KRS 286.8-295: Mortgage loan company and mortgage loan broker to exercise control

over operations, employees, and company affairs -- Requirements for alternate

work location.

(1) As used in this section, "employee" shall include a mortgage loan originator

engaged as an independent contractor.

(2) (a) Every mortgage loan company and mortgage loan broker shall exercise proper

supervision and control over the operations, employees, and affairs of its

company.

(b) A mortgage loan company or mortgage loan broker shall supervise and control

all employees acting as a mortgage loan originator on behalf of the mortgage

loan company or mortgage loan broker.

(3) A licensee that allows employees to engage in the mortgage lending process from an

alternate work location shall:

(a) Exercise proper supervision and control over the employees;

(b) Have written policies and procedures in place that ensure a safe, secure system

for the mortgage lending process;

(c) Oversee compliance, and require all employees to comply, with t he policies

and procedures referenced in paragraph (b) of this subsection;

(d) Employ appropriate risk-based monitoring and oversight processes;

(e) Ensure that:

1. Customer interactions and communications about consumer accounts are

in compliance with fed eral and state information security requirements,

including applicable provisions of:

a. The Gramm -Leach-Bliley Act of 1999, Pub. L. No. 106 -102, as

amended; and

b. The Federal Trade Commission's Safeguards Rule, set forth in 16

C.F.R. pt. 314;

2. Any employee that engages in the mortgage lending process at an

alternate work location accesses the company's secure systems,

including a cloud -based system, directly from any out -of-office device

via a virtual private network (VPN) or a comparable system that ensures

secure connectivity and requires passwords or other forms of

authentication to access;

3. Appropriate security updates, patches, or other alterations to the security

of all devices used at an alternate work location are installed and

maintained;

4. Any employee that engages in the mortgage lending process at an

alternate work location agrees to comply with the licensee's processes

established under paragraph (d) of this subsection; and

5. The Nationwide Multistate Licensing System and Registry record of a

mortgage loan originator that works from an alternate work location

designates a properly licensed location as the mortgage loan originator's

official work station;

(f) Have the ability to:

1. Remotely lock or erase company-related contents of any device; or

2. Otherwise remotely limit all access to the company's secure systems; and

(g) At least annually:

1. Certify that all employees engaged in the mortgage lending process at

alternate work locations meet the appropriate standards and safeguar ds

to continue engaging in the mortgage lending process from the alternate

work locations; and

2. Review each alternate work location and provide proof of the

documented review to the department upon request.

(4) Notwithstanding any provision to the contra ry, nothing in this section shall prohibit

mortgage loan companies from utilizing the services of a mortgage loan broker and

its employees.