The FTC Safeguards Rule for mortgage brokers: securing loan files

If you run a mortgage brokerage, every loan file your team touches holds the data the FTC Safeguards Rule was written to protect: Social Security numbers, tax returns, bank statements, and credit reports. The rule applies to mortgage brokers by name, and some of the FTC's first enforcement cases under it were against mortgage companies.

Are mortgage brokers covered by the FTC Safeguards Rule?

Yes. The FTC's own definitions name them. 16 CFR 314.2(h)(2)(xi) states that a mortgage broker is a financial institution because brokering loans is a financial activity under the Bank Holding Company Act. The neighboring example, 314.2(h)(2)(x), does the same for firms that provide real estate settlement services.

That classification brings the full Safeguards Rule with it: a written information security program, a Qualified Individual who runs it, a risk assessment, specific technical safeguards, service provider oversight, and since May 2024, notice to the FTC after certain breaches. Nonbank mortgage lenders fall under the same rule through the broader definition of financial institution, since lending is also a listed financial activity.

Which loan file information does the rule protect?

All customer information in the firm's possession, including information about applicants who never close. 16 CFR 314.1(b) says the rule applies to customer information whether it pertains to individuals with whom the firm has a customer relationship or to customers of other financial institutions that provided it.

For a brokerage, that reaches almost everything in a loan file: the application, Social Security numbers, pay stubs, tax returns, bank and brokerage statements, credit reports, and the email threads where borrowers send those documents. Section 314.2(d) defines customer information as any record containing nonpublic personal information, "whether in paper, electronic, or other form." The scanned W-2 in a loan officer's download folder counts the same as the record in the loan origination system.

Has the FTC enforced the rule against mortgage companies before?

Yes, and the first cases set the pattern for what the agency looks for. In November 2004, the FTC brought Safeguards Rule actions against Nationwide Mortgage Group, a Virginia mortgage broker, and Sunbelt Lending Services, a Florida lender.

The FTC alleged that Nationwide failed to assess risks to customer information, train employees, oversee its loan officers' handling of customer information, and monitor its network for vulnerabilities. It alleged that Sunbelt failed to oversee its service providers and the security practices of loan officers working from remote locations. Both companies settled without admitting a violation. The March 2005 Nationwide order required an independent professional to certify the company's security program within 180 days and then every other year for 10 years.

Those allegations still read like a list of common findings at brokerages today: loan officers working from home or a car, files shared through personal email, and processing vendors nobody has reviewed.

What does the rule require for securing loan files?

The core technical requirements sit in 16 CFR 314.4(c). They apply to every system that stores or touches customer information, including laptops, phones, file shares, email, and the loan origination system.

• Access controls: authenticate users and limit each person's access to the customer information they need for their role (314.4(c)(1)).
• Inventory: identify and manage the data, personnel, devices, systems, and facilities involved, based on their importance to the business (314.4(c)(2)).
• Encryption: encrypt customer information held or transmitted, both in transit over external networks and at rest. If encryption is infeasible, the Qualified Individual must review and approve compensating controls (314.4(c)(3)).
• Multi-factor authentication: required for any individual accessing any information system, unless the Qualified Individual approves in writing the use of equivalent or more secure controls (314.4(c)(5)).
• Disposal: dispose of customer information no later than two years after the last date it was used in connection with providing a product or service to the customer, unless retention is needed for business or legal reasons (314.4(c)(6)).
• Change management and monitoring: manage changes to systems, and monitor and log the activity of authorized users (314.4(c)(7) and (c)(8)).

The disposal requirement deserves attention at brokerages. Loan files for applications that were withdrawn or denied often sit in shared drives and inboxes indefinitely. Retention obligations under other laws may justify keeping some records. The Safeguards Rule expects the firm to know which records it keeps, why, and when the rest goes.

Do loan origination systems and processors count as service providers?

Yes, if they receive, maintain, or process customer information for the firm. Section 314.4(f) requires the firm to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them based on the risk they present.

For a mortgage broker, that list usually includes the loan origination system, the document portal borrowers upload to, credit reporting and verification vendors, contract processors, e-signature tools, cloud storage, and the IT provider. Sunbelt's 2004 case turned partly on service provider oversight, so this is an area where the FTC has a long record of interest. Our guide to vendor oversight under GLBA covers how to structure those reviews.

What happens if a loan file is exposed?

If an incident involves unencrypted information of at least 500 consumers, the firm must notify the FTC. Section 314.4(j) requires notice as soon as possible and no later than 30 days after discovery, filed through the FTC's online reporting form. Our walkthrough of the FTC breach notification form explains what the filing asks for.

A single compromised mailbox at a busy brokerage can easily hold 500 borrowers' documents. That makes email security and mailbox retention part of breach exposure planning, and it is why the incident response plan required by 314.4(h) needs to cover how the firm would determine which borrowers were in an affected mailbox. State breach notification laws apply separately.

Do small brokerages get any relief?

Some. 16 CFR 314.6 exempts firms that maintain customer information on fewer than 5,000 consumers from four requirements: the written risk assessment in 314.4(b)(1), the testing requirements in 314.4(d)(2), the written incident response plan in 314.4(h), and the Qualified Individual's annual written report in 314.4(i).

Everything else still applies at any size, including encryption, multi-factor authentication, disposal, service provider oversight, and FTC notification. The 5,000 count includes every consumer whose information the firm holds, so a brokerage that keeps years of withdrawn applications may cross the threshold sooner than its closed-loan volume suggests.

What should a mortgage broker do this quarter?

Start with the places loan files actually live. A short, focused review usually surfaces most of the gaps an examiner or investigator would find.

• Map every location that holds borrower documents: the loan origination system, email, file shares, laptops, phones, and any personal accounts loan officers use.
• Confirm multi-factor authentication on email, the loan origination system, remote access, and cloud storage, for every user including the owners.
• Check that laptops and phones holding loan documents are encrypted and can be remotely wiped.
• Set and enforce a disposal schedule for withdrawn, denied, and closed files, with documented exceptions for records kept under other laws.
• List service providers that touch borrower data, collect their security documentation, and confirm contracts require safeguards.
• Confirm the incident response plan explains how the firm would identify affected borrowers and meet the 30-day FTC notice window.

How does s90 help mortgage brokers?

s90 runs the technical side of the Safeguards Rule for financial firms in Los Angeles and Orange County: MFA and encryption across every device, disposal schedules, service provider evidence, and the documentation a Qualified Individual needs for the annual board report. Our agreements commit to notifying clients within 72 hours of a breach and producing evidence within 24 hours of a request. If you want a second set of eyes on where your loan files live, we are glad to walk through it.