Policy, Program and Procedures

Hello. We are in banking and recently came across a potential exposure when we identified our Commercial Mortgage Teams were utilizing Vendors (Companies and Individuals) who are providing a very basic Title Search or Title Opinion. In our research, the majority of these vendors do not carry insurance, license, policies and procedures, etc. In these cases, Title Commitments and Title Policies are NOT being provided, just a basic search or opinion. While these vendors meet the vague definition of business agreement, they don't seem to present much of an exposure. I am looking for a little guidance/recommendations on how to handle these situations? TIA

This message was posted by a user wishing to remain anonymous

Hi! I work in the banking industry as well and I just recently did a deep dive into title company risk.  The 2 factors that strike me in the situation you are describing are:

1. What data has to be given to that title company for them to do that search? - If they require NPI to perform that service, then your institution has a duty to ensure it is handled properly. (i.e. written agreement with vendor, ensure vendor has proper controls in place)
2. What if the service is poor quality? Does the result of this service impact a business decision? - Ideally if a result of the Title Search/Title Opinion would influence whether or not a deal moves forward, you would want to make sure it is trustworthy.  How would you know if it is trustworthy? - The title insurance would typically play a part in that, but that aside, you would research the vendor.  If the vendor doesn't have insurance, license, policy/procedures, or anything to share with you to reasonably show they have their ducks in a row, and the department decides to do business with them anyways, they are essentially "accepting" the risk that Title Search/Opinion may not be good and any risk of loss that would result from it.

Short story long, how you tackle it really depends on your program and your organization. For me, I would leave it to the department head (or whoever has the authority on the department side) answer that number 2 question. 

If I confirmed there was there is no NPI being given and poor quality wouldn't impact anything, I would consider it low risk and not expect to get any real documentation. 

I would also consider the nature of the data overall in evaluating both the vendor, and what you are providing them and what they are providing.  Is what they have and possess available in the public realm independent of what you're providing them?  It may not be, as I'm not sure how you are interacting with them.  I do think the potential exists that title business by default of what they do, is somewhat public in nature.