Yes, if the firm is covered by the FTC Safeguards Rule as mortgage broker, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(xi).
Primary source: 16 CFR 314.2(h)(2)(xi)
Does a mortgage broker need a WISP?
Details
brokers loans for consumers or routes mortgage applications to lenders. Borrower data moves through lead intake, loan-origination systems, credit pulls, document-upload portals, income and asset verification, lender submissions, and broker email. The WISP should name both the LOS and the lender/vendor portals where nonpublic personal information leaves the broker's direct system. Small broker shops may fall below 5,000 consumers, but retained leads, denied applications, and old loan files count toward the data footprint the firm should evaluate. The 16 CFR 314.6 exception removes four listed obligations only.
Primary source: 16 CFR 314.2(h)(2)(xi).
FAQ
Does a mortgage broker need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as mortgage broker, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(xi).
What is the data-flow issue for a mortgage broker?
Borrower data moves through lead intake, loan-origination systems, credit pulls, document-upload portals, income and asset verification, lender submissions, and broker email. The WISP should name both the LOS and the lender/vendor portals where nonpublic personal information leaves the broker's direct system.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.