State Licensing and Net Worth Requirements for Mortgage Lenders

Mortgage lenders operating in more than one state face two separate sets of financial thresholds that rarely line up: state licensing floors that range from roughly $25,000 to $250,000 in net worth, and GSE seller/servicer standards that start at $2.5 million before volume-based add-ons. If you want to stay licensed and stay approved, you need a firm that understands both layers, along with the audited financial statement rules each state and counterparty attaches to them. This piece maps that full stack, state by state and counterparty by counterparty, and points toward the kind of audit relationship you need to manage it.

How the U.S. mortgage licensing system is structured before state-specific rules apply

Every mortgage lender in the country sits on the same federal floor before any state rule ever applies. A federal licensing law and a shared national licensing registry set baseline requirements that no state may undercut: pre-licensure education hours, a standardized national licensing exam, an FBI criminal background check, a credit report review, and registration through the registry itself. But meeting that floor alone does not make a lender compliant anywhere, because every state adds its own layer on top of it.

NMLS tracks compliance at two different levels: individual loan originator licensing and company-level financial requirements. Individual mortgage loan originators carry their own licensing and testing obligations, but net worth thresholds, warehouse lines of credit, and audited financial statement requirements attach to the mortgage company itself, not to the individual originator. NMLS tracks both separately, and many companies end up carrying both as they grow from brokering into direct lending.

State Net Worth Floors by Jurisdiction

State net worth requirements do not follow the logic you might expect. Larger states with bigger mortgage markets are not necessarily the ones with higher floors, and a company that has built its compliance program around one state's requirements can find itself well short of another's the moment it tries to expand.

Florida is at the low end: mortgage lenders there need a minimum net worth of just $63,000, with no surety bond requirement under most readings of the rule (some sources cite a $10,000 bond instead), and brokers need only $25,000. A mortgage lender there must maintain net worth of at least $100,000, but the state also requires evidence of $1,000,000 in liquidity, which can include a warehouse line of credit, and that liquidity must be documented by an unqualified audited financial statement under G.S. 53-244.104. Michigan structures its thresholds by license type: the First Mortgage Broker, Lender and Servicer License calls for a $125,000 bond alongside $100,000 in net worth. Montana sets its net worth floor at $250,000, the highest of the group, and layers a CPA attestation requirement on top of the dollar figure, a detail the next section covers in depth.

Surety bonds follow their own separate logic. California's CFLL licensees, for example, have bond amounts tied to the prior calendar year's origination activity, while CRMLA licensees have bonds tied to prior-year origination and servicing activity combined.

The financial statement itself is not a uniform document across states either. Compiled, reviewed, and audited engagements differ sharply in cost and in the time it takes a CPA firm to complete them, making the choice of assurance level a budgeting and scheduling decision that has to be made well before a license application is due.

Audited financial statements as a licensing condition, not just a reporting formality

Several states do not treat the financial statement as a document to file once and forget. They treat it as a live condition of the license, one that can be withdrawn if the statement is late, deficient, or carries the wrong kind of opinion.

Massachusetts is the clearest example of how prescriptive this can get. Florida enforces its own version of this through statute: audited financial statements must be prepared by an independent licensed CPA, the audit must run as of the licensee's fiscal year-end, and a copy goes to the Office within 120 days after that year-end.

Montana goes further than either state by writing the consequences of falling short directly into its statute. If a lender falls below the threshold, it has 30 business days from the department's notice to submit a remediation plan. North Carolina adds a different kind of teeth: its requirement for an unqualified audited statement of financial condition makes the quality of the audit opinion itself a compliance variable, and a qualified opinion can fail to satisfy the condition.

Lenders operating in more than one of these states run into a scheduling problem that has nothing to do with the quality of their financial condition. A 90-day Massachusetts deadline, a 120-day Florida deadline, and a Montana attestation requirement do not resolve into a single filing calendar, and federally-approved lenders have their own 90-day recertification window for electronically submitted audited financial statements under a federal housing agency's handbook, with suggested audit procedures covering adjusted net worth, liquidity, fidelity bond coverage, and errors and omissions bond. Multi-state operators need an audit calendar built around these overlapping deadlines, and this is the same coordination problem that gets sharper once GSE counterparty standards enter the picture.

Why GSE counterparty standards dwarf state licensing floors

A lender can hold every state license it needs and still be shut out of the GSE market, because Fannie Mae and Freddie Mac set net worth floors that are a multiple of what any state requires. These are a separate regime that a lender pursuing GSE approval has to satisfy on top of, not instead of, its state obligations.

Fannie Mae requires all sellers/servicers, depository and non-depository alike, to maintain an Adjusted Net Worth of at least $2.5 million, plus an additional amount tied to a percentage of the unpaid principal balance of loans serviced, plus a capital ratio of at least 6% of Adjusted Net Worth to Total Assets for non-depository sellers/servicers. Freddie Mac's structure runs in a similar direction but with more components: depository institutions must maintain Tangible Net Worth of $2.5 million, plus 25 basis points of Residential First Lien Mortgage Servicing UPB serviced for the Enterprises, plus 25 basis points of Other Servicing UPB, plus 35 basis points of Residential First Lien Mortgage Servicing UPB serviced for Ginnie Mae, plus 35 basis points of Ginnie Mae UPB.

These two sets of numbers do not stack on top of state minimums in a simple additive way, but a lender working toward GSE approval has to satisfy both simultaneously. A lender that cannot meet the GSE threshold directly can still reach the secondary market by selling through an approved third-party aggregator, but that path comes at a cost: it forfeits pricing control and the direct counterparty relationship that comes with full approval.

Independent mortgage companies face a particular version of this squeeze. Because the net worth formula scales with UPB serviced, the required threshold rises as a lender grows its servicing book, making it easier for large incumbents, who already clear the bar, to stay compliant than it is for a mid-size lender trying to scale into it. Fannie Mae's own financial disclosures acknowledge that non-depository servicers generally operate under lighter regulatory oversight than depository counterparties, which is part of why Fannie Mae requires them to meet minimum liquidity requirements and monitors their financial condition and capital adequacy directly.

Who Gets Shut Out by Layered Thresholds

Stacking a state net worth floor, a GSE counterparty threshold, and an ongoing audit obligation on top of each other produces a set of fixed costs that do not move with loan volume.

A lender has to maintain its minimum net worth whether it closes a small handful of loans a month or a much larger volume. The GSE net worth formula rises with UPB serviced, so if a lender is still building its servicing portfolio, its required capital grows faster than its revenue, and the threshold ends up easiest to clear for lenders who already clear it. The indirect route through a GSE-approved aggregator is not free of cost either: it transfers pricing leverage away from the originating lender and removes it from the kind of direct counterparty relationship that would support future growth toward full approval.

That raises an important question about who benefits from thresholds set this high. The debate here is less about whether thresholds should exist and more about where they should be set.

What HUD Section 232 adds for lenders and operators in skilled nursing and multifamily housing

For lenders active in skilled nursing and multifamily housing finance, state licensing and GSE standards make up only two layers of a three-layer compliance picture. HUD's Section 232 mortgage insurance program adds a third, administered by HUD's Office of Residential Care Facilities, and it is large enough to matter: the program insures more than 3,600 loans carrying an unpaid principal balance of more than $32 billion.

The 2026 handbook update sets submission deadlines that differ by category and by party. Borrower audited financial statements are due within 90 days of fiscal year close. Operator quarterly statements are due within 60 calendar days of each quarter's end. None of these statements can simply follow standard GAAP formatting either: they must comply with HUD's Uniform Financial Reporting Standards under 24 CFR 5.801 and 24 CFR 200.36. That means meeting HUD's specific formatting and content rules on top of producing accurate numbers. FHA-approved lenders carry their own parallel obligation, completing annual recertification with electronically submitted audited financial statements within 90 days of fiscal year-end, with audit procedures testing adjusted net worth, liquidity, fidelity bond coverage, and errors and omissions bond coverage under HUD Handbook 4000.1.

One technical detail trips up a disproportionate number of first-time borrowers in this space: interest paid at closing on a prior mortgage needs to be accrued so the expense does not fall inside the HUD audit period. Many Section 232 borrowers operate skilled nursing and long-term care facilities, where the audit has to satisfy both HUD's mortgage compliance requirement and the facility's own healthcare regulatory reporting at the same time. That overlap rewards an auditor who already knows both the handbook and the healthcare reporting environment, rather than one encountering either for the first time.

SOC 1 Examinations for Mortgage Servicers and Technology Vendors

A lender's own audit obligations do not stop at its own books. They extend to the vendors and service organizations that process its loans, and SOC 1 is the mechanism that satisfies the assurance those vendors' clients need.

SOC 1, built on SSAE 18's AT-C 320 framework, applies to companies performing financial transaction processing, which in the mortgage context includes loan servicing platforms, general ledger systems, pricing and hedging tools, valuation systems, and payment processing platforms, anywhere a control failure could ripple into a client's financial reporting. The Type 2 designation matters specifically: it requires demonstrated operating effectiveness over a period, typically a minimum of six months, usually aligned to a fiscal or calendar year-end so the results line up with a client's own reporting needs. A Type 1 report, by comparison, only covers the design of controls at a single point in time and does not satisfy the operating effectiveness standard that most lenders' auditors actually need.

SOC 2 serves a different purpose. If a vendor's clients care more about operational and security controls than financial reporting impact, SOC 2 is the right framework, and any company providing IT systems to lenders is increasingly expected to have one, since it shows a commitment to protecting customer data. Updates to both are anticipated, but the earliest realistic implementation date under the AICPA's current exposure drafts is 2029, so if you are planning an examination cycle now, you have no reason to wait on the current standards.

The consequence on the lender side is direct. A vendor's SOC examination, in other words, is not just the vendor's concern. It shapes how much the lender's own annual audit costs and how long it takes to finish.

Assembling the Full Compliance Picture

Put together, a multi-state non-bank lender pursuing GSE approval has to manage a compliance picture made of obligations that overlap but rarely align. GSE adjusted net worth and capital ratio requirements sit above all of this, and HUD-approved lenders carry their own 90-day recertification cycle with audited financials on top of everything else.

Because net worth requirements and financial statement assurance levels vary so sharply, from Florida's $63,000 floor to New York's stricter thresholds, and because states differ in whether they accept compiled, reviewed, or audited statements, lenders scaling into new states need advisors who understand both the regulatory landscape and the audit standard each jurisdiction actually accepts. Pease Bell's mortgage banking audit practice works across state lines, so it structures financial statements and audit engagements to match the specific assurance level each state requires instead of defaulting to a single approach and hoping it clears every jurisdiction.

The auditor's role in this stack does not stop at producing a set of financial statements once a year. A lender should plan for vendor SOC examination directly: if a lender relies on outside service organizations, a current SOC 1 Type 2 report from those vendors narrows the scope of the lender's own audit and lowers its cost.

The distinction between compiled, reviewed, and audited statements is not a technical footnote. A firm that understands state-level licensing audits and GSE counterparty financial conditions together, and that has direct experience with HUD Section 232, skilled nursing, and multifamily reporting where relevant, can coordinate a lender's full compliance calendar instead of leaving the lender to manage each obligation as a separate, disconnected engagement. Pease Bell works with mortgage banking clients across this range, audit and assurance, HUD reporting, and SOC examinations, which is the kind of specialized footing that turns a compliance calendar from something managed in a scramble into something managed on purpose.