Money Transmission Act: authentication.

Section 2182's requirements for automatic logout, session timeout, and reauthentication were entirely deleted from the enrolled bill. Licensees are no longer required to implement these specific session management controls.

Section 2181(a) introductory language was cleaned up from 'shall not allow a user login without using two-factor implementing all of the following' to 'shall not allow a user login without implementing all of the following,' removing an awkward leftover phrase.

The legislative counsel's digest no longer references the automatic logout, session timeout, and reauthentication requirements, confirming their removal from the bill's scope.

Removed 'digital wallet provider or money transmitter operating in the state' as the covered entity. The bill now applies only to 'a licensee' under the Money Transmitters Act, narrowing who must comply.

The definition of 'user login' was narrowed from any action accessing an account for initiating, receiving, or managing digital wallet or money transmission services to only access 'for the first time or after a logout.' This means routine in-session interactions no longer trigger the authentication requirements.

The definition of 'multifactor authentication' was changed from 'more than two or more forms of verification' to 'two or more forms of verification,' effectively making it synonymous with two-factor authentication.

Added a new requirement that licensees implement a process for reverifying the identity of the user, device, or system using 2FA, MFA, or equivalent access control. This goes beyond initial login and requires ongoing identity verification.

Added a new requirement that licensees provide users the ability to report an error or suspected fraud through the same platform they used to access the service or through a reasonably accessible alternative.

The risk-based approach and consideration of factors (risk level, anomalous behavior, transaction sensitivity) now specifically applies only to implementing the reverification process rather than the general authentication requirement. The list of factors was also made non-exhaustive by adding 'including but not limited to.'

The written approval requirement for secure access control methods was clarified to specify that the approving individual must be 'employed or contracted by the licensee,' adding a specificity that was previously absent.

The entire stored value platform fraud reimbursement scheme was deleted. This removed the requirement for operators to reimburse customers for losses from fraudulently induced transfers, the claim submission process (mail, phone, email, website, mobile app), investigation timelines (10 business days standard, 45 days with provisional credit), customer notification requirements by July 1, 2026, and the commissioner's authority to order refunds or restitution for these violations.

The regulated entity changed from 'a digital wallet provider or money transmitter operating in the state' to simply 'a licensee' under the Money Transmission Act, which may narrow or clarify who is covered.

Authentication requirements expanded to allow 'other reasonably equivalent or more secure access control' in addition to two-factor or multifactor authentication. A new provision requires that any such alternative method be approved in writing by an individual responsible for overseeing the licensee's information security program.

New session management requirements added: licensees must implement an automatic logout requirement, a session timeout requirement, and a reauthentication requirement. These must use a risk-based approach balancing consumer protection with reasonable user access, and may consider factors such as the level of risk, indicators of anomalous behavior, and sensitivity of the transaction.

A new Section 1 states legislative intent that implementation should be 'consistent with evolving security standards while maintaining strong consumer protections,' signaling flexibility in how compliance is achieved.

The definition of 'multifactor authentication' was changed from requiring 'more than two forms of verification' to 'two or more forms of verification,' which overlaps with the two-factor authentication definition and may be a drafting error.

Entire Division 16 (Sections 34000-34002) on digital wallet security was removed. This eliminated requirements for covered businesses to provide fraud reporting mechanisms, notify users of suspicious activity, conduct annual security audits, and the specific $5,000 per day civil penalty for noncompliance with that division.

The bill's overall structure changed from adding both Chapter 10 and a separate Division 16 to the Financial Code, to adding only Chapter 10. The authentication provisions are now housed within the same chapter as the fraudulently induced transfer reimbursement rules rather than in a standalone division.

New Section 2181 prohibits any digital wallet provider or money transmitter operating in the state from allowing a user to log in without two-factor authentication or multifactor authentication. This is broader than the old rule because it covers money transmitters (not just digital wallet businesses) and applies to every login rather than only before transactions.

New definitions added for 'multifactor authentication' (more than two forms of verification), a simplified definition of 'two-factor authentication' (two distinct forms of verification, replacing the old longer definition with examples), and 'user login' (accessing an account to initiate, receive, or manage digital wallet or money transmission services).

New Section 2182 sets a delayed operative date of January 1, 2028 for the authentication requirements, giving operators time to implement the changes.

The specific $5,000 per day civil penalty for digital wallet security violations was removed. Enforcement of the new authentication requirement would fall under the general authorities already available to the commissioner under the Money Transmission Act (Section 2186 references the commissioner's existing powers).

Added new Chapter 10 (Sections 2180-2186) to Division 1.2 of the Financial Code (Money Transmission Act), creating a 'Fraudulently Induced Transfers' chapter that applies to operators of stored value platforms.

Section 2181 requires stored value platform operators to reimburse customers for any loss directly caused by a fraudulently induced transfer.

Section 2182 requires operators to accept reimbursement claims via physical mail, telephone, email, website, and mobile application, and to clearly disclose these methods on their website and app without requiring login credentials.

Section 2184 allows up to 45 days for extended investigations if the operator provisionally credits funds within 10 business days, notifies the customer within 2 days, and gives the customer full use of the credited funds during the investigation.

Defined 'fraudulently induced transfer' as a transfer initiated in response to fraudulent or dishonest conduct intended to manipulate, deceive, or persuade a customer into sending stored value to an account outside the customer's control. Defined 'stored value platform' as a method or service allowing customers of a stored value issuer to send or transfer stored value to another customer.

Section 2183 sets investigation deadlines: complete within 10 business days, report results within 3 business days after completion, and reimburse within 1 business day of determining a fraud occurred. Operators cannot require a police report before investigating.

Section 2185 requires operators to notify customers of their rights by July 1, 2026, and to amend their terms and conditions to include the reimbursement obligation.

Section 2186 authorizes the commissioner to order refunds, restitution, damages, or other monetary relief to harmed customers in addition to existing enforcement authorities.

The fiscal note changed 'State-mandated local program' from 'no' to 'yes,' indicating the bill now imposes a state-mandated local program because it expands the scope of a crime under the Money Transmission Act.

Added a new Section 2 providing that no reimbursement is required under Article XIII B of the California Constitution because costs are incurred due to creating or changing a crime.