(a) The banking commissioner may initiate an action for an administrative penalty against a person for a violation of a cease and desist order by serving on the person notice of the time and place of a hearing on the penalty. The notice must be delivered by personal delivery or registered or certified mail, return receipt requested, to the person’s last known address. The hearing may not be held earlier than the 20th day after the date the notice is served. The notice must contain a statement of the facts or conduct alleged to be in violation of the cease and desist order.
(b) In determining whether a cease and desist order has been violated, the banking commissioner shall consider the maintenance of procedures reasonably adopted to ensure compliance with the order.

(c) If the banking commissioner after the hearing determines that a cease and desist order has been violated, the banking commissioner may:
(1) impose an administrative penalty in an amount not to exceed $25,000 for each separate act of unauthorized activity;
(2) direct the person against whom the order was issued to make complete restitution, in the form and amount and within the period determined by the banking commissioner, to each resident of this state and entity operating in this state damaged by the violation; or
(3) both impose the penalty and direct restitution.
(d) In determining the amount of the penalty and whether to impose restitution, the banking commissioner shall consider:
(1) the seriousness of the violation, including the nature, circumstances, extent, and gravity of any prohibited act;
(2) the economic harm caused by the violation;
(3) the history of previous violations;
(4) the amount necessary to deter future violations;
(5) efforts to correct the violation;
(6) whether the violation was intentional or unintentional;
(7) the financial ability of the person against whom the penalty is to be assessed; and
(8) any other matter that justice may require.