Skip to content
StatementReady

Guides / Documentation

Collecting Bank Statements from Borrowers Without Leaving Them in Your Inbox

Oct 16, 2026 · Varaxon Technologies LLC d/b/a StatementReady

This is educational, not underwriting guidance. Rules below are quoted from specific lender documents as published when checked. Always use the current guidelines for your program.

A bank-statement loan means collecting 12 or 24 months of a borrower's statements, often for several accounts. Every page carries account numbers, balances and transaction history. How you collect and keep those files matters, both for the borrower and for your own obligations.

This is general information, not legal advice. Talk to your attorney about your specific obligations.

Why this is a legal issue for brokers, not just good practice

The FTC's Safeguards Rule (16 CFR Part 314) applies to financial institutions under FTC jurisdiction. The FTC's guide for businesses lists mortgage brokers among its examples of covered financial institutions. [1]

The Rule requires covered businesses to develop, implement and maintain a written information security program with administrative, technical and physical safeguards for customer information. [1] "Customer information" means any record containing nonpublic personal information about a customer, in paper, electronic or other form. [1] A borrower's bank statement fits.

Among the elements the FTC describes [1]:

  • Access controls: know who can see customer information and review regularly whether they still need it.
  • Know where data lives: keep an inventory of where information is collected, stored and transmitted.
  • Encryption of customer information on your system and in transit.
  • Multi-factor authentication for anyone accessing customer information on your system.
  • Secure disposal no later than two years after your most recent use of the information to serve the customer, unless there's a legitimate business need or legal requirement to keep it.
  • Oversight of service providers: pick providers that can maintain appropriate safeguards, put your expectations in the contract, and reassess them periodically.
  • A written incident response plan.

The FTC has exempted financial institutions that maintain customer information on fewer than 5,000 consumers from certain provisions of the Rule, not all of them. [1] Separately, a breach involving the unencrypted information of at least 500 consumers must be reported to the FTC no later than 30 days after discovery. [1]

Where statement collection usually goes wrong

Common practical risks in broker document workflows (not FTC findings):

  • Email attachments. Statements sit in your inbox, the borrower's sent folder, and anywhere the email is forwarded, with no expiry.
  • Text messages and photos. Phone photos of statements end up in camera rolls and cloud backups.
  • Shared drives with broad access. Everyone in the office can open every borrower's folder.
  • No deletion habit. Files from closed loans stay around for years.
  • Missing pages. A borrower who sends pages piecemeal creates more back-and-forth and more copies.

A better collection workflow

  1. Ask for the right thing once. Name the accounts, the exact months and "all pages." Missing pages or months mean a second request and more copies in circulation.
  2. Use an upload link instead of email. A link tied to one loan, with an expiry, keeps files out of inboxes.
  3. Limit who can open the files to the people working the loan, and use MFA on those accounts.
  4. Know where every copy is. Your LOS, your worksheet tool, and any lender portal you submit to.
  5. Delete what you don't need, on a schedule, consistent with your written program and record-keeping obligations.
  6. Add your tools to your vendor oversight file. Ask each provider how they handle data, and keep their answers.

Questions to ask any document or statement tool

  • Where are files stored, and are they encrypted in transit and at rest?
  • Who at the vendor can access them?
  • How long are files kept, and can you delete them sooner?
  • Are files used to train AI models?
  • Does the borrower upload link expire, and can you revoke it?
  • What happens if there's a security incident, and how will you be told?

Get the answers in writing.

How StatementReady handles borrower uploads

  • Borrower upload links expire within 7 days (you choose 1–7), and you can revoke them anytime.
  • Reconciliation: every statement is reconciled to its printed balances. Anything that doesn't tie out, or can't be checked, is flagged for your review.

Borrowers can upload digital or scanned PDFs (digital and scanned PDFs), and you get a 12/24-month worksheet with XLSX, CSV and PDF export. Using a tool doesn't replace your own Safeguards program. For your vendor file, email support@statementready.net with questions.

StatementReady assists your review. It doesn't make underwriting or credit decisions, and it doesn't replace your judgment or your lender's guidelines.

NFCU checked on real files; other US banks and credit unions are accepted, checked to the cent, and marked Unverified if a statement doesn't reconcile or can't be checked.

Get started → statementready.net — Your first 2 loans are on us.

Source (checked 2026-10-15)

  1. Federal Trade Commission, "FTC Safeguards Rule: What Your Business Needs to Know" (December 2024): https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know

The FTC notes that the text of the Safeguards Rule itself (16 CFR Part 314) is the best source of information. State laws and lender requirements may add obligations.

© Varaxon Technologies LLC d/b/a StatementReady. Lender and program names are trademarks of their owners. StatementReady isn't affiliated with any lender named here. Navy Federal is a trademark of its owner; StatementReady isn't affiliated with or endorsed by it. Privacy Policy · Terms

Related guides