Would someone mind sharing how you handle securing confidential information for employees who hold loans/mortgages with your institution? Currently, the only steps we really take is we do not require employees to list or verify their income. However, their loan file does contain their full credit report and also contains the income and credit report of their spouse. Employee files are kept with all our other loan files and are accessable to any and all employees. I suppose we could simply require any confidential information be placed in a sealed envelope before it is placed in the file. What other documents, especially relating to a mortgage, would be considered confidential, and should not be accessable to any random employee who files like doing some snooping?

We place finacial statements, tax returns, credit reports, and any docs with income (borrower and coborrower) listed in a separate file in HR. However, once we start imaging, we'll image these docs in a secure doc type that will have limited access then shred them after verification.

Same as above.

We keep all the docs Cowboys Fan mentioned in a sealed envelope in the file, and all employee's files are locked separately from other loan files. Only the EVP of lending and the President have authority to make employee loans, and only the supervisor of loan processing is allowed to process the loan. These are the only people that have access to the files also (except for when I need to review them - they are authorized to give me the key)

We image and have created a secure doc type that is not available bank-wide. The original documents (Note, Guaranties, Mortgages) of employees in the Mortgage and Credit Department are kept under dual control (those employees that have access to our Note Safes).

I personally would not be happy to know that my Tax Return has been imaged for all to see. We are very sensitive to this issue. Tax Returns not only contain a copy of a W2, they also have information on spousal income and other sources of income. All employees should not have access to income information that can be compared and discussed bank-wide.

Why? Only employees with a "need to know" reason should have access to loan files whether it's an employee loan file or a customer's loan file.

You may want to check your privacy policy. Our privacy policy states that only need to know employees will have access to customer information and then only to the information that is needed to perform the employee's duties. A teller does not need access to loan files to perform their duty.

IMO you have a serious privacy breach.

To clarify a bit, tellers do not access this area. That's not to say that they physically couldn't, but files are kept in a vault in a very conspicuous location, so if we were to see a teller (or any employee without a "need to know" reason) access this vault, it would certainly raise some eyebrows and lead to questioning. That being said, we certainly have a lot of employees who could have a need to access a loan file (loan officers which include our branch managers, asst managers, and Member Service Reps, collections personnel, loan servicing clerks, etc), and so employee loan files could potentially be looked at. My bigger concern is that employees who may have a legitimate need to access an employee's file (the loan servicing clerk who sets up the loan, or who may need to fix an error)will also have access to confidential information.

That's always the chance you take when getting a loan where you work. Those employees need to know that multiple people will see that information. In larger institutions the handling of a file will fall to more than two employees and sometimes as many as 1/2 dozen. The Lender, Loan Secretary, Loan Processor, Imager... will have access to that information throughout putting a loan transaction to bed. If you have centralized funding functions those employees make note of compliance or exceptions to policies related to current financial information, loan applications and/or tax returns.

You need to limit that information to as few employees as possible, but WE don't cripple ourselves trying to keep it so private it's hard to work. We have to give access to Auditors, Loan Review and Examiners. When you have companies like that coming in asking for access to anywhere from 25 to 120 files annually or semi-annually you have to find a system that works for your institutions and limits access to as few as possible.

Previous FI: All employee applications went through the CLO, no income or credit file disclosed, HR pulled credit file and revealed only the score to the CLO, credit file kept in personnel file, application reflected "see HR" for income and credit information, loan under a certain amount approved by CLO and CEO, over a certain amount approved by loan committee. Income and credit file kept confidential and without a lot of fuss or trouble.

Current FI: Credit report and income information is viewed by everyone, some hard feelings between some, not a good system or policy for employees to see incomes paid to peers!

Also, I worked for one of the top 5 largest FI's (not being bailed out by the way) and all employee income and credit reports were protected and the work flow was not disturbed. Internal auditors had no problems with our procedures and audited our records, made notes on income verification and credit reports to review with HR. Not a problem. The procedures are as easy or as difficult as you make them. To maintain peace and harmony, it's worth it to keep the records confidential in the long run.

What happens when job functions change and you are placed in a position where you learn someone with less education, less time on job, less experience, etc. is making substantially more than you are? Not a great happiness booster! Then you find out they are the CEO's neighbor's niece or nephew. Not a valid reason for the pumped up salary but things like this happen and sometimes it's best left covered up.