Mortgage brokers & lenders
The FTC Safeguards Rule for mortgage brokers and lenders
Non-bank mortgage brokers and lenders are named in the rule. Here's what it asks, and a way to keep the program current between exams.
By Tyler Milam, founder of Golden Rock · Updated
Are you covered?
The rule's examples of financial institutions include mortgage lenders and mortgage brokers.
What the rule asks
(a) Qualified Individual
Put one named person in charge of overseeing, running, and enforcing your information security program. They can be an employee or work for an affiliate or outside IT company, but your business stays responsible.
(b) Risk assessment
Base your program on a risk assessment of what could go wrong with customer information and whether your protections are enough, and redo it periodically. Only firms with customer information on 5,000 or more consumers must write it down with formal criteria.
16 CFR 314.4(b) · small-firm exemption 16 CFR 314.6
(c) Safeguards
Put protections in place for the risks you found: access controls, an inventory, encryption, app security, multi-factor authentication, secure disposal, change management, and activity monitoring.
(d) Testing and monitoring
Regularly test or monitor whether your protections actually work. Firms with customer information on 5,000 or more consumers must also use continuous monitoring or do a yearly penetration test plus vulnerability scans at least every six months.
16 CFR 314.4(d) · small-firm exemption 16 CFR 314.6
(e) Staff and training
Make sure your people can carry out the program: train all staff, use qualified security help, and keep that help trained and up to date.
(f) Service providers
Choose vendors that can protect your customers' data, require safeguards in their contracts, and check on them periodically based on their risk.
(g) Evaluate and adjust
Update your program based on testing results, changes to your business, new risk assessments, and anything else that could seriously affect your security.
(h) Incident response plan
Keep a written plan for responding to and recovering from security events that affect customer information. Not required for firms with customer information on fewer than 5,000 consumers.
16 CFR 314.4(h) · small-firm exemption 16 CFR 314.6
(i) Annual report to the board
Your Qualified Individual reports in writing, at least once a year, to your board or, if you have none, to the senior officer responsible for security. Not required for firms with customer information on fewer than 5,000 consumers.
16 CFR 314.4(i) · small-firm exemption 16 CFR 314.6
(j) Notify the FTC
If unencrypted customer information about 500 or more consumers is acquired without permission, tell the FTC as soon as possible and no later than 30 days after you discover it. This applies to firms of every size.
Breach notice: if unencrypted information on 500 or more consumers is taken, tell the FTC within 30 days of discovery (16 CFR 314.4(j)).
Where your customer information lives
- Your loan origination system (LOS)
- Credit reports and bank statements
- Borrower document uploads and email
- Shared drives and closing files
Each of these needs access controls, multi-factor sign-in, encryption and a place in your risk assessment.
We already follow our state regulator's rules.
State requirements sit alongside the FTC rule, they don't replace it. The checklist maps each task to its exact paragraph of 16 CFR 314.4 so you can see where they overlap.
How small is small?
With customer information on fewer than 5,000 consumers, four items become optional (16 CFR 314.6): the written risk assessment, continuous monitoring or annual pen testing, the written incident response plan and the annual board report.
Not ready for a trial?
Get the printable checklist by email, with two short tips emails over the next two weeks.
Plain-language guidance from the rule text, not legal advice. Prefer to have it done for you? See Golden Rock's done-for-you options.