Offshore mortgage staff access permissions matrix

An offshore mortgage support worker can only work safely when a brokerage has decided which records they may see, which fields they may change and which actions still need a broker. “Give access to the CRM” is too broad: a CRM may hold enquiry notes, identity documents, lender correspondence and permissions to send messages. This offshore mortgage staff access permissions matrix is a starting worksheet for an Australian brokerage. It is not a universal permissions policy; your licensee, privacy adviser and system owner should approve the final settings.

Define permission by task, data, action and time

For each task, write four things: the business purpose, the records needed, the action allowed and when the permission ends. A worker might need to see the status of assigned files but not export the full customer database. Another might need to upload a document against one case but not approve a lender submission. Do not use a job title or country as a substitute for this analysis.

The Australian Cyber Security Centre's small business guidance recommends access controls, multi-factor authentication and revoking access when staff leave. Its procurement and outsourcing guidance discusses individually attributable accounts, least privilege and documenting service-provider access. Use these as security design inputs, then fit the controls to your systems and risk.

Use this illustrative access matrix

“Assigned” means files specifically allocated to the person. “None” means no standing permission; an exception must be requested and approved. The broker/reviewer column represents a person with the authority your firm has verified. Technical administrators need a separate, logged path for support rather than a hidden way to read customer files.

System or action	Broker or authorised reviewer	Loan processor	Support coordinator	Provider administrator
CRM case record	Review and approve within role authority	View assigned cases; update factual task status	View assigned follow-ups; update contact status	No standing customer-content access
Document vault	Review evidence for assigned cases	View assigned source files; upload checked work if approved	Upload requested items to assigned case if approved	No standing document access
Lender or aggregator portal	Approve and release actions within authority	Draft factual entries only if system and licensee permit	None by default	None by default
Customer and lender messages	Approve sensitive content and escalation	Internal status notes; external contact only under approved scope	Approved administrative reminders only	None
Account administration	Request changes through system owner	None	None	Temporary technical access only with approval and logs

This table distinguishes preparation from approval. It does not decide whether a particular action is credit activity. ASIC's RG 205 says licensees can outsource functions related to credit activity but remain responsible for their obligations, and third parties undertaking credit activities on their behalf will generally need the appropriate representative or licensee position. Have your licensee assess the actual task and worker authority before enabling a submission or customer-facing credit action.

Turn the matrix into an access request

A manager should submit a short request for each worker: named person, legal employer or provider, role, systems, assigned file scope, allowed actions, device requirements, approver, start date and review date. The system owner grants the minimum practical permissions and records what was actually configured. Shared logins make it harder to attribute actions and to remove one person's access without disrupting others.

Test the account with a fictional file before live use. Check that the worker can complete the permitted task and cannot view another customer's file, export a list or approve a submission outside their scope. Keep the test result and approval next to the access request. Where a platform cannot restrict access at that level, record the gap and choose a compensating workflow or a different system before granting broad permissions by default.

For an Australian Privacy Principles entity, the OAIC's APP 11 guidance says reasonable steps to protect personal information depend on the circumstances and include technical and organisational measures. The OAIC's APP 8 guidance says giving an overseas contractor personal information is a disclosure in most circumstances, while the precise arrangement and exceptions matter. A permissions matrix is one control; it does not settle whether your cross-border handling complies with the Privacy Act.

For example, a processor assigned File A may need to compare an income document with a broker-approved summary. The access request could allow that one case and a document-viewing role, while preventing bulk export and submission approval. If the processor finds a mismatch, they record an exception for the broker rather than requesting permanent wider access. The system owner can verify these boundaries with a fictional case before the first real file is assigned.

Review permissions when the work changes

Inspect the first month's activity with the worker and reviewer: which permissions were used, which tasks were blocked, which files were accessed and whether exceptions were approved. Then set a regular review interval that matches your risk and staffing changes. A new lender portal, a move from follow-ups to document checking, leave cover or a different provider should trigger a fresh task-level review. Do not let old permissions accumulate simply because the account already exists.

For a temporary exception, record the file, requested action, approver, expiry and reason. Grant it through the system's permission controls where possible, then remove it when the work ends. Do not treat a written instruction as equivalent to a technical restriction if the account can still perform a broader action.

Close access and verify the exit

On departure or reassignment, disable the individual account, revoke active sessions and tokens where supported, remove shared-folder invitations and confirm that the new owner can find the work in progress. Ask the provider to account for approved local copies and demonstrate return or deletion under the agreement, subject to any lawful retention duty. Preserve the audit trail and the brokerage's required records. A spreadsheet entry saying “offboarded” is weaker than confirmation from each system owner.

Our offshore support checklist covers the wider hiring and review plan. Use this matrix alongside Mortgage Talent's trust and operating controls and the loan processor role guide when defining actual work. Start with one role and one system, prove the controls work, and expand only after the reviewer is comfortable with the file flow.