Financial institutions report data incidents and mortgage creditors warn homebuyers about floods

Covered institutions and other regulated people must maintain a written data security program and follow applicable federal safeguards. The duty covers the listed banks, credit unions, trust companies, and financial licensees, plus people under the Banking Commissioner's jurisdiction under Title 36b. The program must protect customer information and be consistent with applicable federal rules. If these rules conflict with the listed state banking laws, the rules that give customers greater protection control. This section takes effect October 1, 2026.

Certain institutions must notify the Department of Banking about qualifying data security incidents. The duty applies to financial licensees, Connecticut banks, and Connecticut credit unions. The incident must potentially threaten safe operations or legal compliance, significantly disrupt customer services, or involve unauthorized access to an individual's personal information. The Banking Commissioner may request more information after the initial notice. The three business days begin when the institution knows, or has reason to know, that a qualifying incident occurred.

The Department of Banking must study payroll processing and how long payroll checks take to clear, then report its findings and recommendations. The study concerns payroll processing methods used by financial institutions and the time payroll checks take to clear. The report must go to the legislature's committee on banking. This section takes effect upon passage. The report is due by January 1, 2027.

Banking committee leaders must convene a working group to study consumer fraud and protections against it. The working group studies consumer fraud and protections against it. The group includes lawmakers, state officials, an elder law attorney, and representatives of financial institutions, credit unions, consumers, and older residents. The group's report goes to the legislature's committee on banking. This section takes effect upon passage. The first meeting must be held within 60 days. The group must report by January 1, 2027, and ends when it reports or on that date, whichever is later.

Mortgage creditors must give applicants a written notice about flood risks and insurance. This applies to loans secured by one-to-four-family homes in Connecticut that are under $1 million or mainly for personal, family, or household use. The notice must say standard homeowners insurance does not cover flood damage, flooding can happen outside designated flood zones, and applicants may consult a licensed insurance producer or surplus lines broker. The notice must use plain language and be signed and dated by the applicant to acknowledge receipt. Creditors must keep a copy with the mortgage records. This section takes effect July 1, 2026. For an open-end credit line or home equity loan, the notice is due by closing; for other covered loans, it is due at least 10 days before closing.