[NMLS SAFE] 10, BSA, SARs and Borrower Privacy

Lesson ten of the free Quibank NMLS SAFE course: the Bank Secrecy Act, suspicious activity reports, and borrower privacy. This is the lesson about what you must report, when, and — just as important — what you must never say. Start with the red flags. An originator reviewing a file notices the fonts on the W two differ between pages, the employer's address is a mailbox rental store, and the employment verification number rings to a personal cell.

Classic document fraud signals. What must the originator do? Stop, decline to submit the file, and escalate to the company's compliance or fraud unit under its written procedures. Not quietly withdraw it.

Not ask for a cleaner copy. Not pass it to the underwriter to sort out. Knowingly submitting false information to a federally insured lender is a federal crime — the duty is to stop and escalate. When the company decides a transaction is suspicious, it files a suspicious activity report — a SAR.

The deadline: within thirty calendar days of initially detecting the facts. One extension exists: if no suspect has been identified, the company may take up to thirty more days to identify one — but filing must happen no later than sixty calendar days from detection. Thirty as the rule, sixty as the outer limit. Test the deadline.

The compliance officer confirms a transaction is reportable, but there is no identified suspect yet. File within thirty calendar days — extendable to sixty because the suspect is unknown. Answers offering ninety days, fifteen business days, or before the loan closes are all wrong. Now the rule people break: confidentiality.

ASAR, and anything that would reveal its existence, is confidential by federal law. After the filing, the borrower calls and demands to know why his file has stalled. The originator must disclose nothing — not to the borrower, not to his agent, not after any amount of time. Tipping off the subject is itself a federal violation, separate from whatever prompted the report.

Privacy is the same reflex pointed at a different caller. The buyer's real estate agent phones and asks for the borrower's credit score, monthly debts, and what is taking so long. The borrower has signed no authorization. Under the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act, that is nonpublic personal information and consumer report information — decline to release any of it without the borrower's written authorization.

Being a party to the deal does not entitle the agent to the file. Referring the borrower does not either. And splitting the difference — just the score, not the report — is still a violation. No authorization, no information.

Recap. Fraud red flags: stop, decline, escalate under written procedures. SAR deadline: thirty calendar days, sixty if no suspect identified. SAR confidentiality: never reveal it — tipping off is its own violation.

And privacy: the borrower's information leaves the file only with the borrower's written authorization. That completes the first ten lessons — the heart of federal law. Next: the licensing standards — felonies, credit history, and character. Practice everything so far, free, at quibank.com/mlo.

See you in lesson eleven.