Uniform Money Services Act

Ark. Code Ann. tit. 23, ch. 55

in effect

Ark. Code Ann. § 23-55-101 Short title.

This chapter may be cited as the Uniform Money Services Act.

Ark. Code Ann. § 23-55-102 Definitions.

In this chapter: (1) “Applicant” means a person that files an application for a license under this chapter. (2) “Authorized delegate” means a person a licensee designates to provide money services on behalf of the licensee. (3) “Bank” means an institution organized under federal or state law which: (A) accepts demand deposits or deposits that the depositor may use for payment to third parties and engages in the business of making commercial loans; or (B) engages in credit card operations and maintains only one office that accepts deposits, does not accept demand deposits or deposits that the depositor may use for payments to third parties, does not accept a savings or time deposit less than $100,000, and does not engage in the business of making commercial loans. (4) “Commissioner” means the Securities Commissioner. (5)(A) “Control” means: (i) the power to vote, directly or indirectly, at least 25 percent of a class of voting securities or voting interests of a licensee or person in control of a licensee; (ii) power to elect or appoint a majority of key individuals or executive officers, managers, directors, trustees, or other persons exercising managerial authority of a licensee or person in control of a licensee; or (iii) the power to exercise directly or indirectly, a controlling influence over the management or policies of a licensee or person in control of a licensee. (B)(i) A person: (a) is presumed to exercise a controlling influence if the person holds the power to vote, directly or indirectly, at least 10 percent of the outstanding voting shares or voting interests of a licensee or person in control of a licensee; and (b) that is presumed to exercise a controlling influence may rebut the presumption of control if the person is a passive investor. (ii) For purposes of determining the percentage of a person controlled by any other person, the person's interest shall be aggregated with the interest of any other immediate family member, including without limitation the person's spouse, parents, children, siblings, mothers- in law, fathers-in law, sons-in law, daughters-in law, brothers-in law, sisters-in law, and any other person who shares the person's home. (6) “Currency exchange” means receipt of revenues from the exchange of money of one government for money of another government. (7) “Executive officer” means a president, chairperson of the executive committee, chief financial officer, responsible individual, or other individual who performs similar functions. (8) "Key individual" means an individual who is ultimately responsible for establishing or directing policies and procedures of a licensee, including without limitation an executive officer, manager, director, or trustee. (9) “Licensee” means a person licensed under this chapter. (10) “Monetary value” means a medium of exchange, whether or not redeemable in money. (11) “Money” means a medium of exchange that is authorized or adopted by the United States or a foreign government. The term includes a monetary unit of account established by an intergovernmental organization or by agreement between two or more governments. (12) “Money services” means money transmission or currency exchange. (13)(A) “Money transmission” means any of the following: (i) selling or issuing payment instruments to a person located in this state; (ii) selling or issuing stored value to a person located in this state; (iii) facilitating, selling, trading, transferring, or converting virtual currency or monetary value in this state; or (iv) receiving money for transmission from a person located in this state. (B) "Money transmission" does not include: (i) providing: (a) online services; (b) telecommunication services; (c) network access; (d) delivery services such as courier or package delivery services; or (ii) acting as a mere conduit for the transmission of data. (14) “Outstanding,” with respect to a payment instrument, means issued or sold by or for the licensee and reported as sold but not yet paid by or for the licensee. (15) "Passive investor" means a person that: (A) does not have the power to elect: (i) a majority of key individuals; (ii) a majority of executive officers, managers, directors, or trustees; or (iii) other persons exercising managerial authority of a person in control of a licensee; (B) is not employed by and does not have any managerial duties of the licensee or person in control of a licensee; (C) does not have the power to exercise, directly or indirectly, a controlling influence over the management or policies of a licensee or person in control of a licensee; and (D) either: (i) attests to subdivisions (15)(A)-(C), in a form and in a medium prescribed by the commissioner; or (ii) commits to the passivity characteristics of subdivisions (15)(A)-(C), in a written document. (16) “Payment instrument” means a written or electronic check, draft, money order, traveler's check, or other written or electronic instrument for the transmission or payment of money or monetary value, whether or not negotiable. The term does not include stored value or any instrument that: (A) is redeemable by the issuer only for goods or services provided by the issuer or its affiliate or franchisees of the issuer or its affiliate, except to the extent required by applicable law to be redeemable in cash for its cash value; or (B) not sold to the public but issued and distributed as part of a loyalty, rewards, or promotional program. (17) "Person" means an individual, corporation, business trust, estate, trust, partnership, limited liability company, association, joint venture, government; governmental subdivision, agency or instrumentality; public corporation; or any other legal or commercial entity. (18) "Record” means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form. (19) “State” means a State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the United States Virgin Islands, or any territory or insular possession subject to the jurisdiction of the United States. (20)(A) “Stored value” means monetary value representing a claim against the issuer evidenced by an electronic or digital record, and that is intended and accepted for use as a means of redemption for money or monetary value, or payment for goods or services. (B) "Stored value" includes without limitation prepaid access as defined by 31 C.F.R. § 1010.100, as it existed on January 1, 2023. (C) “Stored value” does not include a payment instrument or closed loop stored value or stored value not sold to the public but issued and distributed as part of a loyalty, rewards, or promotional program. (21) "Tangible net worth" means the aggregate assets of a licensee excluding all intangible assets, less liabilities, as determined according to generally accepted accounting principles. (22) “Unsafe or unsound practice” means a practice or conduct by a person licensed to engage in money transmission or an authorized delegate of such a person which creates the likelihood of material loss, insolvency, or dissipation of the licensee's assets, or otherwise materially prejudices the interests of its customers. (23)(A) “Virtual currency” means a digital representation of value that: (i) is used as a medium of exchange, a unit of account, or a store of value; and (ii) does not have legal tender status as recognized by the United States Department of the Treasury. (B) “Virtual currency” does not include the software or protocols governing the transfer of a digital representation of value or other uses of a virtual distributed ledger system to verify ownership or authenticity in a digital capacity when the virtual currency is not used as a medium of exchange. (24) "Elder adult" means a person who is sixty years of age or older. (25) "Existing customer" means a consumer who: (A) is engaging in a transaction at a virtual currency kiosk in the state; and (B) has been registered for more than seventy-two hours as a customer of the: (i) owner of the virtual currency kiosk; or (ii) virtual currency kiosk operator. (26)(A) "Money transmission kiosk" or “virtual currency kiosk” means an automated, unstaffed electronic machine that allows users to engage in money transmission, including any machine that is capable of accepting or dispensing cash in exchange for virtual currency. (B) "Money transmission kiosk" or "virtual currency kiosk" does not include consumer cellular telephones and other similar personal devices. (27) "New customer" means a consumer who: (A) is engaging in a transaction at a virtual currency kiosk in this state; and (B) has been registered for less than seventy-two hours as a customer of the: (i) owner of the virtual currency kiosk; or (ii) virtual currency kiosk operator. (28) "Unique identifier" means a number or other identifier that is assigned by a protocol established by the automated licensing system approved by the commissioner. (29) "Virtual currency kiosk operator" means a person that engages in virtual currency business activity through a money transmission kiosk located in this state or a person that owns, operates, or manages a money transmission kiosk located in this state through which virtual currency business activity is offered. (30) "Virtual currency storage" means: (A) maintaining possession, custody, or control over virtual currency on behalf of another person, including as a virtual currency control-services vendor; (B) issuing, transferring, or otherwise granting or providing to any person in this State any claim or right or any physical, digital, or electronic instrument, receipt, certificate, or record representing any claim or right to receive, redeem, withdraw, transfer, exchange, or control any virtual currency or amount of virtual currency; or (C) receiving possession, custody, or control over virtual currency from a person in this State in return for a promise or obligation to return, repay, exchange, or transfer such virtual currency or a like amount of such virtual currency. (31) "Virtual currency wallet" means a software application or other mechanism providing a means for holding, storing, and transferring virtual currency.

Ark. Code Ann. § 23-55-103 Exclusions.

This chapter does not apply to: (1) the United States or a department, agency, or instrumentality thereof; (2) money transmission by the United States Postal Service or by a contractor on behalf of the United States Postal Service; (3) a state, county, city, or any other governmental agency or governmental subdivision of a State; (4) a bank, bank holding company, office of an international banking corporation, branch of a foreign bank, corporation organized pursuant to the Bank Service Company Act, 12 U.S.C. §§ 1861-1867 (Supp. V 1999), or corporation organized under the Edge Act, 12 U.S.C. §§ 611-633 (1994 & Supp. V 1999) under the laws of a State or the United States if it does not issue, sell, or provide payment instruments, stored value, prepaid access, or virtual currency through an authorized delegate that is not such a person; (5) electronic funds transfer of governmental benefits for a federal, state, county, or governmental agency by a contractor on behalf of the United States or a department, agency, or instrumentality thereof, or a State or governmental subdivision, agency, or instrumentality thereof; (6) a board of trade designated as a contract market under the federal Commodity Exchange Act, 7 U.S.C. §§ 1-25 (1994), or a person that, in the ordinary course of business, provides clearance and settlement services for a board of trade to the extent of its operation as or for such a board; (7) a registered futures commission merchant under the federal commodities laws to the extent of its operation as such a merchant; (8) a person that provides clearance or settlement services pursuant to a registration as a clearing agency or an exemption from such registration granted under the federal securities laws to the extent of its operation as such a provider; (9) an operator of a payment system to the extent that it provides processing, clearing, or settlement services, between or among persons excluded by this section, in connection with wire transfers, credit card transactions, debit card transactions, stored-value transactions, automated clearing house transfers, similar funds transfers, prepaid access, or virtual currency; (10) a person registered as a securities broker-dealer under federal or state securities laws to the extent of its operation as such a broker-dealer; or (11) a credit union regulated and insured by the National Credit Union Administration. (12) an agent appointed by a payee to collect and process payment as the agent of the payee, if the agent can demonstrate that: (A) there exists a written agreement between the payee and the agent directing the agent to collect and process payments on behalf of the payee; (B) the payee holds the agent out to the public as accepting payments on behalf of the payee; and (C) payment is treated as received by the payee upon receipt by the agent so that there is no risk of loss to the individual initiating the transaction if the agent fails to remit the funds to the payee; (13) virtual currency or other digital representation of value redeemable exclusively for goods or services and limited to transactions involving a defined merchant, including without limitation a rewards program; (14) a digital representation of value issued by or on behalf of a publisher and used solely within an online game, game platform, or family of games sold by the same publisher or offered on the same game platform; or (15) uses of a virtual distributed ledger system to verify ownership or authenticity in a digital capacity when the virtual currency is not used as a medium of exchange. (16) the exchange, transfer, or storage of virtual currency or to virtual currency administration if any of the following apply to the transaction: (A) the Electronic Fund Transfer Act, 15 U.S.C. § 1693 et seq., as it existed on January 1, 2023; (B) the Securities Exchange Act of 1934, 15 U.S.C. §§ 78a et seq., as it existed on January 1, 2023; (C) the Commodity Exchange Act, 7 U.S.C. §§ 1 et seq., as it existed on January 1, 2023; or (D) the Arkansas Securities Act, § 23-42-101—101 et seq.

Ark. Code Ann. § 23-55-104 Administration and rules.

(a) The Securities Commissioner shall administer this chapter. (b) The commissioner may: (1) Make, amend, and rescind any rules, forms, and orders that the commissioner deems necessary or appropriate to carry out this chapter, including without limitation rules and forms governing applications and reports; and (2) Define any terms, whether or not used in this chapter, if consistent with this chapter. (c) A rule, form, or order shall not be made, amended, or rescinded unless the commissioner finds that the action is: (1) Necessary or appropriate in the public interest or for the protection of consumers; and (2) Consistent with the purposes fairly intended by the policy and provisions of this chapter. (d) All rules and forms of the commissioner shall be published.

Ark. Code Ann. § 23-55-201 License required.

(a) A person may not engage in the business of money transmission or advertise, solicit, or hold itself out as providing money transmission unless the person: (1) is licensed under this article; (2) is an authorized delegate of a person licensed under this article; or (3) is excluded under § 23-55-103. (b) A license under this article is not transferable or assignable.

Ark. Code Ann. § 23-55-202 Application for license.

(a) In this section, “material litigation” means litigation that according to generally accepted accounting principles or international financial reporting standards is significant to an applicant's or a licensee's financial health and would be required to be disclosed in the applicant's or licensee's annual audited financial statements, report to shareholders, or similar records. (b) A person applying for a license under this article shall do so in a form and in a medium prescribed by the commissioner. The application must state or contain: (1) the legal name and residential and business addresses of the applicant and any fictitious or trade name used by the applicant in conducting its business; (2) a list of any criminal convictions of the applicant and any material litigation in which the applicant has been involved in the 10-year period next preceding the submission of the application; (3) a description of any money services previously provided by the applicant and the money services that the applicant seeks to provide in this State; (4) a list of the applicant's proposed authorized delegates and the locations, including money transmission kiosks and virtual currency kiosks, located in this State where the applicant and its authorized delegates propose to engage in money transmission or provide other money services; (5) a list of other States in which the applicant is licensed to engage in money transmission or provide other money services and any license revocations, suspensions, or other disciplinary action taken against the applicant in another State; (6) information concerning any bankruptcy or receivership proceedings affecting the licensee; (7) a sample form of contract for authorized delegates, if applicable, and a sample form of payment instrument or instrument upon which stored value or prepaid access is recorded, if applicable; (8) the name and address of any bank through which the applicant's payment instruments, stored value, or prepaid access will be paid; (9) a description of the source of money and credit to be used by the applicant to provide money services; and (10) any other information the commissioner reasonably requires with respect to the applicant. (11) the name of a person submitted by the applicant as the responsible individual and information on that person to include: (A) legal name; (B) residential and business addresses; (C) date of birth; (D) Social Security number; (E) employment history for the five-year period preceding the submission of the application; and (F) documentation that the proposed responsible individual is a citizen of the United States or has obtained legal immigration status to work in the United States; (12) for the ten-year period preceding submission of the application, a list of: (A) any criminal convictions of the proposed responsible individual of the applicant; (B) any litigation involving the proposed responsible individual relating to the provision of money services; and (C) any material litigation in which the applicant has been involved; (13) a list of any license revocations, suspensions, restrictions, or other disciplinary action taken against any money services business involving the proposed responsible individual of the applicant; and (14) information concerning any bankruptcy or receivership proceedings involving or affecting the applicant or the proposed responsible individual of the applicant. (c) If an applicant is a corporation, limited liability company, partnership, or other entity, the applicant shall also provide: (1) the date of the applicant's incorporation or formation and State or country of incorporation or formation; (2) if applicable, a certificate of good standing from the State or country in which the applicant is incorporated or formed; (3) a brief description of the structure or organization of the applicant, including any parent or subsidiary of the applicant, and whether any parent or subsidiary is publicly traded; (4) the legal name, any fictitious or trade name, all business and residential addresses, and the employment, in the 10-year period next preceding the submission of the application of each executive officer, manager, director, or person that has control, of the applicant; (5) a list of any criminal convictions and material litigation in which any executive officer, manager, director, or person in control of, the applicant has been involved in the 10-year period next preceding the submission of the application; (6) a copy of the applicant's audited financial statements for the most recent fiscal year and, if available, for the two-year period next preceding the submission of the application; (7) a copy of the applicant's unconsolidated financial statements for the current fiscal year, whether audited or not, and, if available, for the two-year period next preceding the submission of the application; (8) if the applicant is publicly traded, a copy of the most recent report filed with the United States Securities and Exchange Commission under § 13 of the federal Securities Exchange Act of 1934, 15 U.S.C. § 78m (1994 & Supp. V 1999); (9) evidence of the applicant's registration or qualification to do business in this state; (10) if the applicant is a wholly owned subsidiary of: (A) a corporation publicly traded in the United States, a copy of audited financial statements for the parent corporation for the most recent fiscal year or a copy of the parent corporation's most recent report filed under § 13 of the federal Securities Exchange Act of 1934, 15 U.S.C. § 78m (1994 & Supp. V 1999); or (B) a corporation publicly traded outside the United States, a copy of similar documentation filed with the regulator of the parent corporation's domicile outside the United States; (11) if the applicant has a registered agent in this State, the name and address of the applicant's registered agent in this State; and (12) any other information the commissioner reasonably requires with respect to the applicant. (d) A nonrefundable application fee of $1,500 and a license fee of $750 must accompany an application for a license under this article. The license fee must be refunded if the application is denied. (e) The commissioner may waive one or more requirements of subsections (b) and (c) or permit an applicant to submit other information in lieu of the required information. (f) The application shall be accompanied by the surety bond required by § 23-55-204. (g) An individual in control of a licensee or applicant, an individual who seeks to acquire control of a licensee, and each key individual shall furnish to the commissioner, through the Nationwide Multistate Licensing System, the following: (1) the individual's fingerprints for submission to the Federal Bureau of Investigation and the commissioner for purposes of a national criminal history background check, unless the person currently resides outside of the United States and has resided outside of the United States for the last 10 years. (2) personal history and experience in a form and in a medium prescribed by the commissioner to obtain the following information: (A)(i) a credit report from an independent consumer reporting agency, unless the individual does not have a Social Security number. (ii) if an individual does not have a Social Security number, then the requirement for a credit report from an independent consumer reporting agency under subdivision (g)(2)(A)(i) is waived; (B) information related to any criminal convictions or pending criminal charges; and (C) information related to any regulatory or administrative action or any civil litigation involving claims of fraud, misrepresentation, conversion, mismanagement of funds, breach of fiduciary duty, or breach of contract. (3) if an individual has resided outside of the United States at any time in the last 10 years, an investigative background report prepared by an independent search firm that meets the following requirements: (A) at a minimum, the independent search firm shall: (i) demonstrate that it has sufficient knowledge, resources, and employs accepted and reasonable methodologies to conduct the research for a background report; and (ii) not be affiliated with or have an interest with the individual the independent search firm is researching; and (B) at a minimum, the investigative background report shall: (i) be written in the English language; and (ii) contain the following: (a) if available in the individual's current jurisdiction of residency, a comprehensive credit report, or any equivalent information obtained or generated by the independent search firm to accomplish the report, including without limitation a search of the court data in the countries, provinces, states, cities, towns, and contiguous areas where the individual resided and worked; (b) criminal records information for the past 10 years, including without limitation felonies, misdemeanors, or similar convictions for violations of law in the countries, provinces, states, cities, towns, and contiguous areas where the individual resided and worked; (c) employment history; (d) media history, including an electronic search of national and local publications, wire services, and business applications; and (e) financial services-related regulatory history, including without limitation money transmissions, securities, banking, insurance, and mortgage-related industries.

Ark. Code Ann. § 23-55-204 Surety bonds.

(a) An applicant for a money transmission license shall provide, and a licensee at all times shall maintain, security consisting of a surety bond . (b)(1) The surety bond under subsection (a) shall be in a form satisfactory to the Securities Commissioner and shall run to the State of Arkansas for the benefit of any claimants against the licensee to secure the faithful performance of the obligations of the licensee with respect to the receipt, handling, transmission, and payment of money in connection with money transmission. (2) The commissioner has the discretion to require the applicant to obtain additional security coverage to address related cybersecurity risks inherent in the applicant's business model as it relates to virtual currency transmission and to the extent the risks are not within the scope of the required surety bond. (c) The amount of the required security under this section shall be: (1) the greater of $100,000 or an amount equal to 100 percent of the licensee's average daily money transmission liability in this state, calculated for the most recently completed three-month period, up to a maximum of $500,000; or (2) if the licensee's tangible net worth exceeds 10 percent of total assets, then the licensee shall maintain a surety bond of $100,000. (d) A licensee that maintains a bond in the maximum amount provided for in subsection (c), as applicable, is not required to calculate its average daily money transmission liability in this state for purposes of § 23-55-702. (e) A licensee may exceed the maximum required bond amount under § 23-55-702(a)(6). (f)(1) A party having a claim against the licensee may bring suit directly on the surety bond, or the commissioner may bring suit on behalf of any claimants, either in one action or in successive actions. (2) Consumer claims shall be given priority in recovering from the surety bond. (3) Every bond shall provide for suit on the surety bond by a person who has a cause of action under this subchapter. (g)(1) The surety bond shall remain in effect until cancellation, which may occur only after sixty days' written notice to the commissioner. (2) Cancellation shall not affect any liability incurred or accrued during that period. (h)(1) Except as provided by subdivision (h)(2), the surety bond shall remain in place for no less than five (5) years after the licensee ceases money transmission operations in this state. (2) The commissioner may permit the surety bond to be reduced or eliminated before that time to the extent that the amount of the licensee's outstanding payment instruments, stored value obligations, and money transmitted in this state is reduced.

Ark. Code Ann. § 23-55-205 Issuance of license.

(a) When an application is filed under this article, the commissioner shall investigate the applicant's financial condition and responsibility, financial and business experience, character, and general fitness. The commissioner may conduct an on-site investigation of the applicant, the reasonable cost of which the applicant must pay. The commissioner shall issue a license to an applicant under this subchapter if the commissioner finds that all of the following conditions have been fulfilled: (1) the applicant has complied with §§ 23-55-202, 23-55-204, and 23-55-207; and (2) the financial condition and responsibility, financial and business experience, competence, character, and general fitness of the applicant; and the competence, experience, character, and general fitness of the executive officers, managers, directors, and persons in control of, the applicant indicate that it is in the interest of the public to permit the applicant to engage in money transmission. (3) an applicant, an officer, a person who exercises control over the applicant, or a responsible individual shall not be listed on a specially designated nationals and blocked persons list prepared by the United States Department of the Treasury or as an individual or entity designated by the United States Department of State under Exec. Order No. 13224, issued on September 23, 2001, 66 Fed. Reg. 49079. (b) When an application for an original license under this article is complete, the commissioner shall promptly notify the applicant in a record of the date on which the application was determined to be complete and: (1) the commissioner shall approve or deny the application within 120 days after that date; or (2) if the application is not approved or denied within 120 days after that date: (A) the application is deemed approved; and (B) the commissioner shall issue the license under this article, to take effect as of the first business day after expiration of the 120-day period. (c) The commissioner may for good cause extend the application period. (d) An applicant whose application is denied by the commissioner under this article may appeal, within 30 days after receipt of the notice of the denial, from the denial and request a hearing before the commissioner. (e) A license issued under this article expires annually at the close of business on December 31 unless the license is: (1) renewed according to this article; (2) surrendered by the license holder; (3) suspended; or (4) revoked by the commissioner. (f)(1) A money transmitter licensee may surrender a license by providing the commissioner with a written notice of surrender through the automated licensing system approved by the commissioner. (2) The written notice of surrender shall include notice of where the records of the money transmitter licensee will be stored and the name, address, telephone number, and other contact information of a responsible party who is authorized to provide access to the records. (3) The surrender of a license does not reduce or eliminate the civil or criminal liability of a money transmitter licensee arising from acts or omissions occurring before the surrender of the license, including any administrative actions undertaken by the commissioner to revoke or suspend a license, to assess fines, to order payment of restitution, or to exercise any other authority authorized under this chapter.

Ark. Code Ann. § 23-55-206 Renewal of license.

(a) A licensee under this article shall pay an annual renewal fee of $750 no later than December 31 in order to be licensed for the next calendar year. (b) A licensee under this article shall submit a renewal report with the renewal fee, in a form prescribed by the commissioner. The renewal report must state or contain: (1) a list of the licensee's permissible investments and a certification that the licensee continues to maintain permissible investments according to the requirements set forth in §§ 23-55-701 and 23-55-702; and (2) proof that the licensee continues to maintain an adequate surety bond as required by § 23-55-204. (c) A licensee shall comply with subsections (a) and (b) within thirty (30) days of the renewal date. (d) The commissioner for good cause may grant an extension of the renewal date.

Ark. Code Ann. § 23-55-207 Net worth.

(a) A licensee shall maintain at all times a tangible net worth that is the greater of: (1) $100,000 or 3 percent of total assets for the first $100,000,000; (2) 2 percent of additional assets for $100,000,000 to $1,000,000,000; and (3) 0.5 percent of additional assets for any amount over $1,000,000,000. (b) Tangible net worth shall be demonstrated at initial application by the applicant’s most recent audited or unaudited financial statements under § 23-55-202(c)(6). (c) Notwithstanding the other provisions of this section, the Securities Commissioner, for good cause shown, may exempt an applicant or licensee, in part or in whole, from the requirements of this section.

Ark. Code Ann. § 23-55-401 License required.

(a) A person may not engage in currency exchange or advertise, solicit, or hold itself out as providing currency exchange for which the person receives revenues equal or greater than five percent of total revenues unless the person: (1) is licensed under this article; (2) is licensed for money transmission under § 23-55-201 et seq.; or (3) is an authorized delegate of a person licensed under § 23-55-201 et seq. (b) A license under this article is not transferable or assignable.

Ark. Code Ann. § 23-55-402 Application for license.

(a) A person applying for a license under this article shall do so in a form and in a medium prescribed by the commissioner. The application must state or contain: (1) the legal name and residential and business addresses of the applicant, if the applicant is an individual or, if the applicant is not an individual, the name of each partner, executive officer, manager, and director; (2) the location of the principal office of the applicant; (3) complete addresses of other locations in this State where the applicant proposes to engage in currency exchange, including all limited stations and mobile locations; (4) a description of the source of money and credit to be used by the applicant to engage in currency exchange; and (5) other information the commissioner reasonably requires with respect to the applicant, but not more than the commissioner may require under § 23-55-201 et seq. (6) the name of a person submitted by the applicant as the responsible individual and information on that person to include: (A) legal name; (B) residential and business addresses; (C) date of birth; (D) Social Security number; (E) employment history for the five-year period preceding the submission of the application; and (F) documentation that the proposed responsible individual is a citizen of the United States or has obtained legal immigration status to work in the United States; (7) for the ten-year period preceding the submission of the application, a list of any criminal convictions of the proposed responsible individual of the applicant, any litigation involving the proposed responsible individual relating to the provision of money services, and any material litigation in which the applicant has been involved; (8) a list of other states in which the applicant engages in currency exchange or provides other money services and any license revocations, suspensions, restrictions, or other disciplinary action taken against the applicant in another state; (9) a list of any license revocations, suspensions, restrictions, or other disciplinary action taken against any money services business involving the responsible individual of the applicant; and (10) information concerning any bankruptcy or receivership proceedings involving or affecting the applicant or the responsible individual of the applicant. (b) A nonrefundable application fee of $1,500 and a license fee of $375 must accompany an application for a license under this article. The license fee must be refunded if the application is denied.

Ark. Code Ann. § 23-55-403 Issuance of license.

(a) When an application for a license is made under this article, the commissioner shall investigate the applicant's financial condition and responsibility, financial and business experience, character, and general fitness. The commissioner may conduct an on-site investigation of the applicant, the reasonable cost of which the applicant must pay. The commissioner shall issue a license to an applicant under this article if the commissioner finds that all of the following conditions have been fulfilled: (1) the applicant has complied with § 23-55-402; and (2) the financial condition and responsibility, financial and business experience, competence, character, and general fitness of the applicant; and the competence, experience, character, and general fitness of the executive officers, managers, directors, and persons in control of, the applicant indicate that it is in the interest of the public to permit the applicant to engage in currency exchange. (b) When an application for an original license under this article is complete, the commissioner shall promptly notify the applicant in a record of the date on which the application was determined to be complete and: (1) the commissioner shall approve or deny the application within 120 days after that date; or (2) if the application is not approved or denied within 120 days after that date: (A) the application is deemed approved; and (B) the commissioner shall issue the license under this article, to take effect as of the first business day after expiration of the period. (c) The commissioner may for good cause extend the application period. (d) An applicant whose application is denied a license by the commissioner under this article may appeal, within 30 days after receipt of the notice of the denial, from the denial and request a hearing. (e) A license issued under this chapter expires at the close of business on December 31 of the calendar year unless the license is: (1) renewed according to this chapter; (2) surrendered by the license holder; (3) suspended; or (4) revoked by the commissioner.

Ark. Code Ann. § 23-55-404 Renewal of license.

(a) A licensee under this article shall pay an annual renewal fee of $375 no later than December 31 in order to be licensed for the next calendar year. (b) A licensee under this article shall submit a renewal report with the renewal fee, in a form and in a medium prescribed by the commissioner. The renewal report must contain a list of the locations in this State where the licensee or an authorized delegate of the licensee engages in currency exchange, including limited stations, mobile locations, money transmission kiosks, and virtual currency kiosks. (c) A licensee may renew a license after the time specified in subsection (a) if the licensee renews within thirty (30) days of the renewal date by: (1) paying $375 as required under subsection (a); (2) complying with the requirements in subsection (b); and (3) paying a late fee of $250 so long as the complete renewal application is received. (d)(1) The commissioner for good cause may grant an extension of the renewal date. (2) If a licensee has not renewed a license within thirty (30) days of the renewal date and has not shown good cause to receive an extension of the renewal date as described under subdivision (d)(1), then it shall be necessary for the licensee to submit a new application to engage in the business of currency exchange.

Ark. Code Ann. § 23-55-501 Relationship between licensee and authorized delegate.

(a) In this section, “remit” means to make direct payments of money to a licensee or its representative authorized to receive money or to deposit money in a bank in an account specified by the licensee. (b)(1) A contract between a licensee and an authorized delegate must require the authorized delegate to operate in full compliance with this chapter. (2)(A) The licensee shall furnish in a record to each authorized delegate policies and procedures sufficient for compliance with this chapter. (B) The policies and procedures under subdivision (b)(2)(A) shall be updated on a reasonably periodic basis. (c) An authorized delegate shall remit all money owing to the licensee in accordance with the terms of the contract between the licensee and the authorized delegate. (d) If a license is suspended or revoked , the commissioner shall notify all authorized delegates of the licensee whose names are in a record filed with the commissioner of the suspension, revocation, or non-renewal. After notice is sent or publication is made, an authorized delegate shall immediately cease to provide money services as a delegate of the licensee. (e) An authorized delegate may not provide money services outside the scope of activity permissible under the contract between the authorized delegate and the licensee, except activity in which the authorized delegate is authorized to engage under § 23-55-201 et seq. or § 23-55-401 et seq. An authorized delegate of a licensee holds in trust for the benefit of the licensee all money net of fees received from money transmission. (f) An authorized delegate may not use a subdelegate to conduct money services on behalf of a licensee. (g) A copy of a contract required under this section shall be made available to the Securities Commissioner, upon request.

Ark. Code Ann. § 23-55-502 Unauthorized activities.

A person may not provide money services on behalf of a person not licensed under this chapter. A person that engages in that activity provides money services to the same extent as if the person were a licensee.

Ark. Code Ann. § 23-55-503 Training materials provided to authorized delegates.

(a) On or before April 1 of each year, a licensee shall provide to each authorized delegate through which it engages in the business of money transmission training materials on how to: (1) recognize financial abuse and financial exploitation of an elder adult; and (2) respond appropriately if the authorized delegate suspects that the authorized delegate is being asked to engage in the business of money transmission for a fraudulent transaction in which an elder adult is the victim of financial abuse or financial exploitation. (b) A licensee shall provide the training materials required under subsection (a) to each newly appointed authorized delegate within one month after appointment of the authorized delegate.

Ark. Code Ann. § 23-55-601 Authority to conduct examinations and investigations.

(a) The Securities Commissioner or the commissioner's designee may conduct an annual examination of a licensee or of any of its authorized delegates upon 45 days' notice in a record to the licensee. (b) The commissioner may examine a licensee or its authorized delegate, at any time, without notice, if the commissioner has reason to believe that the licensee or authorized delegate is engaging in an unsafe or unsound practice or has violated or is violating this chapter or a rule adopted or an order issued under this chapter. (c)(1) The licensee, applicant, or person subject to licensing under this chapter shall pay a fee for each examination, not to exceed one hundred fifty dollars ($150) per examiner for each day or for part of a day during which the examiner is conducting the examination. (2) In addition to the fee prescribed under subdivision (c)(1) of this section, the licensee, applicant, or person subject to licensing under this chapter may be required to pay the actual hotel and traveling expenses of each examiner traveling to and from the office of the commissioner while the examiner is conducting the examination. (d) Information obtained during an examination under this chapter may be disclosed only as provided in § 23-55-607. (e) The commissioner may: (1) Make any investigations within or outside of this state that he or she deems necessary to determine whether a person has violated or is about to violate this chapter or any rule or order under this chapter, or to aid in the enforcement of this chapter; (2) Require or permit a person to file a sworn, written statement or submit any other form of evidence concerning the matter to be investigated; and (3) Publish information concerning a violation of this chapter or a rule or order issued under this chapter. (f) For the purpose of an investigation or proceeding under this chapter, the commissioner or the commissioner's designee may: (1) Administer oaths and affirmations; (2) Subpoena and compel the attendance of witnesses; (3) Take evidence; and (4) Require the production of books, papers, correspondence, memoranda, agreements, or other documents or records that the commissioner deems relevant or material to the inquiry. (g)(1) In case of contumacy by or the refusal to obey a subpoena issued to a person, the Pulaski County Circuit Court upon application by the commissioner may order the person to appear before the commissioner or the commissioner's designee to testify or produce documentary or other evidence concerning the matter under investigation or in question. (2) Failure to obey the order of the court may be punished by the court as a contempt of court. (h)(1) A person shall not refuse to appear, testify, or produce evidence before the commissioner or the commissioner's designee on the ground that the testimony or evidence may tend to incriminate the person or subject the person to a penalty or forfeiture. (2)(A) After claiming a privilege against self-incrimination, an individual shall not be prosecuted or subjected to a penalty or forfeiture for or on account of a transaction, matter, or thing concerning which the individual is compelled to testify or produce evidence, documentary or otherwise. (B) However, an individual is not exempt from prosecution and punishment for perjury or contempt committed while testifying or producing evidence, documentary or otherwise. (i)(1) To aid an examination or investigation under this chapter, the commissioner or the commissioner's designee may at any time examine: (A) The business of a licensee, an authorized delegate of a licensee, or any other person engaged in the business of providing money services, whether the person acts or claims to act under or without the authority of this chapter; and (B) Wherever located, the books, accounts, records, papers, documents, files, and other information used in the business of a licensee, an authorized delegate of a licensee, or any other person engaged in the business of providing money services, whether the person acts or claims to act under or without the authority of this chapter. (2) The commissioner or the commissioner's designee shall have free access to the offices and places of business, books, accounts, papers, documents, other information, records, files, safes, and vaults to conduct the examination or investigation under this section. (3) The commissioner or the commissioner’s designee may request through a record the books, accounts, papers, documents, other information, records, and files to be provided to the commissioner on 7 business-days’ notice.

Ark. Code Ann. § 23-55-602 Cooperation.

The Securities Commissioner may consult and cooperate with other state money services regulators and agencies of the United States Government in enforcing and administering this chapter. They may jointly pursue examinations and take other official action that they are otherwise empowered to take.

Ark. Code Ann. § 23-55-603 Reports.

(a) A licensee shall file with the commissioner within 15 business days any material changes in information provided in a licensee's application as prescribed by the commissioner. (b) A licensee shall file with the commissioner within 45 days after the end of each calendar quarter a current list of all authorized delegates, and locations in this State where the licensee or an authorized delegate of the licensee provides money services, including limited stations, mobile locations, money transmission kiosks, and virtual currency kiosks. The licensee shall state the name and street address of each location and authorized delegate. (c) A money transmission licensee shall file with the commissioner within 90 days after the end of the money transmission licensee's fiscal year a copy of the money transmission licensee's audited financial statement from the most recently completed fiscal year or, if the money transmission licensee is a wholly owned subsidiary of another corporation, the consolidated audited financial statement of the parent corporation from the most recently completed fiscal year or the money transmission licensee's consolidated audited annual financial statement from the most recently completed fiscal year. (d) A licensee shall file a report with the commissioner within 3 business days after the licensee has reason to know of the occurrence of the following events: (1) the filing of a petition by or against the licensee under the United States Bankruptcy Code, 11 U.S.C. §§ 101-110 (1994 & Supp. V 1999), for bankruptcy or reorganization; (2) the filing of a petition by or against the licensee for receivership, the commencement of judicial or administrative proceedings for its dissolution or reorganization, or the making of a general assignment for the benefit of its creditors; (3) the commencement of a proceeding to revoke or suspend its license in a state or country that the licensee engages in business or is licensed; (4) the cancellation or impairment of the licensee's bond or other security; (5) a charge or conviction of the licensee or of an executive officer, manager, director, or person in control of the licensee, for a felony; or (6) a charge or conviction of an authorized delegate for a felony. (e) A licensee shall file with the commissioner within 45 days after the end of each calendar quarter, in a form acceptable to the commissioner, a report of the number and monetary amount of payment instruments, stored- value, prepaid access, and virtual currency sold by the licensee in this State for that quarter, and the monetary amount of payment instruments, stored-value, prepaid access, and virtual currency currently outstanding. (f) The commissioner may for good cause grant an extension of the reporting date.

Ark. Code Ann. § 23-55-604 Acquisition of control.

(a)(1) A person, or a group of persons acting in concert, seeking to acquire control of a licensee shall obtain the written approval of the Securities Commissioner before acquiring control. (2) If an individual becomes a key individual of the licensee in the ordinary course of business, then the individual is not deemed to have acquired control of a licensee and is not subject to this section. (b) A person or a group of persons acting in concert seeking to acquire control of a licensee shall submit, in cooperation with the licensee: (1) an application in a form and in a medium prescribed by the commissioner; and (2) a nonrefundable fee of $1,000 with a request for approval. (c) Upon request, the commissioner may permit a licensee or the person or group of persons acting in concert to submit some or all information required under subdivision (b)(1) without using the Nationwide Multistate Licensing System. (d) The application under subdivision (b)(1) shall include information required by § 23-55-202(g) for a new key individual who has not previously completed the requirements of § 23-55-202(g) for a licensee. (e)(1) If an application for acquisition of control under this section appears to include all the items and address all of the matters that are required, then the application shall be considered complete, and the commissioner shall promptly notify the applicant in a record of the date that the application was determined to be complete. (2) The commissioner shall approve or deny the application within 60 days after the completion date. (3) If the application is not approved or denied within 60 days after the completion date, then: (i) the application is approved; and (ii) the person or group of persons acting in concert are not prohibited from acquiring control. (4) The commissioner may for good cause extend the application period. (f) A determination by the commissioner that an application is complete and the application is accepted for processing means that the application, on its face, appears to include all of the items and address all of the matters that are required but is not an assessment of the substance of the application or of the sufficiency of the information provided. (g)(1) If an application is filed and considered complete under subsection (e), then the commissioner shall investigate the financial condition and responsibility, financial and business experience, character, and general fitness of the person or group of persons acting in concert seeking to acquire control. (2) The commissioner shall approve an application for acquisition of control under this section if the commissioner finds that all of the following conditions have been fulfilled: (A) the requirements of subsections (b) and (d) have been met, as applicable; and (B) the financial condition and responsibility, financial and business experience, competence, character, and general fitness of the person or group of persons acting in concert seeking to acquire control, and the competence, experience, character, and general fitness of the key individuals and persons that would be in control of the licensee after the acquisition of control indicate that it is in the interest of the public to permit the person or group of persons acting in concert to control the licensee. (h)(1) The commissioner shall issue a formal written notice of the denial of an application to acquire control within 30 days of the decision to deny the application. (2) The commissioner shall state in the notice of denial the specific reasons for the denial of the application. (3) An applicant whose application is denied by the commissioner under this subsection (h) may appeal within 30 days after receipt of the written notice of the denial. (i) The requirements of subsections (a) and (b) do not apply to: (1) a person that acts as a proxy for the sole purpose of voting: (A) at a designated meeting of the shareholders or holders of voting shares; or (B) interests of a licensee or a person in control of a licensee; (2) a person that acquires control of a licensee by devise or descent; (3) a person that acquires control of a licensee: (A) as a personal representative, custodian, guardian, conservator, or trustee; (B) as an officer appointed by a court of competent jurisdiction; or (C) by operation of law; (4) a person that is exempt under § 23-55-103; (5) a person that the commissioner determines is not subject to subsection (a) based on the public interest; (6) a public offering of securities of a licensee or a person in control of a licensee; or (7) an internal reorganization of a person in control of the licensee if the ultimate person in control of the licensee remains the same. (j) Persons in subdivisions (i)(2)-(4) and subdivisions (i)(6) and (7), in cooperation with the licensee, shall notify the commissioner within 15 days after the acquisition of control. (k)(1) The requirements of subsections (a) and (b) do not apply to a person that has complied with and received approval to engage in money transmission under this chapter or was identified as a person in control in a prior application filed with and approved by the commissioner or by a money services business accredited state under a multistate licensing process if: (A) the person has not had a license revoked or suspended or controlled a licensee that has had a license revoked or suspended while the person was in control of the licensee in the previous 5 years; (B) the person is a licensee, and the person is well managed and has received at least a satisfactory rating for compliance at its most recent examination by a money services business accredited state if the rating was given; (C) the licensee to be acquired is projected to meet the requirements of §§ 23-55-204, 23-55-207, and 23-55-701 after the acquisition of control is completed, and if the person acquiring control is a licensee, then that licensee is also projected to meet the requirements of §§ 23-55-204, 23-55-207, and 23-55-701 after the acquisition of control is completed; (D) the licensee to be acquired shall not implement any material changes to its business plan as a result of the acquisition of control, and if the person acquiring control is a licensee, then that licensee also shall not implement any material changes to its business plan as a result of the acquisition of control; and (E) the person provides notice of the acquisition in cooperation with the licensee and attests to subdivisions (k)(1)(A)-(D) in a form and in a medium prescribed by the commissioner. (2) If the notice is not disapproved within 30 days after the date that the notice was determined to be complete, then the notice is approved. (l)(1) Before filing an application for approval to acquire control of a licensee, a person may request in writing a determination from the commissioner as to whether or not the person would be considered a person in control of a licensee upon consummation of a proposed transaction. (2) If the commissioner determines that the person would not be a person in control of a licensee, then the proposed person and transaction are not subject to the requirements of subsections (a) and (b). (m)(1) A licensee adding or replacing a key individual shall: (A) provide notice in a manner prescribed by the commissioner within 15 days after the effective date of the key individual's appointment; and (B) provide information as required by this section within 45 days of the effective date of the key individual's appointment. (2) Within 90 days of the date that the notice provided under subsection (a) was determined to be complete, the commissioner may issue a notice of disapproval of a key individual if the competence, experience, character, or integrity of the individual are such that it would not be in the best interests of the public or the customers of the licensee to permit the individual to be a key individual of the licensee. (3)(A) A notice of disapproval shall: (i) contain a statement of the basis for disapproval; and (ii) be sent to the licensee and the disapproved individual. (B) A licensee may appeal a notice of disapproval within 30 days after receipt of the notice of disapproval. (4) If the notice provided under subsection (a) is not disapproved within 90 days after the date that the notice was determined to be complete, then the key individual is approved.

Ark. Code Ann. § 23-55-605 Records.

(a) A licensee shall maintain the following records for determining its compliance with this chapter for at least five years: (1) a record of each payment instrument, stored-value, virtual currency, or prepaid access obligation sold; (2) a general ledger posted at least monthly containing all asset, liability, capital, income, and expense accounts; (3) bank statements and bank reconciliation records; (4) records of outstanding payment instruments and stored-value and prepaid access obligations; (5) records of each payment instrument, stored-value, virtual currency, and prepaid access obligation paid within the five-year period; (6) a list of the last known names and addresses of all of the licensee's authorized delegates; and (7) any other records the commissioner reasonably requires by rule. (b) The items specified in subsection (a) may be maintained photographically, electronically, or in any other form of record allowed by the commissioner. (c) Records may be maintained outside this State if they are made accessible and available to the commissioner on seven business-days' notice that is sent in a record. (d) All records maintained by the licensee as required in subsections (a) through (c) are open to inspection by the commissioner pursuant to § 23-55-601.

Ark. Code Ann. § 23-55-606 Anti-money laundering program and reports.

(a) Every licensee shall comply with all state and federal laws, rules, and regulations relating to the detection and prevention of money laundering. (b) Every licensee shall maintain an anti-money laundering program in accordance with 31 C.F.R. § 103.125. The program shall be reviewed and updated as necessary to ensure that the program continues to be effective in detecting and deterring money laundering activities. (c) At a minimum, the program shall include: (1) A system of internal controls to ensure ongoing compliance; (2) Independent testing for compliance to be conducted by bank personnel or by an outside party; (3) Designation of an individual or individuals who are responsible for coordinating and monitoring day-to-day compliance; (4) Training for appropriate personnel; and (5) Appropriate risk-based procedures for conducting ongoing customer due diligence to include without limitation: (A) Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (B)(i) Conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. (ii) For purposes of subdivision (c)(5)(B)(i) of this section, customer information shall include information regarding the beneficial owners of legal entity customers. (d) Every licensee shall comply with the regulations of its federal functional regulator governing such programs. (e) A licensee and an authorized delegate shall file with the commissioner all reports required by federal currency reporting, record keeping, and suspicious transaction reporting requirements as set forth in 31 U.S.C. § 5311 (1994), 31 C.F.R. § 103 (2000), and other federal and state laws pertaining to money laundering. (f) The timely filing of a complete and accurate report required under subsection (e) of this section with the appropriate federal agency satisfies compliance with the requirements of subsection (e) of this section, unless the commissioner notifies the licensee that reports of this type are not being regularly and comprehensively transmitted by the federal agency to the commissioner.

Ark. Code Ann. § 23-55-607 Confidentiality.

(a) Unless otherwise specified in this section, all information filed with the commissioner shall be available for public inspection under rules promulgated by the commissioner consistent with state and federal law governing the disclosure of public information. (b) Except for reasonably segregable portions of information and records that by law would routinely be made available to a party other than an agency in litigation with the commissioner, the commissioner shall not publish or make available: (1) Information contained in reports, summaries, analyses, letters, or memoranda arising out of, in anticipation of, or in connection with an investigation, examination, or inspection of the books and records of any person; (2) Interagency or intra-agency memoranda or letters, including without limitation: (A) Records that reflect discussions between or consideration by the commissioner or members of the staff of the State Securities Department or the staff of the Department of Commerce working for the State Securities Department, or both, of any action taken or proposed to be taken by the commissioner or by any members of the staff of the State Securities Department or the staff of the Department of Commerce working for the State Securities Department; and (B) Reports, summaries, analyses, conclusions, or any other work product of the commissioner or of attorneys, accountants, analysts, or other members of the commissioner's staff, prepared in the course of an: (i) Inspection of the books or records of a person whose affairs are regulated by the commissioner; or (ii) Examination, investigation, or litigation conducted by or on behalf of the commissioner; (3) Personnel files, medical files, and similar files if disclosure would constitute a clearly unwarranted invasion of personal privacy, including without limitation: (A) Information concerning employees of the State Securities Department or employees of the Department of Commerce working for the State Securities Department and all persons subject to rule by the State Securities Department; and (B) Personal information reported to the commissioner under the department's rules concerning registration about employees of applicants, licensees, or their agents; (4)(A) Investigatory records compiled for law enforcement purposes to the extent that production of the records would: (i) Interfere with enforcement proceedings; (ii) Deprive a person of a right to a fair trial or an impartial adjudication; or (iii) Disclose the identity of a confidential source. (B) The commissioner may also withhold investigatory records that would: (i) Constitute an unwarranted invasion of personal privacy; (ii) Disclose investigative techniques and procedures; or (iii) Endanger the life or physical safety of law enforcement personnel. (C) As used in this section, “investigatory records” includes: (i) All documents, records, transcripts, correspondence, and related memoranda and work products concerning examinations and other investigations and related litigation as authorized by law that pertain to or may disclose the possible violation by any person of any provision of the statutes or rules administered by the commissioner; and (ii) All written communications from or to any person confidentially complaining or otherwise furnishing information about a possible violation, as well as all correspondence and memoranda in connection with the confidential complaint or information; (5) Information contained in or related to examinations, operating reports, or condition reports prepared by, on behalf of, or for the use of any agency responsible for the regulation or supervision of financial institutions, check issuers, money transmitters, money services providers, or money service businesses; (6)(A) Financial records of any applicant, licensee, or the agent of an applicant or licensee obtained during or as a result of an examination by the commissioner. (B) However, when a record under this article is required to be filed with the commissioner as part of an application for license, annual renewal, or otherwise, the record, including financial statements prepared by certified public accountants, shall be public information unless sections of the information are bound separately and are marked “confidential” by the applicant, licensee, or agent upon filing. (C) Information under subdivision (b)(6)(B) of this section bound separately and marked “confidential” shall be deemed nonpublic until ten (10) days after the commissioner has given the applicant, licensee, or agent notice that an order will be entered deeming the material public information. (D) An applicant, licensee, or agent may seek an injunction from the Pulaski County Circuit Court ordering the commissioner to withhold the information as nonpublic pending a final order from a court of competent jurisdiction if the order of the commissioner under subdivision (b)(6)(C) of this section is appealed under applicable law; (7) Trade secrets obtained from any person; or (8) Any other records that are required to be closed to the public and are not deemed open to public inspection under other law. (c) The commissioner may disclose information not otherwise subject to disclosure under subsection (a) to representatives of state or federal agencies who promise in a record that they will maintain the confidentiality of the information; or the commissioner finds that the release is reasonably necessary for the protection of the public and in the interests of justice, and the licensee has been given previous notice by the commissioner of its intent to release the information. (d) This section does not prohibit the commissioner from disclosing to the public a list of persons licensed under this chapter or the aggregated financial data concerning those licensees.

Ark. Code Ann. § 23-55-608 Disclosure requirements.

(a) A licensee shall provide its name and mailing address or telephone number to the purchaser in connection with each money transmission or currency exchange transaction conducted by the licensee directly or through an authorized delegate. (b) An authorized delegate shall display prominently in a form and in a medium prescribed by the Securities Commissioner a notice that states or contains the following information: (1) The name, mailing address, and telephone number of the authorized delegate; (2) For each licensee of the authorized delegate: (A) A statement that the authorized delegate is an agent conducting business on behalf of the licensee under this chapter; and (B) The name, mailing address, and telephone number of the licensee; and (3) A statement: (A) Directing consumers with complaints to contact the State Securities Department; and (B) Containing the current mailing address and telephone number of the department. (c)(1) Except as required by § 23-55-1008(a), a licensee or authorized delegate shall include a clear, concise, and conspicuous fraud warning that is posted in a conspicuous area or included on a transmittal form used by a consumer to send money to another individual. (2) The fraud warning required under subdivision (c)(1) shall: (A) include a toll-free telephone number for consumers to call to report fraud or suspected fraud; and (B) be in clear, conspicuous, and legible writing in English and in the language principally used by the licensee or authorized delegate to advertise, solicit, or negotiate, either orally or in writing, for a transaction conducted in person, electronically, or by telephone, if other than English. (3) A licensee shall monitor the activities of its authorized delegates relating to transmittals by consumers. (4) If a licensee or authorized delegate conducts money transmission activity through a website or a mobile application that is not in a physical location, the commissioner may authorize an alternative form of the fraud notice required under subdivision (c)(1).

Ark. Code Ann. § 23-55-609 Policy and procedure — Physical security and cybersecurity.

(a) A money transmitter or currency exchanger licensed or required to be licensed under this chapter shall establish, implement, update, and enforce written physical security and cybersecurity policies and procedures reasonably designed to ensure the confidentiality, integrity, and availability of physical and electronic records and information. (b) A policy or procedure described in subsection (a) of this section shall be tailored to the size and sophistication of the money transmitter or currency exchanger. (c) The Securities Commissioner may impose additional conditions by rule or order to clarify the requirements of a policy or procedure described in subsection (a) of this section.

Ark. Code Ann. § 23-55-610 Timely transmission.

(a) Every licensee shall forward all money received for transmission according to the terms of the agreement between the licensee and the sender unless the licensee has a reasonable belief or a reasonable basis to believe that the sender may be a victim of fraud or that a crime or violation of law, rule, or regulation has occurred, is occurring, or may occur. (b) If a licensee fails to forward money received for transmission under this section, then the licensee shall respond to inquiries by the sender with the reason for the failure unless providing a response would violate a state or federal law, rule, or regulation.

Ark. Code Ann. § 23-55-611 Refunds.

(a) This section does not apply to: (1) money received for transmission subject to the federal remittance transfer definitions, 12 C.F.R. Part 1005.30, as it existed on January 1, 2023; or (2) money received for transmission under a written agreement between the licensee and payee to process payments for goods or services provided by the payee. (b)(1) Every licensee shall refund to the sender within 10 days of receipt of the sender's written request for a refund of all money received for transmission unless any of the following occurs: (A) the money has been forwarded within 10 days of the date that the money was received for transmission; (B) instructions have been given committing an equivalent amount of money to the person designated by the sender within 10 days of the date that the money was received for transmission; (C)(i) the agreement between the licensee and the sender instructs the licensee to forward the money at a time that is beyond 10 days of the date that the money was received for transmission. (ii) if funds have not yet been forwarded according to the terms of the agreement between the licensee and the sender, then the licensee shall issue a refund under this section; or (D) the refund is requested for a transaction that the licensee has not completed based on a reasonable belief or a reasonable basis to believe that a crime or violation of law, rule, or regulation has occurred, is occurring, or may occur. (2) The refund request does not enable the licensee to: (A) identify the sender's name and address or telephone number; or (B) identify the particular transaction to be refunded in the event the sender has multiple transactions outstanding.

Ark. Code Ann. § 23-55-612 Receipts.

(a) This section does not apply to: (1) money received for transmission subject to the federal remittance transfer definitions, 12 C.F.R. Part 1005.30, as it existed on January 1, 2023; (2) money received for transmission that is not primarily for personal, family, or household purposes; (3) money received for transmission under a written agreement between the licensee and payee to process payments for goods or services provided by the payee; or (4) payroll processing services. (b) In this section, "receipt" means a paper receipt, electronic record, or other written confirmation. (c)(1) For a transaction conducted in person, the receipt may be provided electronically if the sender requests or agrees to receive an electronic receipt. (2) For a transaction conducted electronically or by phone, a receipt may be provided electronically. (3) All electronic receipts shall be provided in a retainable form. (d)(1) Every licensee or its authorized delegate shall provide the sender a receipt for money received for transmission. (2) The receipt shall contain the following information, as applicable: (A) the name of the sender, to the extent the licensee or its authorized delegate is required to capture this information before transmission; (B) the name of the designated recipient, unless the licensee can determine the name of the recipient by the unique transaction or identification number described in subdivision (d)(2)(D), in which case the name of the recipient is not required; (C) the date of the transaction; (D) the unique transaction or identification number; (E) the name of the licensee, National Mortgage Licensing System unique ID, the licensee's business address, and the licensee’s customer service telephone number; (F) the amount of the transaction in United States dollars; (G) any fee charged by the licensee to the sender for the transaction; and (H) any taxes collected by the licensee from the sender for the transaction. (e) The receipt required by this section shall be in English and in the language principally used by the licensee or authorized delegate to advertise, solicit, or negotiate, either orally or in writing, for a transaction conducted in person, electronically, or by phone, if other than English.

Ark. Code Ann. § 23-55-701 Maintenance of permissible investments.

(a) A licensee shall maintain at all times permissible investments that have a market value computed in accordance with generally accepted accounting principles or international financial reporting standards of not less than the aggregate amount of all of its outstanding money transmission obligations. (b) A licensee transmitting virtual currency shall hold like-kind virtual currency of the same volume as that held by the licensee but which is obligated to consumers in lieu of the permissible investments required in subsection (a). (c) A licensee conducting activities as described in subsections (a) and (b) shall maintain applicable levels and types of permissible investments as described in subsections (a) and (b). (d) Except for permissible investments enumerated in § 23-55-702(a), the commissioner, with respect to any licensee, may by rule or order limit the extent to which a specific investment maintained by a licensee within a class of permissible investments may be considered a permissible investment if the specific investment represents undue risk to customers that is not reflected in the market value of investments. (e)(1) Permissible investments, even if commingled with other assets of the licensee, are held in trust for the benefit of the purchasers and holders of the licensee's outstanding money transmission obligations in the event of : (A) insolvency; (B) the filing of a petition by or against the licensee under the United States Bankruptcy Code, 11 U.S.C. § 101 et seq., as it existed on January 1, 2023, for bankruptcy or reorganization; (C) the filing of a petition by or against the licensee for receivership; (D) the commencement of any other judicial or administrative proceeding for the licensee's dissolution or reorganization; or (E) an action by a creditor against the licensee who is not a beneficiary of the statutory trust under this subsection. (2) Permissible investments impressed with a trust under this section shall not be subject to attachment, levy of execution, or sequestration by order of any court, except for a beneficiary of the statutory trusts under this section. (f)(1) Upon the establishment of a statutory trust under subsection (e) or if any funds are drawn on a letter of credit under § 23-55-702(a)(4), then the commissioner shall notify the applicable regulator of each state in which the licensee is licensed to engage in money transmission, if any, of the establishment of the statutory trust or the funds drawn on the letter of credit, as applicable. (2) Notice shall be deemed satisfied if performed under a multistate agreement or through Nationwide Multistate Licensing System. (3) Funds drawn on a letter of credit, and any other permissible investments held in trust for the benefit of the purchasers and holders of the licensee's outstanding money transmission obligations, are deemed held in trust for the benefit of the purchasers and holders on a pro rata and equitable basis according to statutes under which permissible investments are required to be held in this state, and other states, as applicable. (4) Any statutory trust established under this subchapter shall be terminated upon extinguishment of all of the licensee's outstanding money transmission obligations. (g)(1) The commissioner by rule or by order may allow other types of investments that the commissioner determines are of sufficient liquidity and quality to be a permissible investment. (2) The commissioner may participate in efforts with other state regulators to determine that other types of investments are of sufficient liquidity and quality to be a permissible investment.

Ark. Code Ann. § 23-55-801 Suspension and revocation.

(a) The commissioner may suspend or revoke a license or order a licensee to revoke the designation of an authorized delegate if: (1) the licensee violates this chapter or a rule adopted or an order issued under this chapter; (2) the licensee does not cooperate with an examination or investigation by the commissioner; (3) the licensee engages in fraud, intentional misrepresentation, or gross negligence; (4) an authorized delegate is convicted of a violation of a state or federal anti-money laundering statute, or violates a rule adopted or an order issued under this chapter, as a result of the licensee's willful misconduct or willful blindness; (5) the competence, experience, character, or general fitness of the licensee, authorized delegate, person in control of a licensee, or responsible person of the licensee or authorized delegate indicates that it is not in the public interest to permit the person to provide money services; (6) the licensee engages in an unsafe or unsound practice; (7) the licensee is insolvent, suspends payment of its obligations, or makes a general assignment for the benefit of its creditors; (8) the licensee does not remove an authorized delegate after the commissioner issues and serves upon the licensee a final order including a finding that the authorized delegate has violated this chapter; or (9) the licensee is the subject of an order, including a denial, suspension, or revocation, by this or any other state or federal authority that was entered against the person within the past 5 years, including without limitation the money services industry. (b) In determining whether a licensee is engaging in an unsafe or unsound practice, the commissioner may consider the size and condition of the licensee's money transmission, the magnitude of the loss, the gravity of the violation of this chapter, and the previous conduct of the person involved.

Ark. Code Ann. § 23-55-802 Suspension and revocation of authorized delegates.

(a) The commissioner may issue an order suspending or revoking the designation of an authorized delegate, if the commissioner finds that: (1) the authorized delegate violated this chapter or a rule adopted or an order issued under this chapter; (2) the authorized delegate did not cooperate with an examination or investigation by the commissioner; (3) the authorized delegate engaged in fraud, intentional misrepresentation, or gross negligence; (4) the authorized delegate is convicted of a violation of a state or federal anti-money laundering statute; (5) the competence, experience, character, or general fitness of the authorized delegate or a person in control of the authorized delegate indicates that it is not in the public interest to permit the authorized delegate to provide money services; or (6) the authorized delegate is engaging in an unsafe or unsound practice. (b) In determining whether an authorized delegate is engaging in an unsafe or unsound practice, the commissioner may consider the size and condition of the authorized delegate's provision of money services, the magnitude of the loss, the gravity of the violation of this chapter or a rule adopted or order issued under this chapter, and the previous conduct of the authorized delegate. (c) An authorized delegate may apply for relief from a suspension or revocation of designation as an authorized delegate according to procedures prescribed by the commissioner.

Ark. Code Ann. § 23-55-803 Orders to cease and desist.

(a) If the Securities Commissioner determines that a violation of this chapter or of a rule adopted or an order issued under this chapter by a licensee, authorized delegate, or any other person is likely to cause immediate and irreparable harm to the licensee, its customers, or the public as a result of the violation or cause insolvency or significant dissipation of assets of the licensee, the commissioner may issue a summary order requiring the licensee, authorized delegate, or any other person to cease and desist from the violation. The order becomes effective upon service of it upon the licensee, authorized delegate, or any other person. (b) The commissioner may issue a summary order against a licensee to cease and desist from providing money services through an authorized delegate that is the subject of a separate order by the commissioner. (c) An order to cease and desist remains effective and enforceable pending the completion of an administrative proceeding pursuant to § 23-55-901 or § 23-55-902 and the entry of a subsequent order to affirm, modify, or vacate the order by the commissioner.

Ark. Code Ann. § 23-55-804 Consent orders.

The commissioner may enter into a consent order at any time with a person to resolve a matter arising under this chapter or a rule adopted or order issued under this chapter. A consent order must be signed by the person to whom it is issued or by the person's authorized representative, and must indicate agreement with the terms contained in the order. A consent order may provide that it does not constitute an admission by a person that this chapter or a rule adopted or an order issued under this chapter has been violated.

Ark. Code Ann. § 23-55-805 Civil penalties.

The commissioner may assess a civil penalty against a person that violates this chapter or a rule adopted or an order issued under this chapter in an amount not to exceed $1,000 per day for each day the violation is outstanding, plus this State's costs and expenses for the investigation and prosecution of the matter, including reasonable attorney's fees.

Ark. Code Ann. § 23-55-806 Criminal penalties.

(a) A person that intentionally makes a false statement, misrepresentation, or false certification in a record filed or required to be maintained under this chapter, that intentionally makes a false entry or omits a material entry in such a record, or violates any rule promulgated or order issued hereunder is guilty of a Class B felony. (b) A person that knowingly engages in an activity for which a license is required under this chapter without being licensed under this chapter and who receives more than $500 in compensation within a 30-day period from this activity is guilty of a Class B felony. (c) A person that knowingly engages in an activity for which a license is required under this chapter without being licensed under this chapter and who receives no more than $500 in compensation within a 30-day period from this activity is guilty of a Class A misdemeanor.

Ark. Code Ann. § 23-55-807 Unlicensed persons.

(a)(1) [Repealed.] (2) If as a result of an investigation or examination the Securities Commissioner finds that a person has engaged or is about to engage in an act or practice constituting a violation of this chapter or a rule or order under this chapter, the commissioner may summarily issue: (A) A cease and desist order under § 23-55-803; or (B) An order to prohibit the person from continuing to engage in providing money services. (b) [Repealed.] (c)(1) An order to cease and desist becomes effective upon service of it upon the person. (2) A hearing shall be held on the written request of the person aggrieved by the order to cease and desist if the request is received by the commissioner within thirty (30) days of the date of the entry of the order to cease and desist or if ordered by the commissioner. (d) An order to cease and desist remains effective and enforceable pending the completion of an administrative proceeding pursuant to §§ 23-55-901 and 23-55-902 and the entry of a subsequent order by the commissioner to affirm, modify, or vacate the order. (e) The commissioner may apply to the Pulaski County Circuit Court to: (1) Temporarily or permanently enjoin an act or practice that violates this chapter or a rule or order under this chapter; or (2) Enforce compliance with this chapter or a rule or order under this chapter.

Ark. Code Ann. § 23-55-808 Receivership.

(a)(1) Whenever a licensee has refused or is unable to pay its obligations generally as they become due or whenever it appears to the commissioner that a licensee is in an unsafe or unsound condition, the commissioner, or the Attorney General representing the commissioner, may apply to the Pulaski County Circuit Court or to the circuit court of any county in which the licensee is located for the appointment of a receiver for the licensee. The court may require the receiver to post a bond in such amount as may appear necessary to protect claimants of the licensee. (2) The receiver, subject to the approval of the court, shall take possession of the books, records, and assets of the licensee and shall take such action with respect to employees, agents, or representatives of the licensee or such other action as may be necessary to conserve the assets of the licensee or ensure payment of instruments issued by the licensee pending further disposition of its business as provided by law. The receiver shall sue and defend, compromise, and settle all claims involving the licensee and exercise such powers and duties as may be necessary and consistent with the laws of this state applicable to the appointment of receivers. (3) The receiver, from time to time, but in no event less frequently than once each calendar quarter, shall report to the court with respect to all acts and proceedings in connection with the receivership.

Ark. Code Ann. § 23-55-901 Administrative proceedings.

All administrative proceedings under this chapter must be conducted in accordance with the Arkansas Administrative Procedure Act, § 25-15-201 et seq.

Ark. Code Ann. § 23-55-902 Hearings.

(a) Except as otherwise provided in §§ 23-55-803 and 23-55-807, the commissioner may not suspend or revoke a license, issue an order to cease and desist, suspend or revoke the designation of an authorized delegate, or assess a civil penalty without notice and an opportunity to be heard. (b) The commissioner shall also hold a hearing when requested to do so by an applicant whose application for a license is denied.

Ark. Code Ann. § 23-55-1001 Uniformity of application and construction.

In applying and construing this Uniform Act, consideration must be given to the need to promote uniformity of the law with respect to its subject matter among States that enact it.

Ark. Code Ann. § 23-55-1002 Severability clause.

If any provision of this chapter or its application to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of this chapter which can be given effect without the invalid provision or application, and to this end the provisions of this chapter are severable.

Ark. Code Ann. § 23-55-1003 Effective date.

This chapter takes effect January 1, 2008.

Ark. Code Ann. § 23-55-1004 [Reserved.]

Ark. Code Ann. § 23-55-1007 Multistate automated licensing system.

(a) The Securities Commissioner may: (1) Enter into an arrangement, agreement, or other working relationship with federal, state, or self-regulatory authorities, the Conference of State Bank Supervisors, or a subsidiary entity owned by the Conference of State Bank Supervisors to file and maintain documents in a multistate automated licensing system or other central depository system; (2) Waive or modify in whole or in part by rule or by order any requirement of this chapter if necessary to implement this section; and (3) Establish new requirements under this chapter to carry out the purpose of this section. (b) It is the intent of this section that the commissioner be provided the authority to reduce duplication of filings, reduce administrative costs, and establish uniform procedures, forms, and administration with other states and federal authorities. (c)(1) The commissioner may permit or require initial and renewal registration filings required under this chapter to be filed with the Conference of State Bank Supervisors, a subsidiary entity owned by the Conference of State Bank Supervisors, the Financial Industry Regulatory Authority, or another entity maintaining or operating a multistate automated licensing system. (2) The applicant or the licensee shall pay any fee charged for the applicant or the licensee to participate in the automated licensing system. (d) The commissioner may accept uniform procedures and forms designed to: (1) Implement a multistate automated licensing system; (2) Implement a uniform national regulatory system; or (3) Facilitate common practices and procedures among the states.

Ark. Code Ann. § 23-55-1008 Virtual currency kiosk requirements.

(a)(1) The owner of a virtual currency kiosk or a virtual currency kiosk operator, in establishing a relationship with a customer and before entering into an initial virtual currency transaction on behalf of or with the customer, shall disclose in clear, conspicuous, and legible writing in English and in the language principally used by the licensee or authorized delegate to advertise, solicit, or negotiate, either orally or in writing, for a transaction conducted in person, electronically, or by phone, if other than English, all material risks associated with virtual currency generally. (2) The material risks associated with virtual currency required to be disclosed under subdivision (a)(1) include without limitation: (A) a disclosure that is acknowledged by the customer and provided separately from the disclosures provided under subdivision (a)(2)(B) and subdivision (a)(2)(G), and written prominently and in bold type, stating the following: “WARNING: LOSSES DUE TO FRAUDULENT OR ACCIDENTAL TRANSACTIONS MAY NOT BE RECOVERABLE AND TRANSACTIONS IN VIRTUAL CURRENCY ARE IRREVERSIBLE.”; (B) virtual currency is not backed or insured by the government and accounts and value balances are not subject to protections of the Federal Deposit Insurance Corporation, National Credit Union Administration, or Securities Investor Protection Corporation; (C) a virtual currency transaction may be deemed to be made when recorded on a public ledger which may not be the date or time when the customer initiates the virtual currency transaction; (D) the value of virtual currency may be derived from the continued willingness of market participants to exchange fiat currency for virtual currency which may result in the permanent and total loss of the value of a particular virtual currency if the market for that virtual currency disappears; (E) the volatility and unpredictability of the price of virtual currency relative to fiat currency may result in a significant loss over a short period of time; (F) a bond maintained by the owner of a virtual currency kiosk or a virtual currency kiosk operator for the benefit of the customers of the owner of a virtual currency kiosk or a virtual currency kiosk operator may not be sufficient to cover all losses incurred by customers; and (G)(i) virtual currency transactions are irreversible and may be used by a person seeking to defraud customers. (ii) As used in subdivision (a)(2)(G)(i), "seeking to defraud customers" includes without limitation a person: (a) impersonating a customer’s family or friends; (b) threatening jail time; (c) stating that a customer’s identity has been stolen; (d) insisting that a customer withdraw money from the customer’s bank account and purchase virtual currency; or (e) alleging that a customer’s personal computer has been hacked. (b)(1) An owner of a virtual currency kiosk or a virtual currency kiosk operator, when opening an account for a new customer and before entering into an initial virtual currency transaction for, on behalf of, or with the customer, shall disclose in clear, conspicuous, and legible writing in English and in the language principally used by the licensee or authorized delegate to advertise, solicit, or negotiate, either orally or in writing, for a transaction conducted in person, electronically, or by phone, if other than English, using not less than twenty-four point sans-serif-type font, all relevant terms and conditions associated with the products, services, and activities of the owner of a virtual currency kiosk or a virtual currency kiosk operator and virtual currency generally. (2) The disclosure required under subdivision (b)(1) shall include without limitation: (A) the customer’s liability for unauthorized virtual currency transactions; (B) the customer’s right to stop payment of a preauthorized virtual currency transfer and the procedure used to initiate a stop-payment order; (C) the circumstances under which the owner of a virtual currency kiosk or a virtual currency kiosk operator, absent a court or government order, will disclose information concerning the customer’s account to third parties; (D) the requirement that the owner of a virtual currency kiosk or a virtual currency kiosk operator communicate to the customer what customer information may be disclosed to third parties; (E) the customer’s right to receive a receipt for a virtual currency transaction at the time of the transaction; (F) upon a change in the rules or policies of the owner or operator, the customer’s right to consent to the changed rules or policies before performing a transaction after the change; and (G) any other disclosures that are customarily provided in connection with opening a person’s account. (c)(1) An owner of a virtual currency kiosk or a virtual currency kiosk operator, before each transaction in virtual currency for, on behalf of, or with a customer, shall disclose to the customer in an easily readable manner that is in clear, conspicuous, and legible writing in English and in the language principally used by the licensee or authorized delegate to advertise, solicit, or negotiate, either orally or in writing, for a transaction conducted in person, electronically, or by phone, if other than English, using not less than twenty-four point sans-serif-type font, the terms and conditions of the virtual currency transaction. (2) The terms and conditions required under subdivision (c)(1) shall include without limitation: (A) the amount of the transaction; (B) any fees, expenses, and charges borne by the customer, including without limitation applicable exchange rates; (C) the type and nature of the virtual currency transaction; (D) a warning that, once executed, the virtual currency transaction may not be undone, if applicable; (E) a daily virtual currency transaction limit according to subsection (g); (F) the difference in the sale price of the virtual currency versus the current market price; and (G) any other disclosures that are customarily given in connection with a virtual currency transaction. (d) An owner of a virtual currency kiosk or a virtual currency kiosk operator shall ensure that each customer acknowledges receipt of all disclosures required under this section. (e)(1) An owner of a virtual currency kiosk or a virtual currency kiosk operator, upon the completion of a virtual currency transaction, shall provide to the customer a receipt containing: (A) the name of, and contact information for, the owner of the virtual currency kiosk or the virtual currency kiosk operator, including without limitation the owner of the virtual currency kiosk's or the virtual currency kiosk operator’s business address and a customer service telephone number established by the owner of a virtual currency kiosk or the virtual currency kiosk operator to answer questions and register complaints; (B) the name of the customer; (C) the type, value, date and precise time of the virtual currency transaction, transaction hash or identification number, and each virtual currency address; (D) the amount of the virtual currency transaction expressed in United States currency; (E) the public virtual currency address of the customer; (F) the unique identifier of the virtual currency kiosk operator; (G) a fee charged, including without limitation a fee charged directly or indirectly by the owner of the virtual currency kiosk or the virtual currency kiosk operator, or a third party involved in the virtual currency transaction; (H) the exchange rate, if applicable; (I) any tax collected by the owner of the virtual currency kiosk or the virtual currency kiosk operator for the virtual currency transaction; (J) a statement of the liability of the owner of the virtual currency kiosk or the virtual currency kiosk operator for nondelivery or delayed delivery; (K) a statement of the refund policy of the owner of the virtual currency kiosk or the virtual currency kiosk operator; (L) the name and telephone number of the State Securities Department and a statement disclosing that the owner of the virtual currency kiosk's or the virtual currency kiosk operator’s customers may contact the department with questions or complaints about the owner of the virtual currency kiosk's or the virtual currency kiosk operator’s virtual currency kiosk services; and (M) any additional information the commissioner may require. (2) The receipt required under subdivision (e)(1): (A) shall be provided in: (i) a retainable form; (ii) English; and (iii) the language principally used by the owner of the virtual currency kiosk or the virtual currency kiosk operator to advertise, solicit, or negotiate, orally or in writing; and (B) may be provided electronically if the customer requests or agrees to receive an electronic receipt. (f) The total amount of a fee and commission charged by an owner of the virtual currency kiosk or a virtual currency kiosk operator for a virtual currency transaction shall not exceed: (1) five dollars; or (2) eighteen percent of the amount of the virtual currency transaction. (g) There are established the following maximum daily virtual currency kiosk transaction limits: (1) two thousand dollars for each new customer of a virtual currency kiosk; and (2) seven thousand five hundred dollars for each existing customer of a virtual currency kiosk. (h) The owner of a virtual currency kiosk or a virtual currency kiosk operator shall allow a new customer, upon the request of the new customer, to cancel and receive a full refund for any fraudulent virtual currency transactions that occurred not later than seventy-two hours after the new customer registered as a customer of the owner of the virtual currency kiosk or the virtual currency kiosk operator if, not later than fourteen days after the last virtual currency transaction that occurred during the seventy-two hour period, the new customer: (1) contacts the owner of the virtual currency kiosk or the virtual currency kiosk operator and a government or law enforcement agency to inform the owner of the virtual currency kiosk or the virtual currency kiosk operator and government or law enforcement agency of the fraudulent nature of the virtual currency transaction; and (2) files a report with a government or law enforcement agency memorializing the fraudulent nature of the virtual currency transaction. (i) Each owner of a virtual currency kiosk or a virtual currency kiosk operator shall: (1) obtain a copy of a government-issued identification card that identifies each customer of the owner of the virtual currency kiosk or the virtual currency kiosk operator; (2) maintain restrictions that prevent more than one customer of the owner of the virtual currency kiosk or the virtual currency kiosk operator from using the same virtual currency wallet; (3) be able to prevent designated virtual currency wallets from being used at a virtual currency kiosk owned or operated by the owner of the virtual currency kiosk or the virtual currency kiosk operator; (4) use an established third party that specializes in performing blockchain analyses to preemptively perform the analyses to identify and prevent high risk or sanctioned virtual currency wallets from being used by customers at virtual currency kiosks owned or operated by the owner of the virtual currency kiosk or the virtual currency kiosk operator; (5) define, in the owner of the virtual currency kiosk's or the virtual currency kiosk operator’s policies and procedures, a risk-based method of monitoring customers of the owner of the virtual currency kiosk or the virtual currency kiosk operator on a post-transaction basis; (6) offer, during the hours of operation of the virtual currency kiosks owned or operated by the owner of the virtual currency kiosk or the virtual currency kiosk operator, live customer support by telephone from a telephone number prominently displayed at or on the virtual currency kiosks; (7)(A) identify and speak by telephone with an elder adult who is a new customer before the elder adult who is a new customer completes his or her first virtual currency transaction with the owner of the virtual currency kiosk or the virtual currency kiosk operator. (B) During the communication, which shall be recorded and retained by the owner of the virtual currency kiosk or the virtual currency kiosk operator, the owner of the virtual currency kiosk or the virtual currency kiosk operator shall: (i) reconfirm any attestations made by the new customer at a virtual currency kiosk owned or operated by the owner of the virtual currency kiosk or the virtual currency kiosk operator; (ii) discuss the transaction; and (iii)(a) discuss types of fraudulent schemes relating to virtual currency. (b) The owner of the virtual currency kiosk's or the virtual currency kiosk operator’s approval of the transaction shall be dependent upon the owner of the virtual currency kiosk's or the virtual currency kiosk operator’s assessment of the communication; (8) designate and employ a chief compliance officer who shall: (A) be qualified to coordinate and monitor a compliance program to ensure compliance with this section and all other applicable federal laws and regulations and state laws and rules; and (B) not own more than twenty percent of the owner of the virtual currency kiosk or the virtual currency kiosk operator that employs the officer; and (9) use full-time employees to fulfill the owner of the virtual currency kiosk's or the virtual currency kiosk operator’s compliance responsibilities under federal laws and regulations and state laws and rules.

Ark. Code Ann. § 23-55-1101 Definitions.

In this subchapter: (1) "Authorized user" means an employee, contractor, agent, or other person that participates in a financial institution’s business operations and is authorized to access and use a financial institution’s information systems and data. (2) "Consumer” means an individual who obtains or has obtained a financial product or service from a financial institution that is to be used primarily for personal, family, or household purposes, or that individual's legal representative. (3) "Customer" means a consumer who has a customer relationship with a financial institution. (4) "Customer information" means a record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of a financial institution or the financial institution’s affiliates. (5) "Customer relationship" means a continuing relationship between a consumer and a financial institution under which the financial institution provides to the consumer one or more financial products or services that are used primarily for personal, family, or household purposes. (6) "Encryption" means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material. (7) "Financial institution" means a money services business licensed under this chapter. (8)(A) "Financial product or service" means a product or service that a financial holding company could offer by engaging in a financial activity under section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C. § 1843(k), as it existed on January 1, 2025. (B) "Financial product or service" includes a financial institution’s evaluation or brokerage of information that a financial institution collects in connection with a request or an application from a consumer for a financial product or service. (9) "Information security program" means the administrative, technical, or physical safeguards a financial institution uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information. (10) "Information system" means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information, including any specialized system such as industrial controls systems or process controls systems, telephone switching and private branch exchange systems, and environmental controls systems, that contains customer information or that is connected to a system that contains customer information. (11) "Multi-factor authentication" means authentication through verification of at least two of the following types of authentication factors: (A) knowledge factors, including without limitation a password; (B) possession factors, including without limitation a token; or (C) inherence factors, including without limitation biometric characteristics. (12)(A) "Nonpublic personal information" means: (i) personally identifiable financial information; and (ii) a list, description, or other grouping of consumers, and publicly available information pertaining to a consumer, that is derived using personally identifiable financial information that is not publicly available. (B) "Nonpublic personal information" includes without limitation a list of individuals’ names and street addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available. (C) "Nonpublic personal information" does not include: (i) publicly available information except as included on a list described in subdivision (12)(A)(ii); (ii) a list, description, or other grouping of consumers, and publicly available information pertaining to the list, description, or other grouping of consumers, that is derived without using personally identifiable financial information that is not publicly available; or (iii) a list of individuals’ names and addresses that contains only publicly available information and is not: (a) derived, in whole or in part, using personally identifiable financial information that is not publicly available; and (b) disclosed in a manner that indicates that any of the individuals on the list is a consumer of a financial institution. (13)(A) "Notification event" means acquisition of unencrypted customer information without the authorization of an individual to which the information pertains. (B) For purposes of subdivision (13)(A): (i) customer information is considered unencrypted if the encryption key was accessed by an unauthorized person; and (ii) unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless a financial institution has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of the customer information. (14) "Penetration testing" means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside a financial institution’s information systems. (15)(A) "Personally identifiable financial information" means information: (i) a consumer provides to a financial institution to obtain a financial product or service from a financial institution; (ii) about a consumer resulting from a transaction involving a financial product or service between a financial institution and a consumer; or (iii) a financial institution otherwise obtains about a consumer in connection with providing a financial product or service to that consumer. (B) "Personally identifiable financial information" includes: (i) information a consumer provides to a financial institution on an application to obtain a loan, credit card, or other financial product or service; (ii) account balance information, payment history, overdraft history, and credit or debit card purchase information; (iii) the fact that an individual is or has been a financial institutions’ customer or has obtained a financial product or service from a financial institution; (iv) information about a financial institution’s consumer if the information is disclosed in a manner that indicates that the individual is or has been the financial institution’s consumer; (v) information that a consumer provides to a financial institution or that a financial institution or a financial institution’s agent otherwise obtains in connection with collecting on, or servicing, a credit account; (vi) information a financial institution collects through an internet cookie or the information collecting device from a computer server; and (vii) information from a consumer report. (C) "Personally identifiable financial information" does not include: (i) a list of names and addresses of customers of an entity that is not a financial institution; and (ii) information that does not identify a consumer, including aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. (16)(A) "Publicly available information" means information that a financial institution has a reasonable basis to believe is lawfully made available to the public from: (i) federal, state, or local government records; (ii) widely distributed media; or (iii) disclosures to the public that are required to be made by federal, state, or local law. (B) "Publicly available information" includes without limitation: (i) information in government records, including information in government real estate records and security interest filings; and (ii)(a) information from widely distributed media, including information from a telephone book, a television or radio program, a newspaper, or a website that is available to the public on an unrestricted basis. (b) A website is not restricted under subdivision (16)(B)(ii)(a) merely because an Internet service provider or a site operator requires a fee or a password, so long as access is available to the public. (C) For purposes of this subdivision (16), a financial institution has a reasonable basis to believe that: (i) information is lawfully made available to the public if the financial institution has taken steps to determine: (a) that the information is of the type that is available to the public; and (b) whether an individual can direct that the information not be made available to the public and, if so, that the financial institution’s consumer has not directed that the information not be made available to the public; (ii) mortgage information is lawfully made available to the public if the financial institution determines that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded; and (iii) an individual’s telephone number is lawfully made available to the public if the financial institution has located the telephone number in a telephone directory or the consumer has informed the financial institution that the telephone number is not unlisted. (17) "Qualified individual" means an individual designated by a financial institution to oversee, implement, and enforce the financial institution’s information security program. (18) "Security event" means an event resulting in unauthorized access to, or disruption or misuse of: (A) an information system or information stored on the information system; or (B) customer information held in physical form. (19) "Service provider" means a person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution that is subject to this subchapter.

Ark. Code Ann. § 23-55-1102 Standards for safeguarding customer information.

(a) A financial institution shall develop, implement, and maintain a comprehensive information security program. (b) The information security program under subsection (a) of this section shall: (1) be written in one or more readily accessible parts; and (2) contain administrative, technical, and physical safeguards that are appropriate to the financial institution’s size and complexity, the nature and scope of the financial institution’s activities, and the sensitivity of any customer information at issue. (c) The information security program shall include the information required under § 23-55-1103.

Ark. Code Ann. § 23-55-1103 Information security program required elements.

(a) In order for a financial institution to develop, implement, and maintain an information security program, the financial institution shall comply with this section. (b)(1) A financial institution shall designate a qualified individual responsible for overseeing and implementing the financial institution’s information security program and enforcing an information security program. (2)(A) The qualified individual may be employed by the financial institution, an affiliate, or a service provider. (B) If a financial institution designates an individual employed by an affiliate or service provider, the financial institution shall: (i) retain responsibility for compliance with this section; (ii) designate a senior member of the financial institution’s personnel to be responsible for direction and oversight of the qualified individual; and (iii) require the service provider or affiliate to maintain an information security program that protects the financial institution in accordance with the requirements of this section. (c)(1) A financial institution shall base the financial institution’s information security program on a risk assessment that: (A) identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of the information; and (B) assesses the sufficiency of any safeguards in place to control these risks. (2) The risk assessment shall be written and include: (A) criteria for the evaluation and categorization of identified security risks or threats the financial institution faces; (B) criteria for the assessment of the confidentiality, integrity, and availability of the financial institution’s information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats the financial institution faces; and (C) requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks. (3) A financial institution shall periodically perform additional risk assessments that: (A) reexamine the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of customer information; and (B) reassess the sufficiency of any safeguards in place to control these risks. (d) A financial institution shall design and implement safeguards to control the risks the financial institution identifies through the risk assessment as required under subsection (c), including without limitation: (1) implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls, to: (A) authenticate and permit access only to authorized users to protect against the unauthorized acquisition of customer information; and (B) limit authorized users’ access only to customer information that the authorized user needs to perform the authorized user’s duties and functions, or in the case of customers, to access the customer’s own customer information; (2) identifying and managing the data, personnel, devices, systems, and facilities that enable the financial institution to achieve business purposes according to the financial institution's relative importance to business objectives and the financial institution’s risk strategy; (3)(A) protecting by encryption all customer information held or transmitted by the financial institution both in transit over external networks and at rest. (B) to the extent the financial institution determines that encryption of customer information, either in transit over external networks or at rest, is infeasible, the financial institution may instead secure the customer information using effective alternative compensating controls reviewed and approved by the financial institution’s qualified individual; (4) adopting secure development practices for in-house developed applications utilized by the financial institution for transmitting, accessing, or storing customer information and procedures for evaluating, assessing, or testing the security of externally developed applications the financial institution utilizes to transmit, access, or store customer information; (5) implementing multi-factor authentication for an individual accessing an information system, unless the financial institution’s qualified individual has approved in writing the use of reasonably equivalent or more secure access controls; (6) developing, implementing, and maintaining procedures for the secure disposal of customer information in any format no later than two years after the last date the customer information is used in connection with the provision of a financial product or service to the customer, unless the customer information is: (A) necessary for business operations or for other legitimate business purposes; (B) otherwise required to be retained by state law or rule, or federal law or regulation; or (C) where targeted disposal is not reasonably feasible due to the manner in which the information is maintained; (7) periodically reviewing the financial institution’s data retention policy to minimize the unnecessary retention of data; (8) adopting procedures for change management; and (9) implementing policies, procedures and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by these users. (e)(1) A financial institution shall regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures of the safeguards required under this section, including those to detect actual and attempted attacks on or intrusions into information systems. (2)(A) For information systems, monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments. (B) Absent effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities, the financial institution shall conduct: (i) annual penetration testing of a financial institution’s information systems determined each given year based on relevant identified risks according to the risk assessment; and (ii) vulnerability assessments, including a systemic scan or review of an information system reasonably designed to identify publicly known security vulnerabilities in the financial institution’s information systems based on the risk assessment, at least every six months, and whenever there are: (a) material changes to the financial institution’s operations or business arrangements; and (b) circumstances the financial institution knows or has reason to know may have a material impact on the financial institution’s information security program. (f) A financial institution shall implement policies and procedures to ensure that personnel are able to enact the financial institution’s information security program by: (1) providing the financial institution’s personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment; (2) utilizing qualified information security personnel employed by the financial institution or an affiliate or service provider sufficient to manage the financial institution’s information security risks and to perform or oversee the information security program; (3) providing information security personnel with security updates and training sufficient to address relevant security risks; and (4) verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures. (g) A financial institution shall oversee service providers by: (1) taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; (2) requiring the financial institution’s service providers by contract to implement and maintain the safeguards referenced under subdivision (g)(1); and (3) periodically assessing the financial institution’s service providers based on the risk they present and the continued adequacy of their safeguards. (h) A financial institution shall evaluate and adjust the financial institution’s information security program to reflect: (1) the results of the testing and monitoring required by subsection (e); (2) upon any material change to the financial institution’s operations or business arrangements or other circumstances; (3) the results of risk assessments performed under subdivision (c)(3); and (4) any other circumstances that the financial institution knows or has reason to know may have a material impact on the financial institution's information security program. (i)(1) A financial institution shall establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in the financial institution’s control. (2) The incident response plan under subdivision (i)(1) shall address: (A) the goals of the incident response plan; (B) the internal processes for responding to a security event; (C) the definition of clear roles, responsibilities, and levels of decision-making authority; (D) external and internal communications and information sharing; (E) identification of requirements for the remediation of any identified weaknesses in information systems and associated controls; (F) documentation and reporting regarding security events and related incident response activities; and (G) the evaluation and revision as necessary of the incident response plan following a security event. (j)(1) The financial institution’s qualified individual shall report in writing at least annually, to the financial institution’s board of directors or equivalent governing body. (2) If a board of directors or equivalent governing body does not exist, the report required under subdivision (j)(1) shall be timely presented to a senior officer responsible for the financial institution’s information security program. (3) The report required under subdivision (j)(1) shall include: (A) the overall status of the information security program and the financial institution’s compliance with this section and associated rules; and (B) material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management’s responses to security events or violations, and recommendations for changes in the information security program. (k) A financial institution shall provide notice to the Securities Commissioner about notification events according to subdivisions (l)(1) and (2). (l)(1) Upon discovery of a notification event as described in subdivision (l)(2), if the notification event involves the information of any consumers in this state, the financial institution shall notify the commissioner as soon as possible, and no later than forty-five days after discovery of the notification event. (2) The notice required under subdivision (l)(1) shall: (A) be made in a format specified by the commissioner; and (B) include the following information: (i) the name and contact information of the reporting financial institution; (ii)(a) a description of the types of information that were involved in the notification event. (b) if the information is possible to determine under subdivision (l)(2)(B)(ii)(a), the notice required under subdivision (l)(1) shall contain the date or date range of the notification event; (iii) the number of consumers affected or potentially affected by the notification event; (iv) a general description of the notification event; and (v)(a) whether a law enforcement official has provided the financial institution with a written determination that notifying the public of the notification event would impede a criminal investigation or cause damage to national security, and a means for the commissioner to contact the law enforcement official. (b) A law enforcement official under subdivision (l)(2)(B)(v)(a) may request an initial delay of up to thirty days following the date when notice was provided to the commissioner. (c) The delay under subdivision (l)(2)(B)(v)(b) may be extended for an additional period of up to sixty days if the law enforcement official seeks an extension in writing. (d) An additional delay beyond the delay under subdivision (l)(2)(B)(v)(b) may be permitted only if the State Securities Department determines that public disclosure of a notification event continues to impede a criminal investigation or cause damage to national security. (3)(A) A notification event under this section shall be treated as discovered as of the first day on which the notification event is known to the financial institution. (B) The financial institution under subdivision (l)(3)(A) shall be deemed to have knowledge of a notification event if the notification event is known to a person, other than the person committing the notification event, who is the financial institution’s employee, officer, or other agent. (m) A financial institution shall establish a written plan addressing business continuity and disaster recovery.

Ark. Code Ann. § 23-55-1104 Exceptions.

This article does not apply to a financial institution that maintains customer information concerning fewer than five thousand consumers.

Source: Public.Resource.Org / UniCourt, Official Code of Arkansas Annotated, Release 78 (2020) (unicourt.github.io/cic-code-ar)URL: https://unicourt.github.io/cic-code-ar/transforms/ar/ocar/r78/gov.ar.code.title.23.htmlFetched: 11/8/2026