GEN-15-01 

UNITED STATES DEPARTMENT OF EDUCATION 

OFFICE OF POSTSECONDARY EDUCATION 

THE ASSISTANT SECRETARY 

JAN 0 9 2015 

Subject: Third-Party Servicer Institutional Requirements and Responsibilities 

Summary: This letter provides guidance to institutions that contract with third-party servicers to 

administer any aspect of the institution's participation in the student assistance programs 

authorized under Title IV of the Higher Education Act of 1965, as amended (HEA). For more 

information, see 34 C.F.R. § 668.2 (definition of third-party servicer); 34 C.F.R. §§ 668.23, 

668.25; Dear Colleague Letter GEN 12-08. 

Dear Colleague: 

We have determined that a significant number of institutions have failed to report, update, and/or 

have reported incorrect third-party servicer information on the institution's Application for 

Approval to Participate in the Federal Student Financial Aid Programs (E-App ), under the 

regulations at 34 C.F.R. § 668.25. We are aware that some servicers have told institutions not to 

report them as third-party servicers, creating confusion regarding what entities should be 

reported as third-party servicers. We have developed this guidance to provide clarity on the 

third-party servicer requirements of the regulations. 

What are the activities performed by a third party that determines if that entity is a thirdparty servicer under the regulations? 

Under the regulations at 34 C.F .R. § 668.2, a third-party servicer is any individual or entity that 

contracts with or performs work on behalf of an institution to administer, through manual or 

automated processing, any aspect of an institution's responsibilities under the Title IV, HEA 

programs. As provided in the regulations, an institution's Title IV responsibilities include, but 

are not restricted to, performing one or more of the following: 

• Processing of student financial aid applications, including Free Application for Federal 

Student Aid (FAFSA) or pre-FAFSA completion services performed on behalf of an 

eligible institution; 

• Collecting, reviewing, and/or maintaining supporting documentation required to process 

Title IV funds; 

• Awarding, certifying, originating, and/or disbursing Title IV funds; 

• Delivering Title IV credit balance refunds to students or parents (via cash, check, 

Automated Clearing House (ACH), debit card, or other means); 

1990 K ST. N.W., WASHINGTON, DC 20006 

www.ed.gov 

The Department of Education~ mission is to promote student aChievement and preparation for global competitiveness 

by fostering educational excellence and ensuring equal access. · 
Page 2 

o Providing financial aid counseling, including assistance to students or parents in person, 

over the phone, or by any electronic means, including operation of call centers; 

o Performing default prevention/management functions for Direct Loan, Federal Family 

Education Loan, and/or Perkins Loan programs, including cohort default analysis, 

enhanced loan counseling, delinquency assistance, development/implementation of a 

default management plan, and/or other default prevention outreach activities; 

o Providing entrance and exit loan counseling, including in person, by mail, or 

electronically; 

o Performing Federal Perkins Loan servicing or collections; 

o Financial aid consulting, including financial aid staffing, interim management, processing 

support, and/or development and maintenance of written policies and procedures; 

o Preparing and/or submitting required reports including enrollment reporting to the 

National Student Loan Data System, the Integrated Postsecondary Education Data 

System, Campus Crime and Security, and the Fiscal Operations Report and Application 

to Participate reporting; and 

o Preparing or disseminating required consumer information disclosures, including general, 

campus crime, drug and alcohol prevention, graduation rates, placement rates, and 

gainful employment disclosures. 

As provided in the regulations, performance of one or more of the following does NOT create a 

regulatory third-party servicer relationship: 

o Publishing, providing, and administering ability-to-benefit tests; 

o Financial and compliance auditing, including preparation of financial statements; 

o Mailing of documents prepared by the institution; 

o Warehousing of records; and 

o Providing computer services or software as long as the provider is not responsible for 

using the software for the institution's student aid purposes. 

The exclusion for "providing computer services or software" is limited to computer products 

and/or services that reside at and are under the control of the institution. The exclusion does not 

apply if the provider performs any Title IV activity and/or maintains any student level 

information. Similarly, the exclusion for the "warehousing of records" is restricted to the 

physical storage of Title IV related records. Entities that host secure portals or similar 

technologies for the transmission and/or electronic storage of and access to Title IV -related 
Page 3 

documents are considered third-party servicers and must comply with all regulatory 

requirements. 

Institutional Requirements for Reporting Third-Party Servicer Information 

Institutions must report, using the Department's E-App process, the names of any individual or 

entity that performs for, or on behalf of, the institution any of the Title IV functions listed above. 

The information must be reported within 10 calendar days of the institution entering into a 

contract (or any other written or oral agreement) with the third party. This reporting requirement 

also applies whenever there is any substantial modification to an existing contract or agreement 

or the termination of a contract or agreement. 34 C.F.R. § 668.25(e). 

Third-Party Servicer Contract Requirements 

When contracting with an institution for performing or providing any relevant Title IV function, 

the servicer and/or any of its contractors, essentially "steps into the shoes" of the institution with 

respect to compliance with the requirements for institutional administration of the Title IV 

. student assistance program activity. The institution must ensure that its contract with any thirdparty servicer contains the required elements outlined in the regulations at 34 C.F.R. § 668.25(c). 

In the contract, the third-party servicer must agree to comply with all statutory and regulatory 

provisions applicable to the Title IV functions provided by the third party. The third-party 

servicer must agree to abide with any special arrangements, agreements, limitations, suspensions, 

and terminations that apply to the institution under Title IV of the HEA. This includes the 

requirement to use any funds that the servicer administers under any Title IV, HEA program and 

any interest or other earnings solely for the purposes ofthat program. 34 C.F.R. § 668.25(c)(1). 

The contract must also indicate that a servicer agrees to: 

• Refer to the Office oflnspector General (OIG) of the Department any information 

indicating there is reasonable cause to believe that the institution or an applicant for Title 

IV, HEA funds might have engaged in fraud or other criminal misconduct (34 C.F.R. § 

68.25( c )(2)); 

• Be jointly and severally liable with the institution for any violation of Title IV, HEA 

requirements resulting from the functions performed by the servicer (34 C.F .R. § 

668.25(c)(3)); 

• Confirm the eligibility of a student before disbursing Title IV, HEA funds to a student 

and to calculate and return any unearned Title IV, HEA funds in accordance with the 

provisions of34 C.F.R. §§ 668.21, 668.22 in the case of a third-party servicer that is 

involved in the process of disbursing Title IV, HEA funds (34 C.F.R. § 668.25(c)(4)); 

and 
Page4 

o Return to the institution all records and Title IV funds in the servicer's possession 

pertaining to the institution's participation in the program or programs if the servicer or 

institution terminates the contract, if the servicer stops providing services for the 

administration of a Title IV program, or the servicer files a petition under the Bankruptcy 

code (34 C.F.R. § 668.25(c)(5). 

In addition, the contract must identifY the third-party servicer by its legal name and by any other 

name the servicer does business as (d/b/a). The contract must provide the physical address and 

primary phone number of the servicer' s primary location, as well as the name, title, phone 

number, and e-mail address of the president or chief executive officer of the entity. The contract 

must clearly describe the specific Title IV functions that the third-party servicer will perform for 

the institution. If a third-party servicer subcontracts any of its contractual responsibilities, the 

contract must identify the subcontractor and clearly describe the functions performed on behalf 

of the servicer and school by the subcontractor. 

FERP A Requirements 

In certain circumstances a third-party servicer may be considered a school official for the 

purposes of the Federal Family Educational Rights and Privacy Act (FERPA) and, in those 

circumstances, is permitted to receive and use personally identifiable information (PII) from 

education records without the student's consent to the same extent as is permitted for a school 

official or employee. If a servicer is using the PII to set up a bank account for the student or to 

maintain a credit balance for the student, it must obtain prior written consent of the student. See 

34 C.F.R. §§ 668.164(c)(3)(i), 668.165(b)(l)(ii). 

FERP A regulations describe the conditions that must be met for a contractor or other party to 

whom an institution has outsourced institutional services or functions to be considered a school 

official under FERP A. Specifically, the contractor or the other outside party must: 

o Perform an institutional service or function for which the school would otherwise use 

employees; 

o Be under the control of the school with respect to the use and maintenance of education 

records; and 

o Comply with the FERP A requirements governing the use and redisclosure of PII from 

education records. 34 C.F.R. § 99.31(a)(l)(i)(B). 

A school official may disclose PII from education records to a third-party servicer that meets the 

above criteria without the student's consent, but only if the school official determines that the 

third-party servicer has "legitimate educational interests." 34 C.F.R. § 99.3(a)(l)(i)(A). 

Each postsecondary institution is required to include the criteria for who is considered a "school 

official" and what is considered a "legitimate educational interest" in its armual notification of 

rights under FERPA. 34 C.F.R. § 99.7(a)(3)(iii). 
Page 5 

Contractors to whom institutions disclose PII from students' education records may use that PII 

only for the purpose(s) for which they are disclosed. 34 C.F.R. § 99.33(a)(2). For a third-party 

servicer, that purpose is the Title IV function the servicer has contracted to perform on behalf of 

the institution. 

Security Information Program Requirements 

Postsecondary educational institutions participating in the Title IV, HEA programs are subject to 

the information security requirements established by the Federal Trade Commission (FTC) for 

financial institutions. These FTC requirements also apply to Title IV third-party servicers. The 

requirements apply to all customer information in an institution's possession, regardless of 

whether such information pertains to students, parents, or other individuals with whom the 

institution has a customer relationship, or pertains to the customers of other financial institutions 

that have provided such information to the institution. Customer information is any record 

containing nonpublic personal information about a customer of a financial institution, whether in 

paper, electronic, or other form, that is handled or maintained by or on behalf of the institution or 

its affiliates. As a financial institution covered under these information security requirements, an 

institution must develop, implement, and maintain a comprehensive information security 

program. 

The information security program must be written in one or more readily accessible parts and 

contain administrative, technical, and physical safeguards that are appropriate to the size and 

complexity of the school, the nature and scope of its activities, and the sensitivity of any 

customer information at issue. Under these provisions, a service provider is any person or entity 

that receives, maintains, processes, or otherwise is permitted access to customer information 

through its provision of services directly with an institution. Institutions must take reasonable 

steps to select and retain service providers that are capable of maintaining appropriate safeguards 

for the customer information at issue and require service providers by contract to implement and 

maintain such safeguards. 

See 15 U.S.C. §§ 680l(b), 6805(b)(2); 16 C.F. R. §§ 313.3(n), 314.1-5; Gramm Leach Bliley 

Act, Pub. L. No.106-102. 

Third-Party Servicer Compliance Audits 

In general, under the regulations at 34 C.F.R. § 668.23(c), a third-party servicer must submit 

annually to the Secretary its compliance audit no later than six months after the last day of the 

servicer's fiscal year. The Department is aware that some third-party servicers have not filed 

annual compliance audits due to an incorrect assessment of whether the entity meets the 

regulatory definition of a third-party servicer and/or based on the omission of specific audit 

procedures in the OIG Audit Guide for some services or functions performed on behalf of an 

institution. Third-party servicers that are subject to the audit requirements outlined in 34 C.F .R. 

§ 668.23(c) that did not submit a required audit(s) for one or more years must: 

• Submit a compliance audit no later than one fiscal year subsequent to the date of this 

letter; and 
Page 6 

• Submit a letter to the Department within 60 days of the date of this letter describing the 

Title IV -related functions the entity performs on behalf of higher education institutions 

along with an explanation of the reason(s) the servicer did not submit its required 

compliance audits. 

Additional guidance concerning audit requirements will be forthcoming. Letters should be 

submitted to: 

Ralph A. LoBosco, Director 

Federal Student Aid 

Third-Party Servicer Oversight Group 

United States Department of Education 

1010 Walnut Street, Suite 336 

Kansas City, MO 64106-2147 

If you have any questions about the information contained in this Dear Colleague Letter, please 

contact the Third-Party Servicer Oversight Group by e-mail at 

FSAPC3rdpartyserviceroversight@ed.gov or by telephone at (816) 268-0543. 

Sincerely, 

Acting Assistant Secretary 

Office of Postsecondary Education