The Complete Guide to CFPB Compliance for Realtors:Protecting your clients and their sensitive information

The Complete Guide to CFPB Compliance for Realtors:Protecting your clients and their sensitive information

In this guide:

I. Your Clients’ Data

is Their Future

II. Simple Client-Side

Encryption:

The Key to CFPB

Compliance

III. More Information

on CFPB Compliance

in the Cloud

The Complete Guide to CFPB Compliance for Realtors 1

I. Your Clients’ Data is Their Future

The Complete Guide to CFPB Compliance for Realtors 2

Real estate agents help clients accomplish their greatest goals, whether it’s finding the perfect home or building a business empire. But poor data security can rob your clients of their future. If hackers get ahold of your client’s financial data, they can steal their identities, trash their credit or even trick them out of their mortgage closing funds, turning great investments into financial disasters.

The Consumer Financial Protection Bureau

(CFPB) was formed to protect consumers from

unscrupulous business practices — a goal most

people in the real estate business support. But

many realtors and mortgage brokers who are

otherwise careful about their business practices

put clients in danger with inadequate cloud and

email security. And with CFPB compliance efforts

increasingly focusing on data security practices,

it’s not just their customers who are at risk.

The Complete Guide to CFPB Compliance for Realtors 3

What is the CFPB?

The 2007-08 financial crisis and subsequent

Great Recession showed the need for increased

government oversight as well as consumer and

investor protection. The 2010 Dodd-Frank Act

enacted sweeping reforms and commissioned

the creation of the Consumer Financial Protection

Bureau to “protect consumers from unfair,

deceptive, or abusive practices and take action

against companies that break the law.” Consumer

financial enforcement and education duties that

had been spread between seven financial agencies

were unified under the CFPB.

The CFPB was given broad power to supervise

and enforce compliance for realtors, mortgage

brokers and other Non-Bank Financial Institutions

(NBFIs), and it has used this power to toughen

regulations significantly. Although the main role of

CFPB enforcement was to protect consumers from

deceptive and confusing business practices, its

mandate also includes the protection of Nonpublic

Personal Information (NPI).

Your organization needs to make their privacy

policy available to customers, explaining how you

share NPI with third-parties, and giving customers

the option to opt out. There are some exceptions

— you can share information with your lawyer, or

when it’s essential for your business, for example

— but generally, CFPB compliance requires you to

keep information about a client confidential.

What CFPB Requirements Affect Email and

File Sharing?

The CFPB is not primarily a data security

organization, but many of its laws affect data

security. Disclosure rules like GLBA and FCRA don’t

just govern intentional disclosure of data — they

govern any disclosure of data. In other words, if

you inadvertently share a client’s confidential data

through inadequate security, you could be subject

to a CFPB penalty.

GLBA is especially strong on information security

requirements. Although GLBA was targeted towards

banks, the Federal Trade Commission (FTC)

explicitly claims the power to enforce it for “real

estate settlement services,” mortgage brokers and

other financial institutions.

Under the Gramm-Leach

Bliley Act (GLBA) and the Fair

Credit Reporting Act (FCRA),

NPI includes any personally

identifiable information

customers give to you, unless

it’s publicly available. This

includes information about:

Identity — name, address,

Social Security number

Background — court records,

consumer credit reports

Transactions — account

balance, payment history,

credit card number

The Complete Guide to CFPB Compliance for Realtors 4

Under the Safeguards Rule, financial institutions

must create information security plans showing

how they protect customer NPI. They need

to conduct a risk analysis, create a program

that protects against both anticipated threats

and unauthorized access to NPI, and securely

dispose of customer information once it’s no

longer needed.

Access control is especially important. Companies

need procedures and tools in place to prevent

unauthorized individuals from receiving sensitive

information, and to restrict access to stored

information — be it on a hard drive, in a filing

cabinet or in the cloud. This access control needs

to be backed up by monitoring and employee

screening to safeguard NPI from improper access.

Unfortunately, the way the average real estate

agency or mortgage broker uses technology

does not comply with GLBA or other CFPB rules.

Realtors use email and file sharing services with

inadequate or non-existent encryption, potentially

allowing hackers to intercept customer NPI while

it’s traveling across the Internet.

They rarely use sufficient access control within the

organization either; many companies use a cloud

storage drive that everyone can access — even

employees who don’t need the data and haven’t

gone through adequate background checks. This

creates an unacceptable risk of breaching NPI and

facing a CFPB enforcement action.

What Makes CFPB Compliance so Difficult?

CFPB compliance penalties for poor data security

used to be a theoretical risk, but the organization

has recently started enforcing security standards.

The CFPB penalized online payment company

Dwolla for “falsely claiming its data security

practices ‘exceed’ or ‘surpass’ industry security

standards” and “falsely claiming its ‘information

is securely encrypted and stored.’”

Dwolla was hit with a $100,000 penalty, ordered

to fix its security system and publicly exposed

as an unsafe vendor — despite not having a data

breach. It’s almost certain that there will be more

(and higher) penalties in the future, and the industry

is simply not ready. Here are a few of the largest

roadblocks the industry faces today:

1. CFPB compliance isn’t the only thing to

worry about. Organizations face a maze of

federal, state and local data rules, which often

apply different standards. Some states define

security standards in technologically neutral

ways, while others mandate specific controls

like encryption. Breaches, breach notifications,

and citizens privacy rights vary from state to

state as well.

Real estate organizations don’t have the

expertise or the time to keep up with dozens

of different compliance regimes, in addition

to CFPB rulemaking and enforcement actions.

Dwolla was hit with a $100,000 penalty, ordered to fix its security system and publicly exposed as an unsafe vendor…

The Complete Guide to CFPB Compliance for Realtors 5

And with many of these laws being

relatively new and untested, even figuring

out issues like applicability, enforcement

risk and jurisdiction can be a challenge.

2. You can’t control where NPI data goes

in the cloud. When you upload a file

to cloud storage or send an email, the

data travels through multiple servers

before it reaches its destination. All you

know is that the data is going to end up

on the service provider’s server, not

how it gets there.

Most cloud file storage and email apps do

encrypt, using point-to-point encryption

protocols such as TLS. Data is encrypted

in your computer and sent to your local

server, which decrypts it, re-encrypts

and sends it on to the next server, until it

reaches its destination. The problem with

this type of encryption is that it depends

on the server’s security. If a server doesn’t

support up-to-date encryption standards

or has been compromised, a hacker

could breach your NPI, and you’d never

even know.

3. Everyone has their own way of doing

things. Your mortgage broker may store

information in the cloud, or on-premises;

your lawyer may use paper records,

electronic records or both; the company

running your background checks might

communicate with secure portals or

email; they may use their own encryption,

or no encryption at all.

You get the idea — there are hundreds

of different ways of transferring and

processing data, and they’re not

compatible. If you’re a real estate

agent working with different mortgage

brokers and lawyers who each have their

own portals, there’s no good way to

communicate with everyone securely.

And furthermore, your customers and

partners may not be able to figure

out complex security tools like secure

portals. Even if you’re doing everything

right, a customer sending their mortgage

application over an unencrypted email

can still breach NPI.

Encrypted Content

Sender Recipient(Only interaction)Mail Client Sender’s

Mail ServerRecipient’s Mail Server

Encrypted Content

Encrypted Content

Encrypted Content

The Goal: Keep NPI Encrypted the Entire Time

The Complete Guide to CFPB Compliance for Realtors 6

4. Real estate deals involve a lot of information

transfer between multiple parties. Real estate

agents, sellers, mortgage brokers, lawyers,

lenders and credit agencies are all involved

in the process, sending documents back

and forth. And CFPB rules have enforced

standardized paperwork requirements that can

make the process even more complicated.

For example, TILA-RESPA Integrated Disclosure

(TRID) enforces the three day rule. The Lender

can’t complete the transaction unless they’ve

provided a closing disclosure at least three

business days before. If the APR is changed by

more than 0.125%, the loan product is changed

or a prepayment penalty is added, they have

to wait another three days.

Similarly, the loan estimate has to be delivered

to the consumer within three days of receiving

the consumer’s application.

If half of the people involved in transactions

are using mail, and the other half are using a

wide variety of incompatible electronic tools,

both delivering the right forms at the right time

and maintaining adequate records become

much more difficult. These complex paperwork

requirements also dramatically increase the

chance of accidentally sending NPI to the

wrong person, potentially creating a breach.

More companies are turning to data loss prevention rules to

automatically secure sensitive messages

The Complete Guide to CFPB Compliance for Realtors 7

II. Simple Client-Side Encryption: The Key to CFPB Compliance

The Complete Guide to CFPB Compliance for Realtors 8

In a 2016 Sans Institute whitepaper on encryption compliance,

Technical Director Dave Shackleford emphasized the importance

of encryption across regulatory regimes:

“Most of today’s standards and compliance regulations are

concerned largely with the protection of private data at rest,

during transactions, and while it traverses network connections.

Some of these regulations make specific recommendations

or require particular technologies for compliance. For all of

them, however, encryption can be employed to satisfy the

protection requirements. By determining what data you are

required to protect, locating the data at rest and in transit, and

implementing the appropriate encryption technologies, you

can significantly improve your overall security posture while

complying with any number of data privacy regulations.”

Unfortunately, the difficulty of many encryption solutions often

prevents people in the real estate industry from securing NPI. A

recent study found that 7 in 10 mortgage lenders let applicants send

unencrypted emails containing applications, and only 12% even

provided a secure email option. When asked why, lenders stressed

the fact that customers were most comfortable with email. One

survey respondent said this:

“ Oftentimes it was easier to have my clients send documents

like W-2s through email because everyone has access to an

email account. Most [lenders] don’t want to take the time to

explain what a secure portal is and how to use it. Everyone

understands email.”

It’s not enough for encryption to be technologically secure — it

also has to integrate easily and intuitively with the email customers

are most comfortable using, or else they won’t adopt it.

7 in 10 mortgage lenders let applicants send unencrypted emails containing applications

The Complete Guide to CFPB Compliance for Realtors 9

Introducing Virtru Client-Side Email Encryption for CFPB Compliance

Virtru Pro is a plugin browser extension that adds user-friendly encryption to Google Apps, Gmail,

Microsoft Office 365, and Outlook. It installs in seconds, providing complete client-side encryption, along

with valuable features to give you more control over your email. Here’s how Virtru supports complete

CFPB cloud compliance:

A seamless dashboard

experience lets you

manage both users

and content

The Complete Guide to CFPB Compliance for Realtors 10

1. Virtru Pro meets or exceeds both CFPB

requirements and state compliance regimes.

While CFPB compliance rules don’t explicitly

mandate encryption, many federal, state and local

compliance regimes do. Virtru provides military-

grade encryption for business and government

organizations across industries. It’s designed

to go beyond CFPB requirements, meeting the

most stringent data security regimes. That means

you can conduct business anywhere, without

worrying about whether inadequate email and

file encryption makes you non-compliant.

2. Virtru uses client-side encryption.

Cloud storage, email providers and portals use

point-to-point encryption, leaving your message

vulnerable if it passes through an unsecured server.

Virtru uses superior client-side encryption, which

secures your NPI before it leaves your computer

and only decrypts it when it reaches the recipient.

If an email or file passes through a compromised

server your data will be safe, as it will still be

encrypted.

And hackers can’t break the encryption by guessing

or bruteforcing the key, either. Virtru uses 256-

bit AES encryption, which has so many possible

combinations that it would take a supercomputer

longer than the age of the universe to guess all

the possible codes.

3. Virtru email encryption is compatible with

all of your partners.

Virtru Pro works with all major email services,

including Gmail, Outlook and other common

webmail applications. With one click, you can

encrypt emails and attachments to business

partners, clients or anyone else — even if they

don’t have Virtru installed. This allows real estate

agents, mortgage brokers and other industry

professionals to send messages and financial

documents with one single system, simplifying

communication and reducing the chances of

CFPB compliance breaches.

Virtru Pro works with all major email services, including Gmail, Outlook and other common webmail applications.

The Complete Guide to CFPB Compliance for Realtors 11

4. Virtru Pro protects against accidents and

records if a message has been opened.

Virtru Pro read receipt automatically displays which

recipient (or recipients) have opened a message.

This allows you to ensure that mandatory notices —

such as those required by TRID — are received by

the proper person within the mandated timeframe.

Virtru Pro provides additional protection against

breaches. If you accidentally send a message to

the wrong recipients, you can revoke it with a click,

then check for a read receipt to see if it has been

opened. If you revoke before the recipient reads

it, you’ll have documentation that a breach was

reverted. But even if it has been opened, revoking

it will prevent future access, decreasing exposure

of NPI.

Virtru Pro can even disable forwarding to prevent

recipients from sharing sensitive communications,

or set time limits, after which the message will

no longer be available.

Virtru DLP provides further protection against

inadvertent breaches, by automating CFPB

compliance rules for your office. Using fully

customizable rules, it scans the emails and

attachments for sensitive information, such as

Social Security or account numbers, words like

“mortgage” and email addresses. It then triggers

compliance actions, such as encrypting the

message, stripping attachments, warning the

user or sending a copy to a supervisor.

Disable

forwarding and

revoke access

Recall emails

you’ve already

sent

Set DLP rules

related to CFPB

The Complete Guide to CFPB Compliance for Realtors 12

As both a real estate brokerage service and

lending and title insurance provider, Baird &

Warner has always taken security seriously.

The Chicago-based company implemented

a secure portal for transmitting NPI, but

employees still needed to send emails

— often with sensitive information. With

no email encryption in place, they risked

exposing customer names, bank account

and Social Security numbers. As Mark

Steward, VP of Technology

put it, “that’s how identity

theft happens.”

Additionally, the real estate

brokerage firm understood

the importance of meeting CFPB compliance

requirements for secure NPI transmission —

particularly with increasing enforcement. The

company could no longer afford the risks

of unencrypted email, and neither could its

customers.

Baird & Warner investigated other email

encryption products, but Virtru was the only

one that was easy for both the recipient and

the sender. The firm loved having the ability

to encrypt messages with a single click, and

the ease with which customers could read

and securely reply to emails — even if they

hadn’t installed the software. Baird & Warner

were able to train staff in just a few minutes,

and let Virtru’s short instructional videos

handle the training for anyone who missed

the initial meeting.

The real estate brokerage service

also valued Virtru’s customer

service in meeting their complex

licensing and access needs.

We worked closely with them

to ensure that they had the right

access level for each user at the right price,

ensuring that Virtru Pro and Virtru DLP could

completely meet their needs.

Baird and Warner sets high standards for

their company and their customer security —

According to Steward, anything below “100%

compliance” is “too big a risk.” Virtru provided

the technology, training and customer

service to meet that goal.

A Customer Success Story: Baird & Warner

“…anything below 100% compliance is too big a risk.”

The Complete Guide to CFPB Compliance for Realtors 13

III. More Information on CFPB Compliance in the Cloud

The Complete Guide to CFPB Compliance for Realtors 14

Webinar: NPI Security – Why Email

Encryption is Your Secret Weapon

Article: How Encryption Can Help with CFPB

Compliance

Article: 6 Common Ways Employees

Compromise Enterprise Data Security

(And What You Can Do About It)

Webinar: Securing Gmail and Drive: Security

Tips from Google and Virtru

Article: Journey of an Unencrypted Email

Webinar: Data Security Essentials: Strategies

to Protect Non-public Personal Information

eBook: The Complete Guide to Email

Encryption for Google Apps Administrators

eBook: Client-Side Data Protection with

Virtru Encryption as a Service (EaaS)

Short Video: Virtru for Business: The Easiest,

Most Secure Way to Share Data

Short Video: Introduction to Virtru DLP

The CFPB has considerable freedom to

set its own enforcement policies and

compliance priorities, and it seems to be

gearing up for an increasing focus on NPI

security. As consumers and businesses

continue to give input, the organization

will continue to evolve.

Here are some resources to help you stay ahead of CFPB requirements.As consumers and businesses continue to give input, the organization will continue to evolve.

The Complete Guide to CFPB Compliance for Realtors 15

CFPB Compliance Checklist

While CFPB compliance contains many rules unrelated to security and electronic communication, email

and file sharing pose some of the biggest risks of NPI breaches. Therefore, it’s crucial to evaluate your

organization’s data security practices to make sure your team is sending NPI safely.

The following checklist will help you determine your organization’s email and file encryption needs, and

choose the appropriate CFPB compliance solutions.

Requirement Yes or No?

Do any of the employees in your organization have access to NPI?

If yes, do you conduct background checks before giving employees access to NPI?

Do you have security measures in place to prevent unauthorized employees from improperly accessing NPI?

Do your employees use email or a file sharing service (such as Google Drive or Dropbox) to share or access NPI?

If yes, does that service have client-side encryption?

Do you have a written privacy and information security Policy?

If Yes, does that policy ensure that your employees only use secure methods to deliver NPI?

Does that information security policy prevent unencrypted storage and transmission of NPI (e.g. on a thumb drive or personal device)?

Does your policy establish a secure way to dispose of NPI when it’s no longer needed?

The Complete Guide to CFPB Compliance for Realtors 16

Requirement Yes or No?

Does your company train, supervise and audit employees in compliance with your information security policy?

Do you ever share NPI outside of your organization?

Do you know how your recipients protect the NPI you exchange with them?

Do you have a way to verify that NPI was received?

Could you rescind NPI if you sent it to the wrong organization?

Make CFPB Compliance as Easy as Sending an Email

The cloud has been a boon to the real estate industry, allowing realtors to communicate, share

information and even finalize transactions online. But that ease has created new risks of data theft and

CFPB compliance violations. Virtru’s CFPB compliance solution allows you to use the email and file

sharing apps that make your job easier, without the risks of unencrypted data. Learn if Virtru is the CFPB

solution for your organization:

Download Virtru secure email for free, or contact us to find out more.