1
Company and people
Verify the business and the people who will handle the work.
- Legal entity, ownership, address, and public contact details
- Named processors and relevant experience
- Insurance, permissioned references, and background requirements
- Applicable NMLS or state records
2
Scope and authority
Document who may do what before any file is transferred.
- Requested tasks and explicit exclusions
- File-eligibility and pause rules
- Borrower-contact role and approval boundaries
- Escalation points and supervision duties
3
Systems and information security
Confirm the approved information path and access controls.
- Secure transfer methods and approved systems
- Least-privilege LOS and portal permissions
- Multifactor authentication where applicable
- Retention, disposal, incident response, continuity, and access removal
4
Commercial and service model
Make the complete operating and pricing model legible.
- Pricing, fee triggers, minimums, and exceptions
- Withdrawn or denied file treatment
- Capacity, response expectations, and backup coverage
- Reporting, termination, and transition support
5
Evidence and monitoring
Put material claims and responsibilities in the approved agreement.
- Current official records
- Permissioned references
- Methodology for every published metric
- Sample status artifacts without borrower information
- A defined process for ongoing review