1. A. Corporate Governance — Generally.

   1. (1) A licensee shall establish, document, and maintain sufficient corporate governance.
   2. (2) Each element of a licensee’s corporate governance shall be commensurate with the size, operational complexity, and overall risk profile of the licensee.
   3. (3) For purposes of this regulation, the operational complexity and risk profile of a licensee shall, in part, be defined by the results of regulatory examinations, any external audits, and internal audits.
   4. (4) A licensee bears the burden of demonstrating to the Commissioner that its corporate governance is sufficient and commensurate with its size, operational complexity, and overall risk profile.

   5. (5) A licensee’s corporate governance shall, at a minimum, include:

      1. (a) Clearly defined responsibilities and accountability;
      2. (b) Internal controls, policies, processes, and practices for monitoring, testing, and ensuring compliance with the corporate governance framework;
      3. (c) Internal controls, policies, processes, and practices for training of employees on corporate governance requirements; and
      4. (d) Internal controls, policies, processes, and practices addressing internal audits, external audits, and risk management as set forth in §§B, C and D of this regulation.
   6. (6) Each licensee shall, not less than annually, conduct a review of its corporate governance to determine its overall effectiveness, address emerging risks, and otherwise assure that the corporate governance remains commensurate with the size, operational complexity, and overall risk profile of the licensee.
   7. (7) Any documentation, controls, policies, procedures, requirements, audits, reports, or other materials included in this regulation shall be made available to the Commissioner upon the Commissioner’s request.

2. B. Internal Audit.

   1. (1) A licensee shall establish internal audit requirements that are appropriate for the size, complexity, and risk profile of the licensee.
   2. (2) Unless impracticable given the size of the licensee, internal audit functions shall be performed by employees of the licensee who report to the licensee’s owners or board of directors and who are not otherwise supervised by the persons who directly manage the activities being reviewed.
   3. (3) Employees performing internal audit functions shall have sufficient knowledge, training, and resources to provide a reliable evaluation of the licensee’s operations, risk management, internal controls, and governance processes.

3. C. External Audit.

   1. (1) If the Commissioner determines based on the size, operational complexity, and overall risk profile of the licensee that an external audit is appropriate, the Commissioner may direct a licensee to receive an external audit.

   2. (2) If the Commissioner directs a licensee to receive an external audit, that external audit shall include:

      1. (a) Annual financial statements, including a balance sheet, statement of operations (income statement), and cash flows, including notes and supplemental schedules prepared in accordance with generally accepted accounting principles;
      2. (b) Assessment of the internal control structure;
      3. (c) Computation of tangible net worth;
      4. (d) Validation of MSR valuation and reserve methodology, if applicable;
      5. (e) Verification of adequate fidelity and errors and omissions (E&O) insurance;
      6. (f) Testing of controls related to risk management activities, including compliance and stress testing, if applicable; and
      7. (g) Any other element the Commissioner deems appropriate.
   3. (3) Nothing in this section is intended to abrogate a requirement of a licensee to receive an external audit under any other law, rule, regulation, or bylaw, policy, or procedure of the licensee.

4. D. Risk Management.

   1. (1) A licensee shall at all times maintain a risk management program that identifies, measures, monitors, and controls risk sufficient for the size, operational complexity, and overall risk profile of the licensee.
   2. (2) The risk management program shall have appropriate processes and models in place to measure, monitor and mitigate financial risks and changes to the risk profile of the licensee.
   3. (3) Evidence of risk management activities throughout the year shall be maintained, including findings of issues and the response to address those findings.
5. E. Authority to Address Risk as Necessary. If risk is determined by a formal review of a licensee to be extremely high, the Commissioner may order or direct the licensee to satisfy additional conditions necessary to ensure that the licensee will continue to operate in a safe and sound manner and be able to continue to engage in business as a mortgage lender in compliance with State and federal law and/or regulation.
6. F. A covered institution as defined in Regulation .27 of this chapter is not subject to this regulation.

Authority: Business Regulation Article, §2-105; Financial Institutions Article, §§2-105.1, 11-503,
11-503.1, 11-505, 11-506(a) and (c)(1), 11-507, 11-508(g), 11-511, 11-511.1, 11-513(a), and 11-515(c);
Real Property Article, §3-104.1; Annotated Code of Maryland

Effective date:

Regulations .01—.15, Code of Conduct—Mortgage Lenders, adopted as an emergency provision effective July 1, 1989 (16:14 Md. R. 1564); emergency status extended at 16:26 Md. R. 2782 (Emergency provisions are temporary and not printed in COMAR)

Regulations .01—.16, Mortgage Lenders, adopted effective February 19, 1990 (17:3 Md. R. 297)

Regulation .06A amended effective July 31, 1995 (22:15 Md. R. 1119)

Regulation .08B amended effective June 16, 1997 (24:12 Md. R. 864)

Chapter recodified from COMAR 09.04.06 to COMAR 09.03.06, April, 1998

Regulation .01 amended effective March 15, 2010 (37:5 Md. R. 427)

Regulation .02B amended effective November 3, 2008 (35:22 Md. R. 1956); January 1, 2009 (35:26 Md. R. 2247); March 15, 2010 (37:5 Md. R. 427)

Regulation .03 amended as an emergency provision effective July 1, 2009 (36:15 Md. R. 1158); emergency status extended at 37:3 Md. R. 170; emergency status expired March 15, 2010

Regulation .03 amended effective March 15, 2010 (37:5 Md. R. 427)

Regulation .03A amended effective November 3, 2008 (35:22 Md. R. 1956)

Regulation .03I adopted effective November 3, 2008 (35:22 Md. R. 1956)

Regulation .03J adopted effective January 1, 2009 (35:26 Md. R. 2247)

Regulation .04B amended as an emergency provision effective February 19, 2008 (35:6 Md. R. 695); emergency status extended at 35:18 Md. R. 1599; emergency action expired August 24, 2008

Regulation .04B amended effective August 25, 2008 (35:17: Md. R. 1485); November 3, 2008 (35:22 Md. R. 1956); March 15, 2010 (37:5 Md. R. 427)

Regulation .07B amended effective March 15, 2010 (37:5 Md. R. 427)

Regulation .07D adopted effective November 3, 2008 (35:22 Md. R. 1956)

Regulation .15G adopted effective June 15, 1998 (25:12 Md. R. 946)

Regulation .15G repealed effective March 15, 2010 (37:5 Md. R. 427)

Regulation .17 adopted effective June 26, 2000 (27:12 Md. R. 1138)

Regulation .17 amended effective March 15, 2010 (37:5 Md. R. 427)

Regulation .17B, G amended effective September 2, 2013 (40:17 Md. R. 1419)

Regulation .17C amended effective April 29, 2002 (29:8 Md. R. 697)

Regulation .18 adopted effective February 17, 2003 (30:3 Md. R. 178)

Regulation .18B, C amended effective March 15, 2010 (37:5 Md. R. 427)

Regulation .19 adopted effective October 1, 2004 (31:19 Md. R. 1431)

Regulation .19 repealed effective March 15, 2010 (37:5 Md. R. 427)

Regulation .20 adopted effective November 3, 2008 (35:22 Md. R. 1956)

Regulation .21 adopted effective November 3, 2008 (35:22 Md. R. 1956)

Regulation .23 adopted effective January 1, 2009 (35:26 Md. R. 2247)

Regulation .23A amended effective July 1, 2016 (43:11 Md. R. 633)

Chapter revised effective October 4, 2019 (46:19 Md. R. 813)

Regulation .02B amended effective June 27, 2022 (49:13 Md. R. 688); February 3, 2025 (52:2 Md. R. 67)

Regulation .02B amended as an emergency effective December 18, 2024 (52:1 Md. R. 17); emergency action expired June 16, 2025

Regulation .04 amended effective October 4, 2021 (48:20 Md. R. 851); February 3, 2025 (52:2 Md. R. 67)

Regulation .04A amended as an emergency effective December 18, 2024 (52:1 Md. R. 17); emergency action expired June 16, 2025

Regulation .06B amended effective February 3, 2025 (52:2 Md. R. 67)

Regulation .16 amended effective February 3, 2025 (52:2 Md. R. 67)

Regulation .26 adopted effective June 27, 2022 (49:16 Md. R. 688)

Regulation .27 adopted effective June 27, 2022 (49:16 Md. R. 688)

Regulation .28 adopted effective December 11, 2023 (50:24 Md. R. 1041)