Bad Record Retention Policy = Red Flags for Mortgage Compliance Risk

Faulty and incomplete records are enforcement targets for regulators. New York and New Hampshire banking departments have targeted lenders based on record keeping problems. Perhaps more problematic, record problems can look to regulators like red flags for noncompliance in other areas.

State banking departments are upping the ante on record keeping violations, if recent developments in New York and New Hampshire are any indication. The New York Department of Financial Services (DFS) has been challenging lenders for noncompliance with Section 597 of the Banking Law, which requires keeping books and records for three years. It penalized a mortgage banker in October for filing to keep documents supporting its operations reports and failing to keep lists of closing agents. In addition to a $15,000 fine, the DFS now requires the lender to: (1) maintain documents supporting reconciliation of its filings, (2) ensure reporting of revenue, (3) keep lists of closing agents for at least three years, (4) develop compliance policies and procedures (to be filed with the DFS), and (5) designate a responsible records compliance officer. The DFS also settled with a mortgage broker that failed to timely file its Volume of Operations Report; for this violation, a $5,000 fine was imposed. A different lender was fined $10,000 for the same issue.

In New Hampshire, a mortgage banker and its president were sanctioned for failure to facilitate a regulatory exam after disregarding a dozen official requests. Ignoring the requests was found tantamount to knowingly withholding information. Mortgage licensees must make accounts, records, documents, files and other information “freely available,” and timely produce requested information.

Bad record retention policy by New Hampshire lenders can result in fines and loss of license; these penalties apply not only to licensed organizations, but also to control persons. The NH Banking Department said the lender’s failure to provide documents meant it had not implemented information security and anti-money laundering programs. The Banking Department ordered fines of $55,000 against the company and another $55,000 against its president.

Record keeping is a necessary, if unglamorous function, but these enforcement actions indicate it involves compliance risk. Perhaps more problematic, record problems can look to regulators like red flag warnings for other kinds of noncompliance. Unlike more ambiguous and fluid requirements (e.g., “unfair” and “abusive” lending prohibitions), rules for record retention are usually clear, objective and precise. Noncompliance may therefore be less easily explained, or forgiven.

Regulatory reporting requires a sophisticated database and robust procedures that incorporate identification of specific records retained, required formats for the records, and an indication of applicable retention periods. Regrettably for lenders, the records and retention periods vary from state to state, from loan program to loan program, and sometimes even from record to record.

Effective record retention policies not only preserve records, but can be used to isolate responsive data from multiple sources. As the New York and New Hampshire penalties show, bad records can be a (time-consuming and expensive) compliance headache for lenders, but are relatively easy pickings for regulators rooting around for noncompliance.


Want to learn more about records retention red flags and fines? Watch the Regulators Crack Down on Faulty Lender Records webinar, where Lee Negroni discusses:

  • What kind of records lenders are required to maintain
  • Why departments are looking at recordkeeping gaps as “red flags” for additional investigation
  • Recent penalties for noncompliant recordkeeping and what they mean for you

Watch Now!

Share this post!

Get a Quote

Tell us about yourself, and we’ll be in touch right away.

Smarsh handles information you submit to Smarsh in accordance with its Privacy Policy. By clicking "submit", you consent to Smarsh processing your information and storing it in accordance with the Privacy Policy and agree to receive communications from Smarsh and its third-party partners regarding products and services that may be of interest to you. You may withdraw your consent at any time by emailing privacy@smarsh.com.

Contact Us

Tell us about yourself, and we’ll be in touch right away.