Online Data Collection Challenge

QUESTION 

Most of our business is from originating mortgages. Recently, we started originating Buy-Now-Pay-Later loans. I know you specialize in mortgage banking. And these are not mortgage loans. However, they are available online just like we offer our mortgages online. 

Our attorney told us that getting a customer's social security number for online Buy-Now-Pay-Later loans poses consumer privacy and information security risks. She says we could collect partial SSN information directly from the customer and then use a third party source to obtain the full SSN before opening the account. 

This is not a practical solution. As the sales manager, I am trying to find some kind of workaround. We need the SSN when the loan comes in online. Processing begins immediately and includes our CIP filters. However, if we use a third party to handle the BSA requirement, there could be a processing delay. 

Hopefully, you can shed some light on how to resolve this situation. Our attorney reads your articles and often sends them to us. So, I'm sure she will read your view on getting online SSN information. 

Can you explain why our attorney is concerned about our online CIP data collection involving Buy-Now-Pay-Later loans? 

COMPLIANCE SOLUTION 

Website Compliance Review 

Policies and Procedures

ANSWER 

Since 2006, Lenders Compliance Group has offered mortgage banking compliance. We do not provide compliance guidance for Buy-Now-Pay-Later (BNPL) loans. The BNPL loan is an installment loan that typically allows a customer to purchase something immediately with little or no initial payment and pay off the balance over four or fewer payments.[i] 

I will answer your question because you have an online origination platform that is used to originate mortgage loan products, where you have now introduced the origination of BNPL loans. 

You do not state if your company is contemplating partnering with a nonbank third party service provider to facilitate BNPL loan originations. 

Read on to find out why that information is a critical compliance element. 

I think there are more reasons for your attorney's directive than is described in your question. Given that you are marketing mortgage and non-mortgage products online, the online platform should be evaluated for its overall compliance with CIP requirements, among other things. Depending on the online consumer disclosures, product and service array, origination technology, and other factors, I think her concern is warranted. 

Please ask your attorney to contact me here. We'll discuss and resolve the situation. 

Your question comes as FinCEN is evaluating, via a Request for Information (RFI), existing requirements for banks under the Customer Identification Program Rule ("CIP Rule") to collect a taxpayer identification number (TIN) from a customer before opening an account. I'll provide a bird's-eye view of the anticipated plans, which may be responsive to your attorney's concerns. 

Generally, banks and nonbanks ("financial institution(s)" or "institution(s)") must collect a full Social Security Number (SSN) from a customer who is an individual and a U.S. person. The RFI, mentioned above, is being issued in consultation with staff at the OCC, FDIC, NCUA, and the Federal Reserve System (collectively, the "Agencies"). 

FinCEN is looking for feedback to understand the potential risks, benefits, and safeguards that could be established if financial institutions were permitted to collect partial SSN information directly from the customer for U.S. individuals and subsequently use reputable third party sources to obtain the full SSN before account opening. So, FinCEN's inquiry seems to align with your attorney's suggestion. Agencies usually issue an RFI because they want certain information to evaluate practices and, in this case, a better understanding of current industry practices and perspectives related to the CIP Rule's TIN collection requirement. So, their inquiry is based on wanting to assess the potential risks and benefits associated with a change to that requirement. 

From the start of anti-money laundering compliance, financial institutions have collected identifying information from a customer before opening an account. FinCEN, in consultation with staff at the Agencies, seeks information and comments from interested parties regarding the CIP Rule requirement for financial institutions to collect a taxpayer identification number (TIN) and other information from a customer who is a U.S. person before opening an account. 

There are minimum standards[ii] for such information collection, including, among other things, reasonable procedures[iii] for 

(1) verifying the identity of any person seeking to open an account to the extent reasonable and practicable; and 

(2) maintaining records of the information used to verify a person's identity, including name, address, and other identifying information.  

It is, therefore, a given that, to satisfy the CIP Rule's TIN collection requirement for a U.S. individual, a financial institution must collect the full SSN from the customer before opening an account. While an institution's procedures for verifying a customer's identity may be risk-based and may vary among institutions, the CIP Rule makes clear that the collection of certain identifying information is a minimum requirement, and such information must be collected directly from the customer before opening an account, except concerning credit card accounts. 

That said, the CIP Rule generally does not allow a financial institution to collect an individual's SSN from a person other than the customer (i.e., a third party service provider). 

When the CIP Rule was adopted, institutions were exempted from the requirement for credit card accounts to collect identifying information directly from the customer, including an identification number. Rather, financial institutions may collect the customer's identifying information, such as the SSN, for credit card accounts, from a third party source before extending credit to the customer. The agency saw at that time that without this exception, the CIP Rule would change an institution's business practices by mandating information beyond what was already obtained directly from a customer who opened a credit card account at the point of sale or by phone. 

Concerns were raised during the proposed CIP Rule's comment period that, for instance, a person applying for a credit card account would be hesitant to provide their SSN, especially through non-face-to-face means, because of consumer privacy and security concerns. 

It seems clear that FinCEN saw requiring a bank to collect a customer's identifying information from the customer in every case, including over the phone, would likely alter how they do business. Consequently, credit card accounts were exempted from the CIP Rule's information collection requirements, allowing banks and nonbanks to obtain, for these purposes, a customer's identifying information from a third party source, such as a credit bureau, before an extension of credit. In its issuances, FinCEN considered this practice an efficient and effective means of extending credit with little risk that an institution did not know the borrower's identity. 

Since the CIP Rule was adopted in 2003, FinCEN has become aware that there has been significant innovation in how customers interact with financial institutions and receive financial services, and in CIP data collection and verification tools available to financial institutions. 

So, here's the crux of the matter: some banks partner with nonbank third party service providers to facilitate new financial products and services. A Buy-Now-Pay-Later loan product is an example of a nonbank financial institution, a third party service provider, that enables such financial products and services by extending credit to customers at the point of sale. 

These products and services operate in a similar manner to credit cards but may be offered by nonbank financial institutions that may or may not be subject to the Bank Secrecy Act (BSA) and its implementing regulations or other comparable regulatory requirements.[iv] Even so, institutions that do not comply with the CIP Rule may face supervisory action, particularly if a nonbank with which a bank has partnered does not collect the customer's identifying information directly from the customer, as required by the CIP Rule. 

The RFI[v] will presumably inform FinCEN's understanding in this area and help the agency evaluate the risks, benefits, and potential safeguards related to certain CIP Rule requirements applicable to financial institutions. Specifically, FinCEN is seeking input from institutions and other interested parties regarding the Rule's SSN collection requirement. The results may allow financial institutions to collect partial SSN information from the customer and use a third party source to collect the full SSN. Partial SSN collection is when a bank collects a certain part of the SSN from individuals who are customers (i.e., the last four digits of an individual's SSN) and then obtains the full SSN from a reputable third party service provider. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] What is a Buy Now, Pay Later (BNPL) Loan?, Consumer Financial Protection Bureau, Issuance (Last Reviewed: December 2, 2021), https://www.consumerfinance.gov/ask-cfpb/what-is-a-buy-now-pay-later-bnpl-loan-en-2119/ 

[ii] Section 326 of the USA Patriot Act amended the BSA to require, inter alia, the Secretary to prescribe regulations "setting forth the minimum standards for financial institutions and their customers regarding the identity of the customer that shall apply in connection with the opening of an account at a financial institution." 

[iii] 13 CFR Part 103, Financial Crimes Enforcement Network; Customer Identification Programs for Certain Banks (Credit Unions, Private Banks and Trust Companies, That do not Have a Federal Functional Regulator, Department of the Treasury

[iv] An example of a nonbank financial institution that is a third-party service provider used to facilitate new financial products and services would be one that provides BNPL loans that extend credit at the point of sale to customers.

[v] The RFI supports FinCEN's ongoing efforts to implement Section 6216 of the Anti-Money Laundering Act of 2020, which requires the agency to, inter alia, identify regulations and guidance that may be outdated, redundant, or otherwise do not promote risk-based AML’s requirements for CFT, the acronym for combating the financing of terrorism.

Online Group’s S.A.F.E Act Violations

QUESTION
In our recent examination, the banking department cited us for S.A.F.E. Act violations. The worst offenders were in our online group. 

The way we’re set up, the online loan officers separate between those who take an application and those who just answer phones and direct the applicants to loan officers. 

It became a licensing issue based on the definition of “taking an application” and whether anyone who spoke to the applicant was licensed in the property’s state. 

Some of the things we now have to do are install a call recording service, monitor all the calls, additional training, quarterly review of all loan officer licenses, complete description of the “hand-off” procedures, and compliance with the S.A.F.E. Act’s definition of originating mortgage loans. 

The biggest problem we face is defining what the banking department calls “mortgage loan originator activities.” We want to revamp the online group, beginning with a new definition. 

What are “mortgage loan originator activities” according to the S.A.F.E. Act?

ANSWER
There are several aspects of your inquiry leading up to the question itself. I have repeatedly said that a financial institution should not go online unless it has the appropriate policies and procedures in place. It appears that your company did exactly what I have argued against doing! I understand the need to get into online sales, but it should not be at the expense of courting regulatory violations. 

If you had come to us to build an online platform, we would have had you work with our checklist and document review that guide you in establishing an online sales group. We would be interacting every step of the way until you launch the platform. 

Such requirements would include not only the items you mention but also many more features that standardize and stabilize the interaction with consumers and ensure federal and, where applicable, state banking law compliance. 

Our firm already has the policies and procedures to conform to your business model. There are several necessary policy documents. But that’s just one feature of the build. 

You need periodic call calibration. Call calibration, which we offer, is an oversight process to monitor, rate, and report on call compliance by listening to recorded calls. Ideally, this should be done by a compliance professional. 

There are numerous disclosure requirements, both oral and written. 

And the threat of being trapped in a licensing violation is real. We have worked with clients that fell into multistate licensing violations and paid millions of dollars in civil monetary penalties. When you say “hand-off procedures,” I say be careful! 

And, most important, you need to understand what constitutes “mortgage loan originator activities” as defined by the S.A.F.E. Act (“Act”),[i] whose implementing Regulation H describes specific requirements for S.A.F.E. Act-compliant state mortgage loan originator licenses and the Nationwide Mortgage Licensing System and Registry.[ii] 

To answer your question, I will treat three fundamental elements that constitute mortgage loan originator activities. The three components are (1) taking an application, (2) offering or negotiating loan terms, and (3) compensation or gain for rendering such services. 

These are not all the possible scenarios but about as comprehensive as I can provide in the space available for this article. If you want more information, please get in touch with me HERE. 

I will base my response on an appendix to the Act.[iii] This appendix is best understood as providing possible examples to aid in understanding activities that would cause an individual to fall within or outside the definition of a mortgage loan originator. Even then, they illustrate only the issue described and do not illustrate any other issues that may arise. 

Let’s begin by describing a residential mortgage loan as any loan primarily for personal, family, or household use that is secured by a mortgage, deed of trust, or other equivalent consensual security interest on a dwelling[iv] or residential real estate upon which is constructed or intended to be constructed a dwelling.[v] 

And, broadly, a loan application is a request, in any form, for an offer (or a response to a solicitation of an offer) of residential mortgage loan terms, and the information about the borrower or prospective borrower that is customary or necessary in a decision on whether to make such an offer. I know this language seems legalistic – and I guess I can’t help myself! – but in this case, every single word counts. Read it again! 

Taking an Application 

The act of taking a residential mortgage loan application means receipt by an individual for the purpose of facilitating a decision whether to extend an offer of loan terms to a borrower or prospective borrower.[vi]

Here are some examples of taking or not taking an application. 

An individual “takes a residential mortgage loan application” even if the individual: 

·    Has received the borrower or prospective borrower’s request or information indirectly, which means an individual takes an application whether they receive it “directly or indirectly” from the borrower or prospective borrower.[vii] It also means that an individual who offers or negotiates residential mortgage loan terms for compensation or gain cannot avoid licensing requirements simply by having another person physically receive the application from the prospective borrower and then pass the application to the individual; 

·    Is not responsible for verifying information. The fact that an individual who takes application information from a borrower or prospective borrower is not responsible for verifying that information – for example, the individual is a mortgage broker who collects and sends that information to a lender – does not mean that the individual is not taking an application; 

·    Only inputs the information into an online application or other automated system; or 

·    Is not involved in the approval of the loan, including determining whether the consumer qualifies for the loan. Similar to an individual who is not responsible for verification, an individual can still “take a residential mortgage loan application” even if they are not ultimately responsible for approving the loan. For instance, a mortgage broker can take a residential mortgage loan application even though it is passed on to a lender to decide whether the borrower qualifies for the loan and the ultimate loan approval. 

An individual does not take a loan application merely because the individual performs any of the following actions: 

·    Receives a loan application through the mail and forwards it, without review, to loan approval personnel. The Bureau interpreted the term “takes a residential mortgage loan application” to exclude an individual whose only role with respect to the application is physically handling a completed application form or transmitting a completed form to a lender on behalf of a borrower or prospective borrower.[viii] 

·    Assists a borrower or prospective borrower who is filling out an application by explaining the contents of the application and where particular borrower information is to be provided on the application; 

·    Generally describes for a borrower or prospective borrower the loan application process without a discussion of particular loan products; or 

·    In response to an inquiry regarding a prequalified offer that a borrower or prospective borrower has received from a lender, collects only basic identifying information about the borrower or prospective borrower on behalf of that lender. 

Offering or Negotiating Terms of a Loan 

The following examples illustrate when an individual offers or negotiates terms of a loan[ix] and, conversely, what does not constitute an offering or negotiating terms of a loan: 

Offering or negotiating the terms of a loan includes: 

·    Presenting for consideration by a borrower or prospective borrower particular loan terms, whether verbally, in writing, or otherwise, even if:

o   Further verification of information is necessary;

o   The offer is conditional;

o   Other individuals must complete the loan process;

o   The individual lacks authority to negotiate the interest rate or other loan terms; or

o   The individual lacks the authority to bind the person that is the source of the prospective financing. 

·    Communicating directly or indirectly with a borrower or prospective borrower to reach a mutual understanding about prospective residential mortgage loan terms, including responding to a borrower or prospective borrower’s request for a different rate or different fees on a pending loan application by presenting to the borrower or prospective borrower a revised loan offer, even if a mutual understanding is not subsequently achieved. 

Offering or negotiating terms of a loan does not include any of the following activities: 

·    Providing general explanations or descriptions in response to consumer queries, such as explaining loan terminology (i.e., debt-to-income ratio) or lending policies (i.e., the loan-to-value ratio policy of the lender), or describing product-related services; 

·    Arranging the loan closing or other aspects of the loan process, including by communicating with a borrower or prospective borrower about those arrangements, provided that any communication that includes a discussion about loan terms only verifies terms already agreed to by the borrower or prospective borrower; 

·    Providing a borrower or prospective borrower with information unrelated to loan terms, such as the best days of the month for scheduling loan closings at the bank; 

·    Making an underwriting decision about whether the borrower or prospective borrower qualifies for a loan; 

·    Explaining or describing the steps that a borrower or prospective borrower would need to take to obtain a loan offer, including providing general guidance about qualifications or criteria that would need to be met that is not specific to that borrower or prospective borrower’s circumstances; 

·    Communicating on behalf of a mortgage loan originator that a written offer has been sent to a borrower or prospective borrower without providing any details of that offer; or 

·    Offering or negotiating loan terms solely through a third-party licensed loan originator, so long as the non-licensed individual does not represent to the public that they can or will perform covered activities and does not communicate with the borrower or potential borrower. 

Examples:

-    A seller who provides financing to a purchaser of a dwelling owned by that seller where the offer and negotiation of loan terms with the borrower or prospective borrower are conducted exclusively by a third-party licensed loan originator.

-    An individual who works solely for a lender, when the individual offers loan terms exclusively to third-party licensed loan originators and not to borrowers or potential borrowers. 

Compensation or Gain 

An individual acts “for compensation or gain”[x] if the individual receives or expects to receive, in connection with the individual’s activities, anything of value, including, but not limited to, payment of a salary, bonus, or commission. 

Note: The concept “anything of value” is interpreted broadly and is not limited only to payments contingent upon the closing of a loan. 

An individual does not act “for compensation or gain” if the individual acts as a volunteer without receiving or expecting to receive anything of value in connection with the individual’s activities. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director
Lenders Compliance Group
_____________________________
[i] 12 CFR Part 1008 – S.A.F.E. Mortgage Licensing Act – State Compliance and Bureau Registration System (Regulation H)
[ii] Regulation H was issued by the Consumer Financial Protection Bureau to implement the Secure and Fair Enforcement for Mortgage Licensing Act of 2008, title V of the Housing and Economic Recovery Act of 2008 (S.A.F.E. Act) (Pub. L. 110-289, 122 Stat. 2654, 12 U.S.C. 5101 et seq.)
[iii] See Appendix A to Part 1008
[iv] As defined in section 103(w) of the Truth in Lending Act
[v] Ibid, as defined
[vi] See § 1008.103(c)(1)
[vii] Ibid
[viii] This interpretation is consistent with the definition of “loan originator” in section 1503(3) of the S.A.F.E. Act.
[ix] See § 1008.103(c)(2)
[x] See § 1008.103(c)(2)(ii)