Security, data and compliance in Shared-Risk Loan Syndication Engine

How Shared-Risk Loan Syndication Engine protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Separation between institutions

Each institution's data, limits and internal reviews are visible only to its own users; loan files are shared only with partners that receive an offer.

Role-based access

What each person can see and do follows their role; preparing a remittance or recommendation is separate from approving it.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, document access, decision, approval and export is logged with the person and time, and cannot be edited.

Data residency

Data is hosted in the United States region.

Requirements it supports

• NCUA loan participation rule (12 CFR 701.22)
• NCUA member business loans and commercial lending (12 CFR Part 723)
• NCUA loans to members and lines of credit (12 CFR 701.21)
• NCUA Call Report (Form 5300) reporting of participations
• FASB ASC 860, Transfers and Servicing (participating interest criteria)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region.
• Dedicated environment: A single-tenant environment for institutions or credit union service organizations whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for data loads, partner onboarding and platform administration.

Limitations

• Moraph does not hold funds. Settlement at closing and remittances to participants are sent through your own payment channels; the Engine calculates and records them.
• The Engine does not make credit decisions. Each buyer's analysts and officers review loans and decide whether to commit.
• It does not originate or service loans. It uses data from your origination and servicing systems.
• Policy limits are configured from your policies; whether a participation complies with regulation and policy remains your institution's judgment.
• Agreement templates come from your counsel. Moraph does not provide legal advice or decide whether a transfer qualifies for sale accounting.
• It is designed for US credit union participations. Bank participations and syndications outside the United States are not configured as standard.
• It is not a marketplace or broker. Moraph does not find partners, set pricing or take part in transactions.
• Offers and commitments update as partners respond, but timing depends on when partners review and approve.