Managed IT services for mortgage brokers start with the loan file. It holds pay stubs, tax returns, bank statements and identification, and it is passed between a loan officer, a processor, a lender and a title company. Every handoff is a place for a copy to be made.
The rule that already points at you
The FTC’s Safeguards Rule lists a mortgage broker as a financial institution, because brokering loans is a financial activity. It then asks for a written information security program. In its list of elements, the rule includes:
- a qualified individual who oversees the program,
- a written risk assessment,
- access controls that are periodically reviewed,
- encryption of customer information held or sent,
- multi-factor authentication for anyone accessing any information system, and
- notice to the FTC when an event involves at least 500 consumers, no later than 30 days after discovery.
Several requirements depend on the size of the business. Read the rule with your counsel to see which ones apply to you. We can’t tell you that you are compliant, and no tool can. What we can do is carry the technical parts of the list.
Where the file really goes
On paper, the file lives in the loan origination system, or LOS. In practice it spreads.
A borrower photographs a pay stub and texts it. A processor downloads a PDF to attach somewhere else. A loan officer forwards a statement to a personal address to read at home. None of that is malicious. Fixing it is partly tools and partly routine: a borrower portal or secure upload link, phones with locks and remote wipe, and an end-of-week habit of clearing downloads.
What a brokerage runs
| Category | Used for | What goes wrong |
|---|---|---|
| Loan origination system | Applications, conditions, status | Shared logins, no record of who changed what |
| Borrower portal or secure upload | Collecting documents | Borrowers email instead, because it is easier |
| Pricing and lender portals | Rates, submissions | Credentials kept in a notes file |
| E-signature | Disclosures and consents | Links forwarded to the wrong address |
| Credit reporting access | Pulling reports | Access for people who no longer need it |
| Email and phones | Everything else | Documents stuck in inboxes and camera rolls |
Wires and payoffs
Closing time is when fraudsters strike, because money is about to move and everyone is in a hurry. A message arrives that looks like it is from the title company, with new wiring details. The defence is a process, not software: payment instructions are confirmed by phone, using a number from the original file, before anything moves. Add multi-factor sign-in on email, so a stolen password alone doesn’t give anyone a seat in a live deal.
Rate-lock weeks
Rate locks and application deadlines don’t wait for IT. We avoid changes to the loan system, email or phones in the days before a heavy closing stretch, and we keep a short list of who to call at each vendor. A processor locked out of the LOS on the last day of a lock is a real cost.
Questions for any IT provider
- Who is the qualified individual, and what do you provide to support them?
- How do borrowers send documents, and how do we stop attachments?
- Who reviews access to the LOS, and how often?
- What happens to a departing loan officer’s phone and files?
What we need from you
- Your systems list and who administers each.
- Your current written program, if you have one.
- A walk-through of one loan file from application to closing.
- Your closing checklist, especially the payment steps.
Monthly care covers access controls, backups and updates. The free IT check ends in a plan and a fixed quote.
A loan file should live in one place. Everything else is a copy, and copies are what get lost.