CPL or Bonds and Insurance: Which is More Important to Verify Before Doing Business with a Closing Agent?

Many lenders mistakenly believe that as long as they receive a closing protection letter (CPL) from a title agent or closing attorney then they have nothing to fear about a loss that may occur at the closing table.  These lenders may collect an agent’s insurance certificate or declaration page but take no steps to verify insurance is valid, paid and in effect.

There are serious negative consequences with this approach to risk management and loss mitigation.

I have covered the inadequacies of the CPL elsewhere and will not repeat them all today.  To summarize: its not insurance, it does not cover all risk (including cyber, general fraud, wire fraud) and it is aggressively defended when claims are made.  In addition, recovery under a CPL may be restricted if their is a bond or insurance policy available for offset and subrogation which makes verification of those items critical.

Agent’s are not universally required by all states to carry errors and omissions coverage or a fidelity bond so no lender can simply assume that everyone carries them. While no serious professional would operate without having some form of insurance protection, lender’s must inquire because no lender should do business with anyone who fails to carry reasonable coverage.  Quite frankly, no lender should agree to send a wire and loan documents to any professional who does not have insurance coverage sufficient to cover potential losses at a closing.  In today’s wire fraud environment the case for requiring cyber liability coverage (often not covered in traditional E&O) is also highly warranted.

Insurance verification can be a tricky process.  Simply collecting a certificate of insurance or declaration page is not enough.  Policy limits, policy restrictions, previous incident omissions and paid status (i.e. paid in full or financed) are key issues which must be addressed.  Furthermore proper verification cannot take place without an authorization from the agent and confirmation with the insurance office where the policy or bond was issued.

No risk management process is foolproof. No risk assessment tool is 100% accurate. No vendor warranty or guarantee is absolute.  Accordingly lenders must consider how they will manage insurance and bond verification and ensure they have a process in place so that when an event takes place, there will be a reliable source of recovery beyond a restrictive and very limited closing protection letter.

At Secure Insight we obtain digital authorizations from all closing agents allowing insurance and bonds to be verified.  Insurance and bonds are confirmed with the issuing office, payments verified and financed payments tracked.  Our agent risk reports set forth types of coverage, including cyber, and their coverage limits and expiration dates.  We took these steps from day one, way back in 2012, because our process was built in conjunction with risk advisors from Lloyds who understood well the need for comprehensive risk assessment to avoid losses.

In our world where reducing the risk of loss at the closing table is a  paramount concern, we understand that the CPL is not enough to offset and manage a loss event that could cost you hundreds of thousands of dollars and a hit on your reputation.

 

 

New York Law Now Requires Borrower Attorneys at Reverse Mortgage Closings to Protect Consumers from Fraud

Identity theft and misrepresentation in mortgage transactions has traditionally concentrated in the reverse mortgage business.  In these cases one can clearly see how elderly homeowners can be manipulated into taking out loans or selling their homes through unscrupulous means.  Oftentimes these transactions are conducted with powers of attorney and not every lender inquires why such a document is being used, although the form is regularly reviewed for legal sufficiency.  Identity theft is likewise a problem in the reverse mortgage business as fake powers of attorney and forged loan documents and deeds can create a legal nightmare for elderly homeowners as well as the lenders who unwittingly engage with fraudsters instead of the actual borrowers.

A bill in New York state (Assembly Bill 5626) was recently signed into law in January 2020 by Governor Cuomo targeting deceptive consumer practices surrounding reverse mortgages and imposing new requirements on borrower representation during loan closings.

This new law addressed what legislators saw as“deceptive practices,” requiring reverse mortgage lenders to provide supplemental consumer protection materials while imposing additional restrictions on lenders related to their payment of insurance premiums and property taxes. The new law also addressing closing table representation, requirement those involved in the settlement of the mortgage transaction to include licensed New York attorneys.  At least one attorney must be present on the sides of both the lender and the borrower to conduct a reverse mortgage closing.

Consequently lenders in New York engaged in reverse mortgage business must ensure their is proper representation, and with the burden on the lender to manage the issue this elevates vendor management obligations as well.  In the past many New York lenders took advantage of the fact that New York allows a ‘lender attorney” to be at the closing, which meant lenders could avoid scrutinizing closing attorneys and simply maintain a limited approved attorney list to manage the regulatory obligations surrounding third party vendor  risk.

With the requirement that lenders demonstrate borrowers in reverse mortgages had independent legal representation, lenders now must make sure that those attorneys are screened for risk too.

Secure Insight maintains the largest database of pre-screened and risk monitored closing attorneys in the United States.  With thousands of New York attorneys rated for risk, and verified as being licensed, insured, with verified trust accounts and free of background issues that might create the potential for harm, lenders have a ready-made solution to meeting new York’s new mandate.

Check us out at www.SecureInsightSales.com or contact us at in**@se***********.com and let us help you manage your new regulatory obligations in the State of New York. We have supervised more than 8 Million mortgage closings without a loss.

The Importance of Escrow Payment Recipient Name Matching to Avoid Wire Fraud Harm

Yesterday the Federal Reserve Chairman Jerome Powell testified in front of the US House  Financial Services Committee about monetary policy generally, however he was asked an interesting question during his appearance by  Representative Brad Sherman (D-CA).

Rep. Sherman inquired why the Federal Reserve does not establish a payee name matching requirement to prevent wire transfer fraud when wires are criminally misdirected to parties who are not the intended recipient.

Thus if a lender directs that proceeds of a mortgage loan be sent to “John Doe” yet during the closing process an offshore hacker intercepts email communications and substitutes wire instructions so that the wire is sent to “ABC Co. Ltd.” instead, why is the wire even approved?

We know that many banks do verification on incoming wires.  I have had a few wires held up or rejected when the sender misspelled my name or the name of my company.  Why wouldn’t name matching rules be implemented for outgoing wires as well?

While we cannot manage the Federal Reserve name matching rules, here at Secure Insight we do go beyond just verifying that wire instructions were previously used or that they simply match an account at a US bank in the Federal Reserve system.  Our analysts verify that the name on every account matches the name of the vetted and verified account holder, and when there is a discrepancy between what was presented to us and public records (licenses, insurance, bonds, corporate filings we require a written explanation and additional evidence of ownership before the account is posted in an business profile and cleared for our lender to send outgoing wires.

Wire fraud is the single largest risk to banks (and most consumers) today.  It is a multi- billion dollar crime epidemic. While we go along way to make sure our client’s only wire to trusted accounts, and have successfully supervised millions of loan transactions without a wire fraud loss, we encourage the Federal Reserve to examine the issue of payee name matching as an additional and critical component to overall wire fraud deterrence.

The All Too Real Threat of Consumer Identity Theft and What Mortgage Banks Must Do to Help Prevent It

A recent article in Bloomberg Business Week chronicled the SIX YEAR plight of a reporter who was a victim of identity theft.  The cost mentally, physically, financially and to his reputation was severe and life changing.  Consumers are paralyzed without good credit, and the theft of identity can  launch a nightmare scenario involving significant personal losses and restricted access to much needed credit.

Mortgage lenders are obligated through compliance rules as well as state laws to protect consumer non-public information typically collected in the course of the mortgage application, loan approval and closing process so that it does not fall into the wrong hands.  Few truly understand the magnitude of diligence and supervision that is required to effectively protect this sensitive data.  Banks routinely collect nearly all personal and financial data that defines a consumer’s identity and existence while evaluating a mortgage loan application.  This data is handled by many people internally and externally in the course of normal business operations.

To the extent that a lender can manage and control its staff they can effectively, with rules and proper management, prevent losses.  However when lenders deliver some or all of the consumer data to vendors outside their sphere of influence and control the risk rises to a high alert levels.  Does the vendor itself have internal controls?  Are their employees who have access to the data screened and monitored?  How is data stored and protected from intrusion and theft? Does the vendor have sufficient insurance coverage (errors and omissions, crimes and cyber) to offset any potential losses?  These are only some of the critical questions that must be addressed when considering the responsibility a lender has when sharing consumer data.

One of the most serious gaps in managing the risk of consumer data privacy and protection takes place at the closing table. In most instances lenders are sending their money as well as consumer non-public financial and personal information into the hands of people with whom they have a very temporary and superficial relationship. A lender’s ability to assess risk from these transaction partners is too often hampered by the volume of business, lack of trained staff, conflicts where the partners may also be referral sources, and insufficient time to be thorough and analytical in evaluating the level of appropriate risk.

Outsourcing vendor management can be an effective solution provided the vendor assessment company has the tools, technology, process and credibility to assess risk, report on risk and flag issues without causing delays to the loan process or the closing.

Seeking and purchasing insurance is helpful however it is not a deterrent or preventative solution, only a concession that in the event a loss occurs there is a policy limit to offload the financial harm.  By then consumers are outraged, reputations are damaged, and, like the Bloomberg article author it may be years to set things straight.

To learn more about what Secure Insight offers to help manage closing table risk, please visit our website at www.secureinsightsales.com.

 

 

 

 

NCUA Gets Serious About Credit Union Third Party Vendor Management

The National Credit Union Administration, based in Washington, was an early advocate for vendor management policies.  As early as 2001, the NCUA issued a guideline suggesting that credit unions manage third party service provider risk carefully. The suggestion had no real weight however.

After the CFPB issued its Bulletin 2012-3 bringing third party vendor management much more into the compliance forefront, the NCUA  supported the effort but had no real power to enforce similar rules.  I had the pleasure of meeting with NCUA officials in Spring 2012 to discuss the topic and explain what I was creating to help the industry manage closing table risk from third party settlement professionals. While they liked what they saw they could not do much other than wish me luck.

Today news broke in the Credit Union Times that the NCUA’s Inspector General is investigating the issue of vendor risk to credit unions.  The IG indicated that “the agency faces “unique challenges” because it is the only banking regulator without power to supervise.”

Of course many credit unions outsource more than closing table functions to vendors.  The use of CUSOs, credit union service organizations, to act as the “back office” for credit union lending establishes a significant reliance on third parties for a great deal of the mortgage lending process.

The IG told Congress that, “credit unions regularly hire vendors and these relationships pose various potential risks to credit unions, as they must relinquish a certain level of control over products and services to the third party vendor as an inherent part of the relationship.”  The NCUA is seeking authority from Congress for the power to regulate and supervise third-party vendors.  Not everyone agrees, however.

Some in the credit union community do not want additional oversight, which is a common reaction when an unregulated business practice suddenly is caught in the cross hairs of regulatory scrutiny. As we found when we started Secure Insight back in 2012 as the first closing table vendor management tool, change does not come easily.  People who have had unfettered access to the mortgage process without any regulation, or with little regulation, understandably balk at being the subject of risk management scrutiny.

In the end what is best for consumers is best for business.  It is therefore very likely the credit union industry will see enhanced scrutiny of third party vendor relationships in the near future, coming into line with existing regulations governing banks and mortgage lenders generally.

Legal and Ethical Considerations Surrounding the Handling of Consumers’ Private Data by Mortgage Lenders

Never have there been so many legal and ethical considerations surrounding mortgage lender handling of consumer data.  There are good reasons for this fact.

Mortgage lenders have access to the most personal and private information owned and guarded by consumers.  This includes their names, age and dates of birth, marital status, home addresses, work addresses and detailed employment and salary information, assets including bank accounts, credit card and debt information, spouse and family members, and credit scores.  This information is collected usually electronically, occasionally manually, and is passed through the hands and eyes of dozens of persons both within and without an organization as the loan process progresses towards a closing.  It is obvious that the handling of this information represents a significant trust factor, as well as offering ethical and legal considerations which must be appropriately managed at the risk of litigation, regulator and reputation costs.

The Gramm-Leach-Bliley Act, Federal Trade Commission rules, CFPB, OCC and HUD directives, and new state data privacy and security laws (i.e. New York and California) among others, all bring specific obligations and the risk of severe penalties to those who fail to “plan and execute.”

HAR CYB M8U1 Fig 2

Managing this problem, like most operational issues, requires a carefully crafted plan to assure the data collected from trusting consumers does not end up being stolen, lost or abused and thereby causing them harm.  Some key considerations every lender should be addressing include:

  • Having a data privacy policy in place that is known throughout the company, backed by a company environment that places the handling of data at the top of its list of risk management priorities.
  • Having a cyber security policy that addresses how stored data can be properly protected fro outside intrusion and internal negligence and bad actors.
  • Enforcing a “clean desk” policy that prohibits employees from having smart phone and other devices in their workplace which might record or copy sensitive data. This policy should also address the proper handling and disposal of paper records through shredding and locked file cabinets, as the case may be.
  • Training all employees from owners and managers to the newest hire on the importance of data privacy and security, the methods of preventing cyber breaches, and the consequences for negligent and intentional acts causing harm to the company and its clients.
  • Engaging proper tools (software, hardware, and third party service providers) to help manage risk and reduce the likelihood of an event.
  • Conducting appropriate evaluation of risk tools and third party providers to ensure they are working effectively and they are not subject to unacceptable risk as well.
  • Establishing a crisis management policy for when something goes wrong so that you can assess, contain, restore and report an event.

Private data (also known as PII-or Personally Identifiable Information) is entrusted to mortgage lenders with the reasonable expectation that it will be handled appropriately throughout the organization.  Next to medical data, personal and financial data is the most coveted private data sought by criminals for its resale value.  Recognizing their unique role in handling this sensitive information, all lenders must plan and execute appropriately.

 

 

 

Successful Risk Management Requires Proper Top-Down Governance

Any organization seeking to adopt appropriate operational risk management policies and procedures must ensure that they have met the five step process to ensure success.  This process focuses on proper governance.  It is not enough to simply “check the box” and hope that wire fraud, mortgage fraud and closing fraud never reach the organization.

The first step is LEADERSHIP BUY-IN.  Unless the “C Suite” decides to make risk management a priority no effective tools or policies will succeed.  There must be top down leadership in this area.  If your chief risk officer (CRO) or chief security officer (CSO) have to “push” their agenda, then the organization is in trouble.  Effective leadership is not only embracing the issue though, it also means effectively communicating it throughout the organization so that even the receptionist and the part-time employees know where you stand on the issue.

The second step is DEFINED HEAD OF COMPLIANCE.  Someone must be placed in charge.  Studies show that management by committee on risk issues results in failure.  Decide who is in charge  and let them manage with minimal interference.

The third step is ORGANIZATIONAL CULTURE.  As mentioned above, everyone has to buy into the  importance of risk and the method chosen to manage the risk.  Frequently in the mortgage industry sales and operations staff push back on risk management and compliance rules and tools because they are viewed as “disruptive” to their departmental goals (more sales, quick closings).  Without the buy-in of these departments measures to address risk of fraud and cyber crimes will not be successful.  Attitudes and behaviors must fall into line with processes and procedures.

The fourth step is CLEAR PROCESSES AND PROCEDURES.  Putting a process into place or using a tool only works if you go beyond the simple framework itself and successfully implement them.  We have seen lenders engage a tool or service and then never use it or only use it occasionally, without any clear policy directives.  Beyond implementation is testing and oversight.  Someone must be regularly making sure that your risk management tools actually work.

The fifth and last step is having a RESPONSE PLAN.  This is important to understand: No risk management tool or policy is foolproof. When an event occurs, whether a cyber breach, wire fraud or other loss, how you react, how quickly you react, and how you learn from the event can be more important than the event itself.  More than one lender recently has found that reputation risk and litigation risk arise when an organization fails to properly react following an event.

The last point to make is that cyber risk and fraud risk must be an “untouchable” line item in your operating budget.  Addressing these issues cannot be the “last in, first out” business decision we see too often.  When business is down, the risk of harm is GREATER because you do not have the economic cushion to absorb a loss. Good leaders, who manage an effective top-down process and set the proper tone about operational risk will not sacrifice protective tools and policies at the first sign of a market slow down.

We spent 12 years studying closing table risk, including 5 years working with risk analysts at Lloyds. Our closing table risk management tool is designed to meet your operational needs, with little disruption, while providing effective management of the risk of loss from cyber crimes that evolve in wire fraud, and all manner of closing and title fraud.  If you are a business leader concerned about closing table risk, please reach out and ask us how we can provide a solution you and your risk team will embrace.

 

 

When a Closing Attorney’s E&O Policy is not Actually Insurance and Why a Lender Should Care

If you are merely collecting a “Certificate of Coverage” on behalf of a closing attorney and passing them through your loan process as meeting your internal risk management protocols you may be in for an unpleasant surprise if a claim arises.

At Secure Insight we do more than collect insurance certificates, we review policies and validate coverage and payment directly at the source: the insurance agency or insurer where the policy originated.  We ask important questions about the validity and extend of coverage, and exclusions, because in the event of an incident a lender needs to know they can offset risk by filing a claim that will be processed and paid under a valid policy of insurance.

Recently we have discovered a rise in offshore, low cost risk-shared E&O coverage plans.  These companies and policies are designed to exploit the high cost nature of E&O for real estate attorneys and other professionals by offering ridiculously low fees for coverage. Notice I said “coverage” and “fees” and not “insurance” and “premiums.”  That is because these policies are not traditional insurance and are likely not worth the paper on which they are written.

Risk sharing groups in the E&O space are based upon the concept of cooperative pooled risk arrangements.  The idea, which has found success in the health insurance area, relies upon the pooling of all plan participant fees to cover expected losses from claims.  The problems with this arrangement  in the E&O space are numerous.

First, the plan is not an insurance product, and therefore is not governed by insurance laws or regulators.  It is not filed or supervised in the United States.  Second, the companies arranging these risk sharing pools are inevitably based outside the legal jurisdiction of the United States making the enforcement of any lawful claim highly improbable and definitely costly.  We are talking Belize by the way, not Canada, by way of example.  Third these companies have no obligation to publish financials or provide any accounting of the fees being collected and supposedly held in a risk pool for the payment of claims.  Fourth, the policies of coverage (they cannot use terms such as insurance and deductible) usually limit the covering company’s obligations significantly.  One policy issued in Belize that I reviewed recently denied any obligation to defend a covered attorney in the event of a lawsuit and created a right on their part to access the attorneys personal and bank records, tax returns, finances and assets so they can recover their losses directly from the covered party!

It appears many attorneys and others are being misled into believing that they can actually receive $2 Million in aggregate insurance coverage for $400 annually rather than $4,000 annually and they will meet their own risk needs and those of their counter-parties in the mortgage industry.  This is certainly not the case.

At Secure Insight we do more than just collect documents, we do real analysis, assign risk ratings, and monitor risk 24/7.  Reviewing E&O “coverage” is just one way we accomplish that and ensure that our lender clients have a real source to offset potential losses and not one that looks like insurance but is really something else.

To our attorney friends: buyer beware!  As my mother used to say, “If it appears too good to be true it usually is dear.”

New Attorney E & O Exclusion Exposes Lender Closing Table Risk in Massachusetts

We have noticed that in Massachusetts, insurance carriers providing attorney errors and omissions coverage have been quietly adding a new exclusion to their new and renewal policies.  This exclusion is known as the “Disbursement of Funds” exclusion, and it creates enhanced risk for lenders in that state in the event an attorney fails to properly disburse funds.  Any “negligence” in this regard will not be covered as it had been traditionally in the past.

The exclusion reads as follows:

“The following acts are EXCLUDED from coverage under this policy: the disbursement or transfer of funds related to (a) the deposit of a counterfeit check or a check with insufficient funds; (b) the lack of a written verification from the issuing bank that the funds are available and valid, (c) a fraudulent scheme, or (d) the failure of any funds reaching the proper party or the intended recipient, for any reason.”

In a discussion with a Massachusetts agent we learned that some insurers are doing this because (i) the cost of wire fraud is becoming unbearable for them and (ii) they want to push attorneys to pay for cyber liability coverage which would help cover some (but not all) of the risk now being excluded.  Cyber coverage is not mandated for attorneys in Massachusetts.

The problem for lenders is that this new exclusion means that there is NO COVERAGE they can attach for reimbursement for a claim where an attorney disburses funds before a deposited check clears (which occurs far too often) or where an attorney fails to follow the closing instructions and disburses the proceeds to the wrong party or in the wrong amount.  Although these acts/omissions rise to the level of negligence, with this new exclusion there will be no coverage.

At Secure Insight we are encouraging attorneys in Massachusetts whom we monitor to acquire cyber liability coverage and also to certify to the adoption of internal policies and practices avoiding the risks inherent in the excluded matters.

As always, it is critical to keep abreast of all changes in all matters which may affect your mortgage lending business.  At Secure Insight we are watching for you, 24-7, 365 days a year to help prevent losses from title and closing fraud.

Stay vigilant and stay clear of fraud!

NYSAR Reports Up Market for Sales in NY, with No CPL Lenders Face More Purchase Mortgage Closing Table Fraud Risk

Lending in New York?  Purchase money business always carries closing fraud risk, however New York business tends to be riskier for many lenders.  The state has high average loan amounts, features instrument recording procedures that delay evidence of mortgage and deed recordings for long periods of time following the closing, and there is no CPL (closing protection letter) in the state.  Lenders doing business in New York should be pleased business is on the uptick, however if they do not have a closing table fraud prevention tool in their arsenal they may be facing more risk of potential losses due to fraud.

The NYSAR report released today stated in part:

“With 46,883 new listings and 29,100 pending sales across the Empire State in the first quarter, the real estate market is trending upwards, according to the housing market report released today by the New York State Association of REALTORS®. New listings were up 4.1 percent from the first quarter of 2018 while pending sales rose 0.8 percent.

Median sales prices were also up in a quarter-over-quarter analysis, rising 6.8 percent to $275,000. The average home sales price increased 1.5 percent as well to $360,526.

While closed sales declined from the first quarter of 2018, dropping 6.2 percent to 24,405 homes, other factors are allowing potential home buyers to remain optimistic. According to Freddie Mac, the 30-year fixed rate mortgage rate has steadily decreased since the beginning of 2019, falling to 4.27 percent, its lowest rate since January 2018.

With the typically strong spring season just around the corner, inventory continues to rise, increasing 3.4 percent to 63,504 homes for sale across the state.  The month’s supply of homes for sale was up 5.6 percent in year over year comparisons to 5.7 month’s supply. A 6-month to 6.5-month supply is considered to be a balanced market.”