Red Flags Compliance

1. Red Flags Compliance Fair & Accurate Credit Transactions Act (FACTA) Identity Theft Prevention BANKERS ADVISORY

2. Red Flag Facts • Compliance rules are effective November 1, 2008 • Implemented by the Federal Trade Commission (FTC) in compliance to the Fair and Accurate Credit Transactions Act (FACTA) Regulation, Section 114 • Rules apply to banks, thrifts, credit unions, finance companies, automobile dealers, mortgage companies – including brokers • All businesses must have a comprehensive system in place that serves to detect, prevent and mitigate identity theft. BANKERS ADVISORY

3. Red Flag Program • Every business must have a written policy • The policy must be approved by the company’s board of directors or senior executive committee who shall direct a designated senior management employee to oversee the program • The designated person must implement the program, train staff, oversee audits, complete annual reports and monitor compliance to all persons who have access to covered accounts (new or existing borrowers) • The plan must reflect the size, structure and business model of the institution and updated periodically BANKERS ADVISORY

4. Red Flag List • The plan must identify and list all possible red flags • Red flags apply to “covered” accounts such as: • New or existing customer information accessed by your company • New or existing customer information accessed by 3rd parties • The Federal Trade Commission has identified “26 Red Flags” to be used as a guide for drafting an internal policy • The FTC list is not be used as a “checklist” and lenders must list sources and examples that are specific to their business model BANKERS ADVISORY

5. Red Flag Sources • Red flags are comprised of various sources: • Suspicious documents furnished by the consumer • Suspicious documents furnished by transaction parties • Suspicious documents furnished by asset or income sources • Alerts, notifications or warnings from a consumer reporting agency • Alerts from an SSN validation check • Alerts from a Factual ID or Fraud-Check • Notices received from outside persons or entities in connection to the covered account being serviced by the institution BANKERS ADVISORY

6. Red Flag Detection • Ordering vendor reports, such as SSN checks or Factual ID are not mandatory … but help support red flag detection • Vendor reports can help a lender save time and also resolve “false positives” by clearing unwarranted discrepancies • If a vendor report indicates any type of “Alert” the lender must respond to that alert • Often red flags are detected by manual review of various file documents or other sources, such as… Google BANKERS ADVISORY

7. Red Flag Detection • Source: Credit Report - SSN Check • Look for exact or partial match on •  borrower name •  borrower address • Note Date of Birth (DOB) & compare with 1003 application • Note Issue Date & Validation • Note Deceased Flag or FKA / AKA (formerly known as, also known as) • Note Address History & compare with 1003 application NAME MATCH? ADDRESS MATCH? SSN VALIDATED ? Memo to File  Compliance Check Completed BANKERS ADVISORY

8. Red Flag Detection • Source: Factual ID – Red Flag Response • Red Flag Response is completed by: • Requesting documents from the borrower • or third party, such as property seller • Ordering a factual report from a vendor • When ordering the Factual ID, the lender may request a specific action, such as Verify Social Security Number  Obtain confirmation from SS Administration Validate borrower occupancy  Confim telephone is land-line or mobile phone • Document file memorandum red flag detection and response completed satisfactory. ACTIONS ADDRESS VARIANCES? OCCUPANCY ? CLEAR TO CLOSE BANKERS ADVISORY

9. Red Flag Response • Once a Red Flag has been detected, lenders must assess the level of risk and evaluate the exposure to identity theft to either the lender or consumer • Examples of responses are: • Ask borrower to submit a written explanation • Ask borrower to submit supporting documentation to clear the discrepancy • Request borrower’s employer to furnish supplementary payroll records • Complete an internal “red flag checklist” that documents the detection and response, place in borrower folder with copy to compliance officer • As appropriate, and in accordance with the established procedure: • Notify Law Enforcement Agency • Complete a Suspicious Activity Report (SAR) • Notify parties in connection with identity theft BANKERS ADVISORY

10. Red Flag Toolkit Bankers Advisory, Inc. has developed a comprehensive Red Flag Toolkit that covers all steps and activities required by law. The toolkit includes three components, which may be purchased separately: Red Flags Compliance Manual • Summary of FACTA Regulation and requirements related to mortgage lending • Job Description for designated program manager • Step by step plan for all required functions for monitoring & reporting • List of red flags & sample policy guide • Camera-ready forms & worksheets Customized Policy Guide • Customized for lender, appropriate to business model & institution type • Addresses every internal department or facility with access to consumer information • Addresses every external entity & 3rd party service providers • Procedures for vendor orders, detection, incident-based response & mitigation • Directives for SAR filing and reporting  Delivered on CD Rom in editable MS Word document BANKERS ADVISORY

11. Red Flag Toolkit Power Point Training Program • Summary of FACTA Red Flag rules & requirements • Description of red flag categories and explanation of the “Red Flag List” • Illustrations & examples of red flags found on mortgage documentation • Illustrations & examples of red flags detected on consumer credit reports • Effective use of SSN validation, Factual ID and other investigative tools • Options & directives for response, mitigation and SAR reporting Bankers Advisory, Inc. 375 Concord Avenue, Belmont MA 02478 Tel 617-489-2008 Fax 617-489-2208 For further information, contact Anna DeSimone anna@bankersadvisory.com BANKERS ADVISORY