BrokerVA
BrokerVA Team · October 28, 2026

Is Borrower Data Safe With an Offshore Virtual Assistant? What to Verify

Is Borrower Data Safe With an Offshore Virtual Assistant? What to Verify

Borrower data can be safe with an offshore virtual assistant, but only when specific controls are in place and you can verify them. Location matters less than access controls, encryption, training, and oversight. Here is what the FTC's Safeguards Rule expects, what to check with any provider, and what BrokerVA can and can't say today.

Is Geography the Real Question?

Not on its own. A provider anywhere can have strong controls or weak ones, so the question is what is in place and whether you can see evidence of it. Offshore arrangements do add a few questions worth asking, such as where data is accessed from, where it is stored, and who else touches it. But those are specific questions with specific answers, not a reason to assume risk or safety.

In Ncontracts' 2026 survey, reported in MBA Newslink, 52% of organizations experienced a third-party cybersecurity incident in the last 12 months. The survey covers financial services broadly, and Ncontracts sells vendor-risk software, so treat it as an indicator. It does show that vendor risk is not limited to offshore providers.

What Does the Safeguards Rule Expect?

The FTC's Safeguards Rule, 16 CFR Part 314, applies to non-bank financial institutions, which includes many mortgage companies and brokers. Confirm how it applies to you with your counsel. It requires a written information security program, and the elements named in the rule include:

  • A designated Qualified Individual who oversees the program
  • A written risk assessment
  • Access controls and a data and systems inventory
  • Encryption of customer information in transit and at rest, or approved alternative controls
  • Multi-factor authentication for anyone accessing customer information systems, unless the Qualified Individual approves an equivalent control
  • Secure disposal of customer information
  • Monitoring and logging, plus testing, including penetration testing and vulnerability assessments
  • Training for staff
  • Oversight of service providers
  • A written incident response plan

Smaller institutions get some relief: the rule exempts an institution with customer information on fewer than 5,000 consumers from certain elements, such as the written risk assessment and incident response plan. The Conference of State Bank Supervisors publishes a Safeguards Rule compliance checklist that is useful for non-bank institutions. These requirements are summarized here, so read the rule or ask your counsel for the details that apply to you.

What Does It Say About Service Providers Like a VA?

That you stay responsible for them. The rule requires you to take reasonable steps to select service providers capable of maintaining appropriate safeguards, to require those safeguards by contract, and to assess the provider periodically. The CFPB's Compliance Bulletin 2016-02 makes a similar point for consumer financial law: a vendor relationship doesn't absolve a supervised entity of responsibility. It is non-binding, and it does not appear on the CFPB's list of withdrawn guidance, last updated July 22, 2026.

In practice, the provider's controls are part of your program. See Who Is Liable for Outsourced File Errors?.

What Happens If Something Goes Wrong?

The rule includes a notification requirement. Since May 13, 2024, a covered institution must notify the FTC when there is unauthorized acquisition of unencrypted customer information involving at least 500 consumers, as soon as possible and no later than 30 days after discovery. That clock runs from when you discover the event, so how quickly your provider tells you matters.

Our recommendation, not a rule: put the notification terms in your contract. Ask what counts as an incident, how fast the provider will tell you, who your contact is, and what information you'll receive. See Security Due Diligence for Outsourced Mortgage Operations.

What Should You Verify With an Offshore Provider?

Ask for evidence, not reassurance. These questions map to the rule:

  • Access. Does each person have an individual login with multi-factor authentication? How is access granted, reviewed, and removed?
  • Devices. Can files be downloaded to local devices? How is that prevented?
  • Encryption. Is data encrypted in transit and at rest on systems the provider controls?
  • Logging. What is logged, who reviews it, and can you see logs for your files?
  • People. Are specialists employees or contractors? What training do they receive?
  • Incidents. Is there a written incident response plan, and how fast will you be told?
  • Subcontractors. Who else touches your data?
  • Location and disposal. Where is data accessed and stored, and what happens to it when the engagement ends?
  • Independent assurance. Is there a SOC 2 report or other independent assessment, and if not, what is in place instead?

The full list of 30 is in our security due diligence checklist.

What Does a Good Answer Look Like?

Specific, documented, and enforced. A named owner for security. A written program you can read. A control that prevents a problem, not a policy asking people to avoid it. An honest account of what is and isn't in place. Be wary of vague language, assurance by implication, and reluctance to put answers in writing.

What Can BrokerVA Say Today?

Here is what we can state. BrokerVA's NMLS number is 1977844. Our 150+ mortgage operations specialists are organized into five stage-based roles, Setup, Disclosure, Closing, Funding, and Post-Closing, and our work is administrative and clerical, with accountability for the loan staying with you and your licensed people. We don't claim to make anyone compliant.

We haven't published detailed security specifics on this page, and we'd rather you ask than assume. Put the questions above to us as you would to any provider, and we'll talk through them on a call. Every client also gets a dedicated Coach for a 6-week implementation, who learns your processes, workflows, SOPs, and expectations, including how you want files and access handled, followed by ongoing coaching and regular check-ins. Our goal is to lower your cost to originate, and pricing is customized to your volume and the roles you need. We can't promise a specific saving, since it depends on your operation. See how BrokerVA works and our security page.

Frequently Asked Questions

Is borrower data safe with an offshore virtual assistant? It depends on the controls, not the location. Look for individual logins with multi-factor authentication, encryption, logging, training, a written incident response plan, and clear oversight, and ask for evidence of each.

Does the FTC Safeguards Rule apply to mortgage brokers? It applies to non-bank financial institutions, which includes many mortgage companies and brokers. Smaller institutions, those with customer information on fewer than 5,000 consumers, are exempt from some elements. Confirm how it applies to you with your counsel.

When must a data breach be reported to the FTC? Under the rule, when unencrypted customer information on at least 500 consumers is acquired without authorization, as soon as possible and no later than 30 days after discovery. The requirement took effect May 13, 2024.

Am I responsible for my virtual assistant provider's security? You remain responsible for overseeing service providers. The rule expects you to select capable providers, require safeguards by contract, and assess them periodically.

Sources

Doing a vendor review that includes data security? Book a call with BrokerVA and bring your questions. We'll walk through your numbers and show you our cost calculator.

BrokerVA | NMLS #1977844