An FTC Safeguards Rule-covered mortgage lender uses only 16-character passwords for access to customer information. It has neither MFA nor a documented, approved equivalent alternative. What is required?
Correct Answer
A) Implement MFA or reasonably equivalent or more secure access controls approved in writing by the Qualified Individual
A. Implement MFA or a qualifying alternative approved in writing by the Qualified Individual. A longer password remains a knowledge factor; length alone does not create a second factor. The stated system has neither MFA nor an approved equivalent alternative, so it does not satisfy this requirement. Scope and exceptions: MFA uses at least two different factor types: knowledge, possession or inherence. Two passwords do not provide two types. A qualifying alternative must meet the security standard, not merely receive a signature; this addresses one safeguard, not full Rule compliance. Source: Required elements, item c.5; MFA definition and limited exceptions — https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
Why This Is the Correct Answer
A. Implement MFA or a qualifying alternative approved in writing by the Qualified Individual. A longer password remains a knowledge factor; length alone does not create a second factor. The stated system has neither MFA nor an approved equivalent alternative, so it does not satisfy this requirement. Scope and exceptions: MFA uses at least two different factor types: knowledge, possession or inherence. Two passwords do not provide two types. A qualifying alternative must meet the security standard, not merely receive a signature; this addresses one safeguard, not full Rule compliance.
Why the Other Options Are Wrong
Option B: No access-security duty applies below 5,000 customers
The limited small-institution exceptions do not remove this access-control duty.
Option C: A manager's written approval alone makes any password system compliant
Approval alone does not establish equivalent security or the required approver.
Option D: Password length automatically exempts the system from MFA
There is no automatic password-length exemption.
Exam Tip
Password strength and multiple authentication factors are different controls.
More Federal Laws Questions
Before the team acts on a production meeting, a training manager must address SCRA Interest Rate Cap. Which response is most defensible?
A team member asks about RESPA Kickbacks and Referrals in an investor-delivery review while trying to confirm the rule-based response. Which response should the loan team use?
During a disclosure desk review, the loan team encounters an RESPA Servicing Transfer issue. Which response should avoid a shortcut that would misapply the rule?
A disciplinary-risk review raises a question about TILA APR and finance-charge rules. Which action should the renewal specialist recommend?
An MLO is reviewing procedures for a case where a compliance analyst asks why covered mortgage application data is collected. What is the proper handling?
A consumer complaint response raises a question about GLBA privacy requirements. Which action should the state compliance officer recommend?
Before the team acts on a branch training session, a policy analyst must address RESPA Servicing Transfer Notice. Which response is most defensible?
A training manager is resolving RESPA Referral Fees during an internal audit sample. Which action best fits the rule?
An operations lead is resolving ECOA Prohibited Discrimination Bases during a loan-team coaching session. Which action best fits the rule?
In a file escalation meeting, a disclosure specialist sees facts tied to TILA Closing Disclosure. What should the file reflect?
People Also Study
General Mortgage Knowledge
20% of exam
Mortgage Loan Origination Activities
27% of exam
Ethics, Fraud & Consumer Protection
18% of exam
Uniform State Test Content
11% of exam
Related Study Resources
Previous Question
An operations lead compares the file facts with BSA CIP Requirements during an underwriting condition review. Which conclusion is accurate?
Next Question
During a ECOA and Regulation B, a licensing coordinator identifies an issue involving ECOA and Regulation B. Which response is most compliant?