Protection of CONSUMER information PowerPoint Presentation By Deanna Sabey, General Counsel CITYWIDE HOME LOANS

PROTECTION OF CONSUMER INFORMATION SUMMARY The security and integrity of consumer non-public personal information is important to Citywide. We take the protection of this information seriously, and expect our employees to take measures so the information is protected from any prohibited disclosure or improper use. This presentation is designed to help you understand: what “consumer non-public personal information” means, what Citywide does to protect the information, and what you are expected to do to help protect the information. This presentation also explains what happens if there is an unintentional disclosure or a theft or conversion of protected information.

Protection of consumer personal information GRAMM-LEACH-BLILEY ACT What consumer information is protected? Social security numbers Account numbers Driver’s license numbers Bank statements Financial information W-2s Employment information and verifications Credit reports Applications and any information provided in the applications Credit scores Any other information a consumer provides to obtain a residential mortgage loan Non-public financial information Protection of consumer personal information

Protection of consumer personal information GRAMM-LEACH-BLILEY ACT What is publicly available information? Any information a lender has a reasonable basis to believe is legally available to the general public from: federal, state, or local government records; widely distributed media; or disclosures to the general public required by law. Examples: information found in a telephone book, information available on a website, information recorded in a county recorders office or court clerk’s office. Protection of consumer personal information

GRAMM LEACH BLILEY ACT Citywide Privacy Notice to Consumers Permits disclosure of nonpublic personal information (protected consumer information) to: a third party, but only when required in the normal course of business (such as warehousing lenders, investors), and on a need-to-know basis; regulatory authorities and law enforcement officials; protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability; report account activity to credit bureaus; consumer reporting agencies; and respond to a subpoena or court order, judicial process or regulatory authorities.

PROTECTION OF CONSUMER INFORMATION What Citywide does to protect consumer information Conducts criminal background checks on employees as part of the hiring process. Prohibits employees from storing consumer non-public personal information on any personal or non-Citywide device. Uses firewalls to protect and encrypt network communication. Critical systems are backed up and stored at a secure, third-party vendor. Servers are located in a locked room with restricted access. Employees with remote access are required to use a VPN with encryption to access Citywide’s system. Provides secure storage for hard-copy files. Requires use of document shredding services. Restricts access to systems. Requires employees to follow password policy. Conducts third party vendor due diligence and periodic review.

Protection of consumer information Employee Actions to Protect Consumer Information Avoid storing protected information on personal devices (laptop, smartphone, hard-drive, etc.) or in personal emails. Devices can be stolen and emails can be hacked. Keep hard-copy documents in a locked cabinet or locked office. Make sure guests are escorted to a location rather than let them walk through the office unattended. Place discarded documents in a shredding bin. Do not give passwords to any other person to use. You could be held responsible for what that person does with your password. Only share protected information with third-parties as authorized by Citywide on a need-to-know basis in the normal course of business. Make sure computer screen is locked while not in use to prevent unauthorized access/viewing.

What happens if protected information is accidentally disclosed? Inform Citywide’s General Counsel. She will oversee the process to: document the disclosure; notify the consumer; provide the consumer with information from the Federal Trade Commission instructing the consumer on how to take protective measures on credit reports; give the consumer a designated Citywide employee’s contact information for any further questions; and take measures to prevent further disclosure issues.

PROTECTING CONSUMER NON-PUBLIC INFORMATION What if someone has taken protected information from Citywide? Notify Citywide’s General Counsel. Senior Management will then assess the nature and scope of the incident. If appropriate, Citywide will: Notify appropriate law enforcement authorities. Notify appropriate regulators. Take measures to contain and control the incident. Prevent further unauthorized access. Notify customers when warranted. PROTECTING CONSUMER NON-PUBLIC INFORMATION