HSB 609 (LSB 5290XD (12) 90)

SENATE/HOUSE FILE _____

BY  (PROPOSED DEPARTMENT OF INSURANCE AND FINANCIAL SERVICES BILL)

A BILL FOR

An Act relating to mortgage administration and mortgage servicers.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 535B.1, Code 2024, is amended by adding the following new subsections:
   NEW SUBSECTION.  1A.  “Branch office” means any location, other than a licensee’s principal place of business or a remote location, where the licensee, the licensee’s employees, or the licensee’s independent contractors maintain a physical presence to engage in business as a mortgage banker or a mortgage broker.
   NEW SUBSECTION.  8A.  “Principal place of business” means a licensee’s primary business office as designated on the licensee’s application for licensure.
   NEW SUBSECTION.  11A.  “Remote location” means a physical location in the United States, other than a licensee’s principal place of business or a branch office, where a licensee’s employee or an independent contractor of the licensee is authorized by the licensee to engage in business as a mortgage banker or mortgage broker.
    Sec. 2.  Section 535B.4, subsection 2, paragraph a, Code 2024, is amended to read as follows:
   a.  License applicants shall submit to the administrator an application on forms provided by the administrator. The forms shall include, at a minimum, all addresses the address of the principal place of business and of all branch offices at which business is to be conducted, the names and titles of each director and principal officers officer of the business, and a description of the activities of the applicant in such detail as the administrator may require.
    Sec. 3.  Section 535B.4, subsections 9 and 10, Code 2024, are amended to read as follows:
   9.  A licensee may shall not establish a branch locations office outside of the United States.
   10.  In addition to the application and renewal fees provided for in subsections 4 and 7, the administrator may assess application and renewal fees for each branch location office of the licensee, sponsor fees, and change of sponsor fees.
    Sec. 4.  Section 535B.11, subsection 3, paragraph a, Code 2024, is amended by striking the paragraph and inserting in lieu thereof the following:
   a.  Perform an annual escrow analysis for each escrow account. A clear and legible copy of the annual escrow analysis shall be delivered to the mortgagor within thirty calendar days of the end of the escrow account computation year, as defined in 12 C.F.R. §1024.17, to which disclosure relates, and shall include the information required for annual escrow account statements under 12 C.F.R. §1024.17.
    Sec. 5.  Section 535B.11, subsection 4, Code 2024, is amended to read as follows:
   4.  Answer As required by 12 C.F.R. §1026.36, answer in writing, within ten business days of receipt, any written request for payoff information received from a mortgagor or the mortgagor’s designated representative.
    Sec. 6.  Section 535B.16, Code 2024, is amended to read as follows:
   535B.16  Notice to administrator.
   A licensee or registrant maintaining an a branch office in the state shall notify the administrator in writing at least thirty days before closing or otherwise ceasing operations at any branch office in the state.
    Sec. 7.  NEW SECTION.  535B.21  Remote work.
   A licensee may authorize work at a remote location provided all of the following requirements are met:
   1.  In-person customer interaction does not occur at the residence of an employee or an independent contractor.
   2.  The licensee’s physical records are not maintained at a remote location.
   3.  The licensee establishes, supervises, and enforces written policies and procedures to ensure that all employees and independent contractors working from a remote location comply with all applicable state and federal laws and rules.
   4.  The licensee maintains the computer system used to enable employees and independent contractors to work from a remote location, and all customer information is maintained in accordance with the licensee’s written information technology security plan and all applicable state and federal laws and rules.
   5.  Employees and independent contractors who work from a remote location only access the licensee’s secure systems directly from an out-of-office device using a virtual private network or comparable system that requires a password or other form of authentication to access, and ensures a secure connection.
   6.  The licensee has the ability to remotely lock or erase the licensee-related contents of any out-of-office device, or otherwise remotely limit access to the licensee’s secure systems.
   7.  The licensee ensures the installation and maintenance of all appropriate security updates, patches, or other alterations to the security of all devices used at remote locations to access the licensee’s computer system.
   8.  The licensee ensures that all customer interactions and communications regarding customers comply with federal and state information security requirements, including but not limited to the federal Gramm-Leach-Bliley Act of 1999, 15 U.S.C. §6801 et seq., and the federal standards for safeguarding customer information in 16 C.F.R. pt. 314.
   9.  The licensee annually certifies that all employees and independent contractors working from a remote location comply with this section. The licensee shall make written documentation of the certification available to the administrator upon request.
   10.  The record of a mortgage loan originator working from a remote location that is contained in the nationwide mortgage licensing system and registry designates a licensed location as the mortgage loan originator’s official work location.
    Sec. 8.  NEW SECTION.  535B.22  Definitions.
   As used in this subchapter unless the context otherwise provides:
   1.  “Administrator” means the superintendent of the division of banking of the department of insurance and financial services.
   2.  “Allowable assets for liquidity” means any of the following assets that may be used to satisfy the liquidity requirements under section 535B.24:
   a.  Unrestricted cash and cash equivalents.
   b.  Unencumbered investment grade assets held for sale or trade, including agency mortgage-backed securities, obligations of government-sponsored enterprises, and United States treasury obligations.
   3.  “Board of directors” means the formal body established by a covered institution that is responsible for corporate governance and compliance with sections 535B.24 and 535B.25.
   4.  “Corporate governance” means the structure of a covered institution and how the covered institution is managed, including but not limited to the corporate rules, policies, processes, and practices used to oversee and manage the covered institution.
   5.  “Covered institution” means a mortgage servicer that services, or subservices for others, two thousand or more residential mortgage loans and loans being interim serviced prior to sale, excluding whole loans owned, as of the most recent calendar year end as reported on the nationwide mortgage licensing system mortgage call report.
   6.  “External audit” means a formal report prepared by an independent certified public accountant expressing an opinion on whether a company’s financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework, and includes an evaluation of the company’s internal control structure.
   7.  “Government-sponsored enterprise” means the federal national mortgage association or the federal home loan mortgage corporation.
   8.  “Interim serviced prior to sale” means the activity of collecting a limited number of contractual mortgage payments immediately after origination on loans held for sale, but no longer than a period of ninety days prior to the loans being sold into the secondary market.
   9.  “Internal audit” means independent and objective assurance and consulting performed internally by a company to evaluate and improve the effectiveness of the company’s operations, risk management, internal controls, and governance processes.
   10.  “Mortgage-backed security” means a financial instrument, including but not limited to a debt security, collateralized by residential mortgages.
   11.  “Mortgage call report” means the quarterly or annual report of residential real estate loan origination, servicing, and financial information filed by companies licensed in the nationwide mortgage licensing system and registry.
   12.  “Mortgage servicer” or “servicer” means a person that performs, under the terms of a servicing contract, the routine administration of residential mortgage loans on behalf of the owner or owners of the related mortgages.
   13.  “Mortgage servicing rights” means the contractual right to service a residential mortgage loan on behalf of the owner of the associated mortgage in exchange for the compensation specified in the applicable servicing contract.
   14.  “Mortgage servicing rights investor” means a person that invests in and owns mortgage servicing rights and relies on subservicers to administer mortgage loans on behalf of the person.
   15.  “Nationwide mortgage licensing system and registry” means the same as defined in section 535D.3.
   16.  “Operating liquidity” means the financial resources necessary for a person to perform the person’s normal business operations, including but not limited to payment of rent, salaries, interest expenses, and other typical expenses associated with operating the business.
   17.  “Person” means a natural person, an association, joint venture or joint stock company, partnership, limited partnership, business corporation, nonprofit corporation, or any other group of individuals however organized.
   18.  “Reverse annuity mortgage loan” means the same as defined in section 528.2.
   19.  “Risk management assessment” means a functional evaluation performed under a risk management program, and the report provided to the covered institution’s board of directors under a relevant governance protocol.
   20.  “Risk management program” means written policies and procedures commensurate with a covered institution’s size and complexity designed to identify, measure, monitor, and mitigate risk.
   21.  “Servicing liquidity” or “liquidity” means the financial resources necessary to manage the risk arising from servicing functions required in acquiring and financing mortgage servicing rights; hedging costs, including margin calls, associated with the mortgage servicing rights asset and financing facilities; and advances or costs of advance financing for principal, interest, taxes, insurance, and any other servicing related advances.
   22.  “Subservicer” means a person that performs, under the terms of a subservicing contract, routine administration of residential mortgage loans as the agent of a servicer or of a mortgage servicing rights investor.
   23.  “Tangible net worth” means total equity less the receivables due from related entities, and less goodwill and other intangibles, and less pledged assets.
   24.  “Whole loan” means a loan where a mortgage and the underlying credit risk is owned and held on a balance sheet of the person possessing all ownership rights of the mortgage.
    Sec. 9.  NEW SECTION.  535B.23  Applicability.
   1.  This subchapter shall apply to covered institutions. For entities within a holding company or an affiliated group of companies, this subchapter shall apply at the covered institution level.
   2.  This subchapter shall not apply to persons exempt from licensing under section 535B.2.
    Sec. 10.  NEW SECTION.  535B.24  Financial condition.
   1.  This section shall not apply to servicers that solely own or conduct servicing on reverse annuity mortgage loans, or to the reverse annuity mortgage loan portfolio administered by a covered institution.
   2.  A covered institution shall maintain capital and liquidity in compliance with this section, and all financial data shall be determined in accordance with generally accepted accounting principles.
   3.  A covered institution may satisfy subsection 2 by complying with the capital, net worth ratio, and liquidity standards of the federal housing finance agency’s eligibility requirements for enterprise single-family sellers or servicers, regardless of whether the servicer is approved for government-sponsored enterprise servicing.
   4.  A covered institution shall maintain the written policies and procedures necessary to implement the capital and liquidity requirements under this section. The policies and procedures must include a sustainable written methodology to comply with subsection 3, and shall be made available to the administrator upon request.
   5.  a.  A covered institution shall maintain sufficient allowable assets for operating liquidity, in addition to the amounts required for servicing liquidity, to sustain normal business operations.
   b.  The covered institution shall develop, establish, and implement written policies and procedures, using sustainable documented methodologies, to maintain operating liquidity. The policies and procedures shall be made available to the administrator upon request.
   6.  A covered institution shall have a written cash management plan and a written business operating plan commensurate with the complexity of the covered institution that ensures normal business operations.
    Sec. 11.  NEW SECTION.  535B.25  Corporate governance.
   1.  A covered institution shall establish and maintain a board of directors that is responsible for oversight of the covered institution. If a government-sponsored enterprise or government national mortgage association has not approved a covered institution to service loans, or has approved an alternative to a board of directors, the covered institution may establish a similar oversight committee for purposes of exercising oversight and fulfilling the responsibilities under subsection 2.
   2.  The board of directors, or a similar oversight committee approved under subsection 1, shall do all of the following:
   a.  Establish a written corporate governance framework that includes appropriate internal controls to monitor and assess compliance with the corporate governance framework.
   b.  Make a copy of the corporate governance framework available to the administrator upon request.
   c.  Monitor and ensure that the covered institution complies with the corporate governance framework and with this subchapter.
   d.  Perform accurate and timely regulatory reporting, including filing the covered institution’s mortgage call report.
   e.  Establish internal audit requirements that are appropriate for the size, complexity, and risk profile of the covered institution, and ensure appropriate independence to provide an unbiased evaluation of the covered institution’s internal control structure, risk management, and corporate governance.
   f.  Ensure the covered institution establishes and maintains a risk management program that identifies, measures, monitors, and controls risk commensurate with the covered institution’s size and complexity. The risk management program must include appropriate processes and models to measure, monitor, and mitigate financial risks and changes to the covered institution’s risk profile and assets being serviced. The risk management program shall address all of the following:
   (1)  The potential that a borrower or counterparty fails to perform on an obligation.
   (2)  The potential that the covered institution is unable to meet the covered institution’s obligations as the obligations come due as a result of an inability to liquidate assets or to obtain adequate funding.
   (3)  The potential that the covered institution cannot easily unwind or offset specific exposures.
   (4)  The risk resulting from inadequate or failed internal processes, people, or systems; or from external events.
   (5)  The risk to the covered institution’s condition resulting from adverse movements in market rates or prices.
   (6)  The risk of regulatory sanctions, fines, penalties, or losses resulting from the covered institution’s failure to comply with applicable laws and rules or other supervisory requirements that apply to the covered institution.
   (7)  The potential that legal proceedings against the covered institution may result in unenforceable contracts, lawsuits, legal sanctions, or adverse judgements that may disrupt or otherwise negatively affect the covered institution’s operations or condition.
   (8)  The risk to earnings and capital arising from negative publicity regarding the covered institution’s business practices.
   3.  A covered institution shall undergo an annual external audit and shall make the external audit available to the administrator upon request. An external audit shall include, at a minimum, all of the following:
   a.  An evaluation of the company’s internal control structure.
   b.  A review of the company’s annual financial statements, including the balance sheet, statement of operations, and income statement, and cash flows, including notes and supplemental schedules prepared in accordance with generally accepted accounting principles.
   c.  A computation of the company’s tangible net worth.
   d.  Validation of the company’s mortgage servicing rights valuation and reserve methodology, if applicable.
   e.  Verification the company has adequate fidelity and errors and omissions insurance.
   f.  Testing of the company’s controls related to risk management activities, including compliance and stress testing, if applicable.
   4.  A covered institution shall conduct an annual risk management assessment and shall make the risk management assessment available to the administrator upon request. A risk management assessment shall include issue findings and the response or action taken to address each issue. A covered institution shall maintain ongoing documentation of risk management activities and shall include the documentation in the risk management assessment.
    Sec. 12.  CODE EDITOR DIRECTIVE.  The Code editor shall divide chapter 535B into subchapters and shall designate sections 535B.1 through 535B.21, including sections amended or enacted in this Act, as subchapter I entitled “Mortgage Banking, Mortgage Brokers, and Closing Agents”, and sections 535B.22 through 535B.25, as enacted in this Act, as subchapter II entitled “Covered Institutions”.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to mortgage administration and mortgage servicers.
   The bill requires applicants for a mortgage banker, a mortgage broker, or a closing agent license to submit to the administrator an application on the provided forms containing, in addition to other information laid out by the bill, the address of the applicant’s principal place of business and of all branch offices where business is to be conducted, rather than all addresses as required under current law. “Principal place of business” and “branch office” are defined in the bill.
   Current law requires a licensee or other mortgagee who services mortgages on residential real estate located in the state to answer in writing, within 10 business days, any written request for payoff information received from a mortgagor or the mortgagor’s designated representative. The bill requires the licensee or other mortgagee to answer as required by 12 C.F.R. §1026.36.
   The bill allows a licensee to authorize employees or independent contractors (contractors) to work from a remote location, as defined by the bill, provided that in-person customer interaction does not occur at the residence of an employee or contractor; physical records are not maintained at the remote location; the licensee establishes and enforces policies and procedures to ensure employees and contractors comply with all applicable state and federal laws and rules; the licensee maintains the computer system used by remote employees and contractors and all customer information is maintained in accordance with the licensee’s written information technology security plan, and all applicable state and federal laws; remote employees and contractors access the licensee’s secure systems directly from an out-of-office device using a virtual private network that requires authentication; the licensee has the ability to remotely lock or erase licensee-related contents of any device, or remotely limit access to the licensee’s secure systems; the licensee ensures the installation and maintenance of appropriate alterations to the security of all devices used at remote locations; the licensee ensures that all communications regarding customers comply with federal and state information security requirements; and the licensee annually certifies that all employees and contractors working from a remote location comply with the requirements of the bill. In addition, the record of a mortgage loan originator working from a remote location that is contained in the nationwide mortgage licensing system and registry must designate a licensed location as the mortgage loan originator’s official work location.
   The bill requires a covered institution (institution) to maintain capital and liquidity, with all financial data determined in accordance with generally accepted accounting principles. “Covered institution” is defined in the bill. An institution may comply with the capital and liquidity requirement by meeting the capital, net worth, and liquidity standards set forth in the federal housing finance agency’s eligibility requirements for enterprise single-family seller-servicers. An institution shall maintain written policies and procedures implementing the capital and liquidity requirements, including a sustainable written methodology for satisfying the requirements; make the written policies and procedures available to the administrator upon request; maintain sufficient allowable assets for operating liquidity; and have written cash management and business operating plans that match the complexity of the institution and ensure normal business operations. “Administrator” is defined in the bill as the superintendent of the division of banking of the department of insurance and financial services.
   The bill requires an institution to establish and maintain a board of directors, or, if approved, a similar body, to be responsible for oversight of the covered institution. The board of directors, or similar body, must establish a written corporate governance framework; make the corporate governance framework available to the administrator upon request; monitor and ensure the covered institution complies with the corporate governance framework and with the provisions of the bill; perform accurate and timely regulatory reporting, including filing the mortgage call report; establish internal audit requirements that are appropriate for the institution, and ensure appropriate independence to provide an unbiased evaluation of the institution’s internal control structure, risk management, and governance; make the results of internal audits available to the administrator upon request; and ensure the institution establishes and maintains a risk management program that identifies, measures, monitors, and controls risk commensurate with the institution’s size and complexity. The requirements for the risk management program are detailed in the bill. An institution is required to undergo an annual external audit and to conduct an annual risk management assessment, and make the results of each available to the administrator upon request. “External audit” and “risk management assessment” are defined in the bill.
   The bill makes conforming changes to Code sections 535B.4 and 535B.16.