Yes, if the firm is covered by the FTC Safeguards Rule as mortgage lender, it needs a written security program for customer information. Citation: 16 CFR Part 314 and FTC Safeguards Rule business guidance.
Primary source: FTC Safeguards Rule business guidance
Does a mortgage lender need a WISP?
Details
extends, arranges, purchases, or services consumer mortgage credit outside a banking regulator's Safeguards jurisdiction. Borrower files include credit, income, tax transcript, bank, employment, appraisal, title, underwriting, and closing data. Information usually crosses a loan-origination system, warehouse or investor portal, settlement vendors, and servicing handoff records. A small lender may still cross 5,000 consumers quickly through leads, denied files, originated loans, and servicing records. Under 16 CFR 314.6, the threshold analysis changes only the listed subparts, not coverage.
Primary source: FTC Safeguards Rule business guidance.
FAQ
Does a mortgage lender need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as mortgage lender, it needs a written security program for customer information. Citation: 16 CFR Part 314 and FTC Safeguards Rule business guidance.
What is the data-flow issue for a mortgage lender?
Borrower files include credit, income, tax transcript, bank, employment, appraisal, title, underwriting, and closing data. Information usually crosses a loan-origination system, warehouse or investor portal, settlement vendors, and servicing handoff records.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.