R162-2c-302. Requirements for Record Retention and Disposal

  (1) Record Retention.

  (a) An entity licensed under the Utah Residential Mortgage Practices Act shall maintain and safeguard for the period set forth in Section 61-2c-302 the following records:

  (i) application forms, which include, but are not limited to:

  (A) the initial 1003 form, signed and dated by the loan originator; and

  (B) the final 1003 form, signed and dated by the loan originator;

  (ii) disclosure forms;

  (iii) truth-in-lending forms;

  (iv) credit reports and the explanations therefor;

  (v) conversation logs;

  (vi) verifications of employment, paycheck stubs, and tax returns;

  (vii) proof of legal residency, if applicable;

  (viii) appraisals, appraisal addenda, and records of communications between the appraiser and the registrant, licensee, and lender;

  (ix) underwriter denials;

  (x) notices of adverse action;

  (xi) loan approval;

  (xii) name and contact information for the borrower in the transaction;

  (xiii) pre-qualification and pre-approval letters; and

  (xiv) all other records required by underwriters involved with the transaction or provided to a lender.

  (b) Records may be maintained electronically if the storage system complies with Title 46 Chapter 04, Utah Uniform Electronic Transactions Act.

  (c) A licensed entity shall make all records available to the division pursuant to Section 61-2c-302(3).

  (d) An individual who terminates sponsorship with an entity shall turn over to the entity any records in the individual's possession at the time of termination.

  (2) Record Disposal. A person who disposes of records at the end of the retention period shall destroy personal information by shredding, erasing, or otherwise making the information indecipherable.

  (3) Responsible Party.

  (a) If a licensed entity is actively engaged in the business of residential mortgage loans, the PLM is responsible for proper retention, maintenance, safeguarding, and disposal of records.

  (b) If a licensed entity ceases doing business in Utah, the control person(s) as of its last day of operation are responsible for proper retention, maintenance, safeguarding, and disposal of records.