CFPB Tweaks Mortgage Data Rules: Privacy Act's Latest Paper Shuffle
Published Date: 1/15/2026
Notice
Summary
The Consumer Financial Protection Bureau is updating the way mortgage loan originators register their info in a national system. This change affects mortgage professionals working with federal agencies and aims to keep their data accurate and secure. Comments on these updates are open until February 17, 2026, and the new rules kick in right after unless changes are needed.
Analyzed Economic Effects
5 provisions identified: 1 benefits, 3 costs, 1 mixed.
Expanded Personal Data for MLOs
If you are a mortgage loan originator (MLO) required to register in the Nationwide Mortgage Licensing System and Registry (NMLSR), the CFPB will collect additional personal information about you, including Social Security numbers, dates and places of birth, fingerprint data, criminal history record information (CHRI), 10 years of employment history, copies/photos of government IDs, and photographs. This information is collected and maintained to support background investigations and registry administration.
Identity Checks for Admin Users
If you are a user designated to perform administrative functions for a covered financial institution or an employee designated as a primary contact, the CFPB will verify your identity as required by the Department of Justice and FBI to allow access to criminal history record information (CHRI). The system will collect identity-verification data (such as name, date of birth, Social Security number, copy/photo of government ID, and photograph) for those users.
Public Access to MLO Employment History
The public may access information in the NMLSR related to MLO employment histories and publicly adjudicated disciplinary and enforcement actions in accordance with section 1507 of the S.A.F.E. Act (12 U.S.C. 5106). This makes certain employment and disciplinary records about MLOs available for public viewing.
Broader Routine Disclosure Authorities
The CFPB updated routine uses allowing disclosure of NMLSR records to a range of entities, including Federal, State, local, Tribal, and self-regulatory agencies for investigations or oversight, DOJ and courts for legal matters, institutions employing MLOs for administering registration, and the National Archives and Records Administration for records management inspections. Records also may be shared in breach-response situations with appropriate agencies and entities.
Five-Year Record Retention Rule
Records in the NMLSR will be retained for five years after an individual's or an institution's NMLSR account status becomes inactive, in accordance with CFPB Records Schedule DAA-0587-2021-0001. This retention schedule applies to records stored electronically and in paper files.
Your PRIA Score
Personalized for You
How does this regulation affect your finances?
Sign up for a PRIA Policy Scan to see your personalized alignment score for this federal register document and every other regulation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.
Key Dates
Department and Agencies
Take It Personal
Get Your Personalized Policy View
Start a Free Government Policy Watch to see how policy affects your household, then upgrade to PRIA Full Coverage for year-round monitoring.
Already have an account? Sign in