CT Enacts New Financial Institution Data Security Requirements, Limits when Flood Disclosure Must be Provided

Connecticut has enacted new data security requirements for financial institutions, incorporating federal standards and requiring notice to the Department of Banking (DOB) within three business days of certain data security incidents, along with changes to when a creditor is required to provide a flood insurance notice to an applicant. 

Connecticut HB 5208 requires financial institutions to adopt a written information security program and to comply with the applicable provisions of the FDIC’s Interagency Guidelines Establishing Information Security Standards, the NCUA’s Guidelines for Safeguarding Member Information, or the FTC’s Safeguard Rule.  This requirement applies broadly, among other financial institutions, to out-of-state banks with a branch in Connecticut, out-of-state credit unions with an office in Connecticut, and certain nondepository licensees regulated by DOB.

In addition, licensees, Connecticut banks, and Connecticut credit unions will be required to file a notification with the DOB no later than three business days after they know, or have reason to know, of a data security incident that may: (i) materially impact its ability to operate in a safe and sound manner in compliance with applicable laws and regulations, (ii) cause significant disruption in customer services, or (iii) involve any unauthorized access to an individual’s personal information.  This is in addition to the state’s general notification requirements for data privacy breaches (previously reported by WBK here).

Further, the law narrows the circumstances in which a creditor must provide a Connecticut-specific flood insurance notice that was previously enacted but had not yet gone into effect.  The notice must be provided to applicants for a mortgage loan secured by a 1-4 family residential property having either: (i) a loan amount under $1 million, or (ii) to be used primarily for personal, family or household purposes.  The notice must be provided at least 10 days before closing, except for open-end lines of credit or closed-end home equity loans meeting certain criteria, in which case the notice must be provided by the closing date.

The flood insurance notice provisions become effective on July 1, 2026.  The data security provisions become effective on October 1, 2026.