DFPI Guidance Regarding Remote Work

Onus put on branch managers to actively monitor MLOs

Link copied

The California Department of Financial Protection and Innovation (DFPI), in recognition of the end of the COVID-19 State of Emergency on February 28, and the status of remote work options, issues the following guidance regarding remote work under the California Residential Mortgage Lending Act (CRMLA).

The CRMLA does not expressly prohibit employees of a licensee from working at a remote location, such as an employee’s home. A licensee may authorize an employee to perform limited functions at a remote location that is not considered a branch office, provided that the location does not have the indicia of a branch office and is not advertised to the public as a business location.

In instances where a mortgage loan originator (MLO) or another employee is working remotely, a branch manager must continue to supervise the employee. In accordance with Rule 1950.122.6 of the CRMLA (Cal. Code of Regs., tit. 10, § 1950.122.6), the DFPI will continue to examine the supervisory activities of a branch manager to ensure that the branch manager is adequately supervising each MLO and employee regardless of whether they are working at a remote location or a branch office.

The following are considerations for a licensee when determining whether a location is adequately supervised, or whether it has the indicia of a branch office:

1. Only one employee or multiple employees who reside at the location and are members of the same immediate family work at the remote location.

2. If confidential physical files are accessible at the remote location, and whether the remote location contains secure storage that protects confidential physical files.

3. The MLO is assigned to a designated branch office, and such designated branch office is reflected on all communications to the public by the MLO.

4. The employee’s communications with the public are subject to the licensee’s supervision or a designated communication person.

5. Electronic mail is through the licensee’s electronic email system.

6. All loan processing is reviewable at the main or branch office.

7. Written supervisory procedures pertaining to supervision of loan origination and lending activities conducted remotely are maintained and enforced by the licensee.

8. A list of the remote locations is maintained by the licensee.

9. All records can be accessed by the DFPI at the main or branch office location.

10. Written supervisory procedures contain specific provisions regarding cybersecurity and a virtual privacy network (VPN) or other secure system at the remote location, including:

a. Multi-factor authentication,

b. Back-up system and data recovery system, and

c. Protocols in the event of a cybersecurity incident.

The DFPI is committed to working with licensees to ensure adequate supervision of employees working from remote locations while recognizing the increased desire and ability of their employees to perform work functions remotely.

Questions regarding this guidance may be directed to [email protected].