A BILL TO BE ENTITLED
AN ACT to enact the north Carolina financial and insurance regulatory sandbox act and to establish the north carolina financial and insurance innovation commission.
The General Assembly of North Carolina enacts:
SECTION 1.  The General Statutes are amended by adding a new Chapter to read:
"Chapter 53D.
"North Carolina Financial and Insurance Regulatory Sandbox Act.
"§ 53D‑1.  Short title.
This Chapter may be cited as the North Carolina Financial and Insurance Regulatory Sandbox Act.
"§ 53D‑2.  Legislative findings.
The North Carolina General Assembly finds all of the following:
(1)	Financial and insurance services are major economic drivers in North Carolina, and financial and insurance technology is undergoing a transformational period. New technologies (Fintech and Insurtech) are providing greater automation, connectivity, transparency, and opportunity for financial and insurance products and services.
(2)	The existing legal and regulatory frameworks are restricting financial and insurance innovation because these frameworks were established largely at a time when technology was not a fundamental component of financial and insurance products and services. Innovators in the financial and insurance industries require a flexible regulatory regimen to test new products and services.
(3)	North Carolina is among the nation's leaders in technology, innovation, and regulatory reform. A Regulatory Sandbox provides unique Fintech and Insurtech solutions and a framework to grow within the regulated financial and insurance services sector. North Carolina has the opportunity to be a leader in the creation of a Regulatory Sandbox that will encourage further development of the Fintech and Insurtech industries.
(4)	Certain nongovernmental partner organizations can help companies through the Regulatory Sandbox process, provide guidance as to how each product or service would fit within the given regulatory framework, and provide technical assistance to support design and implementation of tests of product and services.
"§ 53D‑3.  Definitions.
The following definitions apply in this Chapter:
(1)	Commissioner. – Commissioner of Banks.
(2)	Controlling person. – As defined in G.S. 53‑208.42.
(3)	Innovation Commission. – The North Carolina Financial and Insurance Innovation Commission.
(4)	Regulatory Sandbox. – A testing environment overseen by the Innovation Commission in which a registrant may test a product or service on consumers.
"§ 53D‑4.  North Carolina Financial and Insurance Innovation Commission.
(a)	Mission. – There is established in the Office of the Commissioner of Banks the North Carolina Financial and Insurance Innovation Commission. The Commission shall oversee the Regulatory Sandbox under this Chapter. The mission of the Commission is to develop a regulatory environment that encourages and supports innovation, investment, and job creation in the financial and insurance industries among new and existing companies in this State.
(b)	Membership. – The Commission shall have the following members:
(1)	The Commissioner of Banks, or the Commissioner's designee, who shall serve as the Chair.
(2)	The Commissioner of Insurance, or the Commissioner's designee.
(3)	The Secretary of State, or the Secretary's designee.
(4)	The Attorney General, or the Attorney General's designee.
(5)	The following public members, each of whom shall have a background in either financial services or technology or insurance services or technology:
a.	A public member appointed by the Governor.
b.	A public member appointed by the President Pro Tempore of the Senate.
c.	A public member appointed by the Speaker of the House of Representatives.
Each public member shall serve for a term of six years at the pleasure of the members' appointee and may be reappointed.
(c)	Quorum. – A majority of the members of the Commission constitutes a quorum.
(d)	Compensation. – The public members shall receive reimbursement for attending meetings of the Commission in accordance with G.S. 138‑5. The State Banking Commission shall use funds within its budget to pay these expenses.
"§ 53D‑5.  Regulatory Sandbox.
(a)	A person registered under this Chapter as a Regulatory Sandbox registrant may conduct a test of a product or service on consumers in accordance with this Chapter, any rules adopted under it, and any conditions imposed on the test by the Innovation Commission. Unless otherwise permitted by the Innovation Commission, the test shall not be conducted on more than 25,000 consumers and shall not affect transactions or policies exceeding fifty thousand dollars ($50,000) per consumer.
(b)	To the extent this section conflicts with a provision of State law not listed in this subsection, this section controls. To the extent this section conflicts with a provision listed in this subsection, the listed provision controls:
(1)	Chapter 24 of the General Statutes.
(2)	Chapter 25A of the General Statutes.
(3)	Chapter 25B of the General Statutes.
(4)	Article 20 of Chapter 66 of the General Statutes.
(5)	Chapter 75 of the General Statutes.
"§ 53D‑6.  Application to register in the Regulatory Sandbox.
(a)	Information About the Applicant. – A person may apply to register in the Regulatory Sandbox by submitting a written application to the Innovation Commission. The application shall be verified by oath or affirmation of the applicant or a designee of the applicant and shall include all of the following:
(1)	The legal name, along with any assumed business name, principal address, contact information, and Social Security number or taxpayer identification number of the applicant.
(2)	The applicant's form and place of organization, if applicable.
(3)	A certificate of good standing from the state in which the applicant was organized, if applicable.
(4)	A certificate of authority from the North Carolina Secretary of State to conduct business in this State, if required by Article 15 of Chapter 55 of the General Statutes, or other evidence of the applicant's registration or qualification to do business in this State.
(5)	The most recent audited annual financial statement of the applicant, or if the applicant is a wholly owned subsidiary, of the applicant's parent entity. This statement shall include the balance sheet, statement of income or loss, statement of changes in shareholder equity, if applicable, and statement of changes in financial position.
(6)	A record of any criminal convictions for the applicant, controlling person, or any key management personnel for a 10‑year period prior to the date of the application, including authorization to perform a federal and State criminal background check.
(7)	Any additional information requested by the Innovation Commission.
(b)	Information About the Product or Service to Be Tested. – The application shall also include the following information about each product or service the applicant proposes to test:
(1)	Whether the product or service is a financial innovation or an insurance innovation or both.
(2)	The potential benefits of the product or service.
(3)	The provisions of State law that would be superseded under G.S. 53D‑5(b), if the Innovation Commission allowed the applicant to conduct a test of the product or service.
(4)	The plan for testing, monitoring, and assessing the product or service, including risk management and cybersecurity measures to protect consumers.
(c)	Fee. – An applicant shall include a nonrefundable fee of five hundred dollars ($500.00) with the application.
(d)	Investigation. – On receipt of the application and fee, the Innovation Commission shall notify the Office of the Commissioner of Banks. The Office of the Commissioner of Banks shall investigate all of the following:
(1)	The applicant's financial condition and responsibility, financial and business experience, and character and general fitness.
(2)	The extent of the risk to consumers of testing the product or service and the adequacy of the applicant's proposed plan under subdivision (b)(4) of this section.
If one or more of the products or services is an insurance innovation, the Office of the Commissioner of Banks shall consult with the Department of Insurance in conducting the investigation. The Office of the Commissioner of Banks shall report its findings to the Innovation Commission.
(e)	Abandoned Application. – The Innovation Commission may consider an application abandoned if all of the following are true:
(1)	The applicant fails to respond to a request for information by the Innovation Commission within 30 days of the date of the request.
(2)	The Innovation Commission has given the applicant 15 days' written notice of the Commission's intention to consider the application abandoned.
(f)	Issuance of Registration. – The Innovation Commission shall decide on the application no later than 90 days after the date the application was submitted. The Innovation Commission may issue a Regulatory Sandbox registration to an applicant if the Commission finds all of the following:
(1)	The applicant's financial condition is sound.
(2)	The applicant's business will be conducted honestly, fairly, equitably, carefully, efficiently, consistent with this Chapter's purposes and intent, and in a manner commanding the community's confidence and trust.
(3)	The applicant and the applicant's controlling persons and key management personnel are qualified and of good character.
(4)	The applicant's plan under subdivision (b)(4) of this section includes adequate risk management and cybersecurity measures to protect consumers.
(5)	No person on behalf of the applicant has knowingly made a material misstatement or omission in the application.
(6)	The applicant meets other similar requirements determined by the Commission.
(g)	The Innovation Commission may impose conditions on a Regulatory Sandbox registrant's test.
(h)	Denial of Registration. – If the Innovation Commission denies an application, the Innovation Commission shall inform the applicant of each ground for the denial.
"§ 53D‑7.  License expiration and renewal.
(a)	Expiration. – A Regulatory Sandbox registrant's registration expires two years after issuance.
(b)	Renewal. – A Regulatory Sandbox registrant may apply to renew the registration by submitting a written application to the Commissioner no later than 30 days before the expiration date. The renewal application shall contain the same information and include the same fee as the initial application as provided in G.S. 53D‑6. An application that is submitted after the date 30 days before the expiration date but before the expiration date shall also include a nonrefundable late fee of one hundred dollars ($100.00). The Commissioner shall consider a renewal application and investigate the registrant in the same manner as an initial application as provided in G.S. 53D‑6. The registrant's registration shall be effective during the pendency of the renewal application.
"§ 53D‑8.  Surety bond.
(a)	The Innovation Commission may require that a Regulatory Sandbox registrant post a surety bond for the benefit of any consumers harmed by the test. If the Commission does require a bond, the Commission shall specify the amount of the bond. The Innovation Commission may also require the Regulatory Sandbox registrant to obtain insurance coverage to address any cybersecurity risks of the test. Any consumers harmed by the test shall be the beneficiaries of this insurance coverage.
(b)	In lieu of a surety bond, the Innovation Commission may allow a Regulatory Sandbox registrant to deposit the following with the Commissioner, or with a bank in this State approved by the Commissioner, in an aggregate amount, based upon principal amount or market value, whichever is lower, of not less than the amount of the surety bond:
(1)	Unencumbered cash.
(2)	Unencumbered interest‑bearing bonds.
(3)	Unencumbered notes.
(4)	Unencumbered debentures.
(5)	Unencumbered obligations of the United States or of any agency or instrumentality of the United States or unencumbered obligations guaranteed by the United States.
(6)	Unencumbered obligations of this State or of any political subdivision of this State or unencumbered obligations guaranteed by this State.
A deposit under this subsection shall be for the benefit of any consumers harmed by the test, but the Regulatory Sandbox registrant is entitled to all interest and dividends earned on the deposit.
(c)	The surety bond or deposit shall remain in place for no less than one year after the Regulatory Sandbox registrant ceases to be registered. The Regulatory Sandbox registrant shall give the Commissioner 90 days' written notice before cancelling the surety bond or withdrawing the deposit.
"§ 53D‑9.  Prohibited conduct.
A Regulatory Sandbox registrant is prohibited from doing any of the following:
(1)	Employing, directly or indirectly, any scheme, device, or artifice to defraud or mislead a person.
(2)	Making any false statement or omitting a material fact in connection with (i) any information or report filed with a State or federal agency or (ii) any investigation or examination conducted by the Commissioner or another State or federal agency.
(3)	Knowingly withholding, concealing, mutilating, or destroying any evidence during an investigation or examination by the Commissioner under this Chapter.
(4)	Violating any applicable federal law.
(5)	Violating any State laws listed in G.S. 53D‑5(b).
"§ 53D‑10.  Commissioner's authority to investigate and examine.
(a)	Investigation and Examination. – In addition to the Commissioner's authority to investigate an applicant in connection with an initial application under G.S. 53D‑6 or a renewal application under G.S. 53D‑7, the Commissioner may investigate and examine a Regulatory Sandbox registrant at any time to determine compliance with this Chapter.
(b)	Powers. – In investigating and examining a Regulatory Sandbox registrant, the Commissioner may do any of the following:
(1)	Access any records, regardless of the location, possession, control, or custody of the records. The Commissioner may take possession of and control access to the records in the place where they are usually kept. No person shall remove or attempt to remove the records except pursuant to a court order or with the Commissioner's consent.
(2)	Subpoena any person to produce any evidence the Commissioner deems relevant to the investigation or examination.
(3)	Administer oaths and examine any person under oath concerning the registrant's business.
(4)	Retain attorneys, accountants, other professionals, and specialists as investigators, examiners, or auditors to conduct or assist in conducting the investigation or examination.
(5)	Enter into agreements or relationships with other government officials or regulatory associations to improve efficiencies and reduce regulatory burden by sharing resources, standardized or uniform methods or procedures, and evidence obtained under the Commissioner's authority.
(6)	Use, hire, contract for, or employ publicly or privately available analytical systems, methods, or software to investigate or examine a registrant.
(7)	Accept and rely on investigation and examination reports made by other government officials.
(8)	Accept audit reports made by an independent certified public accountant for the registrant on the same general subject matter as the audit and incorporate the audit report in a report by the Commissioner.
(c)	Regulatory Sandbox Registrant's Access. – The Commissioner shall not prevent a Regulatory Sandbox registrant from accessing its own records as necessary to conduct its ordinary business unless the Commissioner has reason to believe there is a risk that the records will be altered or destroyed to conceal a violation of this Chapter.
(d)	Extraordinary Review. – If the Commissioner determines that the investigation or examination requires an extraordinary review, the Commissioner may assess against the Regulatory Sandbox registrant the actual costs of conducting the extraordinary review, including time spent at the hourly rate for the Commissioner's staff, to be determined by the State Banking Commission.
"§ 53D‑11.  Confidentiality.
(a)	All information obtained by the Commissioner under this Chapter is subject to confidential treatment as provided in G.S. 53C‑2‑7.
(b)	The Commissioner may enter into agreements or sharing arrangements with any state or federal agency and may share otherwise confidential information pursuant to these agreements, but only to the extent permitted by G.S. 53C‑2‑7(d). Information shared pursuant to these agreements retain all applicable privileges and confidentiality protections provided by State or federal law.
"§ 53D‑12.  Commissioner's authority to discipline and enforce; private civil remedy.
(a)	Disciplinary Authority. – The Commissioner may limit, suspend, revoke, or refuse to renew a Regulatory Sandbox registration issued under this Chapter for any violation of this Chapter or any rule adopted under it.
(b)	Cease and Desist Order. – The Commissioner may order a Regulatory Sandbox registrant to cease and desist from violating this Chapter or any rule adopted under it.
(c)	Injunction. – The Commissioner may apply to the Wake County Superior Court for an order enjoining a Regulatory Sandbox registrant from violating this Chapter or any rule adopted under it.
(d)	Civil Remedy. – A consumer harmed by a test conducted by a Regulatory Sandbox registrant may bring an action for damages against the registrant.
"§ 53D‑13.  Service of process.
(a)	A Regulatory Sandbox registrant is deemed to have done all of the following:
(1)	Consented to the jurisdiction of the courts of this State for an action arising under this Chapter.
(2)	Appointed the Secretary of State as the registrant's agent for the purpose of accepting service of process in an action arising under this Chapter.
(b)	For purposes of this Chapter, the Commissioner is deemed to have complied with the requirements of law concerning service of process upon mailing by certified mail notice to a Regulatory Sandbox registrant, postage prepaid and addressed to the last known address on file with the Commissioner.
"§ 53D‑14.  Rules.
The State Banking Commission may adopt rules to implement this Chapter."
SECTION 2.  This act becomes effective October 1, 2020.