OpenLOSGuide
The FTC Safeguards Rule for mortgage broker shops
Mortgage brokers are named in the rule. What 16 CFR Part 314 requires of a broker shop since the 2021 amendments took effect in June 2023, what the 2024 breach-notification duty adds, and which requirements a shop with fewer than 5,000 consumers' records is excused from. Each point is linked to the regulation or the FTC's own guidance.
It applies to you
The Safeguards Rule implements the Gramm-Leach-Bliley Act for financial institutions the FTC oversees. The rule's own list of examples says "a mortgage broker is a financial institution because brokering loans is a financial activity" (§314.2(h)(2)(xi)), and the scope section names "mortgage lenders" and "mortgage brokers" directly (§314.1(b)). Your wholesale lenders may also require it by contract; check your broker agreement.
What's protected is "customer information": any record containing nonpublic personal information about a customer, in any form, that you or someone on your behalf handles (§314.2(d)). Someone who applies to you becomes a consumer whether or not the loan is made (§314.2(b)); someone who enters an agreement for you to arrange a mortgage has a customer relationship (§314.2(e)(2)(i)(E)). A 1003, a credit report, a bank statement, a pay stub, and a closing package are all customer information.
The dates
- The amended rule was published December 9, 2021. Several of its new requirements had a compliance date of December 9, 2022, which the FTC extended to June 9, 2023 (FTC, November 2022). Those were the Qualified Individual, the written risk assessment, access controls and monitoring, encryption, training, the incident response plan, periodic assessment of service providers, and multi-factor authentication.
- The FTC-notification amendment was published November 13, 2023 and took effect May 13, 2024 (§314.5; FTC, May 2024).
What the program has to contain
You must "develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts," appropriate to your size, the nature of your activities, and the sensitivity of the information (§314.3(a)). The elements are in §314.4, paragraphs (a) through (j).
| §314.4 | What it requires | For a broker shop |
|---|---|---|
| (a) Qualified Individual | One person responsible for overseeing, implementing, and enforcing the program. Can be an employee, an affiliate, or a service provider; if it's an outside firm, you keep responsibility, name a senior person to oversee them, and require them to keep their own program. | Usually the owner or operations lead. Write the designation down. |
| (b) Risk assessment | Base the program on an assessment of foreseeable internal and external risks, and reassess periodically. Under (b)(1) the assessment must be written, with criteria for rating risks, criteria for assessing confidentiality, integrity, and availability, and how each risk will be mitigated or accepted. | Where does borrower data live: the LOS, email, phones, lender portals, a scanner, a shared drive? Who can reach each one, and how would it be lost? |
| (c)(1) Access controls | Authenticate users and limit each one to the information they need for their job. | One account per person, roles, remove access when someone leaves. |
| (c)(2) Inventory | Identify and manage the data, people, devices, systems, and facilities that matter. | A list of systems and devices holding customer information. |
| (c)(3) Encryption | Encrypt all customer information in transit over external networks and at rest. If that's infeasible, use compensating controls the Qualified Individual approves in writing. | HTTPS everywhere, encrypted disks and backups, no borrower documents in plain email attachments. |
| (c)(4) Applications | Secure development practices for in-house apps; procedures to evaluate the security of outside apps you use. | Ask vendors how they protect data; keep the answers. |
| (c)(5) Multi-factor authentication | MFA "for any individual accessing any information system," unless the Qualified Individual approves in writing an equivalent or stronger control. MFA means at least two of a knowledge factor, a possession factor, and an inherence factor (§314.2(k)). | MFA on the LOS, email, lender portals, and the credit vendor. |
| (c)(6) Disposal | Secure disposal no later than two years after the information was last used for the customer, unless it's needed for business, required by law to be kept, or targeted disposal isn't feasible. Review the retention policy periodically. | A retention schedule that reconciles this with the records you must keep (TRID, ECOA, state rules). |
| (c)(7) Change management | Procedures for changes to systems. | Who approves a new tool or an upgrade, and where that's recorded. |
| (c)(8) Logging | Monitor and log authorized users' activity and detect unauthorized access or tampering. | Review who viewed, exported, or downloaded files. |
| (d) Testing | Regularly test or monitor the key controls. For information systems, either continuous monitoring or, under (d)(2), annual penetration testing and vulnerability assessments at least every six months. | See the small-shop exception below. |
| (e) People | Security awareness training, updated for the risks found; qualified security personnel (yours or a provider's) who keep current. | Phishing and wire-fraud training is the obvious place to start. |
| (f) Service providers | Select providers that can protect the information, require safeguards by contract, and reassess them periodically. | Your LOS vendor or host, email provider, credit vendor, document storage, IT contractor. |
| (g) Adjust | Revise the program after testing, changes in the business, risk reassessments, or anything else that matters. | Revisit after an incident, a new system, or a new office. |
| (h) Incident response plan | A written plan covering goals, internal process, roles and decision authority, communications, fixing the weakness, documentation, and revising the plan afterward. | Who decides, whom you call, how you contain it. See the exception below. |
| (i) Annual report | The Qualified Individual reports in writing at least annually to the board, or if there is none, to a senior officer: program status, compliance, risks, provider arrangements, test results, incidents, and recommendations. | In a small shop the owner may be writing to themselves. See the exception below. |
| (j) Notify the FTC | Details below. | Applies regardless of size. |
Paraphrased from 16 CFR §314.4; the FTC's plain-language summary is here. Not legal advice.
The small-shop exception
A financial institution that maintains customer information about fewer than 5,000 consumers is excused from four things (§314.6): the written risk assessment in (b)(1), the penetration testing and vulnerability assessments in (d)(2), the written incident response plan in (h), and the annual written report in (i).
Read that carefully. A small shop still has to base its program on a risk assessment and reassess periodically ((b) and (b)(2)); it just doesn't have to meet the written-form requirements in (b)(1). It still has to test or monitor its controls under (d)(1). And everything in (c) applies in full: access controls, encryption, MFA, disposal, logging. So does the FTC notification in (j).
The count is consumers whose information you maintain, not loans closed this year. Applicants who never closed are consumers (§314.2(b)(2)(i)), and files you still keep from past years count toward what you maintain. A shop closing a few hundred loans a year can cross 5,000 over time if it never disposes of anything. How to count edge cases (co-borrowers, prospects who sent a pay stub and vanished) is a judgment the rule doesn't spell out; count conservatively, and treat the exception as something to earn through disposal rather than assume.
Notifying the FTC after a breach
A "notification event" is the unauthorized acquisition of unencrypted customer information. Information is treated as unencrypted if the key was also accessed, and unauthorized access is presumed to be acquisition unless you have reliable evidence it wasn't (§314.2(m)). If the event involves the information of at least 500 consumers, you must notify the FTC "as soon as possible, and no later than 30 days after discovery" (§314.4(j)(1)). The event counts as discovered on the first day any employee, officer, or agent other than the person who did it knows about it (§314.4(j)(2)).
The notice goes in through the FTC's online form and includes your name and contact, the types of information involved, the date or date range if known, the number of consumers affected or potentially affected, a general description, and whether law enforcement has asked in writing for public notice to be delayed. The form says the report may be made public; a law enforcement official can request an initial delay of up to 30 days, extendable by up to 60 more in writing (§314.4(j)(1)(vi)).
Two things the FTC rule doesn't do: it doesn't require you to notify the affected borrowers, and it doesn't replace state breach-notification laws, which generally do, on their own timelines and thresholds. Every state has one (NCSL's summary links each); some state regulators also impose their own cybersecurity rules on licensed mortgage companies. Your incident response plan should list both.
Common mistakes
- Treating the exception as a pass. Fewer than 5,000 consumers removes four paperwork items, not MFA, encryption, access control, or logging.
- MFA only on the LOS. The rule says any individual accessing any information system; email is where most broker breaches start.
- Borrower documents in email. Unencrypted attachments sent across the public internet are the opposite of (c)(3).
- Shared logins. No access control and no usable log.
- No vendor contracts that mention safeguards. (f)(2) requires it by contract, including for the IT person.
- Keeping everything forever, which both violates (c)(6) and pushes the shop past 5,000 consumers.
- No one named. The Qualified Individual is the first thing an examiner, or a lender's vendor review, asks for.
What OpenLOS covers, and what it can't
Software can't comply for you; the program, the people, the vendors, and the plan are yours. OpenLOS is self-hosted, so your hosting provider is your service provider and no OpenLOS company sees your data. Inside the application: four roles checked on the server for every page and action, with read-only users never receiving SSNs, dates of birth, or documents, and optional per-loan access for loan officers (c)(1); SSNs, dates of birth, documents, and credit reports encrypted at rest with AES-256-GCM and key rotation (c)(3), with HTTPS up to you; two-step sign-in with authenticator apps, which an owner can require for everyone (c)(5); and an append-only loan history (edits, exports, uploads, downloads) and sign-in log shown to owners (c)(8). It has no automatic disposal schedule yet (c)(6), no independent security review, and it can't write your risk assessment or incident plan. The project's Safeguards self-assessment maps every paragraph of §314.4 to what the software does and what the shop still has to do; the security notes list the controls in detail.
Not legal advice. The regulation is short; read §314.4 itself, and check your state's breach-notification law and your state regulator's rules.