Finds a card already held for the loan borrower's client first. If no local asset matches, validates the certificate through Collectors using collectorsId and the issuer - the integration's Cert Issuer setting (default PSA), or certIssuer when sent. The cure UI supplies account 200175994 automatically. A Collectors result is not persisted and must be created through the collateral pledge flow before it can be included in a cure plan. When Collectors has no record of the loan itself, the lookup is a 400 validation.msg.collateral.collectors.loan.unknown ("Collectors doesn't know loan {loanId}, so this certificate can't be validated"); any other Collectors 404 means the certificate was not found. Requires READ_COLLATERAL.