Okla. Stat. tit. 59, § 59-2095.27

work at remote locations.

A licensee may permit its employees or independent contractors

to work at remote locations in compliance with the licensee’s

written policies and procedures subject to the following conditions:

1. The licensee has written policies and procedures for

supervision of employees and independent contractors working from

remote locations;

2. Access to a licensee’s platforms and customer information

shall be in accordance with the licensee’s comprehensive written

information security plan;

3. No in-person customer interaction shall occur at an

employee’s or independent contractor’s residence unless such

residence is a licensed or registered location;

4. Physical records shall not be maintained at a remote

location;

5. Interactions with and conversations about consumers shall be

in compliance with federal and state information security

requirements, including applicable provisions under the Gramm-Leach-

Bliley Act and the Safeguards Rule established under the Federal

Trade Commission, set forth in 16 CFR Part 314, as such may be

amended from time to time;

6. Employees or independent contractors working at a remote

location shall have access to the licensee’s secure systems,

including a cloud-based system, directly from any out-of-office

device that such employee or independent contractor may use

including, but not limited to, a laptop, mobile phone, desktop

computer, or tablet, via a virtual private network, or comparable

system, that ensures secure connectivity and requires passwords or

forms of authentication to access;

7. The licensee shall ensure that appropriate security updates,

patches, or other alterations to the security of all devices used at

remote locations are installed and maintained;

8. The licensee shall have an ability to remotely lock or erase

company-related contents of any device or other otherwise remotely

limit all access to the licensee’s secure systems; and

9. The Nationwide Multistate Licensing System and Registry

record of a mortgage loan originator that works from a remote

location shall designate the principal place of business as his or

her registered location unless such mortgage loan originator elects

to choose a licensed branch office as a registered location.