The FTC Safeguards Rule protects nonpublic personal information held by non-bank financial institutions.
A mortgage broker's daily work sits squarely inside that definition: collecting borrower financial documents, verifying income and assets, and ordering credit. The rule names mortgage brokers as a covered financial institution.
Mortgage brokers and lenders hold high-value financial data.
Every application contains Social Security numbers, income and employment records, bank statements, tax returns, credit reports, and property and loan details. That is precisely the customer financial information the Safeguards Rule is written to protect.
Wire fraud and business email compromise target this data directly. The rule requires MFA, access controls, and encryption; out-of-band verification of payment instructions is a best practice we add on top.
These are the same controls that defend against the most common attacks on mortgage operations.
A written program is the baseline, not the ceiling.
The rule requires a written information security program, a Qualified Individual, a documented risk assessment, and an incident response plan. These exist whether or not you have ever had an incident.
We produce these documents to reflect what is actually running in your environment. The program then survives an FTC inquiry or a wholesale-lender security questionnaire rather than reading as boilerplate.
Vendor oversight is part of compliance.
Mortgage operations rely on loan origination systems (LOS), credit bureaus, automated underwriting systems, document and e-sign providers, and wholesale lender portals.
The rule requires you to oversee the service providers that handle your customer information.
We inventory those vendors, document the security expectations, and fold vendor oversight into your written program so the requirement is met and evidenced.
TRID deadlines move borrower data through your LOS fast.
The TILA-RESPA Integrated Disclosure (TRID) rule sets the pace of every file.
The Loan Estimate must be delivered or placed in the mail no later than the third business day after the creditor receives the application, and a mortgage broker that receives the application may provide it (12 CFR 1026.19(e)).
The Closing Disclosure must reach the consumer no later than three business days before consummation (12 CFR 1026.19(f)).
Those disclosures and the documents behind them move through your loan origination system (LOS), e-sign and document vendors, and email under deadline pressure, which is when a spoofed request or a misdirected file does the most damage.
That makes the LOS vendor, its integrations, and every user account on it the center of your vendor oversight and access-control work.
We fold the LOS and its connected services into your risk assessment, enforce MFA where the platform supports it, log access to borrower files, and document the security commitments you hold from each vendor.
TRID compliance itself stays with your compliance staff and counsel.
State mortgage regulators examine your security program too.
The Texas Department of Savings and Mortgage Lending (SML) requires mortgage companies and mortgage bankers to develop, implement, and maintain an information security program (7 Texas Administrative Code §56.204 and §57.204).
In October 2026, SML announced stand-alone IT and cybersecurity examinations that assess the controls required under the FTC Safeguards Rule.
SML also requires a written report of a reportable incident within 30 days after a mortgage entity becomes aware of it, and a root cause analysis within 120 days for a security event that triggers the FTC notification under 16 CFR 314.4(j) and the Texas Attorney General notification under §521.053(i).
In Tennessee, the Department of Financial Institutions Compliance Division licenses mortgage brokers, lenders, and servicers and periodically examines them for compliance with state and federal law.
We keep your written program and evidence current so they are ready for those examinations.
Texas and Tennessee breach-notification law sits alongside the rule.
Texas law applies alongside the FTC Safeguards Rule.
Under Texas Business and Commerce Code §521.053, anyone who conducts business in Texas and owns or licenses computerized data that includes sensitive personal information must notify each affected individual of a breach without unreasonable delay and not later than the 60th day after determining that the breach occurred.
If the breach involves at least 250 Texas residents, the Texas Attorney General must also be notified, through the electronic form on the Attorney General's website, as soon as practicable and not later than the 30th day after that determination.
Those deadlines run separately from the FTC notice due within 30 days of discovering a notification event, so your incident response plan should track each one.
Tennessee Code Annotated §47-18-2107 requires notice to affected Tennessee residents no later than 45 days from discovery or notification of a breach, but subsection (i) states that the section does not apply to an information holder subject to Title V of the Gramm-Leach-Bliley Act, and the Safeguards Rule implements sections of that title (16 CFR 314.1).
Confirm with counsel how the Tennessee exclusion applies to your business.
