What a state must provide the Bureau about SAFE Act enforcement

SAFE Act compliance is evaluated at both the individual-license and state-system levels. Regulation H gives the Bureau a process to assess whether a state has an adequate licensing and registration system. Section 1008.115 specifies information the state must provide when the Bureau requests evidence of compliance.

Three evidence categories

• Applicable state statutes and regulations, with citations.
• Descriptions of the processes used by the state supervisory authority.
• Data concerning examinations, investigations and enforcement actions.

State legislation triggers notice

When a state enacts legislation that affects its compliance with the SAFE Act, the rule requires the state to notify the Bureau. That notice obligation is distinct from the broader obligation to provide supporting evidence when the Bureau requests it.

What happens if the Bureau finds a possible gap

If the Bureau makes an initial determination of noncompliance, it notifies the state and publishes a Federal Register notice describing the initial determination and providing a public-comment period of at least 30 days. The Bureau reviews the state's additional information and public comments before making a final determination under the rule.

Exam distinction

The question asks what the state provides to demonstrate that its system meets federal minimums. It is not asking which details appear on a consumer-facing NMLS search. Keep the audience and purpose clear: state supervisory authority to Bureau, in a SAFE Act compliance review.

Practical application and common errors

Section 1008.115(a) creates two distinct state duties. When a state enacts legislation affecting its SAFE Act compliance, it must notify the CFPB. Separately, upon the Bureau’s request, the state must provide evidence that it complies with the SAFE Act and Regulation H. The evidence may include citations to relevant state statutes and regulations, descriptions of supervisory processes, and data about examinations, investigations, and enforcement actions.

This is a state-system review. It is not an individual MLO’s annual report, a mortgage company’s routine filing, or a borrower disclosure. The purpose is to allow the Bureau to evaluate whether the state has a compliant licensing and supervision system. The state supervisory authority, rather than each licensee, is responsible for assembling and submitting the requested evidence.

A state may use examination results, complaint handling records, disciplinary decisions, investigation procedures, and licensing-system data to demonstrate how its requirements operate in practice. A citation to a statute alone may not show how supervision works; the rule calls for descriptions of processes and enforcement data as well. The request’s scope and the evidence needed depend on the Bureau’s inquiry.

If the Bureau initially determines that a state is not in compliance, subsection (b) calls for notice to the state and publication in the Federal Register, with a public-comment period of at least 30 days. An initial determination is not the same as a final finding. The process gives the state and interested members of the public a chance to respond before the process advances.

The state may submit corrective information, explain its laws and procedures, or address the Bureau’s concerns during the review. A state’s notification that it enacted a relevant law does not itself mean the state is noncompliant; it is the required trigger for informing the Bureau. Likewise, a request for evidence is not by itself a finding that the system has failed.

For compliance staff, keep the state’s source materials current and traceable: law citations, rule versions, examination protocols, enforcement records, and implementation dates. Separate data by type and period so it can answer the Bureau’s request. Do not include personal or confidential material beyond what is legally required; apply the state’s confidentiality and records rules.

For exam purposes, remember who acts and what is provided: the state notifies the CFPB after relevant legislation, supplies compliance evidence on request, and an initial noncompliance determination is published for public comment. Do not confuse this process with NMLS individual licensing, federal registration of bank MLOs, or a state disciplinary order against one originator.

Workflow checks and scenario

A state’s response should be organized around the specific SAFE Act requirement under review. Map each legal citation to the implementing process, responsible unit, records maintained, and evidence that the process operates. If the Bureau asks about examinations, for example, a state can explain risk selection, examination steps, findings, corrective action, and enforcement data. The state should distinguish a lack of enforcement actions from a lack of supervision; supporting process evidence may explain why.

Treat requested data under applicable privacy, confidentiality, retention, and public-records laws. Share through the authorized state channel, verify accuracy, and retain a copy of the submission and source data. A regulator’s request does not automatically make every underlying record public. The Federal Register comment period after an initial determination is a separate public process; it is not the same as the state’s confidential production of all supervisory files.

The state should assign an accountable contact for the response, maintain a request log, confirm deadlines, and identify who approved each data set. If examination and enforcement data use different definitions or periods, disclose those limits so the Bureau can interpret the response. A concise crosswalk from each requested item to its supporting source improves accuracy and reduces unnecessary disclosure. The individual MLO’s role is simply to comply with state requirements; the submission obligation belongs to the state authority.

A complete state submission should explain not only what laws exist, but how the regulator determines whether licensees follow them and what happens after a violation. Use current process documents, anonymized examples where appropriate, and clearly defined reporting periods. If the state has no recent enforcement cases, explain the relevant complaint and examination activity without implying that absence of penalties proves compliance. The CFPB evaluates the state system; this does not replace individual accountability under state licensing rules.

Key takeaway

On request, a state supplies legal citations, supervisory-process descriptions and examination, investigation and enforcement data. Section 1008.115 is about evidence for Bureau oversight of state compliance.