It’s Not Just the CFPB . . . It’s the IRS, Too

The IRS recently announced new requirements for its e-Services Users to re-establish their Secure Access accounts, which enables the government to provide greater protections against cyber-attacks. Curt Knuth, EVP of National Credit-reporting System (NCS), called the new requirements "like TRID for e-Service users." Knuth discussed with MReport the possible effect on lending operations that the new requirements could have.

Who will be affected by the recent IRS announcement?

It's anybody that's within the IRS’s IVES (Income Verification Express Services) program. Additionally, it's anybody that utilizes the e-Services platform so that would be tax practitioners, CPAs, etc. There's a multitude of use cases beyond the folks that are in the IVES program that utilize e-Services. Within the IVES program, there are third-party participants such NCS and there are some lender and credit union and bank participants within the IVES program as well. Anybody that's in the IVES program that interfaces with the e-Services would be affected.

Why do e-Services users need to make changes prior to the October 24 deadline?

As part of an executive order that was issued in October 2014, the IRS and all agencies are required to implement multi factor authentication policies for the interfaces that they have, user interfaces that they have. I believe it was something like 18 months that they had to implement this from 2014, so obviously they're quite a bit delayed, and now they're catching up. We were told about it on September 22 and it's going to be instituted on October 24. Really, the biggest issue is the timeline. The IRS has asked us essentially to re-engineer the systems that we use to interface with e-Services within 30 days.

That is a huge undertaking. I cannot impress that enough, because you're looking at blowing up in many ways whatever system you've built and instituting this new policy. At the end of the day, they've introduced a two-factor authentication policy. Now for each individual that is registered with e-Services, in order to gain access to it, they must have a personal cell phone registered to their user account. When they log in with their credentials and click submit, then a confirmation code will be sent to their cell phone of record and then they'll have to enter in that confirmation code. That's for every single time you access the site. It's not once. Typically, it's once when you register your account. A lot of times we have to do that for bank accounts and so forth and so on. This is for every single transaction. Every time you want to access this site you've got to go through this.

It’s a challenge. The biggest part of any development project like this is testing. You scope up your project, you code it, you roll it out, and then you've got to test it. Testing is where the rubber meets the road. You find out if everything that you thought was going to work, works, or if some kind of a weird thing that you weren't expecting pops up. We don't have a testing environment. We're not going to have any way to test this thing until October 24.

The IRS rolled out this technology within the Get My Transcripts application. This is a system where the consumer can essentially create and account and gain access to their transcripts themselves. There's dual factor authentication or this multi factor authentication where the cell phone is used as part of it, it utilized within the Get My Transcripts app. That's really the only thing that we're able to base any of this on. The rest of it is just on written and verbal communication that we've had with the IRS. I think there's concerns when we go 24 to 48 hours into this thing that if there's a deviation off of what was advertised, and we could have some issues. Lastly, there's going to be a pretty big strain put on the IRS system because again it's not just us, and it's not just the IVES participants. We're a pretty small use case for the IRS. You've got all the tax practitioner folks that are going to be slamming the system at the same time. There could very well be some performance-related issues on the IRS site.

I think at the end of the day we get why they want to do it, we applaud them for wanting to tighten it up, we've been involved with this thing since ‘94, we were the first one to roll out transcripts nationally, and we're behind the intent. But I think the manner in which they're doing it and the timeline leave much to be desired.

Do you think it should be much longer than 30 days?

Yes. We'd love to see a 90-day implementation. We'd love to see that. We'd love to see a way to test it. We would really like to see some sort of a soft launch or something or a testing environments, whatever the case is. That would really help to make sure that the consumers, at the end of the day that's who gets affected by this, so that everything that works, works. That when we go into a production environment, we're all happy-go-lucky, and we're skipping down the road.

How can e-Services users prepare for the deadline or the due date October 24 and what are potential software and policies necessary for the new IRS requirements? When you've only got 30 days to prepare and no way to test it, what are your priorities or what are you focused on the most as far as preparing?

There's two parts to this project. One is the registration mechanism. We have to register and prepare the accounts that we have with the cell phone number with them. The challenge with that is that if there's an error made within when you're keying the information in, such as if you fat finger a cell phone number, if you put in your telephone number, or do anything like that, you are up the creek, because you're not going to be able to rectify it in time to meet the October 24 deadline. You've got to make sure that your registration is all correct. That everything that you're doing there is spot on, no errors.

The second thing is on the software side. You've got two use cases within the IVES program. You've got lenders which are doing this themselves which typically are going to either be very small lenders that are having individuals access their e-Services account. If we focus on that one, the individuals are going to have to make sure that they've got their cell phones set up. They put their code in, they go get their transcripts and away they go. Not too much of an impact. There is an impact though for some banks that will not allow their associates to have a cell phone on the premises during working hours. That's a policy, so that presents an issue. For any of the banks that won't allow the cell phones, it's certainly a problem within the use case. Those are the small lenders and those are the concerns that they have.

For the large lenders, they're pretty much going to be similar to what the third-party vendors. They're going to have some sort of a system that's doing a screen scrape or something like that to get those transcripts. Depending upon how many sessions you've got open at once, how you're interfacing with the IRS site, you can have many, many, many, many, many, many confirmation codes that are coming in to you at once and if the IRS system has some sort of a performance degradation where those codes are delayed in some way, shape or form, if the screen changes, if there's anything out of the ordinary, because again, we're working with a normal website that you or I would just go into and click as a human. There's no interface. It's not a system to system thing, so it is very sensitive to any changes. Those are the pitfalls.

What are the consequences for lack of preparation on the due date?

If you're not prepared, if you're not up and running, then you've got loans that are sitting on the line longer than they should. You incur the fees for having the loans on the line, you incur problems with loans closing, and you incur production-related problems where if you have triggers for other services that go with ordered after a tax transcript comes in. If you've got an underwriting condition that shows itself up at the ninth hour, you've got problems. There's just an array of things that could really delay how originations move forward. At the end of the day, it's still a product that is used highly by the mortgage industry and that is highly recommended by the GSEs to use so if you can't get it, it's a problem.

What is the time and cost necessary to prepare for the deadline?

There’s an opportunity cost. As a vendor, I've had to push a ton of different things off in order to swarm, swarm, swarm. We’ve had to have everybody focused on this. There's been a number of all-nighters that have already occurred and everything else to get ourselves ready for this so I figure at the end of it we'll have a figure. As of right now, we can’t measure the time and cost necessary.