A&B ABstract:

Effective July 1, Montana will become the latest jurisdiction to codify authorization for mortgage loan originators and mortgage company employees to engage in remote work. That legislation follows a general trend over the past year – and, more so, since the early days of the COVID-19 pandemic – to allow remote operations.

No longer a temporary measure necessitated by pandemic lockdowns, remote work is increasingly acknowledged by regulators as an acceptable permanent option for today’s working environment. Last year, 18 jurisdictions took action to extend temporary permission for, or permanently authorize, the practice, and the trend continues in 2023.

Updates to the Montana Mortgage Act

On February 16, Montana Governor Greg Gianforte signed House Bill 30, substantively amending the Montana Mortgage Act and adding requirements relating to the conduct of mortgage business from a remote location. Specifically, the measure requires that each employee or independent contractor engaged in remote work:

• Does not meet with the public at an unlicensed personal residence;
• Does not maintain physical or electronic business records at the remote location;
• Does not display any signage or advertising of the entity or the MLO at a remote location;
• Takes reasonable precautions to protect confidential information in accordance with state and federal laws; and
• Ensures that their NMLS records designate a properly licensed location as the MLO’s official workstation and a manager as a supervisor.

Further, the amended Act mandates that a licensed entity must:

• Have written policies and procedures for working remotely, and supervise and enforce those policies and procedures;
• Ensure that any device used to engage in the mortgage business has appropriate security, encryption, and device management controls to ensure the security and confidentiality of customer information;
• Maintain its computer systems and customer information in accordance with its information technology security plan and all state and federal laws; and
• Annually review and certify that its employees and independent contractors engaged in the mortgage business from remote locations meet specific requirements, and, upon request, provide the Department of Administration with written documentation of such review.

As discussed further below, the Montana measure follows a pattern established by other states, where remote work requirements have been established by regulatory guidance, and by temporary and then permanent legislation, since mid-2020.

Remote Work Authorization Trends 2020 to Present

The purpose of the legislative and regulatory guidance on remote work has changed since the spring of 2020. Remote work was already considered increasingly viable prior to the COVID-19 pandemic. Permissions and adaptations for remote work accelerated drastically with the onset of the pandemic in the spring of 2020. Today, guidance initially necessitated as an emergency response has become a permanent approach to regulating remote work in many states, enabling mortgage companies to take advantage of the benefits of a new mode of operations.

Throughout the evolution of the remote work trend, industry associations have stepped in to survey the regulatory choices being made across states and to recommend best practices. In July 2020, the Mortgage Bankers Association (“MBA”) issued a letter to the Conference of State Bank Supervisors addressing near- and long-term considerations for allowing remote work. Since that letter, there has been much activity across states in implementing permanent and temporary remote work authorization. In recognition of the significant changes to the mortgage business resulting from the new normal of remote work, on June 7, 2022, the American Association of Residential Mortgage Regulators (“AARMR”) issued guidance on best practices for permitting employees to work remotely.

In general, the guidance requires licensed mortgage entities to:

1. Develop policies and procedures for adequate supervision of MLOs working remotely;
2. Ensure that MLOs refrain from meeting with consumers in their homes (unless, if applicable, the MLO’s home is licensed as a branch);
3. Ensure that MLOs use a VPN or similar system of authentication for access to the company’s secure origination system;
4. Maintain and update security for devices used to access the company’s secure origination system;
5. Ensure that MLOs refrain from storing physical business records at any location other than the company’s licensed main office; and
6. Ensure that documents are available at a licensed location for regulators to conduct examinations.

The majority of legislation enacted, and guidance adopted, by jurisdictions reflects the framework set out by the MBA and AARMR.

State Response

Following the issuance of the MBA and AARMR guidance, several states have focused on effective implementation of key processes for remote operations. For example, jurisdictions including California, Kansas, Kentucky, Ohio, Pennsylvania, Rhode Island, Tennessee, and Washington require licensees to develop a written information security plan to ensure that the security goals for remote work are met.

States such as California provide specific requirements on the safeguards that must be included in the policy. In another common trend, California, the District of Columbia, Kentucky, Pennsylvania, Rhode Island, and Washington explicitly note that a remote location should not be advertised or represented to consumers as an operating location. Across states, licensees should ensure that consumer and licensee information and records remain accessible for regulatory oversight and exams.

2022 State Activity on Remote Work Authorization

In 2022, eight states (California, Kansas, Kentucky, Ohio, Pennsylvania (Amendment), Rhode Island, South Dakota, and Tennessee) enacted legislation addressing remote work. In addition to passing legislation, Pennsylvania enacted an amendatory measure and Rhode Island issued related guidance. Georgia, Oregon, and Washington adopted regulations implementing previous statutory measures. Finally, nine jurisdictions issued guidance, or extended temporary guidance, regarding remote operations: Colorado, the District of Columbia, Kansas, Maine, Oklahoma, Rhode Island, Vermont, West Virginia, and Wyoming.

As of February 2023,  there were significant developments in remote work guidance and legislation in Montana and California. Montana amended the Montana Mortgage Act to permit and establish the requirements for mortgage business employees to work remotely effective July 1, 2023. The California Department of Financial Protection and Innovation issued guidance permitting remote work by employees of a licensee under the California Residential Mortgage Lending Act.

Outliers and Special Considerations

Jurisdictions have not implemented remote work guidance uniformly. Mortgage companies and MLOs should be aware of unique requirements and restrictions in certain states.

Security and Data Privacy

Mortgage industry regulators and companies are particularly concerned with ensuring responsible handling of data and maintaining the security of company systems and consumer information in connection with remote operations. Reflecting this concern, California’s legislation requires companies to provide employees working remotely with appropriate equipment to perform the work and safeguard records and personal information. In addition to the prohibition on storing physical records at a remote location, California prohibits the receipt of business-related mail at a remote location.

Similarly, the new South Dakota and Rhode Island provisions on remote work mandate employee training on the confidentiality of conversations with, or relating to, consumers that are conducted from the remote location.

Location Requirements

Mortgage companies and MLOs should be aware of particular requirements for the location of an eligible remote work site. Pennsylvania expressly requires that the location where the remote work takes place is not owned or controlled by the licensee. Pennsylvania’s legislation would allow remote work from a location that is under the control of a subsidiary or affiliate of the licensee, if the location is only used by the licensee or on an incidental basis for consumer convenience. Note that under Pennsylvania’s provisions, in-person consumer interaction is permitted at a remote location if that location is not a personal residence.

Regulators may not apply all of these requirements as written. Rhode Island’s provisions include the requirement that the remote location be within a reasonable distance of the licensed place of business or branch location. Despite the text of the statute and regulations, the Department of Business Regulation issued regulatory guidance indicating that “MLOs are not required to live within a certain distance” of a main office or branch location. Instead, companies are required to provide proof of effective supervision of MLOs.

Supervisory Requirements

Some jurisdictions permit remote locations to be licensed as branches, even when the location is a personal residence. Georgia will consider a personal residence to be a branch and subject it to branch licensing requirements when the following conditions are met: (1) advertising the location as place of business; (2) receiving consumers; (3) maintaining physical files; or (4) arranging for the licensee to reimburse rent, utilities, or other expenses for the location. If none of the conditions are met, a personal residence that is a remote work location will not be considered a branch.

As an additional oversight measure, Kansas, Kentucky, and Tennessee require licensees to annually review and certify that employees engaged in remote work meet the applicable requirements under the relevant legislation.

Takeaways

As the Montana measure evidences, the trend towards authorizing and regulating remote work has not stopped in 2023. First, in January, the Nebraska and Virginia legislatures introduced bills related to allowing remote work. Second, more of the jurisdictions that in 2022 updated their remote work statutes are expected to adopt corresponding regulations or issue guidance to implement or supplement the new requirements for remote work authorization. For example, Vermont has announced that it will adopt regulations to implement the changes to its mortgage licensing statute that allow remote work in the coming months.

Further, some states that have not yet authorized remote work for MLOs and mortgage company employees have passed legislation authorizing remote work by employees of companies holding certain non-mortgage licenses. Colorado passed legislation in 2022 to permanently allow supervised lender licensees to work remotely. Colorado is one of the states that has also opted to extend temporary authorization for regulated entities that are not covered by the new legislation, including mortgage licensees into 2023. Based on the activity we have seen so far this year, and announcements regarding anticipated rulemaking activity, MLOs and mortgage company employees should expect future developments in this area.

* We would like to thank Associate, Rachel Myers, for their contribution to this blog post.

[View source.]