JD Key Consulting Logo
SB2371

Regular Session

Relating to skimmers on electronic terminals; authorizing a civil penalty; creating criminal offenses.

Critical
Low Cost
Effective:2025-09-01
SB2371
Critical
Relating to skimmers on electronic terminals; authorizing a civil penalty; creating criminal offenses.
Critical Compliance Urgency
Requires immediate attention
Cost Impact
Low
Effective
2025-09-01
Enforcing Agencies
FCICLocal Law Enforcement AgenciesOffice of the Attorney GeneralTDLR
Primary Author: Sen. Robert Nichols
89th Texas Legislature
jdkey.com
01

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

  • Effective Date: September 1, 2025
  • Compliance Deadline: September 1, 2025 (All protocols must be active).
  • Agency Rulemaking: The Texas Commission of Licensing and Regulation (TDLR) and the Financial Crimes Intelligence Center (FCIC) must adopt rules prescribing the specific form and manner of reporting *prior* to the effective date. Expect draft rules in Summer 2025.

Immediate Action Plan

  • 1. Revise SOPs: Update Incident Response Plans to explicitly forbid the removal or disposal of skimming devices by store staff.
  • 2. Establish Chain of Command: Designate a specific Compliance Officer responsible for contacting the FCIC immediately upon a report from the field.
  • 3. Audit Vendor Protocols: Send a formal notice to your POS/ATM service providers requiring confirmation that their technicians are trained on SB2371 reporting duties.
  • 4. Monitor Rulemaking: Watch for TDLR’s publication of the reporting form/portal in mid-2025.

Operational Changes Required

Contracts

  • Vendor MSAs: Review agreements with ATM maintenance providers and POS repair firms. Insert indemnification clauses protecting your business if a third-party technician discovers a skimmer but fails to report it to the FCIC as required by law.
  • Lease/Premises: Ensure lease agreements do not conflict with the new statutory requirement to grant immediate access to law enforcement or FCIC agents for terminal inspections.

Hiring/Training

  • "Do Not Dispose" Training: Frontline managers and shift leads must be trained immediately that throwing a discovered skimmer in the trash is now a Class B Misdemeanor (or 3rd Degree Felony if an investigation is known).
  • Incident Response: Staff must be drilled on the "Disable, Preserve, Report" sequence. They must know how to take a terminal offline without physically removing the skimming device until instructed by law enforcement.

Reporting & Record-Keeping

  • Dual Reporting Protocol: Establish a workflow to report discoveries to both local law enforcement AND the FCIC.
  • Compliance Logs: Create a "Skimmer Incident Log" documenting the exact time of discovery and the exact time of notification to authorities. This log will be your primary defense against the Attorney General’s $5,000/day civil penalty for failure to report.

Fees & Costs

  • Potential Penalties: Budget for legal defense reserves; civil penalties for non-compliance are capped at $5,000 per violation, per day.
  • Operational Downtime: Anticipate revenue loss from terminals being disabled for longer periods while awaiting law enforcement clearance to remove devices.

Strategic Ambiguities & Considerations

  • "Appropriate Measures to Protect": The statute requires businesses to protect the terminal from tampering after discovery but does not define the standard of care. Rulemaking may clarify if this requires physical security (guards), camera monitoring, or simply powering down the unit.
  • Reporting Mechanism: The "manner and form" of reporting is currently undefined. We are monitoring whether the FCIC will establish a 24/7 digital portal or a hotline. The efficiency of this system will dictate your operational burden.
  • Definition of Service Technician: It is unclear if internal IT staff are classified as "service technicians" subject to the independent reporting duty, or if this applies strictly to third-party licensed vendors.

Need Help Understanding Implementation?

Our government affairs experts can walk you through this bill's specific impact on your operations.

Schedule Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

02

Legislative Timeline

This bill's path through the Texas Legislature

Filed
Mar 12, 2025
Passed Senate
Apr 29, 2025
Passed House
May 10, 2025
Signed
May 27, 2025
TopicsCivil Remedies & LiabilitiesCrimesCrimes--miscellaneousElectronic Information SystemsFinancialFinancial--banksFinancial--generalAutomated Teller MachinesCredit & Debit CardsCurrency & Currency ExchangeBanking, Texas Department ofLaw EnforcementProtection of Personal InformationLicensing & Regulation, Texas Commission of
03

Senate Authors

Sen. Robert NicholsRepublican · Primary Author
Coauthors (1)

House Sponsor

Rep. Mary PerezDemocrat · Primary Sponsor

Bill Text(with markup)

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

Related Legislation

Explore more bills from this author and on related topics

More from Sen. Robert Nichols

View all bills by Sen. Robert Nichols

Related by Topic

View more Civil Remedies & Liabilities legislation
Quick Reference

Frequently Asked Questions

Common questions about SB2371

Q

What does Texas SB2371 do?

Senate Bill 2371 criminalizes the disposal of payment card skimmers and mandates a strict "report and preserve" protocol for all Texas businesses operating electronic terminals (POS, ATMs, fuel pumps). This legislation shifts skimmer discovery from an internal loss-prevention matter to a mandatory state reporting event, exposing businesses to civil penalties of up to $5,000 per day and staff to criminal liability for non-compliance. Implementation Timeline Effective Date: September 1, 2025 Compliance Deadline: September 1, 2025 (All protocols must be active).

Q

Who authored SB2371?

SB2371 was authored by Texas Senator Robert Nichols during the Regular Session.

Q

When was SB2371 signed into law?

SB2371 was signed into law by Governor Greg Abbott on May 27, 2025.

Q

Which agencies enforce SB2371?

SB2371 is enforced by Financial Crimes Intelligence Center (FCIC), Local Law Enforcement Agencies, Office of the Attorney General (Civil Penalty Collection) and Texas Commission of Licensing and Regulation (TDLR).

Q

How urgent is compliance with SB2371?

The compliance urgency for SB2371 is rated as "critical". Businesses and organizations should review the requirements and timeline to ensure timely compliance.

Q

What is the cost impact of SB2371?

The cost impact of SB2371 is estimated as "low". This may vary based on industry and implementation requirements.

Q

What topics does SB2371 address?

SB2371 addresses topics including civil remedies & liabilities, crimes, crimes--miscellaneous, electronic information systems and financial.

Legislative data provided by LegiScanLast updated: November 25, 2025

Need Strategic Guidance on This Bill?

Need help with Government Relations, Lobbying, or compliance? JD Key Consulting has the expertise you're looking for.