Relating to mortgage administration and mortgage servicers

Current law requires a licensee or other mortgagee who services mortgages on residential real estate located in the state to answer in writing, within business days, any written request for payoff information received from a mortgagor or the mortgagor’s designated representative.36. The bill allows a licensee to authorize employees or independent contractors (contractors) to work from a remote location, as defined by the bill, provided that in-person customer interaction does not occur at the residence of an employee or contractor; physical records are not maintained at the remote location; the licensee establishes and enforces policies and procedures to ensure employees and contractors comply with all applicable state and federal laws and rules; the licensee maintains the computer system used by remote employees and contractors and all customer information is maintained in accordance with the licensee’s written information technology security plan, and all applicable state and federal laws; remote employees and contractors access the licensee’s secure systems directly from an out-of-office device using a virtual private network that requires authentication; the licensee has the ability to remotely lock or erase licensee-related contents of any device, or remotely limit access to the licensee’s secure systems; the licensee ensures the installation and maintenance of appropriate alterations to the security of all devices used at remote locations; the licensee ensures that all communications regarding customers comply with federal and state information security requirements; and the licensee annually certifies that all employees and contractors working from a remote location comply with the requirements of the bill. In addition, the record of a mortgage loan originator working from a remote location that is contained in the nationwide mortgage licensing system and registry must designate a licensed location as the mortgage loan originator’s official work location. The bill requires a covered institution (institution) to maintain capital and liquidity, with all financial data determined in accordance with generally accepted accounting principles. “Covered institution” is defined in the bill. An institution may comply with the capital and liquidity requirement by meeting the capital, net worth, and liquidity standards set forth in the federal housing finance agency’s eligibility requirements for enterprise single-family seller-servicers. An institution shall maintain written policies and procedures implementing the capital, operating liquidity, and servicing liquidity requirements, including a sustainable written methodology for satisfying the requirements; make the written policies and procedures available to the administrator upon request; maintain sufficient allowable assets for operating liquidity; and have sound written cash management and sound written business operating plans that match the complexity of the institution and ensure normal business operations. “Administrator” is defined in the bill as the superintendent of the division of banking of the department of insurance and financial services. The bill requires an institution to establish and maintain a board of directors, or, if approved, a similar body, to be responsible for oversight of the covered institution. The board of directors, or similar body, must establish a written corporate governance framework; make the corporate governance framework available to the administrator upon request; monitor and ensure the covered institution complies with the corporate governance framework and with the provisions of the bill; perform accurate and timely regulatory reporting, including filing the mortgage call report; establish internal audit requirements that are appropriate for the institution, and ensure appropriate independence to provide an unbiased evaluation of the institution’s internal control structure, risk management, and governance; make the results of internal audits available to the administrator upon request; and ensure the institution establishes and maintains a risk management program that identifies, measures, monitors, and controls risk commensurate with the institution’s size and complexity. The requirements for the risk management program are detailed in the bill. An institution is required to undergo an annual external audit and to conduct an annual risk management assessment, and make the results of each available to the administrator upon request. “External audit” and “risk management assessment” are defined in the bill.16.