On June 23^rd, the IRS dropped a bombshell on the lending industry.  As of Midnight on July 1, 2016, many lenders will no longer be able to  verify directly borrower income except through snail mail. If the IRS sticks to its plan, domestic lending is about to slow to a snail’s pace.  Based on a June 24 call with the IRS, the agency may not have fully appreciated the unintended consequences of its mandate.

In a June 23 press release, the IRS announced changes to the procedures and requirements for all participants in the IRS’ Income Verification Express Service (IVES).  These participants use the program to confirm the income of a borrower during the processing of a loan application (commonly referred to as a 4506-T request). IVES participants are now required to conduct employee and client re-verifications and to certify their compliance with these new dictates by July 1, 2016.  The IRS will not deliver borrower income transcripts after Midnight on July 1, 2016 unless the certification is received.

In a June 24 call with the industry, the IRS confirmed this new policy applies to all lenders. The direct users of the IVES program must “re-verify,” the identities of all individuals submitting and retrieving IRS transcripts on its behalf. This reverification process requires the collection of the following:

1. Name
2. Date of birth
3. Address
4. Social security number
5. Email address
6. Phone number

Once re-verification is complete the lender must send a certification to the IRS that it has met the re-verification obligations to be able to continue to participate in the program.

There are other requirements regarding access management, transcript delivery, document retention, reporting of suspicious activity and security controls.

Resellers  must take even more steps. Resellers of borrower income transcripts must obtain from each client the following information:

1. Name of the company President, CEO or other Officer acting on behalf of the client (this most likely will be the client’s relationship manager).
2. Last four digits of the client’s social security number of the company President, CEO or other Officer acting on behalf of the client.
3. The employee identification number of the client
4. The company name
5. The businesses primary physical address.

The resellers must also maintain a list of all authorized users submitting and receiving IRS transcripts on behalf of the client. Resellers also must verify the legitimacy of all current and future clients through known trusted public sources.  The IRS gives as an example, locating a phone number and address for the client on a public telephone listing and then contacting the number or address to verify that the party at the number is legitimately their client.

While the goal of security for personal tax information is admirable, the fire drill seems unnecessary. IVES participants are encouraged to contact their legislators to advise them of the IRS’s actions and to seek delay so that the IRS’s objectives can be met in a thoughtful way.