(1) A payment instrument seller shall maintain records of the following information, which must be obtained for each issuance or sale of a payment instrument, regardless of the amount:
    (a) The date of purchase;
    (b) The serial number(s) or confirmation number of the payment instrument(s) purchased; and,
    (c) The amount in dollars of each of the instruments purchased.
    (2) For all transactions that exceed $3,000, the payment instrument seller shall also obtain and record the information required by 31 C.F.R. 1010.415 in accordance with Florida Statutes § 560.1235(1) For purposes of this section multiple payment instruments purchased in one or more transactions on a single day shall be aggregated.
    (3) Every payment instrument seller shall maintain a schedule of all outstanding receivables due from authorized vendors to include amounts and numbers of days outstanding. This schedule shall be updated, at a minimum, monthly.
    (4) Every payment instrument seller shall develop and implement written policies and procedures to monitor compliance with applicable state and federal law by its authorized vendors. The policies and procedures must include compliance with the following applicable statutes and regulations:
    (a) Florida Statutes Chapter 560
    (b) Anti-money laundering requirements referenced in Florida Statutes § 560.1235(1)
    (c) Office of Foreign Asset Control regulations: 31 C.F.R. 594.201 effective July 1, 2018, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11466; 31 C.F.R. 594.204 effective July 1, 2018, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11467; 31 C.F.R. 501.603 effective July 1, 2018, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11468; and 31 C.F.R. 501.604, effective July 1, 2018, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11469.
    (d) Gramm-Leach-Bliley Act regarding protection of personal information: 15 U.S.C. ss. 6801 effective July 21, 2010, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11470, 6802 effective July 21, 2010, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11471, and 6803 effective December 4, 2015, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11472.
    (e) Sections 817.568 and 817.5681, F.S., regarding fraudulent use of personal information and breaches of information security.
    (5) Every payment instrument seller shall maintain individual files for each authorized vendor that document the establishment and termination of these relationships. The file shall include the written contract between the payment instrument seller and authorized vendor as required by Florida Statutes § 560.2085
    (6) Subpoenas, warrants, and other requests from regulatory, law enforcement, or prosecutorial agencies and records relating to training as required by 31 C.F.R. 1022.210, effective July 1, 2018, and available at http://www.flrules.org/Gateway/reference.asp?No=Ref-11473, shall be maintained so that they are retrievable as required by Florida Statutes § 560.1105(1)
    (7) Records of all payment instrument sales shall be maintained in an electronic format that is readily retrievable and capable of being exported to most widely available software applications including Microsoft EXCEL.
    (8) All federal laws and regulations referenced in subsections (4) and (6) this rule are hereby incorporated by reference and available on the Office’s website at www.flofr.gov and by mail from the Office of Financial Regulation, 200 East Gaines Street, Tallahassee, Florida 32399-0376.
Rulemaking Authority 560.105, 560.2085 FS. Law Implemented 560.1105, 560.1235, 560.2085, 560.211 FS. History-New 9-24-97, Formerly 3C-560.702, Amended 1-13-09, 1-6-20.