If a regulator/auditor is asking us for steps we have taken to validate accuracy of third-party products. What might they be talking about/referring to? And is this required under MLA? Thanks.

It is not required under the MLA regulation. But let's suppose that you use Vendor X ( it could be a credit bureau or some other third-party service provider) to do your MLA checks and for some reason, Vendor X is accessing month-old data. You learn that three borrowers whose loans closed in December were, in fact, on active duty when they signed their loan notes, but Vendor X reported that were not on the MLA database when they checked, the day you received the applications. To add insult to injury, you find out they were all in the service when they applied and no one discussed their military status then or later.

If the bank had tested Vendor X's procedures, it could have learned about their use of stale data.

That's the sort of thing your regulator wants to know you have checked for.

Thanks for your response John. So we currently use two of the three nationwide consumer reporting agencies for our MLA searches (and using them is one of the safe harbors under the MLA), so why would we be expected to doublecheck/verify the accuracy of the information they provide, if this is considered one of safe harbor methods? I'm sure this was done when we initially set this up years ago, but I don't believe anything additional has been done since then. Is this what the regulators are expecting now??