LOS creating ULI with masked number

Our LOS is creating the ULI with a masked number. If our system generated loan number is 1234, instead of the ULI being the LEI+1234+check digit, it's LEI+random masked number+check digit. Our LOS believes that using the loan number is in violation of the requirement to not include information in the ULI that could be used to identify the borrower directly. The HMDA small entity compliance guide doesn't list loan number in the example of information that could be used to identify the borrower, so I'm not sure I agree with their interpretation of that.

My questions are: 1) does it matter if we are using a masked number to generate the ULI as long as I can tie that ULI to the system generated loan number? And 2) is anyone using a masked number to generate a ULI? It seems like an unnecessary step but maybe I'm not fully thinking this through. I would prefer to use the system generated loan number, but to switch our LOS to do that would be a custom work order.

They are nuts - there is no such limitation. The ULI is not even going to be available to the public via the modified LAR.

Unless the loan number you're LOS is using is something identifiable about the borrower (like their SSN etc.), then I agree with rlcarey that they are instituting functionality that doesn't need to exist.

Thanks for both responses, and to clarify the loan number does not contain SSN, birth date, anything else along those lines. This always struck me as unnecessary extra work.

Since someone's loan number does not personally identify them, it becomes very confusing as to where they got this idea.

Paragraph 4(a)(1).

4. Application or loan number. An institution must ensure that each identifying number is unique within the institution. If an institution's register contains data for branch offices, for example, the institution could use a letter or a numerical code to identify the loans or applications of different branches, or could assign a certain series of numbers to particular branches to avoid duplicate numbers. Institutions are strongly encouraged not to use the applicant's or borrower's name or social security number, for privacy reasons.

Even the proposal had more examples than the final regulation, and none of them were a loan number either:

Proposed comment 4(a)(1)(i)–2 explains that information that could be used to directly identify the applicant or borrower includes but is not limited to the applicant’s or borrower’s name, date of birth, Social Security number, official government-issued driver’s license or identification number, alien registration number, government passport number, or employer or taxpayer identification number.