(a) For purposes of this section:

(1) “Covered institution” means a mortgage servicer that services, or subservices for others, at least two thousand mortgage loans primarily for personal, family or household use secured by residential property in the United States, excluding whole loans owned and loans being interim serviced prior to sale, as reported on the mortgage call report on the system or any other document required by the commissioner. “Covered institution” does not include: (A) Any person exempt from mortgage servicer licensing requirements pursuant to subdivision (1), (2) or (3) of subsection (b) of § 36a-718, (B) any mortgage servicer that has the status of a tax-exempt organization under Section 501(c)(3) of Internal Revenue Code of 1986, or any subsequent corresponding internal revenue code of the United States, as amended from time to time, or (C) any agency exempt from mortgage servicer requirements pursuant to § 36a-719l;

(2) “Interim serviced prior to sale” means the activity of collecting a limited number of contractual mortgage payments immediately after origination on loans held for sale but no longer than a period of ninety days prior to the loans being sold into the secondary market; and

(3) “Whole loan” means a loan where a mortgage and the underlying credit risk is owned and held on the balance sheet of the entity with all ownership rights.

(b) A covered institution shall maintain capital and liquidity as described in this section, except for any mortgage servicer that solely: (1) Owns reverse mortgage loans, (2) performs subservicing for others with no responsibility to advance moneys not yet received in connection with such subservicing activities, or (3) conducts reverse mortgage servicing.

(c) A covered institution shall maintain the Federal Housing Finance Agency’s Eligibility Requirements for Enterprise Single-Family Seller/Servicers for minimum capital ratio, net worth and liquidity, as amended from time to time, whether or not the mortgage servicer is approved for government sponsored enterprise servicing.

(d) A covered institution shall maintain written policies and procedures implementing the capital and servicing liquidity requirements of this subsection, including a sustainable written methodology for satisfying the requirements of this subsection.

(e) A covered institution shall maintain sufficient allowable assets for liquidity in addition to the amounts required for servicing liquidity, to cover normal business operations. A covered institution shall have in place sound cash management and business operating plans that are commensurate with the complexity of the institution to ensure normal business operations. A covered institution shall develop, establish and implement plans, policies and procedures for maintaining operating liquidity sufficient for the ongoing needs of the institution, that shall include sustainable, written methodologies for maintaining sufficient operating liquidity. For purposes of this subsection, “allowable assets for liquidity” means assets that may be used to satisfy the liquidity requirements established under this subsection, including unrestricted cash and cash equivalents and unencumbered investment grade assets held for sale or trade, including, but not limited to, mortgage-backed securities of Fannie Mae, Freddie Mac or Ginnie Mae and obligations of the United States Department of Treasury.

(f) For the purposes of complying with the capital and liquidity requirements described in subsections (c) to (e), inclusive, of this section, the reverse mortgage portfolio administered by a covered institution shall be excluded from calculations and all financial data shall be determined in accordance with generally accepted accounting principles.

(g) A covered institution shall establish and maintain a board of directors responsible for oversight of the covered institution. For covered institutions that are not approved to service loans by a government sponsored enterprise or Ginnie Mae, or where a federal agency has granted approval for a board alternative, an institution may establish a similar body constituted to exercise oversight and fulfill the board of directors’ responsibilities described under this subsection. The board of directors shall: (1) Establish a written corporate governance framework, including appropriate internal controls designed to monitor corporate governance and assess compliance with the corporate governance framework, (2) monitor and ensure institutional compliance with the rules established under sections 36a-715 to 36a-719l, inclusive, and accurately and timely complete and submit regulatory reports, including filing the mortgage call report, and (3) establish internal audit requirements that are appropriate for the size, complexity and risk profile of the servicer, with appropriate independence to provide a reliable evaluation of the servicer’s internal control structure, risk management and governance.

(h) A covered institution shall annually procure an external audit, including audited financial statements and audit reports conducted by an independent public accountant. The audit shall include: (1) Annual financial statements, including a balance sheet, income statement, cash flows, notes and supplemental schedules prepared in accordance with generally accepted accounting principles, (2) assessment of the internal control structure, (3) computation of tangible net worth, (4) validation of mortgage servicing rights valuation and reserve methodology, if applicable, (5) verification of adequate fidelity and errors and omissions insurance, and (6) testing of controls related to risk management activities, including compliance and stress testing, as applicable.

(i) A covered institution shall establish a risk management program under the oversight of the board of directors that identifies, measures, monitors and controls risk commensurate with the complexity of the servicer. The risk management program shall have appropriate processes and models in place to measure, monitor and mitigate financial risks and changes to the risk profile of the servicer and assets being serviced. The risk management program shall be scaled to the complexity of the organization and be sufficient to manage the risk of the institution. Such risks shall include, but are not limited to:

(1) Credit risk, which means the potential that a borrower or counterparty will fail to perform on an obligation;

(2) Liquidity risk, which means the potential that the servicer will be unable to meet its obligations as they come due because of an inability to liquidate assets or obtain adequate funding or that it cannot easily unwind or offset specific exposures;

(3) Operational risk, which means the risk resulting from inadequate or failed internal processes, people and systems or from external events;

(4) Market risk, which means the risk to the servicer’s condition resulting from adverse movements in market rates or prices;

(5) Compliance risk, which means the risk of regulatory sanctions, fines, penalties or losses resulting from failure to comply with laws, rules, regulations or other supervisory requirements applicable to the servicer;

(6) Legal risk, which means the potential that actions against the servicer that result in unenforceable contracts, lawsuits, legal sanctions or adverse judgments can disrupt or otherwise negatively affect the operations or condition of the servicer; and

(7) Reputation risk, which means the risk to earnings and capital arising from negative publicity regarding the servicer’s business practices.

(j) A covered institution shall annually conduct a risk management assessment. The risk management assessment shall include a written report to the board of directors. The report shall include evidence of risk management activities, any adverse findings relating to the institution’s risk management program and proposed corrective actions needed to remedy any findings noted.

(k) Whenever the commissioner finds, as the result of an investigation, inquiry or examination, that any risk of a covered institution is of significant concern, the commissioner may order or direct the institution to satisfy additional conditions necessary to ensure that the institution continues to operate in a safe and sound manner and continues to service loans in compliance with state and federal law and regulations.