Apply Confidentiality Requirements - Nationwide Multistate Licensing System NMLS
- Find the compliance error: leaving a loan file with NPI visible on an unattended desk.
- Error: unsecured NPI; correct: secure file in locked/controlled area. Leaving files unattended violates GLBA by exposing NPI to unauthorized access, requiring secure storage to maintain confidentiality.
- Identify the best practice for emailing documents that contain NPI to a third party.
- Use secure encrypted delivery and verify recipient authorization. Encryption and verification comply with GLBA by protecting NPI during transmission and ensuring delivery to authorized parties only.
- What is the minimum rule for discussing a borrower's loan details by phone?
- Authenticate the caller and confirm authorization before disclosure. Authentication prevents unauthorized disclosure of NPI, aligning with GLBA and FCRA requirements for protecting borrower privacy.
- Which recordkeeping item must be retained to evidence borrower authorization to proceed?
- Documented intent to proceed and related disclosures acknowledgments. Retaining these records demonstrates borrower consent and compliance with disclosure requirements under regulations like RESPA.
- Choose the correct action when an unauthorized person emails requesting loan status details.
- Decline disclosure and request borrower authorization or verified authority. Declining protects NPI under GLBA and FCRA by requiring verified authorization to prevent unauthorized information sharing.
- Identify the best immediate step after sending NPI to the wrong recipient by email.
- Notify compliance, attempt recall, document incident, follow breach protocol. Immediate notification and protocol adherence minimize breach impact, complying with GLBA incident response requirements for data security.
- What does GLBA define as nonpublic personal information (NPI) in a mortgage file?
- Personally identifiable financial information not publicly available. GLBA classifies NPI as private financial details that identify individuals and are not accessible from public sources, requiring protection.
- Identify the violation: faxing a borrower's paystubs to a number not verified with the recipient.
- Violation: unverified disclosure; correct: verify number and authorization. Unverified faxing risks unauthorized NPI disclosure, breaching GLBA; verification ensures secure and authorized transmission.
- What is the correct disposal method for documents containing NPI under GLBA principles?
- Shred, pulverize, or securely destroy to prevent reconstruction. Secure destruction methods under GLBA prevent data reconstruction, safeguarding NPI from unauthorized recovery and potential misuse.
- Which document provides consumers the annual notice of a company's privacy practices under GLBA?
- Privacy notice (initial and, when required, annual privacy notice). GLBA requires financial institutions to inform consumers of privacy policies via initial and annual notices to promote transparency.
- Which action best reduces risk when using third-party vendors for processing or storage?
- Execute contracts requiring safeguards and monitor vendor compliance. Contracts and monitoring ensure vendors adhere to GLBA Safeguards Rule, mitigating risks of data breaches in outsourced services.
- What is the primary purpose of mortgage transaction recordkeeping requirements?
- To document compliance and support audits, examinations, and consumer disputes. Recordkeeping ensures evidence of regulatory adherence, facilitates audits, and resolves disputes by maintaining verifiable transaction details.
- What is the required approach to storing e-sign consent records for e-disclosures?
- Retain verifiable E-SIGN consent and delivery evidence in the file. E-SIGN Act requires verifiable consent and proof of delivery to ensure electronic disclosures are legally valid and auditable.
- Which federal law requires safeguarding customer information through a written security program?
- Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. The GLBA Safeguards Rule mandates financial institutions to implement a comprehensive information security program to protect customer data.
- Identify the confidentiality rule for sharing a borrower's information with an appraiser.
- Share only what is necessary and only with an authorized provider. Limiting sharing to necessary information with authorized appraisers upholds GLBA principles of data minimization and privacy protection.
- Which option best describes the need-to-know standard in mortgage offices?
- Access to NPI is limited to job-related necessity. The need-to-know principle under GLBA restricts NPI access to essential personnel, minimizing breach risks and ensuring compliance.
- Which option is the best description of a complete mortgage compliance file for audits?
- All disclosures, underwriting docs, communications, and change logs. A complete file includes all relevant documents to demonstrate full compliance with federal regulations during audits and examinations.
- Which federal law governs permissible purposes for obtaining and using consumer reports?
- Fair Credit Reporting Act (FCRA). FCRA establishes permissible purposes to protect consumer privacy by regulating access and use of credit information.
- What is the confidentiality requirement for Social Security numbers in mortgage records?
- Restrict access, minimize display, and secure storage and transmission. SSNs are sensitive NPI under GLBA, necessitating strict controls to prevent identity theft and unauthorized access.
- What is the general confidentiality rule for a borrower's credit report in a mortgage file?
- Use and disclose only for a permissible purpose and limit access. FCRA limits credit report use to authorized purposes and restricts access to prevent unauthorized disclosure and ensure data security.
- What is the correct handling of paper loan files when not in use during the workday?
- Store in a locked cabinet or secured area with controlled access. Secure storage complies with GLBA Safeguards Rule by preventing unauthorized access to physical documents containing NPI.
- What is the required action if you take an adverse action based on a consumer report?
- Provide an adverse action notice with CRA and rights information. FCRA requires adverse action notices to inform consumers of denials based on reports, including CRA details and appeal rights for fairness.
- What is the correct response if a real estate agent requests the borrower's credit score?
- Do not disclose without borrower authorization and a permissible purpose. Disclosure without authorization violates FCRA permissible purpose rules, protecting borrower privacy from unauthorized third-party access.