Hi ...the bank owns a title company (wholly owned subsidiary of the bank)- can we give those employees access to our loan origination system? If not, I'm looking for a citation.

You would be sharing customer information with an affiliate. What is the reason for sharing this data with the affiliate employees? What is their need to know? What does your privacy notice say how you share?

If for marketing, consider FCRA opt out and your privacy notice.

If for other reasons, you must consider Reg P. Do you state that you share on a need to know basis? Why would these people need to access the bank's customer data?

Good questions - Thanks for pointing me in the right direction.