| Of Interest

A&B Abstract:

On June 9, Illinois became the latest state in a growing trend to authorize remote work for mortgage loan originators and mortgage company employees. This makes five states joining the list of jurisdictions legislatively permitting MLOs to work remotely since Montana enacted similar legislation in March, with more states expected during the 2024 legislative sessions.

The Illinois amendments to The Residential Mortgage License Act of 1987, signed by Governor Pritzker on June 30, 2023, take effect on January 1, 2024 and specifies requirements that licensed MLOs must follow to allow employees to work from remote locations. These changes include:

Requiring the licensee to have written policies and procedures for supervising mortgage loan originators working from a remote location;
Restricting access to company platforms and customer information in accordance with the licensee’s comprehensive written information security plan;
Prohibiting in-person customer interactions at a mortgage originator’s residence unless the residence is a licensed location;
Prohibiting maintaining physical records at a remote location;
Requiring customer interactions and conversations about consumers to be in compliance with state and federal information security requirements.
Mandating mortgage loan originators working from a remote location to use a secure connection, either through a virtual private network (VPN) or other comparable system, to access the company’s system;
Ensuring the licensee maintains appropriate security updates, patches, or other alterations to devices used for remote work;
Requiring the licensee to be able to remotely lock, erase, or otherwise remotely limit access to company-related contents on any device; and
Designating the loan originator’s local licensed office as their principal place of business on the NMLS.

Nevada, Virginia, and Florida passed legislation resembling the Illinois law, mandating similar security, compliance, and surveillance requirements.

Temporary Guidance Ending

Remote work flexibility is now the majority stance for the industry. The four states mentioned above are the most recent since Montana passed similar legislation in March. Of the 53 U.S. jurisdictions tracked by the Mortgage Bankers Association (including Washington, D.C., Guam, and Puerto Rico), 30 have implemented permanent statutes or regulations allowing remote work, with 9 more jurisdictions still operating under temporary guidance permitting remote work.

Of the states still operating under temporary guidance, Oklahoma’s guidance expires December 31, 2023. The state government will need to take further action, whether legislative or regulatory, to continue to allow MLOs to work remotely. Louisiana issued temporary guidance in July 2020, which would stay active, “as long as there is a public health emergency relating to COVID-19, as declared by Governor Edwards of the State of Louisiana, or until rescinded or replaced.” Governor Edwards ended the emergency in March 2022 when he did not renew the expiring order. Remote work in Louisiana is now operating in a grey zone with regards to whether the temporary order is still in effect due to the, “until rescinded” language.

Different Methods, Similar Results

Although remote work is the new norm, states are taking different routes to allow MLOs to work remotely. Many statehouses passed legislative statutes, which allow for stable policies but can be difficult to revise through the legislative process. These statutes tend to follow similar structures and have similar requirements. Illinois, Virginia, Florida, and Nevada require MLOs to work from home so long as certain records are not maintained in remote locations, professionals do not meet with customers outside of licensed facilities, employees are properly supervised as required by the license, and the company maintains adequate cybersecurity measures to protect customer data.

Nebraska’s state legislature did not pass specific guidance regarding remote work for MLOs, but rather, passed authorization to allow the Nebraska Department of Banking and Finance to promulgate regulations allowing remote work for MLOs. The Department has not yet issued permanent guidance for local MLOs regarding remote work requirements. Although using the regulatory system to implement rules may take longer to implement, it is also more flexible to changing circumstances and generally permits regulators to revise guidance faster than it takes a state legislature to convene, draft, and pass appropriate amendments to existing legislation.

Takeaway

The post-COVID workforce is clinging onto the last bit of convenience that the pandemic forced upon us. Surveys show that remote work flexibility is now the primary perk that would drive people to different employers. Since the technology needed to safely conduct business remotely is now proven, states are realizing that the easiest way to retain qualified mortgage professionals is to allow remote work flexibility. The American Association of Residential Mortgage Regulators (AARMR) expressed concern over a lack of remote work options in 2022 before states started passing permanent legislation. State legislatures embraced AARMR’s concern that a lack of remote work options could cause professionals to leave the industry, further widening the access gap for already underserved communities. The remote work trend has touched other industries that were previously in-person only and is likely to grow in those other industries (e.g., remote notarization) as far as practically feasible.

* We would like to thank Associate, CJ Blaney, for their contributions to this blog post.

A&B ABstract:

Effective July 1, Montana will become the latest jurisdiction to codify authorization for mortgage loan originators and mortgage company employees to engage in remote work. That legislation follows a general trend over the past year – and, more so, since the early days of the COVID-19 pandemic – to allow remote operations.

No longer a temporary measure necessitated by pandemic lockdowns, remote work is increasingly acknowledged by regulators as an acceptable permanent option for today’s working environment. Last year, 18 jurisdictions took action to extend temporary permission for, or permanently authorize, the practice, and the trend continues in 2023.

Updates to the Montana Mortgage Act

On February 16, Montana Governor Greg Gianforte signed House Bill 30, substantively amending the Montana Mortgage Act and adding requirements relating to the conduct of mortgage business from a remote location. Specifically, the measure requires that each employee or independent contractor engaged in remote work:

Does not meet with the public at an unlicensed personal residence;
Does not maintain physical or electronic business records at the remote location;
Does not display any signage or advertising of the entity or the MLO at a remote location;
Takes reasonable precautions to protect confidential information in accordance with state and federal laws; and
Ensures that their NMLS records designate a properly licensed location as the MLO’s official workstation and a manager as a supervisor.

Further, the amended Act mandates that a licensed entity must:

Have written policies and procedures for working remotely, and supervise and enforce those policies and procedures;
Ensure that any device used to engage in the mortgage business has appropriate security, encryption, and device management controls to ensure the security and confidentiality of customer information;
Maintain its computer systems and customer information in accordance with its information technology security plan and all state and federal laws; and
Annually review and certify that its employees and independent contractors engaged in the mortgage business from remote locations meet specific requirements, and, upon request, provide the Department of Administration with written documentation of such review.

As discussed further below, the Montana measure follows a pattern established by other states, where remote work requirements have been established by regulatory guidance, and by temporary and then permanent legislation, since mid-2020.

Remote Work Authorization Trends 2020 to Present

The purpose of the legislative and regulatory guidance on remote work has changed since the spring of 2020. Remote work was already considered increasingly viable prior to the COVID-19 pandemic. Permissions and adaptations for remote work accelerated drastically with the onset of the pandemic in the spring of 2020. Today, guidance initially necessitated as an emergency response has become a permanent approach to regulating remote work in many states, enabling mortgage companies to take advantage of the benefits of a new mode of operations.

Throughout the evolution of the remote work trend, industry associations have stepped in to survey the regulatory choices being made across states and to recommend best practices. In July 2020, the Mortgage Bankers Association (“MBA”) issued a letter to the Conference of State Bank Supervisors addressing near- and long-term considerations for allowing remote work. Since that letter, there has been much activity across states in implementing permanent and temporary remote work authorization. In recognition of the significant changes to the mortgage business resulting from the new normal of remote work, on June 7, 2022, the American Association of Residential Mortgage Regulators (“AARMR”) issued guidance on best practices for permitting employees to work remotely.

In general, the guidance requires licensed mortgage entities to:

Develop policies and procedures for adequate supervision of MLOs working remotely;
Ensure that MLOs refrain from meeting with consumers in their homes (unless, if applicable, the MLO’s home is licensed as a branch);
Ensure that MLOs use a VPN or similar system of authentication for access to the company’s secure origination system;
Maintain and update security for devices used to access the company’s secure origination system;
Ensure that MLOs refrain from storing physical business records at any location other than the company’s licensed main office; and
Ensure that documents are available at a licensed location for regulators to conduct examinations.

The majority of legislation enacted, and guidance adopted, by jurisdictions reflects the framework set out by the MBA and AARMR.

State Response

Following the issuance of the MBA and AARMR guidance, several states have focused on effective implementation of key processes for remote operations. For example, jurisdictions including California, Kansas, Kentucky, Ohio, Pennsylvania, Rhode Island, Tennessee, and Washington require licensees to develop a written information security plan to ensure that the security goals for remote work are met.

States such as California provide specific requirements on the safeguards that must be included in the policy. In another common trend, California, the District of Columbia, Kentucky, Pennsylvania, Rhode Island, and Washington explicitly note that a remote location should not be advertised or represented to consumers as an operating location. Across states, licensees should ensure that consumer and licensee information and records remain accessible for regulatory oversight and exams.

2022 State Activity on Remote Work Authorization

In 2022, eight states (California, Kansas, Kentucky, Ohio, Pennsylvania (Amendment), Rhode Island, South Dakota, and Tennessee) enacted legislation addressing remote work. In addition to passing legislation, Pennsylvania enacted an amendatory measure and Rhode Island issued related guidance. Georgia, Oregon, and Washington adopted regulations implementing previous statutory measures. Finally, nine jurisdictions issued guidance, or extended temporary guidance, regarding remote operations: Colorado, the District of Columbia, Kansas, Maine, Oklahoma, Rhode Island, Vermont, West Virginia, and Wyoming.

As of February 2023, there were significant developments in remote work guidance and legislation in Montana and California. Montana amended the Montana Mortgage Act to permit and establish the requirements for mortgage business employees to work remotely effective July 1, 2023. The California Department of Financial Protection and Innovation issued guidance permitting remote work by employees of a licensee under the California Residential Mortgage Lending Act.

Outliers and Special Considerations

Jurisdictions have not implemented remote work guidance uniformly. Mortgage companies and MLOs should be aware of unique requirements and restrictions in certain states.

Security and Data Privacy

Mortgage industry regulators and companies are particularly concerned with ensuring responsible handling of data and maintaining the security of company systems and consumer information in connection with remote operations. Reflecting this concern, California’s legislation requires companies to provide employees working remotely with appropriate equipment to perform the work and safeguard records and personal information. In addition to the prohibition on storing physical records at a remote location, California prohibits the receipt of business-related mail at a remote location.

Similarly, the new South Dakota and Rhode Island provisions on remote work mandate employee training on the confidentiality of conversations with, or relating to, consumers that are conducted from the remote location.

Location Requirements

Mortgage companies and MLOs should be aware of particular requirements for the location of an eligible remote work site. Pennsylvania expressly requires that the location where the remote work takes place is not owned or controlled by the licensee. Pennsylvania’s legislation would allow remote work from a location that is under the control of a subsidiary or affiliate of the licensee, if the location is only used by the licensee or on an incidental basis for consumer convenience. Note that under Pennsylvania’s provisions, in-person consumer interaction is permitted at a remote location if that location is not a personal residence.

Regulators may not apply all of these requirements as written. Rhode Island’s provisions include the requirement that the remote location be within a reasonable distance of the licensed place of business or branch location. Despite the text of the statute and regulations, the Department of Business Regulation issued regulatory guidance indicating that “MLOs are not required to live within a certain distance” of a main office or branch location. Instead, companies are required to provide proof of effective supervision of MLOs.

Supervisory Requirements

Some jurisdictions permit remote locations to be licensed as branches, even when the location is a personal residence. Georgia will consider a personal residence to be a branch and subject it to branch licensing requirements when the following conditions are met: (1) advertising the location as place of business; (2) receiving consumers; (3) maintaining physical files; or (4) arranging for the licensee to reimburse rent, utilities, or other expenses for the location. If none of the conditions are met, a personal residence that is a remote work location will not be considered a branch.

As an additional oversight measure, Kansas, Kentucky, and Tennessee require licensees to annually review and certify that employees engaged in remote work meet the applicable requirements under the relevant legislation.

Takeaways

As the Montana measure evidences, the trend towards authorizing and regulating remote work has not stopped in 2023. First, in January, the Nebraska and Virginia legislatures introduced bills related to allowing remote work. Second, more of the jurisdictions that in 2022 updated their remote work statutes are expected to adopt corresponding regulations or issue guidance to implement or supplement the new requirements for remote work authorization. For example, Vermont has announced that it will adopt regulations to implement the changes to its mortgage licensing statute that allow remote work in the coming months.

Further, some states that have not yet authorized remote work for MLOs and mortgage company employees have passed legislation authorizing remote work by employees of companies holding certain non-mortgage licenses. Colorado passed legislation in 2022 to permanently allow supervised lender licensees to work remotely. Colorado is one of the states that has also opted to extend temporary authorization for regulated entities that are not covered by the new legislation, including mortgage licensees into 2023. Based on the activity we have seen so far this year, and announcements regarding anticipated rulemaking activity, MLOs and mortgage company employees should expect future developments in this area.

* We would like to thank Associate, Rachel Myers, for their contribution to this blog post.