A GLBA privacy notice tells a borrower what personal financial data a lender collects, who it shares that data with and how the borrower can opt out. Under Regulation P, a customer gets it no later than when the loan relationship starts. An applicant who never closes gets one only before the lender shares their data outside the narrow exceptions.
When is a GLBA privacy notice required for a loan applicant?
A GLBA privacy notice is required at two moments under Regulation P, the CFPB rule behind the Gramm-Leach-Bliley Act privacy duties. A customer gets it by the time the relationship begins. Any other consumer gets it before the lender discloses their nonpublic personal information to a nonaffiliated third party, unless an exception covers that sharing.
The difference between those two words drives everything else. A consumer, in Regulation P terms, is anyone who applies for or obtains a financial product for personal, family or household use. A customer is a consumer who has a continuing relationship with the institution. The CFPB's text of Regulation P section 1016.4 says that for a consumer loan, the customer relationship starts when the lender originates the loan or acquires its servicing rights.
So a mortgage applicant who sends twelve months of statements, gets an approval and closes becomes a customer at closing. An applicant who sends the same statements and then walks away stays a consumer. That applicant does not need a notice at all if the lender shares their data only under the exceptions in sections 1016.14 and 1016.15, which cover things like processing the transaction the consumer asked for and complying with law.
Section 1016.4 also allows a short delay in two cases: the relationship was not the customer's choice, or giving the notice right away would substantially delay a transaction the customer agreed to receive the notice for later. The delay does not apply when the borrower is sitting in your office or applying on a website where the notice can be shown.
What the GLBA privacy notice must say about bank statement data
A GLBA privacy notice must describe, by category, the nonpublic personal information the lender collects and discloses, the kinds of companies that receive it, the borrower's opt-out right and how the lender protects the data. Bank statements land squarely in that information. Account numbers, balances, payroll deposits and the names of the people a borrower pays all count.
The CFPB's text of section 1016.6 lists nine content items. The checklist below pairs each one with an example answer a small broker might give. The answers are examples for illustration, not model language.
| Content item in 1016.6(a) | Example answer for a small broker |
|---|---|
| Categories of information collected | Application data, credit reports, bank statements, pay stubs and tax returns |
| Categories of information disclosed | Application data and statements, if any go beyond the exceptions |
| Categories of affiliates and third parties receiving it | None outside the exceptions, for a broker that only places loans |
| Information about former customers disclosed | The same categories, to the same parties, after the loan closes |
| Sharing under the joint marketing exception | None, if the broker has no joint marketing agreements |
| Right to opt out and how to use it | A phone number and a mailed form, if any sharing triggers opt-out |
| Fair Credit Reporting Act affiliate sharing notice | Only if the broker shares credit data with affiliates |
| How the data is protected | Encryption, access limits and a retention schedule |
| Sharing permitted under the exceptions | A plain statement that lenders, appraisers and title agents receive data to process the loan, as the law permits |
The collection category is where many notices are thin. A borrower who is self-employed often sends both W-2s from a part-time job and business account statements, and the notice should cover both kinds of record. The guide to combining W-2 and self-employed income on one application shows how many document types such a file can gather.
The protection item should describe practices the firm actually runs. When statements sit in a tool like TrueBankFlow, which encrypts files in transit and at rest and lets the team choose how long files stay after a report is exported, the notice can name those practices plainly. See how TrueBankFlow handles statement files.
Does the annual GLBA privacy notice exception apply to your lending shop?
The annual GLBA privacy notice exception lets a lender skip the yearly notice when two things are both true. The lender shares nonpublic personal information with nonaffiliated third parties only under the exceptions in sections 1016.13, 1016.14 and 1016.15. And its sharing policies have not changed since the most recent notice it sent.
Without the exception, the CFPB's text of section 1016.5 requires a notice at least once in any period of 12 consecutive months while the customer relationship lasts. The lender picks the 12-month period and must apply it consistently.
Most brokers and small lenders qualify for the exception, because they send borrower data only to the parties needed to make the loan. The test is honest self-review, not assumption. A firm that starts selling leads to an insurance agency, or adds a marketing partner, has changed its practices. If the change requires a revised notice, that revised notice counts as the new initial notice for annual timing. If it does not, section 1016.5 says the annual notice is due within 100 days of the change.
Who delivers the privacy notice when a mortgage broker and a lender share a file
A mortgage broker and the lender it places a loan with each have their own relationship with the borrower, so each weighs its own notice duty. Section 1016.5 treats a brokered borrower as a former customer of the broker once the loan is obtained and the broker stops sending statements or notices about it.
The broker collects the application and statements, and the lender originates the loan. In practice, the two firms should agree in writing on who sends what, and when. The broker's notice usually goes out with the application package. The lender's notice usually goes out with the loan documents. Both should match what the firm really does with the data. A broker that forwards the same file to three lenders to shop a rate is disclosing it three times. That sharing usually falls under the exception for processing a transaction the borrower asked for, and the notice can say so in its exceptions statement rather than list lenders as an opt-out category.
The notice also has to be delivered in a way the rule accepts. Section 1016.4 points to section 1016.9 for delivery methods, so check that section before relying on an emailed PDF or a link.
Privacy notice slips on declined, withdrawn and paid-off loan files
Privacy notice errors cluster on files that never become loans, or that end. A declined applicant is a consumer only. If a lender shares nothing outside the exceptions, that applicant needs no privacy notice. What a declined applicant does need is a reason. The guide to the adverse action notice for cash flow based declines covers that separate duty.
Withdrawn files cause the opposite slip. A firm sends a full privacy notice to everyone who starts an application, which is allowed, and then forgets that its notice promised a retention practice it does not follow. The notice becomes a written statement the firm can be held to.
Paid-off loans end the annual duty. Section 1016.5 says a closed-end loan customer becomes a former customer when the loan is paid in full, charged off or sold without servicing. Keep sending annual notices after that and the cost is only postage. Stop too early, while the firm still services the loan, and the borrower misses a notice the rule requires.
One more check belongs in the privacy review. The data categories a firm lists in its notice are often the same ones its underwriting rules read. The post on fair lending in cash flow underwriting explains how to test whether rules built on that data treat borrowers evenly.