A recent article in Bloomberg Business Week chronicled the SIX YEAR plight of a reporter who was a victim of identity theft.  The cost mentally, physically, financially and to his reputation was severe and life changing.  Consumers are paralyzed without good credit, and the theft of identity can  launch a nightmare scenario involving significant personal losses and restricted access to much needed credit.

Mortgage lenders are obligated through compliance rules as well as state laws to protect consumer non-public information typically collected in the course of the mortgage application, loan approval and closing process so that it does not fall into the wrong hands.  Few truly understand the magnitude of diligence and supervision that is required to effectively protect this sensitive data.  Banks routinely collect nearly all personal and financial data that defines a consumer’s identity and existence while evaluating a mortgage loan application.  This data is handled by many people internally and externally in the course of normal business operations.

To the extent that a lender can manage and control its staff they can effectively, with rules and proper management, prevent losses.  However when lenders deliver some or all of the consumer data to vendors outside their sphere of influence and control the risk rises to a high alert levels.  Does the vendor itself have internal controls?  Are their employees who have access to the data screened and monitored?  How is data stored and protected from intrusion and theft? Does the vendor have sufficient insurance coverage (errors and omissions, crimes and cyber) to offset any potential losses?  These are only some of the critical questions that must be addressed when considering the responsibility a lender has when sharing consumer data.

One of the most serious gaps in managing the risk of consumer data privacy and protection takes place at the closing table. In most instances lenders are sending their money as well as consumer non-public financial and personal information into the hands of people with whom they have a very temporary and superficial relationship. A lender’s ability to assess risk from these transaction partners is too often hampered by the volume of business, lack of trained staff, conflicts where the partners may also be referral sources, and insufficient time to be thorough and analytical in evaluating the level of appropriate risk.

Outsourcing vendor management can be an effective solution provided the vendor assessment company has the tools, technology, process and credibility to assess risk, report on risk and flag issues without causing delays to the loan process or the closing.

Seeking and purchasing insurance is helpful however it is not a deterrent or preventative solution, only a concession that in the event a loss occurs there is a policy limit to offload the financial harm.  By then consumers are outraged, reputations are damaged, and, like the Bloomberg article author it may be years to set things straight.

To learn more about what Secure Insight offers to help manage closing table risk, please visit our website at www.secureinsightsales.com.

The National Credit Union Administration, based in Washington, was an early advocate for vendor management policies.  As early as 2001, the NCUA issued a guideline suggesting that credit unions manage third party service provider risk carefully. The suggestion had no real weight however.

After the CFPB issued its Bulletin 2012-3 bringing third party vendor management much more into the compliance forefront, the NCUA  supported the effort but had no real power to enforce similar rules.  I had the pleasure of meeting with NCUA officials in Spring 2012 to discuss the topic and explain what I was creating to help the industry manage closing table risk from third party settlement professionals. While they liked what they saw they could not do much other than wish me luck.

Today news broke in the Credit Union Times that the NCUA’s Inspector General is investigating the issue of vendor risk to credit unions.  The IG indicated that “the agency faces “unique challenges” because it is the only banking regulator without power to supervise.”

Of course many credit unions outsource more than closing table functions to vendors.  The use of CUSOs, credit union service organizations, to act as the “back office” for credit union lending establishes a significant reliance on third parties for a great deal of the mortgage lending process.

The IG told Congress that, “credit unions regularly hire vendors and these relationships pose various potential risks to credit unions, as they must relinquish a certain level of control over products and services to the third party vendor as an inherent part of the relationship.”  The NCUA is seeking authority from Congress for the power to regulate and supervise third-party vendors.  Not everyone agrees, however.

Some in the credit union community do not want additional oversight, which is a common reaction when an unregulated business practice suddenly is caught in the cross hairs of regulatory scrutiny. As we found when we started Secure Insight back in 2012 as the first closing table vendor management tool, change does not come easily.  People who have had unfettered access to the mortgage process without any regulation, or with little regulation, understandably balk at being the subject of risk management scrutiny.

In the end what is best for consumers is best for business.  It is therefore very likely the credit union industry will see enhanced scrutiny of third party vendor relationships in the near future, coming into line with existing regulations governing banks and mortgage lenders generally.

Never have there been so many legal and ethical considerations surrounding mortgage lender handling of consumer data.  There are good reasons for this fact.

Mortgage lenders have access to the most personal and private information owned and guarded by consumers.  This includes their names, age and dates of birth, marital status, home addresses, work addresses and detailed employment and salary information, assets including bank accounts, credit card and debt information, spouse and family members, and credit scores.  This information is collected usually electronically, occasionally manually, and is passed through the hands and eyes of dozens of persons both within and without an organization as the loan process progresses towards a closing.  It is obvious that the handling of this information represents a significant trust factor, as well as offering ethical and legal considerations which must be appropriately managed at the risk of litigation, regulator and reputation costs.

The Gramm-Leach-Bliley Act, Federal Trade Commission rules, CFPB, OCC and HUD directives, and new state data privacy and security laws (i.e. New York and California) among others, all bring specific obligations and the risk of severe penalties to those who fail to “plan and execute.”

Managing this problem, like most operational issues, requires a carefully crafted plan to assure the data collected from trusting consumers does not end up being stolen, lost or abused and thereby causing them harm.  Some key considerations every lender should be addressing include:

• Having a data privacy policy in place that is known throughout the company, backed by a company environment that places the handling of data at the top of its list of risk management priorities.
• Having a cyber security policy that addresses how stored data can be properly protected fro outside intrusion and internal negligence and bad actors.
• Enforcing a “clean desk” policy that prohibits employees from having smart phone and other devices in their workplace which might record or copy sensitive data. This policy should also address the proper handling and disposal of paper records through shredding and locked file cabinets, as the case may be.
• Training all employees from owners and managers to the newest hire on the importance of data privacy and security, the methods of preventing cyber breaches, and the consequences for negligent and intentional acts causing harm to the company and its clients.
• Engaging proper tools (software, hardware, and third party service providers) to help manage risk and reduce the likelihood of an event.
• Conducting appropriate evaluation of risk tools and third party providers to ensure they are working effectively and they are not subject to unacceptable risk as well.
• Establishing a crisis management policy for when something goes wrong so that you can assess, contain, restore and report an event.

Private data (also known as PII-or Personally Identifiable Information) is entrusted to mortgage lenders with the reasonable expectation that it will be handled appropriately throughout the organization.  Next to medical data, personal and financial data is the most coveted private data sought by criminals for its resale value.  Recognizing their unique role in handling this sensitive information, all lenders must plan and execute appropriately.

Back in October 2014 the industry had an opportunity to attend a public information session in Washington, D.C. organized by the Consumer Financial Protection Bureau (CFPB).  The meeting was called to announce the results of a public commentary period regarding mortgage closing experiences as well as to announce details of the CFPB’s eClosing initiatives.

The eClosing pilot launched publicly at that time was part of the CFPB’s “Know Before You Owe” mortgage initiative, and the companies participating in the pilot were a mix of technology vendors providing eClosing solutions, and creditors that had contracted to close loans using those solutions. These included Accenture Mortgage Cadence, DocMagic, Inc., eLynx, Pavaso, Inc., and Pierson Patterson, LLP, as vendors, and Blanco National Bank, Boeing Employees Credit Union, Flagstar Bank, Mountain America Credit Union, Sierra Pacific Mortgage, and Universal American Mortgage Company, as lenders.  The participants agreed to work together to examine how electronic closings might help both consumers and lenders save time and money and establish a better, safer consumer experience.

Much has transpired since then, and as we pass the four year mark since that day the landscape regarding eClosings has changed drastically.  Today eClosings are a reality, with a growing number of mortgage lenders adopting the technology platform that allows a borrower to credibly review and execute closing documents electronically.  In addition advances in technology, along with a bit slower regulatory authorization among the states, has made digital and remote notarization an integral part of the eClosing experience.

Lenders are embracing eClosings, slowly but surely and are now seeking to locate settlement professionals, attorneys, title agents and notaries who actually know how to manage an electronic closing transaction.  Consequently eClosing education and training has become a necessary and important resource to match lenders willing to embrace digital mortgages and eClosings with professionals trained to properly manage the process for them during the closing segment of the mortgage manufacturing process.