Vendor Management Policies - What's Really Involved?

Click here to download a copy of the vendor management approval process

checklist.  Comment below or in the blog and learn how to get an up-to-date policy

for your company that gets maintained for free.

Free Vendor Management Checklist

We make the assumption that our business partners all comply with the rules and regulations of our common business.  If they don't, we have been used to the idea that we can simply say "Not my fault!"  Unfortunately, while the idea of "plausible deniability" seems comforting,  the industry no longer allows us to blame someone else for ignorance.  We now need to manage our vendors.

Participate in the Vendor Management Survey here 

The CFPB's mandate for Vendor Management is over 1 

year old .  How do you comply?

Don't Fall Prey to Regulatory Paranoia

In the same way that some compliance firms use the fear of CFPB audit as a marketing prompt, Vendor Management occupies that same space in mortgage industry participants' chest of fears.

This is the News Flash that wasn't:  CFPB requires financial entities to oversee their vendors for compliance. "We need to have vendor management policies and procedures?  That is such a compliance burden!"  Wait a second.  Don't we already do this?  The answer, for firms who have already initiated standard mortgage industry operating procedures, is yes.  Vendor management has long been a function in the branch operations process.  We have always approved appraisers, title/escrow companies, couriers, PMI companies and credit bureaus, to name a few.  For those of us who are in wholesale, we have always approved our brokers and correspondents.  Since we do this anyway, it is important to examine whether we are doing it correctly.

I Have Covered the Basics - Who Am I Missing?

This depends greatly on your business model.  Who is customer facing?  Who presents an information security risk?

The easiest way of ensuring you have captured all of your vendors is to go through your accounts payable register and your office correspondence.  Is there anyone there who looks at your customer's information?  Do they have access to your office?  Do they ever interface with your customers?  At a minimum

• Title Companies/Escrow/Settlement
• Appraisers
• Credit Bureaus
• Mortgage Insurance Company
• Courier/Delivery
• Mortgage Brokers
• Mortgage Wholesalers
• Lead Generation
• Office Cleaning
• Temporary Staffing
• Accountant/Bookeeping
• Web/Network Hosting
• Document Destruction
• Records Management
• Consultants
• SOFTWARE (SaaS)
• Sub-Servicer

What Am I Checking Them For?

Again, depending on the provider and the scope of its business you will address different elements.  Customer facing vendors have to comply with the same laws we do, while all vendors should have basic elements in place:

Background and Reputation

You should consider the background and reputation of ALL providers regardless of the level or type of service it provides.  At a minimum, check the internet, BBB, and the agency disbarred lists including FinCen, FNMA, FHLMC, and LDP as well as others you regularly check.  Individuals should have a background check of the court records in their jurisdiction.  The provider should be prepared to allow you request enough information to make a meaningful search.  Consider the difficulty of conducting a check without the name and address information of the principals.
  

THEIR Compliance Program

Consumer Facing/Access - Tier 1 or 2 depending on the type of information vendor has access to:

Even though LOS/Credit SaaS vendors are not consumer facing, they have access to the customer's information, so should provide this information as to customer identifying information.  

• Truth-in-Lending Act
• Real Estate Settlement Procedures Act
• Flood/Disaster Protection
• Right to Financial Privacy Act
• Credit Practices Rule
• Fair Housing Act
• Equal Credit Opportunity Act
• FACT Act
• SAFE Act
• Appraiser Independence

Non-Consumer Facing - Low Risk Tier 3

• Information Security 
• Criminal Background Checks

Do I have to hire someone to manager my vendors?

Vendor management simply means the process of monitoring things that are being done on our behalf.  You do not have to hire someone.  In fact, if you do hire someone you have to vet that contractor as well!  In addition, much of the work done to manage this information is borne by the client since the company has the access to the customer information.

Order our Vendor Management Policy and Procedure and receive free access to updates as you provide feedback!

Companies Offering Vendor Management Services

Fortrex Technologies - David Bedard
Vendor Audit - Lenders Compliance Group
Appraiser Management - Global DMS, Melissa Key