Transition to Permanent Work at Home Rules Increases Lender Risk from Third Party Vendors

When vendors allow employees to work from home, lenders face heightened service provider risk due to significantly relaxed operational oversight as well as non-sterile work environments where sensitive data can be lost or exploited more easily.

Recent industry and news reports have discussed widespread efforts to make permanent work at home rules for employees. In fact the MBA has had discussions with regulators regarding loan originator office rules to allow MLOs the ability to work from home and still meet all licensing requirements. When large numbers of mortgage industry vendors moved their operations to employees’ homes, the risk for potential fraud and error in providing services increased dramatically. After many months, as routine has set in, and as companies show very few signs of changing their work from home rules, the risk continues to increase endangering lenders and their consumer clients.

While work at home during COVID is a convenience and in some cases mandated by the health emergency it is not conducive to proper operational oversight, compliance and risk management. Access to lender financial documents and consumer non public personal and banking data is difficult to manage: “out of sight is out of mind.”

Unfortunately for lenders. the increased difficulty in managing vendor risk due to work from home rules does not excuse their regulatory compliance obligations. Quite the opposite. Lenders are expected to up their game in managing vendor risk and ensure they are taking reasonable steps to ensure proper oversight for the scope and size of their business. This is when do it yourself vendor management becomes costly and difficult to implement, requiring lenders to seek competent outside sources to replace or supplement their internal vendor oversight departments.

We have written before about the Biden Administration’s commitment to enhanced regulatory oversight. The new CFPB director is cut from the Elizabeth Warren cloth of governance which means more audits, more litigation, more consent orders, and more fines and penalties. As rates eventually rise and rate and term refis dry up, business will slow, risk of buybacks and transaction defects will increase, and audit notices will start to arrive. Lenders need to take action now to evaluate their compliance tools and prepare for a new normal that will require sophisticated, evidence based, technology driven vendor management solutions.

A common industry saying back in the last banking crisis was, “why rent money,” which meant that prudence requires you to take steps to make sure today’s business decisions do not result in tomorrow’s financial loses. We think this is very good advice for this year.