I sure could use some guidance on checking for service provider agreements under 501(b). There have been discussions here listing vendors that we apparently did not include in our analysis of what was covered. For example, correspondent banks were listed in the regulation, but I'm told we don't use them for any activity that involves sharing customer information. What about entities that we sell loans to? Whether government sponsored or other institutions, wouldn't agreements be put in place? I've not been supplied with servicing contracts, and don't know if they would address the exchange of information. Anyone involved in mortgage banking out there that can tell me how they handled this? I know the guidelines were intended to be "flexible", but I need more information!

Our IT exam will be this fall, and I had hoped we'd be prepared for this since our deadline was long past. With FTC's regulations finalized not so long ago, but their contract requirement deadline still far in advance, will there be another wave of these agreements from entities that last year claimed they were not covered?