What a state must provide to show SAFE Act compliance

The SAFE Act relies on state systems to license and supervise mortgage loan originators, while the CFPB evaluates whether those systems meet federal requirements. Regulation H § 1008.115 sets out what a state must do when its laws change and what information it must provide when the Bureau asks for evidence of compliance.

Notify the Bureau when relevant legislation changes

When a state enacts legislation that affects its compliance with the SAFE Act, it must notify the CFPB. This is a state obligation tied to enactment of relevant legislation. Do not confuse it with the separate duty to provide supporting evidence when requested.

Provide evidence when the Bureau requests it

Upon request, the state must provide evidence showing compliance with the SAFE Act and Regulation H. The regulation lists three categories: citations to applicable state laws and regulations; descriptions of the processes used by the state's supervisory authority; and data concerning examinations, investigations and enforcement actions. The request is not satisfied by simply stating that the system is accredited or that enforcement exists.

What happens if the Bureau sees a compliance problem

If the CFPB makes an initial determination that a state is not compliant, it notifies the state and publishes a notice in the Federal Register with an opportunity for public comment of at least 30 days. The state may provide additional information. The Bureau then reviews the state response and public comments before making a final determination.

Memory aid

• New relevant state legislation: notify the Bureau.
• Bureau request: provide law citations, supervisory-process descriptions and examination, investigation and enforcement data.
• Initial noncompliance finding: notice plus a public-comment period of at least 30 days.
• Final determination follows review of additional information and comments.

Exam takeaway

A state's proof package must show both the legal framework and how supervision works in practice. Remember law, process and enforcement data as the three evidence categories.

Two state duties, two triggers

Regulation H separates notice of relevant legislation from an evidence package. When a state enacts legislation that affects its SAFE Act compliance, it must notify the Bureau. Separately, if the CFPB requests evidence, the state provides information showing how its system satisfies the federal framework. Do not treat the notification duty as satisfied merely because a state has an accredited system.

The evidence has three categories

The rule calls for citations to applicable state statutes and regulations; a description of the processes used by the state supervisory authority; and data concerning examinations, investigations, and enforcement actions. Together, these show both the written legal authority and how the regulator uses it. A statement that a state “complies” is not a substitute for the evidence the rule identifies.

Processes should be described concretely

A useful process description explains how the authority licenses MLOs, supervises licensees, conducts examinations or investigations, and responds to violations. Data help show that those powers operate in practice. The exact material requested can vary; the state should respond to the Bureau’s request rather than sending an unrelated summary.

Noncompliance process is separate

If the Bureau preliminarily determines that a state does not meet the minimum standards, Regulation H provides notice and an opportunity for the state to respond, along with public notice and comment. A final determination follows consideration of the response and comments. Do not collapse an initial concern into a final finding or assume the federal fallback begins at the preliminary stage.

Example: a new licensing statute

Suppose a legislature changes who may qualify as a state MLO and the change affects SAFE Act compliance. The state has a notice obligation tied to enactment. If the Bureau later asks how the law and supervisory process meet minimum standards, the state should cite the statute and provide process and enforcement data. These are related steps but not the same submission.

Exam checklist

Look for the trigger: enacted legislation or Bureau request. For a request, recall law citations, supervisory process, and exam/investigation/enforcement data. If the fact pattern mentions a noncompliance finding, identify whether it is preliminary or final and follow the separate process in §1008.115.

Evidence should tie authority to practice

A statute citation can show that the regulator has examination authority, but examination data help show how the authority is exercised. Similarly, a description of process should identify actual supervisory steps, not just reproduce statutory language. When a Bureau request asks for particular periods or categories, respond to those instructions and keep the source records that support the data.

Avoid substituting accreditation for the response

Accreditation may be relevant background, but Regulation H identifies evidence categories the state must provide when requested. A certificate or short summary may not supply the law citations, process descriptions, and enforcement data the Bureau asks for. Separate general accreditation status from the state’s obligation to respond to the specific request.

Additional compliance detail

Before submitting a response, the state should map each Bureau request item to its statutory citation, process owner, and supporting source data. This makes gaps visible: a written power without examination records may show authority but not implementation. Keep an index of the response package and the period each enforcement data set covers.