GEN-15-01 UNITED STATES DEPARTMENT OF EDUCATION OFFICE OF POSTSECONDARY EDUCATION THE ASSISTANT SECRETARY 

## JAN 092015
Subject: Third-Party ServicerInstitutional Requirements and Responsibilities Summary: This letter provides guidance to institutions that contract with third-party servicers to administer any aspect ofthe institution's participation in the student assistance programs authorized under Title IV ofthe Higher Education Act of 1965, as amended (HEA). For more information, see 34 C.F.R. § 668.2 (definition ofthird-party servicer); 34 C.F.R. §§ 668.23, 668.25; Dear Colleague Letter GEN 12-08. Dear Colleague: We have determined that a significant number ofinstitutions have failed to report, update, and/or have reported incorrect third-party servicer information on the institution's Application for Approval to Participate in the Federal Student Financial Aid Programs (E-App), under the regulations at 34 C.F.R. § 668.25. We are aware that some servicers have told institutions not to report them as third-party servicers, creating confusionregarding what entities should be reported as third-party servicers. We have developed this guidance to provide clarity onthe third-party servicerrequirements ofthe regulations. What are the activities performed by a third party that determines ifthat entity is a thirdparty servicer under the regulations? Under the regulations at 34 C.F.R. § 668.2, a third-party servicer is any individual or entity that contracts with orperforms work on behalfofan institution to administer, through manual or automated processing, any aspect ofan institution's responsibilities under the Title IV, HEA programs. As provided in the regulations, an institution's Title IV responsibilities include, but are not restricted to, performing one ormore ofthe following:
• Processing ofstudent financial aid applications, including Free Application for Federal StudentAid (FAFSA) or pre-FAFSA completion services performed on behalfofan eligible institution;

• Collecting, reviewing, and/or maintaining supporting documentation required to process Title IV funds;

• Awarding, certifying, originating, and/or disbursing Title IV funds;

• Delivering Title IV credit balance refunds to students or parents (via cash, check, Automated Clearing House (ACH), debit card, or othermeans);

1990 K ST. N.W., WASHINGTON, DC 20006 www.ed.gov The Departmentof**Education~** mission is topromote studentaChievementandpreparationforglobal competitiveness byfostering educational excellence and ensuring equalaccess. ·Page 2

o Providing financial aid counseling, including assistance to students or parents inperson, over the phone, orby any electronic means, including operation ofcall centers;

o Performing default prevention/management functions for Direct Loan, Federal Family Education Loan, and/or Perkins Loanprograms, including cohort default analysis, enhanced loan counseling, delinquency assistance, development/implementation ofa default managementplan, and/or other default prevention outreach activities;

o Providing entrance and exit loan counseling, including inperson, by mail, or electronically;

o Performing Federal Perkins Loan servicing or collections;

o Financial aid consulting, including financial aid staffing, interim management, processing support, and/or development and maintenance ofwrittenpolicies andprocedures;

o Preparing and/or submitting required reports including enrollmentreporting to the National Student Loan Data System, the Integrated Postsecondary Education Data System, Campus Crime and Security, and the Fiscal Operations Report and Application to Participate reporting; and

o Preparing or disseminating required consumer information disclosures, including general, campus crime, drug and alcohol prevention, graduation rates, placement rates, and gainful employment disclosures. As provided inthe regulations, performance ofone ormore ofthe following does NOT create a regulatory third-party servicer relationship:

o Publishing, providing, and administering ability-to-benefit tests;

o Financial and compliance auditing, includingpreparation offinancial statements;

o Mailing ofdocuments prepared bythe institution;

o Warehousing ofrecords; and

o Providing computer services or software as long as the provider is not responsible for using the software for the institution's student aid purposes. The exclusionfor "providing computer services or software" is limited to computerproducts and/or servicesthat reside at and are under the control ofthe institution. The exclusion does not apply ifthe providerperforms any Title IV activity and/or maintains any student level information. Similarly, the exclusion for the "warehousing ofrecords" is restricted to the physical storage ofTitle IV related records. Entitiesthathost secure portals or similar technologies for the transmission and/or electronic storage ofand access to Title IV-relatedPage 3 documents are considered third-party servicers and must comply with all regulatory requirements.
Institutional Requirements for Reporting Third-Party ServicerInformation Institutions must report, using the Department's E-App process, the names ofany individual or entity thatperforms for, or on behalfof, the institution any ofthe Title IV functions listed above. The information mustbe reported within 10 calendar days ofthe institution entering into a contract (or any other written or oral agreement) with the third party. This reporting requirement also applies whenever there is any substantial modification to an existing contract or agreement orthe termination ofa contract or agreement. 34 C.F.R. § 668.25(e). Third-Party Servicer Contract Requirements When contracting with an institutionfor performing orproviding any relevant Title IV function, the servicer and/or any ofits contractors, essentially "steps into the shoes" ofthe institution with respect to compliance withthe requirements for institutional administration ofthe Title IV

. student assistance program activity. The institution must ensure that its contract with any thirdparty servicer contains the required elements outlined inthe regulations at 34 C.F.R. § 668.25(c). Inthe contract, the third-party servicer must agree to comply with all statutory and regulatory provisions applicable to the Title IV functions providedbythe third party. The third-party servicer must agree to abide with any special arrangements, agreements, limitations, suspensions, and terminations that apply to the institution under Title IV ofthe HEA. This includes the requirement to use any funds that the servicer administers under any Title IV, HEAprogram and any interest or other earnings solely for the purposes ofthatprogram. 34 C.F.R. § 668.25(c)(1). The contract must also indicate that a servicer agrees 

### to:
• Refer to the Office oflnspector General (OIG) ofthe Department any information indicatingthere is reasonable cause to believe that the institution or an applicant for Title IV, HEA funds might have engaged in fraud or other criminal misconduct (34 C.F.R. § 68.25(c)(2));

• Bejointly and severally liable with the institution for any violation ofTitle IV, HEA requirements resulting from the functions performed by the servicer (34 C.F.R. § 668.25(c)(3));

• Confirmthe eligibility ofa student before disbursing Title IV, HEA funds to a student and to calculate and return any unearned Title IV, HEA funds in accordance with the provisions of34 C.F.R. §§ 668.21, 668.22 inthe case ofa third-party servicerthat is involved inthe process ofdisbursing Title IV, HEA funds (34 C.F.R. § 668.25(c)(4)); andPage4

o Return to the institution all records and Title IV funds in the servicer's possession pertaining to the institution's participation inthe program orprograms ifthe servicer or institution terminates the contract, ifthe servicer stops providing services for the administration ofa Title IV program, orthe servicerfiles a petition under the Bankruptcy code (34 C.F.R. § 668.25(c)(5). In addition, the contract must identifY the third-party servicerby its legal name and by any other name the servicer does business as (d/b/a). The contract must provide the physical address and primaryphone number ofthe servicer's primary location, as well as the name, title, phone number, and e-mail address ofthe president or chiefexecutive officer ofthe entity. The contract must clearly describe the specific Title IV functions that the third-party servicer will perform for the institution. Ifa third-party servicer subcontracts any ofits contractual responsibilities, the contractmust identify the subcontractor and clearly describe the functions performed on behalf ofthe servicer and school bythe subcontractor. FERP A Requirements In certain circumstances a third-party servicer may be considered a school official for the purposes ofthe Federal Family Educational Rights and Privacy Act (FERPA) and, in those circumstances, is permitted to receive and use personally identifiable information (PII) from education records without the student's consentto the same extent as is permitted for a school official or employee. Ifa servicer is using the PII to set up a bank account for the student orto maintain a credit balance for the student, it must obtainprior written consent ofthe student. See 34 C.F.R. §§ 668.164(c)(3)(i), 668.165(b)(l)(ii). FERPA regulations describe the conditions that mustbe met for a contractor or otherpartyto whom an institution has outsourced institutional services or functions to be considered a school official under FERPA. Specifically, the contractor orthe other outside party must:

o Perform an institutional service or function for which the school would otherwise use employees;

o Be under the control ofthe school with respect to the use and maintenance ofeducation records; and

o Comply with the FERPA requirements governing the use and redisclosure ofPII from education records. 34 C.F.R. 

### § 99.31(a)(l)(i)(B). A school official may disclose PII from educationrecords to a third-party servicer that meets the above criteria without the student's consent, but only ifthe school official determines that the third-party servicer has "legitimate educational interests." 34 C.F.R. 

### § 99.3(a)(l)(i)(A). Eachpostsecondary institution is required to include the criteriafor who is considered a "school official" and whatis considered a "legitimate educational interest" in its armual notification of rights under FERPA. 34 C.F.R. § 99.7(a)(3)(iii).Page 5
Contractors to whom institutions disclose PII from students' education records may use that PII only for the purpose(s) for which they are disclosed. 34 C.F.R. § 99.33(a)(2). For a third-party servicer, that purpose is the Title IV function the servicerhas contracted to perform on behalfof the institution. Security Information Program Requirements Postsecondary educational institutions participating inthe Title IV, HEA programs are subject to the information security requirements established by the Federal Trade Commission (FTC) for financial institutions. These FTC requirements also apply to Title IV third-party servicers. The requirements apply to all customer information in an institution's possession, regardless of whether such informationpertains to students, parents, or other individuals with whom the institution has a customer relationship, or pertains to the customers ofother financial institutions that have provided such informationto the institution. Customerinformation is any record containingnonpublic personal information about a customer ofa financial institution, whether in paper, electronic, orotherform, that is handled ormaintained by oronbehalfofthe institution or its affiliates. As a financial institution coveredunder these information security requirements, an institution must develop, implement, andmaintain a comprehensive information security program. The information security program must be written in one ormore readily accessible parts and contain administrative, technical, and physical safeguards that are appropriate to the size and complexity ofthe school, the nature and scope ofits activities, and the sensitivity ofany customer information at issue. Underthese provisions, a service provider is any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision ofservices directly with an institution. Institutions must take reasonable steps to select and retain service providers that are capable ofmaintaining appropriate safeguards for the customer information at issue and require service providers by contract to implement and maintain such safeguards. See 15 U.S.C. §§ 680l(b), 6805(b)(2); 16 C.F. R. §§ 313.3(n), 314.1-5; Gramm Leach Bliley Act, Pub. L. No.106-102. Third-Party Servicer Compliance Audits In general, under the regulations at 34 C.F.R. § 668.23(c), a third-party servicer must submit annually to the Secretary its compliance audit no later than six months after the last day ofthe servicer's fiscal year. The Department is aware that some third-party servicers have not filed annual compliance audits due to anincorrect assessment ofwhether the entity meets the regulatory definition ofa third-party servicer and/or based on the omission ofspecific audit procedures in the OIG Audit Guide for some services orfunctions performed onbehalfofan institution. Third-party servicers that are subject to the audit requirements outlined in 34 C.F.R. § 668.23(c) that did not submit a required audit(s) for one ormore years must:

• Submit a compliance audit no laterthan one fiscal year subsequentto the date ofthis letter; andPage 6

• Submit a letter to the Department within 60 days ofthe date ofthis letter describing the Title IV-related functions the entity performs on behalfofhigher education institutions along with an explanation ofthe reason(s) the servicer did not submit its required compliance audits. Additional guidance concerning audit requirements will be forthcoming. Letters should be submitted to: Ralph A. LoBosco, Director Federal Student Aid Third-Party Servicer Oversight Group United States Department ofEducation 1010 Walnut Street, Suite 336 Kansas City, MO 64106-2147 Ifyouhave any questions aboutthe information contained inthis Dear Colleague Letter, please contactthe Third-Party Servicer Oversight Group by e-mail at FSAPC3rdpartyserviceroversight@ed.gov or bytelephone at (816) 268-0543. Sincerely,

Acting Assistant Secretary Office ofPostsecondary Education