09.03.06 - Financial Regulation - Final Regulations
FINAL ACTION ON REGULATIONS
MARYLAND REGISTER, VOLUME 46, ISSUE 13,
FRIDAY, SEPTEMBER 13, 2019
Subtitle 03 COMMISSIONER OF FINANCIAL REGULATION
09.03.06 Mortgage Lenders
Authority: Business Regulation Article, §2-105; Financial Institutions Article, §§2-105.1(b), 11-503, 11-503.1, 11-505(e)(3), 11-508(f), 11-511.1; Real Property Article, §3-104.1(c); Annotated Code of Maryland
Notice of Final Action
On August 29, 2019, the Commissioner of Financial Regulation adopted amendments to Regulations .02, .20, and .21, new Regulations .03 and .23—.25, amendments to and the recodification of existing Regulations .03—.07, .09, .11, .15, .17, .18, and .23 to be Regulations .04—.08, .10, .12, .16, .18, .19, and .22, respectively, and the recodification of existing Regulations .08, .10, .12—.14, and .16 to be Regulations .09, .11, .13—.15, and .17, respectively, under COMAR 09.03.06 Mortgage Lenders. This action, which was proposed for adoption in 46:5 Md. R. 315—323 (March 1, 2019), has been adopted with the nonsubstantive changes shown below.
Effective Date: October 4, 2019.
Attorney General's Certification
In accordance with State Government Article, §10-113, Annotated Code of Maryland, the Attorney General certifies that the following changes do not differ substantively from the proposed text. The nature of the changes and the basis for this conclusion are as follows:
As a general matter, these changes do not substantively affect the rights, duties, or obligations of licensees. The changes merely clarify intent, clarify process, and correct cross references.
Regulation .02B(6): In response to comments received, the cross reference is being corrected.
Regulation .02B(17): In response to comments received, the cross reference is being clarified.
Regulation .02B(24): In response to comments received, the term “loan modification” is being deleted because it does not appear in any other regulation.
Regulation .02B(25): .025(B)(26) In response to comments received, this change avoids confusion by withdrawing the term “Maryland loan”.
Regulation .02B(30)(a): In response to comments received, the definition of mortgage servicer is being simplified to clarify the intent that a mortgage servicer performs activities during repayment of a mortgage loan.
Regulation .02B(30)(e): This change is being made to clarify that the word person applies to an attorney representing a mortgagee or its successors and assigns or to a substitute trustee, and to delete the word mortgage because a substitute trustee only applies to a deed of trust.
Regulation .05A(1), .05A(5)(c), .05B(1), .05B(1)(q)(ii), and .05B(2): The term “mortgage loan” is being substituted for “Maryland loan” because of the definition change in Regulation .02B(25).
Regulation .05A(5)(a), (b), and (c): During the 2019 legislative session, Md. Code Ann., Fin. Inst. §11-515(a)(2)(ii)(2) was amended to extend the time period from 36 months to 60 months within which the Commissioner must conduct an examination. Accordingly, the record retention requirement is changed to reflect the statutory amendment.
Regulation .05C(4)(c): In response to comments received that concerned a required manner of organization of records that has not been communicated to licensees, the language is being changed to provide the Commissioner with flexibility to adjust the manner of organization at the time of examination based on the size and complexity of the licensee.
Regulation .05D: In response to comments received that noted compliance with the “reasonably should know” standard would be impossible, this standard is deleted.
Regulation .07D: In response to comments received that noted inconsistency with current Maryland law, this section is deleted.
Regulation .08C(3): In response to comments received regarding clarity, the federal statutes are replaced with federal regulations.
Regulation .19C: In response to comments received regarding clarity, the cross reference is changed to the specific section.
Regulation .24C: In response to comments received that noted the very robust, new requirements for data protection, and that compliance processes could differ based on the size and complexity of licensees’ businesses, the requirement for the design of a licensee’s information security program to achieve certain objectives is changed to the requirement for the design to consider certain objectives.
Regulation .24H: In response to comments received that noted the requirement for an annual certification of periodic testing could be inconsistent with the timing of testing that will be based on the size and complexity of the licensee’s information technology system, the annual certification requirement is deleted.
Regulation .24I: The security risk assessment required under Regulation .24 is the foundation for testing and monitoring. Accordingly, requirements to retain records of the security risk assessment and periodic testing results and to provide a copy the security risk assessment and periodic testing to the Commissioner upon request are added.
A. (proposed text unchanged)
B. Terms Defined.
(1)—(5) (proposed text unchanged)
(6) “Breach of the security of a system” has the meaning stated in Commercial Law Article, [[§14-3501]] §14-3504, Annotated Code of Maryland.
(7)—(16) (proposed text unchanged)
(17) “Information security program” has the meaning stated in 16 CFR [[Part 3]] §314.2, as it may be amended from time to time.
(18)—(23) (proposed text unchanged)
[[(24) “Loan modification” means a change to a mortgage loan, excluding any change required due to a filing for bankruptcy, which alters the loan amount or one or more of the terms of repayment set forth in the document creating the debt.]]
[[(25)]] (24)(proposed text unchanged)
[[(26) “Maryland loan” as used in this regulation means a mortgage loan secured by real property or a dwelling located in the State.]]
[[(27)]] (25)—[[(29]] (27)(proposed text unchanged)
[[(30)]] (28) “Mortgage servicer” includes a person that engages in one or more of the following actions for the benefit of other persons in connection with mortgage loans:
(a) Collects or receives [[one or more of the following types of]] payments directly from borrowers for distribution to the owner of the mortgage loan or another third party, including a master servicer[[:
(iv) Insurance; or
(v) Any other payment due under a loan agreement or security instrument]];
(b)—(d) (proposed text unchanged)
(e) Conducts or supervises the foreclosure process, except if the person is an attorney representing a mortgagee or its successors and assigns, or is acting as a substitute trustee in a foreclosure action under a [[mortgage or]] deed of trust.
[[(31)]] (29)—[[(38)]] (36)(proposed text unchanged)
A. Preservation of Records.
(1) A licensee shall preserve the records of a [[Maryland]] mortgageloan in one or more of the following ways:
(a)—(c) (proposed text unchanged)
(2)—(4) (proposed text unchanged)
(5) Time Period.
(a) A lender shall retain records for [] 61 months after a loan is denied, repayment of the loan is made in full, or the loan is sold, whichever occurs first.
(b) A mortgage servicer shall retain records for [] 61 months after final payment is made or the right to service the loan under either a servicing or subservicing agreement is terminated or transferred, whichever occurs first.
(c) If a licensee acts as a broker in a [[Maryland]] mortgage loan, records of the [[Maryland]] mortgage loan shall be retained for [] 61 months after the [[Maryland]] mortgage loan is made or denied.
(6)—(7) (proposed text unchanged)
B. Content of Records.
(1) For each [[Maryland]] mortgageloan made or serviced by a licensee, a file shall be maintained which contains, at a minimum, the following:
(a)—(p) (proposed text unchanged)
(q) Optional insurance:
(i) (proposed text unchanged)
(ii) This paragraph does not apply to hazard insurance and flood insurance on the property securing the [[Maryland]] mortgage loan;
(r)—(u) (proposed text unchanged)
(2) Notwithstanding §B(1) of this regulation, a licensee acting as a broker in connection with a particular [[Maryland]] mortgage loan:
(a)—(f) (proposed text unchanged)
(3)—(4) (proposed text unchanged)
C. Provision of Records to the Commissioner.
(1) – (3) (proposed text unchanged)
(4) When delivered to the Commissioner, records shall be:
(a)—(b) (proposed text unchanged)
(c) Organized in [[the]] any manner[[specified]] requested by the Commissioner.
D. Loss of Records. A licensee shall immediately notify the Commissioner [[when the licensee:
(1) Knows]] of any actual or potential loss of records required to be kept by this regulation [[; or
(2) Reasonably should know of
any actual or potential loss of records required to be kept by this regulation]].
.07 Financing Agreements.
A.—C. (proposed text unchanged)
[[D. A licensee that provides disclosures that comply with 12 CFR Parts 1024 and 1026, as they may be amended from time to time, shall be deemed compliant with the requirement to:
(1) Provide a financing agreement; and
(2) Provide a commitment.]]
.08 Agreements with the Borrower.
A.—B. (proposed text unchanged)
C. Undisclosed Fees.
(1)—(2) (proposed text unchanged)
(3) Compliance with applicable disclosures under [[the Real Estate Settlement Procedures Act (12 U.S.C. §2601 et seq.) and corresponding regulations and applicable disclosures under the Truth in Lending Act (15 U.S.C. §1601 et seq.) and corresponding regulations]] 12 CFR §§1026.37 and 1026.38 shall be deemed compliance with §C(1) and (2) of this regulation.
(4) (proposed text unchanged)
D. (proposed text unchanged)
.19 Ability to Repay.
A.—B. (proposed text unchanged)
C. Compliance with applicable
provisions in 12 CFR Part [] 1026.43, as it may be amended from
time to time, may be substituted for the obligations required by, and shall be
sufficient to meet the requirements of, §B of this regulation.
.24 Data Protection.
A.—B. (proposed text unchanged)
C. A licensee’s information security program shall [[be designed to achieve]] consider the following objectives:
(1)—(3) (proposed text unchanged)
D.—G. (proposed text unchanged)
H. Reporting Obligations.
[[(1) A licensee shall obtain an annual certification as to the performance and results of the periodic testing required by §E(1) of this regulation and make the annual certification available at the request of the Commissioner.
(2)]] A licensee shall provide notice of a breach of the security of a system to the Commissioner prior to giving the notice required by Commercial Law Article, §14-3504(b), Annotated Code of Maryland.
I. Record Retention.
A licensee shall provide copies of risk assessments under §D of this regulation and results of periodic testing under §E of this regulation to the Commissioner upon request.
ANTONIO P. SALAZAR
Commissioner of Financial Regulation