A borrower calls and asks us to fax a payoff statement to a title company for her loan. Loan processor told her it's law that we must have a Borrower's Authprization form to release a loan payoff (due to privacy).

1) Is this true? If so, where can I find it documented?

Besides, if a borrower calls and we can verify it's our borrower, can we go ahead and do it?

It may be policy but it's not law. However with the privacy issues today it is a best practice. If you have ID procedures in place to identify customers over the phone, and good documentation the ID procedures were performed, I see no reason you could not release the PO.