S.F. 2298 Section 1. Section 535B.1, Code 2024, is amended by adding 1 the following new subsections: 2 NEW SUBSECTION . 1A. “Branch office” means any location, 3 other than a licensee’s principal place of business or a remote 4 location, where the licensee, the licensee’s employees, or the 5 licensee’s independent contractors maintain a physical presence 6 to engage in business as a mortgage banker or a mortgage 7 broker. 8 NEW SUBSECTION . 8A. “Principal place of business” means 9 a licensee’s primary business office as designated on the 10 licensee’s application for licensure. 11 NEW SUBSECTION . 11A. “Remote location” means a physical 12 location in the United States, other than a licensee’s 13 principal place of business or a branch office, where a 14 licensee’s employee or an independent contractor of the 15 licensee is authorized by the licensee to engage in business as 16 a mortgage banker or mortgage broker. 17 Sec. 2. Section 535B.4, subsection 2, paragraph a, Code 18 2024, is amended to read as follows: 19 a. License applicants shall submit to the administrator 20 an application on forms provided by the administrator. The 21 forms shall include, at a minimum, all addresses the address of 22 the principal place of business and of all branch offices at 23 which business is to be conducted, the names and titles of each 24 director and principal officers officer of the business, and a 25 description of the activities of the applicant in such detail 26 as the administrator may require. 27 Sec. 3. Section 535B.4, subsections 9 and 10, Code 2024, are 28 amended to read as follows: 29 9. A licensee may shall not establish a branch locations 30 office outside of the United States. 31 10. In addition to the application and renewal fees provided 32 for in subsections 4 and 7 , the administrator may assess 33 application and renewal fees for each branch location office of 34 the licensee, sponsor fees, and change of sponsor fees. 35 -1- LSB 5290SV (3) 90 nls/ko 1/ 13

S.F. 2298 Sec. 4. Section 535B.11, subsection 3, paragraph a, Code 1 2024, is amended by striking the paragraph and inserting in 2 lieu thereof the following: 3 a. Perform an annual escrow analysis for each escrow 4 account. A clear and legible copy of the annual escrow 5 analysis shall be delivered to the mortgagor within thirty 6 calendar days of the end of the escrow account computation 7 year, as defined in 12 C.F.R. §1024.17, to which disclosure 8 relates, and shall include the information required for annual 9 escrow account statements under 12 C.F.R. §1024.17. 10 Sec. 5. Section 535B.11, subsection 4, Code 2024, is amended 11 to read as follows: 12 4. Answer As required by 12 C.F.R. §1026.36, answer in 13 writing , within ten business days of receipt, any written 14 request for payoff information received from a mortgagor or the 15 mortgagor’s designated representative. 16 Sec. 6. Section 535B.16, Code 2024, is amended to read as 17 follows: 18 535B.16 Notice to administrator. 19 A licensee or registrant maintaining an a branch office in 20 the state shall notify the administrator in writing at least 21 thirty days before closing or otherwise ceasing operations at 22 any branch office in the state. 23 Sec. 7. NEW SECTION . 535B.21 Remote work. 24 A licensee may authorize work at a remote location provided 25 all of the following requirements are met: 26 1. In-person customer interaction does not occur at the 27 residence of an employee or an independent contractor. 28 2. The licensee’s physical records are not maintained at a 29 remote location. 30 3. The licensee establishes, supervises, and enforces 31 written policies and procedures to ensure that all employees 32 and independent contractors working from a remote location 33 comply with all applicable state and federal laws and rules. 34 4. The licensee maintains the computer system used to 35 -2- LSB 5290SV (3) 90 nls/ko 2/ 13

S.F. 2298 enable employees and independent contractors to work from a 1 remote location, and all customer information is maintained in 2 accordance with the licensee’s written information technology 3 security plan and all applicable state and federal laws and 4 rules. 5 5. Employees and independent contractors who work from 6 a remote location only access the licensee’s secure systems 7 directly from an out-of-office device using a virtual private 8 network or comparable system that requires a password or 9 other form of authentication to access, and ensures a secure 10 connection. 11 6. The licensee has the ability to remotely lock or erase 12 the licensee-related contents of any out-of-office device, 13 or otherwise remotely limit access to the licensee’s secure 14 systems. 15 7. The licensee ensures the installation and maintenance of 16 all appropriate security updates, patches, or other alterations 17 to the security of all devices used at remote locations to 18 access the licensee’s computer system. 19 8. The licensee ensures that all customer interactions 20 and communications regarding customers comply with federal 21 and state information security requirements, including but 22 not limited to the federal Gramm-Leach-Bliley Act of 1999, 23 15 U.S.C. §6801 et seq., and the federal standards for 24 safeguarding customer information in 16 C.F.R. pt. 314. 25 9. The licensee annually certifies that all employees 26 and independent contractors working from a remote location 27 comply with this section. The licensee shall make written 28 documentation of the certification available to the 29 administrator upon request. 30 10. The record of a mortgage loan originator working from a 31 remote location that is contained in the nationwide mortgage 32 licensing system and registry designates a licensed location as 33 the mortgage loan originator’s official work location. 34 Sec. 8. NEW SECTION . 535B.22 Definitions. 35 -3- LSB 5290SV (3) 90 nls/ko 3/ 13

S.F. 2298 As used in this subchapter unless the context otherwise 1 provides: 2 1. “Administrator” means the superintendent of the division 3 of banking of the department of insurance and financial 4 services. 5 2. “Allowable assets for liquidity” means any of the 6 following assets that may be used to satisfy the liquidity 7 requirements under section 535B.24: 8 a. Unrestricted cash and cash equivalents. 9 b. Unencumbered investment grade assets held for sale or 10 trade, including agency mortgage-backed securities, obligations 11 of government-sponsored enterprises, and United States treasury 12 obligations. 13 3. “Board of directors” means the formal body established 14 by a covered institution that is responsible for corporate 15 governance and compliance with sections 535B.24 and 535B.25. 16 4. “Corporate governance” means the structure of a covered 17 institution and how the covered institution is managed, 18 including but not limited to the corporate rules, policies, 19 processes, and practices used to oversee and manage the covered 20 institution. 21 5. “Covered institution” means a mortgage servicer that 22 services, or subservices for others, two thousand or more 23 residential mortgage loans, excluding whole loans owned and 24 loans being interim serviced prior to sale, as of the most 25 recent calendar year end as reported on the nationwide mortgage 26 licensing system mortgage call report. 27 6. “External audit” means a formal report prepared by an 28 independent certified public accountant expressing an opinion 29 on whether a company’s financial statements are presented 30 fairly, in all material respects, in accordance with the 31 applicable financial reporting framework, and includes an 32 evaluation of the company’s internal control structure. 33 7. “Government-sponsored enterprise” means the federal 34 national mortgage association or the federal home loan mortgage 35 -4- LSB 5290SV (3) 90 nls/ko 4/ 13

S.F. 2298 corporation. 1 8. “Interim serviced prior to sale” means the activity of 2 collecting a limited number of contractual mortgage payments 3 immediately after origination on loans held for sale, but no 4 longer than a period of ninety days prior to the loans being 5 sold into the secondary market. 6 9. “Internal audit” means independent and objective 7 assurance and consulting performed internally by a company 8 to evaluate and improve the effectiveness of the company’s 9 operations, risk management, internal controls, and governance 10 processes. 11 10. “Mortgage-backed security” means a financial instrument, 12 including but not limited to a debt security, collateralized by 13 residential mortgages. 14 11. “Mortgage call report” means the quarterly or annual 15 report of residential real estate loan origination, servicing, 16 and financial information filed by companies licensed in the 17 nationwide mortgage licensing system and registry. 18 12. “Mortgage servicer” or “servicer” means a person that 19 performs, under the terms of a servicing contract, the routine 20 administration of residential mortgage loans on behalf of the 21 owner or owners of the related mortgages. 22 13. “Mortgage servicing rights” means the contractual right 23 to service a residential mortgage loan on behalf of the owner 24 of the associated mortgage in exchange for the compensation 25 specified in the applicable servicing contract. 26 14. “Mortgage servicing rights investor” means a person 27 that invests in and owns mortgage servicing rights and relies 28 on subservicers to administer mortgage loans on behalf of the 29 person. 30 15. “Nationwide mortgage licensing system and registry” means 31 the same as defined in section 535D.3. 32 16. “Operating liquidity” means the financial resources 33 necessary for a person to perform the person’s normal business 34 operations, including but not limited to payment of rent, 35 -5- LSB 5290SV (3) 90 nls/ko 5/ 13

S.F. 2298 salaries, interest expenses, and other typical expenses 1 associated with operating the business. 2 17. “Person” means a natural person, an association, 3 joint venture or joint stock company, partnership, limited 4 partnership, business corporation, nonprofit corporation, or 5 any other group of individuals however organized. 6 18. “Reverse annuity mortgage loan” means the same as 7 defined in section 528.2. 8 19. “Risk management assessment” means a functional 9 evaluation performed under a risk management program, and the 10 report provided to the covered institution’s board of directors 11 under the relevant governance protocol. 12 20. “Risk management program” means written policies and 13 procedures commensurate with a covered institution’s size and 14 complexity designed to identify, measure, monitor, and mitigate 15 risk. 16 21. “Servicing liquidity” or “liquidity” means the financial 17 resources necessary to manage the liquidity risk arising 18 from servicing functions required in acquiring and financing 19 mortgage servicing rights; hedging costs, including margin 20 calls, associated with the mortgage servicing rights asset 21 and financing facilities; and advances or costs of advance 22 financing for principal, interest, taxes, insurance, and any 23 other servicing related advances. 24 22. “Subservicer” means a person that performs, under the 25 terms of a subservicing contract, routine administration of 26 residential mortgage loans as the agent of a servicer or of a 27 mortgage servicing rights investor. 28 23. “Tangible net worth” means total equity less the 29 receivables due from related entities, and less goodwill and 30 other intangibles, and less pledged assets. 31 24. “Whole loan” means a loan where a mortgage and the 32 underlying credit risk is owned and held on a balance sheet of 33 the person possessing all ownership rights of the mortgage. 34 Sec. 9. NEW SECTION . 535B.23 Applicability. 35 -6- LSB 5290SV (3) 90 nls/ko 6/ 13

S.F. 2298 1. This subchapter shall apply to covered institutions. 1 For entities within a holding company or an affiliated group 2 of companies, this subchapter shall apply at the covered 3 institution level. 4 2. This subchapter shall not apply to persons exempt from 5 licensing under section 535B.2. 6 Sec. 10. NEW SECTION . 535B.24 Financial condition. 7 1. This section shall not apply to servicers that solely 8 own or conduct servicing on reverse annuity mortgage loans, or 9 to the reverse annuity mortgage loan portfolio administered by 10 a covered institution. 11 2. A covered institution shall maintain capital and 12 liquidity in compliance with this section, and all financial 13 data shall be determined in accordance with generally accepted 14 accounting principles. 15 3. A covered institution may satisfy subsection 2 by 16 complying with the capital, net worth ratio, and liquidity 17 standards of the federal housing finance agency’s eligibility 18 requirements for enterprise single-family sellers or 19 servicers, regardless of whether the servicer is approved for 20 government-sponsored enterprise servicing. 21 4. A covered institution shall maintain the written 22 policies and procedures necessary to implement the capital, 23 operating liquidity, and servicing liquidity requirements under 24 this section. The policies and procedures must include a 25 sustainable written methodology to comply with subsection 3, 26 and shall be made available to the administrator upon request. 27 5. a. A covered institution shall maintain sufficient 28 allowable assets for operating liquidity, in addition to the 29 amounts required for servicing liquidity, to sustain normal 30 business operations. 31 b. The covered institution shall develop, establish, and 32 implement written plans, policies, and procedures, using 33 sustainable documented methodologies, to maintain operating 34 liquidity. The policies and procedures shall be made available 35 -7- LSB 5290SV (3) 90 nls/ko 7/ 13

S.F. 2298 to the administrator upon request. 1 6. A covered institution shall have a sound written cash 2 management plan and a sound written business operating plan 3 commensurate with the complexity of the covered institution 4 that ensures normal business operations. 5 Sec. 11. NEW SECTION . 535B.25 Corporate governance. 6 1. A covered institution shall establish and maintain a 7 board of directors that is responsible for oversight of the 8 covered institution. If a government-sponsored enterprise 9 or government national mortgage association has not approved 10 a covered institution to service loans, or has approved an 11 alternative to a board of directors, the covered institution 12 may establish a similar oversight committee for purposes of 13 exercising oversight and fulfilling the responsibilities under 14 subsection 2. 15 2. The board of directors, or a similar oversight committee 16 approved under subsection 1, shall do all of the following: 17 a. Establish a written corporate governance framework that 18 includes appropriate internal controls to monitor and assess 19 compliance with the corporate governance framework. 20 b. Make a copy of the corporate governance framework 21 available to the administrator upon request. 22 c. Monitor and ensure that the covered institution 23 complies with the corporate governance framework and with this 24 subchapter. 25 d. Perform accurate and timely regulatory reporting, 26 including filing the covered institution’s mortgage call 27 report. 28 e. Establish internal audit requirements that are 29 appropriate for the size, complexity, and risk profile of the 30 covered institution, and ensure appropriate independence to 31 provide an unbiased evaluation of the covered institution’s 32 internal control structure, risk management, and corporate 33 governance. The established internal audit requirements and 34 the results of internal audits shall be made available to the 35 -8- LSB 5290SV (3) 90 nls/ko 8/ 13

S.F. 2298 administrator upon request. 1 f. Ensure the covered institution establishes and maintains 2 a risk management program that identifies, measures, monitors, 3 and controls risk commensurate with the covered institution’s 4 size and complexity. The risk management program must 5 include appropriate processes and models to measure, monitor, 6 and mitigate financial risks and changes to the covered 7 institution’s risk profile and assets being serviced. The risk 8 management program shall address all of the following: 9 (1) The potential that a borrower or counterparty fails to 10 perform on an obligation. 11 (2) The potential that the covered institution is unable to 12 meet the covered institution’s obligations as the obligations 13 come due as a result of an inability to liquidate assets or to 14 obtain adequate funding. 15 (3) The potential that the covered institution cannot 16 easily unwind or offset specific exposures. 17 (4) The risk resulting from inadequate or failed internal 18 processes, people, or systems; or from external events. 19 (5) The risk to the covered institution’s condition 20 resulting from adverse movements in market rates or prices. 21 (6) The risk of regulatory sanctions, fines, penalties, 22 or losses resulting from the covered institution’s failure to 23 comply with applicable laws and rules or other supervisory 24 requirements that apply to the covered institution. 25 (7) The potential that legal proceedings against the 26 covered institution may result in unenforceable contracts, 27 lawsuits, legal sanctions, or adverse judgements that 28 may disrupt or otherwise negatively affect the covered 29 institution’s operations or condition. 30 (8) The risk to earnings and capital arising from negative 31 publicity regarding the covered institution’s business 32 practices. 33 3. A covered institution shall undergo an annual external 34 audit and shall make the external audit available to the 35 -9- LSB 5290SV (3) 90 nls/ko 9/ 13

S.F. 2298 administrator upon request. An external audit shall include, 1 at a minimum, all of the following: 2 a. An evaluation of the company’s internal control 3 structure. 4 b. A review of the company’s annual financial statements, 5 including the balance sheet, income statement, and cash 6 flows, including notes and supplemental schedules prepared in 7 accordance with generally accepted accounting principles. 8 c. A computation of the company’s tangible net worth. 9 d. Validation of the company’s mortgage servicing rights 10 valuation and reserve methodology, if applicable. 11 e. Verification the company has adequate fidelity and errors 12 and omissions insurance. 13 f. Testing of the company’s controls related to risk 14 management activities, including compliance and stress testing, 15 if applicable. 16 4. A covered institution shall conduct an annual risk 17 management assessment that shall conclude with a formal report 18 to the board of directors, and shall make the risk management 19 assessment available to the administrator upon request. A 20 risk management assessment shall include issue findings and 21 the response or action taken to address each issue. A covered 22 institution shall maintain ongoing documentation of risk 23 management activities and shall include the documentation in 24 the risk management assessment. 25 Sec. 12. CODE EDITOR DIRECTIVE. The Code editor shall 26 divide chapter 535B into subchapters and shall designate 27 sections 535B.1 through 535B.21, including sections amended 28 or enacted in this Act, as subchapter I entitled “Mortgage 29 Banking, Mortgage Brokers, and Closing Agents”, and sections 30 535B.22 through 535B.25, as enacted in this Act, as subchapter 31 II entitled “Prudential Standards”. 32 EXPLANATION 33 The inclusion of this explanation does not constitute agreement with 34 the explanation’s substance by the members of the general assembly. 35 -10- LSB 5290SV (3) 90 nls/ko 10/ 13

S.F. 2298 This bill relates to mortgage administration and mortgage 1 servicers. 2 The bill requires applicants for a mortgage banker, a 3 mortgage broker, or a closing agent license to submit to the 4 administrator an application on the provided forms containing, 5 in addition to other information laid out by the bill, the 6 address of the applicant’s principal place of business and of 7 all branch offices where business is to be conducted, rather 8 than all addresses as required under current law. “Principal 9 place of business” and “branch office” are defined in the bill. 10 Current law requires a licensee or other mortgagee who 11 services mortgages on residential real estate located in 12 the state to answer in writing, within 10 business days, 13 any written request for payoff information received from a 14 mortgagor or the mortgagor’s designated representative. The 15 bill requires the licensee or other mortgagee to answer as 16 required by 12 C.F.R. §1026.36. 17 The bill allows a licensee to authorize employees or 18 independent contractors (contractors) to work from a remote 19 location, as defined by the bill, provided that in-person 20 customer interaction does not occur at the residence of an 21 employee or contractor; physical records are not maintained 22 at the remote location; the licensee establishes and enforces 23 policies and procedures to ensure employees and contractors 24 comply with all applicable state and federal laws and rules; 25 the licensee maintains the computer system used by remote 26 employees and contractors and all customer information 27 is maintained in accordance with the licensee’s written 28 information technology security plan, and all applicable state 29 and federal laws; remote employees and contractors access the 30 licensee’s secure systems directly from an out-of-office device 31 using a virtual private network that requires authentication; 32 the licensee has the ability to remotely lock or erase 33 licensee-related contents of any device, or remotely limit 34 access to the licensee’s secure systems; the licensee ensures 35 -11- LSB 5290SV (3) 90 nls/ko 11/ 13

S.F. 2298 the installation and maintenance of appropriate alterations 1 to the security of all devices used at remote locations; 2 the licensee ensures that all communications regarding 3 customers comply with federal and state information security 4 requirements; and the licensee annually certifies that all 5 employees and contractors working from a remote location comply 6 with the requirements of the bill. In addition, the record of 7 a mortgage loan originator working from a remote location that 8 is contained in the nationwide mortgage licensing system and 9 registry must designate a licensed location as the mortgage 10 loan originator’s official work location. 11 The bill requires a covered institution (institution) 12 to maintain capital and liquidity, with all financial 13 data determined in accordance with generally accepted 14 accounting principles. “Covered institution” is defined in 15 the bill. An institution may comply with the capital and 16 liquidity requirement by meeting the capital, net worth, 17 and liquidity standards set forth in the federal housing 18 finance agency’s eligibility requirements for enterprise 19 single-family seller-servicers. An institution shall maintain 20 written policies and procedures implementing the capital, 21 operating liquidity, and servicing liquidity requirements, 22 including a sustainable written methodology for satisfying 23 the requirements; make the written policies and procedures 24 available to the administrator upon request; maintain 25 sufficient allowable assets for operating liquidity; and have 26 sound written cash management and sound written business 27 operating plans that match the complexity of the institution 28 and ensure normal business operations. “Administrator” is 29 defined in the bill as the superintendent of the division of 30 banking of the department of insurance and financial services. 31 The bill requires an institution to establish and maintain 32 a board of directors, or, if approved, a similar body, to be 33 responsible for oversight of the covered institution. The 34 board of directors, or similar body, must establish a written 35 -12- LSB 5290SV (3) 90 nls/ko 12/ 13

S.F. 2298 corporate governance framework; make the corporate governance 1 framework available to the administrator upon request; 2 monitor and ensure the covered institution complies with the 3 corporate governance framework and with the provisions of 4 the bill; perform accurate and timely regulatory reporting, 5 including filing the mortgage call report; establish internal 6 audit requirements that are appropriate for the institution, 7 and ensure appropriate independence to provide an unbiased 8 evaluation of the institution’s internal control structure, 9 risk management, and governance; make the results of internal 10 audits available to the administrator upon request; and ensure 11 the institution establishes and maintains a risk management 12 program that identifies, measures, monitors, and controls risk 13 commensurate with the institution’s size and complexity. The 14 requirements for the risk management program are detailed in 15 the bill. An institution is required to undergo an annual 16 external audit and to conduct an annual risk management 17 assessment, and make the results of each available to the 18 administrator upon request. “External audit” and “risk 19 management assessment” are defined in the bill. 20 The bill makes conforming changes to Code sections 535B.4 21 and 535B.16. 22 -13- LSB 5290SV (3) 90 nls/ko 13/ 13