SB 505: Money Transmission Act: authentication.

The Money Transmission Act (MTA) prohibits a person from engaging in the business of money transmission in the state, or from advertising, soliciting, or holding itself out as providing money transmission in the state, unless the person is licensed by the Department of Financial Protection and Innovation under the act. The MTA defines money transmission to mean, among other things, selling or issuing stored value to a person located in the state and defines stored value to mean monetary value representing a claim against the issuer that is stored on an electronic or digital medium and evidenced by an electronic or digital record and that is intended and accepted for use as a means of redemption for money or monetary value or payment for goods or services. The MTA punishes noncompliance with, among other things, a civil penalty, license revocation, and, for certain violations, as a felony, as prescribed.

This bill would prohibit a licensee under the MTA from allowing a user login without using unless the licensee has implemented specified processes, including 2-factor authentication, multifactor authentication, or other reasonably equivalent or more secure access control, as specified. The bill would prohibit a licensee from allowing a user login without implementing an automatic logout requirement, a session timeout requirement, and a reauthentication requirement, as specified. The bill would provide that its provisions become operative January 1, 2028. By expanding the scope of a crime, this bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.