The loan processor probably has a "too casual" understanding of the federal privacy regulation (Regulation P if you are supervised by the fed). It says a consumer may not opt out of a discloure made:
(1) With the consent or at the direction of the consumer, provided that the consumer has not revoked the consent or direction;
The compliance issue is simply whether you can establish that the consumer authorized the disclosure. A signed authorization form would certainly be one way to do that, but it would not be the only way.
Previous Thread
Index