North Dakota House Bill HB1127

North Dakota 2025-2026 Regular Session

• Introduced: 1/7/25
• Refer: 1/7/25
• Report Pass: 2/12/25
• Engrossed: 2/17/25
• Refer: 2/18/25
• Report Pass: 3/11/25
• Enrolled: 4/4/25
• Passed: 4/11/25

Caption

AN ACT to create and enact chapter 13-01.2 of the North Dakota Century Code, relating to the financial institution data security program; and to amend and reenact sections 6-01-04.1 and 6-01-04.2, subsection 7 of section 6-03-02, sections 13-04.1-01.1, 13-04.1-11.1, 13-05-07.1, 13-08-10, 13-08-11.1, and 13-09.1-14, subsection 3 of section 13-09.1-17, sections 13-09.1-38 and 13-10-05, subsection 1 of section 13-11-10, section 13-12-19, subsections 6, 21, and 22 of section 13-13-01, and sections 13-13-04 and 13-13-18 of the North Dakota Century Code, relating to the department of financial institutions, financial institutions, response to department requests, renewal of licenses, orders to cease and desist, issuance of licenses, revocation of licenses, and exemptions from licenses.

Summary

HB 1127 makes a broad set of changes to North Dakota’s financial regulatory code, centered on the Department of Financial Institutions and the security and supervision of regulated financial entities. The bill creates a new chapter establishing a financial institution data security program for financial corporations, requiring written information security programs, risk assessments, encryption of customer information, multifactor authentication, secure disposal of data, service-provider oversight, incident response planning, annual reporting to management, and breach notification to the commissioner for larger incidents. It also defines key cybersecurity and privacy terms such as customer information, notification event, penetration testing, and multifactor authentication. Beyond cybersecurity, the bill updates enforcement and licensing provisions across several financial-services chapters. It revises authority for removal or suspension of officers and employees, cease-and-desist procedures, response deadlines for department information requests, renewal and denial rules for money transmitter and mortgage-related licenses, and exemptions for certain entities such as banks, credit unions, not-for-profit mortgage servicers, and entities performing interim mortgage servicing. It also clarifies banking powers related to custodial accounts for health savings, retirement, and pension-related services, and updates mortgage servicing definitions.

Impact

The bill amends multiple sections of the North Dakota Century Code affecting banks, credit unions, money brokers, money transmitters, mortgage loan originators, debt-settlement providers, mortgage servicers, and other entities regulated by the Department of Financial Institutions. Its most significant legal effect is the creation of chapter 13-01.2, which imposes affirmative cybersecurity and data-protection duties on financial corporations and gives the commissioner a breach-notification role. It also strengthens administrative enforcement by tightening response deadlines, clarifying cease-and-desist and license-revocation procedures, and expanding or refining exemptions and definitions in several licensing chapters.

Sentiment

The voting record suggests the bill was broadly supported and largely noncontroversial. It passed the House 78-0 on second reading, the Senate 46-1, and later the House 89-2, indicating strong bipartisan approval. The absence of committee transcript material limits insight into detailed debate, but the near-unanimous votes suggest general agreement with the bill’s regulatory and cybersecurity updates.

Contention

There is little evidence of major opposition in the available record. The few dissenting votes appear to reflect isolated concerns rather than organized resistance. Potential points of contention inherent in the bill include the compliance burden of the new cybersecurity program, especially requirements for encryption, multifactor authentication, penetration testing, service-provider oversight, and breach reporting; however, the bill also includes a smaller-institution exemption for certain provisions, which may have reduced objections. The licensing and enforcement changes likewise could be viewed as giving the department more administrative leverage, but the strong vote margins indicate those concerns were not significant enough to generate broad opposition.