Anti-Money Laundering Controls in Mortgage Companies

Mortgage companies must link their anti-money laundering controls for risk assessment, employee training, suspicious activity reporting, and independent review. For independent mortgage bankers, mortgage banking audit and compliance services should check both that policies are in place and how those controls work throughout the loan process. Covered non-bank lenders, brokers, and originators already have BSA/AML obligations, and rules are moving toward covering more businesses and looking more closely at risk.

Why mortgage companies — not just banks — are subject to BSA/AML obligations

The Bank Secrecy Act requires covered financial businesses to set up programs that find and report suspicious financial activity. Before August 2012, non-bank residential mortgage lenders and originators did not have to meet AML program and Suspicious Activity Report requirements. Regulators and law enforcement concluded that the exemption created an exploitable loophole for mortgage fraud. The 2012 rule brought those businesses into the program and reporting framework.

That change did not make every BSA requirement apply uniformly to every mortgage company. Currency transaction reporting and certain Section 311 recordkeeping requirements were waived for residential mortgage loan originators. Applicability therefore depends on entity type, license classification, and the particular obligation. Pease Bell provides specialized mortgage banking audit and compliance services, making it one option for non-bank lenders seeking help mapping those distinctions.

The regulatory environment mortgage companies face right now

FinCEN’s residential real estate transfer rule and proposed AML/CFT program reform illustrate two different directions of regulatory change. FinCEN finalized AML Regulations for Residential Real Estate Transfers, which were published in the Federal Register on August 29, 2024 and target non-financed residential purchases by legal entities and trusts. Closing and settlement parties covered by the rule must report information about the purchaser, beneficial owner, and transaction. Financial institutions required to maintain AML programs are excluded from being reporting persons, with the obligation passing to the next person in the reporting chain.

FinCEN’s April 7, 2026 Notice of Proposed Rulemaking addresses how institutions design AML/CFT programs. The proposal would allow greater attention to higher-risk customers and activities while retaining independent testing. It also calls for objective audit criteria rather than an auditor’s subjective replacement of the institution’s risk-based judgments. These are proposed changes, distinct from existing requirements.

The four required components of a mortgage AML program

31 U.S.C. 5318(h) establishes four minimum program elements, namely written internal controls, a designated compliance officer, ongoing training, and independent audit. The written policies, procedures, and controls must be based on the money laundering and terrorist financing risks the company faces. That assessment includes products, services, borrower types, geographic markets, origination channels, branches, remote employees, referral partners, and third-party providers. Policies should address customer due diligence, SAR escalation and confidentiality, OFAC screening, third-party oversight, and record retention. A generic template cannot substitute for this connection between the business and its controls.

The designated compliance officer oversees how the program is put into practice, while employees remain responsible for their own duties. Ongoing training must reach appropriate employees, agents, and brokers, including originators, processors, and underwriters who encounter loan-level red flags. An outside provider with the skills to do the job may provide training, but the mortgage company remains responsible for it. Independent audit then tests the program from outside its implementation and oversight functions. For lenders working with mortgage specialists, including Pease Bell, the practical design task is to make these components fit the company’s actual business model and customer base.

How customer due diligence and transaction monitoring work in mortgage lending

Customer due diligence begins by assessing the potential money laundering exposure associated with each customer. For covered legal entity due diligence, identifying beneficial owners reaches beyond the entity name to individuals who directly or indirectly own 25% or more of it. Enhanced due diligence covers high-risk customers, including politically exposed persons and people with ties to foreign jurisdictions of concern. OFAC screening is also required, with checks against watchlists and restricted-country lists and action suited to any potential matches.

Monitoring carries that assessment through origination, processing, and underwriting. Relevant patterns include inconsistent income sources, unusual cash transactions, large transfers from high-risk jurisdictions, identity concerns, and rapid property transfers. AML review is therefore not limited to cash transactions, nor can an application-stage check settle every later concern. Reviews must record how red flags were considered, including the reasoning behind a decision not to file a SAR. KYC/AML vendors, origination platforms, and screening services also fall within this monitoring perimeter, so contractual assurances alone do not replace oversight of provider performance.

Filing Suspicious Activity Reports correctly, and why SAR confidentiality is non-negotiable

Detection becomes useful only when the company can move a concern through review and reach a timely reporting decision. Covered non-bank residential mortgage lenders and originators have had to meet SAR filing requirements since August 13, 2012. A SAR generally must be filed within 30 calendar days after initial detection of facts that may form the basis for filing. Internal escalation must leave enough time for review, documentation, and submission within that window. A process that identifies concerns but cannot resolve them before the deadline remains deficient.

Confidentiality creates a separate obligation that timely filing does not satisfy. A mortgage company and its employees, officers, directors, and agents must not disclose a SAR, or information revealing its existence, to its subject. Training must address the danger of revealing a filing to a borrower, referral partner, or other third party, including inadvertently. This deserves its own treatment rather than a passing reference in a general AML policy.

Why the independent audit cannot be performed internally

Independent testing requires personnel separate from those who implement or oversee the AML program, a distinction particularly important in small broker-owner companies, where the owner often serves as the AML Compliance Officer. That owner cannot also conduct the independent review. Many state regulators will not accept a self-audit, and some explicitly require third-party performance.

A qualified outside auditor must do more than establish distance from management. The review should test policies, controls, training records, SAR documentation, risk assessment currency, OFAC screening, and third-party oversight against the company’s risk profile. FinCEN’s proposed emphasis on objective criteria makes mortgage industry knowledge especially relevant because reviewers must distinguish defensible risk prioritization from a control gap. Pease Bell’s specialized mortgage banking practice is one qualified third-party option for companies that need both independence and an understanding of how their business works.

What a weak or poorly designed AML program exposes a mortgage company to

A generic policy may overlook a company’s channels, while a stale risk assessment may miss changes in products or markets. Untrained loan-level staff, undocumented red flag reviews, and misunderstood SAR confidentiality create further gaps. Unmonitored vendors and branches can leave parts of the operation outside the controls. A missing or nonqualifying independent audit then leaves those weaknesses without the required review.

The consequences extend beyond having to rewrite a policy. Civil monetary fines for BSA/AML violations range from $5,000 to $1 million per violation, while money laundering convictions can carry imprisonment. The residential real estate transfer rule has its own civil penalty structure, with escalating consequences for patterns of negligence and willful violations. Weak programs can also harm a company’s reputation, put investors at risk, and cost the company its relationships with wholesale lenders. Closing one gap does not excuse leaving another unresolved.

How AML obligations interact with HUD 232 and multifamily mortgage compliance

Specialized mortgage lending places AML controls within a broader reporting framework. HUD Section 232 insures mortgages for skilled nursing facilities, assisted living communities, and other residential care facilities like them. Under 24 CFR 5.801, borrowers covered by the rule must send in annual financial statements within 90 calendar days of fiscal-year-end. Operators must send in quarterly and year-to-date statements within 90 calendar days of the fiscal-year-end quarter and prepare them under GAAP as further defined by HUD. The updated Section Handbook provisions that take effect January 5, 2026 apply to new applications and transactional requests for covered projects already in place.

These reporting duties do not replace ownership and source-of-funds scrutiny. Borrowers, operators, and management companies may use LLC or limited partnership structures that make ownership identification more demanding. HUD OIG’s April 2, 2026 audit report 2026-BO-0001 found that HUD did not always address financial risks identified in Section 232 borrowers’ audited statements. The review, prompted by rising defaults, also found that HUD ORCF staff lacked the time and capacity for analysis needed to identify unauthorized distributions. Those findings underscore the importance of lender-side controls alongside HUD oversight.

What SOC examinations and AI governance add to the AML compliance picture for mortgage technology vendors

Vendor assurance must match the function entrusted to the provider. SOC 1 addresses internal controls over financial reporting, while SOC 2 covers security, availability, processing integrity, confidentiality, and privacy. SOC 2 Type I assesses control design and implementation at a point in time. SOC 2 Type II examines operating effectiveness over a sustained period, making it more meaningful for ongoing monitoring services. Requiring Type II reports from AML technology vendors is therefore a baseline expectation.

AI adds another layer to that assessment. Freddie Mac’s Bulletin 2025-16, amending Guide §§ 1302.2 and 1302.8, has been in effect since March 3, 2026. Fannie Mae’s Lender Letter LL-2026-04, issued April 2026, establishes AI and ML governance requirements for approved sellers and servicers using those systems in origination or servicing, effective August 6, 2026. It covers both systems built in-house and those supplied by vendors.

A SOC 2 Type II report may not provide sufficient assurance about an AI-enabled AML or underwriting workflow on its own. Combined SOC 2 and AIUC-1 reporting represents an emerging assurance direction rather than a stated GSE mandate for that particular report combination. Pease Bell’s work in SOC 1, SOC 2, and emerging standards including AIUC-1 makes it one option for this layered assurance.

Building a mortgage AML program that holds up to independent review

A defensible program connects its parts through a current risk assessment. When the business changes its products, markets, channels, or providers, those decisions must also shape the written controls. Training must teach the people who come across suspicious activity how to use those controls. Escalation must lead to a recorded filing decision within the time allowed, while vendor oversight must include up-to-date assurance evidence. Independent testing then evaluates whether these connections work, rather than merely confirming that the required documents exist.

Independent mortgage bankers choosing a CPA firm should look for one that knows mortgage compliance, meets the independence requirements, and has experience with the rules their business must follow. Where HUD lending, mortgage technology, or GSE-governed AI systems are involved, the review also needs to account for those additional requirements. This makes the scope of the engagement as important as the choice of firm. FinCEN’s proposed reforms point toward reviews that examine whether controls are calibrated to actual risk. The direction is broader coverage, more deliberate prioritization, and independent evidence that the program fits the mortgage operation it governs.