CALIFORNIA LENDER LICENSING COMPLIANCE OUTLINE
CALIFORNIA LENDER LICENSING COMPLIANCE OUTLINE
For the PHOCIS Tech AI Compliance Bot — v1 (Mortgage-Focused)
Prepared: April 22, 2026
Status: Internal working draft. NOT LEGAL ADVICE. Review by California-licensed counsel required before operationalizing the bot or shipping the state-lookup dropdown on phocistech.com.
================================================================
0. PURPOSE AND SCOPE
0.1 Purpose
This document defines the legal requirements the PHOCIS compliance bot must reason over to determine whether a given lender may lawfully originate, broker, or service residential mortgage loans with California consumers, and to define the PHOCIS shielding controls that insulate banking partners from compliance exposure.
0.2 Scope — v1
Licenses covered: (a) California DRE Real Estate Broker with MLO endorsement; (b) California CRMLA Residential Mortgage Lender / Servicer (DFPI-regulated); (c) NMLS MLO individual registration (state-licensed and federal-registered tracks).
Products covered: Closed-end residential mortgage loans on 1–4 unit property (purchase, rate/term refi, cash-out refi), HELOCs.
Excluded from v1: CFL non-mortgage consumer lending, CDDTL (deferred deposit/payday), commercial-purpose lending, any non-California state.
Geographic trigger: Lender earning on a California consumer, or loan secured by California real property, or originator physically located in California.
0.3 Bot decision output (per query)
(a) ELIGIBLE / NOT ELIGIBLE / NEEDS REVIEW
(b) Authorized activity scope
(c) PHOCIS shielding controls required for this transaction
(d) Disclosure and reporting obligations triggered
(e) Expiry-based re-check schedule
================================================================
DRE — CALIFORNIA REAL ESTATE BROKER LICENSE WITH MLO ENDORSEMENT
================================================================
Regulator: California Department of Real Estate (DRE)
Statutory base: Business & Professions Code §§10000 et seq.; California Real Estate Law; SAFE Act (federal) for the MLO endorsement.
Primary use case: Real estate brokers who also negotiate residential mortgage loans for borrowers.
1.1 Licensing prerequisites
Entity form: Individual broker, broker corporation (with designated officer-broker), or broker LLC.
Education (individual): Eight statutorily specified college-level real-estate courses, OR a four-year degree with a real-estate major.
Experience (individual): Minimum two years' full-time licensed salesperson experience within the past five years, OR statutorily equivalent experience.
Exam: DRE broker examination — passing score 75%.
Background: Fingerprint submission via Live Scan; no disqualifying history under B&P §10177.
Fees: Current DRE exam and license fees (verify annually — DRE updates).
MLO endorsement (required if the broker originates residential mortgage loans on 1–4 unit property for compensation): NMLS registration, 20 hours SAFE pre-licensing education, pass the SAFE National Exam with Uniform State Test, annual NMLS renewal, 8 hours continuing education annually.
1.2 Scope of authorized activity
Negotiate real estate purchase/sale.
Negotiate mortgage loans secured by real property (residential and non-residential).
Act as principal mortgage lender in limited circumstances under B&P §10131 / §10131.1.
With MLO endorsement: originate residential mortgage loans covered by the SAFE Act.
NOT authorized under DRE alone: operating at CRMLA scale as a residential mortgage lender; residential mortgage servicing beyond broker-permitted activity.
1.3 Bond, trust account, and net worth
Broker trust fund account required for client funds (B&P §10145); monthly reconciliation; commingling prohibited.
No statutory net-worth minimum for the broker license itself.
MLO endorsement requires a surety bond sized to origination volume — tiered under current CA regulation. (Verify current tier schedule before shipping.)
DRE may impose additional bonding for specific activities.
1.4 Disclosure obligations
Mortgage Loan Disclosure Statement (MLDS; RE 882 / RE 883 as applicable) — timing: within three business days of receipt of a written loan application.
Agency disclosure (real-estate brokerage relationship) where applicable.
Federal overlay (see §4): TRID Loan Estimate within 3 business days of application; Closing Disclosure at least 3 business days before consummation; TILA/RESPA/ECOA.
California-specific: Per Diem interest disclosure; Holden Act anti-discrimination notice; Homeowner Bill of Rights notices in any servicing capacity.
1.5 Advertising rules
B&P §10140, §10140.6, §10235.5: broker must include license number in all advertising; NMLS ID must appear in any MLO advertising; no false or misleading claims; restrictions on the use of "lender," "banker," "guaranteed approval"; specific rules for internet and electronic advertising.
Endorsement-specific ad rules under SAFE Act and Reg Z.
1.6 Recordkeeping and reporting
Trust account records: minimum three years (B&P §10148).
Transaction files: minimum three years.
MLO Call Reports filed via NMLS (quarterly and annual composite).
Audited trust fund reports when DRE thresholds are triggered.
1.7 Prohibited practices
Misrepresentation to borrower or lender (B&P §10176).
Undisclosed dual agency.
Commingling trust funds.
Kickbacks and unearned fees (parallel to RESPA §8).
Covered-loan violations under Fin. Code Division 1.6 (§4970 et seq.) if applicable.
Loan flipping and steering.
1.8 Enforcement triggers — the bot MUST flag
License status not active (expired, suspended, revoked, surrendered) on DRE public lookup.
MLO endorsement not current on NMLS Consumer Access.
Restricted license conditions.
Disciplinary actions in the past five years.
Outstanding DRE audit findings.
1.9 Renewal cadence
DRE broker license: 4-year term.
MLO endorsement: annual (calendar year) via NMLS.
Continuing ed: 45 hours every 4 years for broker; 8 hours annually for MLO endorsement.
1.10 PHOCIS shielding controls — DRE-licensed partners
[PLACEHOLDER — populate from banking-partner intake notes]
Expected control categories:
Real-time DRE license status check at application and pre-funding.
NMLS Consumer Access MLO status check per originator per loan.
Trust-fund segregation verification.
MLDS delivery timestamping.
Advertising copy pre-clearance log.
Immutable audit trail retained ≥3 years (recommend 7 to align with federal retention).
================================================================
2. CRMLA — CALIFORNIA RESIDENTIAL MORTGAGE LENDING ACT
Regulator: California Department of Financial Protection and Innovation (DFPI)
Statutory base: Financial Code §§50000 et seq.; 10 CCR §1950 et seq.
Primary use case: Entities that lend or service residential mortgage loans and hold agency approval (Fannie Mae / Freddie Mac / Ginnie Mae / HUD / VA / Farmer Mac), or operate within that ecosystem.
2.1 Two license tracks
CRMLA Lender — originates and funds residential mortgage loans.
CRMLA Servicer — collects payments, handles escrow, manages default for residential mortgage loans.
An entity may hold either or both.
2.2 Licensing prerequisites
Entity required: Corporation, LLC, or partnership. There is NO individual CRMLA license — individuals operate either under a CRMLA licensee or under DRE-broker + MLO endorsement.
Prerequisite agency approval: Fin. Code §50002 requires approval as a lender/servicer by Fannie Mae, Freddie Mac, Ginnie Mae, HUD, VA, or Farmer Mac. This is a hard gate — no agency approval, no CRMLA.
Net worth: Minimum $250,000 for a CRMLA lender (verify current amount; DFPI has revisited this floor). Servicer-track and larger-portfolio thresholds are higher — confirm against current DFPI rulebook before shipping.
Bonding: Surety bond starting at $50,000, scaled with origination/servicing volume.
Errors & omissions and fidelity bond coverage at DFPI-specified minimums.
NMLS registration of the entity plus every covered employee originator.
Fingerprints for all control persons; no disqualifying history.
Application attachments: business plan, audited or reviewed financials, org chart, written policies and procedures, written AML program.
2.3 Scope of authorized activity
Make, broker, or purchase residential mortgage loans secured by 1–4 unit residential property.
Service such loans (servicer endorsement).
NOT authorized under CRMLA: commercial-purpose loans, non-residential collateral — separate licensure required.
2.4 Disclosures
All federal TRID / TILA / RESPA / ECOA / FCRA disclosures apply.
California-specific: Per Diem interest limits (Fin. Code §50204 and related); MLDS may be required depending on loan structure; Homeowner Bill of Rights notices in servicing; CCPA/CPRA "notice at collection."
MLO-level disclosures delivered through endorsed MLOs.
2.5 Reporting
Mortgage Call Reports (MCR) quarterly via NMLS.
Annual audited financial statements to DFPI.
Annual report of originations, loans serviced, and delinquencies.
HMDA reporting under federal Reg C when thresholds are met.
Notice to DFPI of material changes: control-person change, address change, bond lapse, net-worth dip, adverse regulatory action, loss of agency approval.
2.6 AML / BSA
CRMLA lenders are "loan or finance companies" under FinCEN rules: written AML program, Customer Identification Program (CIP), SAR/CTR filings, independent testing, annual training, designated BSA officer.
OFAC screening at application and pre-funding.
Written suspicious activity escalation protocol.
2.7 Advertising rules
Fin. Code §§50204, 50205 and DFPI commentary: license name and number in advertising; NMLS ID on all MLO ads; no misleading rate or APR claims; Reg N (Mortgage Acts and Practices) compliance; prohibition on misleading government-sponsorship language.
2.8 Prohibited practices and consumer protections
High-cost covered loan rules (Fin. Code Division 1.6, §4970 et seq.): points/fees caps, ATR, prepayment-penalty limits, counseling.
Federal Ability-to-Repay (Reg Z §1026.43).
No loan flipping, equity stripping, or prohibited negative amortization.
Holden Act (Fin. Code §35800): anti-redlining.
Rosenthal FDCPA + federal FDCPA (servicing).
California Homeowner Bill of Rights: pre-NOD contact, single point of contact, no dual-tracking, denial notices with appeal rights, timing rules for post-sale processes.
2.9 Enforcement triggers — the bot MUST flag
DFPI license status: not active, suspended, revoked, surrendered, or under conditional order.
Net worth below floor (visible on quarterly MCR).
Bond lapsed or reduced below required amount.
Loss of agency approval (Fannie/Freddie/Ginnie/HUD/VA) — this disqualifies CRMLA eligibility.
Outstanding DFPI enforcement order.
CFPB parallel action against the entity.
Missing or late MCR filings.
2.10 Renewal cadence
CRMLA license: annual renewal via NMLS (calendar year).
Surety bond: annual or continuous instrument.
Audited financials: annual, within 90 days of fiscal year end (or per current DFPI schedule).
2.11 PHOCIS shielding controls — CRMLA-licensed partners
[PLACEHOLDER — populate from banking-partner intake notes]
Expected control categories:
Real-time DFPI / NMLS Consumer Access license status check.
Agency approval verification (GSE / HUD / VA lookup).
Net-worth and bond currency tracking vs. DFPI floor.
AML program attestation on file plus transaction-monitoring integration.
Per-loan ATR determination logged.
Servicing-side HBOR control attestations.
MCR filing-status monitor.
CCPA/CPRA data-handling attestation.
================================================================
3. NMLS MLO INDIVIDUAL REGISTRATION (SAFE ACT)
Regulator (state-licensed track): DRE or DFPI, depending on the sponsoring company's license.
Regulator (federal-registered track): Prudential federal banking regulators (OCC, FDIC, FRB, NCUA, FCA).
Statutory base: S.A.F.E. Mortgage Licensing Act, 12 U.S.C. §§5101 et seq.; California SAFE implementation in Fin. Code §50140 et seq. (DFPI side) and B&P §10166.01 et seq. (DRE side).
Primary use case: Any natural person who, for compensation or gain, takes a residential mortgage loan application OR offers or negotiates terms of such a loan.
3.1 Two tracks
State-licensed MLO: employed by a non-depository (CRMLA licensee or DRE broker with MLO endorsement). Full state licensure plus annual renewal.
Federal-registered MLO: employed by a federally insured depository institution or its owned/controlled subsidiary. NMLS registration only — no state license — but must still carry a unique NMLS ID.
3.2 Licensing prerequisites (state-licensed track)
Age: 18+.
Education: 20 hours of SAFE pre-licensing education (standard current composition — verify against current NMLS requirement).
Exam: SAFE MLO National Exam including the Uniform State Test — passing score 75%.
Background: FBI criminal history check via Live Scan. Statutory bar on felonies within the past seven years, and a permanent bar on felonies ever involving fraud, dishonesty, breach of trust, or money laundering.
Credit: Financial responsibility review; recent bankruptcies, repeated delinquencies, tax liens, or judgments may be disqualifying (case-by-case under SAFE).
Sponsorship: Must be sponsored by a CRMLA licensee or a DRE broker with MLO endorsement; NMLS record must show an active sponsorship link.
Surety bond: Covered under the sponsoring company's bond.
3.3 Continuing ed and renewal
8 hours of continuing education annually (current composition per NMLS — verify).
Annual renewal window via NMLS (historically November 1 – December 31).
Lapse means re-qualification.
3.4 Scope of authorized activity
Take a residential mortgage loan application.
Offer or negotiate terms of a residential mortgage loan.
Must be tied to one sponsoring company at a time (dual employment generally prohibited without explicit dual-sponsorship on NMLS).
3.5 Disclosures
NMLS ID on all advertisements, business cards, solicitations, and loan documents the MLO signs.
All loan-level disclosures delivered on behalf of the sponsoring entity.
3.6 Prohibited practices
Originating without an active sponsorship link.
Steering to higher-cost products.
Compensation tied to loan terms (Reg Z §1026.36(d) — loan-originator compensation rule).
Misrepresentation on application, income, appraisal.
3.7 Enforcement triggers — the bot MUST flag
NMLS status not "Licensed — Active." Pending, Surrendered, Revoked, Suspended, Terminated, or Expired all block origination.
No active sponsorship link in NMLS.
Continuing-education deficiency.
Credit or background trigger since last renewal.
3.8 PHOCIS shielding controls — MLO layer
[PLACEHOLDER — populate from banking-partner intake notes]
Expected control categories:
Per-originator NMLS Consumer Access status pull at application intake AND pre-funding.
Sponsorship-link verification between MLO NMLS record and lender NMLS record.
LO-comp policy ingestion and audit.
Disclosure signature timestamping.
CE and renewal expiry alerting.
================================================================
4. FEDERAL OVERLAY (applies across all three licenses)
4.1 Consumer disclosure and fair-lending statutes
TILA (15 U.S.C. §1601) + Reg Z — APR, finance charge, ATR, LO compensation, HELOC rules.
RESPA (12 U.S.C. §2601) + Reg X — escrow, servicing transfer, §8 anti-kickback, mortgage servicing rules.
TRID — Loan Estimate within 3 business days of application; Closing Disclosure at least 3 business days before consummation.
ECOA + Reg B — adverse-action notice; non-discrimination; protected classes.
FCRA — permissible purpose; risk-based pricing notice; adverse-action notice.
GLBA + Reg P — privacy notice; safeguards rule.
Fair Housing Act — residential-lending protected classes.
HMDA + Reg C — loan/application register if thresholds are met.
4.2 Anti-money laundering
BSA / FinCEN rule for Residential Mortgage Lenders and Originators — written AML program, SAR filings, CIP.
OFAC sanctions screening.
4.3 Consumer-protection umbrella
CFPB Dodd-Frank §§1031, 1036 — unfair, deceptive, or abusive acts or practices (UDAAP).
4.4 Servicemember protections
SCRA — interest-rate cap at 6% on pre-service obligations; foreclosure protections for active-duty servicemembers.
MLA — generally narrower for closed-end residential mortgages but can intersect with certain home-equity products.
================================================================
5. CALIFORNIA-SPECIFIC CROSS-CUTTING OVERLAY
5.1 Privacy
CCPA/CPRA — notice at collection; consumer rights (access, delete, correct, opt-out of sale/share). GLBA-data exemption is narrow, not categorical — intake data outside GLBA scope still falls under CCPA.
California SB-1001 chatbot-disclosure law — applies if the PHOCIS bot interacts with consumers directly to induce a transaction.
5.2 Fair lending / anti-discrimination
Holden Act, Fin. Code §35800 — neighborhood-level anti-redlining for real-property loans.
Unruh Civil Rights Act.
California Fair Employment and Housing Act — housing-related discrimination.
5.3 Servicing and default
California Homeowner Bill of Rights (HBOR): single point of contact; prohibition on dual-tracking; denial letters with appeal rights; 30-day pre-NOD contact; post-sale timing rules.
Per Diem Interest (Fin. Code §50204): prohibition on charging interest for more than one day prior to disbursement.
5.4 Debt collection
Rosenthal Fair Debt Collection Practices Act — applies to first-party and third-party collection, overlays federal FDCPA.
California Consumer Financial Protection Law (CCFPL) — DFPI's UDAAP authority, applies broadly to covered persons and service providers.
5.5 High-cost and covered loans
Fin. Code Division 1.6, §4970 et seq. — covered-loan thresholds; points and fees caps; prepayment-penalty limits; ATR; counseling requirement.
================================================================
6. PHOCIS TECH SHIELDING FRAMEWORK — INGESTION PLACEHOLDERS
Status: Structure only. Specific controls, mappings, SLAs, and attestations to be populated from the banking-partner intake notes Nate will provide.
6.1 Per-partner intake (PHOCIS captures at onboarding)
License(s) held: DRE broker #, CRMLA lender #, CRMLA servicer #, NMLS entity ID.
Agency approvals: FNMA, FHLMC, GNMA, HUD, VA, Farmer Mac seller/servicer IDs.
Bond and insurance documentation plus expiry.
Net-worth attestation plus supporting financial statements.
State footprint (CA only for v1; multi-state in later scope).
Product catalog (loan types, collateral types, occupancy types).
AML program documentation and BSA officer contact.
LO-compensation plan.
Advertising templates (pre-cleared).
Servicing portfolio plus HBOR control attestations (if servicer).
MCR filing history (last 8 quarters).
Enforcement history (last 5 years across regulators).
6.2 Ongoing shielding controls (skeleton)
[TO BE POPULATED from partner-note data the user will provide]
Pre-application gate: state-licensed? active? scope match?
Application gate: MLO sponsored and active? disclosures queued?
Pre-funding gate: disclosures delivered on schedule? ATR logged? HBOR check for refis? OFAC cleared?
Post-funding: servicing handoff attestation; HMDA capture; call-report inputs; audit trail frozen.
Continuous monitoring: license renewal alerts; bond expiry alerts; enforcement docket watch; credit/background re-check triggers; MCR deadline tracker.
6.3 Banking-partner evidence package
[PLACEHOLDER]
PHOCIS produces, per loan and per partner, a timestamped evidence artifact demonstrating: licensed lender, active MLO, disclosures delivered on schedule, ATR determination documented, OFAC clean, no HBOR conflict. Retained ≥7 years.
================================================================
7. BOT DECISION LOGIC — v1 SKETCH
Inputs per query:
Lender legal name and NMLS entity ID.
Originator NMLS individual ID.
Product (purchase / rate-term refi / cash-out refi / HELOC).
Collateral (owner-occupied 1–4, investor 1–4, other).
State of property and of consumer (v1: CA only).
Loan amount, APR, points and fees (high-cost trigger check).
Decision tree (abbreviated):
Step 1 — State gate: State = CA? If no → out of v1 scope.
Step 2 — License gate:
2a. CRMLA-licensed entity? → allowed to lend/broker/service residential mortgages in CA.
2b. DRE broker with active MLO endorsement? → allowed to broker; not allowed to operate at CRMLA lender scale.
2c. Neither → NOT ELIGIBLE.
Step 3 — MLO gate: Originator NMLS status = "Licensed — Active" with sponsorship linked to the lender in Step 2? If no → NOT ELIGIBLE.
Step 4 — Agency gate (CRMLA only): Agency approval current (FNMA/FHLMC/GNMA/HUD/VA)? If no → NOT ELIGIBLE.
Step 5 — Bond/net-worth gate: Current per DFPI floor? If no → NEEDS REVIEW.
Step 6 — Product gate: Product within license scope? If not → out of v1 scope.
Step 7 — High-cost trigger: Covered loan under Fin. Code Division 1.6? If yes → attach high-cost control set.
Step 8 — PHOCIS controls: Attach the control set from §6 keyed to license type and product.
Step 9 — Output: ELIGIBLE / NEEDS REVIEW / NOT ELIGIBLE + rationale + attached control set + re-check schedule.
================================================================
8. WEBSITE DROPDOWN — v1 STRUCTURE
State selector: California (only state active at v1 launch; dropdown pre-built for expansion).
User-facing filters (within California):
Product: Purchase mortgage / Refinance / Cash-out refi / HELOC.
Lender license type: DRE Broker / CRMLA Lender / CRMLA Servicer.
Originator status: (hidden — auto-queried via NMLS Consumer Access).
Result card per lender:
Lender name, NMLS entity ID, license-type badges.
Eligibility status (ELIGIBLE / NEEDS REVIEW / NOT ELIGIBLE).
Authorized products.
PHOCIS shielding level / evidence-package availability.
Last verified timestamp.
Consumer disclaimer linking to §9.2 below.
================================================================
9. LEGAL DISCLAIMERS AND OPERATIONAL NOTES
9.1 This document is an internal working outline drafted for PHOCIS Tech to guide development of the AI compliance bot and the state-lookup feature on phocistech.com. It is not legal advice. California mortgage law, DFPI regulation, DRE regulation, and the federal overlays change frequently. Every citation and requirement must be verified against current statute, regulation, and regulator guidance by California-licensed counsel before the bot or the website dropdown is operationalized or presented to consumers or banking partners as authoritative.
9.2 The bot must carry a consumer-facing disclaimer that its output is informational and does not constitute legal advice or a regulatory determination. If the bot interacts with consumers directly in California, SB-1001 chatbot disclosure applies.
9.3 The bot must log every determination with: input-data snapshot, rule version, sources consulted (for example, NMLS Consumer Access pull timestamp), decision, and rationale. Retain ≥7 years to cover cross-cutting federal retention plus state-limitations overhang.
9.4 Data privacy: PII captured in the licensing-verification flow is subject to CCPA/CPRA and GLBA safeguards. Data-minimization and retention schedules must be drafted before launch.
9.5 Change management: Each regulatory update triggers a rule-version bump. Bot responses should cite rule version. Website dropdown copy should cite "last verified" date.
9.6 Open items for counsel review (highest priority before launch)
Confirm current CRMLA net-worth and bond floors (tracking a known DFPI review cycle).
Confirm current MLO surety-bond tiers.
Confirm DRE broker MLO-endorsement specifics under current regulation.
Confirm CCPA/CPRA scope for mortgage data flows through PHOCIS.
Confirm whether PHOCIS itself requires any California license or registration as a service provider, vendor, or "covered person" under CCFPL — this is the single most important unanswered question for the business.
Confirm whether PHOCIS marketing to consumers implicates mortgage-advertising rules even though PHOCIS is not the licensee.
9.7 PHOCIS strategic note (for internal alignment, not for publication)
The commercial defensibility of the banking-partner-shielding claim rests on PHOCIS being able to demonstrate, per loan, that every gate in §7 was cleared with a fresh regulator-data pull and a retained evidence package (§6.3). Marketing copy on phocistech.com that promises "shielded" or "compliant" partner status should be written only after counsel signs off on §6.3 and the retention schedule, to avoid PHOCIS itself becoming the locus of a UDAAP or CCFPL claim for overstated compliance.
END OF v1 OUTLINE — ready for counsel review, banking-partner-note ingestion, and dev handoff for the phocistech.com state-lookup feature.