Kansas Office of the State Bank Commissioner Guidance on Remote Work Under the Uniform Consumer Credit Code

700 S. W. Jackson Suite 300 Topeka, KS 66603-3796 Phone: (785) 380-3939 Fax: (785) 371-1229 www.osbckansas.org David L. Herndon, Bank Commissioner Laura Kelly, Governor Office of the State Bank Commissioner CML Guidance 2022-1 Kansas Uniform Consumer Credit Code (UCCC) Working Remotely May 5, 2022 The Office of the State Bank Commissioner, Consumer and Mortgage Lending Division (hereinafter “OSBC”), recognizes the ongoing business need for employees of Supervised Loan Licensees and Credit Notification Filers to work remotely. The OSBC has determined that the question of remote offices1 for work done pursuant to the UCCC remains a relevant question. Accordingly, the OSBC is establishing guidance regarding remote work. This guidance replaces CML Guidance 2021-2. Place of Business Under K.S.A. 16a-2-302(5), the Administrator is required to set by regulation whether a license is required for each place of business for a Supervised Loan Licensee or whether a master license can be obtained for all of the licensee’s places of business. The OSBC has established through K.A.R. 75-6-30(a) that a license is required for each place of business. K.A.R. 75-6-30(b) defines “place of business” as the location where an applicant or licensee regularly performs the following: making a supervised loan, making any loan for personal, family or household purpose to a consumer, or accepting payments on loans. K.S.A. 16a-2-302(7) says: A licensee may conduct the business of making loans for personal, family or household purposes only at or from any place of business for which the licensee holds a license and not under any other name than that in the license. The use of the phrase “at or from” implies that the business activity need not occur physically “at” the location but rather could be done elsewhere and considered done “from” the location. For employees or independent contractors working remotely, the official main or branch location serves as the customer-facing location where the work is done “from” and therefore as the place of business. The worker’s remote office is not the place of business from the customer’s perspective. For example, the address provided to the customer in contact information for the 1 Remote office means a location other than the principal place of business or a branch office where a company’s employee or independent contractor is authorized by such company to engage in consumer credit activity.

2 company should be the official place of business, not the remote office address. Similarly, the company's employees or independent contractors should not meet with the public at a personal residence. If a company treats any location as an official, customer-facing place of business, then such a location would require a license. Under K.S.A. 16a-2-302(6), “[n]o licensee shall change the location of any place of business without giving the administrator at least 15 days prior written notice.” Because a proper remote office is not considered a place of business, no notice must be sent to the Administrator to work remotely or to change remote offices under this statute. Fee for Business Locations K.S.A. 16a-6-203(1) requires a Credit Notification Filer to pay to the Administrator an annual fee for each business location. As discussed above, a proper remote office does not count as a place of business under the UCCC. Similarly, it does not count as a “business location” under this statute and no additional fee will be incurred. Location of Records Records must remain accessible to the Administrator regardless of any remote work. Offices and places of business must also remain accessible to the Administrator. K.S.A 16a-6-104(1)(i) requires the Administrator to have free and reasonable access to the offices, places of business and records of the Supervised Loan Licensee or Credit Notification Filer. K.S.A. 16a-2-304(1) says that records do not need to be kept in the place of business so long as the Administrator is given free access to the records wherever located. Every Supervised Loan Licensee, assignee, servicer, and Credit Notification Filer must provide the Administrator with the name, address, telephone number, contact person, and any other reasonable information regarding the location and availability of current records of a consumer credit transaction. Subsection (4) of this statute allows the records to be retained in electronic form. K.S.A. 16a-6-106(6) says if the records are located outside of Kansas, the records should either be made available to the Administrator at a convenient location within this state or the Administrator may examine them at the place where they are maintained. Management of Remote Work Supervised Loan Licensees and Credit Notification Filers are responsible and liable for the conduct of their employees and independent contractors under the UCCC, whether they work in the company’s places of business or remotely. The company should have written policies and procedures for working at a remote office and should supervise and enforce such policies and procedures.

3 Information Security Supervised Loan Licensees and Credit Notification Filers should be mindful of the OSBC best practices offered for remote workers, as security of information will always be a necessary component of remote work.2 Best practices include, but are not limited to, the following:  The company should maintain computer systems and consumer information in accordance with the company’s information technology security plan and all state and federal laws.  The company’s employees or independent contractors should take reasonable precautions to protect confidential information in accordance with state and federal laws.  Any device used to engage in consumer credit activity should have appropriate security, encryption and device management controls to ensure the security and confidentiality of consumer information. o Computers and devices that are utilized for remote work should include at-rest encryption. o Connectivity to the main office or sensitive systems should be encrypted in transit by use of a virtual private network (VPN) or similar technology.  Steps should be taken to minimize the remote use of paper records with confidential information and proper destruction/disposal of paper documents must be employed.  The company should regularly review and certify that the employees or independent contractors engaged in consumer credit activity at remote offices meet these standards. Supervised Loan Licensees and Credit Notification Filers will be responsible and liable for any breaches of security and should consult their Information Technology Department or other technology or security expert to ensure that their records are secure and safe. Conclusion Employees or independent contractors of Supervised Loan Licensees and Credit Notification Filers under the UCCC may conduct their work from a remote office. Kansas law requires that the Supervised Loan Licensee conduct business “at or from” a licensed place of business. To work “from” a place of business, it must be the official customer-facing location; the employee need not be physically “at” the location. Remote work practices should not interfere with the 2 See K.S.A. 16a-2-304(2) requiring establishment, maintenance, and enforcement of written policies and procedures regarding security of records, reasonably designed to prevent the misuse of consumer personal and financial information, and K.S.A. 16a-2-304(4)(c) requiring reasonable safeguards to protect records from loss, alteration, or destruction.

4 OSBC’s ability to access and examine records, offices, and places of business. Each company remains responsible and liable for its employees and independent contractors, whether they work in the company’s places of business or remotely, including for any breaches of information security. Aside from remote offices, places of business of a Supervised Loan Licensee should continue to hold a license, and places of business of a Credit Notification Filer should continue to be reported annually.