A HOW-TO guide for your business relations and PHE duties.

1. Employee Orientation A HOW-TO guide for your business relations and PHE duties.

2. Employee Orientation A Guide for your PHE job PHE specific requirements. What is required? WELCOME! Please become familiar with the PHE requirements of performing your job duties in a highly professional manner and to help in shortening the learning curve for new employees. A successful onboarding process.

3. All Employees Phone Caller ID / Voicemail Requirements Caller ID Voicemail You are required to immediately establish your business connection by correctly changing and/or programming your Caller ID to reflect Peoples Home Equity, or United Capital Lending, or Redstone Mortgage on your business phone lines. This is an important step to embark on your new business and its success with us. All PHE/UCL/Redstone related phones, whether office or mobile, must change/correct your voicemail message to reflect your business connection. Every potential customer seeking your assistance needs to know you work for PHE/UCL/Redstone. It gives them the reassurance that they have reached the correct party. Cell phones that may be used to conduct business or business emails are required to be password protected and use encryption. Apple iPhones offer encryption by default once you set a passcode. Android phones require you to turn on encryption in the settings, and it takes 1-hour to activate. 1 2

4. All Loan Officers NMLS Licensing / Marketing-Advertising NMLS Licensing Marketing-Advertising All employees must include our PHE company NMLS#63371 in all communications. (i.e., emails, letters, business cards, marketing materials, website profiles, social media outlets) All Loan Originators must transfer their license to PHE prior to originating loans, and also include your individual NMLS# in all communications as listed above, including but not limited to loan applications. All PHE/UCL/Redstone marketing-advertising must be submitted for approval PRIOR to distributing it to the public to marketing@peopleshomeequity.com. The Branch Office will be held accountable for any punishment and/or fines if final approval was not received and your materials were used without it. 1 2

5. New Hires / Existing Employees Training on our Loan Origination System (LOS) New employees who are issued LOS login credentials will receive a Welcome email from Dottie Stump, Compliance Coordinator, to schedule required training. Existing employees who need additional training will need to contact Dottie directly. Contact: (615) 872-0220 x301 or dstump@peopleshomeequity.com.

6. Good Grammar Shows Professionalism Using correct grammar in all areas and why it matters ✓ Use good ethics to write in a professional manner. 1 Good grammar should be a part of our everyday lives. 2 3 Do not use all CAPS; it appears you are yelling. 4 Use spell check tools; use correct punctuation. 5 Use it inside PHE, outside PHE, and with Vendors. 6 Good grammar shows that you are educated, not sloppy. 7 The way you express yourself speaks volumes. ✓ GrammarGirl is a resource to improve your writing

7. Why does Grammar matter? CFPB penalties for RESPA disclosure violations Correct data entry into LOS is required Correctness of data entry into our LOS program for Initial & RESPA disclosures is required to be grammatically correct. Usage of capital letters and case sensitive data entry is being monitored by the CFPB for RESPA violations. Recently, RealtySouth, Alabama’s largest real estate firm was fined $500,000 by the CFPB because disclosures did not use capital letters. 1 Grammatical correctness is important because… …it is the language that makes it possible to present ourselves professionally in written form. People associate grammar with errors and correctness. Correctness in grammar reflects upon correct etiquette. Proper capitalization is a cornerstone of good grammar. Following good grammar rules can help make the documents more readable, thus showing our applicants that PHE hires articulate communicators in today’s highly competitive business landscape. 2

8. Why does Grammar matter? CFPB penalties for RESPA disclosure violations PHE Policy in Practice: PHE strives to present accurate disclosures using correct grammar and capitalization. All PHE employees performing origination / operational duties are required to complete mortgage loan documents in an accurate and professional manner within regulatory guidelines. Below is an example of INACCURATE data entry that is not acceptable. Please be sure to use proper capitalization and verify the subject property address matches all required docs in file for disclosure and closing doc purposes (i.e., appraisal, title, HOI, USPS) 3

9. Protecting Confidential Information Preventing Identity Theft A 2014 compliance inspection reinforced our mitigation requirements: ALL confidential client information (CCI) must ‘never’ be left unattended. What does this mean? We have 8 areas of CCIthat you are required to comply with. Protecting CCI is a PHE high-level concern; your employment status requires your cooperation with all 8 areas addressed in the following pages.

10. GLBA & Privacy Law Requirements Your duties to protect CCI When printing documents with CCI appearing on them, you cannot leave them un-retrieved from printer(s). This exposes enough info for a serious risk of ID theft to occur for a consumer. This is also part of our agreement with the Credit Agencies to keep it confidential and in safe hands to comply with the Fair Credit Reporting Act (FCRA). Copy Machines You must always LOCK your computer screen before walking away from your desk at anytime (during & after hours). Press Ctrl+Alt+Del then Enter, OR press the Windows key+L on your keyboard. Inspectors are notorious for asking that a copy be made of something then using it as a ploy to see if you are locking your electronic devices before stepping away. Be mindful of this when you are working outside the office (i.e., internet café, conferences). Computers When traveling with CCI paper files from work-to-closings, work-to-home/office, you must notify your immediate Supervisor of what is being transported and it must be kept either in your trunk OR locked in the glove box/briefcase if your vehicle does not have a trunk. Laptops and/or electronic devices being transported must be password protected and have a label or sticker to contact your Supervisor with contact info, if lost. Traveling

11. GLBA & Privacy Law Requirements Your duties to protect CCI NO files may be left on your desk at any time that exposes CCI. Your paper file should be uploaded into ImageFlow or PHE secure network drive to prevent exposing CCI to anyone approaching your desk. If your office maintains paper files, they must kept under locked drawers/cabinets. Paper Files Shred items MUST be emptied into shred bins nightly before you go home. All shred bins must be locked at all times. Remote workers who are working from home must have shredding capabilities and follow these same rules. Shred Boxes All login credentials / passwords to electronic devices and websites used for PHE/UCL/Redstone business must be kept in a secure or confidential location. They cannot be readily available for someone to access your computer / server / or LOS. (i.e., sticky notes stuck to monitor screens, on desktops, or inside drawers are not secure locations) Secure Passwords

12. GLBA & Privacy Law Requirements Your duties to protect CCI When sending CCI in an email, it MUST be protected with 128-bit (or higher) encryption with a secure password. DO NOT include the password in the email body. Secure it with the consumers last 4SSN (as they will know it themselves) or send a separate email (without the attachment) that gives the password. Email Encryption Sharing CCI within a loan file is restricted to only the immediate parties related to the loan who can be given details of the loan (i.e., borrower/co-borrower, LO, LO Assistant). Processors/LO’s/Underwriters/Closers cannot share details of the loan or conditions with unrelated parties (i.e., Realtors, ex-Spouses, non-borrowers/non co-borrowers). We must protect CCI at all costs. We recommend unrelated parties to contact the borrower(s) directly. An “express written consent” is not acceptable. Sharing CCI If you have a question about what is/is not considered Confidential Client Information (CCI), then please contact compliance@peopleshomeequity.com or (615) 872-0220 x603. Questions?

13. GLBA & Privacy Laws: fines/penalties Monetary losses PHE can be held responsible for Civil Penalties Personal Liability Imprisonment / Cease&Desist PHE will be subject to a civil penalty of $100,000 for each violation. Officers / Directors of PHE will be personally liable for a civil penalty of $10,000; and PHE and its Officers / Directors are subject to fines in accordance with Title 18 of the US Code or imprisonment for not more than 5 years, or both. Institutions in violation of GLBA are subject to a number of sanctions including the potential for a Cease & Desist Order. 3 1 2

14. Acknowledgment Required Go to Testing Site to sign acknowledgment • You MUST complete the acknowledgment on the compliance testing site. • http://comptest.peopleshomeequity.com

15. Thank You!