Establishing secure connection…Loading editor…Preparing document…

MLOA and Privacy Agreement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

MLOA and Privacy Agreement

This MLOA and Privacy Agreement (the Agreement) is entered into as of Effective Date: by and between Client Name: (the Client) and Originator Name: (the Originator). The Client and the Originator are each sometimes referred to herein as a Party and collectively as the Parties.

RECITALS

WHEREAS, the Client seeks mortgage loan origination and related services and authorizes the Originator to obtain, use, and disclose certain consumer, financial and property information necessary to evaluate, process and close a loan; and

WHEREAS, the Parties desire to set forth the Client's express authorization for information disclosure and the Originator's obligations regarding the privacy, security, retention and permissible use of nonpublic personal information in connection with such services; and

WHEREAS, the Parties intend that this Agreement satisfy applicable authorizations for information release and that the Originator may share information with affiliates, service providers and third parties as necessary to effectuate the transaction, subject to the privacy protections and limitations set forth below.

NOW THEREFORE, in consideration of the mutual promises contained herein and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. DEFINITIONS

For purposes of this Agreement: (a) "Nonpublic Personal Information" means any information provided by the Client or obtained by the Originator in connection with the loan relationship that is not publicly available, including, without limitation, social security number, tax identification number, income, assets, credit history, employment information, tax returns, and property valuation reports; (b) "Permitted Purposes" means the evaluation, underwriting, origination, processing, closing, servicing, sale, placement or secondary market transfer of a mortgage loan and related compliance, audit and fraud-prevention activities.

2. AUTHORIZATION TO OBTAIN INFORMATION

The Client expressly authorizes the Originator and its agents to obtain and verify credit reports, employment and income records, bank and asset statements, tax returns, appraisal and property information, and other financial and consumer information for the Permitted Purposes. The Client further authorizes third parties, including employers, financial institutions, insurers, title companies, appraisers and governmental entities, to release such information to the Originator upon request for Permitted Purposes.

3. SCOPE OF PRIVACY CONSENT

The Client consents to the Originator's collection, use, retention and disclosure of Nonpublic Personal Information as necessary for the Permitted Purposes. This consent includes, without limitation, disclosures to: (a) service providers retained to perform functions in connection with the loan; (b) purchasers or investors in the loan; (c) insurers, guarantors, and secondary market participants; and (d) governmental authorities, when required by law or regulation.

4. DATA SECURITY AND CONFIDENTIALITY

The Originator shall implement and maintain reasonable administrative, technical and physical safeguards designed to protect Nonpublic Personal Information from unauthorized access, disclosure, alteration and destruction consistent with industry standards. The Originator shall require any third-party service providers to maintain appropriate safeguards and to use Client information only for the Permitted Purposes.

5. DATA RETENTION AND DESTRUCTION

The Originator will retain records containing Nonpublic Personal Information for the period required by applicable law and for such additional period as reasonably necessary for business and regulatory purposes. Thereafter, the Originator will securely dispose of or anonymize such information in a manner intended to prevent reconstruction or retrieval.

6. LIMITATIONS ON USE AND DISCLOSURE

Notwithstanding the Client's consent herein, the Originator shall not use or disclose Nonpublic Personal Information for marketing unrelated products or services to the Client without separate written consent. The Originator shall not sell or transfer Nonpublic Personal Information to unaffiliated third parties except as necessary for Permitted Purposes or as otherwise required by law.

7. REPRESENTATIONS AND WARRANTIES

Each Party represents and warrants to the other that: (a) it has full power and authority to enter into and perform this Agreement; (b) execution and delivery of this Agreement have been duly authorized by all necessary corporate or other action; and (c) this Agreement constitutes a valid and binding obligation enforceable in accordance with its terms.

8. INDEMNIFICATION; LIMITATION OF LIABILITY

The Client agrees to indemnify, defend and hold harmless the Originator and its affiliates, officers, directors and employees from and against any and all claims, losses, liabilities, costs and expenses (including reasonable attorneys' fees) arising out of the Client's breach of this Agreement or any false representation made by the Client. Except for willful misconduct or gross negligence, neither Party shall be liable to the other for incidental, consequential or punitive damages.

9. TERM AND TERMINATION

This Agreement shall commence on the Effective Date and, unless earlier terminated pursuant to this Section, shall remain in effect through the later of (a) the date on which all obligations relating to the loan have been fully discharged, or (b) the date required by applicable law. Either Party may terminate this Agreement for material breach by the other Party upon thirty (30) days' written notice and failure to cure.

10. NOTICES

All notices under this Agreement shall be in writing and delivered by certified mail, nationally recognized overnight courier, or by hand to the addresses set forth below or to such other address as either Party designates in writing. Notices shall be effective upon delivery or refusal of delivery.

11. COMPLIANCE WITH LAW

Each Party shall comply with all applicable federal, state and local laws and regulations in performing its obligations under this Agreement, including those relating to consumer privacy, data protection, fair lending, and information security. The Originator shall provide reasonable cooperation to the Client in responding to governmental or regulatory inquiries concerning the Client's loan file.

12. AMENDMENTS; WAIVER

No amendment or waiver of any provision of this Agreement shall be effective unless in writing and signed by both Parties. No failure or delay by either Party in exercising any right shall operate as a waiver of that right.

13. COUNTERPARTS

This Agreement may be executed in one or more counterparts, each of which shall be deemed an original and all of which together shall constitute a single instrument. Facsimile, electronic image or other electronic signatures shall be deemed to be original signatures for all purposes.

14. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to principles of conflicts of law.

15. ENTIRE AGREEMENT; SEVERABILITY

This Agreement, together with any documents incorporated by reference and any written disclosures delivered to the Client, constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior agreements and understandings related thereto. If any provision of this Agreement is held to be invalid or unenforceable, the remainder of this Agreement shall remain in full force and effect.

16. MISCELLANEOUS PROVISIONS

The Parties agree that any dispute arising out of or relating to this Agreement shall first be referred to senior representatives of each Party for good faith negotiation. Nothing in this Agreement shall limit either Party from seeking injunctive or other equitable relief to prevent the unauthorized disclosure or use of Nonpublic Personal Information.

CERTIFICATION AND AUTHORIZATION

By signing below, the Client certifies that the information provided to the Originator is true, complete and correct to the best of the Client's knowledge and authorizes the Originator and its designees to obtain and disclose Nonpublic Personal Information as described in this Agreement. The Client acknowledges receipt of any required privacy notices and understands the scope of the authorization granted herein.

Client Name:

By:

Date:

Originator Name:

By:

Date:

Enter text✕

What the MLOA and Privacy Agreement Covers

A Mortgage Loan Originator Authorization (MLOA) and Privacy Agreement is a combined consent and data-handling notice used in mortgage and lending workflows. It authorizes a loan originator to collect, verify, and share consumer financial and identifying information (credit, income, assets) and explains how that information will be used, disclosed, and protected. The agreement typically describes permitted third-party disclosures, data retention, consumer rights, and privacy notices required by financial privacy law. It also includes signature and effective date fields so the authorization is explicit and time-limited.

Why this agreement matters for compliance and underwriting

An MLOA and Privacy Agreement documents borrower consent to information access needed for credit decisions and loan processing, and it memorializes the lender’s privacy disclosures required under federal and state law. Clear authorization reduces underwriting delays, establishes lawful data sharing pathways with service providers, and helps demonstrate compliance with financial privacy obligations such as GLBA and state consumer privacy rules.

Why this agreement matters for compliance and underwriting

Typical parties who complete or rely on this agreement

The form is used by lenders, mortgage loan originators (MLOs), brokers, servicers, and borrowers to document consent for data collection and sharing during loan origination.

  • Lenders and loan processors — to establish authorization for credit pulls, income verification, and third-party ordering (appraisals, title).
  • Mortgage loan originators and brokers — to obtain consumer data for loan matching, pricing, and underwriting.
  • Borrowers and co-borrowers — to provide express consent and receive privacy disclosures related to how their financial data is used.

Using a single combined MLOA and Privacy Agreement streamlines intake, reduces duplication of consent forms, and clarifies who may access or disclose borrower data during the transaction.

Representative signer roles

Loan Officer — MLO

The loan officer signs to confirm authorization to access and share applicant financial information for the mortgage application, and to acknowledge receipt of any lender privacy policy associated with the transaction.

Borrower — Primary

The borrower signs to consent to credit checks, income verification, and data sharing with service providers; the signature also documents acceptance of privacy notices and sets the effective date for data processing activities.

Core sections a professional MLOA and Privacy Agreement should include

A robust document organizes authorization and privacy terms clearly, aligning consent language with applicable statutes and operational needs so underwriting and compliance teams can rely on it.

Authorization Scope

Defines which specific financial and identifying records the originator may request, the purposes (loan origination, underwriting, servicing), limits on reuse, and the time window for authorization.

Privacy Notice

Summarizes the lender’s privacy practices, including categories of data collected, categories of recipients, and legal bases for disclosure applicable under GLBA or state privacy laws.

Third-Party Sharing

Identifies common recipients (credit bureaus, title companies, appraisers) and clarifies whether redisclosure is permitted and under what conditions.

Retention and Destruction

States how long records will be retained, procedures for secure destruction, and references to applicable retention rules for tax, regulatory, or consumer protection purposes.

Signature and Authentication

Includes signer name, date, typed or handwritten signature, and any required witness/notary or multi-factor authentication to support nonrepudiation.

Consumer Rights

Explains borrower rights such as revocation (if permitted), how to request copies, and contact information for privacy inquiries or complaints.

Step-by-step: completing and issuing the agreement

Follow this sequence to collect a valid authorization and preserve evidence of consent for underwriting and audit purposes.

  • 01
    Prepare Document: Populate borrower and loan fields before sending to avoid editing after signature.
  • 02
    Attach Disclosures: Include lender privacy notice and any state-required disclosures for consumer review.
  • 03
    Send for Signature: Use secure e-delivery or in-person signing; ensure signer receives consent disclosure if consumer-facing.
  • 04
    Capture Audit Trail: Retain timestamp, IP, and authentication logs to satisfy ESIGN/UETA enforceability tests.

Typical digital workflow for MLOA and Privacy Agreements

Digital execution simplifies intake and creates machine-readable records; these steps show a common automated flow used in lender systems.

  • Upload Template: Load a standardized MLOA template into your document system.
  • Pre-fill Data: Auto-populate borrower and loan fields from the LOS or CRM.
  • Authenticate Signer: Use email, SMS OTP, or stronger methods like KBA where required.
  • Archive Signed Copy: Store the signed PDF with audit trail and metadata for retention and retrieval.

Configuring an online execution workflow

Recommended settings and controls when configuring the agreement for eSignature and automated routing.

Field Configuration
Signature Type Specify allowable methods: typed, drawn, or cryptographic
Authentication Email + SMS OTP; use KBA/ID verification for higher-risk loans
Retention Policy Attach retention tags and retention periods per document type
Routing Order Set signer order and conditional routing for co-borrowers

Data protection and security measures to include

Encryption: TLS in transit; AES-256 at rest
Access Controls: Role-based permissions and SSO/SAML
Audit Trail: Timestamp, IP, and action log
Data Minimization: Collect only fields required for processing
BAA Availability: Business Associate Agreement where PHI is involved
Retention Tags: Metadata for automated retention and deletion

Consequences of incomplete or improper authorizations

Credit Pull Challenges: Missing or incorrect consent can prevent credit reporting and delay underwriting
Regulatory Liability: Violations of GLBA or state privacy rules may trigger enforcement actions
Civil Claims: Unauthorized disclosures can lead to borrower complaints and civil damages
Operational Delays: Incomplete fields or mismatched names cause rework and processing delays
Tax/Recordkeeping Gaps: Failure to retain signed records can complicate audits and compliance reviews
Reputation Risk: Data breaches or privacy incidents harm borrower trust and brand

Common preparation errors to avoid

  • Leaving effective dates blank or ambiguous, which can invalidate authorization windows.
  • Asking for unnecessary sensitive data without documenting a lawful basis or retention plan.
  • Using vague consent language like 'all information' without specific purposes and recipient categories.
  • Failing to attach the lender’s privacy notice or to document that the consumer received it.

eSignature vendor comparison for MLOA and Privacy Agreement workflows

Standard capability and pricing comparisons help choose a provider that supports required authentication, audit trails, and BAA availability for sensitive loan documents.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day trial Varies by plan Varies by plan Varies by plan Varies by plan
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No
Envelope Cap No cap 100 envelopes/user/year Varies by plan Varies by plan Varies by plan

Practical configuration checklist for eSubmission

Ensure your eSignature configuration matches legal, audit, and operational requirements for loan authorizations and privacy consents.

Field Configuration
Document Template Lock core authorization text; allow variable fields for borrower and loan identifiers
Identity Verification Select appropriate signer verification: email, SMS OTP, or KBA
Audit & Logs Enable full audit trail capture (IP, timestamp, actions)
BAA Settings Enable BAA options and contractual terms when processing PHI or health-related income verification

Supporting documents commonly attached to MLOA and Privacy Agreements

Attaching standard supporting documents prevents follow-up requests and speeds underwriting.

Identification

Government-issued photo ID copy (driver’s license or passport) to validate name and identity during verification and KBA checks.

Income Verification

Recent paystubs, W-2s, or tax transcripts showing income used to validate borrower representations in the loan application.

Asset Statements

Bank or investment account statements to demonstrate reserves or down payment funds required by underwriting guidelines.

Property Documents

Purchase contract, prior appraisal, or title commitment to link the authorization to the specific property transaction.

Practical tips for accurate, efficient completion

Adopt these practices to reduce rework and strengthen the evidentiary value of authorizations.

Standardize Templates
Use a single vetted template for all loan products to ensure language consistency and simplify audit reviews.
Pre-Fill Known Data
Populate borrower and loan fields before sending to minimize signer edits and save time.
Record Consent Evidence
Capture explicit consumer disclosures and any opt-outs; maintain verification logs per ESIGN requirements.
Limit Data Scope
Request only the data items necessary for processing to reduce privacy exposure and simplify recordkeeping.

How to update or amend an executed MLOA and Privacy Agreement

Follow a clear amendment process to preserve consent validity and maintain an audit trail for each change.

01

Identify Amendment Need:

Confirm which fields or authorizations require change and why.
02

Draft Amendment:

Prepare a short amendment that references original agreement and specifies changed items.
03

Notify Parties:

Inform all signers of the amendment and explain implications.
04

Obtain Signatures:

Collect new signatures using the same authentication strength as the original.
05

Attach and Archive:

Attach amendment to the original file and update retention metadata.
06

Audit Entry:

Log the amendment event and store audit evidence with the document.

Frequently asked questions about MLOA and Privacy Agreements

Answers to common operational and legal questions encountered when using combined authorization and privacy forms.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users