ShareEligibility for coverage under NAR’s blanket errors and omissions insurance program is contingent on compliance with the following security measures whether the system is operated by the association, its MLS, or by a recognized lock-box vendor on behalf of an association or MLS: (Amended 5/17)
1. Types of keys. Any physical or electronic key, programmer, or other device (hereinafter referred to as key) by which a lockbox can be opened, must be non-duplicative. Being non-duplicative means that it cannot be readily copied in the manner that other types of keys ordinarily are. (Amended 5/17)
A mobile device (such as, a smart phone, tablet, fob, etc.) can transmit a key to access a lockbox using standard protocols, including Bluetooth, ZigBee, infrared technology, and others. The applications and software used by mobile devices must contain security controls to allow only authorized users access to the lockbox. (Adopted 5/17)
As a matter of local discretion, the listing broker or agent can issue temporary codes/access to the lockbox and property on terms and conditions agreed to in advance by the seller. Temporary codes/access must expire within seventy-two (72) hours after being issued or must be under the control of the listing broker or agent. Temporary codes must be a minimum field size of five (5) characters. (XX,XXX) (Adopted 5/17)
2. Security protocols. Keys must be obtained from the original manufacturer, from a recognized vendor of lockbox systems or from any other legitimate source. Prior to utilizing previously used keys, lids, or boxes, associations and MLSs must obtain sufficient information from the original manufacturer and surrounding associations and MLSs in order to determine whether the key’s pattern, code, or configuration is already in use. (Amended 5/17)
Electronic lockboxes and electronic keys running on mobile devices must incorporate security protocols to prevent the following types of cyber-attacks:
- where an unauthorized user can override or escalate their security credentials
- where the communication session between the electronic lockbox and key are recorded and played back later to gain unauthorized access
- forging of electronic credentials that could allow an unauthorized user the ability to masquerade as an authorized user
- digitally signed updates to electronic keys running on mobile devices or electronic lockbox firmware plus a secured update process to prevent unauthorized software from being introduced into the lockbox system
- transmission(s) of frequencies to deceive the lockbox electronics into opening (Adopted 5/17)
3. Availability of lockbox system and keys. Any lockbox system must be designated as either an activity of an association of REALTORS® or an association-owned and operated MLS. (Amended 5/17)
If the lockbox system is an activity of an association of REALTORS®, then every REALTOR® and REALTOR-associate® and every non-principal broker, sales licensee and licensed or certified appraiser affiliated with a REALTOR®, shall be eligible to hold a key subject to their execution of a lease agreement with the association. (Amended 11/96)
If the lockbox system is an activity of an association-owned and operated MLS, then every MLS participant and every non-principal broker, sales licensee and licensed or certified appraiser who is affiliated with an MLS participant and who is legally eligible for MLS access shall be eligible to hold a key subject to their execution of a lease agreement with the MLS. (Amended 5/17)
As a matter of local discretion, associations and MLSs can determine that key lease agreements executed by non-principal brokers, sales licensees, unlicensed personal assistants, administrative and clerical staff, and licensed, certified, or those seeking to be licensed or certified as appraisers, must also be cosigned by the designated REALRTOR® or the office’s broker of record. Lease agreements shall spell out the responsibilities of the parties and shall incorporate by reference any applicable rules or regulations or other governing provisions of the association or MLS that relate to the operation of the lockbox system. The lease agreement shall also provide that keys may not be used under any circumstances by anyone other than the keyholder, except as provided elsewhere in this statement of policy. (Amended 5/17)
Associations and MLSs may, at their discretion, lease keys to affiliate members of associations who are actively engaged in a recognized eld of real estate practice or in related fields. In such instances, the lease agreement shall be signed by the keyholder and by a principal, partner, or corporate officer of the keyholder’s firm. (Adopted 5/17)
Individuals may be required to pay lockbox costs as part of association dues or as part of MLS participation fees pursuant to MLS Policy Statement 7.57, Categorization of MLS Services, Information, and Products and pursuant to NAR Bylaws Official Interpretation #32. No one shall be required to lease a key from the association except on a voluntary basis. (Adopted 5/17)
Associations and MLSs may refuse to sell or lease lockbox keys, may terminate existing key lease agreements, and may refuse to activate or reactivate any key held by an individual who has been convicted of a crime within the past seven (7) years under the following circumstances: (Amended 5/17)
A. The association or MLS determines that the conviction(s) relates to the real estate business or puts clients, customers, other real estate professionals, or property at risk, for example through dishonest, deceptive, or violent acts; and (Amended 5/17)
B. The association or MLS gives the individual an opportunity to provide and the association or MLS must consider mitigating factors related to the individual’s criminal history, including, but not limited to, factors such as:
i) the individual’s age at the time of the conviction(s)
ii) nature and seriousness of the crime
iii) extent and nature of past criminal activity
iv) time elapsed since criminal activity was engaged in
v) rehabilitative efforts undertaken by the applicant since the conviction(s)
vi) facts and circumstances surrounding the conviction(s) and
vii) evidence of current fitness to practice real estate (Amended 5/17)
Associations and MLSs should be sure to evaluate individuals uniformly, and avoid making exceptions for one individual while denying an exception to another individual with a similar criminal history. (Amended 5/17)
Associations or MLSs may suspend the right of lockbox keyholders to use lockbox keys following their arrest and prior to a nal determination on any such charge if, in the determination of the association or MLS, the charge relates to a crime that relates to the real estate business or puts clients, customers, other real estate professionals, or property at risk. (Amended 5/17)
4. Audit requirement. Associations or MLSs shall maintain current records as to all keys issued and in inventory, including registered users accessing lockboxes through applications and software used by mobile devices. There shall be an audit, at least annually, of all keys, whether issued or in inventory. This requirement may be satisfied by a physical inventory or by receipt of a statement signed by the keyholder and the designated REALTOR®, broker of record, or, in the case of an affiliate member, by a principal, partner, or corporate officer of the keyholder’s firm, attesting that the key is currently in possession of the keyholder. (Amended 5/17)
5. Seller authority required. Lockboxes may not be placed on a property without written authority from the seller. This authority may be established in the listing contract or any other written document. Inclusion in MLS compilations cannot be required as a condition of placing lockboxes on listed property. (Amended 5/17)
6. Reporting missing keys. Associations or MLSs must charge keyholders and their cosignatories with the joint obligation of immediately reporting lost, stolen, or otherwise unaccountable for keys to the association or MLS. Upon receipt of notice, the association or MLS must take any steps deemed necessary to resecure the system. (Amended 5/17)
7. Rules and procedures governing lockbox systems. Associations or MLSs must adopt written, reasonable, and appropriate rules and procedures for administration of lockbox systems which may include appropriate fines, not to exceed $15,000. Any issuing fees, recurring fees, or other administrative costs shall be established at the discretion of the association or MLS and set forth in the rules and procedures. All keyholders, whether or not they are association members or MLS participants, shall agree, as a condition of the key lease agreement, to be bound by the rules and procedures governing the operation of the lockbox system. (Amended 5/17)
Key lease agreements may contain a liquidated damages provision to offset some or all of the costs in reestablishing the security of the system if it is determined that the security has been compromised through the negligence or fault of the keyholder. (Amended 11/97)
8. Issuing electronic programmers or keypads on temporary basis.In the event electronic lockbox programmers or keypads are sold or leased, a designated REALTOR® principal or an office’s broker of record may purchase or lease additional programmers or keypads to be issued on a temporary basis to other keyholders in the same office in the event their programmer or keypad becomes non-functional outside normal business hours or under circumstances where a replacement programmer or keypad is not reasonably available from the issuing association or MLS. When a programmer or keypad is issued on a temporary basis, it shall be the responsibility of the REALTOR® principal or the broker of record to advise the association or MLS in writing that the programmer or keypad has been issued, to whom, and the date and time of issuance within forty-eight (48) hours. It shall also be the responsibility of the REALTOR® principal or the broker of record to advise the association or MLS in writing within two (2) business days after possession of the previously issued programmer or keypad has been reassumed. (Amended 5/17) M
9. Requiring “approved” lockbox systems. As a matter of local discretion, associations and MLSs may require placement of an “approved” lockbox on listed properties if any device giving access to real estate professionals or service providers is authorized by the seller and occupant and is placed on the property. The purpose of this requirement, if adopted by an association or MLS, is to ensure cooperating participants and subscribers have timely access to listed properties. Requiring that a lockbox or other access device be “approved” does not limit the devices that satisfy the requirement to lockboxes leased or sold by an association or MLS. The association or MLS may require that the devices be submitted in advance for approval, and the access device may be any lockbox or other access device that provides reasonable, timely access to listed property. The association or MLS also may revoke the approval or subject the participant to discipline if the device is used in a manner that fails to continue to satisfy this requirement. (Amended 05/17) M