What items MUST a Broker retain independently in each loan file

Don't let your wholesaler tell you they've got everything you need. They don't. Important lessons in regulatory audits and examinations. 

"If you only do ONE THING - post close your loan files."

Brokers - ALWAYS Retain All Loan Documents

I cannot overstate the importance of meticulous record-keeping. Regulatory requirements and best practices require brokers to maintain comprehensive records of all loan transactions, including disclosure events and closing documents. 

I hear people saying, "I don't see anything in the regulations that says I have to keep certain documents..." but your regulator will require copies of all documents on all the loans you handle. In this article, we provide an explanation of what documents regulators hold brokers accountable for. 

I also hear people saying "My wholesaler will give me copies of everything if I ask for it. So I don't need to post-close my loan files..." While the wholesaler will retain copies, and may also provide a copy of a file a long time after loan closing, we see a lot of inconsistency in the condition of those document stacks from the lender. They can look like a jumble, which will require you to reprocess the file. Furthermore, what happens if the lender shuts down, gets merged or otherwise doesn't have the ability to provide what you need? 

Record Retention Requirements

As a broker, your record retention involves both the disclosures you issue and those provided by the lender. While federal and state regulations may not explicitly mandate the retention of all documents from the lender, best practices and regulatory expectations strongly advise maintaining a complete set of records. 

Also, your loans progress in stages and may not complete or get submitted to the lender. Our system suggests what you must retain at various stages of the process. 

We provide a checklist of this here:

Key Practices and Checklists

1. Retain All Broker-Issued Disclosures:

   • Initial Loan Application Form (1003): Ensure that the signed initial application is on file.
   • Loan Estimate and Required Providers Disclosure: These should be issued within three days of application.
   • Notice of Intent to Proceed: Must be signed by all borrowers.
   • Changed Circumstances Re-issued: Include any tolerance adjustments.
   • E-SIGN Acceptance/Agreement and Delivery Transcript: Keep records of acceptance and delivery audit trails.
   • Signed Initial and Final Broker Fee Agreement: Must match the closing disclosure or settlement statement.

2. Obtain and Retain Lender-Issued Documents:

   • Final Loan Application (1003) and Transmittal Summary (1008): Essential for compliance.
   • Executed Closing Disclosure (CD): Include all attachments.
   • Final Mortgage Loan Lock-in/Financing Agreement: Required at least five days prior to closing.
   • Appraisal and Related Notices: Keep copies of the appraisal order, the appraisal itself, and the right to appraisal notice.
   • Final Sales Contract and Earnest Money Deposit: Ensure these are part of your records.
   • Loan Commitment/Approval Notification: Document the lender's commitment to the loan.

3. Comprehensive Documentation:

   • Fee/Cost Reconciliation: Maintain copies of all application fees, appraisal fees, credit report fees, and other relevant costs.
   • Affiliated Business Arrangement Disclosure: If applicable, retain this disclosure.
   • Compliance Disclosures: Include ARM disclosures, CHARM Booklet Notice, Anti-Steering Notice, ECOA Rights, Fair Credit Reporting Act Notice, and others.
   • State-Specific Disclosures: Ensure all state-required disclosures are documented and retained.

Why Complete Record Retention Matters

State regulators, such as those in Washington and Texas, expect brokers to maintain records similar to those required from lenders. During examinations, brokers are often asked to produce detailed records of all disclosure events, closing documents, and other pertinent paperwork.

Texas, North Carolina, and Maryland Loan File Checklists

Adhering to the checklists from different states can help ensure comprehensive compliance:

• Texas Checklist: Includes initial and final disclosures, funding checks, appraisal reports, and title insurance.
• North Carolina Loan File Checklist: Similar to the Texas checklist, emphasizing the importance of complete documentation.
• Maryland Loan File Checklist: Focuses on detailed retention of all application and closing documents.

Updated Practices and Client Advice

In light of experiences and state examinations, brokers should update their practices to require copies of all signed disclosures and final closing packages from the lender. This proactive approach not only ensures compliance but also protects brokers in the event of an audit. You do not want to have to stop producing and getting new business to have to reprocess loan files to submit to a regulator. 

Advice for Broker Clients: Always obtain a complete disclosure package from the lender, and ensure you send out the required broker disclosures independently. This comprehensive approach to record retention is crucial for compliance and to avoid citations for missing lender documents. If the lender does not cooperate, document your efforts to obtain the necessary records.

How to create a compliance library for your company

Creating content takes weeks and months. That's why many people purchase off-the-shelf training subscriptions for compliance training. But in truth, much of this material is the same stuff that's been trotted out for years. Why not take the material directly from the source (e.g., government agency, regulator, or mortgage insurance company) and just document that our employees have taken it with a quiz? 

This allows you to devote your training program development to those areas where there is a gap or where your specific situation needs more attention. 

Step 1 - Assemble the Playlist

We did this here on YouTube. It's a great resource for compliance managers who need to have more than their line employee's training. Visit https://www.youtube.com/@Mortgagemanuals/videos

You can curate playlists with the content you want your employees to see.

Then it's just a matter of developing a quiz to ensure the students have gotten the message. You can create a quiz in Chat GPT, or use our models here:

https://www.mortgagemanuals.com/annual-aml-training.html

Gramm-Leach-Bliley FTC Safeguard Rules Updated 6/2023 - Regulators asking lots of questions

Changes published in 2021 went into final effect in June 2023. Now, regulators are stepping up their review.

We've been seeing the impact of the updated CyberSecurity examinations prompted by the December 2021 FTC rule revisions. Regulators are dumping massive checklists into the exam load, and most companies don't have the bandwidth to address it. It's a hefty load, but it's worth going through to establish a baseline. 

Click here for the updated rule 

Click here for the CSBS Model Examination Form for non-banks 

The word you will see the most in an examination citation is "implementation." This means that, no matter how good your model policy is, if you're not doing - or have evidence that you can do - the things the rule requires, you'll likely be cited. 

Like every good compliance program, policies and procedures are simply part of a complete IT Security Plan. There are 4 pillars of every compliance program: 

1. a compliance officer, 
2. policies and procedures
3. training, and 
4. testing/auditing. 

Most of the policies we've seen are precisely that - policies. There is very little procedure. In other words, the model form says, "We will comply," but doesn't say, "This is how we comply." This is the most significant difference between our products and those written by lawyers or compliance experts. 

Location of IT Security Questionnaire Items in 2-9 IT/CyberSecurity Plan

 

States Strictly Enforcing GLB Compliance

• DC
• Maryland
• Massachusetts
• Virginia
• Texas
• New York

Remember to add those non-policy items

• List of hardware (investor)
• List of software and cloud services
• List of vendors (investors, office tech, processors, etc. )
• Cyber Insurance Policy

Tools for Self-Training

MortgageManuals.com provides training for our customers' Non-NMLS employees. 

Tools for Self-Audit

We provide the tools for a self-assessment, but if you want a third party risk assessment we do that here.

The problem with the flip flop - Anti- Steering and Loan Originator Comp

Broker companies are creating compensation plans with flexibility for lowering the compensation of broker loan originators by switching from lender paid to borrower paid. It appears legal, by taking the Safe Harbor of "borrower's best interests" to allow pricing discretion and reduced commission to loan originators. However, this changing commission is based on loan terms (or proxy) because it results from the change of fees. Seen this way, the practice is prohibited under the anti-steering rules. Why? Because if you can reduce pricing by switching, you can achieve the inverse, too. 

This is precisely what is happening today; loan originators go to the prospect with one price based on lender-paid fixed compensation plans. Then the prospect comes back with a competing offer and the loan originator now tries to beat it. Since it's impractical to change pricing under LO comp rules under lender paid on a case-by-case basis, they switch the pricing to borrower paid where there is flexibility to reduce the charges. Now, the compensation is in the hands of the broker-company, not the wholesale lender. This is done under the auspices of "borrower's best interests" Safe Harbor. 

It should be clear that, unless you have a loan amount-based compensation plan, the temptation to flip a borrower from Borrower Paid to Lender Paid and INCREASE commission is inherent in the "flip to borrower paid" structure. 

I think any regulator will see this as flying in the face of the LO Comp/Anti-steering rule because it gives the LO pricing power with discretion to decrease his or her commission. The argument goes; it benefits the borrower - which is a SAFE Harbor. The main flaw in this thinking is that it doesn't consider that the inverse is also true; a loan originator could switch from borrower paid to lender paid at a higher commission. In a word - steering. 

Perhaps the fact that compensation is capped at a QM level of 2.75 points as a maximum commission provides a sense of no variable compensation. 

I am not sure why this has escaped scrutiny for so long. We tell our customers that we recommend a flat commission rate based on loan amounts, not a percentage of the of the fee, to avoid the appearance of steering.

The problem for the industry is that the good actors who lead with their best price in compliance are having their production poached by participants who allow loan originators to adjust pricing to "get the deal." While that seems to benefit the customer by creating a competitive market, remember that the whole idea of the rule was to regulate this practice because the pricing was opaque to the consumer. The consumer has minimal knowledge of the market, rates, and pricing, while loan originators are very knowledgeable and are extremely motivated to increase their income.  

A Look at AML Audits - Can you Audit Without a Risk Assessment?

We deal with known risks by establishing a plan to mitigate them. In the case of AML plans for mortgage companies, we face the risk of allowing financial crimes to go undiscovered and enter the financial system through our business. 

We create compliance plans as multi-tiered tools to deal with the risk. The tiers are the four (or five, depending on your business) pillars of an AML plan 

1. the plan itself - which identifies the risks your business encounters and how you mitigate them
2. training - your employees learn how to identify and report red flags
3. compliance officer - the person who implements the procedures, files reports, and ensures the activity, such as training, audits, risk assessments, etc., takes place 
4. an audit or exam - reviews your plan, determines if it is sufficient for the risks you face, and identifies if you are following it
5. ongoing review of accounts - if we are servicing, for instance

Static Plans DO NOT Address the Risks - Make Sure you know what they are

We conduct hundreds of AML audits, and the BIGGEST problem we see is that AML plans don't address the risks the business faces explicitly. Furthermore, the audits or tests we see focus on whether the AML plan contains arcane legal citations or reviews a sampling of closed loan files. This is not where the risk is.  

In the mortgage business, we are experts in looking for fraud - documenting sources of funds and ferreting out suspicious income and transactions. This doesn't mean that fraud and suspicious activity doesn't make it through (CoreLogic reports 1 in 131, or 0.76% of loans, are fraudulent). Still, it does mean that the MAJORITY of incidences probably aren't in the files that make it through to closing. So it makes sense to focus our efforts on loans that don't go through a complete underwriting process. 

None of the AML plans and audits we have reviewed focus on risk assessments. Hawaii is the only state we have encountered where they are requesting a specific AML risk assessment - (Bravo! Mahalo!). New York requires large-scale risk assessments of the entire operation, including AML. 

This leads me to conclude that people don't know what a risk assessment is or even why you do one. The purpose of the Risk Assessment is to look at YOUR business for areas of risk. Only then can you create a strategy to mitigate money laundering activity? 

How to Conduct a Risk Assessment?

Depending on the firm's scope, our risk assessments create a binary decision tree instead of a complex "relative risk rating" approach - e.g., low, medium, and high. We do it this way because the risk increases on an absolute basis. One red flag doesn't necessarily indicate fraud or money laundering activity; however, two levels of risk means that we should, at a minimum, document that we validated there were no red flags. We refer to this as "risk layering," where two or more inherent risks exist in a file. 

• Higher risk components - Company-wide
• Geography
• Business model -
• delegated, non-delegated, 
• retail/wholesale, etc. 
• Origination strategy - 
• direct/indirect
• relationship/transactional
• Higher risk components - Loan Level
• Loan Type
• Gift Letter
• ALT/Non-QM
• Investment
• Borrower Type
• Self-employed
• Real Estate
• Medical
• Cash Business

This allows us to have a methodical elevation of the review of the file. 

We do this because things that don't matter to the underwriter from an approval perspective (the loan meets guidelines) often matter for detecting and reviewing red flags. In our business, we review files for these elements, and it always surprises us how often these are overlooked. Examples include:

Deposits not needed for down payment or closing costs - the underwriter isn't concerned about whether a borrower has a $100,000 CD in one bank if he has the $20,000 he needs for closing seasoned in another account. The money has been there forever, and the account doesn't move. But does it make sense that someone who makes $60,000 a year has $100,000 stashed in an account they don't touch? Especially when they have a lot of debt? No, it doesn't. That's a SAR.

Income and Expenses from a side business - the underwriter doesn't include the borrower's side business which involves cash in the computation. He or she has enough income to qualify for the loan. The side job (documented by frequent small dollar cash deposits) is a compensating factor, and the borrower didn't need to provide tax returns because she was on salary. That makes perfect sense, except that if there is more than $5,000 of this kind of activity in the loan file (e.g., 2 months' bank statements), then that triggers a SAR report for "smurfing."

• Focus on engagements/applications/rate quotes/pre-quals which do not complete
• The greatest risk lies in loans or prospects not reviewed by underwriting/credit.