SAFE ACT

GENERAL OVERVIEW

The Bureau’s SAFE Act rule requires an individual who acts as a residential MLO and is 

employed by a covered entity that is regulated by one of the FFIEC member agencies or the Farm 

Credit Administration to register with the Nationwide Mortgage Licensing System and Registry 

(Registry) and to obtain a unique identifier.1 Regarding entities supervised by the Federal 

Reserve, the SAFE Act rule applies to state member banks and their respective subsidiaries that

are not functionally regulated within the meaning of section 5(c)(5) of the Bank Holding

Company Act, as amended (see 12 USC 1844); branches and agencies of foreign banks (other 

than federal branches, federal agencies, and insured state branches of foreign banks); and

commercial lending companies owned or controlled by foreign banks; and their employees who

act as MLOs.

Covered entities are required to provide certain institution-specific information to the 

Registry to enable their individual MLO employees to complete their registrations. MLOs 

themselves must provide additional information, including: (a) the MLO’s fingerprints for 

submission to the Federal Bureau of Investigation to perform a national criminal background 

check; and (b) information on the MLO’s employment history as well as information related to 

any relevant criminal, civil, administrative, or arbitration actions. Selected MLO personal 

information and identifying institution information is made available to consumers using the 

Registry’s public website.

Additionally, covered entities must also make the unique identifiers of their registered 

MLOs available to consumers in a manner and method practicable for the institution. Likewise, 

to make sure that consumers have access to an MLO’s unique identifier before committing to a 

mortgage loan transaction, an MLO must provide the unique identifier upon request, before 

acting as an MLO, and in any initial written communication from the MLO to the consumer.

 

The SAFE Act rule requires covered entities to adopt written policies and procedures to 

ensure that their MLO employees are registered and that their registration information, as 

reflected in the institution’s records, is accurate. These policies and procedures should be

appropriate to the nature, size, complexity, and scope of residential mortgage lending activities of

each institution. Consistent with the policies and procedures required by the rule, covered 

entities should provide guidance and assistance to their MLOs regarding the applicability and 

requirements of the rule and should instruct their MLOs to direct any inquiries about the rule to 

appropriate institution staff. Additionally, the policies and procedures should address taking 

appropriate action, consistent with applicable federal law, including section 19 of the Federal 

 1 Under the SAFE Act, an individual is generally prohibited from engaging in the business of mortgage loan 

origination without first obtaining and maintaining a unique identifier and either a license and registration as a statelicensed MLO or a registration as a federally registered MLO. The SAFE Act rule generally excepts from 

registration requirements employees who engage in a de minimis level of mortgage loan origination activity. In 

particular, the rule does not apply to an employee of a covered entity who has never been registered through the 

Registry if, during the preceding 12 months, the employee acted as an MLO for five or fewer residential loans. 

Pursuant to the Dodd-Frank Act, the Bureau has responsibility for developing and maintaining the federal registration

system and supervisory and enforcement authority for SAFE Act compliance for entities under the Bureau’s 

jurisdiction. See Dodd-Frank Act sections 1025, 1061, and 1100.
Deposit Insurance Act (12 U.S.C. Section 1829), and implementing regulations with respect to 

the results of an MLO’s criminal background check from the Registry.

Furthermore, the SAFE Act rule requires covered entities to conduct testing to review 

compliance with the rule. Institutions are required to independently test for compliance with the

regulation at least annually. Such independent compliance activities may be conducted by an 

institution’s internal audit function, compliance (or similar function), or an outside party.