Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act) (Regulation G)

The Secure and Fair Enforcement for Mortgage Licensing Act of 2008 (SAFE Act), 12 U.S.C. § 5101, et seq. was enacted on July 30, 2008, and requires individuals who engage in the business of a residential mortgage loan originator (MLO) to be either state-licensed or federally-registered as MLOs. Federal registration is available only to individuals who are employees of:

• A depository institution (which includes a credit union);
• A subsidiary that is owned and controlled by a depository institution and regulated by a federal banking agency; or
• An institution regulated by the Farm Credit Administration.

Federal registration is done through the Nationwide Mortgage Licensing System and Registry (NMLS) at http://fedregistry.nationwidelicensingsystem.org/Pages/default.aspx .

When an MLO begins the federal registration process through the NMLS, he or she receives a unique identification number. The SAFE Act and its implementing regulation, Regulation G, (12 CFR Part 1007) require this unique identification number to be provided to consumers in specific instances.

The SAFE Act and Regulation G also require the employer of federally-registered MLOs to adopt written policies and procedures to comply with the SAFE Act and Regulation G, and perform annual independent testing of the policies and procedures.
The SAFE Act is codified at 12 U.S.C. §§ 5101 to 5116 and Regulation G is codified at 12 CFR §§ 1007.101 to 1007.105 (with an appendix).

Full text of the SAFE Act can be found here.

Regulation G (SAFE Mortgage Licensing Act – Federal Registration of Residential Mortgage Loan Originators) can be found here.

NCUA Regulation requires federally-insured credit unions to adhere to the requirement of 12 CFR Part 1007 (12 CFR §741.223)

• Definitions
• Associated Risks
• Examination Objectives
• Examination Procedures
• Checklist

Associated Risks

Compliance risk can occur when the credit union does not implement controls to comply with the SAFE Act and Regulation G. The credit union must establish procedures to ensure that third party companies which handle mortgage loan originations have policies and procedures to comply with the SAFE Act, including licensing and/or registration of individuals acting as MLOs.

Transaction risk can occur when the credit union does not have adequate internal controls in place and as a result suffers a loss.

Reputation risk can occur when the credit union incurs fines and penalties or experiences decreased member confidence because it or third party companies did not comply with the SAFE Act and Regulation G.

Strategic risk can occur when the board of directors does not perform due diligence in reviewing policies, and existing and prospective products and services for compliance with Regulation G and the SAFE Act.

Examination Objectives

• To determine if the credit union is in compliance with Regulation G and the SAFE Act.
• To determine if the credit union has written policies and procedures to ensure compliance with Regulation G and the SAFE Act.
• To determine if the annual independent testing of the credit union’s policies and procedures for complying with Regulation G has been conducted.
• To determine if the independent test included a sufficient audit scope to reach a conclusion about whether or not minimum regulatory requirements are being met.
• To determine whether any violations or deficiencies identified during the independent testing have been corrected and that steps have been taken to ensure they do not recur.
• To determine if there is evidence that Mortgage Loan Originators (MLOs) are providing their unique identifiers to consumers as required by § 1007.105.

Examination Procedures

Scoping

1. Determine whether the credit union, or any of its subsidiaries, has one or more MLO employees. For those credit unions without any MLO employees, these review considerations do not need to be completed. (§ 1007.103(a)(2))

Policies and Procedures

1. Determine for credit unions with MLO employees whether the credit union has adopted written policies and procedures and conducts annual independent compliance tests to ensure compliance with Regulation G. (§ 1007.104)
2. Review the credit union’s written policies and procedures and the annual independent compliance tests to determine whether the credit union has taken appropriate steps to ensure compliance with the SAFE Act and Regulation G. These must at a minimum:
   1. Establish a process for identifying which employees of the credit union must be registered MLOs; (§ 1007.104(a))
   2. Require all employees of the credit union who are MLOs to be informed of the registration requirements of the SAFE Act and Regulation G and be instructed on how to comply with the requirements and procedures; (§ 1007.104(b))
   3. Establish procedures to comply with the unique identifier requirements in Regulation G; (§ 1007.104(c))
   4. Establish procedures for confirming the adequacy and accuracy of employee registrations, including updates and renewals, by comparisons with its own records; (§ 1007.104(d))
   5. Establish procedures and tracking systems for monitoring compliance with registration and renewal requirements and procedures; (§ 1007.104(e))
   6. Provide for independent testing for compliance with Regulation G that either credit union personnel or an outside party conducts annually; (§ 1007.104(f))
   7. Provide for action in the case of an employee who fails to comply with the registration requirements of the SAFE Act, Regulation G, or the credit union’s policies and procedures. This includes prohibiting the employee from acting as an MLO or other disciplinary actions; (§ 1007.104(g))
   8. Establish a process for reviewing employee criminal history background reports received according to Regulation G, taking action consistent with federal law (including Section 206(i) of the Federal Credit Union Act (12 U.S.C. § 1786(i)) and Section 741.3(c) of the NCUA Rules and Regulations (12 CFR § 741.3(c))) with respect to the reports, and keeping records of the reports and actions taken regarding applicable employees; and (§ 1007.104(h))
   9. Establish procedures to ensure that any third party with which the credit union has arrangements related to mortgage loan origination has policies and procedures to comply with the SAFE Act, including licensing and/or registration for individuals acting as MLOs. (§ 1007.104(i))

   Use of Unique Identifier

   1. Determine whether credit unions make the unique identification numbers of their MLO employees available to consumers in a practical way. (§ 1007.105(a))
   2. Determine whether federally-registered MLOs provide their unique identification numbers to consumers as required by Regulation G: (§ 1007.105(b)(1)-(3))
      1. Upon request (orally or in writing);
      2. Before acting as an MLO (orally or in writing); and
      3. In any initial written communication (paper or electronic) from the MLO to the consumer (such as a commitment letter, good faith estimate, or disclosure statement).

      Recordkeeping

      1. Determine whether sufficient records are maintained to indicate compliance with all components of the SAFE Act and Regulation G. Credit unions with MLO employees must retain sufficient records to indicate they are in compliance with the registration requirements, review of criminal background checks (where applicable), and the proper use of unique identifiers.
         

      SECURE AND FAIR ENFORCEMENT FOR MORTGAGE LICENSING ACT (SAFE ACT)
      (REGULATION G)
      EXAMINATION CHECKLIST

      General Requirements

      Item	Description	YES	NO	N/A
      1	Does the credit union have a process for identifying which employees of the credit union must be federally-registered as MLOs? (§ 1007.104(a))
      2	Does the credit union have probationary procedures for new MLOs? (§ 1007.103(a)(2))
      3	Does the credit union monitor and regularly review loan transactions to make sure that only registered MLOs are performing MLO activity? (§ 1007.103(a)(2))
      4	Does the credit union require that all employees who are MLOs know about the federal registration requirements of the SAFE Act and Regulation G and be told how to comply? (§ 1007.104(b))
      5	Does the credit union have procedures for confirming the adequacy and accuracy of the credit union’s registration (NMLS Form MU1R)? (§ 1007.103(e))
      6	Is all information in the credit union’s NMLS Form MU1R current? (§ 1007.103(e))
      7	Does the credit union have procedures for confirming the adequacy and accuracy of MLO employee federal registrations, including updates and renewals, by comparing them with its own records? (§ 1007.104(d))
      8	Does the credit union have procedures and tracking systems for monitoring compliance with federal registration and renewal requirements and procedures? (§ 1007.104(e))
      9	Does the credit union take appropriate action if an employee does not comply with the registration requirements of the SAFE Act, Regulation G, or the credit union’s policies and procedures, including prohibiting the employee from acting as an MLO or other disciplinary action? (§ 1007.104(g))
      10	Does the credit union have procedures for reviewing MLO employee criminal history background reports, taking action consistent with federal law, and keeping records of the reports and actions taken regarding those employees? (§ 1007.104(h))
      11	Does the credit union ensure that only employees or authorized representatives of the credit union can view MLO employee criminal history background reports? (Employees of the credit union’s subsidiaries must not be allowed to access these reports. See NMLS FAQs.)
      12	Does the credit union have procedures to ensure that any third party with which the credit union has arrangements for mortgage loan origination has policies and procedures to comply with the SAFE Act and Regulation G, including licensing and/or registration of individuals acting as MLOs? (§ 1007.104(i))
      13	Does the credit union conduct annual independent testing to ensure compliance with the SAFE Act and Regulation G? (§ 1007.104(f))
      14	Does the credit union have procedures to ensure that the NMLS unique identification numbers of its MLO employees are disclosed? (§ 1007.104(c), § 1007.105)
      15	Does the credit union have security controls and procedures in place for accessing the credit union’s NMLS account? (§ 1007.103(e)(1)(i)(F))
      16	Does the credit union prohibit system administrators of the credit union’s NMLS account from acting as MLOs? (Note that there is an exemption for a credit union that has 10 or fewer full-time employees and that is not a subsidiary.) (§ 1007.103(e)(1)(i)(F))
      17	If the credit union is a privately-insured credit union, is it eligible to register via the NMLS’ federal registration system? If not, does the credit union and its MLO employees use the NMLS’ state licensing and registration system? (§ 1007.101(c)(3))
      18	If the credit union is privately-insured and is eligible to register via the NMLS’ federal registration system, does its NMLS listing include the required disclosure statement? (§ 1007.101(c)(3))