We are a bank that is servicing loans for some investors. One of our investors is requesting to hear some of the Collection calls we make for delinquent customers. The problem is that none of the loans in their pool are delinquent so we do not have any Collection calls for them to hear.

We understand they are probably doing this from a due diligence perspective under Vendor Risk Management. However, are we required to let them listen to the Collection calls of other customers that do not fall in their loan pools? We want to make sure we aren't crossing any privacy lines but want to help satisfy their goal if we can.

Tell them when they have a delinquent loan, you would be glad to let them listen in.