GLBA, SAFE Act & NMLS: What Compliance Looks Like When You Outsource

Outsourcing loan processing does not outsource compliance liability. Under the GLBA Safeguards Rule, lenders and brokers remain responsible for overseeing any third party that touches borrower data, and under the SAFE Act, whether a processor needs an individual NMLS license depends on whether they're a supervised employee or an independent contractor. 

Who Is Still Liable for Compliance When You Use a Contract Processor? 

You are. The Federal Trade Commission's GLBA Safeguards Rule (16 CFR Part 314) treats mortgage brokers and lenders as covered "financial institutions" regardless of who physically processes the file. The rule requires a written information security program with nine specific elements, including a designated qualified individual, documented risk assessments, encryption, multi-factor authentication, and periodic penetration testing. Critically, it also requires institutions to oversee their service providers' handling of customer information, not just their own staff. Bringing in a contract processor adds a vendor to that oversight list; it doesn't remove your name from it. 

The stakes are real. The FTC can impose civil penalties of up to $100,000 per violation, with no cap on total exposure, and state attorneys general can bring parallel actions. A vendor's weak security program becomes the broker's regulatory problem the moment a borrower's data is compromised. 

Does a Contract Loan Processor Need Their Own NMLS License? 

It depends on employment structure, not job title. Federal SAFE Act rules (12 CFR Part 1008) define a "loan processor or underwriter" as someone performing clerical or support duties, such as collecting and organizing borrower documents, under the direction of a licensed loan originator. That definition alone doesn't grant an automatic exemption from licensing. 

The licensing requirement comes down to how the processor is employed, not what tasks they perform. A W-2 employee supervised by a licensed MLO is generally exempt from individual MLO licensing in most states. An independent contractor performing the same duties, however, is often required to hold an individual license or to work under a licensed loan processor/underwriter company.

Several states enforce this distinction explicitly. Texas requires independent contractor loan processors to be individually licensed under its SAFE Act provisions, and Washington similarly limits the unlicensed "loan processor" designation to W-2 employees, requiring MLO licensure for anyone doing the same work as a 1099 contractor. A processing company operating across multiple states has to track this variance state by state, not assume one rule covers the whole footprint. 

What Should You Ask a Contract Processor Before You Sign? 

Four questions separate a compliant partner from a liability: 

Are your processors W-2 employees or independent contractors? This determines which states require individual NMLS licensure and whether that licensing is actually in place. 

Can you produce a written information security program? Ask specifically about the nine Safeguards Rule elements, not just a general privacy policy. 

How do you handle vendor oversight of your own subcontractors or software, including any AI tools? GLBA obligations flow downstream through every layer that touches borrower data. 

Can I verify your licensing independently? NMLS Consumer Access is a free public tool where you can confirm company and individual licensing status by name or NMLS ID before signing anything. 

FAQ 

Does GLBA apply to mortgage brokers, not just banks?

Yes. The FTC's Safeguards Rule defines "financial institution" broadly enough to cover mortgage brokers and non-bank lenders, regardless of size. 

Is a contract processor automatically exempt from NMLS licensing?

No. Exemption generally depends on being a supervised W-2 employee. Independent contractor processors are frequently required to hold individual licensing, and the specific rule varies by state. 

Who is responsible if a contract processor has a data breach?

Primary liability typically stays with the lender or broker of record, since GLBA requires oversight of third-party vendors as part of the institution's own security program. 

How can I verify a processing company's licensing before signing a contract?

Search the company and any individually licensed staff on NMLS Consumer Access (nmlsconsumeraccess.org), a free public database maintained by state regulators. 

Compliance shouldn't be the fine print you find out about after the file gets flagged. See how Willow Processing structures compliance into every file →