Michigan orders $15,000 fine over escrow and data disposal

Michigan’s Department of Insurance and Financial Services (DIFS) ordered an unnamed, state-licensed mortgage broker, lender and servicer to pay a $15,000 civil fine on October 19, resolving allegations of escrow, customer-data disposal and licensing violations. The consent order also commands full implementation of a loan servicing software platform, records for 10 files selected during an examination and two years of independent audits. The fine is $15,000. The paperwork is larger.

What did Michigan regulators allege?

DIFS’s July 20 notice of opportunity to show compliance alleged breaches of the annual escrow account statement requirements in Regulation X, the implementing regulation for RESPA; the FTC Safeguards Rule’s customer information disposal requirements; and several provisions of Michigan’s Mortgage Brokers, Lenders, and Servicers Licensing Act, or MBLSLA.

The company accepted those allegations, admitted additional MBLSLA violations and waived its right to a hearing before an administrative law judge. The claims therefore resolve through an agreed consent order rather than a contested hearing on the violations. Regulators get undertakings. The company avoids a hearing.

Takeaway: The company conceded the violations and accepted an agreed order rather than litigate them before an administrative law judge.

What does the consent order require?

The consent order sets prohibitions, payment terms, technology deadlines, file-production duties and recurring independent review. Its operative requirements are:

• Cease and desist from violating Regulation X and the MBLSLA.
• Pay the $15,000 civil fine within 30 days of the date on the DIFS invoice.
• Fully implement the loan servicing software platform by October 31.
• After implementation, use the platform to generate a “complete servicing loan log” as of December 31, 2025, together with escrow analyses, payment histories and communication logs for 10 servicing files selected during the examination.

The deadlines form a sequence: software implementation first, then generation of the complete log and supporting materials from the selected files. The order names both the source system and the records it must produce, reducing the room for a policy document to stand in for actual servicing evidence.

Takeaway: The company must fix its systems, generate auditable records and pay the fine within the order’s stated timetable.

What will the independent audits cover?

For two years, the company must retain an independent third party to audit its compliance every six months, a cadence of four audit rounds across the two-year term. The reviewer must test compliance with:

• Regulation X’s escrow requirements.
• The mortgage servicing practices provisions of TILA’s implementing regulation, Regulation Z.
• The FTC Safeguards Rule.
• NMLS filing requirements.

The audit scope reaches further than escrow statements alone. It also covers mortgage-servicing practices under Regulation Z, customer information disposal under the FTC Safeguards Rule and NMLS filings, while the company’s own remediation remains centered on Regulation X, the MBLSLA and the servicing platform.

Read together, the provisions require infrastructure, evidence and outside assurance rather than one isolated correction. The annual escrow-statement duty sits inside a twice-yearly testing schedule, and the software deadline precedes creation of the dated servicing record. Regulators have specified a chain of accountability. Paperwork alone does not close it.

Takeaway: Independent testing will recur twice a year for two years across four compliance areas.

What changes for practitioners?

For mortgage-servicing lawyers and compliance teams, the practical consequence is straightforward: escrow statements, customer-information disposal, licensing controls and NMLS filings must operate in the servicing platform and withstand independent review every six months. The order pushes advisers toward system evidence, test results and a record trail rather than policy prose. Policy language cannot produce a complete loan log.

The company’s acceptance also means the allegations were not tested through a contested hearing. Advisers should distinguish this negotiated consent resolution from a contested case adjudicated after a hearing, while recognizing that the cease-and-desist terms, deadline-conditioned fine, remediation program and two-year audit requirement form the company’s binding obligations.

Takeaway: In plain terms, the order makes working systems and documentary evidence, not policy prose alone, the measure of compliance.