System Third-Party Users

Objective

The objective of this policy is to define the Third-Party User role in the System¹. This includes access permissions, and the ability to use the System and its features.

Background

Companies may, at times, require the services of third-party entities to support their licensing and/or supervision activities. Accordingly, the System offers a third-party user role. This policy establishes the role’s access permissions, user classification, and defined capabilities in the System pertaining to licensing and/or supervision activities.

Policy

The following provisions apply to the Third-Party User (TPU) role in the System.

1. Intended Use of the Third-Party User Role. Company Users² are required to identify the association of a TPU when employing a third-party to assist with licensing, examination, investigation, consumer complaint or any other activity in the System. The TPU role is designed to inform regulators when a third-party assists a company with its activities in the System, and to limit access to information and functionality within the System that is relevant to its designated responsibilities.
2. Third-Party User Role Definition and Classification.
   1. Definition. A TPU is a sole proprietor or an entity that provides support to a Company User with its licensing, examination, investigation, consumer complaint, or other activity in the System. TPUs do not include employees of a Company User or of any of its parent or subsidiary entities.
   2. Classification. A TPU shall be required to select its classification upon creating a user account in NMLS. TPUs may be any of the following:
      • Law Firm
      • Audit Firm
      • Accounting Firm
      • Compliance and/or Licensing Management Company
      • Sole proprietor providing any of the services above
      • Business Process Outsourcing Providers
   3. Account Creation in NMLS. A TPU is subject to the same NMLS account set up requirements as a Company User. Steps to creating a TPU account are as follows:
      • The Company User initiates the account creation process for the TPU, triggering an email to the TPU with step-by-step instructions for setting up their organization’s account in NMLS.
        1. Once the TPU account is created, the TPU account administrator will be able to create individual user logins under the account.
        2. Once the TPU account is created, the Company User will receive a notification and can then assign the TPU to a specific activity within SES. Before the Company User adds the TPU to the activity, the agency may require a confidentiality agreement between the TPU and the Company User to be uploaded to the System.
3. Agency Determination in SES. Agencies have the option to opt in to receive notifications regarding the involvement of Third-Party Users (TPUs). If an agency opts in, it will determine whether a Company User is permitted to engage a TPU for a specific activity, and whether the TPU may communicate directly with the agency in accordance with its designated role, as outlined below. Agencies that choose to opt out will not receive notifications about TPU usage from Company Users.
   1. TPU Support in a Single-State Supervisory Activity. If the agency approves the request, the TPU will be automatically added to the activity under the designated TPU role. If the request is denied, the Company User will be notified that the TPU is not authorized to participate in the activity. TPUs may assist the Company User in responding to supervisory activity requests, including Information Requests, Loan Requests, and Matters Requiring Attention. Based on the agency’s preference, the TPU may either communicate directly with the agency or coordinate through the Company User. Prior to submission, the SES Company User must attest to the accuracy of all information provided by the TPU or prepared in collaboration with them.
   2. TPU Support in a Miltistate Supervisory Activity. Approval from all participating agencies is required for the TPU to support a multistate examination. In the absence of unanimous approval, the TPU feature will be unavailable for use. Alternatively, any agency unable to grant approval may elect to withdraw from participating in the examination. Depending on the agencies’ preference, the TPU may engage directly with the agency leading the multistate activity or defer to the Company User for direct communication. Prior to submission, the SES Company User must attest to the accuracy of all information prepared by, or in collaboration with, the TPU.
4. TPU Role in SES. TPUs are limited to their assigned supervisory activity and designated role within SES. Under no circumstances may a TPU hold a Company User-level role, including but not limited to Account Administrator, Leader, or Company Lead. TPUs cannot access the Company User’s account profile or view other System activities beyond their assigned scope. Upon closure of the supervisory activity, the TPU will be automatically removed from the activity and lose all associated access. Additionally, TPUs are prohibited from accessing QuickIR, the Company User’s repository of the standard Information Requests in SES. They may not draft, edit, or update company responses to the standards in QuickIR.

This policy operates in alignment with the Data Relevancy and Record Retention Policies. It will be revised as necessary to incorporate relevant provisions from those policies as they are developed and approved.