(a) Notification by legitimate cannabis-related business.--If a legitimate cannabis-related business obtains financial or insurance services from a financial institution or insurer doing business in this Commonwealth, the business shall, within five business days, provide notice to the financial institution or insurer if a cannabis-related permit, registration or certification held by the business or its affiliates under Federal law, the laws of this Commonwealth or a law established by another state is suspended or revoked.

(b) Penalty.--If a legitimate cannabis-related business fails to give the notice required under subsection (a) to a financial institution or insurer, the business or business associate may be assessed a civil penalty up to $500 per day, not to exceed $25,000, until the notice is provided. The Department of Banking and Securities shall have authorization to assess civil penalties for failure to give notice under this section to a financial institution, and the Insurance Department shall have authorization to assess civil penalties for failure to give the notice under this section to an insurer.