The CFPB has proposed updates to its Privacy Act system governing the Nationwide Mortgage Licensing System and Registry (NMLS), hoping to clarify how personal data is collected, used, and shared for mortgage loan originators and financial institutions.

In a notice published in the Federal Register, the CFPB said it is modifying the CFPB.019 system of records to reflect the expanding number of users who interact with the NMLS. In addition to mortgage loan originators, the system now explicitly covers primary institutional contacts, administrative users at covered financial institutions, and authorized users from federal agencies and regulators. The Bureau said the update aligns the notice with how the registry already operates. 

The filing also clarified that NMLS data is used not only for registering loan originators, but for conducting criminal background checks and identity verification. These checks are required for individuals who access sensitive criminal history record information, a process overseen by the Department of Justice and the Federal Bureau of Investigation.

To support those functions, the CFPB formally listed the types of information collected, including Social Security numbers, fingerprints, photographs, government-issued identification, employment history, and records of disciplinary or enforcement actions. The agency emphasized that the information is collected under the authority of the SAFE Act and its implementing regulations.

The CFPB also added a routine use allowing disclosures to the National Archives and Records Administration for records-management inspections and updated retention schedules to reflect federal requirements.

The Bureau stressed that the changes do not impose new regulatory requirements on mortgage lenders or credit unions, but instead update privacy disclosures and recordkeeping practices to improve transparency and compliance.

NOT FOR REPRINT

© Arc, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.