HMDA Compliance and Data Integrity

HMDA compliance failures persist because the organizational processes built to meet those rules have not kept pace with what the rules demand. Wipfli's January 2026 analysis makes this point: despite few regulatory changes since 2018, many financial institutions still struggle to report HMDA Loan Application Register data accurately, and the firm argues that ongoing education and process review, not rule familiarity, is what closes the gap. The core data fields involved, loan purpose, action taken, income, and rate spread, have been stable since 2018. Errors that keep appearing in the same fields year after year occur because of a process gap inside the institution, not confusion over a changing rulebook. The 2026 Filing Instructions Guide confirms there are no significant changes to the submission process and no new data fields for data collected in 2026, so the architecture lenders are reporting against is the same one they've worked with for years. The data points from the 2015 rule have been in place since January 1, 2018, so institutions have had roughly eight to nine years to build systems around them, and by now complexity is not a credible excuse for recurring mistakes.

The 2026 regulatory picture for covered institutions

Before diagnosing where reporting goes wrong, it helps to settle what the 2026 landscape actually requires, because misunderstanding coverage and deadlines wastes compliance resources on the wrong problems. The asset-size threshold under HMDA applies only to depository institutions. Non-depository lenders face no asset-size test at all and are instead subject only to the origination thresholds, 25 closed-end loans and 200 open-end lines of credit, each applied independently. Credit Technologies got this distinction wrong in its own reporting and later had to correct it, so even experienced reporters can misapply the threshold rules. The closed-end threshold is 25 originated loans in each of the two preceding calendar years, and it has not moved higher. A 2020 rule that would have raised that threshold was vacated by the U.S. District Court for the District of Columbia on September 23, 2022, which restored the 25-loan figure that remains in effect.

Large reporters are institutions that had a high volume of applications and covered loans, excluding purchased loans, in the prior year, which requires them to file quarterly. The annual filing period for 2025 data ran from January 1 to March 2, 2026, and the first quarterly filing period for 2026 data ran from April 1 to June 1, 2026. Data collected throughout 2026 is due on the HMDA Platform by March 1, 2027, under the same schema, the same validation regime, and no additional testing obligation beyond what institutions already know. Two developments from early 2026 deserve attention, but they do not change this cycle's requirements. On March 13, 2026, President Trump signed an executive order directing the CFPB to consider further mortgage regulatory reforms, including raising the asset threshold for HMDA exemption and excluding mortgage inquiries from reporting scope, but those potential changes would not affect 2026 reporting requirements as they currently stand. Separately, on January 16, 2026, the CFPB announced it would discontinue, effective January 20, 2026, the email service it had used to notify institutions about changes to HMDA requirements, citing operational constraints. Institutions that relied on those alerts now need to monitor official CFPB channels directly rather than waiting for a notification that will not arrive.

Where reporting breaks down

Once the coverage questions are settled, the harder operational problem comes into view: certain fields produce errors repeatedly, and each one traces back to a specific breakdown in how data moves through an institution before it ever reaches the LAR. Action taken is one of the most common failure points. Some lenders code a loan as "approved but not accepted" when it was actually denied, or mark an application "withdrawn" when it should have been closed for incompleteness. You need thorough records of borrower communications and application activity to get this field right, so when those records are thin, the error becomes almost inevitable.

Income reporting follows a similar pattern. HMDA requires reporting only the income relied on for the credit decision, not any figure a borrower mentioned earlier in the process. Misreporting happens when institutions default to an initial self-reported number instead of the final underwritten figure, or when they enter an employee's own income where the rule requires "NA. Cash-out refinance classification carries its own trap: Wipfli notes that a transaction can only be reported as a cash-out refinance if it meets Regulation C's definition and the institution or its investor treats it as such, not simply because the borrower walked away with cash at closing. Dwelling definition and mixed-use property scenarios also round out the top five issues for the 2025 submission cycle. Properties used to provide medical care, such as skilled nursing, rehabilitation, or long-term medical care, are not dwellings under HMDA and fall outside its coverage entirely, a boundary that has to be enforced with some rigor. Secondary market reporting and demographic information collection make up the rest of the recurring error categories reporters flagged for 2025.

What connects all of these failure points is not rule complexity but fragmentation. Data lives scattered across email inboxes, manual spreadsheets, and paper files, with no single authoritative dataset governing the LAR before it gets submitted. When you need to pull data from five different places to code a field correctly, the chance someone assembles it right under deadline pressure drops with each handoff.

What examiners do when they find errors

The stakes attached to these field-level errors have shifted. Federal supervisory agencies with HMDA authority can verify accuracy within a sample of an institution's reported transactions, and when errors exceed certain thresholds, the institution gets directed to correct and resubmit its HMDA data. But resubmission is only the starting point of the consequence, not its limit. Under FFIEC Guidelines, examiners can also direct an institution to change its policies, procedures, audit processes, or other elements of its compliance management system to prevent the same errors from recurring.

HMDA's appearance on the FDIC's top five violations list for the first time, in its 2026 Consumer Compliance Supervisory Highlights, deserves attention on its own. The list named the same five regulations as the prior year's publication, HMDA alongside the Truth in Lending Act, the Flood Disaster Protection Act, the Truth in Savings Act, and Regulation E, and those five together accounted for the large majority of all violations cited. If you have treated HMDA as a lower-tier compliance obligation, handled once a year by a small team under deadline pressure, you need to know that examiner attention to this data has measurably intensified. The reason runs deeper than administrative tidiness. Accurate LAR data feeds directly into fair lending statistical analysis, so when HMDA data quality slips, the effects ripple into safety and soundness, fair lending exposure, and supervisory control, and any perceived slippage can be expected to draw pushback from regulatory examiners well beyond a request to resubmit a file.

HMDA data integrity's intersection with financial statement audits and SOC examinations

HMDA data integrity does not stay contained to the LAR filing. It appears in audit domains that compliance teams often do not see coming, only when an examiner or auditor flags the discrepancy directly. HMDA LAR data has to reconcile to underlying loan-level financial records, and when transaction volumes or income figures on the LAR diverge from the general ledger, that discrepancy becomes a materiality concern for auditors working under generally accepted auditing standards during a financial statement audit.

A related exposure runs through vendor oversight. Mortgage servicers and loan origination system vendors typically carry SOC 1 (AT-C 320) or SOC 2 reports covering the controls that process loan data, and auditors now test those controls more rigorously as the threat landscape shifts, so they pay particular attention to how AI and automation touch customer data. New GSE rules are pushing mortgage lenders to audit vendor AI systems more deeply than a traditional SOC 2 review requires. The mortgage banking industry has moved into a procurement environment where a vendor's SOC 2 Type II report is a necessary credential but no longer a sufficient one on its own.

This is where the case for cross-domain audit expertise becomes concrete: Pease Bell's work spans financial statement audits, SOC 1 and SOC 2 examinations, and mortgage banking audit and compliance, which puts the firm in a position to see HMDA data integrity issues from several audit angles at once, catching discrepancies before they turn into resubmission events or examiner findings.

How AI-assisted underwriting amplifies HMDA data integrity risk

As lenders bring AI-assisted underwriting, document processing, automated data extraction, and workflow tools into their operations, HMDA data governance becomes both more important and more complicated at the same time. One might argue that automation should reduce errors by removing manual data entry from the process, and in some respects it does. But automation does not eliminate the risk of a misclassification; it accelerates how far that misclassification travels once it exists. Automated data extraction can propagate an error across hundreds of transactions faster than any manual process ever could. If the extraction logic encodes a waterfall error in purpose coding, or misclassifies a cash-out refinance, the LAR inherits that mistake at scale.

That raises an important question for institutions adopting these tools: is the goal simply that the tool produces an output, or that the output can be defended? The emerging assurance question for mortgage lenders is not only whether an AI tool works, but whether its outputs can be traced, documented, and defended in a HMDA examination or a fair lending review. An institution that cannot explain why its automated system classified a loan a certain way has not solved its data integrity problem; it has outsourced the problem to a system it cannot fully audit. Pease Bell's orientation toward emerging AI assurance standards, including AIUC-1, reflects this same logic: as AI enters financial workflows, institutions need auditors who understand both the technical controls behind the tool and the regulatory exposure those controls are meant to manage.

What year-round operational discipline looks like in practice

The persistence of HMDA errors despite stable rules since 2018 points to a principle that runs through financial compliance more broadly: high-quality assurance is not a once-a-year checkpoint, but a year-round operational discipline. If an institution files clean LARs, it treats data integrity as a continuous process, with defined controls built in from the start, not as an annual validation exercise that kicks off every January. A single authoritative dataset needs to govern HMDA report validation, internal reviews, and final submission; automation can help maintain that single source of truth, but if you accept a manual override, it needs a documented exception reason and supporting evidence first.

Quality edits built directly into loan origination systems should catch action-taken mismatches, income field anomalies, and purpose-code waterfall errors at the point of data entry, not weeks later when someone is compiling the LAR under deadline pressure. Borrower communications and application activity need to be documented thoroughly enough to support whatever action-taken code eventually gets reported, and the same documentation discipline that prevents HMDA errors also supports an institution's fair lending defense if examiners come asking questions.

Since many HMDA errors cluster around fields with complex application logic, action taken, income relied upon, cash-out refinance status, and dwelling definitions, the institutions that report cleanly are the ones treating data capture and validation as a disciplined process from origination onward, not as a batch-correction exercise squeezed in before submission. Mortgage banking auditors at regional CPA firms focused on this space routinely see which lenders have built that discipline into their systems and which haven't, and the difference becomes visible long before an examiner ever opens a file.

The 2026 FIG confirms no new fields and no new validation regime for data collected this year, so institutions that built their processes correctly for 2025 are already collecting correctly for 2026. The work now is maintaining and auditing those processes, not rebuilding them from scratch. Institutions with quarterly filing obligations, those with the volume of applications and covered loans that triggers large-reporter status, face a more compressed version of this same discipline, because quarterly windows leave no room for a year-end scramble to fix what you should have caught in April. HMDA worksheets, flow charts, and the CFPB's Filing Instructions Guide get recalibrated every year, so you should check your training logs and internal checklists against the current year's FIG, not a prior year's version or a secondary summary that may still carry errors a later draft corrected.

Catching HMDA integrity issues through mortgage banking audit practice

The firms best positioned to support independent mortgage bankers and regional lenders on HMDA compliance share a common trait: they understand mortgage banking's regulatory environment, not just the mechanics of the LAR itself, which lets them surface data integrity problems at the process level where they can actually be fixed, rather than at the submission level where the damage is already done. If you are asking how to find a CPA firm that understands seller-servicer audit requirements from the government-sponsored mortgage enterprises, start with that distinction: process-level versus submission-level review.

HMDA compliance asks community banks to do three things at once: report required data with integrity and accuracy, maintain quality checks throughout the lending process, and prove those controls are actually working when an examiner asks. That third requirement is an audit function, not a line item on a compliance checklist, and it's the one institutions most often underbuild. HMDA reporting, fair lending statistical analysis, and financial statement reconciliation intersect, so a lender's audit team needs to see across all three at once. If a general-purpose auditor reviews the LAR in isolation, without connecting it to fair lending patterns or general ledger reconciliation, they will miss the cross-domain discrepancies that examiners are trained to find.

Closely held mortgage banking entities, community banks organized as S-corps or LLCs, carry an additional layer of exposure where HMDA compliance meets tax planning. Errors in origination counts or loan classifications can create discrepancies between the LAR and the institution's tax returns, and tax advisors working alongside auditors are positioned to catch these before they compound into something harder to unwind. Pease Bell's mortgage banking audit and compliance practice is built around this exact intersection; it combines HMDA compliance review, financial statement audit, and tax advisory within a single client relationship. For independent mortgage bankers evaluating what compliance support they need to stay in good standing with the GSEs, that combination, one relationship spanning compliance, audit, and tax, rather than three separate vendors who never compare notes, is what partner-level attention across the domains where HMDA errors tend to hide actually looks like in practice.