Unsafe and unsound practices.

(1) Financial institutions must make determinations about the provision or denial of services based on an analysis of risk factors unique to each current or prospective customer or member and may not engage in an unsafe and unsound practice as provided in subsection (2). This subsection does not restrict a financial institution that claims a religious purpose from making such determinations based on the current or prospective customer’s or member’s religious beliefs, religious exercise, or religious affiliations.

(2) It is an unsafe and unsound practice for a financial institution to deny, cancel, suspend, or terminate its services to a person, or to otherwise discriminate against a person in making available such services, or in the terms or conditions of such services, on the basis of:

(a) The person’s political opinions, speech, or affiliations;

(b) Except as provided in subsection (1), the person’s religious beliefs, religious exercise, or religious affiliations;

(c) Any factor if it is not a quantitative, impartial, and risk-based standard, including any such factor related to the person’s business sector; or

(d) The use of any rating, scoring, analysis, tabulation, or action that considers a social credit score based on factors including, but not limited to:

1. The person’s political opinions, speech, or affiliations.

2. The person’s religious beliefs, religious exercise, or religious affiliations.

3. The person’s lawful ownership of a firearm.

4. The person’s engagement in the lawful manufacture, distribution, sale, purchase, or use of firearms or ammunition.

5. The person’s engagement in the exploration, production, utilization, transportation, sale, or manufacture of fossil fuel-based energy, timber, mining, or agriculture.

6. The person’s support of the state or Federal Government in combating illegal immigration, drug trafficking, or human trafficking.

7. The person’s engagement with, facilitation of, employment by, support of, business relationship with, representation of, or advocacy for any person described in this paragraph.

8. The person’s failure to meet or commit to meet, or expected failure to meet, any of the following as long as such person is in compliance with applicable state or federal law:

a. Environmental standards, including emissions standards, benchmarks, requirements, or disclosures;

b. Social governance standards, benchmarks, or requirements, including, but not limited to, environmental or social justice;

c. Corporate board or company employment composition standards, benchmarks, requirements, or disclosures based on characteristics protected under the Florida Civil Rights Act of 1992; or

d. Policies or procedures requiring or encouraging employee participation in social justice programming, including, but not limited to, diversity, equity, or inclusion training.

(3) Beginning July 1, 2023, and by July 1 of each year thereafter, financial institutions as defined in s. 655.005 must attest, under penalty of perjury, on a form prescribed by the commission whether the entity is acting in compliance with subsections (1) and (2).

(4) If a person who is a customer or member of a financial institution suspects that such financial institution has acted in violation of subsection (2), the aggrieved customer or member may submit a complaint to the office on a form prescribed by the commission within 30 days after such action. A complaint is barred if not timely submitted. The complaint must, at a minimum, contain the name and address of the customer or member, the name of the financial institution, and the facts upon which the customer or member bases his or her allegation.

(5) After receipt of a customer’s or member’s complaint under subsection (4):

(a) The office must notify the financial institution that a complaint has been filed.

(b) Within 90 calendar days after receiving the notice from the office, the financial institution must file with the office a complaint response report containing such information as the commission requires by rule, unless precluded by law.

(c) If the complaint response report indicates that the financial institution took action due to suspicious activity, as defined in s. 655.50(3), the initial investigation by the office must be handled in accordance with s. 655.50. If the office determines that the financial institution’s action was taken without any basis under s. 655.50, the office must continue to investigate the financial institution’s action and determine whether the financial institution has acted in violation of subsection (2).

(d) Within 90 calendar days after receiving the complaint submitted pursuant to this subsection, the office shall begin an investigation of the alleged violation.

(e) After the investigation is completed or ceases to be active, the office shall:

1. Within 30 calendar days after the completion or cessation of the investigation, create a report on the findings of the investigation. Such report, however, may not contain or must redact any information that remains confidential and exempt from s. 119.07(1). If the office determines that no violation of subsection (2) has occurred, the report must only:

a. Identify the complaint for which the report is made; and

b. State that a determination has been made that no violation of subsection (2) has occurred.

2. Except as otherwise provided or prohibited by law, within 45 calendar days after the completion or cessation of the investigation, send such report to the customer or member who submitted the complaint pursuant to this subsection, via certified mail, return receipt requested, delivery restricted to the addressee; and to the subject financial institution.

(f) Except as otherwise provided or prohibited by law, if the office determines that a violation of subsection (2) has occurred, the office must provide notice of such violation to the customer or member and to the Department of Financial Services and the enforcing authority, as defined in s. 501.203(2), and provide a copy of the report created pursuant to this subsection.

(6) Engaging in a practice described in subsection (2) or failing to timely provide the attestation under subsection (3) is a failure to comply with this chapter, constitutes a violation of the financial institutions codes, and is subject to the applicable sanctions and penalties provided for in the financial institutions codes.

(7) Notwithstanding ss. 501.211 and 501.212, a failure to comply with subsection (1) or engaging in a practice described in subsection (2) constitutes a violation of the Florida Deceptive and Unfair Trade Practices Act under part II of chapter 501. Violations must be enforced only by the enforcing authority, as defined in s. 501.203(2), and subject the violator to the sanctions and penalties provided for in that part. If such action is successful, the enforcing authority is entitled to reasonable attorney fees and costs.

(8) The office and the commission may not exercise authority pursuant to s. 655.061 in relation to this section.

(9) The commission may adopt rules to administer this section.