There continues to be a trend towards extending, and in some cases, codifying through regulation or statute, emergency COVID-19 guidance enabling work from home.  Most recently:

• The Rhode Island Department of Banking amended Rule 230-RICR-40-10-2 (Lenders, Loan Brokers, Small Loan Lenders, Third-Party Loan Services and Mortgage Loan Officers) to codify previously issued guidance allowing for remote work locations for mortgage loan originators.  Specifically, it added new Section 2.10, setting forth the supervision, training, and security requirements to allow employees of licensed lenders, loan brokers, small loan lenders, third-party loan servicers and mortgage
  loan originators to work from home.  Section 2.10 requires that:
  • The employee is subject to the supervision of the licensee;
  • The remote location is employee’s residence or other location identified in the records of the licensee and is within a reasonable distance of a place of business named in the licensee’s license or branch certificate;
  • The licensee has written policies and procedures for the supervision of employees and employs appropriate risk-based monitoring and oversight processes of work performed by employees working from remote locations;
  • Access to licensee’s computer platforms and to customer information is in accordance with the licensee’s comprehensive written information security plan;
  • No in-person customer interaction occurs at a remote location and the licensee will not designate the remote location to consumers or customers as a business location;
  • Physical records related to the licensee’s business, including consumer information, are not maintained at the remote location;
  • The licensee must ensure consumer and licensee information and records remain accessible and available for regulatory oversight and exams; and
  • The licensee must provide training to keep all conversations about, and with, consumers conducted from a remote location confidential as if conducted from a licensed commercial location, and to ensure remote employees work in an environment conducive and appropriate to that privacy.

The remote location will not be considered a branch location, but activities conducted therein shall be subject to examination.  The amended regulation is effective immediately and is available here.

• In Kansas, legislation was enacted (HB 2568) permitting, effective July 1, 2022, employees or independent contractors of a mortgage company licensee, including mortgage loan originators, to work at remote locations, as long as various conditions are met.  In addition, effective July 1, 2022, branch locations are no longer licensed.  The conditions required for remote work are as follows:
  • The licensed mortgage company’s employees or independent contractors do not meet with the public at a personal residence;
  • No physical business records are maintained at the remote location;
  • The licensed mortgage company has written policies and procedures for working at a remote location and such company supervises and enforces such policies and procedures;
  • The licensed mortgage company maintains the computer system and customer information in accordance with the company’s information technology security plan and all state and federal laws;
  • Any device used to engage in mortgage business has appropriate security, encryption and device management controls to ensure the security and confidentiality of customer information as required by rules and regulations adopted by the commissioner;
  • The licensed mortgage company’s employees or independent contractors take reasonable precautions to protect confidential information in accordance with state and federal laws; and
  • The licensed mortgage company annually reviews and certifies that the employees or independent contractors engaged in mortgage business at remote locations meet the requirements of this section  Upon request, a licensee shall provide written documentation of such licensee’s review to the commissioner.   K.S.A. 2021 Supp. 9-2203(d) (as amended by HB 2568, Sec. 2).

• South Dakota recently enacted the following statutory provision (HB 1271) applicable to its money lender and mortgage licensees that provides in each instance that an employee may work remotely if the licensee:   
  • Ensures in-person interactions with consumers are not conducted at the remote location and the remote location is not represented to consumers as a business location;
  • Maintains secure virtual private networks and other appropriate safeguards for licensee and consumer data, information, and records;
  • Employs appropriate risk-based monitoring and oversight processes of work performed from a remote location and maintains records of the processes;
  • Ensures consumer information and records are not maintained at the remote location;
  • Ensures consumer and licensee information and records remain accessible and available for regulatory oversight and examination; and
  • Provides appropriate employee training to keep all conversations about and with consumers conducted from the remote location confidential, as if conducted from the business location, and to ensure remote employees work in an environment that maintains confidentiality.

• In Kentucky, legislation effective July 14, 2022 (HB 643) permits employees (including mortgage loan originators engaged as independent contractors) of a licensee to remotely engage at “alternate work locations” in the “mortgage lending process,” including meeting in person at the convenience of the borrower on an infrequent or as-needed basis in order to complete the mortgage ending process so long as the “alternate work location” is not the employee’s home and so long as certain conditions are met.   The conditions are as follows:
  • The licensee has written policies and procedures for supervision of employees working from alternate work locations;
  • Access to the licensee’s computer systems and customer information is in accordance with the licensee’s comprehensive written information technology security plan;
  • Employees are not permitted to conduct in-person customer activities at the alternate work location except as provided in subsection (2)(b)2. of Section 1 of this Act;
  • The licensee ensures that no physical or electronic documents are maintained at the alternate work location; and
  • No signage or advertising of the licensee or the mortgage loan originator is displayed at any alternate work location.

In addition, a licensee that allows employees to engage in the mortgage lending process from an alternate work location shall:   

• Exercise proper supervision and control over the employees;
• Have written policies and procedures in place that ensure a safe, secure system for the mortgage lending process;
• Oversee compliance, and require all employees to comply, with the policies and procedures referenced in paragraph (b) of this subsection;
• Employ appropriate risk-based monitoring and oversight processes;
• Ensure that:
  1. Customer interactions and communications about consumer accounts are in compliance with federal and state information security requirements, including applicable provisions of: a. The Gramm-Leach-Bliley Act of 1999, Pub. L. No. 106-102, as amended; and b. The Federal Trade Commission’s Safeguards Rule, set forth in 16 C.F.R. Part 314;
  2. Any employee that engages in the mortgage lending process at an alternate work location accesses the company’s secure systems, including a cloud-based system, directly from any out-of-office device via a virtual private network (VPN) or a comparable system that ensures secure connectivity and requires passwords or other forms of authentication to access;
  3. Appropriate security updates, patches, or other alterations to the security of all devices used at an alternate work location are installed and maintained;
  4. Any employee that engages in the mortgage lending process at an alternate work location agrees to comply with the licensee’s processes established under paragraph (d) of this subsection; and
  5. The Nationwide Multistate Licensing System and Registry record of a mortgage loan originator that works from an alternate work location designates a properly licensed location as the mortgage loan originator’s official work station;
• Have the ability to:
  • 1. Remotely lock or erase company-related contents of any device; or
  • 2. Otherwise remotely limit all access to the company’s secure systems; and
• At least annually:
  • 1. Certify that all employees engaged in the mortgage lending process at alternate work locations meet the appropriate standards and safeguards to continue engaging in the mortgage lending process from the alternate work locations; and
  • 2. Review each alternate work location and provide proof of the documented review to the department upon request.

An “alternate work location” is not a branch. 

• Ohio similarly passed legislation that will be effective September 11, 2022.  SB 264 revises the Ohio Residential Mortgage Lending Act (“RMLA”) and the Consumer Installment Loan Act to permit remote work.  Under the Ohio RMLA, the following conditions must be present in order for a registrant or entity holding a letter of exemption to allow a mortgage loan originator or any other person associated with it to transact business on its behalf from a location other than its principal office or a branch office:
  • The registrant or entity has a written policy governing the supervision of the mortgage loan originator or other person associated with the registrant or entity while the originator or person transacts business on behalf of the registrant or entity from such location;
  • Access to the registrant’s or entity’s platform and customer information is in accordance with the registrant’s or entity’s written security plan;
  • The mortgage loan originator or other person associated with the registrant or entity does not interact with a customer at the originator’s or person’s residence, unless the residence is the registrant’s or entity’s principal office or a branch office; and
  • Physical records are not maintained at such location.

The Superintendent of Financial Institutions may charge an annual fee to cover the costs associated with administration of this provision, which such fee shall not exceed twenty-five ($25) for each remote location.

Notably, however, not all states have moved in this direction.  In West Virginia, the emergency guidance issued in response to COVID-19 expired on June 1, 2022, and the Division of Financial Institutions has indicated that no further extensions are contemplated at this time.  Thus, it appears that existing statutory requirements now apply (e.g., licensed mortgage loan originators are prohibited from working from other than approved locations).

As states weigh options about how to proceed, they can consult recently published guidance from the American Association of Residential Mortgage Regulators (AARMR) entitled, Best Practices for Permitting Employees to Work Remotely (the “Guidance”).  The Guidance is written to state agencies, reminding them that COVID-19 changed the industry dramatically by forcing the industry to leverage technology and a fully remote workforce to serve borrowers. The Guidance sets forth the following best industry practices that state agencies should consider when permitting employees of state-licensed residential mortgage lenders to work from an unlicensed home or other location:

“AARMR recognizes that this is a decision that each sovereign jurisdiction must make for itself, but for those states considering changes, AARMR sets forth these best practices that states ought to consider when implementing a permanent remote workforce option:

• First, a mortgage loan originator should not be allowed to meet consumers at the originator’s home unless the home is licensed as a branch location;
• Second, there must be systems in place to ensure that data security and privacy requirements are met regardless of where the company’s personnel are
  working;
• Third, the company responsible for sponsoring the loan originator must sufficiently supervise the mortgage loan origination activities being conducted from any locations, whether that be licensed location or unlicensed home or other location; and,

• Finally, documents must be available at a licensed location in the United States so that regulators are able to conduct examinations of the mortgage lending activities.

As state agencies and businesses reflect upon pandemic policies, the lack of consumer complaints and the ability to conduct examinations indicate that loan originators and others can work at home safely and effectively if a company is able to provide systems that protect consumer privacy and ensure regulatory compliance.”

Although not a perfect solution to the issue, the Guidance should bring a bit of relief to the industry. As previously noted in earlier posts, the industry has been struggling not only with states’ varying positions on whether individually licensed MLOs may work from “remote locations” after emergency orders expire, but also with states’ varying positions on whether other employees that are not required to be licensed (e.g., processors and underwriters in many states) are permitted to work from home. The Guidance addresses a “permanent remote workforce option” for “permitting [all] employees to work remotely” and specifically points out that the industry has utilized a permanent remote workforce for the duration of the pandemic with relatively few consumer complaints and roadblocks for licensees to be examined. It should also give the industry comfort that AARMR, the national organization representing state residential mortgage regulators, has released the Guidance for its participants, as it may result in fewer examination findings or other regulatory scrutiny for licensees that implement a permanent remote workforce option.

State adoption of remote work continues to evolve. We expect state regulators to react to the Guidance, either by setting forth formal policies that make it clear that “remote locations” are not subject to licensing requirements or by pushing for legislative changes that allow for employees to work from remote locations. We are hopeful for a nationwide adoption of a permanent remote workforce in time.

[View source.]