Federal Mortgage-Related Laws are 24% of the national SAFE MLO test. Most people study RESPA, TILA, and ECOA there and skim the rest. That is a mistake, because privacy and marketing laws produce some of the easiest points on the exam: they are mostly rules about notices, opt-outs, calling hours, and email content.
This guide covers the three groups the test likes: the Gramm-Leach-Bliley Act and its privacy and safeguards rules, the Do-Not-Call rules for phone marketing, and the CAN-SPAM Act for commercial email.
Why MLOs get tested on privacy and marketing
An MLO handles Social Security numbers, tax returns, bank statements, and credit reports every day. The same MLO calls, texts, and emails people to find new business. Federal law regulates both sides: what you may share about the people who apply with you, and how you may contact people who have not. Expect scenario questions where you pick whether a call, email, or disclosure is allowed.
Gramm-Leach-Bliley Act: the Privacy Rule
The Gramm-Leach-Bliley Act (GLBA), passed in 1999, requires financial institutions to tell people how they share nonpublic personal information and, in many cases, let them say no. Mortgage lenders and brokers are financial institutions for this purpose. The CFPB implements the privacy rules in Regulation P.
Nonpublic personal information (NPI) is personally identifiable financial information a consumer gives you or that you obtain in providing a financial product. Everything on a loan application counts, including income, account numbers, and Social Security numbers. Even the fact that a person applied with you or is your customer is NPI, and so is a list built from NPI.
The rule draws a line between two kinds of people:
- Consumer: an individual who obtains, or has obtained, a financial product or service for personal, family, or household purposes. Someone who applies for a mortgage with you is a consumer, even if the loan never closes.
- Customer: a consumer who has a continuing relationship with you. A borrower whose loan you made is a customer.
That distinction controls the notices:
| Notice | Who gets it | When |
|---|---|---|
| Initial privacy notice | Customers | No later than when the customer relationship is established |
| Initial privacy notice | Consumers who are not customers | Before you share their NPI with a nonaffiliated third party outside the exceptions |
| Annual privacy notice | Customers | At least once every 12 months while the relationship lasts, unless an exception applies |
| Opt-out notice | Consumers and customers | Before NPI is shared with nonaffiliated third parties outside the exceptions |
The annual notice has an exception added in 2015. An institution that shares only within the exceptions and has not changed its policies since its last notice does not have to send an annual notice.
The right to opt out
Before sharing NPI with a nonaffiliated third party, the institution must give a clear opt-out notice and a reasonable opportunity to use it. Regulation P gives 30 days after mailing the notice as an example of a reasonable opportunity. The opt-out covers nonaffiliated third parties. Sharing with affiliates is not stopped by the GLBA opt-out, though the FCRA has its own affiliate marketing rule (see the FCRA and FACTA guide).
Some sharing needs a notice but no opt-out, and some needs neither. The main exceptions are:
- Service providers and joint marketing. Sharing with a company that performs services for you, such as a printer or a marketing firm working under a contract that keeps the information confidential.
- Processing and servicing. Sharing needed to make, service, sell, or securitize the loan, such as sending the file to an appraiser, title company, or investor.
- Legal and protective reasons. Sharing with the consumer’s consent, to prevent fraud, to report to a consumer reporting agency under the FCRA, to respond to regulators or a subpoena, or to comply with other laws.
Exam tip: One thing is flatly prohibited. A financial institution may not give an account number or access code for a credit card, deposit, or transaction account to a nonaffiliated third party for marketing, even if the consumer did not opt out.
The Safeguards Rule and pretexting
The privacy rule is about sharing. The Safeguards Rule is about protecting. For nonbank mortgage lenders and brokers, the Federal Trade Commission enforces it. The FTC’s rule requires a written information security program that includes:
- A qualified individual designated to oversee and enforce the program
- A written risk assessment of threats to customer information
- Safeguards built from that assessment, such as access controls, encryption, and multi-factor authentication
- Staff training, and oversight of service providers that handle customer information
- Regular testing, and updates when the business or risks change
Under an amendment effective in 2024, a covered institution must notify the FTC within 30 days of discovering a security event involving unencrypted information of at least 500 consumers.
GLBA also bans pretexting: getting someone’s financial information from an institution by false pretenses, such as calling a bank and pretending to be the account holder. For an MLO, that means you verify information through the borrower and authorized channels, never by impersonating anyone.
Do-Not-Call: the Telemarketing Sales Rule and the TCPA
Phone marketing is governed by two overlapping rules: the FTC’s Telemarketing Sales Rule (TSR) and the FCC’s rules under the Telephone Consumer Protection Act (TCPA). Together they created the National Do Not Call Registry. The core numbers the exam tests:
- Scrub every 31 days. Telemarketers must check their call lists against the National Registry at least once every 31 days.
- Calling hours. Telemarketing calls are allowed only between 8 a.m. and 9 p.m., local time at the called person’s location.
- Caller ID. Telemarketers must transmit their telephone number and, when available, their name.
- Company-specific requests. If someone asks your company not to call again, you must put them on your internal do-not-call list and stop, even if you have a business relationship with them and even if they are not on the National Registry.
- Abandoned calls. Under the TSR, no more than 3% of answered calls in a campaign over a 30-day period may be abandoned. The phone must ring for at least 15 seconds or four rings, and when no live agent is available, a recorded message identifying the seller must play within two seconds of the greeting.
The established business relationship exception
You may call a number on the National Registry if you have an established business relationship (EBR) with the person:
| What happened | How long you may call |
|---|---|
| The consumer bought, leased, or transacted with you | 18 months after the last purchase, transaction, or payment |
| The consumer made an inquiry or submitted an application | 3 months after the inquiry or application |
| The consumer gave express written permission | Until they revoke it |
An EBR never overrides a company-specific do-not-call request. Once a person says “stop calling me,” the EBR no longer lets you call them for marketing.
Autodialers, recorded messages, texts, and faxes
The TCPA adds consent rules. Calls or texts to a cell phone made with an autodialer or a prerecorded voice need the person’s prior express consent. If the message is telemarketing, the consent must be prior express written consent. Prerecorded telemarketing calls to a home line also need prior express written consent. Under the Junk Fax Prevention Act, an unsolicited fax ad is allowed only with an established business relationship, a fax number the recipient provided voluntarily, and an opt-out notice on the first page.
Exam tip: Buying a lead list does not create a business relationship with the people on it. The EBR belongs to the company the consumer actually dealt with, so purchased leads still have to be scrubbed against the Registry before you call.
CAN-SPAM: commercial email
The CAN-SPAM Act of 2003, enforced by the FTC, does not require consent before sending commercial email. It sets rules for what the email must contain and how fast you must stop:
- No false or misleading header information. The from line and routing must identify who sent it.
- No deceptive subject lines.
- Clearly identify the message as an advertisement, unless the recipient gave prior affirmative consent.
- Include a valid physical postal address for the sender.
- Give a clear way to opt out of future email.
- Honor opt-out requests within 10 business days. The opt-out mechanism must keep working for at least 30 days after the email is sent.
- Do not charge a fee to opt out, require any information beyond an email address, or sell or transfer the address of someone who opted out.
Transactional or relationship messages, such as a rate lock confirmation or a closing reminder to a current borrower, are mostly exempt from these requirements but still may not contain false routing information. If you hire a vendor to send marketing email, both your company and the vendor can be held responsible for violations.
Common exam traps
- Applicant versus borrower: an applicant whose loan never closed is a consumer, not a customer, so they get a privacy notice only if you plan to share their NPI outside the exceptions.
- Affiliates versus third parties: the GLBA opt-out covers nonaffiliated third parties, not affiliates.
- Calling hours are the consumer’s: 8 a.m. to 9 p.m. in the called person’s time zone, not yours.
- Stop means stop: a company-specific do-not-call request beats an established business relationship.
- CAN-SPAM is opt-out, not opt-in: commercial email is legal without prior consent if it follows the content rules and honors opt-outs within 10 business days.
Four practice questions
1. A consumer applied for a refinance with an MLO four months ago and never closed. The consumer is on the National Do Not Call Registry. May the MLO make a telemarketing call to offer a new rate?
Answer: No. An inquiry or application creates an established business relationship for only 3 months. At four months the exception has expired.
2. A mortgage company sends a commercial email and receives an unsubscribe request. Within how many business days must the request be honored?
Answer: 10 business days. CAN-SPAM also requires the opt-out mechanism to work for at least 30 days after the email is sent.
3. A lender wants to share borrowers’ NPI with an unaffiliated insurance agency that will market homeowners policies to them. The sharing is not under any exception. What must the lender do first?
Answer: Give the borrowers a privacy notice and an opt-out notice, with a reasonable opportunity to opt out. The lender still may not share account numbers with the agency for marketing.
4. A borrower closed a purchase loan with a lender eight months ago and has made every payment. The borrower is on the National Registry but has never asked the lender to stop calling. Which statement is correct? (A) The lender may never call because the number is on the Registry. (B) The lender may call between 8 a.m. and 9 p.m. the borrower’s local time. (C) The lender may call at any time because of the business relationship. (D) The lender must get written consent before every call.
Answer: B. The loan closed eight months ago, well inside the 18-month established business relationship window, so the Registry does not block the call. Calling-hour limits still apply.
Practice this on MLO Pass
Privacy and marketing questions reward knowing a handful of exact numbers: 31 days, 8 a.m. to 9 p.m., 18 months and 3 months, and 10 business days. A one-time $99 unlock of MLO Pass gives you about 1,154 questions across all five domains: Mortgage Loan Origination Activities 27%, Federal Mortgage-Related Laws 24%, General Mortgage Knowledge 20%, Ethics 18%, and Uniform State Content 11%. Pay once and keep it for life, with no subscription. Sign up to pass your test
Related study guides
- FCRA and FACTA: Credit Reports on the SAFE Exam
- The SAFE Act: MLO Licensing Rules for the NMLS Exam
- BSA/AML and SARs: Anti-Money Laundering on the SAFE Exam
Studying with other people taking the SAFE exam? Join the NMLS Test Prep community.