The Branch Manager's Quick Favor for a Referral Partner
Your branch's business development officer, Greg, asks you to print the last six months of account statements for a customer, Ms. Alvarez, and give them to his friend, who owns Meridian Motors. Greg says Meridian is a bank referral partner, the friend needs to see “how much Ms. Alvarez can afford” for a trade-in, and Ms. Alvarez will “sign a consent form later.” Ms. Alvarez is not present and has an account note saying she prefers contact by mail only. Greg also asks you to use your own teller login because his access is slow. You know Greg is a senior employee and that he has referred several customers to Meridian. The account shows regular payroll deposits, a $34,000 balance, and a recent auto-loan inquiry. Greg says refusing would hurt the branch's referral relationship.
1. Should you print and release the statements? Explain your reasoning.
Read the worked answer
No. Customer account information is confidential, and a referral relationship with Meridian Motors is not customer authorization. “Consent later” is not consent now, and the dealer's desire to know what Ms. Alvarez can afford is not a bank permissible purpose. The account note preferring mail contact reinforces that the customer's privacy preferences must be respected. Even with a signed authorization, the bank should release only the minimum information necessary for a stated purpose, through an approved process-not by handing statements to a dealership employee. Decline the request, explain the privacy rule, and offer to route a properly documented request to the appropriate department.
2. Greg insists and says he will take responsibility. How should you respond, including the request to use your login?
Read the worked answer
Remain professional and firm. Tell Greg you cannot release the statements without a valid authorization and approved process, and that you cannot use your login to access information for his friend. Sharing credentials or performing access under your own ID for someone else's purpose would misattribute the access and defeat audit controls. If Greg says he will take responsibility, explain that responsibility does not cure the privacy breach. Offer to escalate the request to the privacy or compliance officer or branch manager. Document the request and your refusal, and report the pressure through the bank's ethics or whistleblowing channel if it continues.
3. What should happen next to protect the customer and the bank?
Read the worked answer
Notify the privacy or compliance officer and file an incident report, even if no information was released. Preserve Greg's request, emails, and system logs. Compliance should review whether the referral arrangement creates a conflict or improper information-sharing, and whether Ms. Alvarez needs notice. Do not discuss the matter with the dealer. Provide staff training on confidentiality, authorization, and credential use. If the request was an attempt to obtain customer data improperly, the bank should consider disciplinary action and, where required, regulatory notification. The assistant should be protected from retaliation for refusing and reporting.