Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act) (Regulation G)

The Secure and Fair Enforcement for Mortgage Licensing Act of 2008 (SAFE Act), 12 U.S.C. § 5101, et seq. was enacted on July 30, 2008, and requires individuals who engage in the business of a residential mortgage loan originator (MLO) to be either state-licensed or federally-registered as MLOs. Federal registration is available only to individuals who are employees of:

A depository institution (which includes a credit union);
A subsidiary that is owned and controlled by a depository institution and regulated by a federal banking agency; or
An institution regulated by the Farm Credit Administration.

Federal registration is done through the Nationwide Mortgage Licensing System and Registry (NMLS) at This is an external link to a website belonging to another federal agency, private organization, or commercial entity. http://fedregistry.nationwidelicensingsystem.org/Pages/default.aspx (Opens new window) .

When an MLO begins the federal registration process through the NMLS, he or she receives a unique identification number. The SAFE Act and its implementing regulation, Regulation G, (12 CFR Part 1007) require this unique identification number to be provided to consumers in specific instances.

The SAFE Act and Regulation G also require the employer of federally-registered MLOs to adopt written policies and procedures to comply with the SAFE Act and Regulation G, and perform annual independent testing of the policies and procedures.
The SAFE Act is codified at 12 U.S.C. §§ 5101 to 5116 and Regulation G is codified at 12 CFR §§ 1007.101 to 1007.105 (with an appendix).

Full text of the SAFE Act can be found This is an external link to a website belonging to another federal agency, private organization, or commercial entity. here (Opens new window) .

Regulation G (SAFE Mortgage Licensing Act – Federal Registration of Residential Mortgage Loan Originators) can be found This is an external link to a website belonging to another federal agency, private organization, or commercial entity. here (Opens new window) .

NCUA Regulation requires federally-insured credit unions to adhere to the requirement of 12 CFR Part 1007 ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. 12 CFR §741.223 (Opens new window) )

Associated Risks

Compliance risk can occur when the credit union does not implement controls to comply with the SAFE Act and Regulation G. The credit union must establish procedures to ensure that third party companies which handle mortgage loan originations have policies and procedures to comply with the SAFE Act, including licensing and/or registration of individuals acting as MLOs.

Transaction risk can occur when the credit union does not have adequate internal controls in place and as a result suffers a loss.

Reputation risk can occur when the credit union incurs fines and penalties or experiences decreased member confidence because it or third party companies did not comply with the SAFE Act and Regulation G.

Strategic risk can occur when the board of directors does not perform due diligence in reviewing policies, and existing and prospective products and services for compliance with Regulation G and the SAFE Act.

Examination Objectives

To determine if the credit union is in compliance with Regulation G and the SAFE Act.
To determine if the credit union has written policies and procedures to ensure compliance with Regulation G and the SAFE Act.
To determine if the annual independent testing of the credit union’s policies and procedures for complying with Regulation G has been conducted.
To determine if the independent test included a sufficient audit scope to reach a conclusion about whether or not minimum regulatory requirements are being met.
To determine whether any violations or deficiencies identified during the independent testing have been corrected and that steps have been taken to ensure they do not recur.
To determine if there is evidence that Mortgage Loan Originators (MLOs) are providing their unique identifiers to consumers as required by This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.105 (Opens new window) .

Examination Procedures

Scoping

Determine whether the credit union, or any of its subsidiaries, has one or more MLO employees. For those credit unions without any MLO employees, these review considerations do not need to be completed. ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.103(a)(2) (Opens new window) )

Policies and Procedures

Determine for credit unions with MLO employees whether the credit union has adopted written policies and procedures and conducts annual independent compliance tests to ensure compliance with Regulation G. ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104 (Opens new window) )
Review the credit union’s written policies and procedures and the annual independent compliance tests to determine whether the credit union has taken appropriate steps to ensure compliance with the SAFE Act and Regulation G. These must at a minimum:
1. Establish a process for identifying which employees of the credit union must be registered MLOs; ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(a) (Opens new window) )
2. Require all employees of the credit union who are MLOs to be informed of the registration requirements of the SAFE Act and Regulation G and be instructed on how to comply with the requirements and procedures; ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(b) (Opens new window) )
3. Establish procedures to comply with the unique identifier requirements in Regulation G; ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(c) (Opens new window) )
4. Establish procedures for confirming the adequacy and accuracy of employee registrations, including updates and renewals, by comparisons with its own records; ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(d) (Opens new window) )
5. Establish procedures and tracking systems for monitoring compliance with registration and renewal requirements and procedures; ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(e) (Opens new window) )
6. Provide for independent testing for compliance with Regulation G that either credit union personnel or an outside party conducts annually; ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(f) (Opens new window) )
7. Provide for action in the case of an employee who fails to comply with the registration requirements of the SAFE Act, Regulation G, or the credit union’s policies and procedures. This includes prohibiting the employee from acting as an MLO or other disciplinary actions; ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(g) (Opens new window) )
8. Establish a process for reviewing employee criminal history background reports received according to Regulation G, taking action consistent with federal law (including Section 206(i) of the Federal Credit Union Act ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. 12 U.S.C. § 1786(i) (Opens new window) ) and Section 741.3(c) of the NCUA Rules and Regulations ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. 12 CFR § 741.3(c)) (Opens new window) ) with respect to the reports, and keeping records of the reports and actions taken regarding applicable employees; and ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(h) (Opens new window) )
9. Establish procedures to ensure that any third party with which the credit union has arrangements related to mortgage loan origination has policies and procedures to comply with the SAFE Act, including licensing and/or registration for individuals acting as MLOs. ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.104(i) (Opens new window) )

Use of Unique Identifier

Determine whether credit unions make the unique identification numbers of their MLO employees available to consumers in a practical way. ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.105(a) (Opens new window) )
Determine whether federally-registered MLOs provide their unique identification numbers to consumers as required by Regulation G: ( This is an external link to a website belonging to another federal agency, private organization, or commercial entity. § 1007.105(b)(1)-(3) (Opens new window) )
1. Upon request (orally or in writing);
2. Before acting as an MLO (orally or in writing); and
3. In any initial written communication (paper or electronic) from the MLO to the consumer (such as a commitment letter, good faith estimate, or disclosure statement).

Recordkeeping

Determine whether sufficient records are maintained to indicate compliance with all components of the SAFE Act and Regulation G. Credit unions with MLO employees must retain sufficient records to indicate they are in compliance with the registration requirements, review of criminal background checks (where applicable), and the proper use of unique identifiers.