§ 286-8-295

286.8 -295 Mortgage loan company and mortgage loan broker to exercise control over operations, employees, and company affairs -- Requirements for alternate work location. (1) As used in this section, 'employee' shall include a mortgage loan originator engaged as an independent contractor. (2) (a) Every mortgage loan company and mortgage loan broker shall exercise proper supervision and control over the operations, employees, and affairs of its company. (b) A mortgage loan company or mortgage loan broke r shall supervise and control all employees acting as a mortgage loan originator on behalf of the mortgage loan company or mortgage loan broker. (3) A licensee that allows employees to engage in the mortgage lending process from an alternate work location shall: (a) Exercise proper supervision and control over the employees; (b) Have written policies and procedures in place that ensure a safe, secure system for the mortgage lending process; (c) Oversee compliance, and require all employees to comply, with t he policies and procedures referenced in paragraph (b) of this subsection; (d) Employ appropriate risk -based monitoring and oversight processes; (e) Ensure that: 1.

e all employees to comply, with t he policies and procedures referenced in paragraph (b) of this subsection; (d) Employ appropriate risk -based monitoring and oversight processes; (e) Ensure that: 1. Customer interactions and communications about consumer accounts are in compliance with fed eral and state information security requirements, including applicable provisions of: a. The Gramm -Leach -Bliley Act of 1999, Pub. L. No. 106 -102, as amended; and b. The Federal Trade Commission's Safeguards Rule, set forth in 16 C.F.R. pt. 314; 2. Any employee that engages in the mortgage lending process at an alternate work location accesses the company's secure systems, including a cloud -based system, directly from any out -of-office device via a virtual private network (VPN) or a comparable system that ensures secure connectivity and requires passwords or other forms of authentication to access; 3. Appropriate security updates, patches, or other alterations to the security of all devices used at an alternate work location are installed and maintain ed; 4. Any employee that engages in the mortgage lending process at an alternate work location agrees to comply with the licensee's processes

at an alternate work location are installed and maintain ed; 4. Any employee that engages in the mortgage lending process at an alternate work location agrees to comply with the licensee's processes established under paragraph (d) of this subsection; and 5. The Nationwide Multistate Licensing System and Registry record of a mortgage loan originator that works from an alternate work location designates a properly licensed location as the mortgage loan originator's official work station; (f) Have the ability to: 1. Remotely lock or erase company -related contents of any device; or 2. Otherwise remotely limit all access to the company's secure systems; and (g) At least annually: 1. Certify that all employees engaged in the mortgage lending process at alternate work locations meet the appropriate standards and safeguar ds to continue engaging in the mortgage lending process from the alternate work locations; and 2. Review each alternate work location and provide proof of the documented review to the department upon request. (4) Notwithstanding any provision to the contra ry, nothing in this section shall prohibit mortgage loan companies from utilizing the services of a mortgage loan

eview to the department upon request. (4) Notwithstanding any provision to the contra ry, nothing in this section shall prohibit mortgage loan companies from utilizing the services of a mortgage loan broker and its employees. Effective: July 14, 2022 History: Amended 2022 Ky. Acts ch. 125, sec. 4, effective July 14, 2022. -- Created 2009 Ky . Acts ch. 104, sec. 21, effective June 25, 2009.