What if a lender requirement conficts with state law

This is an excerpt from a recent article by Jeremy Yohe of ALTA:

“Some national lenders are now requiring in their master service agreements adherence to a six-month data retention policy. This means that all data provided to support a transaction must be disposed of within six months after a transaction closes.”

Has anybody seen this?  If so, how does this align with the NJ requirement to save files for 14 years?

The CFPB’s authority differs from other regulatory regimes

The CFPB’s UDAAP authority differs from other regulatory regimes because it expressly imposes upon a financial institution an affirmative obligation to supervise closely the behavior of its service providers.

The UDAAP Trap: How Financial Institutions can Avoid Penalties when Using Third Party Services | Pillsbury Global Sourcing Practice – JDSupra

http://www.jdsupra.com/legalnews/the-udaap-trap-how-financial-institutio-83421/?utm_source=jds&utm_medium=twitter&utm_campaign=cftc&utm_term= &utm_content=