Rhode Island General Laws Title 19. Financial Institutions § 19-14.3-3.7. Mandated compliance programs and monitoring

(a) An applicant, before submitting an application, shall create and, during licensure, maintain in a record, policies and procedures for:

(b) A licensee's information-security and operational-security policy must include reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of any non-public personal information or currency transmission it receives, maintains, or transmits.

(c) A licensee is not required to file with the department a copy of a report it makes to a federal authority unless the department specifically requires filing.

(d) After the policies and procedures required under this section are created by the licensee and approved by the department, the licensee shall engage a responsible individual with adequate authority and experience to monitor each policy and procedure, recommend changes as desirable, and enforce it.

(e) A licensee may:

(f) Failure of a particular policy or procedure adopted under this section to meet its goals in a particular instance is not a ground for liability of the licensee if the policy or procedure was created, implemented, and monitored properly. Repeated failures of a policy or procedure are evidence that the policy or procedure was not created or implemented properly.