When applying for a mortgage, you are required to provide a large amount of personal and financial information to be approved and receive financing. As our world has become increasingly complex and the loan amounts have increased substantially, the amount of documentation required to be submitted has grown accordingly, reflecting the growing complexity of the mortgage approval process.
The question then becomes, how do I know my personal and financial information is being protected? How confident can I be that my information is secure? Ultimately it comes down to one, single question, “Can I trust you and your organization to protect me and keep me safe?”
What is Soc 2 Type 2 Compliance
FSRA Auditing of Mortgage Brokerages
Mortgage Outlet Policies and Procedures
Why Protecting My Client’s Information is Paramount
Scarlett
As a mortgage agent, I use Scarlett as my mortgage technology platform.
Scarlett is a comprehensive mortgage technology platform designed primarily for brokers and agents to manage the entire loan origination process from start to finish. It combines several essential tools into one system, allowing users to handle document management, credit bureau pulls, e-signatures, and automated workflows.
Scarlett supports the security of clients’ documents and information through several robust measures. One of its key features is SOC 2 Type 2 compliance, a high-standard certification that ensures the platform meets rigorous security, availability, processing integrity, confidentiality, and privacy standards. This certification gives users confidence that their data, especially sensitive client information, is protected against unauthorized access and identity theft.
Additionally, Scarlett integrates with multiple secure platforms, including credit bureaus like Equifax and TransUnion, ensuring that client data is handled with the utmost security. It allows for seamless document management, automating the request and storage of documents while ensuring they are encrypted and stored securely.
These security measures are crucial in an industry where sensitive personal and financial information is frequently shared during the mortgage process.
What is Soc 2 Type 2 Compliance
SOC 2 Type 2 compliance is a certification that indicates a company has established and follows strict security protocols to protect sensitive customer data. SOC 2 (System and Organization Controls 2) is a framework developed by the American Institute of CPAs (AICPA) to ensure that service providers manage customer data in a way that safeguards privacy and security.
SOC 2 compliance focuses on five trust service principles:
- Security: The system is protected against unauthorized access, ensuring the confidentiality of the information.
- Availability: The system is available for operation and use as agreed upon.
- Processing Integrity: System processing is complete, accurate, and valid.
- Confidentiality: Data designated as confidential is protected and handled securely.
- Privacy: Personal information is collected, used, retained, and disclosed in accordance with privacy policies.
SOC 2 Type 2 reports are more comprehensive than Type 1. While SOC 2 Type 1 assesses the design of a company’s security controls at a specific point in time, SOC 2 Type 2 evaluates how effective these controls are over an extended period, typically six months to a year. This demonstrates that the company not only has the necessary security protocols in place but that it also consistently adheres to them over time.
In the context of mortgage platforms like Scarlett, SOC 2 Type 2 compliance provides assurance that sensitive data, such as personal and financial information, is handled securely throughout the loan origination and processing lifecycle
Government Oversight: FSRA
The Financial Services Regulatory Authority of Ontario (FSRA) is an independent regulatory agency that oversees the financial services industry in Ontario. FSRA was established in 2019, replacing the Financial Services Commission of Ontario (FSCO) and the Deposit Insurance Corporation of Ontario (DICO). Its mandate is to regulate various financial sectors, ensuring they operate in compliance with laws and maintain fairness, transparency, and financial stability.
FSRA regulates industries such as:
- Mortgage brokers and agents: Ensuring compliance with laws, including the Mortgage Brokerages, Lenders and Administrators Act (MBLAA), to protect consumers in the mortgage industry.
- Insurance: Overseeing insurance companies, agents, brokers, and adjusters to ensure they adhere to regulatory standards.
- Pensions: Regulating pension plans to ensure they are properly managed and that retirement benefits are secure.
- Credit unions and caisses populaires: Regulating these financial institutions to maintain their financial health and protect depositors.
- Loan and trust companies: Supervising their operations to ensure stability and compliance with regulatory requirements.
FSRA also has a consumer protection role, working to ensure that Ontarians are treated fairly in their dealings with the financial services industry. The agency focuses on risk-based regulation and enforcing laws that prevent misconduct or unethical practices.
FSRA aims to promote public confidence in the financial services sector by maintaining strong industry standards and ensuring that companies and professionals act in the best interest of their clients.
FSRA Auditing of Mortgage Brokerages
The Financial Services Regulatory Authority of Ontario (FSRA) audits mortgage brokerages to ensure they are following appropriate practices regarding the protection of private and sensitive information.
As part of its role in regulating the mortgage brokerage industry in Ontario, FSRA ensures that brokerages comply with the Mortgage Brokerages, Lenders and Administrators Act, 2006 (MBLAA) and other relevant privacy regulations, such as the Personal Information Protection and Electronic Documents Act (PIPEDA). FSRA audits or reviews a brokerage’s operations to ensure compliance with these laws, which include proper handling, storage, and protection of client’s personal and financial data.
These audits often assess:
- Security Measures: Whether the brokerage has adequate physical and digital safeguards in place to protect client information.
- Data Handling Procedures: How the brokerage collects, uses, discloses, and retains sensitive client data.
- Privacy Policies: The brokerage’s compliance with legal requirements for privacy policies that outline how clients’ information is protected.
- Compliance with PIPEDA: Ensuring that brokerages are following Canadian privacy laws regarding data protection, consent, and breach notifications.
FSRA aims to ensure that brokerages are operating ethically and in line with industry standards for protecting client information, which includes mitigating risks related to data breaches and identity theft. Non-compliance with these standards can result in penalties, fines, or even loss of license for the brokerage.
Mortgage Outlet Policies and Procedures
As a leading Canadian mortgage brokerage, Mortgage Outlet has published a robust Policies and Procedures Manual that must be followed by all Mortgage Outlet agents and brokers. The Mortgage Outlet Policies and Procedures Manual aligns with MBLAA (2006) and PIPEDA. Mortgage Outlet operates in a regulated industry is subject to FSRA Audits (see above).
The Mortgage Outlet Policies and Procedures Manual has comprehensive sections on privacy, information collection, safeguards, and protection of data. It also includes a special section on cyber security. Mortgage Outlet agents and brokers follow the principles outlined by the Mortgage Brokers Regulators Council of Canada (MBRCC) to protect clients, lenders, and society at large.
Why Protecting My Client’s Information is Paramount
It is critical for mortgage agents to protect their clients’ personal and financial information for several key reasons:
- Legal and Regulatory Compliance: Mortgage agents are legally obligated to protect clients’ sensitive data under privacy laws such as the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada. Failure to do so can result in hefty fines, legal penalties, and loss of professional licenses.
- Preventing Identity Theft and Fraud: Personal and financial information in mortgage applications, such as SIN numbers, income details, and credit histories, is highly sensitive. If not properly secured, it can be stolen and used for identity theft, leading to financial fraud, which could ruin clients’ finances and reputations.
- Maintaining Client Trust: Clients trust me with their most sensitive information, and any breach of that trust can damage my reputation and the client relationship. A data breach could result in clients losing faith in my ability to safeguard their interests, potentially leading to loss of business and negative referrals.
- Professional Integrity and Ethics: Protecting my client’s data is part of my ethical responsibility. Ensuring the confidentiality and integrity of this information shows my professionalism and a commitment to you and ethical standards, enhancing your trust in me and the brokerage, Mortgage Outlet, I stand with.
- Mitigating Financial Losses and Legal Liabilities: A data breach can result in significant financial costs related to mitigation efforts, legal fees, and settlements. Moreover, agents could face lawsuits from affected clients if they are found to be negligent in protecting data.
Summary
The requirement to submit a large amount of personal information and financial documentation when making a mortgage application raises concerns about the security of personal and financial data. Applicants are left questioning the protection measures in place: “How can I be certain that my sensitive information is safeguarded?” Ultimately, it boils down to a fundamental issue of trust—”Can I rely on my mortgage agent and the brokerage handling my mortgage to keep my data secure and protect my interests?”
To summarize, here’s why you can trust me, Allen Ehlert, with your personal and financial information when applying for a mortgage:
- Use of SOC 2 Type 2 Compliant Technology
- Integration with Secure Platforms
- Government Oversight
- FSRA Audits
- Mortgage Outlet Policies and Procedures
- My Commitment to Client Trust and Professional Integrity
In summary, securing your information and protecting your privacy is not only a legal obligation for me, but a core aspect of maintaining trust, ensuring ethical standards, and preventing potential financial and reputational damage to everyone I do business with.
Please contact me if you have any questions or concerns.
