Maryland Legal Alert for Financial Services

As reported in the Maryland Register on September 13, 2019, the Commissioner of Financial Regulation adopted amendments to regulations governing licensed Maryland mortgage lenders.

These regulatory amendments, proposed in the Maryland Register published March 1, 2019, are effective October 4, 2019. Many of the amendments are helpful to clarify how Maryland licensed mortgage lenders, brokers and servicers should operate in light of changes in federal and Maryland law (for example, delivery of disclosures consistent with TRID will comply with certain Maryland law). 

Some of the amendments accommodate recent innovations in business practices (for example, permitting electronic delivery of Maryland-required disclosures and use of social media for advertising). 

A few amendments impose new obligations on licensees (for example, a requirement to develop a comprehensive information security program along with policies for governance and risk assessment of that program).

We highlight below some of the more significant changes grouped by subject. These highlights, however, do not substitute for a careful review of all the amendments to ensure compliance with Maryland’s revised mortgage lender licensee regulations. Note that at this time the only way to read the revised regulations as a whole is to piece together (i) the existing regulations found at COMAR 09.03.06), (ii) the proposed regulations (published in the March 1, 2019 Maryland Register), and (iii) the Notice of Final Action (published in the September 13, 2019, issue of the Maryland Register). 

Mortgage Servicer Defined [COMAR 09.03.06.02(28)]

Under Maryland’s statute, “mortgage servicers” must be licensed.  The statute defines “mortgage servicer” as a person who is in the business of servicing mortgage loans for others or who collects or receives payments on mortgage loans directly from borrowers for distribution to others.  The revised regulations include for the first time a definition of “mortgage servicer”, and this regulatory definition is much broader than the definition in the statute.  For example, the regulatory definition of “mortgage servicer” includes a person who, for the benefit of another, evaluates a borrower’s eligibility for loss mitigation or communicates loss mitigation options to borrowers.  This regulatory definition also includes a person who, for the benefit of another, is responsible for supervision of third parties that take action to protect a secured party’s interest in a property.  Although no similar language is expressly included in the regulations, the Notice of Final Action regarding these regulations clarifies that a “mortgage servicer” is limited to a person that performs activities during repayment of a mortgage loan.  Given the reach of this new regulatory definition of “mortgage servicer”, all persons that perform activities in connection with mortgage loans should consider whether licensing might be required or whether to argue that this definition exceeds statutory authority.

Maryland Law Disclosures [COMAR 09.03.06.03, -.07, -.08]

The revised regulations make it clear that written mortgage loan disclosures required by Maryland credit laws may be delivered electronically, subject to compliance with other applicable laws (for example, the federal E-Sign Act and the Maryland Uniform Electronic Transactions Act).  Also, when Maryland law requires that those disclosures be provided within a certain time period after receipt of a loan application, the regulations clarify that this requirement is met if the disclosure is placed in the mail (versus received) before the end of the specified time period.

The proposed regulations included language stating that if a licensee provides disclosures that comply with RESPA and TILA, then the licensee will be deemed in compliance with the Maryland requirement to provide a Financing Agreement and Commitment.  References to all of RESPA and all of TILA was too expansive and this language was removed from the final version.  Instead, the final regulations permit licensees to rely on the Maryland statute which provides that if the licensee gives disclosures in compliance with TRID (as opposed to all of RESPA and TILA), then the licensee will be deemed in compliance with the Maryland requirement to provide a Financing Agreement and Commitment.  Similarly, the regulations are amended to clarify that compliance with TRID will be deemed compliance with Maryland’s prohibition against imposing fees not disclosed in a written agreement signed by the borrower.

Licensing Matters  [COMAR 09.03.06.04, -.16, -.22]

Under Maryland law, there must be an individual (“principal officer”) associated with a mortgage lender entity who has at least three years of experience in the mortgage lending business.  The revised regulations identify those individuals who may qualify as the “principal officer” with three years of experience.

As to all license applications (initial, renewal, amendments), the revised regulations provide more specificity regarding the process the Commissioner’s office must follow if it believes that a license application is incomplete.  This is a welcomed clarification and should assist applicants in understanding what needs to be accomplished and by when, if the Commissioner’s office believes an application is incomplete.

Regarding license renewals, the revised regulations clarify that if a renewal application is filed less than two calendar weeks before the license expires (licenses expire on December 31), then the licensee must cease all licensed activities upon license expiration, including processing and closing loans already in the pipeline (unless the renewal license is approved before that time).  If a renewal application is filed at least two calendar weeks before the license expires, then the licensee may continue to process and close loans in the pipeline before license expiration until the Commissioner takes final action on the renewal application.

The revised regulations further clarify that the amount of the required surety bond (or letter of credit or trust account, if applicable) will be recalculated annually at the time a license is renewed.  The new amount will be based on information provided by the licensee as well as the licensee’s last four quarterly call reports filed with NMLS.

A licensee is now required to notify the Commissioner within 10 business days of any change in the person designated by a licensee in NMLS as being responsible for resolving complaints.

Regarding the posting of licenses, the revised regulations provide more precise direction on how and where the physical license must be posted.

Finally, licensees might find that the costs of examinations or investigations will increase.  Existing regulations provide that a fee of $250 per day per Commissioner employee may be charged.  As amended, the regulations now provide that licensees must pay all reasonable costs, including the actual cost per day for each of the Commissioner’s employees, without any indication what the actual per day cost or “reasonable costs” might be.

Records and Record Retention  [COMAR 09.03.06.05, -.24]

Maryland law allows a licensee to retain records electronically or offsite subject to the Commissioner’s approval.  It has always been unclear how to obtain the necessary approval.  The revised regulations establish a new approval process and explain that electronic or offsite storage is considered approved if the licensee completes an attestation form prescribed by the Commissioner and uploads the form to NMLS.

The regulations also mandate how electronic records must be stored, maintained and protected.  These regulations in particular must be shared with any third-party vendor that assists a licensee in creating and maintaining electronic records.

Records must now be retained for 61 (rather than 25) months following certain events specified in the regulations.  Again, licensees may need to work with third-party vendors to ensure compliance with this significantly longer retention period.

The types of records to be retained have been expanded, particularly as to loan payment history and any foreclosure or bankruptcy proceedings.  Records relating to communications with borrowers have been added to the list of records to be retained by mortgage servicers.  Records relating to broker compensation have been added to the list of records to be retained by mortgage brokers.

The revised regulations establish very short time frames within which records must be provided to the Commissioner upon request.  In addition, the regulations make it clear that the Commissioner may request the records be organized in a particular manner when they are delivered to the Commissioner’s office.  In connection with the new requirement to develop a comprehensive information security program along with policies for governance and risk assessment of that program (discussed below), the licensee must provide a copy of its risk assessments and the results of its periodic testing to the Commissioner upon request.  Waiting to organize records or testing for data security risks until the Commissioner asks for records will put the licensee in a difficult position.

The revised regulations require licensees to immediately notify the Commissioner of any actual or potential loss of records.

Advertising  [COMAR 09.03.06.06]

Existing Maryland regulations require licensees to advertise only using the name or address on the license (or the trade name of a parent corporation).  As amended, the regulations make it clear that a trade name may be used in advertising if it has been approved by the Commissioner and is included in the licensee’s NMLS records.

The revised regulations allow a licensee to use an email or website address that is different from the name or address on the license.  However, the actual content of any email or of a website may only use the name on the license or a trade name that has been approved by the Commissioner.

For the first time, Maryland regulations require that every advertisement must disclose the licensee’s NMLS number.  However, for purposes of complying with this Maryland regulation, if a licensee is using social media for advertising, each statement published through social media does not need to include the licensee’s NMLS number as long as the NMLS number is displayed prominently on the license’s social media profile page.

Ability to Repay  [COMAR 09.03.06.19]

Maryland law requires lenders to determine a mortgage loan borrower’s ability to repay.  The amended regulations update the method a lender should use when giving due regard to a borrower’s ability to repay.  The amendments also provide, as an alternative, that a lender will be deemed in compliance with this Maryland requirement if it complies with TILA’s ability to repay rule.

Supervision of Mortgage Loan Originators  [COMAR 09.03.06.23]

There is a new section in the regulations that details the scope of supervision the Commissioner expects licensees to exercise over MLOs.  It describes factors the Commissioner will consider in determining whether the licensee is providing reasonable and adequate supervision for MLOs. The factors include:  (i) the availability of experienced supervisory personnel who interact with MLOs regarding legal compliance issues; (ii) the regular updating of policies and procedures that provide guidance to MLOs regarding licensing, continuing education, disclosures, advertising, and other legal requirements; and (iii) evidence that the work of MLOs is reviewed and critiqued and that policies and procedures, as updated, are shared with and complied with by MLOs.  Licensees should be ready to show the Commissioner that MLOs are regularly trained on updated laws, policies, and procedures.

Data Protection  [COMAR 09.03.06.24]

There is a new section in the regulations that imposes obligations on licensees to develop, implement, and maintain a comprehensive information security program.  Compliance with the federal banking Interagency Guidelines Establishing Information Security Standards will be deemed compliance with this new Maryland requirement.  To the extent a licensee is not already in compliance with the federal Interagency Guidelines, the licensee should very quickly develop an information security program that meets the requirements of the federal guidelines or the requirements detailed in Maryland’s revised regulations.

Existing Maryland law requires nearly all businesses in Maryland that suffer a data breach to take certain actions, including, when applicable, notifying affected individuals and the Maryland Attorney General of the breach.  The revised regulations provide that a licensee must notify the Commissioner of such a breach before notifying affected individuals.

Reporting Significant Events  [COMAR 09.03.06.25]

There is a new section in the regulations that requires licensees to notify the Commissioner within two business days if certain significant events occur for the licensee, including:  (i) expiration or nonrenewal of, or default under, a line of credit or warehouse agreement; (ii) decrease of net worth below the Maryland minimum requirement; (iii) bankruptcy or insolvency; (iv) receiving notification of initiation of a settlement agreement or other form of consensual resolution, or entry of judgment in any administrative, civil, or criminal action by any governmental agency; (v) becoming aware of systemic violations of the Maryland Mortgage Lender licensing law or regulations or any other Maryland law regulating mortgage lending; and (vi) similar momentous business events.  This is a very short notice period and could get overlooked, so licensees should have a procedure in place to monitor for such events and ensure that the notice is submitted on a timely basis.  Licensees should be sure that consultants and business and legal advisors are aware of this somewhat unique requirement.

Please contact Andrew Bulgin or Christopher Rahl if you have questions or would like assistance in implementing changes.