Brokers: Do I Report HMDA Data?

2/28/23 Update

Significant threshold changes - much lower thresholds may impact non-delegated correspondents. 

4/6/2017 Update

As we approach the 2018 HMDA reporting window, with the wider rubric for filing requirement, we are getting many calls from brokers about preparing to become reporters. We want to reiterate that a broker business that categorizes its customers as PRE-QUALIFICATIONS until the loan is referred to an investor DOES NOT HAVE TO REPORT HMDA DATA.

1.) HMDA is an extension of ECOA, so if you are not making credit decisions, you do not report. Only the ultimate decision maker reports.
2.) Technically, brokers CANNOT make decisions because they do not have the funds available to unilaterally fund applications. 
3.) Many states sanction brokers who represent that they are lenders

Original Post From 12/5/13

As compliance season descends on the mortgage business again, we start to hear growing numbers of concerns over how a firm will comply with a nuance of a rule.  Often the concern originates with a rumor or other misinformation from a networking group or an e-mail from a service provider looking for business. With respect to brokers, you should generally avoid reporting HMDA denial data for the simple reason that BROKERS DO NOT MAKE CREDIT DECISIONS.

Among the risks you expose yourself to:

• State Regulator sanctions for acting as a lender without a lender license.
• Scrutiny from a Federal regulator regarding why ALL your loans are denied?
• Inconsistent reporting/reporting errors on other reports

NMLS Call Report - Requests Denied Applications

The idea that brokers should report HMDA data may come from the fact that the NMLS Call Report has a line item for "Denied."  However, this is not the intention of this element of call reporting:  this is to identify the "net loan volume."  (Pipeline + New Loans - Closed, Withdrawn and Denied Loans = Ending Pipeline) The denied loans, in this case, should be loans that you will never close because ALL of your wholesalers or investors have denied them.

Brokers should only put the loans which the INVESTOR has denied in this column.

NMLS Call Report - Don't include pre-qualifications you have denied.

Is It Really a Loan Until the Lender Has It?

If you are a straight broker, and not a mini-correspondent, you should define your application policy to ensure that loans which will not be sent to an investor, for whatever reason, are coded as pre-qualifications. Pre-Qualifications do not trigger HMDA Reporting.  This does not mean that you will not send GFE or other property or application related disclosures if you are actively processing the file.

According to the staff commentary in the HMDA Small Entity Compliance Guide: "2. Pre-Qualification. A pre-qualification request is a request by a prospective loan applicant (other than a request for preapproval) for a preliminary determination on whether the prospective applicant would likely qualify for credit under an institution’s standards, or for a determination on the amount of credit for which the prospective applicant would likely qualify. Some institutions evaluate pre-qualification requests through a procedure that is separate from the institution’s normal loan application process; others use the same process. In either case, Regulation C does not require an institution to report pre-qualification requests on the HMDA/LAR, even though these requests may constitute applications under Regulation B for purposes of adverse action notices." Commentary Appendix D, Supplement I

HMDA Small Entity Guide

ECOA, Fair Lending and Loan Disposition - Not to be Confused with HMDA Reporting

Due to the overlay of so many regulations, it can be easy to confuse what rule requires what actions.  You are still required to adhere to Fair Lending and Equal Credit Opportunity Act (Regulation B) guidelines with respect to providing an applicant with a disposition within 30 days.  To avoid monitoring challenges and potential violations on small pipelines use your Incomplete Application Notice on all loans.  If the customer fails to provide all of the information, you can withdraw the loan from your pipeline without any further action.  You MAY optionally send a letter noting the withdrawal.   

Avoid Being the Creditor

Under the current regulatory scheme, lenders bear the burden for credit and disclosure risks.  A correctly structured broker pre-qualification process allows for the unique opportunity to avoid many of the lender's pitfalls with respect to creditor actions.

New York State "Cybersecurity" Requirements

If you own your network infrastructure, big changes coming to New York

For MortgageManuals.com customers, your Information Security Plan covers the requirements

New York State licensed financial entities have received notice of new specific requirements for cyber-security. Rules went into effective March 1, 2017, and compliance deadlines start August 28, 2017. Cyber-security is a synonym for information security when data is stored or accessed via an electronic information storage and retrieval network. In other words, cyber-security deals with network security in addition to basic information security.

Complete text of Cyber-security Rule

At the heart of the requirements, aside from standard information security remediation, companies must have some form of dual factor authorization. If you use a token or mobile password in addition to your password, you probably already comply.

Are you Exempt?

The law contains a number of key exemptions:

Exemption - Asset Size: < 10 employees OR < $5 MM in revenue OR < $10 MM assets

Exempt from 500.04, 500.05, 500.06, 500.08, 500.10, 500.12, 500.14, 500.15, and 500.16

You must still have policies and procedures, you must control access, conduct a risk assessment, identify if 3rd parties have an CISP,

Exemption - "Agent" classification: If you use someone else's system (such as wholesaler's or investor's)

Exemption - No server: If you don't own and operate the infrastructure

Exempt from 500.02, 500.03, 500.04, 500.05, 500.06, 500.07, 500.08, 500.10, 500.12, 500.14, 500.15, and 500.16

You must still control access, conduct a risk assessment and identify if 3rd parties have a CISP.

IF YOU ARE EXEMPT, YOU MUST FILE AN EXEMPTION BY AUGUST 28, 2017. A copy of the exemption certification is on the last page of the announcement - click here.

To file your exemption certificate go to http://www.dfs.ny.gov/about/cybersecurity.htm and click on the large orange filing button graphic.

If you are NOT Exempt

For entities which are NOT exempt, we identify where your policies and procedures meet the requirements. While there are a number of preparations entities must make to comply, unless you maintain your own servers the actual, physical changes normally will be undertaken by your third party infrastructure provider.

If you obtained your information security policy from us, you may share it with your infrastructure vendors, as it addresses the requirements:

Section 500.02 Cybersecurity Program

By virtue of having a written policy in place, you comply with this section. In addition, our policy states the protocol for testing the program, another requirement of this section.

Section 500.03 Policy 

This section defines what must be in your policy and procedure. We identify those things that are the responsibility of the network provider, and those which are the responsibility of the mortgage company.

(a) information security; the actual plan for protecting NPI - #1 - mortgage company
(b) data governance and classification; the system by which you identify data that is NPI - #2 -  mortgage company
(c) asset inventory and device management; infrastructure provider
(d) access controls and identity management; infrastructure provider & #3 password policy mortgage company
(e) business continuity and disaster recovery planning and resources; #4 mortgage company
(f) systems operations and availability concerns; infrastructure provider
(g) systems and network security; infrastructure provider
(h) systems and network monitoring; infrastructure provider
(i) systems and application development and quality assurance; infrastructure provider
(j) physical security and environmental controls; #5 mortgage company
(k) customer data privacy; #6 mortgage company
(l) vendor and Third Party Service Provider management; #7 mortgage company
(m) risk assessment; #8 mortgage company
(n) incident response. #9 mortgage company

Citation	Requirement	Addressed in Info Security Plan
500.04	Chief Information Security Officer (CISO) – you must install one, if you don’t have one	2-90 #5
500.05	Penetration Testing – CISO must conduct yearly, vulnerability assessment every 6 mos	2-90-4 #7
500.06	Audit Trail – keep records of all activity	2-90-3
500.07	Access Control – must control access to NPI on network	2-90-2 #3
500.08	App Security – certify developed programs free of defects	N/A
500.09	Risk Assessment – Identify what NPI is at risk when	2-90-2 #8
500.10	Personnel – must have training and certifications	2-90-7 #9
500.11	3rd Party Assessments – evaluate whether 3rd parties comply	2-90-4 #7
500.12	Multi-Factor Authentication – must have at least 2	2-90-2 #3
500.13	Records Retention – limits on NPI data retained	2-90-2 #10
500.14	Training – must train annually	2-90-6 #9
500.15	Encryption – NPI protected by encryption during transit	2-90-2 #11
500.16	Incident Response Plan	2-90-2 #2

Page 1 - Information Security Plan - Showing References to Requirements

Page 2 - Information Security Plan 

Page 1 - Disaster Recovery Plan/Business Continuity Plan

Page 1 - Customer Privacy Policy

Updated Regulatory Compliance One-Pager

Mortgage Compliance One-Pager - Desk Reference/Study Guide for laminating

Updated 3/17/17

I recently re-took the NMLS' National Test with Uniform State Component. I neglected to take the Uniform State Test add-on when it first came out, but thought that if I needed to add additional licenses later, it wouldn't be so bad to re-take the National Test. I worried that I might have a problem because the last time I took it, I really struggled with the intricate test questions, puzzling over three or possibly four correct answers to decide which one was the "best right answer." This time, I found the test questions much more straight-forward. The bad news: I didn't score 100. What did I get wrong?

I should have studied my own mortgage compliance guide!

I have found that people don't really like to read pages and pages of material. "Can't you cook it down for me?" they ask. So we did. We authored a series of "QuickNotes" (QuickStart: QuickNotes... get it?) which have helped thousands cram and pass the national test. These one page "cheat sheets" boil the material down to its most fundamental level.

Regulatory Compliance Matrix - Click to Download

Document Not Clicking? Try this link.

Loan officers love our cheat sheets. Compliance trainers and regulators hate them. "There's not enough content!" they complain. But the infographic tells it all. Sure you can study MORE, but loan officers aren't attorneys. We get lost reading 3000 pages of code. Just like an attorney or compliance officer would get lost reading 3000 rate sheets and program guidelines a day.

We use this methodology in our new loan originator training, too. Instead of 2000 words describing how to to something, we give an illustrated form, a checklist, or a reference tool like this one which highlights Ability to Repay Guidelines.

Ability to Repay and Mortgage Knowledge Tools - Click to Download

Click here to download these tools at no cost or obligation. Also, feel free to provide feedback.

What I THINK I got wrong...

• PMI Cancellation @78% 
• Do Not Call from 8am to 9pm
• Balloon Payment Qualifying
• Section 32 (High Costs) max Debt Ratio is 50%
• Confusing question on Finance Charges with options I would consider ALL to be finance charges. (I think they wanted the recording fee, still not sure)

These items are ALL on the study guides, so my advice is to study these all. I knew I was going to pass, but I was surprised about how many questions I had to review at the end.

CFPB's Complaint Line a "Targeting Tool"

The targeting of audit subjects through the use of the CFPB Complaint Portal means you need a proactive complaint resolution process

Since the Consumer Financial Protection Bureau began accepting complaints related to mortgage transactions in 2011, the industry's fears that this would simply act as a targeting mechanism have been realized. Multiple complaints, more than a single complaint, act as a red flag attracting the worst kind of scrutiny. Recent presentations by CFPB Senior Analyst Ann Thompson confirmed this. As a preventative tool, our first recommendation involves adding a daily or weekly check of state and national complaint portals by the company's compliance manager.

But it goes beyond dealing with complaints. You must take a proactive attitude. Make it easy for your customers to file a complaint with you and company management directly, before the customer elevates it to the regulator to resolve it. This means:

• Adding prominent "complaint" button on web pages
• Proactively sourcing "compliments and complaints" via promotional materials
• Asking customers "have I addressed all of your concerns today?" question in the footer of all electronic communications

In addition, have an effective process for resolving complaints once they arise. This is called a "Complaint Resolution Process"

More importantly, though, all employees need to understand they must participate in communicating to troubleshoot, document and resolve complaints.

Complaint Resolution 101

This is a problem solving business, and there is rarely a loan where absolutely everything goes as planned.

If you have our Quality Control and Compliance Modules we provide you with a Complaint Resolution Policy template. It's time to pull it out and make sure you are ready to adhere to it.

Rule # 1

LISTEN! Listen to the customers complaint. Identify what the customer's real problem is and acknowledge that it is a problem. You do not have to admit fault to show empathy.

Rule # 2

DOCUMENT! Make sure the file has been documented with correspondence and that the conversation log has been populated. Complete a complaint report and deliver it to the manager for review.

Rule # 3

RESOLVE and close the complaint. Based on the manager's determination, diary your Outlook Calendar to follow up with the customer and ascertain that the problem was handled. Not every customer will be happy, but if you are responsive, the customer will not automatically elevate the complaint.

Sample Complaint Resolution Policy - Request a Free One

State Examinations - AML/BSA Compliance - Self-Audit Checklist to Ensure Compliance

The Anti-Money Laundering rule (AML) implemented by the Bank Secrecy Act (BSA) creates many questions for lenders and brokers. We know that state examiners focus on a number of specific issues. A recent spate of calls reveals that New York, Indiana, Texas and Pennsylvania have questionnaires and examiners that ask pointed questions about the AML/BSA compliance program for mortgage originators.  To ensure that you are hitting all of the requirements we have compiled a self-audit checklist for you to use to evaluate and collect data.  You should run through this checklist annually.

Use the BSA/AML Self-Audit Checklist for mortgage originators, to ensure you keep all of the information needed for an examination.  Members may download the original form for customization from http://www.mortgagepolicymanual.com/updates-and-downloads.html or mortgagemanuals.com/updatesanddownloads.htm

Compliance Officer Training

New York's examination findings sometimes cite a recommendation for the compliance officer to have training.  The FinCEN rule requires training, but does not say that it must come from a certified 3rd party.  FinCEN offers training on its website, and many compliance providers provide training for a fee. Familiarity with the rule - actually reading your policy - also counts as training.

Here is a video that instructs the Compliance Officer how to register for the FinCEN portal to report SARs

Quality Control and AML

We do not recommend that firms maintain a separate Anti-Money Laundering Plan, but rather that they integrate the AML process with their Quality Control function.  After all, FinCEN wrote the AML rule as a fraud detection/reporting requirement, and that is exactly what the quality control plan should do.  As a consequence, make sure your quality control plan has a robust red flag feature.

Register for the Portal

Your plan loses credibility if your compliance officer isn't even registered with the FinCEN portal.  It implies that you have no intention of participating in the program.  This simple fix will eliminate many citations.