New State Work From Home Regulations Boosting Flexibility for Licensed Entities

As the country returns to some state of normalcy, and with many businesses returning to work, the accounts receivables management industry has made efforts to push state legislatures to continue and/or codify work-from-home (“WFH”) regulations. The more permanent rules allow agencies licensed by each individual state to permit the use of home or remote offices without the additional burden and cost of obtaining additional licenses to continue to operate from those locations.  Most states, pre-Covid-19, required collection agencies to operate from a physical office licensed by the state, with each successive location requiring obtaining an additional license.  With the pandemic and the public health need to have its workers conduct business remotely, states relaxed or stayed these requirements.  In the last few months, while most states have terminated their temporary emergency guidance, others have taken steps to continue to allow agencies to work remotely under certain conditions and requirements.  Below is a brief summary of the states that have made recent changes to its WFH policies:

Washington

Washington led the way as far as broad and permanent work-from-home legislation, finalizing the state’s WFH rules on February 17, 2021.  The final rules require licensed entities to (1) keep a list of all employees who are authorized to work from home; (2) keep a list of all company equipment in the homes (or other virtual office space) of WFH employees; (3) produce and have employees sign WFH agreements, which must include provisions governing confidentiality of consumer data, provisions requiring a review of policies and procedures as to IT security and other company policies, disclosures as to where an employee is working, and monitoring and recording. Additionally, the order codifies other requirements, including certain office standards as to connectivity, infrastructure and data security; requirements for employees to work from home, such as mandatory training programs and forty-five days of in-office oversight; requirements that employees follow all applicable laws as if they were working at an office; and requirements as to specific IT security policies.  The text of the final rule can be found here.

Maryland

On January 22, 2021, the Maryland Commissioner of Financial Regulation issued an emergency regulation, effective January 29, 2021 and valid for six (6) months while the state considered public comment on a permanent rule. As of today, the emergency order remains intact, while the state expects to continue or finalize the new rule soon. Broadly, the order states that employers “shall provide a workspace that is secure, provide for appropriate protection of personal information as required under applicable law, and have appropriate technological security measures and physical safeguards in place to protect personal information.” A licensee that allows any employee to work at an authorized location must develop a security program that is consistent with all applicable laws and regulations, upholds industry standards, address known vulnerabilities, and fits the size and complexity of its systems.  This security program must undergo a risk assessment to understand the vulnerabilities and risks of operating remotely as well as identifying other systems that must be protected. The text of the emergency order, which the final order is expected to largely follow, can be found here.

Minnesota

On June 26, 2021, Governor Tim Walz signed the Commerce and Energy Omnibus bill.  Of its many provisions covering several different industries, the law permits remote work if the licensee and employee comply with Minnesota statutes § 332.33 as if they were working at the regular business office location. The law will take effect on August 1, 2021.  According to the specific section pertaining to remote working of collection agencies (Art. 7, Sec. 4), the bill expires on May 31, 2022 and will need to be renewed next year. The bill also states that no additional branch license is required for a location considered under this section.  The text of the amended act can be found here.

Connecticut

On March 9, 2020, Connecticut took a no-action position as to enforcement of office licensing rules, allowing WFH for licensed entities.  This no-action guidance expired on June 30, 2021. However, on July 1,2021, Banking Commissioner Jorge L. Perez ordered an extension of the WFH guidance. The new order is effective immediately and is in effect until modified or vacated. The order requires licensed collection agencies who wish to have employees work remotely to be able to, in addition to complying with other state and federal laws,

• Maintain records identifying all dates of authorized remote office activity, the location of each office, and names of all individuals authorized to conduct business remotely
• Implement policies and procedures to ensure proper supervision of these activities
• Ensure that no records of licensable activity are maintained at such a remote office
• Ensure each individual working remotely is licensed under state regulations
• Ensure that no one holds meetings with members of the public take place at the location nor holds out the remote location as an office
• Designate a licensed branch office
• Ensure records remain accessible and available for oversight
• Establish data security procedures

The text of the Commissioner’s order can be found here.

Texas

On July 2, 2021, Texas enacted H.B. 3510 which allows remote work for employees of entities licensed by the Texas Finance Commission.  Although the act would not impact most third-party collection agencies, it does impact some creditors and debt buyers. The bill, as enacted, allows WFH so long as the licensee:

• Ensures all in-person customer interactions will be conducted at the physical location;
• Maintains appropriate safeguards for licensee and consumer data, information, and records, including the use of secure virtual private networks (“VPNs”) where appropriate;
• Employs appropriate risk-based monitoring and oversight processes of work performed from a Remote Location, and maintains records of the same;
• Ensures consumer information and records are not maintained at a remote location;
• Ensures consumer and licensee information and records remain accessible and available for regulatory oversight and exams;
• Provides appropriate employee training to keep all conversations about, and with, consumers conducted from a remote location confidential, as if conducted from a commercial location, and to ensure remote employees work in an environment conducive and appropriate to that privacy.

The text of the enacted bill, effective September 1, 2021, can be found here.

Massachusetts

On July 12, 2021, the Massachusetts Division of Banks formally extended its March 11, 2020 guidance authorizing for the continued option of WFH operations, subject to certain conditions and restrictions.  Broadly speaking the Division conditions the ability to work remotely with certain principles, including, prohibiting operating or advertising that the remote location is a licensed place of business, complying with all relevant laws and record retention policies, maintaining procedures designed to ensure the security of certain company data, confidential information and personal data security, as well as maintain procedures sufficient to provide adequate supervision of all personnel. The updated guidance can be found here.

Nevada (Ending WFH Guidance)

On the other side of the coin, Nevada, which had been extending its temporary remote work guidance into July of 2021, has announced it will not be extending such policies beyond July 31, 2021. Agencies in that state need to prepare their work forces to move back into the office heading into the end of the summer.

In the next year, industry licensees will continue to keep an eye on states as they consider the benefits and drawbacks of WFH office locations and policies that developed over the last year. Businesses across industries will continue to push for more flexible licensing requirements as to WFH options to the extent they benefit both the businesses and consumers.

Information about KD’s Consumer Financial Servicers Practice Group can be found here.