# Borrower Authorization Form for Bank Statement Access

- Author: TrueBankFlow (https://www.truebankflow.com)
- Published: 2026-09-12
- Updated: 2026-09-12
- Category: Lending compliance and borrower data
- Canonical: https://www.truebankflow.com/blog/borrower-authorization-form

> What a borrower authorization form must cover before a lender verifies accounts or pulls statement data, the signature rules and how long it lasts.
A borrower authorization form is the signed consent that lets a lender verify a borrower's accounts, contact their bank or pull statement data from a third party. It should name who may collect what, from whom, for which loan and for how long, and it should be signed on paper or electronically before any request goes out.

## What should a borrower authorization form cover before statement access?

A borrower authorization form should cover five things: who is authorized, which accounts and data, the purpose, who may receive the data, and how long the consent lasts. A form that leaves one of these vague gives a bank or data vendor a reason to refuse the request, and gives the borrower a reason to dispute it later.

Most lenders use one general authorization at application and add narrower forms when a specific step needs one. The checklist below lists clauses worth reviewing. It is an example built for this post, and counsel should approve the final wording.

- [ ] **Parties.** The lender's legal name, plus any broker, servicer or investor the consent should also cover.
- [ ] **Borrowers.** Each signer by full name, with the last four digits of a taxpayer number if the lender uses one to match records.
- [ ] **Accounts.** The bank names and account types, or a clear statement that all deposit accounts listed on the application are covered.
- [ ] **Data and actions.** Verifying balances and deposits, requesting statements, confirming account ownership and, where used, connecting to a data aggregator.
- [ ] **Purpose.** The specific loan application, and whether the consent also reaches quality control, servicing or a later refinance.
- [ ] **Recipients.** Vendors that will handle the data on the lender's behalf, named or described by role.
- [ ] **Duration.** An end date, or an event that ends it, such as closing or a decline.
- [ ] **Revocation.** How the borrower can withdraw consent and what happens to data already collected.
- [ ] **Copies.** A statement that a copy of the signed form is as valid as the original, so banks accept a scan.

The recipients line ties into vendor oversight. Each company named on the form is one the lender must manage, which is the subject of [third party risk management for lenders](/blog/third-party-risk-management-for-lenders).

Business files need one more check. In a [business acquisition loan](/blog/business-acquisition-loan-underwriting), the accounts belong to the seller's company, not the buyer. The buyer cannot authorize access to them, so the form must be signed by someone with authority over the target's accounts.

## Borrower authorization form signatures: paper or electronic?

A borrower authorization form can be signed on paper or electronically. Federal law says a signature or contract in interstate commerce cannot be denied legal effect only because it is electronic. Lenders still need to capture the signature in a way that shows who signed, when, and what they saw.

That rule comes from [the federal ESIGN Act at 15 U.S.C. 7001](https://www.law.cornell.edu/uscode/text/15/7001). Section 7001(a) gives electronic signatures and records the same validity as paper ones. Section 7001(c) adds a separate step when another law requires a disclosure to be given to a consumer in writing. In that case an electronic version counts only if the consumer agreed to receive records electronically after being told of the right to paper copies, the right to withdraw consent and the hardware and software needed.

The authorization itself is the borrower's own statement, so it is the signature rule that matters most. The consent step matters for the disclosures that travel with it. A lender sending its loan disclosures electronically in the same session should collect that consent first.

Some steps need a specific kind of signed consent. Under [FCRA section 604(a)(2), 15 U.S.C. 1681b](https://www.law.cornell.edu/uscode/text/15/1681b), a consumer reporting agency may furnish a report "in accordance with the written instructions of the consumer." A lender that relies on that ground, rather than on its own permissible purpose, needs instructions in a form the agency will accept.

Where signatures are collected matters too. A borrower who signs and uploads the form through a [secure document upload portal for lenders](/blog/secure-document-upload-for-lenders) leaves an audit record. One who emails a phone photo of a signed page leaves much less.

## How long does a borrower authorization form stay valid?

A borrower authorization form stays valid for the period it states. No single federal rule sets one term for every use. Many lenders tie it to the loan, ending at closing or decline, and ask for a new form for later checks such as a pre-closing reverification or post-funding monitoring.

The 2024 section 1033 open banking rule offered one model for data access. Under [section 1033.401 of that rule](https://www.consumerfinance.gov/rules-policy/regulations/1033/401/), a third party collecting account data had to give the consumer an authorization disclosure, include a certification that it would follow the rule's limits, and get the consumer's signature electronically or in writing. Collection could then run for at most one year before a new authorization. A federal court has enjoined enforcement of that rule while the CFPB reconsiders it, as the [section 1033 rule guide](/blog/section-1033-rule) explains, so treat those terms as a reference point, not a current duty.

A practical approach for most lenders:

1. One form at application, valid until closing or decline.
2. A fresh form if verification happens long after signing, since banks may reject an old one.
3. A separate form for any ongoing data connection after funding, with its own end date.

## Borrower authorization gaps that stall account verification

Borrower authorization gaps usually show up when a bank or vendor rejects a request. The most common causes are a missing co-borrower signature, an account not covered by the form, or a purpose that does not match the request. Each one sends the file back to the borrower and adds days.

Patterns to check before sending a request:

- **Joint accounts.** Some banks want every owner on the account to sign, not only the borrower.
- **New accounts.** An account opened after the form was signed may fall outside a form that listed accounts by number.
- **Business accounts.** A personal signature does not cover a company account unless the signer has authority for the company.
- **Stale dates.** A form signed months ago may be refused by the bank even if it states no end date.

Once statements arrive, [TrueBankFlow](/) reads them into monthly totals and flags, with access limited to the lender's team and a retention period the lender chooses.