CFPB Compliance Audit Scope for Mortgage Lenders

A CFPB compliance audit for a mortgage lender is not a single pass through loan files looking for stray errors. It works on three levels at once: whether written policy meets the Bureau's own standards, whether day-to-day practice matches that policy, and whether any gap between the two actually hurt a borrower. Most mortgage professionals assume this kind of scrutiny only applies to large banks with trillion-dollar balance sheets. That assumption is wrong in a way that matters for nearly every independent mortgage company in the country.

What a CFPB compliance audit examines for mortgage lenders

Title X of Dodd-Frank sets the boundary of CFPB supervisory authority, and the line most people draw, the $10 billion asset threshold for depository institutions, only tells half the story. That threshold governs banks, thrifts, and credit unions. It does not apply to nondepository mortgage originators and servicers, which fall under CFPB supervision regardless of size. A five-person mortgage broker and a national nonbank servicer sit under the same examination authority. Scale changes the intensity of a given exam, not whether the exam can happen.

Once an institution is in scope, the audit itself runs on three tracks. The first is policy adequacy: does the written compliance management system meet the standards laid out in the CFPB's own examination manual? The second is operational conformity: do actual practices, the way disclosures go out, the way servicing transfers happen, the way complaints get resolved, match what the policy says should happen? The third is consumer harm assessment: where the first two break down, did real borrowers lose money, lose access to credit, or get misled? Each of the next three sections in this piece takes one of those tracks in turn, because each one asks a different question and produces a different kind of finding.

For mortgage lenders, the substantive law behind these three tracks is dense. Examiners map findings against a range of federal consumer financial statutes covering lending disclosures, settlement procedures, credit discrimination, debt collection, mortgage data reporting, credit reporting, loan servicer licensing, and the Bureau's UDAAP authority covering unfair, deceptive, or abusive acts and practices. Each statute attaches to specific product and servicing modules, so a servicing-side examination and an origination-side examination pull from overlapping but distinct sets of rules.

Statute sets the financial consequences of an unmanaged finding. Under 12 U.S.C. § 5565, civil penalties scale with the severity of the violation: ordinary violations carry one daily maximum, reckless violations a steeper one, and knowing violations the steepest tier of all. A finding that starts as a documentation gap can turn into a penalty calculated per day, which is part of why remediation speed matters as much as remediation substance.

The shape of examination activity itself is shifting in 2026. Acting CFPB Director Vought has said the Bureau expects to run fewer examinations this year, concentrating on higher-risk areas and cutting duplication with other regulators. That narrower footprint points toward fraud, mortgage-related harms, military consumer protections, credit reporting, and debt collection, specifically where there's an identifiable victim and measurable harm. Fewer exams does not mean lighter consequences for the institutions that get selected; selection itself is now a stronger signal that something in the complaint data or prior findings caught attention.

The Compliance Management System: the audit's first lens

Every CFPB examination starts with the Compliance Management System, and a CMS that reads well on paper but doesn't function day to day counts as a finding on its own, before an examiner opens a single loan file. The Bureau's Supervision and Examination Manual treats the CMS as a system with four working parts: board and senior management oversight, the design of the compliance program itself, how consumer complaints get handled, and whether an internal compliance audit function actually operates. Examiners assess all four as a working whole, not as a stack of binders.

That assessment unfolds in phases. It begins with scoping and risk assessment, where regulators pull complaint data from the CFPB Consumer Complaint Database and review prior examination findings to decide where to concentrate. From there, examiners issue a document request, typically at least 60 days before the examination start date, covering policies, procedures, training records, consumer disclosures, loan files, servicing records, and complaint logs. Interviews with compliance officers, operational staff, and in some cases vendor representatives follow, testing whether the written controls actually get used the way the documentation claims.

IT and information security sit inside this same CMS framework. Access controls, vendor management, data security, business continuity planning, and incident response all get reviewed as pieces of operational compliance. A lender's cybersecurity posture is not a separate conversation from its regulatory standing.

Independent mortgage lenders carry additional layers of assurance obligation that stack on top of CFPB review. Fannie Mae, Freddie Mac, and Ginnie Mae each run seller-servicer counterparty audits, and the FTC Safeguards Rule under 16 CFR Part 314 adds its own requirements tied to financial reporting and data controls. A lender preparing for CFPB supervision is, in practice, preparing for several overlapping assurance regimes at once.

A fully documented CMS feels like proof of readiness, but examiners test whether the program functions in practice. A written policy that nobody consistently follows gets treated, for purposes of findings, the same as no policy.

The operational layer: what transaction testing and timing requirements reveal about day-to-day practice

Most CFPB findings against mortgage lenders originate here, in the space between what a policy says and what loan officers and servicers actually do once volume rises and deadlines tighten. The CMS section covers what's written down. This section covers what happens anyway.

TRID disclosure accuracy sits near the top of the list of things examiners check first. They trace how borrower applications come in and get processed, and they verify the accuracy of the Loan Estimate and the Closing Disclosure against what actually happened in the transaction. Under Regulation Z §1026.25, you need to keep most disclosures for three years, Closing Disclosure records for five years, and ability-to-repay and loan originator records for three years. A lender that can't produce the right record for the right period has a finding regardless of whether the underlying disclosure was accurate.

The disclosure baseline itself may move. The CFPB issued a 2026 Request for Information on the TRID rule, following the March 2026 Executive Order 14393, "Promoting Access to Mortgage Credit," with comments due August 10, 2026. Lenders should watch whether any resulting rule change alters existing documentation and retention practices, because an examination period can span a transition between old and new requirements.

On the servicing side, the July 2026 CFPB Mortgage Servicing Examination Procedures organize review into a modular structure that examiners apply after completing risk assessment and scoping. Depending on scope, an exam can pull from modules covering servicing transfers and loan ownership transfers, payment processing and account maintenance, consumer inquiries and complaints and error resolution, escrow account and insurance product maintenance, credit reporting, information sharing and privacy, collections and accounts in bankruptcy, and loss mitigation, early intervention, and continuity of contact. The breadth of that list is itself the point: a servicing exam can reach into nearly every part of the borrower relationship after closing.

One procedural rule inside that servicing framework produces a disproportionate share of findings: the dual-tracking prohibition. Servicers are barred from moving forward with foreclosure while a borrower's complete loss mitigation application is still under review. When that overlap happens anyway, it generates an operational finding and a consumer harm finding at the same time, because the procedural failure and the borrower's injury are the same event.

Examiners test for these failures through transaction testing: a statistical sample of consumer accounts or transactions, drawn on risk-based principles, checked for disclosure accuracy, timing compliance, and correct fee calculation. Timing failures appear with some regularity around loan transfer events specifically, when records move between systems and deadlines slip in the handoff.

HMDA data sits inside this same operational layer. The asset size exemption threshold rose slightly effective January 7, 2026, but the closed-end reporting threshold itself stayed at 25 or more originations in each of the two preceding calendar years, with the 2026 data submission due March 1, 2027. The operational obligation here is making sure the data collected is accurate and complete under the threshold that already applies.

Transaction testing turns up the late disclosure, the mistimed transfer, the dual-tracked foreclosure, and each of these is rarely a standalone operational defect. Each one raises the next question examiners ask: did this actually cost a borrower something?

The consumer harm layer: how examiners determine whether operational gaps injured borrowers

Consumer harm assessment is where a compliance finding turns into something with real financial consequence, because it is the point at which examiners decide whether a policy gap or an operational failure produced financial loss, denied credit, or a deceived borrower, and then try to size that injury.

Findings that reach this stage get classified as violations or as matters requiring attention, and either classification triggers a formal corrective action plan with its own remediation timeline. If remediation doesn't resolve the underlying issue, the path runs toward enforcement, including civil money penalties under the tiered structure set out in 12 U.S.C. § 5565.

Complaint data does double duty in this process. The CFPB Consumer Complaint Database shapes scoping before an examination even starts, so a lender's complaint volume and how well those complaints get resolved function as an early signal of which modules examiners will scrutinize hardest. A servicer with a cluster of complaints about escrow handling should expect the escrow module to get more attention, not less.

Before any finding becomes final, institutions get a response window. Draft findings go to management first, who can supply factual corrections and context, and who can point to remediation already underway. That window is a genuine opportunity to shape how harm gets characterized, so long as the lender has already started fixing the underlying problem before the final report arrives.

Fair lending sits inside this harm-assessment track as its most consequential sub-area, and the next section works through why that is, and why 2026's regulatory changes make it more complicated to manage.

Fair lending as the highest-stakes area of consumer harm review

The CFPB narrowed fair lending enforcement under ECOA in April 2026, and that narrowing redistributes mortgage lenders' fair lending risk. The Fair Housing Act, state enforcement, and private litigation still reach the same underwriting and pricing conduct the federal rule now reaches less often.

The limitation built into the 2026 rule change matters specifically because of what it leaves untouched. The Fair Housing Act applies broadly to loans secured by residential real estate, covering first-lien mortgages, subordinate-lien loans, refinancings, and home equity loans alike. Disparate impact claims still stand cognizable under that statute after the Supreme Court ruled in 2015 in Texas Department of Housing and Community Affairs v. Inclusive Communities Project, Inc. A lending practice that produces disproportionate outcomes across protected classes can still draw a disparate impact claim under the FHA even where ECOA enforcement has stepped back.

Federal banking regulators are not moving in lockstep on this. The OCC ended its fixed mandatory fair lending risk assessment schedule for community banks and dropped disparate impact liability from exam scope, but it still runs risk-based fair lending reviews and screens HMDA data for signs of intentional discrimination. The FDIC also ended disparate impact use in exams and moved to a schedule based on asset size and compliance rating: a well-rated bank under $350 million in assets now gets a joint compliance and CRA exam roughly once every 66 to 78 months, call it five and a half to six and a half years. The NCUA still runs defined-scope exams for smaller credit unions and risk-focused exams for larger ones. The Federal Reserve has not pulled back its fair lending review and keeps the authority to refer cases to the Department of Justice, though it made no ECOA referrals to the DOJ in 2025.

One might argue that this pullback across several regulators adds up to meaningfully lower risk. The statute of limitations complicates that read. ECOA claims carry a five-year limitations period and FHA claims a two-year one, but the DOJ has in prior reviews looked at data reaching beyond that five-year ECOA window. A lending practice that draws no scrutiny under today's exam posture can still face a private lawsuit, a state attorney general's investigation, or a future administration's enforcement priorities later on. Reduced federal exam frequency changes who is likely to look and when, not whether the underlying conduct remains actionable.

In the exam room itself, fair lending review still runs on regression analysis across loan files, testing demographic proxies for disparate treatment and disparate impact in underwriting, pricing, and servicing decisions. That methodology does not change with the 2026 rule shift, and it increasingly applies to a newer kind of underwriting decision: one made in part by an algorithm.

Algorithmic underwriting and AI tools in the fair lending framework

Algorithmic underwriting does not sit outside the compliance framework already described. It sharpens the scrutiny already applied under ECOA, adverse action notice requirements, and consumer harm assessment, and it does so faster than the assurance frameworks built to cover it can keep pace.

Consider how an adverse action notice works when a human underwriter makes the call. A denied applicant can be given a specific, traceable reason: insufficient income relative to debt, a thin credit file, an unverifiable employment history. An algorithmic underwriting model trained on thousands of variables and their interactions can produce a denial that is statistically sound but much harder to translate into the plain-language reason ECOA requires. It is the existing adverse action requirement running up against a decision process that was not designed with disclosure in mind.

The same tension runs through fair lending testing itself. Regression analysis across demographic proxies works well when it runs against a conventional underwriting matrix with a known, finite set of inputs. An algorithmic model can incorporate variables correlated with protected class status in ways that are not obvious from the model's documentation alone. Disparate impact can appear in the model's outputs even where no single input looks problematic on its face.

What raises the stakes further is the gap between how fast lenders are adopting these tools and how developed the assurance standards for them actually are. Financial statement auditors and compliance examiners have decades of established methodology for testing a conventional underwriting process. Testing an algorithmic one for fair lending compliance, for adverse action accuracy, for consumer harm, is a newer and less settled discipline, and lenders deploying these tools are, in effect, operating ahead of the assurance infrastructure meant to validate them.

None of this suggests mortgage lenders should avoid algorithmic tools. It suggests that if a lender adopts one, it should treat fair lending testing, adverse action documentation, and model validation as part of the same compliance obligation it already owes under ECOA and the CFPB's examination framework, not as a separate technical question to handle later. The three-dimensional structure that opened this piece, policy adequacy, operational conformity, and consumer harm, still applies. The inputs have just gotten more complicated to trace.