12 CFR Part 9 is the OCC regulation governing fiduciary activities of national banks and, to the same extent, Federal branches of foreign banks. It isn't a mortgage origination rule.
If you work at a bank, does every federal banking regulation govern your individual loan officer license? That assumption confuses the bank's authority to manage assets for others with your authorization to originate mortgage loans. Understanding the difference helps you ask the right compliance questions without treating every mortgage job as a trust-department position.
What 12 CFR Part 9 Governs and Who It Covers
12 CFR Part 9 governs a bank's fiduciary activities, not its mortgage origination business. A trust department works like a vault holding other people's assets: Part 9 is the rulebook for managing what sits inside that vault, not the licensing manual for the loan desk down the hall.
The rule speaks to the institution. It sets conditions for how a bank may act for customers in fiduciary roles, and its current text names the specific capacities that bring the bank under its requirements. A loan officer's personal authority to take applications and originate mortgages comes from separate licensing rules that Part 9 does not touch.
The two regimes overlap in one place worth understanding. When an employee exercises investment discretion or gives compensated advice inside the bank's fiduciary business, Part 9 still binds the bank itself, but the employee's day-to-day conduct becomes part of what the bank must supervise. The obligation lands on the institution; the institution then manages the individual.
Fiduciary Capacities Covered by 12 CFR Part 9
The rule's definition reaches beyond traditional trust management. The following examples illustrate the capacities named in Part 9; they aren't descriptions of particular customer accounts.
| Capacity | Typical example | What makes it a fiduciary role |
|---|---|---|
| Trustee | Manages a trust for named beneficiaries | Holds legal title and acts for others |
| Executor or administrator | Settles a deceased person's estate | Acts under court or will authority |
| Guardian | Manages assets for a minor or incapacitated person | Acts in the ward's interest |
| Registrar or transfer agent | Keeps records of securities ownership | Handles ownership records for an issuer |
| Custodian under a Uniform Gifts to Minors Act | Holds assets for a minor | Holds property for the minor's benefit |
| Receiver | Manages assets for a court-supervised estate or insolvent entity | Acts under court appointment |
| Fee-based investment adviser | Gives compensated investment advice | Provides advice for a fee |
| Investment discretion for another party | Chooses which securities to buy or sell | Makes decisions for someone else's account |
For a mortgage team, the important distinction is whose assets the bank manages and what authority it exercises. One customer can hold a mortgage application and a trust relationship at the same institution, yet the duties that attach to each relationship differ, and so do the rules that govern them.
Practical rule: Identify the bank's actual role before deciding which regulatory requirements apply.
A department name doesn't settle the question, and neither does an account label such as custody, advisory, or wealth services. Compliance staff need to examine the responsibilities the bank has accepted, because Part 9 follows the function the bank performs rather than the title on the door.
Key Provisions and the Sections That Hold Them
A national bank generally needs OCC approval under 12 CFR 5.26 before exercising fiduciary powers when approval is required. The current Part 9 regulatory text connects that approval requirement with the bank's continuing fiduciary responsibilities.
Approval is the entry gate, not the entire compliance program. After the bank begins fiduciary business, staff must maintain records, follow written controls, manage conflicts, and support board oversight.
Key 12 CFR Part 9 Provisions and What They Require
The table pairs regulatory obligations with practical evidence a reviewer could request. Its document checks are useful preparation suggestions, not an exhaustive examination checklist.
| Provision | What it requires | What a reviewer checks |
|---|---|---|
| 12 CFR 5.26 | OCC approval before exercising fiduciary powers where required | Approval letter on file before the activity starts |
| Section 9.5 | Written policies and procedures adequate to ensure legal compliance | Current written policies covering fiduciary activities |
| Section 9.8 | Maintenance of fiduciary records | Records retrievable for a named account |
| Sections 9.9(a) and 9.9(b) | Audit results recorded in board minutes, with requirements depending on the audit approach | Board minutes documenting audit results |
| Section 9.12 | Limits on self-dealing and conflicted transactions | Counterparty flags and legally supported exception approvals |
| Section 9.17(a) | Certified board resolution filed when surrendering fiduciary powers | Resolution and OCC filing record |
| Section 9.18 | Collective investment funds need a written plan, public availability, and financial reporting | Publicly available plan and disclosed financial reports |
The OCC's information-collection description of fiduciary requirements identifies the recordkeeping, board-minute, surrender-resolution, and collective-fund disclosure obligations summarized above. For collective investment funds, transparency includes financial reporting to investors and other interested persons, not merely maintaining an internal accounting file.
Why Recurring Review Matters
Under the annual-audit approach, all significant fiduciary activities must receive a suitable audit at least once during each calendar year. The OCC explains that approach alongside the written-policy requirements in its fiduciary activities guidance on the revised rule.
Think of that approach like a recurring building inspection. The inspector doesn't wait until a ceiling falls before checking the structure; similarly, a bank shouldn't wait for a customer complaint before reviewing significant fiduciary activities.
Written procedures also need to match actual work. A policy that describes manual approval won't explain a transaction processed automatically unless the bank documents how that automated process satisfies its controls.
For practical preparation, assemble an approval record, current policies, retrievable account records, audit results, and board minutes. Add conflict documentation and collective-fund materials where relevant, and use a broader banking regulations and compliance overview to understand how this fiduciary program fits within the institution's other obligations.
How Your Activities Trigger Part 9, Including Digital Assets
The bank's functions matter more than its product labels. A label on a jar tells you what someone called the contents, but you still need to inspect what's inside.
Consider a hypothetical account marketed as custody-only. If the bank in practice chooses which bonds to buy for the customer, that investment discretion can bring the activity within Part 9's fiduciary definition. Calling the service custody doesn't remove the authority the bank exercises.
Build an Activity Inventory
Use the capacities identified earlier as the starting point, then document how each service works:
- List services that hold or manage client assets. Include arrangements outside the department formally called trust or wealth management. Capture the governing agreement and responsible business team.
- Identify who makes investment decisions. Distinguish a customer directing a purchase from bank staff choosing the investment.
- Check compensation for advice. Record whether the bank provides investment advice for a fee, rather than assuming every customer conversation has the same legal character.
- Confirm authority and approval. Ask compliance to match each activity with its legal basis and the bank's required OCC approval.
- Document board delegation. Identify who performs each function and how the board retains direction and governance responsibility.
Part 9 allows the board to delegate functions while retaining responsibility for directing fiduciary activities. A useful operational record therefore shows both the employee or committee doing the work and the reporting route back to the board.
A customer-facing name is a starting point for questions, not a legal conclusion.
Apply the Same Test to Digital Custody
Holding crypto-assets doesn't automatically make a bank a Part 9 fiduciary. The OCC, Federal Reserve, and FDIC explain that banking organizations may safeguard crypto-assets in either a fiduciary or non-fiduciary capacity in their joint statement on crypto-asset safekeeping.
When custody is fiduciary, the organization must follow Part 9 or the applicable federal fiduciary rule, state law, and the document creating the relationship. The decisive question is the bank's legal capacity and duties, not whether the asset exists digitally.
For example, compare a bank safeguarding digital assets under a non-fiduciary arrangement with a bank managing those assets as trustee. The technology may look similar, but compliance staff must analyze the relationships separately.
Operationally, a sensible review should address private-key control, transaction authorization, asset segregation, valuation, key-holder succession, and incident response. Those are practical questions for applying established fiduciary safeguards to digital assets, not a claim that Part 9 explicitly prescribes a particular wallet design.
Ask who can authorize a transfer, who can execute it, and how the bank would respond if an authorized key holder became unavailable. Documenting those answers makes the institution's responsibilities clearer than describing the service merely as secure digital custody.
Conflict-of-Interest Rules in a Real Trust Account
Consider a hypothetical trust officer managing a family trust with investment discretion. An affiliate of the bank offers a bond at a discount, and the officer believes it could suit the trust's portfolio.
The discount doesn't resolve the conflict. Section 9.12 generally prohibits specified self-dealing and conflicted investments unless applicable law authorizes them, including investments involving the bank, insiders, affiliates, and other parties whose interests could impair the bank's judgment.
Fiduciary Account Transactions and Conflict Status
The conflict restrictions and permissions in Section 9.12 distinguish prohibited dealings from certain transactions that may proceed if fairness and legal conditions are satisfied.
| Transaction | Generally permitted | Condition |
|---|---|---|
| Buying the bank's own stock for a trust account | No | Unless applicable law authorizes it |
| Buying assets acquired from the bank | No | Generally prohibited unless applicable law authorizes it |
| Buying instruments tied to an officer or director | No | Insider interests trigger restrictions, subject to applicable-law authorization |
| Lending trust assets to an affiliate | No | Affiliate dealings are restricted unless applicable law authorizes them |
| Transfer between fiduciary accounts | Possibly | Fair to both accounts and not otherwise prohibited |
| Loan from the bank to a fiduciary account | Possibly | Fair to the account and not otherwise prohibited |
Think of the conflict review as a referee checking a play. An attractive result doesn't excuse breaking the rules governing how the transaction occurs.
What the Transaction File Should Explain
A useful control test is whether the bank can show independent, economically defensible treatment of the trust. That means examining the transaction from the trust's perspective rather than treating the affiliate's business objective as a reason to proceed.
- Identify the relationship. Record the issuer, seller, affiliate connections, and any relevant insider interests.
- Establish legal authorization. Route a proposed exception for legal review and preserve its basis. Internal approval alone can't override the law.
- Document the account's treatment. For a permissible transaction, explain pricing, alternatives, and fairness to every affected fiduciary account.
In the hypothetical bond purchase, the bank should block execution unless legal review establishes an applicable authorization and the required exception process is completed. Any permitted transaction should have a file explaining why it served the trust.
The trust officer's confidence isn't enough. The bank needs evidence that another reviewer can follow without relying on the officer's memory.
Where to Read the Rule and Verify Your Status
Start with 12 CFR Part 9 on the eCFR, using the primary-text reference provided earlier. Read it alongside the approval requirements in 12 CFR 5.26, rather than treating fiduciary operating standards and permission to conduct the business as interchangeable.
For supervisory context, consult the OCC's Comptroller's Handbook guidance on asset management. Use it to frame questions about how examiners assess the bank's audits, records, governance, and conflicts, while keeping the regulation itself as the primary legal reference.
A Practical Verification Sequence
Treat your review file like a map: someone else should be able to follow the route from legal requirement to bank practice.
- Read the provisions matching the activity. Start with the written-policy, recordkeeping, and conflict provisions discussed earlier.
- Pull the bank's written fiduciary policies. Compare actual procedures with the relevant requirements and note unanswered questions.
- Request audit evidence through compliance. Ask for the relevant audit results and board-minute records, including annual-audit evidence where that approach applies.
- Keep related evidence together. Save the approval letter and conflict-exception log in the same controlled review file.
Record the access date and any displayed revision date for each legal or supervisory source. Don't copy an old training slide into a compliance file without checking the underlying text.
Verify the Individual Separately
For a loan officer, check NMLS Consumer Access for licensing or registration status and available history. Then consult the appropriate state regulator for requirements that go beyond the federal baseline.
Keep the files separate: The bank's fiduciary approval doesn't establish an employee's mortgage licensing status.
If you're unsure which authority handles a question, a guide to financial services regulators can help organize the inquiry. Bring compliance a specific activity, document, or licensing question rather than asking whether the entire department is covered.
What Part 9 Means for Mortgage Professionals and Your Next Step
Part 9 governs the bank's fiduciary business; the SAFE Act framework addresses individual mortgage origination licensing or registration. A loan officer taking a residential mortgage application doesn't follow Part 9 as an origination rule just because the employer also operates a trust department.
An individual who, for compensation or gain, takes a residential mortgage application or offers or negotiates residential mortgage terms must be licensed or registered as an MLO. Don't assume every bank employee follows the same state-licensing route; confirm the route that fits your employment and duties.
SAFE Act Requirements for an Individual MLO
For the state-licensed route, the New York Department of Financial Services MLO application guidance describes the education and testing thresholds below, including New York's additional requirement.
| Requirement | Amount | Notes |
|---|---|---|
| Pre-licensing education | 20 hours NMLS-approved | Includes the subject allocations below |
| Federal law and regulations | 3 hours | Part of the pre-licensing total |
| Ethics covering fraud, consumer protection, and fair lending | 3 hours | Part of the pre-licensing total |
| Nontraditional mortgage products | 2 hours | Part of the pre-licensing total |
| National mortgage test | Score of at least 75% | Required for the state-licensed route |
| Continuing education | 8 hours NMLS-approved each year | Annual education requirement |
| New York add-on | 3 hours of New York law plus an NMLS application | Applies in New York only |
The subject allocations listed within the pre-licensing total aren't separate courses to add on top of that total. State-specific education, however, requires its own check.
Follow the Duties, Not Just the Job Title
Use separate checklists for the institution and the individual. Think of them as different credentials: permission for the bank to conduct fiduciary business doesn't substitute for authorization for a person to originate mortgages.
- Check for fiduciary responsibilities. If your work involves trust, estate, custody, or investment discretion, ask compliance whether the bank's activity falls within Part 9.
- Check your origination duties. If you take residential applications or offer or negotiate terms for compensation, confirm the applicable licensing or registration requirements.
- Map overlapping relationships. If a trust customer also seeks a mortgage, identify who handles each responsibility and flag potential conflicts.
- Verify current requirements. Check the governing text and state requirements, and use regulatory compliance updates as a supplement rather than a replacement for official guidance.
- Confirm institutional controls. Ask compliance about fiduciary approval and the conflict policy where those matters affect your work.
A rewarding mortgage career begins with knowing which requirements belong on your checklist. Online education can make the learning portion easier to organize around existing commitments, while a clear licensing plan helps you focus on preparation rather than unrelated bank rules.
24hourEDU offers an NMLS-approved 20-hour SAFE course online, with instructor-led video lessons, free exam prep, and complimentary NMLS hours reporting. If mortgage origination is your path, visit 24hourEDU to review the course and plan your education around your schedule, while keeping your individual licensing requirements separate from the bank's fiduciary obligations.
