States Continue Trend to Permit Remote Work For Licensee Employees

Additional Author: Anthony Jenkins

Many industries continue to adapt to the prevalence of post-pandemic remote or hybrid work arrangements, and the consumer finance industry is no different. One significant obstacle to remote or hybrid work arrangements is that—at least before the COVID-19 pandemic—many state mortgage or consumer finance laws either prohibit remote work, or require any location where licensable activity is done to be licensed as a branch office, which can render remote work impractical or unfeasible. While many states initially permitted remote work through temporary executive orders, agency guidance, or bulletins, several states have adjusted to the “new normal” of post-pandemic remote work by enacting legislation to codify mortgage loan originators or other licensed individuals’ ability to work from home without the individual’s remote location being considered a branch office that must be licensed. In this article, we discuss recent remote work guidance and legislation in California, Florida, Montana, and West Virginia. These four join the growing list of states that have authorized mortgage loan originators and consumer lenders to engage in remote work since the onset of the COVID-19 pandemic.

California

With California ending its COVID-19 State of Emergency on February 28, 2023, the California Department of Financial Protection and Innovation (“DFPI”) issued guidance regarding remote work under the California Residential Mortgage Lending Act (“CRMLA”). The guidance clarifies that the CRMLA does not expressly prohibit employees of a licensee from working at a remote location, such as an employee’s home. The DFPI guidance states that a licensee may authorize an employee to perform limited functions at a remote location without that location being considered a branch office (which would then require the location to obtain a separate branch license), provided that the location does not have the “indicia” of a branch office and is not advertised to the public as a business location. The guidance also reiterates a branch manager’s obligation to adequately supervise each MLO and employee, whether or not they work remotely, and notes that the DFPI will continue to examine licensees to determine whether branch managers are adequately supervising employees.

The DFPI set forth the following criteria that it will consider when determining whether a location is adequately supervised by a licensee, or whether it has the indicia of a branch office:

• Only one employee, or multiple employees who reside at the location and are members of the same immediate family, work at the remote location.
• If confidential physical files are accessible at the remote location, and whether the remote location contains secure storage that protects confidential physical files.
• The MLO is assigned to a designated branch office, and the MLO’s designated branch office is reflected on all communications to the public by the MLO.
• The employee’s communications with the public are subject to the licensee’s supervision or a designated communication person.Electronic mail is through the licensee’s email system.
• All loan processing is reviewable at the main or branch office.
• Written supervisory procedures pertaining to supervision of loan origination and lending activities conducted remotely are maintained and enforced by the licensee.
• A list of the remote locations is maintained by the licensee.
• All records can be accessed by the DFPI at the main or branch office location.
• Written supervisory procedures contain specific provisions regarding cybersecurity and a virtual privacy network (VPN) or other secure system at the remote location, including multi-factor authentication, a back-up and data recovery system, and protocols in the event of a cybersecurity incident.

Florida
On May 4, 2023, the Florida legislature enacted House Bill 1185, which amended the Florida Mortgage Lenders, Mortgage Brokers, and Loan Originators Act. House Bill 1185 authorizes a licensee to allow loan originators to work from remote locations, without those locations being required to be licensed as branch offices, if specified conditions are met. A “branch office” is now defined as “a location, other than a mortgage broker’s or mortgage lender’s principal place of business or remote location.” A “remote location” is defined in turn as “[a] location, other than a principal place of business or a branch office, at which a loan originator of a licensee may conduct business.”

• The licensee has written policies and procedures for the supervision of loan originators working from remote locations.
• Access to the company platforms and customer information is in accordance with the licensee’s comprehensive written information security plan.
• In-person customer interaction does not occur at a loan originator’s residence unless such residence is a licensed location.
• Physical records are not maintained at a remote location.
• Customer interactions and conversations about consumers will be in compliance with federal and state information security requirements, including applicable provisions under the Gramm-Leach-Bliley Act and the Safeguards Rule established by the Federal Trade Commission.
• A loan originator working at a remote location accesses the company’s secure systems or documents, including a cloud-based system, directly from any out-of-office device such as a laptop, phone, desktop computer, or tablet, through a virtual private network or system that ensures secure connectivity and that requires passwords or other forms of authentication to access.
• The licensee ensures that appropriate security updates, patches, or other alterations to the security of all devices used at remote locations are installed and maintained.
• The licensee is able to remotely lock or erase company-related contents of any device or otherwise remotely limit all access to a company’s secure systems.
• The NMLS registry’s record of a loan originator who works from a remote location designates the principal place of business as the loan originator’s registered location, or the loan originator has elected a licensed branch office as a registered location.

If signed by the governor, House Bill 1185 will take effect on July 1, 2023.

Montana

On February 16, 2023, Montana Governor Greg Gianforte signed House Bill 30 into law. House Bill 30 revises the Montana Mortgage Act to allow licensable mortgage business to be conducted remotely, subject to certain conditions. The bill clarifies that a mortgage loan originator working from a remote location is not a branch office if the perquisites for remote work are met, and the licensee’s designated manager is responsible for the mortgage origination activity of all MLOs, employees, independent contractors, and agents assigned to the licensee. The prerequisites for the mortgage company and its employees to engage in remote work pursuant to House Bill 30 include:

• Employees do not meet with the public at an unlicensed personal residence.
• No physical or electronic business records are maintained at the remote location.
• The licensed mortgage entity has written policies and procedures for working remotely and the entity supervises and enforces the policies and procedures.
• There is no signage or advertising of the entity or the mortgage loan originator displayed at any remote work location.
• The licensed mortgage entity maintains the computer system and customer information in accordance with the entity’s information security plan and all state and federal laws.
• Devices used to engage in mortgage business have the appropriate security, encryption, and device management controls to ensure the security and confidentiality of consumer information in accordance with Department of Banking regulations.
• The licensed mortgage entity’s employees and independent contractors take reasonable precautions to protect confidential information in accordance with state and federal laws.
• The NMLS record of a mortgage loan originator that works remotely designates a properly licensed location as the mortgage loan originator’s official workstation and a designated manager as a supervisor.
• The licensed mortgage entity annually reviews and certifies that the employees and independent contractors engaged in mortgage business at the remote location meet specific requirements set forth in House Bill 30 and provide written documentation of the licensee’s review to the department upon request.

The law will take effect July 1, 2023.

West Virginia

On March 29, 2023, West Virginia Governor Jim Justice signed House Bill 3500, which amends the West Virginia Consumer Credit and Protection Act to authorize employees of regulated consumer lender licensees that are located in West Virginia to perform work at their residence. The amended Consumer Credit and Protection Act permits employees of a licensee to conduct consumer loan business at any location other than the one designated by the licensee as its place of business, provided that the remote location is located within 100 miles of a licensed West Virginia corporation or branch office, and the licensee ensures the following:

• No in-person customer interactions will be conducted at the other location, and that the licensee will not designate the remote location as a business location to consumers or customers.
• Appropriate data security and privacy safeguards are implemented for licensee and consumer data, information, and records, including the use of secure virtual private networks.
• Appropriate risk-based monitoring and oversight processes of work performed by the employees of a licensee at their other location are in place, and the licensee maintains records of this monitoring and oversight.
• No consumer information and records are maintained at the remote location.
• All consumer and licensee information and records remain accessible and available for regulatory oversight and examinations.
• Employees are trained to, and keep confidential, all conversations about, and with, consumers that may be conducted at the remote location.

Prior to authorizing work at a remote location, the licensee must establish written policies and procedures to ensure compliance with the remote work requirement. Once a licensee has authorized its employees to work remotely, the licensee must periodically review and document its compliance with the remote work requirements and its written policies and procedures governing remote work, and provide an annual certification to regulators that the remote work requirements have been met for each employee working at a remote location. House Bill 3500 will take effect on June 7, 2023, 90 days from when the law was passed.