How mortgage brokers can collect bank statements and pay stubs securely

A mortgage file is the most sensitive bundle most people ever send: pay stubs, W-2s, two years of tax returns, bank and investment statements, a driver’s license and a Social Security number. NIST’s guide to protecting personal information notes that a Social Security number or financial account number is generally more sensitive than other fields, and that data in transit is protected “by encrypting the communications or by encrypting the information before it is transmitted” (NIST SP 800-122).

Email does the first at best, and leaves the documents readable in both mailboxes afterwards. An upload link that encrypts each file in the borrower’s browser does the second. With ShieldFive, only your firm holds the key, and our servers store ciphertext.

The FTC Safeguards Rule also names a mortgage broker as a financial institution (16 CFR 314.2); what that rule asks of a small firm is covered in the Safeguards Rule guide. This page is practical advice, not legal advice.

The CFPB’s loan application packet lists pay stubs for the last 30 days, W-2s and signed federal tax returns for the last two years, the two most recent bank statements, statements showing at least two months’ ownership of the down payment, proof of identity and a Social Security number (CFPB: create a loan application packet). The mortgage application checklist has that list, and ShieldFive offers it as a template when you create a request. Document requests for mortgage brokers shows the workflow in short.

Tell the borrower to send every page. The CFPB says to “include every page of multi-page documents, even ones marked ‘intentionally left blank’”, and to submit copies and keep the originals (CFPB: submit documents to the lender). A statement with a page missing is likely to come back, and the file stalls while you ask again.

Self-employed borrowers, gifts and large deposits need more: lenders ask where a large recent deposit came from. Add those items to the request as you learn about them.

1. Create a request from the mortgage application template, and remove or add items for this borrower.

2. Set a PIN of at least four characters and an expiry: up to 7 days on the free plan, or 30 or 90 days on Firm seats.

3. Send the link by email or text, and the PIN by a different channel, such as on the phone.

4. The borrower opens the link in any current browser, types the PIN and uploads photos or PDFs. No account, no app. Each file and its name is encrypted before it leaves the device.

5. You get an email when files arrive and open them in your browser. If nothing arrives after about three and seven days, you get a reminder to follow up. Revoke the link when the file is complete.

The help article on collecting bank statements and pay stubs from loan applicants lists every limit in one table: file size, file types, link expiry, reminders and plans.

LoanLens says “no accounts for clients”, that documents are encrypted with AES-256, and that files can auto-delete after a retention window; its homepage publishes no price (LoanLens). OnboardMap says clients need “no signup, no password, no app”, encrypts with AES-256 at rest, sends automatic nudges, and charges $12 per client onboarding after a free first one (OnboardMap). Neither page says who holds the encryption keys; if that matters to you, ask the vendor whether it can decrypt your borrowers’ files.

Chasing is light. On Firm seats (and during the trial), if you add the client’s email, ShieldFive reminds them at most twice, after about three and seven days, while required items are missing. The reminder cannot contain the upload link, because the decryption key never reaches our server, so it points the client back to the link you sent. You also get a reminder to follow up. Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. Tools such as OnboardMap chase the borrower harder.

It collects documents; it does not model loan scenarios, run a fact-find, pull credit or connect to your loan origination system. Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. There are no recurring requests.

You need a free ShieldFive account to create requests; only the borrower skips signup. Every link needs a PIN of at least four characters, which is one more thing to pass on.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model.