Mortgage Loan Companies and Loan Brokers

Ark. Code Ann. tit. 23, ch. 39

in effect

Ark. Code Ann. § 23-39-401 Definitions.

For purposes of this subchapter, unless the context otherwise requires: (1) “Advance fee” means any consideration which is assessed or collected prior to the closing of a loan by a loan broker; (2) “Affiliate” means any person who, directly or indirectly, through one (1) or more intermediaries, controls, is controlled by, or is under common control with another person; (3) “Borrower” means a person obtaining or desiring to obtain a loan of money, a credit card, or a line of credit; (4) “Closing of a loan” means completion of the final steps of the transaction, except for the payment of consideration for loan services provided, whereby the borrower has full access to and use of the benefits of the loan of money, a credit card, or a line of credit; (5)(A) “Loan broker” means any person not exempt under subdivision (5)(B) of this section who: (i) For or in expectation of consideration arranges, attempts to arrange, or offers to fund a loan of money, a credit card, or a line of credit; (ii) For or in expectation of consideration assists or advises a borrower in obtaining or attempting to obtain a loan of money, a credit card, a line of credit, or related guarantee, enhancement, or collateral of any kind or nature; (iii) Acts for or on behalf of a loan broker for the purpose of soliciting borrowers; or (iv) Holds himself or herself out as a loan broker. (B) The following persons or entities shall not be considered loan brokers under subdivision (5)(A) of this section: (i) If licensed by and subject to regulation or supervision of any agency, commission, or department of the United States or of the State of Arkansas, and if engaged in the permitted activity granted pursuant to their license, permit, or registration or with express written authority for the activity from the regulatory or supervising agency: (a) Bank; (b) Savings and loan association; (c) Trust company; (d) Credit union; (e) Investment company; (f) Industrial loan company; (g) Securities broker-dealer, agent, or investment adviser; (h) Real estate broker or sales associate; (i) Attorney; (j) Federal Housing Administration or Department of Veterans Affairs approved lender; (k) Credit card company; (l) Mortgage loan company; (m) Mortgage loan broker; (n) Public utility; (o) Insurance company or agent; or (p) Motor vehicle manufacturer or dealer; (ii) Subsidiaries of licensed or chartered consumer loan companies, banks, or savings and loan associations are not loan brokers; (iii) A person extending or arranging credit, or offering to extend or arrange credit, to a partnership or corporation exclusively for commercial or business purposes; (iv) A depository financial institution chartered or licensed by an agency, commission, or department of another state, if the funds on deposit with the institution are insured by the Federal Deposit Insurance Corporation; (v) An affiliate of a person listed in subdivision (5)(B)(iii) of this section; or (vi) A bona fide seller or lessor of goods, services, or interests in real estate in a transaction in which the seller or lessor extends, arranges, or offers to extend or arrange credit that is to be used exclusively for financing the purchase or lease or for services performed by an independent third party directly related to the purchase or lease. A transaction shall not be exempt under this subdivision (5)(B)(vi) if the purchaser or lessee receives, or is to receive, a cash advance or consolidation loan in addition to the financing; and (6) “Principal” means any officer, director, partner, joint venturer, branch manager, or other person with similar managerial or supervisory responsibilities for a loan broker.

Ark. Code Ann. § 23-39-402 Nonexclusive remedy.

Nothing in this subchapter limits the rights or remedies which are otherwise available to a consumer under any other law.

Ark. Code Ann. § 23-39-403 Liability of loan broker's principal.

A principal of a loan broker shall be liable under this subchapter to the same extent as the loan broker himself or herself for any actions on behalf of the loan broker, or the loan broker's agents or employees, which violate this subchapter.

Ark. Code Ann. § 23-39-404 Prohibited acts.

It shall be unlawful for a loan broker to: (1) Assess or collect an advance fee from a borrower to provide services as a loan broker; or (2) Make or use unfair, false, misleading, or deceptive representations or to omit any material fact in the offer or sale of the services of a loan broker, or to engage, directly or indirectly, in any act that operates or would operate as an unfair, false, misleading, or deceptive representation in his or her business dealings.

Ark. Code Ann. § 23-39-405 Remedies and penalties.

(a)(1) A violation of any of the provisions of this subchapter shall constitute an unfair or deceptive act or practice as defined by the Deceptive Trade Practices Act, § 4-88-101 et seq. (2) All remedies, penalties, and authority granted to the Attorney General under the Deceptive Trade Practices Act, § 4-88-101 et seq., shall be available to him or her for the enforcement of this subchapter. (3) In any action brought by the Attorney General pursuant to this subsection, the Attorney General may also recover on behalf of borrowers the amounts specified under subsection (b) of this section. (b)(1) A borrower may bring an action against the loan broker, its principals, employees, or agents, and against the surety bond, or trust account, if any, of the loan broker as a result of a violation of this subchapter. (2) The action shall be brought in the county in which the solicitation was made, and the court shall award: (A) An amount of three (3) times the amount paid by the borrower for the loan services or one thousand dollars ($1,000), whichever is greater; (B) Incidental and consequential damages; and (C) Costs and reasonable attorney's fees. (c) A permanent injunction, judgment, or order of the court obtained by the Attorney General pursuant to this section shall be prima facie evidence in an action brought under this section that the defendant used or employed a method, act, or practice declared unlawful by this subchapter. (d) A person bringing an action under this section shall bring the action within one (1) year after any action brought by the Attorney General has been terminated or two (2) years after the violation occurred, whichever is later. (e)(1) Any person who knowingly commits a practice defined as unlawful by this subchapter shall be guilty of a Class D felony and, upon conviction in the circuit court of any county in this state in which any portion of the unlawful practice occurred, shall be subject to punishment accordingly. (2) If the person is a corporation, the penalties of this subsection also apply to a director, officer, or individual agent of a corporation who knowingly authorizes, orders, or performs an act in violation of this subchapter without regard to penalties imposed on the corporation.

Ark. Code Ann. § 23-39-501 Title.

This subchapter may be referred to as the “Fair Mortgage Lending Act”.

Ark. Code Ann. § 23-39-503 License required — Licensee records.

(a) It is unlawful for any person located in Arkansas other than an exempt person to act or attempt to act, directly or indirectly, as a mortgage broker, mortgage banker, loan officer, transitional loan officer, or mortgage servicer without first obtaining a license from the Securities Commissioner under this subchapter. (b) It is unlawful for any person other than an exempt person to act or attempt to act, directly or indirectly, as a mortgage broker, mortgage banker, loan officer, transitional loan officer, or mortgage servicer with any person located in Arkansas without first obtaining a license from the commissioner under this subchapter. (c) It is unlawful for any person other than an exempt person to employ, to compensate, or to appoint as its agent any person to act as a loan officer unless the loan officer is licensed as a loan officer or a transitional loan officer under this subchapter. (d)(1)(A) If the employment of a loan officer or transitional loan officer is surrendered or canceled, then the sponsor shall terminate the sponsorship of the loan officer or transitional loan officer with the commissioner within thirty (30) days from the date that the loan officer or transitional loan officer ceased to be employed or ceased activities for the sponsor. (B) The termination of a sponsorship extinguishes the right of the loan officer or transitional loan officer to engage in any mortgage loan activity. (2) Upon receipt of a termination of sponsorship, the license of a loan officer shall be designated as approved-inactive until a licensed mortgage broker or mortgage banker files an application with the commissioner to sponsor the loan officer under § 23-39-506(c). (3)(A) A licensee that does not comply with subdivision (d)(1)(A) of this section shall pay a late fee of two hundred fifty dollars ($250) for failure to timely notify the commissioner. (B) The late fee may be waived, in whole or in part, at the sole discretion of the commissioner and for good cause shown. (4) A loan officer or a transitional loan officer shall not be employed simultaneously by more than one (1) mortgage broker or mortgage banker licensed under this subchapter. (e) Each mortgage broker and mortgage banker licensed under this subchapter shall maintain a list of all loan officers and all transitional loan officers employed by the mortgage broker or mortgage banker and who engage or attempt to engage in business with any person in Arkansas. (f) No person other than an exempt person shall hold himself or herself out as a mortgage banker, mortgage broker, mortgage servicer, loan officer, or transitional loan officer unless the person is licensed in accordance with this subchapter.

Ark. Code Ann. § 23-39-504 Authority.

(a) The Securities Commissioner may adopt any rules that he or she deems necessary to: (1) Carry out the provisions of this subchapter; (2) Provide for the protection of the borrowing public; (3) Provide any requirements necessary for the State of Arkansas to participate in a multistate automated licensing system; and (4) Instruct mortgage brokers, mortgage bankers, mortgage servicers, loan officers, and transitional loan officers in interpreting this subchapter. (b) The commissioner may: (1) If risk is determined by a formal review of a specific covered institution servicer to be extremely high, order or direct the covered institution servicer to satisfy additional conditions necessary to ensure that the covered institution servicer will continue to operate in a safe and sound manner and be able to continue to service loans in compliance with state law or rule and federal law or regulations; (2) If risk is determined by a formal review of a specific covered institution servicer to be extremely low, provide notice that all or part of this subchapter is not applicable to the covered institution servicer; and (3) If economic, environmental, or societal events are determined to be of severity to warrant a temporary suspension of all or certain sections of this subchapter, provide public notice of the temporary suspension.

Ark. Code Ann. § 23-39-506 License renewal — Termination.

(a) A licensed mortgage broker, mortgage banker, and mortgage servicer wishing to renew a license shall: (1) File a renewal application with the Securities Commissioner in the form prescribed by the commissioner between November 1 and December 31 of the calendar year; (2) Present proof to the commissioner that the surety bond required in § 23-39-505(f)(1) is still in effect; and (3) Pay the commissioner an annual renewal fee of three hundred fifty dollars ($350) for the licensee's principal place of business and one hundred dollars ($100) for each of the licensee's branch offices. (b) The failure of a mortgage broker, mortgage banker, or mortgage servicer to timely file a renewal application shall subject the licensee to a late fee of one hundred dollars ($100). (c)(1) Each licensed loan officer wishing to renew a license shall: (A) File an application with the commissioner in the form prescribed by the commissioner between November 1 and December 31 of the calendar year; (B) Comply with the continuing education requirements as required by rules promulgated by the commissioner; and (C) Pay an annual renewal fee of fifty dollars ($50.00). (2) If an initial loan officer license is issued between November 1 through December 31 of the calendar year, the loan officer is not required to file a renewal application until the subsequent renewal period. (3) A license of a loan officer may change from approved- inactive to approved if, before the license of the loan officer terminates, a licensed mortgage broker or mortgage banker: (A) Files an application for sponsorship of the license of the loan officer; (B) Pays a fee of fifty dollars ($50.00); and (C) Provides notice to the commissioner that the licensed mortgage broker or mortgage banker is sponsoring the loan officer. (d) The failure of a loan officer to timely file a renewal application shall subject the loan officer to a late fee of fifty dollars ($50.00). (e)(1)(A) A late fee assessed under subsection (b) or subsection (d) of this section shall be in addition to the renewal application fee under subsection (a) or subsection (c) of this section. (B) All or part of the late fee may be waived by the commissioner for good cause. (2)(A) The commissioner may consider an application and a license to be abandoned and surrendered and may require the licensee to comply with the requirements for the initial issuance of a license under this subchapter in order to continue in business if the licensee: (i) Fails to file a renewal application within fifteen (15) days after the date the renewal application is due; (ii) Unreasonably fails to remedy any deficiency in an application within thirty (30) days following the sending of written notice to the licensee; or (iii) Unreasonably fails to deliver additional information or documents to the commissioner within thirty (30) days following the sending of written notice to the licensee. (B) For purposes of this subdivision (e)(2), notice shall be complete upon: (i) Deposit in the United States mail, postage prepaid, to the address of the licensee listed in the application; or (ii) Delivery through an automated licensing system approved by the commissioner. (3) The commissioner shall not reissue a license for which a late fee has accrued as a result of a person's failure to timely file a renewal application unless the late fee has been paid or waived by the commissioner for good cause. (f)(1) A mortgage banker shall submit audited financial statements to the commissioner within ninety (90) days after the end of the mortgage banker's fiscal year. (2) The audited financial statements submitted to the commissioner under subdivision (f)(1) of this section shall: (A) Reflect that the mortgage banker has a net worth of at least twenty-five thousand dollars ($25,000); and (B) Comply with the requirements of § 23-39-505(g). (3)(A) Failure to timely submit audited financial statements to the commissioner shall result in a late fee of two hundred fifty dollars ($250). (B) All or part of the late fee may be waived by the commissioner for good cause. (g)(1) A mortgage servicer subject to § 23-39-505(p) or § 23-39-505(q) shall submit audited financial statements to the commissioner within ninety (90) days after the end of the mortgage servicer's fiscal year. (2) The audited financial statements submitted to the commissioner under subdivision (g)(1) of this section shall reflect that the mortgage servicer has a net worth that remains in compliance with § 23-39-505(p) or § 23-39-505(q), as applicable. (3)(A) A licensee servicing Arkansas residential mortgage loans, other than a covered institution servicer, may apply to the commissioner to waive or adjust one (1) or more of the net worth requirements. (B) In considering a request to waive or adjust one (1) or more of the net worth requirements, the commissioner shall consider the number and types of loans being serviced and whether the licensee has a positive net worth and adequate operating reserves. (C) For purposes of this section, “operating reserves” means the funds set aside in anticipation of future payments or obligations and are included in liquidity. (4)(A) Failure to timely submit audited financial statements to the commissioner shall result in a late fee of two hundred fifty dollars ($250). (B) All or part of the late fee may be waived by the commissioner for good cause. (h) A covered institution servicer shall remain in compliance with the requirements of § 23-39-505(q) and § 23-39-519.

Ark. Code Ann. § 23-39-507 Continuing education.

(a) In addition to the other licensing requirements under this subchapter, the Securities Commissioner may adopt rules to require continuing education of licensees under this subchapter for the purpose of enhancing the professional competence and professional responsibility of mortgage bankers, mortgage brokers, mortgage servicers, and loan officers and may condition the renewal of a license upon compliance with the commissioner's rules. (b) The rules under subsection (a) of this section may include criteria for: (1) The content of continuing education courses; (2) Accreditation of continuing education sponsors and programs; (3) Accreditation of videotape or other audiovisual programs; (4) Computation of credit; (5) Special cases and exemptions; (6) General compliance procedures; and (7) Sanctions for noncompliance with the continuing education requirements. (c) Annual continuing professional education requirements shall be determined by the commissioner but shall not exceed eight (8) credit hours within a one-year period.

Ark. Code Ann. § 23-39-508 Managing principals and branch managers.

(a)(1) Each mortgage broker, mortgage banker, or mortgage servicer licensed under this subchapter shall have a managing principal who operates the business under that person's full charge, control, and supervision. (2) The managing principal shall: (A) Have at least three (3) years of experience in mortgage lending; or (B) Meet the experience and competency requirements prescribed by rule or order of the Securities Commissioner. (b) Any individual licensee who operates as a sole proprietorship shall be considered a managing principal for the purposes of this subchapter. (c) The managing principal for a licensee may also serve as the branch manager of one (1) or more of the licensee's branch offices. (d)(1) Each branch office of a mortgage broker, mortgage banker, or mortgage servicer licensed under this subchapter shall have a designated branch manager who is in charge of and who is responsible for the business operations of a branch office. (2) Each branch manager of a mortgage broker or mortgage banker must be licensed as a loan officer. (e) Each mortgage broker, mortgage banker, or mortgage servicer licensed under this subchapter shall file a form as prescribed by the Securities Commissioner indicating the licensee's designation of managing principal and branch manager for each branch and each individual's acceptance of the responsibility as managing principal or branch manager. (f) Each mortgage broker, mortgage banker, or mortgage servicer licensed under this subchapter shall notify the commissioner within thirty (30) days of any change in its managing principal or branch manager designated for each branch. (g)(1) A mortgage broker, mortgage banker, or mortgage servicer that does not comply with this section shall pay a late fee of two hundred fifty dollars ($250). (2) All or part of the late fee may be waived by the commissioner for good cause. (3) The commissioner may revoke or suspend the license of any mortgage broker, mortgage banker, or mortgage servicer who fails to pay any late fee assessed under subdivision (g)(1) of this section.

Ark. Code Ann. § 23-39-509 Offices — Address changes — Location of records.

(a) A mortgage broker, mortgage banker, and mortgage servicer shall maintain a principal place of business. (b) A mortgage broker, mortgage banker, and mortgage servicer shall identify the location in which the licensee's books, records, and files pertaining to mortgage loan transactions are maintained. (c) The Securities Commissioner by rule may impose terms and conditions under which the records and files shall be maintained, including if the records must be maintained in this state. (d)(1) A principal place of business or branch office from which a mortgage broker, mortgage banker, or mortgage servicer conducts mortgage loan activity or business shall be a physical address. (2) Mortgage loan activity or business includes without limitation the address appearing on business cards, stationery, promotional materials, or advertising. (3) The commissioner may by rule or order impose terms and conditions under which a loan officer may conduct mortgage loan activity or business from a location that is not licensed under this subchapter as a principal place of business or branch office. (e)(1) A mortgage banker, mortgage broker, or mortgage servicer shall not use any name or address to conduct mortgage loan activity or business other than the name and address specified on the license issued by the commissioner. (2) A mortgage broker, mortgage banker, or mortgage servicer may change the name of the licensee or address of the principal place of business or branch office specified on the most recent filing with the commissioner if: (A)(i) At least thirty (30) calendar days before the change, the licensee files a notice of the change with the commissioner. (ii) If necessary, the licensee shall provide a bond rider or endorsement, or addendum, as applicable, to the surety bond on file with the commissioner that reflects the new name or change of address of the licensee's principal place of business; and (B) The commissioner does not disapprove the name change or the change of address in writing or request additional information within the thirty-day time frame described in subdivision (e)(2)(A)(i) of this section. (f) A mortgage broker, mortgage banker, or mortgage servicer that ceases to do business in this state shall: (1) Notify the commissioner within thirty (30) days after the mortgage broker, mortgage banker, or mortgage servicer ceases to do business in this state that the mortgage broker, mortgage banker, or mortgage servicer has ceased to do business in this state; and (2) Provide the commissioner the address where all records pertaining to loans made or serviced in this state will be maintained for the period of time required by this subchapter or rule of the commissioner.

Ark. Code Ann. § 23-39-510 Licensee duties.

(a) In addition to duties imposed by other statutory or common law, a person required to be licensed under this subchapter shall: (1) Safeguard and account for any money received for, from, or on behalf of the borrower; (2) Follow reasonable and lawful instructions from the borrower; (3) Act with reasonable skill, care, and diligence; (4) Make reasonable efforts with lenders with whom a mortgage broker regularly does business to secure a loan that is reasonably advantageous to the borrower considering all the circumstances, including the rates, charges, and repayment terms of the loan and the loan options for which the borrower qualifies with such lenders; (5) Include the full name, address, and telephone number of the licensee in all solicitations and advertisements; and (6)(A) Provide the Securities Commissioner with a quarterly report of mortgage activity. (B) The commissioner may designate by rule or order the information to be provided in the quarterly report. (b) At the time a mortgage servicer accepts assignment of servicing rights for a mortgage loan in this state, the mortgage servicer shall disclose to the borrower the following: (1) Any notice required by the Real Estate Settlement Procedures Act of 1974, 12 U.S.C. § 2601 et seq., as it existed on January 1, 2017, or by regulations promulgated thereunder; and (2) A notice in a clear and conspicuous form and content that the mortgage servicer is licensed in Arkansas and that complaints about the mortgage servicer may be submitted to the commissioner. (c) The unique identifier of a person soliciting or originating a mortgage loan shall be clearly shown on all mortgage loan application forms, solicitations, advertisements, business cards, websites, and any other document or medium established by rule or order of the commissioner. (d)(1) A mortgage broker, mortgage banker, or mortgage servicer licensed or required to be licensed under this subchapter shall establish, implement, update, and enforce written physical security and cybersecurity policies and procedures reasonably designed to ensure the confidentiality, integrity, and availability of physical and electronic records and information. (2) A policy or procedure described in subdivision (d)(1) of this section shall be tailored to the size and sophistication of the mortgage broker, mortgage banker, or mortgage servicer. (3) The commissioner may impose additional conditions by rule or order to clarify the requirements of a policy or procedure described in subdivision (d)(1) of this section. (e) A mortgage broker, mortgage banker, or mortgage servicer shall establish, enforce, and maintain policies and procedures reasonably designed to achieve compliance with this subchapter and any other state law or rule or federal law or regulation that is applicable to any business the licensee is authorized to conduct in this state.

Ark. Code Ann. § 23-39-511 Records — Escrow funds or trust accounts.

(a) The Securities Commissioner shall keep a list of all applicants for licensure under this subchapter that includes: (1) The applicant's name; (2) The date of application; (3) The applicant's place of residence; and (4) Whether the license was granted or refused. (b)(1) The commissioner shall keep a current roster showing the names and places of business of all licensees that shows their respective loan officers and their respective transitional loan officers. (2) The roster under subdivision (b)(1) of this section shall: (A) Be kept on file in the office of the commissioner; (B) Contain information regarding all orders or other actions taken against the licensees and other persons; and (C) Be open to public inspection. (c) Every licensee shall make and keep the accounts, correspondence, memoranda, papers, books, and other records as prescribed in rules adopted by the commissioner. (d)(1) If the information contained in any document filed with the commissioner is or becomes inaccurate or incomplete in any material respect, the licensee shall file a correcting amendment to the information contained in the document within thirty (30) days from the date on which the change takes place. (2)(A) Any licensee that does not comply with subdivision (d)(1) of this section shall pay a late fee of two hundred fifty dollars ($250). (B) All or part of the late fee may be waived by the commissioner for good cause. (e)(1) A licensee shall maintain in a segregated escrow fund or trust account any funds that come into the licensee's possession but that are not the licensee's property and which the licensee is not entitled to retain under the circumstances. (2) The escrow fund or trust account under subdivision (e)(1) of this section shall be held on deposit in a federally insured financial institution.

Ark. Code Ann. § 23-39-512 Public inspection of records — Exceptions.

(a)(1) Unless otherwise specified in this section, all information filed with the Securities Commissioner shall be available for public inspection. (2) The information contained in or filed with any application or report may be made available to the public under any rules the commissioner prescribes that are consistent with state or federal law governing the disclosure of public information. (b) Except for reasonably segregable portions of information and records that by law would be made routinely available to a party in litigation with the commissioner, the commissioner shall not publish or make available the following information: (1) Information contained in reports, summaries, analyses, letters, or memoranda arising out of, in anticipation of, or in connection with an examination or inspection of the books and records of any person or any other investigation; (2) Interagency or intra-agency memoranda or letters, including: (A) Generally, records that reflect discussions between or consideration by the commissioner or members of the staff of the State Securities Department or the staff of the Department of Commerce working for the State Securities Department, or both, of any action taken or proposed to be taken by the commissioner or by any members of the staff of the State Securities Department or the staff of the Department of Commerce working for the State Securities Department; and (B) Specifically, reports, summaries, analyses, conclusions, or any other work product of the commissioner or of attorneys, accountants, analysts, or other members of the commissioner's staff, prepared in the course of an inspection of the books or records of any person whose affairs are regulated by the commissioner or prepared otherwise in the course of an examination or investigation or related litigation conducted by or on behalf of the commissioner; (3) Personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy, including: (A) Information concerning all employees of the State Securities Department or the Department of Commerce working for the State Securities Department and information concerning persons subject to regulation by the State Securities Department; and (B) Personal information about employees of mortgage brokers, mortgage bankers, mortgage servicers, loan officers, or transitional loan officers reported to the commissioner under the State Securities Department's rules concerning registration of those persons; (4)(A) Investigatory records compiled for law enforcement purposes to the extent that production of the records would: (i) Interfere with enforcement proceedings; (ii) Deprive a person of a right to a fair trial or an impartial adjudication; or (iii) Disclose the identity of a confidential source. (B) The commissioner may also withhold investigatory records that would: (i) Constitute an unwarranted invasion of personal privacy; (ii) Disclose investigative techniques and procedures; or (iii) Endanger the life or physical safety of law enforcement personnel. (C) Investigatory records under this section include: (i) All documents, records, transcripts, correspondence, and related memoranda and work products concerning examinations and other investigations and related litigation as authorized by law that pertain to or may disclose the possible violations by any person of any provision of any of the statutes or rules administered by the commissioner; and (ii) All written communications from or to any person confidentially complaining or otherwise furnishing information respecting the possible violations, as well as all correspondence and memoranda in connection with the confidential complaints or information; (5) Information contained in or related to examinations, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions or mortgage lenders; (6)(A) Financial records of mortgage bankers, mortgage brokers, mortgage servicers, loan officers, or transitional loan officers, obtained during or as a result of an examination by the State Securities Department. (B) However, when a record under this subchapter is required to be filed with the commissioner as part of an application for license, annual renewal, or otherwise, the record, including financial statements prepared by certified public accountants, shall be public information unless sections of the information are bound separately and are marked “confidential” by the mortgage banker, mortgage broker, mortgage servicer, loan officer, or transitional loan officer upon its submission. (C) Information under subdivision (6)(B) of this section bound separately and marked “confidential” shall be considered nonpublic until ten (10) days after the commissioner has given the mortgage banker, mortgage broker, mortgage servicer, loan officer, or transitional loan officer notice that an order will be entered declaring the material public. (D) If the mortgage banker, mortgage broker, mortgage servicer, loan officer, or transitional loan officer believes the commissioner's order is incorrect, the mortgage banker, mortgage broker, mortgage servicer, loan officer, or transitional loan officer may seek an injunction from the Pulaski County Circuit Court ordering the State Securities Department to hold the information as nonpublic pending a final order from a court of competent jurisdiction if the order of the commissioner is appealed under applicable law; (7) Trade secrets obtained from any person; or (8) Any other records that are required to be closed to the public and are not considered open to public inspection under the Freedom of Information Act of 1967, § 25-19-101 et seq., or under other law. (c) This section does not prevent the commissioner from sharing with other state or federal law enforcement authorities, regulatory authorities, or self-regulatory organizations authorized by law any information that the commissioner may have or may obtain in aid of the enforcement of this subchapter or any other state or federal law. (d)(1) Except as otherwise provided in this subchapter, the requirements of any federal or state law regarding privacy or confidentiality of any information or material provided to an automated licensing system under this subchapter and any privilege arising under federal or state law, including the rules of any federal or state court with respect to the information or material, shall continue to apply to the information or material after the information or material has been disclosed to the automated licensing system. (2) The information or material provided to an automated licensing system under this subchapter may be shared with a state or federal regulatory official with mortgage industry oversight authority without the loss of privilege or the loss of confidentiality protections provided by federal or state law.

Ark. Code Ann. § 23-39-513 Prohibited activities.

In addition to the other activities that are prohibited under this subchapter, it is unlawful for any person other than a person described in § 23-39-502(9)(B)(vi) in the course of any mortgage loan transaction or activity: (1) To misrepresent or conceal any material fact or make any false promise likely to influence, persuade, or induce an applicant for a mortgage loan or a borrower to take a mortgage loan or to pursue a course of misrepresentation through agents or otherwise; (2) To improperly refuse to issue a satisfaction or release of a mortgage; (3) To fail to account for or to deliver to any person any funds, documents, or other thing of value obtained in connection with a mortgage loan, including money provided by a borrower for a real estate appraisal or a credit report, that the mortgage banker, mortgage broker, mortgage servicer, loan officer, or transitional loan officer is not entitled to retain; (4) To pay, receive, or collect, in whole or in part, any commission, fee, or other compensation for brokering a mortgage loan in violation of this subchapter, including a mortgage loan brokered or solicited by any unlicensed person other than an exempt person; (5) To advertise mortgage loans, including rates, margins, discounts, points, fees, commissions, or other material information without disclosing the lengths of the loans, whether the interest rates are fixed or adjustable, and any other material limitations on the loans; (6) To fail to disburse funds in accordance with a written commitment or agreement to make or service a mortgage loan; (7) In connection with the advertisement, solicitation, brokering, making, servicing, purchase, or sale of any mortgage loan, to engage in any transaction, practice, or course of business that: (A) Is not in good faith or fair dealing; (B) Is misleading or deceptive; or (C) Constitutes a fraud upon any person; (8)(A) To broker or make a residential mortgage loan that contains a penalty for prepayment if the prepayment is made after the expiration of the thirty-six-month period immediately following the date on which the loan was made. (B) A penalty for prepayment under subdivision (8)(A) of this section made within the thirty-six-month period shall not exceed any of the following amounts: (i) Three percent (3%) of the principal loan amount remaining on the date of prepayment if the prepayment is made within the first twelve-month period immediately following the date the loan was made; (ii) Two percent (2%) of the principal loan amount remaining on the date of prepayment if the prepayment is made within the second twelve-month period immediately following the date the loan was made; or (iii) One percent (1%) of the principal loan amount remaining on the date of prepayment if the prepayment is made within the third twelve-month period immediately following the date the loan was made; (9)(A) To influence or attempt to influence through coercion, extortion, or bribery the development, reporting, result, or review of a real estate appraisal sought in connection with a mortgage loan. (B) This subdivision (9) does not prohibit a mortgage broker or mortgage banker from asking the appraiser to do one (1) or more of the following: (i) Consider additional appropriate property information; (ii) Provide further detail, substantiation, or explanation for the appraiser's value conclusion; or (iii) Correct errors in the appraisal report; (10) To broker or make a refinancing of a residential mortgage loan when the refinancing charges additional points and fees, within a twelve-month period after the original loan agreement was signed, unless the refinancing results in a reasonable, tangible net benefit to the borrower, considering all of the circumstances surrounding the refinancing; (11) To broker, make, or service a mortgage loan in violation of any federal law or any law of this state; (12) To engage in practices that are dishonest or unethical in the mortgage industry; (13) To unreasonably fail to deliver or provide information or documents promptly to the commissioner upon written request or to knowingly withhold, abstract, remove, mutilate, destroy, or secrete any books, records, computer records, or other information; (14) To unreasonably fail to supervise the branches, loan officers, transitional loan officers, and employees of the mortgage broker, mortgage banker, or mortgage servicer; (15) To fail to make payments in a timely manner from an escrow account held for the borrower to pay insurance, taxes, and other charges concerning the mortgage property without good cause, and the failure to pay results in late penalties or other negative activity; (16) To place hazard, homeowners, or flood insurance on a mortgaged property: (A) Without providing prior written notice to the borrower; (B) If the mortgage servicer knows or has reason to know that adequate insurance coverage already exists; or (C) In an amount that unreasonably exceeds the value of the insurable improvements or the last-known coverage amount or policy limits of insurance; or (17)(A) To fail to refund to the borrower unearned premiums paid by or charged to a borrower for hazard, homeowners, or flood insurance placed by a mortgage banker or mortgage servicer if reasonable proof is available or provided that the borrower had or obtained coverage in effect resulting in the unnecessary placement of forced insurance. (B) The borrower shall receive a refund of excess premium funds taken from the borrower when reasonable proof is provided within twelve (12) months of the forced placement. (18) To use a mortgage trigger lead in a misleading or deceptive manner by, including without limitation: (A) Failing to state in the initial communication with a consumer: (i) The loan officer's name and the mortgage broker or mortgage banker on behalf of whom the loan officer is acting; (ii) A brief explanation of how the loan officer or his or her sponsor obtained the consumer's contact information to make the communication, or an explanation of a mortgage trigger lead; (iii) That the solicitation is based on personal information about the consumer that was purchased, directly or indirectly, from a consumer reporting agency without the knowledge or permission of the lender, mortgage broker, or mortgage banker with whom the consumer initially applied; (iv) That the loan officer and his or her sponsor is not affiliated with the creditor to which the consumer made the credit application that resulted in the mortgage trigger lead; (v) That the purpose of the communication is to solicit new business for the sponsor; and (vi) To make a firm offer of credit as provided by the Fair Credit Reporting Act, 15 U.S.C. § 1681b(e), as it existed on January 1, 2025; (B) Soliciting or contacting a consumer who has opted out of prescreened offers of credit under the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., as it existed on January 1, 2025; (C) Placing a telephone call to a consumer who has placed his or her contact information on a national "Do-Not-Call" registry established and maintained by the Federal Trade Commission under 16 C.F.R. § 310.4, as it existed on January 1, 2025; or (D) Knowingly using information from a mortgage trigger lead in violation of this subdivision (18) or the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., as it existed on January 1, 2025.

Ark. Code Ann. § 23-39-515 Review of order of the commissioner.

(a)(1) Any person aggrieved by a final order of the Securities Commissioner may obtain a review of the order by filing in the Pulaski County Circuit Court within sixty (60) days after the entry of the order a written petition praying that the order be modified or set aside in whole or in part. (2)(A) A copy of the petition shall be served upon the commissioner, after which the commissioner shall certify and file in court a copy of the filing and evidence upon which the order was entered. (B) When a petition under subdivision (a)(1) of this section has been filed, the court has exclusive jurisdiction to affirm, modify, enforce, or set aside any order of the commissioner in whole or in part, except that a court may not set aside a summary order entered by the commissioner when the subject of the order has not requested a hearing before the commissioner as provided in § 23-39-514(c)(1) or (d)(1). (b)(1) The findings of the commissioner as to the facts are conclusive if supported by competent, material, and substantial evidence. (2) If either party applies to the court for leave to submit additional material evidence and shows to the satisfaction of the court that there were reasonable grounds for failure to submit the evidence in the hearing before the commissioner, the court may order the additional evidence to be taken before the commissioner and to be submitted upon the hearing before the commissioner in any manner and upon any condition as the court considers to be proper. (3) After consideration of the additional evidence, the commissioner may modify his or her findings and order and shall file in the court the additional evidence together with any modified or new findings or order. (c) Unless specifically ordered by the court, the commencement of proceedings under subsection (a) of this section does not operate as a stay of the commissioner's order.

Ark. Code Ann. § 23-39-516 Criminal penalty.

(a) It is unlawful for any person to make or cause to be made in any document filed with the Securities Commissioner or in any proceeding under this subchapter any statement that is, at the time and in the light of the circumstances under which it is made, false or misleading in any material respect. (b)(1) A person is guilty of a Class B felony if he or she: (A) Willfully violates any provision of this subchapter, except subsection (a) of this section; (B) Willfully violates subsection (a) of this section knowing the statement to be false or misleading in any material respect; or (C) Willfully violates any rule under this subchapter or any order of the commissioner. (2) Each transaction involving the unlawful making or brokering of a mortgage loan is a separate offense. (c) No person may be imprisoned for violation of any order of the commissioner unless the person had actual knowledge of the order. (d) The commissioner may refer any available evidence concerning violations of this subchapter or any rule or order issued under this subchapter to the appropriate prosecuting authority who, with or without the reference, may institute the appropriate criminal proceedings under this subchapter. (e) This subchapter does not limit the power of the state to punish any person for any conduct that constitutes a crime under any statute or common law.

Ark. Code Ann. § 23-39-518 Cooperation with other regulatory agencies.

(a) The Securities Commissioner may: (1) Enter into an arrangement, agreement, or other working relationship with federal, state, or self-regulatory authorities, the Conference of State Bank Supervisors, or a subsidiary of the Conference of State Bank Supervisors to file and maintain documents in a multistate automated licensing system or other central depository system; (2) Waive or modify in whole or in part by rule or by order any requirement of this subchapter if necessary to implement this section; and (3) Establish new requirements under this subchapter to carry out the purpose of this section. (b) It is the intent of this section that the commissioner be provided the authority to reduce duplication of filings, reduce administrative costs, and establish uniform procedures, forms, and administration with other states and federal authorities. (c)(1) The commissioner may permit or require initial and renewal registration filings required under this subchapter to be filed with the Conference of State Bank Supervisors, a subsidiary entity owned by the Conference of State Bank Supervisors, the Financial Industry Regulatory Authority, or another entity maintaining or operating a multistate automated licensing system. (2) The applicant or the licensee shall pay any fee charged for the applicant or the licensee to participate in the automated licensing system. (d) The commissioner may accept uniform procedures and forms designed to: (1) Implement a multistate automated licensing system; (2) Implement a uniform national mortgage lending regulatory system; or (3) Facilitate common practices and procedures among the states. (e)(1) If the State of Arkansas joins a multistate automated licensing system for mortgage industry participants pursuant to this section, the commissioner may require a criminal background investigation of each applicant seeking to become licensed under this subchapter as a mortgage broker, mortgage banker, mortgage servicer, loan officer, or transitional loan officer. (2) The criminal background investigation may include a fingerprint examination and may be conducted by the Federal Bureau of Investigation, the Division of Arkansas State Police, or an equivalent state or federal law enforcement department or agency. (3) The information obtained by the background investigation may be used by the commissioner to determine the applicant's eligibility for licensing under this subchapter. (4) The fee required to perform the criminal background investigation shall be borne by the license applicant. (5) Notwithstanding any other law to the contrary, information obtained or held by the commissioner under this subsection: (A) May be disclosed when necessary in any proceeding under this subchapter; (B) May be provided to other state agencies participating in the multistate automatic licensing system; (C) Shall be considered privileged and confidential; and (D) Shall not be available for examination except by the affected applicant for licensure or his or her authorized representative, or by the person whose license is subject to sanctions or his or her authorized representative. (6) No record, file, or document shall be removed from the custody of the Identification Bureau of the Division of Arkansas State Police. (7) Any information made available to the affected applicant for licensure or to the person whose license is subject to sanctions shall be information pertaining to that person only. (8) Rights of privilege and confidentiality established in this section shall not extend to any document created for purposes other than the background check. (9) The commissioner may adopt rules to fully implement the provisions of this section.

Ark. Code Ann. § 23-39-519 Prudential standards for covered institution servicers — Financial condition.

(a) A covered institution servicer shall meet or exceed the minimum financial requirements of the Federal Housing Finance Agency's Eligibility Requirements for Enterprise Single-Family Seller/Servicers in order to maintain the capital and servicing liquidity as required by this section and § 23-39-505(q). (b) All financial data shall be determined according to generally accepted accounting principles or the international financial reporting standards promulgated by the International Financial Reporting Standards Foundation and the International Accounting Standards Board. (c) A covered institution servicer that meets the Federal Housing Finance Agency's Eligibility Requirements for Enterprise Single-Family Seller/Servicers for capital, net worth ratio, and servicing liquidity, whether or not the servicer is approved for government-sponsored enterprises servicing, or Federal National Mortgage Association servicing, or Federal Home Loan Mortgage Corporation servicing, satisfies the requirements of subsection (a) and subsection (b) of this section. (d)(1) A covered institution servicer shall maintain written policies and procedures implementing the capital and servicing liquidity requirements. (2) The policies and procedures under subdivision (d)(1) of this section shall include a sustainable written methodology for satisfying the requirements of subsection (a) of this section and be available to the Securities Commissioner upon request. (e)(1) A covered institution servicer under this subchapter shall: (A) Maintain sufficient allowable assets for liquidity in addition to the amounts required for servicing liquidity to cover normal business operations; and (B) Have in place sound cash management and business operating plans that match the size and sophistication of the covered institution servicer to ensure normal business operations. (2)(A) The management or key individual of a covered institution servicer shall develop, establish, and implement plans, policies, and procedures for maintaining operating liquidity sufficient for the ongoing needs of the covered institution servicer. (B) The plans, policies, and procedures under subdivision (e)(2)(A) of this section shall: (i) Contain sustainable, written methodologies for maintaining sufficient operating liquidity; and (ii) Be available to the commissioner upon request.

Ark. Code Ann. § 23-39-520 Corporate governance for covered institution servicers.

(a) A covered institution servicer shall establish and maintain a board of directors who are responsible for the oversight of the covered institution servicer. (b) For a covered institution servicer that is not approved to service loans by a government-sponsored enterprise, the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation, or the Government National Mortgage Association, or when these federal agencies have granted approval for a board alternative, a covered institution servicer may establish a similar body constituted to exercise oversight and fulfill the board of directors’ responsibilities under subsection (c) of this section. (c) The board of directors shall be responsible for: (1) Establishing a written corporate governance framework, including appropriate internal controls designed to monitor corporate governance and assess compliance with the corporate governance framework, available to the Securities Commissioner upon request; (2) Monitoring and ensuring the covered institution servicer's compliance with the corporate governance framework and this subchapter; and (3) Accurate and timely regulatory reporting, including without limitation the requirements for filing the mortgage call report. (d)(1) The board of directors shall establish internal audit requirements that are appropriate for the size, complexity, and risk profile of the covered institution servicer, with appropriate independence to provide a reliable evaluation of the covered institution servicer’s internal control structure, risk management, and governance. (2) Internal audit requirements established by the board of directors and the results of internal audits shall be made available to the commissioner upon request. (e)(1) A covered institution servicer shall receive an external audit, including audited financial statements and audit reports, conducted by an independent certified public accountant annually. (2) The external audit required under subdivision (e)(1) of this section shall: (A) Be available to the commissioner upon request; and (B) Include at a minimum: (i) Annual financial statements including a balance sheet, statement of operations income statement and cash flows, notes, and supplemental schedules, prepared according to generally accepted accounting principles; (ii) An assessment of the internal control structure; (iii) A computation of tangible net worth; (iv) Validation of mortgage servicing rights valuation and reserve methodology, if applicable; (v) Verification of adequate fidelity and errors and omissions insurance; and (vi) Testing of controls related to risk management activities, including compliance and stress testing, if applicable. (f)(1) A covered institution servicer shall establish a risk management program under the oversight of the board of directors that is available to the commissioner upon request that identifies, measures, monitors, and controls risk sufficient for the level of sophistication of the covered institution servicer. (2) The risk management program required under subdivision (f)(1) of this section shall: (A) Have appropriate processes and models in place to measure, monitor, and mitigate financial risks and changes to the risk profile of the covered institution servicer and assets being serviced; and (B) Be scaled to the complexity of the covered institution servicer, but be sufficiently robust to manage risks in several areas, including without limitation: (i) Credit risk, including the potential that a borrower or counterparty will fail to perform on an obligation; (ii) Servicing liquidity risk, including the potential that the covered institution servicer will be unable to meet the covered institution servicer's obligations as the obligations come due because of an inability to liquidate assets or obtain adequate funding or that it cannot easily unwind or offset specific exposures; (iii) Operational risk, including the risk resulting from inadequate or failed internal processes, people, and systems or from external events; (iv) Market risk, including the risk to the covered institution servicer’s condition resulting from adverse movements in market rates or prices; (v) Compliance risk, including the risk of regulatory sanctions, fines, penalties, or losses resulting from failure to comply with laws, rules, regulations, or other supervisory requirements applicable to a covered institution servicer; (vi) Legal risk, including the potential that actions against the covered institution servicer that result in unenforceable contracts, lawsuits, legal sanctions, or adverse judgments can disrupt or otherwise negatively affect the operations or condition of the covered institution servicer; and (vii) Reputation risk, including the risk to earnings and capital arising from negative publicity regarding the covered institution servicer’s business practices. (g)(1) A covered institution servicer shall conduct a risk management assessment on an annual basis concluding with a formal report to the board of directors and be available to the commissioner upon request. (2) Evidence of risk management activities throughout the year shall be maintained and made part of the report, including findings of issues and the response to address the findings made in the report.

Ark. Code Ann. § 23-39-521 Standards for safeguarding customer information.

(a) A financial institution shall develop, implement, and maintain a comprehensive information security program. (b) The information security program under subsection (a) of this section shall: (1) Be written in one (1) or more readily accessible parts; and (2) Contain administrative, technical, and physical safeguards that are appropriate to the financial institution’s size and complexity, the nature and scope of the financial institution’s activities, and the sensitivity of any customer information at issue. (c) The information security program shall include the information required under § 23-39-522.

Ark. Code Ann. § 23-39-522 Information security program required elements.

(a) In order for a financial institution to develop, implement, and maintain an information security program, the financial institution shall comply with this section. (b)(1) A financial institution shall designate a qualified individual responsible for overseeing and implementing the financial institution’s information security program and enforcing an information security program. (2)(A) The qualified individual may be employed by the financial institution, an affiliate, or a service provider. (B) If a financial institution designates an individual employed by an affiliate or a service provider, the financial institution shall: (i) Retain responsibility for compliance with this section; (ii) Designate a senior member of the financial institution’s personnel to be responsible for direction and oversight of the qualified individual; and (iii) Require the service provider or affiliate to maintain an information security program that protects the financial institution in accordance with the requirements of this section. (c)(1) A financial institution shall base the financial institution’s information security program on a risk assessment that: (A) Identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of the information; and (B) Assesses the sufficiency of any safeguards in place to control these risks. (2) The risk assessment shall be written and include: (A) Criteria for the evaluation and categorization of identified security risks or threats the financial institution faces; (B) Criteria for the assessment of the confidentiality, integrity, and availability of the financial institution’s information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats the financial institution faces; and (C) Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks. (3) A financial institution shall periodically perform additional risk assessments that: (A) Reexamine the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of the customer information; and (B) Reassess the sufficiency of any safeguards in place to control these risks. (d) A financial institution shall design and implement safeguards to control the risks the financial institution identifies through the risk assessment as required under subsection (c) of this section, including without limitation: (1) Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls, to: (A) Authenticate and permit access only to authorized users to protect against the unauthorized acquisition of customer information; and (B) Limit authorized users’ access only to customer information that the authorized user needs to perform the authorized user’s duties and functions, or in the case of customers, to access the customer’s own customer information; (2) Identifying and managing the data, personnel, devices, systems, and facilities that enable the financial institution to achieve business purposes according to the financial institution's relative importance to business objectives and the financial institution’s risk strategy; (3)(A) Protecting by encryption all customer information held or transmitted by the financial institution both in transit over external networks and at rest. (B) To the extent the financial institution determines that encryption of customer information, either in transit over external networks or at rest, is infeasible, the financial institution may instead secure the customer information using effective alternative compensating controls reviewed and approved by the financial institution’s qualified individual; (4) Adopting secure development practices for in-house developed applications utilized by the financial institution for transmitting, accessing, or storing customer information and procedures for evaluating, assessing, or testing the security of externally developed applications the financial institution utilizes to transmit, access, or store customer information; (5) Implementing multifactor authentication for an individual accessing an information system, unless the financial institution’s qualified individual has approved in writing the use of reasonably equivalent or more secure access controls; (6) Developing, implementing, and maintaining procedures for the secure disposal of customer information in any format no later than two (2) years after the last date the customer information is used in connection with the provision of a financial product or service to the customer, unless the customer information is: (A) Necessary for business operations or for other legitimate business purposes; (B) Otherwise required to be retained by state law or rule, or federal law or regulation; or (C) Where targeted disposal is not reasonably feasible due to the manner in which the information is maintained; (7) Periodically reviewing the financial institution’s data retention policy to minimize the unnecessary retention of data; (8) Adopting procedures for change management; and (9) Implementing policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by these users. (e)(1) A financial institution shall regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures of the safeguards' required under this section, including those to detect actual and attempted attacks on, or intrusions into, information systems. (2)(A) For information systems, monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments. (B) Absent effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities, the financial institution shall conduct: (i) Annual penetration testing of a financial institution’s information systems determined each given year based on relevant identified risks according to the risk assessment; and (ii) Vulnerability assessments, including a systemic scan or review of an information system reasonably designed to identify publicly known security vulnerabilities in the financial institution’s information systems based on the risk assessment, at least every six (6) months, and whenever there are: (a) Material changes to the financial institution’s operations or business arrangements; and (b) Circumstances the financial institution knows or has reason to know may have a material impact on the financial institution’s information security program. (f) A financial institution shall implement policies and procedures to ensure that personnel are able to enact the financial institution’s information security program by: (1) Providing the financial institution’s personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment; (2) Utilizing qualified information security personnel employed by the financial institution or an affiliate or a service provider sufficient to manage the financial institution’s information security risks and to perform or oversee the information security program; (3) Providing information security personnel with security updates and training sufficient to address relevant security risks; and (4) Verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures. (g) A financial institution shall oversee service providers by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; (2) Requiring the financial institution’s service providers by contract to implement and maintain the safeguards referenced under subdivision (g)(1) of this section; and (3) Periodically assessing the financial institution’s service providers based on the risk they present and the continued adequacy of their safeguards. (h) A financial institution shall evaluate and adjust the financial institution’s information security program to reflect: (1) The results of the testing and monitoring required by subsection (e) of this section; (2) Any material change to the financial institution’s operations or business arrangements or other circumstances; (3) The results of risk assessments performed under subdivision (c)(3) of this section; and (4) Any other circumstances that the financial institution knows or has reason to know may have a material impact on the financial institution's information security program. (i)(1) A financial institution shall establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in the financial institution’s control. (2) The incident response plan under subdivision (i)(1) of this section shall address: (A) The goals of the incident response plan; (B) The internal processes for responding to a security event; (C) The definition of clear roles, responsibilities, and levels of decision-making authority; (D) External and internal communications and information sharing; (E) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls; (F) Documentation and reporting regarding security events and related incident response activities; and (G) The evaluation and revision as necessary of the incident response plan following a security event. (j)(1) The financial institution’s qualified individual shall report in writing at least annually, to the financial institution’s board of directors or equivalent governing body. (2) If a board of directors or equivalent governing body does not exist, the report required under subdivision (j)(1) of this section shall be timely presented to a senior officer responsible for the financial institution’s information security program. (3) The report required under subdivision (j)(1) of this section shall include: (A) The overall status of the information security program and the financial institution’s compliance with this section and associated rules; and (B) Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management’s responses to security events or violations, and recommendations for changes in the information security program. (k) A financial institution shall provide notice to the Securities Commissioner about notification events according to subdivisions (l)(1) and (2) of this section. (l)(1) Upon discovery of a notification event as described in subdivision (l)(3) of this section, if the notification event involves the information of any consumers in this state, the financial institution shall notify the commissioner as soon as possible and no later forty-five (45) days after discovery of the notification event. (2) The notice required under subdivision (l)(1) of this section shall: (A) Be made in a format specified by the commissioner; and (B) Include the following information: (i) The name and contact information of the reporting financial institution; (ii)(a) A description of the types of information that were involved in the notification event. (b) If the information is possible to determine under subdivision (l)(2)(B)(ii)(a) of this section, the notice required under subdivision (l)(1) of this section shall contain the date or date range of the notification event; (iii) The number of consumers affected or potentially affected by the notification event; (iv) A general description of the notification event; and (v)(a) Whether a law enforcement official has provided the financial institution with a written determination that notifying the public of the notification event would impede a criminal investigation or cause damage to national security, and a means for the commissioner to contact the law enforcement official. (b) A law enforcement official under subdivision (l)(2)(B)(v)(a) of this section may request an initial delay of up to thirty (30) days following the date when notice was provided to the commissioner. (c) The delay under subdivision (l)(2)(B)(v)(b) of this section may be extended for an additional period of up to sixty (60) days if the law enforcement official seeks an extension in writing. (d) An additional delay beyond the delay under subdivision (l)(2)(B)(v)(b) of this section may be permitted only if the State Securities Department determines that public disclosure of a notification event continues to impede a criminal investigation or cause damage to national security. (3)(A) A notification event under this section shall be treated as discovered as of the first day on which the notification event is known to the financial institution. (B) The financial institution under subdivision (l)(3)(A) of this section shall be deemed to have knowledge of a notification event if the notification event is known to a person, other than the person committing the notification event, who is the financial institution’s employee, officer, or other agent. (m) A financial institution shall establish a written plan addressing business continuity and disaster recovery.

Ark. Code Ann. § 23-39-523 Exceptions.

This subchapter does not apply to a financial institution that maintains customer information concerning fewer than five thousand (5,000) consumers.

Source: Public.Resource.Org / UniCourt, Official Code of Arkansas Annotated, Release 78 (2020) (unicourt.github.io/cic-code-ar)URL: https://unicourt.github.io/cic-code-ar/transforms/ar/ocar/r78/gov.ar.code.title.23.htmlFetched: 11/8/2026