner according to the licensing procedures 
21.22 	provided in this chapter.
21.23 	(b) A licensee must be either a partnership, limited liability partnership, association, 
21.24 	limited liability company, corporation, or other form of business organization, and must 
21.25 	have and maintain a surety bond in the amounts prescribed under section 58.08.
21.26 	(c) The following persons are exempt from the residential mortgage originator licensing 
21.27 	requirements:
21.28 	(1) a person who is not in the business of making residential mortgage loans and who 
21.29 	makes no more than three such loans, with its own funds, during any 12-month period;
21.30 	(2) a financial institution as defined in section 58.02, subdivision 10;
21.31 	(3) an agency of the federal government, or of a state or municipal government;
22.1 	(4) an employee or employer pension plan making loans only to its participants;
22.2 	(5) a person acting in a fiduciary capacity, such as a trustee or receiver, as a result of a 
22.3 	specific order issued by a court of competent jurisdiction;
22.4 	(6) a person who is a bona fide nonprofit organization that meets all the criteria required 
22.5 	by the federal Secure and Fair Enforcement Licensing Act in Regulation H, adopted pursuant 
22.6 	to Code of Federal Regulations, title 12, part 1008, subpart B, section 1008.103 (e)(7)(ii);
22.7 	(6) (7) a person exempted by order of the commissioner; or
22.8 	(7) (8) a manufactured home dealer, as defined in section 327B.01, subdivision 7 or 11b, 
22.9 	or a manufactured home salesperson, as defined in section 327B.01, subdivision 19, that:
22.10 	(i) performs only clerical or support duties in connection with assisting a consumer in 
22.11 	filling out a residential mortgage loan application but does not in any way offer or negotiate 
22.12 	loan terms, or hold themselves out as a housing counselor;
22.13 	(ii) does not receive any direct or indirect compensation or gain from any individual or 
22.14 	company for assisting consumers with a residential mortgage loan application, in excess of 
22.15 	the customary salary or commission from the employer in connection with the sales 
22.16 	transaction; and
22.17 	(iii) discloses to the borrower in writing:
22.18 	(A) if a corporate affiliation with a lender exists;
22.19 	(B) if a corporate affiliation with a lender exists, that the lender cannot guarantee the 
22.20 	lowest or best terms available and the consumer has the right to choose their lender; and
22.21 	(C) if a corporate affiliation with a lender exists, the name of at least one unaffiliated 
22.22 	lender.
22.23 	(d) For the purposes of this subdivision, "housing counselor" means an individual who 
22.24 	provides assistance and guidance about residential mortgage loan terms including rates, 
22.25 	fees, or other costs.
22.26 	(e) The disclosures required under paragraph (c), clause (7) (8), item (iii), must be made 
22.27 	on a one-page form prescribed by the commissioner and developed in consultation with the 
22.28 	Manufactured and Modular Home Association. The form must be posted on the department's 
22.29 	website.

23.1 	Sec. 16. Minnesota Statutes 2022, section 58.04, subdivision 2, is amended to read:
23.2 		Subd. 2.Residential mortgage servicer licensing requirements. (a) Beginning August 
23.3 	1, 1999, no person shall engage in activities or practices that fall within the definition of 
23.4 	"servicing a residential mortgage loan" under section 58.02, subdivision 22, without first 
23.5 	obtaining a license from the commissioner according to the licensing procedures provided 
23.6 	in this chapter.
23.7 	(b) The following persons are exempt from the residential mortgage servicer licensing 
23.8 	requirements:
23.9 	(1) a person licensed as a residential mortgage originator;
23.10 	(2) an employee of one licensee or one person holding a certificate of exemption based 
23.11 	on an exemption under this subdivision;
23.12 	(3) a person servicing loans made with its own funds, if no more than three such loans 
23.13 	are made in any 12-month period;
23.14 	(4) a financial institution as defined in section 58.02, subdivision 10;
23.15 	(5) an agency of the federal government, or of a state or municipal government;
23.16 	(6) an employee or employer pension plan making loans only to its participants;
23.17 	(7) a person acting in a fiduciary capacity, such as a trustee or receiver, as a result of a 
23.18 	specific order issued by a court of competent jurisdiction; or
23.19 	(8) a person who is a bona fide nonprofit organization that meets all the criteria required 
23.20 	by the federal Secure and Fair Enforcement Licensing Act in Regulation H, Code of Federal 
23.21 	Regulations, title 12, part 1008, subpart B, section 1008.103 (e)(7)(ii); or
23.22 	(8) (9) a person exempted by order of the commissioner.

23.23 	Sec. 17. Minnesota Statutes 2022, section 58.05, subdivision 1, is amended to read:
23.24 		Subdivision 1.Exempt person. (a) An exempt person, as defined by section 58.04, 
23.25 	subdivision 1, paragraph (c), and subdivision 2, paragraph (b), is exempt from the licensing 
23.26 	requirements of this chapter, but is subject to all other provisions of this chapter.
23.27 	(b) Paragraph (a) does not apply to an institution covered under section 58.04, subdivision 
23.28 	4, even if the institution is otherwise an exempt person.

24.1 	Sec. 18. Minnesota Statutes 2022, section 58.05, subdivision 3, is amended to read:
24.2 		Subd. 3.Certificate of exemption. A person (a) The following persons must obtain a 
24.3 	certificate of exemption from the commissioner to qualify as an exempt person under section 
24.4 	58.04, subdivision 1, paragraph (c),: (1) a financial institution under section 58.04, 
24.5 	subdivision 1, paragraph (c), clause (2),; (2) a bona fide nonprofit organization under section 
24.6 	58.04, subdivision 1, paragraph (c), clause (6); or (3) a person exempted by order of the 
24.7 	commissioner under section 58.04, subdivision 1, paragraph (c), clause (6); or (7).
24.8 	(b) The following persons must obtain a certificate of exemption from the commissioner 
24.9 	to qualify as an exempt person under section 58.04, subdivision 2, paragraph (b), as: (1) a 
24.10 	financial institution under section 58.04, subdivision 2, paragraph (b), clause (4),; (2) a bona 
24.11 	fide nonprofit organization under section 58.04, subdivision 2, paragraph (b), clause (8); or
24.12 	(3) a person exempted by order of the commissioner under clause (8) (9).

24.13 	Sec. 19. Minnesota Statutes 2022, section 58.06, is amended by adding a subdivision to 
24.14 	read:
24.15 		Subd. 6.Requesting and distributing criminal information; agency. For the purposes 
24.16 	of this section and in order to reduce the points of contact the Federal Bureau of Investigation 
24.17 	may have to maintain for purposes of subdivision 5, clauses (1) and (2), the commissioner 
24.18 	may use the Nationwide Multistate Licensing System and Registry as a channeling agent 
24.19 	to request information from and distribute information to the United States Department of 
24.20 	Justice or any governmental agency.

24.21 	Sec. 20. Minnesota Statutes 2022, section 58.06, is amended by adding a subdivision to 
24.22 	read:
24.23 		Subd. 7.Requesting and distributing noncriminal information; agency. For the 
24.24 	purposes of this section and in order to reduce the points of contact the commissioner may 
24.25 	have to maintain for purposes of subdivision 5, clause (2), the commissioner may use the 
24.26 	Nationwide Multistate Licensing System and Registry as a channeling agent to request and 
24.27 	distribute information from and to any source, as directed by the commissioner.

24.28 	Sec. 21. Minnesota Statutes 2022, section 58.08, subdivision 1a, is amended to read:
24.29 		Subd. 1a.Residential mortgage originators. (a) An applicant for a residential mortgage 
24.30 	originator license must file with the department a surety bond in the amount of $100,000
24.31 	$125,000, issued by an insurance company authorized to do so in this state. The bond must 
24.32 	cover all mortgage loan originators who are employees or independent agents of the applicant. 
25.1 	The bond must be available for the recovery of expenses, fines, and fees levied by the 
25.2 	commissioner under this chapter and for losses incurred by borrowers as a result of a 
25.3 	licensee's noncompliance with the requirements of this chapter, sections 325D.43 to 325D.48, 
25.4 	and 325F.67 to 325F.69, or breach of contract relating to activities regulated by this chapter.
25.5 	(b) The bond must be submitted with the originator's license application and evidence 
25.6 	of continued coverage must be submitted with each renewal. Any change in the bond must 
25.7 	be submitted for approval by the commissioner, within ten days of its execution. The bond 
25.8 	or a substitute bond shall remain in effect during all periods of licensing.
25.9 	(c) Upon filing of the mortgage call report as required by section 58A.17 58.141, a 
25.10 	licensee shall maintain or increase its the licensee's surety bond to reflect the total dollar 
25.11 	amount of the closed residential mortgage loans originated in this state in the preceding 
25.12 	year according to the table in this paragraph. A licensee may decrease its the licensee's
25.13 	surety bond according to the table in this paragraph if the surety bond required is less than 
25.14 	the amount of the surety bond on file with the department.

25.15
25.16	Dollar Amount of Closed Residential 
Mortgage Loans
	Surety Bond Required
	
25.17	$0 to $5,000,000 $10,000,000
	$100,000 $125,000
	
25.18
25.19	$5,000,000.01 $10,000,000.01 to $10,000,000
$25,000,000
	$125,000 $150,000
	
25.20
25.21	$10,000,000.01 $25,000,000.01 to 
$25,000,000 $100,000,000
	$150,000 $200,000
	
25.22	Over $25,000,000 $100,000,000
	$200,000 $300,000
	
25.23 	For purposes of this subdivision, "mortgage loan originator" has the meaning given the 
25.24 	term in section 58A.02, subdivision 7.

25.25 	Sec. 22. Minnesota Statutes 2022, section 58.08, subdivision 2, is amended to read:
25.26 		Subd. 2.Residential mortgage servicers. (a) A residential mortgage servicer licensee 
25.27 	shall continuously maintain a surety bond or irrevocable letter of credit in an amount not 
25.28 	less than $100,000 $125,000 in a form approved by the commissioner, issued by an insurance 
25.29 	company or bank authorized to do so in this state. The bond or irrevocable letter of credit 
25.30 	must be available for the recovery of expenses, fines, and fees levied by the commissioner 
25.31 	under this chapter, and for losses or damages incurred by borrowers or other aggrieved 
25.32 	parties as the result of a licensee's noncompliance with the requirements of this chapter, 
25.33 	sections 325D.43 to 325D.48, and 325F.67 to 325F.69, or breach of contract relating to 
25.34 	activities regulated by this chapter.
26.1 	(b) The bond or irrevocable letter of credit must be submitted with the servicer's license 
26.2 	application and evidence of continued coverage must be submitted with each renewal. Any 
26.3 	change in the bond or letter of credit must be submitted for approval by the commissioner, 
26.4 	within ten days of its execution. The bond or a substitute bond must remain in effect during 
26.5 	all periods of a license.
26.6 	(c) Upon filing the mortgage call report under section 58.141, a licensee must maintain 
26.7 	or increase the licensee's surety bond to reflect the total dollar amount of unpaid principal 
26.8 	balance for residential mortgage loans serviced in Minnesota during the preceding quarter 
26.9 	according to the table in this paragraph. A licensee may decrease the licensee's surety bond 
26.10 	according to the table in this paragraph if the surety bond required is less than the amount 
26.11 	of the surety bond on file with the department.

26.12
26.13	Dollar Amount of Unpaid Principal Balance 
for Serviced Residential Mortgage Loans
	Surety Bond Required
	
26.14	$0 to $10,000,000
	$125,000
	
26.15	$10,000,000.01 to $50,000,000
	$200,000
	
26.16	Over $50,000,000
	$300,000

26.17 	Sec. 23. Minnesota Statutes 2022, section 58.10, subdivision 3, is amended to read:
26.18 		Subd. 3.Consumer education account; money credited and appropriated. (a) The 
26.19 	consumer education account is created in the special revenue fund. Money credited to this 
26.20 	account may be appropriated to the commissioner for the purpose of making to: (1) make
26.21 	grants to programs and campaigns designed to help consumers avoid being victimized by 
26.22 	unscrupulous lenders and mortgage brokers; and (2) pay for expenses the commissioner 
26.23 	incurs to provide outreach and education related to affordable housing and home ownership 
26.24 	education. The commissioner must give preference shall be given for grants to programs 
26.25 	and campaigns designed by coalitions of public sector, private sector, and nonprofit agencies, 
26.26 	institutions, companies, and organizations.
26.27 	(b) A sum sufficient is appropriated annually from the consumer education account to 
26.28 	the commissioner to make the grants described in paragraph (a).

26.29 	Sec. 24. Minnesota Statutes 2022, section 58.115, is amended to read:
26.30 	58.115 EXAMINATIONS.
26.31 	The commissioner has under this chapter the same powers with respect to examinations 
26.32 	that the commissioner has under section 46.04. In addition to the powers under section 
26.33 	46.04, the commissioner may accept examination reports prepared by a state agency that 
27.1 	has comparable supervisory powers and examination procedures. The authority under section 
27.2 	49.411, subdivision 7, applies to examinations of institutions under this chapter.

27.3 	Sec. 25. Minnesota Statutes 2022, section 58.13, subdivision 1, is amended to read:
27.4 		Subdivision 1.Generally. (a) No person acting as a residential mortgage originator or 
27.5 	servicer, including a person required to be licensed under this chapter, and no person exempt 
27.6 	from the licensing requirements of this chapter under section 58.04, except as otherwise 
27.7 	provided in paragraph (b), shall:
27.8 	(1) fail to maintain a trust account to hold trust funds received in connection with a 
27.9 	residential mortgage loan;
27.10 	(2) fail to deposit all trust funds into a trust account within three business days of receipt; 
27.11 	commingle trust funds with funds belonging to the licensee or exempt person; or use trust 
27.12 	account funds for any purpose other than that for which they are received;
27.13 	(3) unreasonably delay the processing of a residential mortgage loan application, or the 
27.14 	closing of a residential mortgage loan. For purposes of this clause, evidence of unreasonable 
27.15 	delay includes but is not limited to those factors identified in section 47.206, subdivision 
27.16 	7, paragraph (d);
27.17 	(4) fail to disburse funds according to its contractual or statutory obligations;
27.18 	(5) fail to perform in conformance with its written agreements with borrowers, investors, 
27.19 	other licensees, or exempt persons;
27.20 	(6) charge a fee for a product or service where the product or service is not actually 
27.21 	provided, or misrepresent the amount charged by or paid to a third party for a product or 
27.22 	service;
27.23 	(7) fail to comply with sections 345.31 to 345.60, the Minnesota unclaimed property 
27.24 	law;
27.25 	(8) violate any provision of any other applicable state or federal law regulating residential 
27.26 	mortgage loans including, without limitation, sections 47.20 to 47.208 and 47.58;
27.27 	(9) make or cause to be made, directly or indirectly, any false, deceptive, or misleading 
27.28 	statement or representation in connection with a residential loan transaction including, 
27.29 	without limitation, a false, deceptive, or misleading statement or representation regarding 
27.30 	the borrower's ability to qualify for any mortgage product;
27.31 	(10) conduct residential mortgage loan business under any name other than that under 
27.32 	which the license or certificate of exemption was issued;
28.1 	(11) compensate, whether directly or indirectly, coerce or intimidate an appraiser for 
28.2 	the purpose of influencing the independent judgment of the appraiser with respect to the 
28.3 	value of real estate that is to be covered by a residential mortgage or is being offered as 
28.4 	security according to an application for a residential mortgage loan;
28.5 	(12) issue any document indicating conditional qualification or conditional approval for 
28.6 	a residential mortgage loan, unless the document also clearly indicates that final qualification 
28.7 	or approval is not guaranteed, and may be subject to additional review;
28.8 	(13) make or assist in making any residential mortgage loan with the intent that the loan 
28.9 	will not be repaid and that the residential mortgage originator will obtain title to the property 
28.10 	through foreclosure;
28.11 	(14) provide or offer to provide for a borrower, any brokering or lending services under 
28.12 	an arrangement with a person other than a licensee or exempt person, provided that a person 
28.13 	may rely upon a written representation by the residential mortgage originator that it is in 
28.14 	compliance with the licensing requirements of this chapter;
28.15 	(15) claim to represent a licensee or exempt person, unless the person is an employee 
28.16 	of the licensee or exempt person or unless the person has entered into a written agency 
28.17 	agreement with the licensee or exempt person;
28.18 	(16) fail to comply with the record keeping and notification requirements identified in 
28.19 	section 58.14 or fail to abide by the affirmations made on the application for licensure;
28.20 	(17) represent that the licensee or exempt person is acting as the borrower's agent after 
28.21 	providing the nonagency disclosure required by section 58.15, unless the disclosure is 
28.22 	retracted and the licensee or exempt person complies with all of the requirements of section 
28.23 	58.16;
28.24 	(18) make, provide, or arrange for a residential mortgage loan that is of a lower investment 
28.25 	grade if the borrower's credit score or, if the originator does not utilize credit scoring or if 
28.26 	a credit score is unavailable, then comparable underwriting data, indicates that the borrower 
28.27 	may qualify for a residential mortgage loan, available from or through the originator, that 
28.28 	is of a higher investment grade, unless the borrower is informed that the borrower may 
28.29 	qualify for a higher investment grade loan with a lower interest rate and/or lower discount 
28.30 	points, and consents in writing to receipt of the lower investment grade loan;
28.31 	For purposes of this section, "investment grade" refers to a system of categorizing 
28.32 	residential mortgage loans in which the loans are distinguished by interest rate or discount 
28.33 	points or both charged to the borrower, which vary according to the degree of perceived 
29.1 	risk of default based on factors such as the borrower's credit, including credit score and 
29.2 	credit patterns, income and employment history, debt ratio, loan-to-value ratio, and prior 
29.3 	bankruptcy or foreclosure;
29.4 	(19) make, publish, disseminate, circulate, place before the public, or cause to be made, 
29.5 	directly or indirectly, any advertisement or marketing materials of any type, or any statement 
29.6 	or representation relating to the business of residential mortgage loans that is false, deceptive, 
29.7 	or misleading;
29.8 	(20) advertise loan types or terms that are not available from or through the licensee or 
29.9 	exempt person on the date advertised, or on the date specified in the advertisement. For 
29.10 	purposes of this clause, advertisement includes, but is not limited to, a list of sample mortgage 
29.11 	terms, including interest rates, discount points, and closing costs provided by licensees or 
29.12 	exempt persons to a print or electronic medium that presents the information to the public;
29.13 	(21) use or employ phrases, pictures, return addresses, geographic designations, or other 
29.14 	means that create the impression, directly or indirectly, that a licensee or other person is a 
29.15 	governmental agency, or is associated with, sponsored by, or in any manner connected to, 
29.16 	related to, or endorsed by a governmental agency, if that is not the case;
29.17 	(22) violate section 82.77, relating to table funding;
29.18 	(23) make, provide, or arrange for a residential mortgage loan all or a portion of the 
29.19 	proceeds of which are used to fully or partially pay off a "special mortgage" unless the 
29.20 	borrower has obtained a written certification from an authorized independent loan counselor 
29.21 	that the borrower has received counseling on the advisability of the loan transaction. For 
29.22 	purposes of this section, "special mortgage" means a residential mortgage loan originated, 
29.23 	subsidized, or guaranteed by or through a state, tribal, or local government, or nonprofit 
29.24 	organization, that bears one or more of the following nonstandard payment terms which 
29.25 	substantially benefit the borrower: (i) payments vary with income; (ii) payments of principal 
29.26 	or interest are not required or can be deferred under specified conditions; (iii) principal or 
29.27 	interest is forgivable under specified conditions; or (iv) where no interest or an annual 
29.28 	interest rate of two percent or less is charged in connection with the loan. For purposes of 
29.29 	this section, "authorized independent loan counselor" means a nonprofit, third-party 
29.30 	individual or organization providing home buyer education programs, foreclosure prevention 
29.31 	services, mortgage loan counseling, or credit counseling certified by the United States 
29.32 	Department of Housing and Urban Development, the Minnesota Home Ownership Center, 
29.33 	the Minnesota Mortgage Foreclosure Prevention Association, AARP, or NeighborWorks 
29.34 	America;
30.1 	(24) make, provide, or arrange for a residential mortgage loan without verifying the 
30.2 	borrower's reasonable ability to pay the scheduled payments of the following, as applicable: 
30.3 	principal; interest; real estate taxes; homeowner's insurance, assessments, and mortgage 
30.4 	insurance premiums. For loans in which the interest rate may vary, the reasonable ability 
30.5 	to pay shall be determined based on a fully indexed rate and a repayment schedule which 
30.6 	achieves full amortization over the life of the loan. For all residential mortgage loans, the 
30.7 	borrower's income and financial resources must be verified by tax returns, payroll receipts, 
30.8 	bank records, or other similarly reliable documents.
30.9 	Nothing in this section shall be construed to limit a mortgage originator's or exempt 
30.10 	person's ability to rely on criteria other than the borrower's income and financial resources 
30.11 	to establish the borrower's reasonable ability to repay the residential mortgage loan, including 
30.12 	criteria established by the United States Department of Veterans Affairs or the United States 
30.13 	Department of Housing and Urban Development for interest rate reduction refinancing loans 
30.14 	or streamline loans, or criteria authorized or promulgated by the Federal National Mortgage 
30.15 	Association or Federal Home Loan Mortgage Corporation; however, such other criteria 
30.16 	must be verified through reasonably reliable methods and documentation. The mortgage 
30.17 	originator's analysis of the borrower's reasonable ability to repay may include, but is not 
30.18 	limited to, consideration of the following items, if verified: (1) the borrower's current and 
30.19 	expected income; (2) current and expected cash flow; (3) net worth and other financial 
30.20 	resources other than the consumer's equity in the dwelling that secures the loan; (4) current 
30.21 	financial obligations; (5) property taxes and insurance; (6) assessments on the property; (7) 
30.22 	employment status; (8) credit history; (9) debt-to-income ratio; (10) credit scores; (11) tax 
30.23 	returns; (12) pension statements; and (13) employment payment records, provided that no 
30.24 	mortgage originator shall disregard facts and circumstances that indicate that the financial 
30.25 	or other information submitted by the consumer is inaccurate or incomplete. A statement 
30.26 	by the borrower to the residential mortgage originator or exempt person of the borrower's 
30.27 	income and resources or sole reliance on any single item listed above is not sufficient to 
30.28 	establish the existence of the income or resources when verifying the reasonable ability to 
30.29 	pay;
30.30 	(25) engage in "churning." As used in this section, "churning" means knowingly or 
30.31 	intentionally making, providing, or arranging for a residential mortgage loan when the new 
30.32 	residential mortgage loan does not provide a reasonable, tangible net benefit to the borrower 
30.33 	considering all of the circumstances, including the terms of both the new and refinanced 
30.34 	loans, the cost of the new loan, and the borrower's circumstances;. In order to demonstrate 
30.35 	a reasonable, tangible net benefit to the borrower, the circumstances must be documented 
31.1 	in writing and must be signed by the borrower and lender three days before the closing date. 
31.2 	The written analysis must, with respect to the prior loan and the new loan, document the: 
31.3 	(i) origination date; (ii) loan amount; (iii) loan balance; (iv) loan term; (v) loan program; 
31.4 	(vi) type of loan; (vii) interest rate; (viii) monthly amount of principal and interest paid; (ix) 
31.5 	monthly amount of private mortgage insurance paid; (x) loan purpose; (xi) loan origination 
31.6 	cost; (xii) cash to borrower, if applicable; and (xiii) time to recoup the loan cost, if applicable, 
31.7 	expressed in months;
31.8 	(26) the first time a residential mortgage originator orally informs a borrower of the 
31.9 	anticipated or actual periodic payment amount for a first-lien residential mortgage loan 
31.10 	which does not include an amount for payment of property taxes and hazard insurance, the 
31.11 	residential mortgage originator must inform the borrower that an additional amount will be 
31.12 	due for taxes and insurance and, if known, disclose to the borrower the amount of the 
31.13 	anticipated or actual periodic payments for property taxes and hazard insurance. This same 
31.14 	oral disclosure must be made each time the residential mortgage originator orally informs 
31.15 	the borrower of a different anticipated or actual periodic payment amount change from the 
31.16 	amount previously disclosed. A residential mortgage originator need not make this disclosure 
31.17 	concerning a refinancing loan if the residential mortgage originator knows that the borrower's 
31.18 	existing loan that is anticipated to be refinanced does not have an escrow account; or
31.19 	(27) make, provide, or arrange for a residential mortgage loan, other than a reverse 
31.20 	mortgage pursuant to United States Code, title 15, chapter 41, if the borrower's compliance 
31.21 	with any repayment option offered pursuant to the terms of the loan will result in negative 
31.22 	amortization during any six-month period.
31.23 	(b) Paragraph (a), clauses (24) through (27), do not apply to a state or federally chartered 
31.24 	bank, savings bank, or credit union, an institution chartered by Congress under the Farm 
31.25 	Credit Act, or to a person making, providing, or arranging a residential mortgage loan 
31.26 	originated or purchased by a state agency or a tribal or local unit of government. This 
31.27 	paragraph supersedes any inconsistent provision of this chapter.

31.28 	Sec. 26. [58.141] REPORTS AND UNIQUE IDENTIFIER.
31.29 		Subdivision 1.Mortgage call reports. A residential mortgage originator or servicer 
31.30 	must submit reports of condition to the Nationwide Multistate Licensing System and Registry. 
31.31 	Reports submitted under this subdivision must be in the form and contain the information 
31.32 	required by the Nationwide Multistate Licensing System and Registry.
31.33 		Subd. 2.Report to Nationwide Multistate Licensing System and Registry. Subject 
31.34 	to section 58A.14, the commissioner must regularly report violations of this chapter, as well 
32.1 	as enforcement actions and other relevant information, to the Nationwide Multistate Licensing 
32.2 	System and Registry.
32.3 		Subd. 3.Unique identifier; display. The unique identifier of any person originating a 
32.4 	residential mortgage loan must be clearly displayed on all residential mortgage loan 
32.5 	application forms, solicitations, or advertisements, including business cards or websites, 
32.6 	and any other documents the commissioner establishes by rule or order.

32.7 	Sec. 27. RULEMAKING.
 32.8 	The commissioner of commerce must amend Minnesota Rules, part 2675.2170, to comply 
32.9 	with the changes made in this act. The commissioner of commerce may use the good cause 
32.10 	exemption under Minnesota Statutes, section 14.388, subdivision 1, clause (3), to amend 
32.11 	the rule under this section. Minnesota Statutes, section 14.386, does not apply, except as 
32.12 	provided under Minnesota Statutes, section 14.388.

32.13 	Sec. 28. REPEALER.
 32.14 	Minnesota Statutes 2022, section 58.08, subdivision 3, is repealed.

APPENDIX 

Repealed Minnesota Statutes: S4157-1 

58.08 BONDS; LETTERS OF CREDIT.Subd. 3.Exemption. 
Subdivision 2 does not apply to mortgage originators or mortgage servicers who are approved as seller/servicers by the Federal National Mortgage Association or the Federal Home Loan Mortgage Corporation.