source:
  type: regulation
  id: safe-12cfr-1008.305
  authority: 12 CFR Part 1008 — SAFE Act Minimum State Licensing Standards for Mortgage Loan Originators (CFPB)
    § 1008.305 — Data security
  description: '12 CFR Part 1008 — SAFE Act Minimum State Licensing Standards for Mortgage Loan Originators (CFPB),
    §1008.305 Data security. Captured section-complete (all subsections verbatim).

    '
obligations:
- id: safe-12cfr-1008.305-a
  canonical_id: safe-12cfr-1008.305-a
  section: 12 CFR §1008.305(a)
  description: 'Data security — (a): (a) To the extent that CSBS, AARMR, or their successors maintain the NMLSR,
    CSBS, AARMR, and their successors, as applicable, must complete a background check on their employees, contractors,
    or other persons who have access to loan originators'' Social Security Numbers, fingerprints, or any credit
    r…'
  type: do
  tags:
  - regulator-direct
  - gap-fill
  - section-complete
  primary_source:
    tier: 1
    authority: 12 CFR Part 1008 — SAFE Act Minimum State Licensing Standards for Mortgage Loan Originators (CFPB)
      § 1008.305
    source_class: ecfr-xml
    source_url: https://www.ecfr.gov/current/title-12/chapter-X/subchapter-B/part-1008
    snapshot_id: 8be7db7ff328d57d
    fetched_at: '2026-06-18T00:00:00+00:00'
    content_hash: sha256:d145571b2b30300b8a66c87fe89c457b2c3961ee4d853c3e9b551a7eb4f181bb
    paragraph_quote: (a) To the extent that CSBS, AARMR, or their successors maintain the NMLSR, CSBS, AARMR, and
      their successors, as applicable, must complete a background check on their employees, contractors, or other
      persons who have access to loan originators' Social Security Numbers, fingerprints, or any credit reports
      collected by the system.
    drafter_attestation: Verbatim (whitespace-normalized) slice of §1008.305 subsection (a) from snapshot 8be7db7ff328d57d;
      substring-verified.
  judgment: false
- id: safe-12cfr-1008.305-b
  canonical_id: safe-12cfr-1008.305-b
  section: 12 CFR §1008.305(b)
  description: 'Data security — (b): (b) To the extent that CSBS, AARMR, or their successors maintain the NMLSR,
    CSBS, AARMR, and their successors as applicable, must keep and adhere to an appropriate information security
    and privacy policy. If the NMLSR forms a reasonable belief that a security breach has occurred, it shall notify
    aff…'
  type: do
  tags:
  - regulator-direct
  - gap-fill
  - section-complete
  primary_source:
    tier: 1
    authority: 12 CFR Part 1008 — SAFE Act Minimum State Licensing Standards for Mortgage Loan Originators (CFPB)
      § 1008.305
    source_class: ecfr-xml
    source_url: https://www.ecfr.gov/current/title-12/chapter-X/subchapter-B/part-1008
    snapshot_id: 8be7db7ff328d57d
    fetched_at: '2026-06-18T00:00:00+00:00'
    content_hash: sha256:d145571b2b30300b8a66c87fe89c457b2c3961ee4d853c3e9b551a7eb4f181bb
    paragraph_quote: (b) To the extent that CSBS, AARMR, or their successors maintain the NMLSR, CSBS, AARMR, and
      their successors as applicable, must keep and adhere to an appropriate information security and privacy policy.
      If the NMLSR forms a reasonable belief that a security breach has occurred, it shall notify affected parties,
      as soon as practicable, including the Bureau, any loan originator or registrant whose data may have been compromised,
      and the employer of the loan originator or registrant, if such employer is also licensed through the system.
    drafter_attestation: Verbatim (whitespace-normalized) slice of §1008.305 subsection (b) from snapshot 8be7db7ff328d57d;
      substring-verified.
  judgment: false
