Mortgage Software Solutions Blog

Cyber Security Seatbelts Save Digital Lives

digital seatbeltsWear a seatbelt—navigate your cloud-based systems with safety in mind. 

“Safety first.”

It’s a pretty easy idea to agree on. We all think safety is important.

So what do we do when customers say we aren’t being safe enough?

2017 saw the largest consumer data breach in world history. Equifax made international headlines for a breach that exposed the personal information of as many as 143 million people.

As Equifax knows well, financial and credit-related information is extremely valuable to cyber criminals. Hacks of this kind need to be protected against.

Consumer Safety

After many years of unsafe automobiles, consumers were tired of dangerous cars. They demanded that the industry clean up its act to make vehicles safer. With a little help from activists, car makers complied.

With government regulations in place, riding in a car has changed. Now all cars are made with seatbelts and few people get into a car without buckling up.

The auto industry’s move towards standard safety precautions can teach finance folks a lesson about how to face consumer demand for safety.

Cyber Seatbelt

Safety precautions for automotive vehicles began with the simple safety belt.

The seatbelt of the mortgage industry is MFA security, which keeps data safe.

The safest “seatbelt” on the market, it’s time to implement multi factor authentication when your company migrates into the cloud.

For your staff, a cloud-based workspace makes work convenient and accessible. For cyber criminals, migration to the cloud means they have a doorway to try and break in.

Also known as MFA, multi factor authentication is a nearly fool-proof way to prevent the wrong people from accessing your company’s data.

MFA requires that employees accessing the cloud have to enter at least 2 forms of digital identification. MFA validates that the person logging into the system is who they say they are. Whether by a text message to their company phone or another form of ID, staffers are let in and hackers are kept out.

MFA is so secure, it has become the modern standard for financial institutions. It was adopted by the Payment Card Industry Data Security Standard (PSI DSS) in February of 2017. It was also listed as the standard for the mortgage industry in New York’s new cyber security legislation.

For any financial institution that works in the cloud, MFA is the first safety precaution that can protect both the company and consumers.

If MFA is the visible seatbelt, what are the airbags that provide safety behind-the-scenes?

Cyber Airbags

Email Guardian is a product developed by a US-based company specifically to keep financial information secure for mortgage companies.

Its main job is to watch business email. It checks URLs on incoming messages to watch for phishing attacks. It filters every link and tests linked sites to make sure they are clean. If a link is dangerous, this program catches it and breaks the link before your staff can click-through.

It protects companies from intrusion by providing comprehensive, multi-layered email security and content controls. A web-based application especially for financial institutions and big business, this application handles dynamic security precautions including email encryption and security tracking as well.

Just like how airbags provide a layer of cushioned protection for car drivers and passengers, this innovative technology provides layers of security to keep email hackers at bay and avoid catastrophe.

With MFA and Email Guardian combined, your company data remains out of harm’s way.

Lessons from the Auto Industry

Just as with unsafe automobiles, consumers are reacting to the Equifax disaster by demanding that something be done about info protection for credit companies and mortgage brokers.

Government regulators have begun to react as well. New York introduced groundbreaking legislation to regulate cyber security for financial institutions. Colorado and Vermont are following suit.

When consumers make an industry-wide demand, companies need to pay attention.

Since widespread consumer outrage over information leaks continues making news and influencing regulators, mortgage companies are wise to adopt security measures and establish a basis of protection for their customers.

In the same situation decades ago, auto manufacturers made serious efforts to improve consumer protection for their products. Today carmakers are seen by the public as one of the most safety-conscious industries.

Taking care of consumer data is important if lenders want to be seen in the same light in the future.

ABT’s cutting-edge Email Guardian application provides strict security breach protection and data leakage prevention. Contact us to learn more.

Image: VisualHunt.com

Topics: Mortgage Cloud Services cyber security email security data security social networking safety cybersecurity security mobile technology mortgage industry HUD Consumer Finance Protection Bureau Compliance for Mortgage Companies Compliance Audit Housing Market network safety MBA

2018 Changes in Banking Technology Part II

blog pic 3Finance customers turn to mobile banking technology.

New technology continues to change the banking landscape.

For mortgage lenders, finance technology or “fintech” startups are competing to attract lending clients.

Smartphone-obsessed customers are more mobile than ever and the number of banking platforms has exploded. With 46% of consumers using only digital channels for their banking, the way that customers handle their finances is taking a huge shift.

Here are 3 more ways that new technology is changing the banking industry in 2018.

  1. Cybersecurity

Cybersecurity in the financial industry is experiencing a worldwide crackdown in response to infamous missteps in 2017.

Last year was rough. Large businesses from Uber to Equifax came clean with the public about record-breaking customer data breaches.

As a result, new regulations concerning finance-related cybersecurity have made it onto the books in the United States, Europe, and the United Kingdom. Stricter regulations even include naming and shaming in the public forum. For example, starting in 2018 the Financial Conduct Authority requires UK banks to publish data on how many complaints and security breaches they have encountered throughout the year.

Formerly held accountable by regulatory bodies within the banking industry, now financial institutions will be facing not only federal law but public opinion. With leaders like the EU, the UK, and the US taking the lead, other world markets are sure to follow.

High-tech options in identification and recognition are hitting the market as a way to shore up security. Biometric security and voice verification software are in development and beta testing. The new measuring stick for basic security begins at multi-factor authentication.

Mortgage lenders at any level would be smart to take notice and sort out their cybersecurity issues. The only other option is to risk having their name added to the growing list of internationally untrustworthy companies in the eyes of consumers.

  1. Mobile Investing

Another new technology on the market takes investment consultations out of the local branch and drops it right into the investor’s pocket.

A full 82% of 18 to 24-year-old smartphone owners say they use mobile banking exclusively. 

Feeding the demand for putting banking applications onto mobile devices like smartphones and tablets, fintech is making lending and investing more accessible than ever.

This new wave of mobile finance is letting millennial do-it-yourselfers have all the control by using plain language and visuals to explain financial terms. Bankers are replaced by explanatory screens and animations. Investment apps even let new customers dip their toes in the investing game by allowing customers to have a “practice run” before dealing with actual money.

Small-scale investment companies are reshaping the barriers to entry by allowing new investors to get in the game for as little as £250 in the UK. These game changers are coming about due to aims of open banking legislation strategies for reducing monopolies.

This new family of mobile investing apps offers greater control than traditional banks over their mobile-based portfolios, even allowing customers to pick and choose investment baskets based on trending labels like “socially responsible tech”.

  1. New Technologies

Beyond cybersecurity and innovation in mobile investing technology, there is a host of newly-developed niche finance technologies hitting the market.

Robo investing automates the risk appetite assessment process.

Full integration of voice assistants are popping up. Capital One partner Alexa can now tell customers their account balances and spending habits after a night out.

Though historically skeptical towards bitcoin and cryptocurrency, credit giant Mastercard changed their tune in 2018 and announced open support for virtual currency in the Asian-Pacific market.

It’s too early to predict which of these new technologies will have staying power and which ones just won’t stick, but they all have one thing in common. They all work on the basis of a hybrid platform that combines human and computer-based tools to carry out financial services.

These new integrations of technology into the banking world are already changing the way that consumers approach banking.

With 2018 is primed to be the year that tech saturates the finance industry, mortgage lenders and other traditional finance institutions have no choice but to take notice.

Join us at the cutting edge of technology with regulation-compliant cyber security, remote device access, and more. ABT equips mortgage lenders with the tools for success in a digital world.

Image: Unsplash

Topics: mortgage regulations mobile technology mortgage industry partnerships Consumer Finance Protection Bureau Compliance for Mortgage Companies Compliance Audit job opportunity Trump Administration Mortgage Lending

What Technology Is Changing In Banking For 2018

blog pic 4In the future, financial information and programming will be increasingly available on-the-go.

The old days of purely brick-and-mortar banks are over.

Mobile banking is the preferred platform as global smartphone use skyrockets and our preference for handheld interaction grows.

In 2011 only 10% of the world’s population used a smartphone. By 2018, that number has reached over 36% penetration.

From traditional commercial banks to finance technology or “fintech” startups, the banking industry is competing in an all-out sprint towards digital progress.

Here are 4 ways that technology is changing the banking industry in 2018.

  1. Open Banking

Open banking is a phenomenon being pushed by regulatory bodies around the world.

Lawmakers in the EU, UK, and the US have all passed legislation that takes personal financial data out of the hands of the banks and returns control to consumers.

The EU’s Payment Services Directives (PSD 2007 and PSD2 2015) will be fully implemented this year.

Together the PSDs regulate financial service providers by requiring transparency about consumer rights and the banks’ obligations to the public. They also require banks to free up customer data for third party access, limiting the power of the bank that gathered it.

The EU regulations coincide with the “Open Banking revolution” in the United Kingdom that intends to make banking more competitive for increased consumer protection. The UK also made it mandatory for all banks to provide third-party access to customer financial data using open API technology at the start of 2018.

In the wake of the Equifax data breach on the other side of the Atlantic, the United States made their move towards stricter regulations beginning in 2017 with the state of New York. US laws are focused on cybersecurity and consumer protection via speedy cyber attack reporting and increased government oversight of consumer data mishandling.

The proximity of these launch dates mean that traditional banks around the world face new technology-based limitations. Open banking and cyber security requirements leave the door open for tech-savvy challengers with a spotless reputation for safeguarding the public.

  1. RegTech

Another technology changing global banking in 2018 is regulation technology or “RegTech”.

RegTech is the umbrella term for software tools specifically designed to streamline regulatory compliance.

In the EU, RegTech has been using guidelines from the 2004 and 2011 Markets in Financial Instruments Directives (MiFID) as well as the General Data Protection Regulation (GDPR) of 2014.

Newly developed RegTech takes new 2018 regulations into account and eliminates duplication issues and insufficient data storage signposting.

Due to increased regulation, the adoption of these programs across the industry will determine which finance organizations move ahead and which ones get stuck hitting every legal bump in the road.

If implemented well, RegTech has the potential to significantly reduce risk, speed up compliance management, and control bank costs despite increased accountability.

  1. Robo Advice

“Robo advice” is the term for technology that does traditionally human jobs in investment banking.

In the past, investment managers evaluated a customer’s financial situation, communicated investment options, assessed risk appetite, handled portfolios according to client preferences, and relayed information about performance back to the investor.

Robo advice is the software and algorithms that provide these services digitally and accessibly on mobile devices like smartphones and tablets.

Millennials aged 22-37 prefer to work with apps and digital information over commercial banks. The demographic has a do-it-yourself attitude and shows an aversion to traditional banking institutions that have steered them into crushing student debt.

In fact, 75% of American millennials report trusting a financial product from a fintech company. Almost half of millennials in the US with investments report being aware of robo-advisors, while a full 11% currently use a robo-advisor exclusively.

With a frictionless user experience, robo advice may become the new norm.

  1. New Technology

In the UK, financial services newcomers are edging out traditional banks. Startup lenders like Iwoca in the UK are touted as the “future of small business lending” by using software algorithms to make credit decisions and having quick loan turnaround thanks to fintech.

By using all-digital or hybrid platforms combining human and algorithmic tools to reach customers, other digitally-native finance startups are slated to follow their lead.

Whether it’s anti-monopoly Open Banking APIs, intelligent RegTech software to handle compliance, or the growing preference for robo advice over human interaction, technology is making huge waves in the global banking industry this year.

As the digitally-native generations grow, traditional financial institutions scramble to expand their digital offerings while fintech startups flourish and join the market.

Join us at the cutting edge of technology with regulation-compliant cyber security, remote device access, and more. ABT equips mortgage lenders with the tools for success in a digital world.

Image: Visual Hunt

Topics: millennials cloud storage mortgage business mortgage regulations mobile technology mortgage industry Consumer Finance Protection Bureau Compliance Audit job opportunity cloud-based data Trump Administration Housing Market Mortgage Lending

Time for Lenders to Take Responsibility for Data Security

sharky

Lenders and customers face the dangers lurking in the finance world.

Since when do finance organizations rely on customers for security advice?

An investigation into US mortgage lending practices found that 70% of lenders regularly put sensitive financial data at risk by prioritizing customer convenience over security.

While customers often choose to send personal information via quick and familiar technology such as fax or unencrypted personal email, lenders continue to look the other way rather than correct these dangerous habits.

Something has gone awry in the lending industry and customers are taking notice.

It’s the responsibility of the lender to uphold security measures. Lenders have security tools at their disposal. Instead of leaving the doors open to data thieves, they should be insisting on secure email portals and other measures that protect the consumer.

As technology advances for both financial institutions and the data thieves that seek to attack them, it’s time for lenders to take the reins when it comes to customer security.

Financial Services are at High Risk

The two main dangers facing the finance industry are data breaches and security incidents.

A security incident describes any occurrence that has the potential to compromise consumer information. This can be an attempted data theft or an attempted hack into a computer system that stores sensitive information.

A data breach is more serious. Breaches are confirmed disclosures to an unauthorized party. Breaches represent a complete failure of the security system to keep the wrong people out.

An investigation of data breaches across industries finds that Financial Service organizations like mortgage lenders fall into the top three industries affected by successful hacks. In fact 2016 saw 1,368 security incidents and 795 confirmed data loss cases in the finance industry.

Given the value of the data that mortgage lenders collect, mortgage companies remain among the most vulnerable to cyber attacks.

Cyber Security Issues to Watch For

As mentioned, one security vulnerability is with lending staff. Sophisticated cybersecurity standards don’t mean anything if your employees are side-stepping official procedure. Documents with any sort of consumer data should only be shared within secured environments.

Round up the staff and reiterate how the company (and perhaps their job) relies on following the rules. Employee negligence and unsafe information disposal are not to be tolerated.

It’s also a good idea to get coordinated with your IT department. Are staff members using mobile devices like smart phones and tablets to handle sensitive information? Your IT department can install security measures like password protection and encryption so that these devices are cleared for proper company use.

Besides training and an IT device round-up, make sure your software access is secure. Multi-factor authentication or MFA is another way to seriously step up your security game.

After you’ve cleaned house, check your neighbors. Third-party services and their software tools cannot be overlooked. Anything handled by another organization that concerns your company’s customers should meet the same stringent security standards that you enforce in-house.

The Financial Cost of Cyber Attacks

Though financial institutions may have always had customer security in mind, the industry has felt the backlash in recent years.

Historically respected companies are losing consumer confidence. Beyond topping lists for riskiest industry, some of the big names have taken very public falls.

Equifax, a national name in credit scoring, experienced a hack in late 2017. The breach resulted in unsavory national headlines, a PR crisis, the involvement of the FTC, and a resulting push for never-before-seen legislation that regulates the whole industry.

Beyond reputations, there is money at stake. The financial cost of cyber attacks has been on the rise in recent years.

The average cost per capita of a Financial Services data breach in the US has increased by 10% in three years. In 2016 it reached $221 per person as a shared cost that consumers are burdened with thanks to lenders being devil-may-care with their information.

With consumers taking the hit and their financial institutions being degraded by cyber attacks, the industry is set to lose a lot of money.

Clearly, it’s time for a serious turn towards cyber security in order to prop the industry up in the eyes of consumers.

For mortgage lenders, it’s time to turn away from business as usual and make a serious effort to put cybersecurity at the top of the priority list. Not only will this protect valued customers, but it will save the reputation of an industry that has taken enough hits.

Businesses protected by a cloud-based portal with access secured by MFA are leading the industry in the push for cyber security. To find out about security-focused programs like Document Guardian contact ABT.

Image: Laura College on Unsplash

Topics: phishing security mortgage industry Compliance Audit DFS 23 NYCRR Part 500 NYSDFS network safety

How New York’s Latest Cyber Security Law Will Impact You

sgfhj.jpgNew cyber security laws in New York mean strict accountability for businesses.

Cyber security is on the brink of an unprecedented crackdown in New York.

The finance industry is preparing for a new normal that looks vastly more stringent than before.

Part reaction to consumer outrage and part finger-pointing to the market for accountability when it comes to data breaches, the regulation titled Cybersecurity Requirements for Financial Services Companies (2017) is a broad re-draw of the rules by the state regulator.

In a country where the sector has historically played fast and loose with handling missteps, all eyes are watching to see how quickly it can adapt to the new normal.

As everyone settles in for the ride, industry insiders are already forming hypotheses about how far this new regimentation will reach.

Laying Down the Law

The new law outlining consumer data security measures in New York State is the first of its kind in the United States.

Officially released in March of 2017 with a built-in year of lag time, the enforcement date has arrived. As of Thursday February 15, 2018 enforcement is in full effect.

Financial institutions are expected to have stepped up their game in safeguarding computer systems and the sensitive information stored inside. A full guide to the highly prescriptive requirements can be found here.

The end goal is to avoiding security breaches by making businesses sufficiently fearful of repercussions. If they do foster an environment that allows for future problems or leaks of personal data, the stakes are high.

Who the Law Affects

The current law has been interpreted to include all banking, insurance, lending, and mortgage brokerage firms that are operating in New York. Every company under that heading will be held to the new standard.

This means that entities must get in gear to assess their actual and potential cybersecurity risks and make a solid plan to mitigate them.

The good news for IT departments is that due to the highly detailed guidelines about policy and the use of technology to patch up the security gaps, they have rather exact instructions to follow.

Beyond State Lines

At first glance, companies outside of New York might assume they have been spared from the harshest regulations in the country. After a closer look, it seems imminent that the change will have a wide-ranging impact.

Going forward, consumers will rely on their financial institutions to keep personal data safe. Not only are the expectations high, but the safety net sets the stage for demanding the same in other states.

Mortgage companies across the country are targeted by hackers due to the quantity of information and the quality of its use for fraud purposes. Companies outside of New York in the same industry should brace for the arrival of comparable laws on their home turf.  

Out-of-state entities with branches in New York should have a response as well, even before their own states begin drafting something similar.

In fact, other states are already following suit. Colorado and Vermont introduced their own measures within months after the NY regulation was put in place.

Vermont’s law names “securities professionals” as the intended subjects of its tighter regulations. Without specifying banks, the use of this broad term leaves the door open for enforcement with entities that may not previously fall under the state’s traditional regulation agencies.

As a global financial hub, even entities doing business in New York should consider getting the jump on re-assessing their policies as a continuity plan.

Beyond the Finance World

The effect of intensified scrutiny over cyber security practices will logically spill over to third-parties who work in the finance world and businesses who directly manage cyber security for the industry.

Fortune magazine goes one step further, predicting that ripple effect will go well beyond the financial industry. It could cover security events by any business that stores personal data “from point-of-sale to payroll providers.”

After that, it seems the industry shake-up will likely bleed into any major industry that houses consumer data using any sort of technology. These days, companies who aren’t keeping customer information in a computer system are few and far between.

The only thing the industry seems sure of is how this trend in accountability will not be contained by state lines or by industry.

In the early days of this new law’s enactment, the extent of this chain reaction is yet to be seen.

Over the next fiscal year, New Yorkers will lead the way, with countless gazes focused on them for cues of how to adapt.

ABT’s cloud-based portal MortgageWorkSpace adds banking level security to email, servers, PC’s and mobile devices in the mortgage industry. Contact us to learn more.

Image: VisualHunt.com

Topics: Compliance Due Diligence cyber security mortgage company security financial data security cybersecurity mortgage business mortgage industry Consumer Finance Protection Bureau Compliance for Mortgage Companies Compliance Audit cloud-based data Mortgage Lending 23 NYCRR Part 500 NYSDFS network safety

Business Data Security and Multi-Factor Authentication

 240_F_122590781_AfHycyjOI0sOqepiZ1DQVBYkZsH7qlRr.jpg Get an extra level of security with multi-factor authentication or MFA.

Each year, cybersecurity gets more complicated.

According to anti-virus developer Panda Security, the amount of malware created by cybercriminals is predicted to grow exponentially with each passing year.

Companies have to face the reality that a security breach has a serious impact on business.

To avoid the distress of company-wide damage control and a PR nightmare, it’s best to make sure security is in good shape.

Real Business Impact

For some businesses, consumer data handling is the main issue.

Financial institutions such as banks and mortgage companies are often targeted by hackers because they house the most personal information.

With major security failures like the Equifax breach of 2017 making international news, the finance industry’s cybersecurity worries are real.

More is at stake than information. A data breach can mean sales losses and a tarnished reputation that lasts for years.

From fines to fraud, there are monetary repercussions as well.

So what is the fastest way to tighten security on cloud-based and traditional networks?

Multi-Factor Authentication

Data breaches in single-factor authentication systems often exploit the system login credentials or passwords of users.

Multi-factor authentication or MFA is a group of security measures that go beyond the traditional password in order to correctly identify a person for system access.

MFA is becoming more prevalent in the financial industry. This kind of authentication was adopted by the Payment Card Industry Data Security Standard (PSI DSS) in February of 2017 and was listed as a standard for the mortgage industry in the State of New York in the same year.

Multiple factors mean heightened levels of information that only the user can provide.

These factors can be a number of different security measures. A “soft token” is when security software generates a one-time-use passcode sent to the user’s mobile device. This type of authentication can also be executed with a text message, phone call, or an email with a hyperlink.

Other factors run the gamut from predefined security questions to biometric identifiers like fingerprints or facial recognition software.

Only the correct user knows the information or is in the circumstance to receive the passcode, so using MFA means only the approved user is given access.

The Modern Office

Another issue with security is the modern office environment.

There are a growing number of remote workers. Employees want access to work-related applications from outside the office.

In this mobile workforce, employees are moving off of network-approved computers and onto personal or public machines. It’s up to the IT department to facilitate their work and make sure they go through a heightened level of security checks.

MFA is an authentication strategy that allows IT to deliver this level of remote access. It solves the problem of identifying recognized employees while maintaining a solid defense against intruders.

User Experience

The final consideration when implementing cybersecurity measures is user experience.

With higher scrutiny comes a higher level of annoyance by the employee at having to prove their authorization.

IT staffers need to balance security measures with user convenience.

One development that improves this balance is “adaptive” MFA. This security technology evaluates the risk factor of the user and then adapts the number of factors required for entry to the system.

An employee using a company-issued laptop at a café with an IP address across the street from headquarters is considered a low-risk access attempt. This situation does not require extra security measures.

On the other hand, if someone is trying to gain access on an unrecognized device in a location where the company doesn’t have an office (e.g. employee is attempting to do work on her tablet while vacationing in Bali) then the number of factors required will be at the maximum level. The employee jumps through some hoops, but with an understanding of why.

Conclusion

Data breaches are happening at the enterprise level at an alarming rate. A watchdog organization called Breach Level Index estimates that every second, an average of 57 records are stolen.

Employees are moving towards a more mobile work environment with wide geographic distribution.

For companies who handle consumer data, implementing MFA is simply one of the most effective ways to crack down on security violations and keep up with the modern workplace.

Businesses that use the MortgageWorkspace management software by ABT are protected by multi-factor authentication and a host of other cybersecurity measures. Contact us to learn more.

Topics: social networking safety phishing multi-factor authentication cloud storage mortgage business Compliance for Mortgage Companies Compliance Audit cloud-based data Housing Market Mortgage Lending

Guide to New York’s Cybersecurity Regulations

The deadline is less than a month away.

As February 15, 2018 draws near, financial institutions in the state of New York are scrambling to comply with cybersecurity regulations that are new to the industry and unprecedented in the state.

Released in early March of last year, Part 500 of Title 23 or Cybersecurity Requirements for Financial Services Companies (2017) is a 14-page document detailing how finance companies will be legally required to protect nonpublic information in their computer systems.

These regulations were implemented by the Department of Financial Services (DFS) citing security risks and the “ever-growing threat” of foreign nation-states, terrorist organizations and cybercriminals. The DFS Superintendent’s office will be overseeing compliance with the new laws aimed at safeguarding sensitive information that banks, credit unions, and mortgage companies keep on file.

As the zero hour approaches, here is a quick guide to the new DFS directives.

Cybersecurity Programs for All 

The main requirement is that all financial institutions under the regulation of the DFS are now required to create and implement a written cybersecurity program. 240_F_41316834_khRM1Linm358EZL0uiTOmQS2tyeankBN.jpg

With computer-based leaks making national headlines, New York’s banks will be held to a high standard.

The main issue of information leaks is “nonpublic information” or data gathered about customers and clients that is not meant for public knowledge. This includes business information, identifying information, account numbers, and even medical information.

A “cybersecurity event” is any action or attempt of unauthorized access to this information.

Security Measures

The new DFS regulations specifically call for annual penetration testing and bi-annual vulnerability checks of all information systems.

This includes extensive recordkeeping of system activity. Each financial institution must keep transaction records for a period of 5 years and an audit trail that records at least 3 years of activity.

The DFS further urges permissions control for all software applications.

Policy Requirements

This new cybersecurity program that every institution must implement is subject to oversight. The regulations require that all policies be recorded and approved by a senior officer or the company’s board of directors.

The guidelines state that any policies laid down must address an extensive list of 14 distinct topics ranging from data governance to disaster recovery planning.

Beyond stating the goals of these new measures, the law requires that companies designate a Chief Information Security Officer (CISO) for in-house enforcement.

This individual is required to report in writing annually about security to the company’s board and will be held responsible in the event of a breach at the agency.

Risk Assessment

Beyond coming up with a plan, the new regulations require action.

Financial institutions must run a complete risk assessment of their company. The assessment must be documented and it should include an evaluation of the adequacy of the existing access controls.

By law, this assessment must be carried out by qualified cybersecurity personnel. To avoid passing the buck, companies who hire out for the job must still exercise due diligence in evaluating the adequacy of the third party’s own security practices.

The law makes it clear that the financial institution itself will be held responsible for the integrity of their new program.

Other Regulations

There is a host of supplementary details in the document that outline currently-held security precautions across the information systems industry.

For example, multi-factor authentication for network access, a time limit on data retention, and regular cybersecurity awareness training for all personnel are all part of the regulation.

Encryption guidelines are spelled out and become subject to annual review by the CISO.

Notifications

The final issue addressed by the new regulation involves communication with DFS. The superintendent’s office places a strict time cap on security breach announcements. A company has no more than 72 hours to report any event that has a “reasonable likelihood of materially harming the normal operations” of the company. 

Serious events like this have always fallen under reporting laws to local supervisory bodies. Under the new law, these events will be taken up the chain of command to the Superintendent’s office immediately.  

As of last year, New York is taking cybersecurity seriously. With such strict laws, it’s understandable that financial institutions have been slow to enact changes. After the year-long cushion, the new regulations are set to be enforced and financial institutions will be held responsible if they don’t comply.

14 pages of detailed requirements are on the books. As the transition year comes to an end, banks, mortgage companies, and credit unions are under the gun to make it happen.

Are you a CIO?

Has your institution taken the proper steps for system security?

For comprehensive compliance guidance and other cybersecurity solutions and, contact us.

Topics: DocumentGuardian cloud storage mortgage business mortgage regulations Compliance Audit Mortgage Lending DFS 23 NYCRR Part 500 NYSDFS

The Inevitable Mortgage Audit: Are You Prepared?

The Inevitable Mortgage Audit: Are You Prepared?

Anyone who has worked in the mortgage arena for any length of time knows that mortgage audits are inevitable. But even if you know that audits are a reality of the job, are you actually prepared?

Luckily, we're here to give you an idea about that—five ideas, in fact.

The Federal Financial Institutions Examination Council (FFIEC)

Working in the mortgage field, you are no doubt familiar with this group. The FFIEC has the power to develop and prescribe uniform principles and standards for examinations of financial institutions. The Council provides training for examiners at both the federal and state levels. It also provides guidance on compliance audits to the financial services industry through its member agencies.

Don't Reinvent the Wheel. Utilize Risk Assessment Models.

Several of the regulatory agencies with jurisdiction over financial institutions provide assessment models that can help with risk management. In addition, some industry organizations and commercial companies offer similar models. Just to name a few:

  • Consumer Financial Protection Bureau (CFPB) in its Supervision and Examination manual
  • Federal Reserve (the Fed) in its Community Bank Risk-Focused Consumer Compliance Supervision Program
  • Federal Deposit Insurance Corporation (FDIC), Comptroller of the Treasury (OCC) and National Credit Union Association

These organizations all publish guidance on risk assessment programs that will help you demonstrate your institution's risk as it is, not as the board wishes it would be.

In addition, ComplianceAlliance.com offers a Mortgage Compliance Checklist Tool to help mortgage companies comply with the various lending regulation requirements.

Compliance Risk Assessment

Compliance examinations, these days, rely less on identifying non-compliant transactions and more on assessing risk and evaluating the financial institution's components that manage, mitigate, or prevent risk. Your financial institution's risk assessment should focus on its structure, policies, and procedures; how actively your board participates in oversight; and of course, your products and services.

Here are three basic questions your compliance risk assessment should answer:

  • First, identify your worst case scenario—not just now but in the future.
  • What controls does your institution have in place?
  • How well do your controls limit the impact of non-compliance?
  • How big is the gap between the worse case scenario and the controls you have in place? That gap is the risk that you want to reduce to as small a point as possible.

What Characteristics to Assess

The following are the characteristics that you want to identify with respect to:

  • Each of Your Institution's Products: Identify the volume and activity—whether it's a new product or an old one. Determine how complicated the product is and whether you intend to make changes or have recently made changes to the product.

  • Your Institution's Internal Operations: Identify how large your staff is, your turnover rates, whether the organization operates with centralized management or not, whether the staff and the organization's culture are compliance driven, and whether the organization has a robust internal monitoring system. Also review recent compliance risk assessment efforts.

  • Third-Party Service Providers: Identify compliance monitoring and due diligence efforts.

  • Each of Your Services: Identify any unfair, deceptive, abusive acts or practices as required by regulatory agencies.

  • Your Consumer Complaint Process: Identify response time and efficacy, and review the record-keeping policy with respect to complaints.

The Federal Compliance Laws for Financial Institutions

The American Bar Association provides its members with a list of the Federal laws that require financial institutions to comply with their rules and regulations and that cover mortgage audits. Just to remind you how regulated the mortgage industry truly is, here is a sampling:

  • Truth in Lending (Regulation Z) disclosure statements
  • Equal Credit Opportunity Act (Regulation B)
  • Fair Credit Reporting Act
  • Federal Reserve Board Regulation, Fair Credit Practices Rule
  • Fair Debt Collection Practices Act
  • ServiceMembers Civil Relief Act

To read an analysis of the accuracy of the CFPB's mortgage compliant data, see National Mortgage Professional Magazine's article from February 2017, entitled "Analysis: How Accurate is CFPB Mortgage Complaint Data?"

To learn more about compliance for mortgage companies, please contact us. We are your resource for all your mortgage company audit compliance questions.

Topics: Compliance Consumer Finance Protection Bureau Compliance for Mortgage Companies Compliance Audit