Boy is this topic a dead horse or what!?

While there is a wealth of information about this topic on BOL, I have yet to find anyone who has come forth and said "this is exactly how we did it".

I get the need for demonstrable consent. I get that it can be achieved through a pull or push system. What I haven't seen is how others ACTUALLY accomplish this task.

Did you partner with a vendor who achieves the demonstrable consent for you (push or pull system). If so, the name of the vendor would be very helpful to others.

Did your IT department design a PDF system that will track users access to the document or link within?

These are the questions that, I believe, have gone unanswered in the forums.

As always, your time and input is appreciated.

P.S. - My focus here is for the use of E-Sign to satisfy the written form requirement of applicable loan disclosures.

Norm.

Your "test drive" (demonstration) must match the technology and methods you will use for live deliveries. Therefore, no one can suggest how to accomplish a demonstration until you tell us how you plan to make the live deliveries.

Thank you Richard. The easy answer to that is that I don't know yet.

If someone has a vendor that achieves the process for delivering disclosures that would be interesting.

Otherwise, the next method would be for loan assistants to e-mail the disclosures.

For the latter, how do others actually achieve and track the demonstrable consent?

I GOT IT!

This is what I'm going to do. Now go ahead and pick it to pieces.

The customer is e-mailed a disclosure outlining their rights and requirements under ESIGN. At the bottom of the disclosure is a hyperlink that says "I have read and agreed and consent..."

The hyperlink opens an e-mail window. That e-mail is then sent to a designated email group within the FI.

We have proven that the customer has the ability to read the document because they clicked the link and sent their consent via hyperlink. They also received the disclosure.

Go ahead. Get to picking.

As long as the e-mailed disclosure is in the exact same file format as the documents you plan on delivering (i.e., PDF documents) then you should be good to go.

This is all accomplished through an encrypted e-mail system - correct? Otherwise you are going to have GLBA issues for customer information security.

Yep. PDF document and encrypted e-mail.

Sounds like a good ESIGN opt-in system.

The obvious challenge that remains is to tie it all together and establish sufficient controls to minimize human errors and maximize compliance with the various loan disclosure regs. You should also pay close attention to any new costs and staff time associated with e-delivery. By the time you develop sufficient controls, you could discover that e-delivery costs you more than paper did!

Here are a few random thoughts about potential weaknesses:
- How will you prevent lenders from bypassing the opt-in steps?
- What will happen for those loan applicants who don't want e-delivery?
- How will you guarantee that the various loan disclosures meet the delivery timing requirements?
- If you plan more than one document e-delivery during the processing period, what provision will you make for the occasional applicant who receives the initial e-delivery and then wants to opt-out for subsequent document deliveries?

Thank you both. I know I've searched far and wide on BOL and this is the first time I've actually come up with a way to accomplish the dreaded "demonstrable consent". I appreciate your time and input.

Realistically (other COs may feel the same)
- Lenders already bypass the process (they just lie to me and don't get caught)
- If the applicants don't want e-delivery, they will continue to receive their disclosures via snail-mail
- Loan disclosure are already going out on time, it's not really an issue (allowing delivery by e-mail should be even easier)
- We will have to setup a method of tracking and archiving those who have opted-in and those who have revoked. Maybe a CIF alert. That will be tough.

The truth is, I believe that many lenders send out disclosures via e-mail anyway.

Just call me Colorado. It's happening anyway, might as well find a way to make it legal.

CONSENT FOR ELECTRONIC DELIVERY OF MORTGAGE DISCLOSURES:

You have the right or option to have mortgage loan disclosures to be delivered in non-electronic form. You have the right to withdraw consent for electronic delivery at any time. You have the right to request a paper copy of any electronic record disclosure at no fee. You must have a computer and Internet browser that will support 128 bit encryption. You will need Internet access through an Internet service provider (ISP). You will need access to a printer and/or other storage medium such as a hard drive for downloading information or printing disclosures. You will also need an external email address for the delivery of electronic notices and disclosures. Prior to consenting to accepting disclosures electronically, you should verify that you have the required hardware and software necessary to access the disclosures. If we revise hardware and software requirements, and if there’s a material chance that the changes may impact your ability to access the electronic records, we will give you advance notice of these changes and provide you an opportunity to cancel this agreement and/or change your method of receiving electronic disclosures (e.g. change to paper format vs. an electronic format) without the imposition of any fees. You should print or save a copy of all disclosures delivered electronically.

If you would like to receive disclosures and other information for this transaction by email please provide the email address you would like us to use:

___________________________@_______________________.

The above is given to customer on the information request letter. Where we ask them for recent paystubs etc. If they return it with an email address, we then send them a secure email with a PDF file attached. The PDF file has a confirmation code that they need to send in a reply email back to the bank to confirm they can open and read the PDF. After they return the confirmation code via email, we print a copy of the emails and put in the customers mortgage file.

Since 95% of the required disclosures have probably all been delivered by the time this all happens, what is this really buying you????

We hope to be able to use this for sending appraisals. We just have to figure out a way that will work for us using our secure e-mail. This thread has been very helpful for me.

Has anyone found a vendor that can manage the E-SIGN process? Especially one that can track the opt-in and out, etc. My loan department has brought me a couple vendors, one referred as a solution by a banking association, and none seem to comply with the delivery of the consumer E-Sign disclosure or the demonstration of ability to receive the docs.

Norman's approach is interesting, but seems cumbersome, and I like to see this in an automated solution.

Take a look at a company called e-Lynx. The consumer consents to electronic delivery. The disclosures will be provided in PDF format. The consumer gets a PDF file with a 6 digit code in it. The customer has to open the file get the 6 digit code and enter it on a screen. If the code matches, the vendor says we have demonstrable consent because they've proven they can open and read the PDF file.

Sounds like a good system.

I have a question along the E-sign lines and am not sure if it should be considered under the E-sign rules or is it part of bank policy. The employees have been instructed to utilize a "secure email" system through our core provider whenever sending sensitive info between ourselves or outside of the bank. Well, I am pretty new in compliance and am trying to enforce what seems to me good business practice by using the secure email. Now, having said that, is utilizing the secure email system to send loan documentation between ie: attorneys, appraisers, title ins. co's. and even the lender using it to send regular correspondence with a potential customer, and giving them notice that the bank would like them to establish an email acct. within the secure system and send correspondence that way; is that within the E-sign rules? Can the bank require that they utilize the secure email? What happens if they refuse and continue to use the regular outlook email system? E-sign is the customer agreeing to receive ex: loan documents electronically or bank statements for example, but is that ANY correspondence? In our rural areas, our customers email us quite often. Does E-sign cover everything we may receive from them or only what we want to send them? And what about those appraisers, attorneys etc? I'm so confused?

You may have set a BOL record for the number of questions included in a single post. I'll hit a couple of them. (Also, it's better to start a new thread for a new topic of discussion. These monster threads that go on and on are tough on other readers who come along later.)

The use of ordinary email for any type of external communication of sensitive information is a hazardous business practice, but I'm not aware there is a federal regulation to this effect.

ESIGN only comes into play when your customer agrees to let you substitute electrons for paper when you are delivering documents that contain any federal disclosure that must be "in writing." By following the steps spelled out in ESIGN, the law views your e-documents as the legal equivalent of paper documents bearing the same disclosures.

Since regulations do not require consumers to give federal disclosures to banks, your customers can send electronic communications to you without getting your demonstrable consent. You can (and should) strongly discourage customers from using unsecured email messages to send sensitive information.

to add on, the bank should refuse to continue an email correspondence containing private info outside of its secure email system.

Thank you Richard and Kathleen. I appreciate the help and guidance.

What we currently have set-up for E-sign compliance is to e-mail the customer a PDF which has fillable fields for them to complete and e-mail it back to us. However, we have a few loan originators who are having problems with this. The problem they are having is when the customer e-mails the "completed" form back and we open it, it shows as blank until you click in a fillable line, then the entered info will show on that line. But will disappear when the next line is clicked. From my research it seems to be a Mac/Preview problem.

Anyways. Would it be enough for us to e-mail the PDF to the borrowers and for them to e-mail us back stating that they received, read, and agree to the E-Sign disclosure?

Assuming you're giving all the pre-consent disclosures, your returnable PDF document is identical to the types of documents that will contain the live disclosures, and you can somehow read the customer-supplied information, your current system appears to be ESIGN compliant.

The back up plan is almost compliant, but needs to demonstrate that the customer can open and read the test document. Customer statements like "I got it" or "I can read it" are declarations, not demonstrations. By including some type of code in the test document and requiring customers to key the code into the return email, you and the customer are "demonstrating" that your system will be an effective alternative to paper.

Sorry to revive an old thread!

We did end up changing the way we had customers demonstrate consent by having them e-mail back a code that was included in our E-Sign doc.
But now we have a customer who mistyped the code by 1 digit. (its a 6 digit number)

Do we need to have him re-send the consent email with the correct code? Or have him send an explanation saying that he did open the PDF, but mistyped the code in his consent?

Yes, have the customer repeat that step with the correct info. A flawed demonstration the customer's ability to receive and read the sample document is essentially worthless to you. Have him resend the email or document his error, either way.

We are looking at implementing electronic delivery due to the new Integrated Disclosure rules using a third party that will provide secure delivery, and that will USPS mail disclosures if they have not been “picked up” by the applicant after 48 hours. If we use their mail service, and in order to provide the Loan Estimate within 3 days of application, if we upload the disclsoures in the 2nd day after application, and the applicant doe snot “pick up” their disclosures, with the servicing waiting 48 hours, they would be mailed the 4th day after application. My question is does that meets the timing requirement?

My second question is if the applicant receives the E-Sign disclosures, accepts, and demonstrates they can receive electronic disclosures quickly. Then when the pre-disclsoures are provided electronically a day or two later, is confirmation required for each item sent by the bank is actually received/looked at or veiwed by the applicant? The third party will keep a log to show items have been “picket up” but is that required? i.e. is the bank's process of "uploading" enough?

I have a similar question to the above.

Our loan origination system has the ability to send docs electronically. Once docs are ready for delivery they are sent via email to the borrower along with the e-sign consent and demonstration (within the email link). Consent with this system doesn't look like it can be obtained earlier. Most of our disclosures are generated on day 3 so if the customer didn't open that email and "receive" the docs that day we would not be in compliance with sending the docs within 3 business days after app date, right?

If you don't already have E-SIGN opt in with demonstrable consent, then sending the LE electronically is just as if you never sent it at all. You can include the E-SIGN opt in forms as part of the same package as the early disclosures, but if it is not picked up and opted in within 3 business days from application, you haven't sent the disclosures within 3 business days of application. With the option to mail paper if not picked up within 48 hours, you'll have to upload the disclosures on the 1st business day after application, not the 2nd, to be sure paper disclosures go out in time if the customer doesn't open and opt-in in time.