We are an institution that does not share NPPI except under the exceptions. We actually send our privacy notices to all customers, personal and business. How are we supposed to handle the situation when the customer calls and wants us to send his financials and other info from their loan file to their accountant or tax preparer? (This happens a lot with our agricultural based customers.) My first instinct is to get written permission from them first. Is this in writing anywhere, or if we document verbal instructions taken over the phone is that good enough?

nga, I don't have regulatory guidance, but I would have the same gut reaction as you. Does management at your institution feel comfortable with taking the risk of releasing the information on word of mouth alone? What if it's a pretext caller? If I were in your shoes, I'd get written permission.

We get written permission. This came in handy once, when we were called by someone asking for the customer's info and we said we had to get permission first. When we called the customer, he had no idea where this call was coming from, and I feel we prevented a possible identity theft.

Our customers also like the fact that we are showing the effort to keep their private info private.

The best action is written permission or send it to the customer.

I would feel very uneasy about giving this information to a 3rd party. If the customer supplied the information to your bank, then they should have copies for their records.

Go with your first instinct - get a fax, letter, or email prior to sending any confidential material out of the bank.

Faxes and email are just about as trustworthy as phone call from the customer. With technology as it is I'd like to see originals before sending anything out. For those sending out based on email and faxes why wouldn't you take oral requests?