Conduct with Borrowers, Fees & Business Ethics: practice questions

A non-bank mortgage lender outsources its information security programme to a managed service provider. Under the FTC Safeguards Rule, who remains responsible for compliance?

1. The lender, which must name a senior person to oversee it ✓
2. The provider alone, once the contract assigns the duty to it
3. The FTC, which approves providers
4. The lender's auditors, who certify the programme every year

Why: 16 CFR 314.4(a): the Qualified Individual may be employed by a service provider, but the institution must "(1) Retain responsibility for compliance with this part; (2) Designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual".

Source: 16 CFR 314.4(a)

A company pays higher commissions on loans secured by property in State A, where rates run higher, than in State B. Its originators have no way to influence where the property is. Is location a proxy for a loan term?

1. Yes; any factor that tracks the interest rate is a proxy
2. Yes, unless the company pays the same base salary to all
3. No, but only if the rate gap is below one percentage point
4. No; the originators cannot add, drop or change the factor ✓

Why: Under 12 CFR 1026.36(d)(1)(i), comment 36(d)(1)-2.ii.B: where the loan originator "does not have any ability to influence whether the transaction is secured by property located in State A or State B", the location "is not a proxy for a term of a transaction". Both limbs of the proxy test in 1026.36(d)(1)(i) must be met.

Source: 12 CFR 1026.36(d)(1)(i); Supplement I comment 36(d)(1)-2

A loan officer originated eight consumer mortgage loans in the 12 months before her company sets its annual bonus. The bonus comes from mortgage profits and is not based on her loans' terms. Does the 10 percent cap apply?

1. No; ten or fewer loans in the prior 12 months lifts the cap ✓
2. Yes; a profits-based bonus may never exceed 10 percent of total compensation
3. No; profits-based bonuses are banned outright
4. Yes, unless the bonus is paid into a tax-advantaged retirement plan instead

Why: 12 CFR 1026.36(d)(1)(iv) allows a non-deferred profits-based bonus not based on the originator's own terms if either it does not exceed 10 percent of total compensation for the period, or the originator "was a loan originator for ten or fewer transactions ... consummated during the 12-month period preceding the date of the compensation determination" (d)(1)(iv)(B)(2).

Source: 12 CFR 1026.36(d)(1)(iv)

Which institutions must keep written policies and procedures to monitor compliance with Regulation Z's rules on originator compensation, steering, qualification and NMLSR IDs?

1. Every mortgage broker, whatever its size or charter type
2. Only creditors that make more than 25 mortgage loans a year
3. Depository institutions, for themselves and their subsidiaries ✓
4. Only non-bank lenders licensed by a state regulator

Why: 12 CFR 1026.36(j)(1): "A depository institution must establish and maintain written policies and procedures reasonably designed to ensure and monitor the compliance of the depository institution, its employees, its subsidiaries, and its subsidiaries' employees with the requirements of paragraphs (d), (e), (f), and (g)".

Source: 12 CFR 1026.36(j)(1)

A creditor requires HUD-approved counseling before making a negative amortization loan to a first-time borrower. May it tell the borrower which counselor to use?

1. Yes; it may require a counselor on its own approved list
2. Yes, if the counseling is free of charge to the borrower
3. No, unless the counselor is a HUD employee rather than an agency
4. No; it may not steer the borrower to a particular counselor ✓

Why: 12 CFR 1026.36(k)(3): a creditor making such a loan to a first-time borrower "shall not steer or otherwise direct a consumer to choose a particular counselor or counseling organization" for the required counseling.

Source: 12 CFR 1026.36(k)(3)

What does the Safeguards Rule require for customer information a lender holds or sends over external networks?

1. Encryption only for Social Security numbers, not other customer data
2. Encryption in transit and at rest, or approved alternatives ✓
3. Encryption only for data sent by email, not data stored on servers
4. No encryption, provided staff sign a confidentiality agreement

Why: 16 CFR 314.4(c)(3): "Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest"; if that is infeasible, effective alternative compensating controls reviewed and approved by the Qualified Individual may be used.

Source: 16 CFR 314.4(c)(3)

After a dispute arises over a mortgage, the borrower and the lender both agree to settle it through arbitration. Is that allowed?

1. Yes; the ban covers only pre-dispute terms requiring arbitration ✓
2. No; any arbitration of a claim on a dwelling-secured loan is barred
3. Yes, but only if a court first approves the arbitration agreement
4. No, unless the claim is below the state small-claims court limit

Why: 12 CFR 1026.36(h)(1): the prohibition "does not limit a consumer and creditor or any assignee from agreeing, after a dispute or claim under the transaction arises, to settle or use arbitration or other non-judicial procedure to resolve that dispute or claim."

Source: 12 CFR 1026.36(h)(1)

A borrower sends a written request for a payoff statement on her home loan. Within what time must the servicer provide it, in the ordinary case?

1. Three business days
2. Ten calendar days
3. Thirty calendar days
4. Seven business days ✓

Why: 12 CFR 1026.36(c)(3): the statement "shall be sent within a reasonable time, but in no case more than seven business days, after receiving a written request from the consumer or any person acting on behalf of the consumer", with exceptions such as loans in bankruptcy or foreclosure.

Source: 12 CFR 1026.36(c)(3)

Under the FTC Safeguards Rule, what must the information security programme of a mortgage lender holding data on 20,000 consumers be based on?

1. A written risk assessment of foreseeable risks to customer information ✓
2. The security standards its largest outside vendor has itself chosen to follow
3. A checklist the FTC sends to each lender at the start of every calendar year
4. Whatever controls its insurer requires for a cyber insurance policy

Why: 16 CFR 314.4(b) requires the programme to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to customer information, and (b)(1) says "The risk assessment shall be written". 16 CFR 314.6 exempts institutions holding information on fewer than 5,000 consumers from (b)(1).

Source: 16 CFR 314.4(b), 314.6

A lender's standard home equity line of credit agreement requires all disputes to go to binding arbitration. Is the clause permitted?

1. Yes, if the clause is printed in bold and initialled by the borrower
2. Yes, as the rule on arbitration applies only to closed-end loans
3. No, unless the arbitration is held in the borrower's home county
4. No; dwelling-secured credit contracts may not require arbitration ✓

Why: 12 CFR 1026.36(h)(1): a contract for a consumer credit transaction secured by a dwelling, "including a home equity line of credit secured by the consumer's principal dwelling", may not include terms that require arbitration or any other non-judicial procedure.

Source: 12 CFR 1026.36(h)(1)