Mortgage Loan Officers · Chapter 09 of 10
Compliance and the never-list
This is an operating document, not a law review. Every row below is a rule, what you actually do about it, and where it came from, so you can run your desk without reading the regulation yourself.
Nothing in this chapter is legal or compliance advice. It is operational guidance built from the rules current as of 2026-09-04, written so you know what to do file by file, and, just as important, when to stop and hand a question to your company's compliance officer or counsel instead of guessing. Your compliance department decides what actually applies to your file, your state, and your comp plan; this chapter is the checklist you bring to that conversation, not a substitute for it.
Disclosures and timing
| Rule | What you do about it | Chip | Source |
|---|---|---|---|
| The Loan Estimate must reach the applicant within 3 business days of application and no later than 7 business days before consummation | Don't quote firm numbers until you know the six pieces of application information are complete and the clock has started | verified | [1] |
| The Closing Disclosure must reach the consumer at least 3 business days before consummation | Know what resets that clock, and never assume a late document swap is a small delay | verified | [2] |
| A changed circumstance that increases a fee beyond its tolerance bucket requires a revised LE within 3 business days of the creditor learning of it | Report any post-LE change (rate lock switch, program change, new fee) to processing or compliance the same day; don't let it sit | verified | [3] |
| The old "black hole" period is closed: a creditor can now use the Closing Disclosure itself to reset tolerances at any point before consummation | The fix exists but isn't automatic; still route every late-discovered cost change to compliance immediately | verified | [4] |
| Three tolerance buckets govern how much a fee can move: zero-tolerance (origination and lender-selected-provider fees), 10 percent aggregate (recording and shoppable third-party fees), and no set limit (prepaid interest, insurance, escrow, fees the consumer shops for on their own) | Know which bucket a given fee sits in before you tell anyone a number is final | verified | [5] |
| The creditor must deliver a copy of the appraisal (or any written valuation) to the applicant promptly upon completion, or 3 business days before consummation, whichever is earlier, with no charge for the copy | Trigger delivery the moment the appraisal is complete; never let it sit in the file until the closing package | verified | [6] |
Compensation and QM
| Rule | What you do about it | Chip | Source |
|---|---|---|---|
| Your compensation may not be based, directly or indirectly, on a term of the transaction (rate, LTV, prepayment penalty, or a proxy for any of those), and no dual compensation from both the consumer and a creditor on the same loan | Never negotiate your own commission split, comp tier, or bonus based on the rate or points on a specific file; that structuring decision belongs to management and compliance | verified | [7] |
| Non-deferred, profit-based bonuses are capped at 10 percent of an individual originator's total compensation, with narrow exceptions (10-or-fewer closed loans in the trailing 12 months, business lines unrelated to mortgage profits, qualified retirement contributions) | Flag any new bonus plan or override to compliance before assuming it fits an exception | verified | [8] |
| Ability-to-Repay requires a reasonable, good-faith determination based on verified income, assets, and debts using reasonably reliable third-party records | Your intake job is to gather and forward complete, verifiable documentation, not to originate on stated or unverifiable numbers under pressure to close | verified | [9] |
| General Qualified Mortgage criteria: no negative amortization, no interest-only, no balloon (limited small-creditor exceptions), term of 30 years or less, and a price-based APR/APOR spread cap; QM status gives a presumption of ATR compliance, not proof the loan fits the borrower | Know which program and QM category a file falls into, and don't treat QM status as a substitute for your own suitability judgment | verified | [9] |
Referrals and co-marketing
| Rule | What you do about it | Chip | Source |
|---|---|---|---|
| RESPA Section 8(a) bans giving or accepting any fee, kickback, or thing of value for the referral of settlement service business | Never pay or receive money, discounted services, or in-kind perks tied to referral volume, from an agent, a builder rep, or anyone else | report | [10] |
| CFPB rescinded its 2015 suspicion-of-MSAs bulletin in 2020 and replaced it with FAQs: marketing services agreements are legal unless their terms or actual implementation violate RESPA, a facts-and-circumstances standard, not a blanket ban | Keep every MSA payment tied to real, invoiced deliverables and fair-market-value, pro-rata cost splits, documented at the time, not after the fact | verified | [11] |
| The CFPB's 2023-08-17 consent orders against Freedom Mortgage ($1.75 million) and Realty Connect USA Long Island ($200,000) found that MSA payments correlated with referral volume, plus lender-subsidized events for the referring brokerage's agents, were disguised pay-for-referral | Treat any marketing fee, sponsorship, or event that scales with how much business a partner sends you as a hard stop, whatever it's labeled | verified | [12] |
| Regulation X defines "thing of value" broadly, reaching free or below-market office space, free advertising, and paid-for events, not just cash | Run every co-marketing idea, cash or not, through the same test: fair market value, pro rata to actual usage, documented with an invoice trail | verified | [13] |
Advertising and rate talk
| Rule | What you do about it | Chip | Source |
|---|---|---|---|
| Regulation Z trigger terms (down payment amount or percent, number of payments, repayment period, payment amount, finance charge amount) require the full disclosure block if used in an ad; APR alone is not a trigger term | Never post a specific payment, down payment figure, or term count without the full Reg Z block cleared by compliance first | verified | [14] |
| Regulation N bars any material misrepresentation about a mortgage product in any commercial communication, by "any person," a scope broad enough to reach your own social posts, not just your company's official ads | Treat every rate-adjacent post you make personally as regulated mortgage advertising, not personal speech | report | [15] |
| Reg G does not require an NMLS ID on every general ad; that comes from state law and is not uniform: California bans blind ads, Texas allows the notice at the social-profile level, Arizona requires employer approval of the specific ad, Florida requires a rate-could-change disclaimer | Confirm your own licensed state's ad rule before publishing; don't assume one state's practice covers another | report | [16] |
| "Rates as low as" and teaser-rate advertising without stated conditions has drawn CFPB and FTC deceptive-advertising enforcement | Never advertise a rate that isn't genuinely available today, with points, credit score, LTV, and program stated in the same ad, not a rate quote, it changes | report | [17] |
Fair lending and adverse action
| Rule | What you do about it | Chip | Source |
|---|---|---|---|
| An adverse action notice must state the specific principal reasons for a denial, and CFPB Circulars 2022-03 and 2023-03 confirm this holds even when the credit decision runs through a complex or algorithmic model; a generic "did not meet model standards" is not enough | Never draft, paraphrase, or send adverse-action reason language yourself; it comes from the creditor's approved reason-code source | verified | [18][19] |
| The steering ban prohibits directing a consumer to a transaction based on your own greater compensation, unless a documented multi-creditor comparison-shopping safe harbor applies | Product and lender choice must be comp-neutral; if you rely on the safe harbor, document the actual comparison per file, not after the fact | verified | [20] |
| HMDA's Loan Application Register captures roughly 110 data points per covered application, including your own NMLS ID and pricing data | Treat sloppy or guessed intake data as a fair-lending problem, not a paperwork problem | report | [21] |
| A CFPB final rule, effective 2026-07-21, eliminates ECOA disparate-impact liability; this is contested, and state fair-lending law, the Fair Housing Act, and investor overlays are unaffected | Don't relax steering or marketing discipline based on this federal change; state and FHA exposure hold regardless | report | [22] |
Privacy, data and consent
| Rule | What you do about it | Chip | Source |
|---|---|---|---|
| GLBA's Privacy Rule requires an initial and annual privacy notice describing information practices and opt-out rights for sharing with nonaffiliated third parties | Don't independently share borrower nonpublic information with a co-marketing partner (a realtor, a title company) beyond what the notice and any opt-out already cover | verified | [23] |
| The FTC Safeguards Rule requires covered nonbank financial institutions, expressly including mortgage brokers, to report a breach affecting 500 or more consumers to the FTC within 30 days of discovery | Escalate any suspected loss or exposure of borrower files, or a phished inbox, to compliance and IT the same day; the clock starts at discovery | verified | [24] |
| The Homebuyers Privacy Protection Act, effective 2026-03-05, restricts credit-bureau "trigger lead" sales to lenders with a qualifying relationship or the consumer's opt-in | Treat any unsolicited lead after that date from a source outside your own CRM as a compliance-review item before you work it | verified | [25] |
| FCRA permissible purpose: a bona fide mortgage application creates permissible purpose to pull a credit report; written authorization is best-practice documentation, not a substitute for a real application | Never pull a report "to see what someone qualifies for" before an actual application exists or written authorization is on file | report | [26] |
| ESIGN consent must be affirmative and informed before TRID disclosures are delivered electronically; for TRID timing, the send date, not the received date, generally starts the clock, but only with valid consent on file | Never send TRID documents electronically to a borrower who hasn't completed valid ESIGN consent for that transaction | verified | [27] |
| Recording consent varies by state; most are one-party, roughly a dozen require all-party consent | Confirm the compliance-approved consent method for the borrower's state before recording or AI note-taking any call | inference | [28] |
| TCPA prior express written consent gates marketing texts and calls; honor any opt-out; scrub the National DNC Registry every 31 days; call only 8 a.m. to 9 p.m. local time of the person called; CAN-SPAM requires accurate headers, honest subject lines, a physical address, and a working opt-out | Text or call only a documented consent record; treat every opt-out as valid on sight; scrub monthly; check the recipient's time zone, not yours | report | [29] |
AI use
| Rule | What you do about it | Chip | Source |
|---|---|---|---|
| CFPB Circulars 2022-03 and 2023-03 remain live guidance: AI or algorithmic underwriting does not excuse the specific-reasons requirement for adverse action | Never let an AI tool generate or send adverse-action reason text, regardless of what model produced the underlying decision | verified | [18][19] |
| The CFPB's 2023 chatbot issue spotlight found chatbots can trap consumers in unresolved "doom loops" and warned that a chatbot must offer accurate answers and a timely path to a human | Any AI chat surface facing a borrower needs a visible, working human-escalation path before it launches | verified | [30] |
| Colorado's AI Act (SB 24-205) was delayed, court-paused, then repealed and replaced by SB 26-189, a narrower framework effective 2027-01-01 | Build any Colorado-specific AI control for the 2027-01-01 date under SB 26-189, not the repealed law | report | [31] |
| New York DFS has issued AI-adjacent guidance to its regulated entities, layered on existing 23 NYCRR Part 500 cybersecurity obligations, not a separate new AI statute | If you're NY-licensed, review any AI vendor use against Part 500 obligations rather than assuming a distinct AI rule applies | report | [32] |
| Anthropic's Usage Policy classifies home loan decisioning as a high-risk category requiring human-in-the-loop review before use reaches a consumer | Every Claude output that could reach a borrower, a rate figure, a program comparison, a status update, gets compliance or manager review before it sends | report | [33] |
Two moments where compliance is the whole job
A rate figure in a social post. Trigger: you want to post a program update or promotional content that mentions a rate or a payment example. What Claude prepares: a draft with the number framed as a dated example, flagged for the Reg Z trigger-term disclosure block and the state-specific ad rule that applies to your license. What the human checks and does: confirms the rate is genuinely available today, adds the required disclosure block and any state disclaimer, and gets compliance sign-off before it posts. What is never automated: publishing a rate, payment, or "as low as" figure without that sign-off, not a rate quote, it changes.
A file heads toward denial. Trigger: underwriting returns a decision that includes a denial, or a counteroffer with conditions the borrower cannot meet. What Claude prepares: nothing borrower-facing; at most an internal timeline summary for your own notes. What the human checks and does: routes the adverse-action reason language through the creditor's approved reason-code process, without paraphrasing it. What is never automated: any AI-drafted or AI-paraphrased adverse-action reason reaching the borrower.
The never-list
These are the things you and any AI tool you use never do on this desk, no matter how well a workflow is running. Each one names the rule it comes from.
- Never quote a rate, an APR, or a payment outside the company's disclosure process. Reg Z 1026.19 sets what the Loan Estimate and Closing Disclosure say and when, not an informal number given ahead of them.
- Never imply approval. The credit decision belongs to Ability-to-Repay and underwriting under Reg Z 1026.43 and Reg B 1002.9, not to anything said in a first conversation.
- Never promise a closing date. TRID's own timing rules, Reg Z 1026.19(e) and (f), set the clocks; your word doesn't override them.
- Never let AI draft or send an adverse action reason. ECOA and Reg B 1002.9, sharpened by CFPB Circulars 2022-03 and 2023-03, require a specific, accurate reason from the creditor's approved source.
- Never structure or accept compensation tied to a specific loan's terms. Reg Z 1026.36(d) bans comp based on rate, LTV, or any proxy for a transaction term.
- Never pay or receive anything, cash or in-kind, for a referral. RESPA Section 8(a) and Reg X's broad "thing of value" definition cover more than money.
- Never text or call without a documented consent record, or ignore a reasonable opt-out. TCPA prior express written consent and its revocation rule attach to the number, not your intent.
- Never pull a credit report before a bona fide application or written authorization exists. FCRA's permissible-purpose requirement is the highest-risk pattern for an individual LO to get wrong.
- Never move borrower nonpublic information into a tool your company hasn't approved. GLBA's Privacy Rule and the FTC Safeguards Rule govern where that data can live and who can see it.
- Never select a lender or product because it pays you more, without a documented consumer-interest basis. Reg Z 1026.36(e)'s steering ban requires comp-neutral judgment or a documented comparison-shopping safe harbor.
What to disclose and when
- Your NMLS ID. Provide it through your initial written communication with a consumer under Reg G, and display it on any advertisement your licensed state requires, which varies (confirmed here for California, Texas, Arizona, and Florida).
- Trigger-term ads. The full Reg Z 1026.24(d) disclosure block runs alongside any down payment, payment amount, or term count used in an ad.
- The appraisal copy. Deliver it promptly upon completion, or 3 business days before consummation, whichever is earlier, with no charge for the copy.
- AI-assisted content reaching a borrower. Anthropic's Usage Policy treats home loan content as high-risk, requiring a qualified human review before anything AI-drafted reaches a consumer; treat that review as your disclosure and quality gate together.
- A chatbot or AI chat surface. Per the CFPB's chatbot guidance, make the path to a human clear and fast, so a borrower is never left in an unresolved loop.
When to escalate
- To your manager. Pipeline pressure to move faster than a file supports, comp-plan questions, or a borrower complaint that doesn't yet look like a fair-lending or data issue.
- To compliance. Any post-LE cost change, a new co-marketing or MSA arrangement, new social or ad content carrying a trigger term or a rate figure, or a suspected data exposure.
- To counsel. Any new MSA or co-branded platform placement before it's signed, any discouragement or fair-lending complaint, any GLBA-applicability question, or reliance on the 2026 ECOA disparate-impact change in a state with its own fair-lending statute.
- To the lender's fair-lending officer. Any adverse-action content question, an HMDA data-accuracy concern, or a pattern that looks like unequal treatment across your files.
What stays human
- Every adverse-action reason, and the reason-code source it came from.
- Every rate, APR, and payment quoted to a borrower.
- Every compensation decision, comp-plan question, and bonus structure.
- Every credit pull, and the application or authorization it's based on.
- Every co-marketing or MSA payment decision.
- The choice to escalate, made early rather than after something has already gone out.
Do this today
- Pull your last 10 closed or in-process files and confirm every Loan Estimate and Closing Disclosure hit its clock; note any that didn't and why.
- Check your current comp plan and any bonus structure against the comp-neutral, 10 percent rule, and flag anything that looks tied to loan terms.
- Print the never-list and keep it next to your Claude Project instructions from Chapter 08.
Sources
- CFPB, TILA-RESPA Integrated Disclosure (TRID) FAQs, consumerfinance.gov, retrieved 2026-09-04.
- CFPB, TILA-RESPA Integrated Disclosure (TRID) FAQs, consumerfinance.gov, retrieved 2026-09-04.
- Wolters Kluwer, "A refresher on triggering events impacting the revised Loan Estimate," retrieved 2026-09-04.
- Cullen and Dykman, "TRID amendment gives lenders greater flexibility to use Closing Disclosures to reset tolerances," retrieved 2026-09-04.
- eCFR, 12 CFR 1026.19(e)(3), tolerance buckets, and CFPB compliance guide references, retrieved 2026-09-04.
- CFPB, 12 CFR 1002.14, appraisal delivery (Regulation B), consumerfinance.gov, retrieved 2026-09-04.
- eCFR, 12 CFR 1026.36(d), Loan Originator Compensation, retrieved 2026-09-04.
- Federal Register, Loan Originator Compensation Requirements Under TILA (Regulation Z), Feb. 15, 2013, 10 percent bonus cap, retrieved 2026-09-04.
- CFPB, Ability-to-Repay/Qualified Mortgage Small Entity Compliance Guide, Feb. 2021 (PDF), retrieved 2026-09-04.
- RESPA, 12 U.S.C. 2607(a), and Regulation X, reused from prior verified work this week, retrieved 2026-09-04.
- CFPB, RESPA Section 8 FAQs, October 2020, via ALTA and Buchalter summaries, retrieved 2026-09-04.
- CFPB newsroom and consent orders, Freedom Mortgage Corporation and Realty Connect USA Long Island, 2023-08-17, files.consumerfinance.gov, retrieved 2026-09-04.
- Regulation X, 12 CFR 1024.14, "thing of value" definition, retrieved 2026-09-04.
- CFPB, 12 CFR 1026.24(d), advertising, consumerfinance.gov, retrieved 2026-09-04.
- ActiveComply and BankersHub, Regulation Z and Regulation N social media advertising scope, retrieved 2026-09-04.
- NMLS, Required Use of NMLS Unique Identifier page; California DFPI, Texas SML, Arizona DIFI, and Florida OFR licensing pages, retrieved 2026-09-04.
- Mayer Brown, "Words, Words, Words" advertising and marketing presentation (PDF), retrieved 2026-09-04.
- CFPB Circular 2022-03, Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms, retrieved 2026-09-04.
- CFPB Circular 2023-03, Federal Register notice, retrieved 2026-09-04.
- eCFR, 12 CFR 1026.36(e), steering, retrieved 2026-09-04.
- Wolters Kluwer, Understanding HMDA Reporting; Credit Technologies, 2026 HMDA Reporting Changes for Lenders, retrieved 2026-09-04.
- Venable and Consumer Finance Monitor summaries, CFPB final Regulation B rule, effective 2026-07-21, retrieved 2026-09-04.
- CFPB, GLBA privacy notices page, consumerfinance.gov, retrieved 2026-09-04.
- FTC press release, Safeguards Rule breach-notification amendment, 2023-10-27, retrieved 2026-09-04.
- National Mortgage Professional, trigger lead restrictions effective 2026-03-05, retrieved 2026-09-04.
- America's Credit Unions, "Understanding Permissible Purpose Under FCRA," retrieved 2026-09-04.
- Federal Reserve Bank of Minneapolis, "E-SIGN Act Requirements," retrieved 2026-09-04.
- General state wiretap-statute landscape, inference, not independently verified state by state, retrieved 2026-09-04.
- bclplaw.com and womblebonddickinson.com TCPA alerts; ftc.gov CAN-SPAM Act Compliance Guide, reused from the agent guide's WS7, retrieved 2026-09-03.
- CFPB, "Chatbots in Consumer Finance" issue spotlight, June 2023, consumerfinance.gov, retrieved 2026-09-04.
- Akin, Troutman Privacy, and McDermott summaries, Colorado SB 26-189, effective 2027-01-01, retrieved 2026-09-04.
- New York DFS industry letter, managing risks of third-party service providers, Oct. 2025, dfs.ny.gov, retrieved 2026-09-04.
- Anthropic Usage Policy, high-risk category including home loans, reused by reference per task instructions, retrieved 2026-09-04.
Starting from zero? Use the field manuals first.
02 · BEFORE YOU BUY SOFTWARE
If you're still choosing the buyer, offer, stack, agents, content, customers, and delivery, don't start with a tool: start with the manuals. These create local worksheets only: no checkout, outreach, or account setup.
Find the first manual
Not sure which guide to open first? Start from your stuck point and let the finder recommend the next manual and the first worksheet question. No personal data is collected: it just points you at the right starting move.
Work the starter pack
Move through buyer, offer, stack, agents, content, customers, and delivery as a sequence of short local worksheet sessions. One artifact at a time, in order, so you build the business instead of browsing for it.
See what "done" looks like
Read a fully worked field manual before writing your own version, so the output feels concrete: a real, numbered workflow with the risky steps gated, not a fake proof claim.