Appendix D — Federal Law and Regulation Reference

The federal law a loan officer actually operates under, arranged the way it arrives in a working day. For each statute: what it does, what it requires of you at the origination desk, and where in this book it is taught.

⚠️ Read this paragraph before you use anything below. This appendix names statutes and the regulations that implement them. It does not give you current numbers. Almost every threshold in mortgage compliance — HOEPA's high-cost triggers, the Qualified Mortgage points-and-fees cap, HMDA's reporting thresholds, conforming loan limits, the APOR spread that makes a loan higher-priced — is adjusted on a schedule, usually annually. Retention periods and document-age rules vary by program, by regulator, and by investor, and they change. Wherever this appendix gives a period, it says "commonly" — which means go look it up. Verify with your compliance department and the current regulation, agency handbook, or investor guide before you rely on any figure here. And nothing in this appendix is legal advice.

D.1 The five layers, and why practitioners argue about the wrong one

Most compliance arguments on a sales floor are arguments between people standing on different layers of the same stack. Learn the stack and the arguments get shorter.

The practitioner's test: when someone tells you "we can't do that," ask which layer. If the answer is layer 5, there may be an exception process. If the answer is layer 1 or 2, there is not, and you should stop asking. A great deal of a loan officer's credibility comes from knowing the difference and not promising relief that no one can grant (§7, §37).

A sixth layer sits underneath all of it: state law. State licensing, usury caps, high-cost thresholds, prepayment-penalty limits, attorney-closing requirements, notary and witness rules, community-property rules, homestead rules, and dozens of disclosure mandates are state law and they vary enormously. Several states have their own "mini-TILA" or anti-predatory-lending statutes with triggers tighter than HOEPA's. This appendix is federal only. Know your state's rules and know that they change when you cross a line on a map.

D.2 "Which statute governs this?" — the lookup table

The question a loan officer actually asks is almost never "what does RESPA say." It is "is this a RESPA problem or a TILA problem?" — because the answer tells you whom to call and how fast.

Note the last two rows. Two of the most common "compliance" conversations on the floor are not compliance conversations at all. A large-deposit condition and a DTI ceiling are program requirements, layer 4 or 5. Calling them "the law" is how loan officers lose credibility with borrowers who later find a lender that does it differently.

D.3 RESPA — Real Estate Settlement Procedures Act

What it does. RESPA has two unrelated jobs that share a name. The first is disclosure — tell consumers what settlement will cost. Most of that job now lives in TRID (§D.5). The second is market conduct — keep the referral of settlement business from being bought and sold. That second job is the one that ends careers.

Section 8 — kickbacks, unearned fees, and "things of value"

Statute: 12 U.S.C. §2607. Regulation: Reg X §1024.14.

The three words that do the damage are "thing of value." It is not limited to money. Read the regulation's own list and then read it again: the concept reaches lead purchases, marketing services agreements, desk rentals, event sponsorships, discounted or free services, tickets, trips, meals beyond the ordinary, and business referrals in the other direction. A referral is itself a thing of value. The question is never "was there a check." The question is was something of value given, and was it given in exchange for referrals.

What it requires of you as an originator:

• Do not pay for referrals, in cash or in kind, and do not accept payment for them.
• If you buy marketing, buy marketing — services that are actually performed, at a price that is reasonably related to their fair market value, priced without reference to the volume or value of referrals. Agreements that pay per referral, per closed loan, or per "lead delivered from your office" are the ones examiners take apart first.
• Split nothing that was not earned. Section 8(b) reaches fee-splitting and marking up a third-party charge, which is why an originator may not add a margin to an appraisal or credit report fee.
• Assume every arrangement will one day be read aloud by someone hostile. If describing it honestly makes you uncomfortable, that is the answer.

Penalties. The statute provides both criminal and civil exposure — commonly stated as a fine of up to \$10,000 and up to one year of imprisonment, plus liability to the person charged for three times the amount of the charge paid for the settlement service. Treat the number as secondary: the practical penalty is a consent order, a license, and a career. Verify current enforcement exposure with counsel; do not quote figures to a referral partner as if you were the authority. (§24)

Affiliated business arrangements

Statute: definition at 12 U.S.C. §2602(7). Regulation: Reg X §1024.15.

An affiliated business arrangement — a lender that owns or is owned in common with a title agency, an insurance agency, an appraisal management company — is not automatically illegal. It is legal only if it stays inside a narrow safe harbor:

1. A written disclosure of the relationship and an estimate of the charges, given at or before the referral;
2. No required use of the affiliate (with limited exceptions the regulation itself defines); and
3. The only thing received from the affiliate is a return on the ownership interest — not a fee that moves with referral volume.

Where originators get caught: disclosing the affiliation at closing instead of at referral; saying "you have to use our title company" out loud; and sham arrangements where the "affiliate" has no employees, no capital, and no function except to collect a fee. (§24)

Section 9 — the seller may not require a title company

Statute: 12 U.S.C. §2608. Regulation: Reg X §1024.16.

A seller may not require, as a condition of selling the property, that the buyer purchase title insurance from any particular company. The statute makes the seller liable to the buyer for three times all charges made for the title insurance.

⚠️ Section 9 binds the seller, not you. Loan officers confuse this constantly. Your obligation on provider selection comes from TRID: the creditor must give the consumer a written list of providers for the services the consumer is permitted to shop for, and whether the consumer shops — and whether they pick from your list — determines which tolerance bucket the fee falls into (§D.5). A builder or seller conditioning a credit on using an affiliated lender raises RESPA §8 questions, not §9 questions. Three different rules, one conversation. (§24, §21)

Section 10 — escrow accounts and the cushion

Statute: 12 U.S.C. §2609. Regulation: Reg X §1024.17.

On the Linden Street file the initial escrow deposit is \$2,315.00 — five months of tax (\$1,925.00) plus three months of insurance (\$390.00), on a calendar of taxes disbursed in August and insurance in October, with each sub-ledger landing exactly on the two-month cushion. The mechanics, the aggregate adjustment line, and how a negative aggregate adjustment arises are worked in §23.

Where originators get caught: promising a borrower that "escrow is just twelve months of taxes divided by twelve," quoting an escrow deposit before the tax and insurance disbursement dates are known, and treating the escrow deposit as a fee that can be shopped or waived. It is neither — it is the borrower's own money, and the cushion is capped by law.

The rest of Regulation X you should know exists

Servicing is not origination, but you will be asked about it (§39). Know that the duties exist and know to route the borrower to the servicer's written error-resolution address rather than improvising.

D.4 TILA — Truth in Lending Act

What it does. TILA does not cap prices. It is a disclosure statute with a growing substantive core bolted on: tell the consumer the cost of credit in a uniform way so that offers can be compared, and — since Dodd-Frank — do not make certain loans at all.

The four numbers TILA invented

On the Linden Street file: prepaid finance charges \$6,095.34, amount financed \$359,654.66, note rate 6.625%, APR 7.253%. The APR sits 0.628 points above the note rate almost entirely because Regulation Z requires mortgage insurance to be included in the payment stream for as long as it is scheduled to be paid — here, 137 months. Anyone who "checks" the APR against the P&I stream alone gets roughly 6.79% and concludes the book is wrong. It is not. See §22 and Appendix A §A.7.

APR accuracy tolerance. Reg Z §1026.22 provides that a disclosed APR is considered accurate if it is within one-eighth of one percentage point of the actual APR for a regular transaction, and within one-quarter of one percentage point for an irregular transaction. This is a disclosure tolerance, not a pricing tolerance — it does not license sloppy quoting.

Right of rescission — Reg Z §1026.23

• The consumer may rescind until midnight of the third business day following consummation, delivery of the notice of the right to rescind, or delivery of all material disclosures — whichever is last.
• "Business day" here is the precise definition (§D.5): all calendar days except Sundays and the specified federal legal holidays. Saturday counts.
• Each consumer with an ownership interest in the dwelling has the right — including a spouse who is not on the note.
• Two copies of the notice per consumer is the customary practice.
• If the notice or the material disclosures were not delivered, the right can extend for up to three years. That is the exposure that makes rescission worth taking seriously.
• No funds disburse until the period expires.

Where originators get caught: telling a refinance borrower they will "have the money Friday" without counting the rescission period, and forgetting the non-borrowing spouse's signature on the notice (§31).

The substantive core: HOEPA and higher-priced loans

⚠️ Every trigger and every spread in the two rows above is a moving number. The HOEPA thresholds are adjusted annually; the APOR is published and updated frequently; the points-and-fees figures change. Never quote them from memory. Look them up the day you need them, and note that several states impose their own high-cost tests with lower triggers (§24).

High-cost and higher-priced are not the same thing, and neither is subprime. Most lenders simply refuse to originate high-cost loans at all; HPMLs are ordinary and common. Confusing the two in front of a borrower is a tell.

Advertising — Reg Z §1026.24

If an advertisement states a rate, it must state the annual percentage rate. If it states certain trigger terms — the amount or percentage of a down payment, the number of payments or period of repayment, the amount of any payment, or the amount of any finance charge — it must also state the additional required terms. §1026.24 further prohibits a list of specific practices in advertisements for closed-end dwelling-secured credit, including misleading uses of the word "fixed," misleading comparisons to actual or hypothetical rates, and misrepresenting a government endorsement. This sits alongside the MAP Rule (§D.16). (§24, §38)

Recordkeeping — Reg Z §1026.25

Commonly stated: general records for two years; loan originator compensation records for three years; evidence of compliance with the TRID disclosure requirements for three years after consummation; and copies of the Closing Disclosure and related documents for five years. Verify the current periods — and note that your investors' and your state's requirements may be longer, and the longest one governs your file room.

D.5 TRID — the TILA-RESPA Integrated Disclosures

What it did. TRID replaced four forms with two. The Good Faith Estimate and the initial TILA disclosure became the Loan Estimate. The HUD-1 and the final TILA disclosure became the Closing Disclosure. Crucially, it also replaced a disclosure regime with a tolerance regime: what you put on the Loan Estimate is not an estimate in the ordinary sense. It is a commitment with consequences.

The trigger: what counts as an "application"

Reg Z §1026.2(a)(3) defines application for these purposes as six pieces of information:

  1. the consumer's name
  2. the consumer's income
  3. the consumer's Social Security number (to obtain a credit report)
  4. the property address
  5. an estimate of the value of the property
  6. the mortgage loan amount sought

When all six are in your possession, the clock has started — whether or not you meant to take an application, whether or not the borrower called it one, and whether the information arrived by email, by phone, or on a napkin. You may not require additional information as a condition of "application" in order to delay the clock.

⚠️ This is the single most common TRID failure by loan officers, and it is a sales-behavior failure, not a processing failure. A pre-approval conversation collects all six items routinely (§8). If you then "wait to see if they find a house," the Loan Estimate is already late. The defensive habit: know the six, and know which one you are deliberately not collecting.

Related: before the consumer receives the Loan Estimate and indicates intent to proceed, a creditor may not impose any fee other than a bona fide and reasonable credit report fee (§1026.19(e)(2)). Collecting an appraisal deposit at pre-approval is a violation.

The two waiting periods, and the two definitions of "business day"

⚠️ Regulation Z uses the term "business day" in two different ways in the same rule. This is not a trick question on an exam; it is the reason files close on the wrong day.

Worked on the Linden Street file. The Closing Disclosure is issued and received on day 48, a Tuesday. Closing is day 51, a Friday. Wednesday, Thursday, Friday — three business days. The count works because the precise definition counts Saturday, and because nothing in the count fell on a Sunday or a holiday. See §22 and the calendar in §6.

Three redisclosure events that reset or do not reset the CD clock — a change in the APR beyond the accuracy tolerance, a change in the loan product, and the addition of a prepayment penalty require a corrected CD and a new three-business-day waiting period. Other changes require a corrected CD at or before consummation but do not restart the clock. Know which is which before you agree to a fee change on the day of closing (§35).

Tolerances — the part with money attached

Reg Z §1026.19(e)(3) sorts every estimated charge into one of three buckets.

Changed circumstances. A revised Loan Estimate may reset a tolerance baseline when a valid changed circumstance, a consumer-requested change, a rate lock, or one of the other enumerated triggers occurs — delivered commonly within three business days of receiving the information that establishes it (§1026.19(e)(4)). There is also an outer limit: a revised Loan Estimate may not be delivered on or after the date the Closing Disclosure is provided, and must reach the consumer far enough ahead of consummation for the rule's timing to work. A revised LE issued after you already knew is not a changed circumstance. It is a paper trail against you.

Cures. A tolerance violation is cured by refunding the excess to the consumer and delivering a corrected Closing Disclosure — commonly within 60 days of consummation (§1026.19(f)(2)(v)).

Worked on the Linden Street file. The 30-day lock taken on day 12 expired on day 42, three days before the contract's own named closing date — it was short from the moment it was taken. The 15-day extension cost 0.250 point = \$914.38, and the lender paid it. It never touched cash to close. That is the practical shape of a lender absorbing a cost rather than passing it to a borrower who did nothing to cause it. The critique of the undersized lock is §30's; the discipline that prevents it — measure the lock against the contract's closing date, not against your optimism — is §20's.

D.6 Ability-to-Repay and Qualified Mortgage

What it does. Before Dodd-Frank, no federal statute required a lender to determine that a borrower could repay. §1026.43 does. It applies to most closed-end consumer credit transactions secured by a dwelling.

The eight factors. A creditor must make a reasonable and good-faith determination of ability to repay, considering and verifying at minimum:

  1. current or reasonably expected income or assets (other than the value of
     the dwelling securing the loan)
  2. current employment status (if relied on)
  3. the monthly payment on the covered transaction
  4. the monthly payment on any simultaneous loan
  5. the monthly payment for mortgage-related obligations
  6. current debt obligations, alimony, and child support
  7. the monthly debt-to-income ratio or residual income
  8. credit history

⚠️ Factor 1 contains the whole point of Dodd-Frank Title XIV. "Other than the value of the dwelling" is the statute rejecting collateral-based lending — the practice of approving a borrower because the house would cover the loss. Every documentation requirement in Appendix E descends from this sentence.

Qualified Mortgage is a category of loan that carries a presumption of ATR compliance:

Do not tell a borrower "43% is the legal limit." It is not, it never applied to every loan, and it no longer exists as a General QM boundary. See §4 and §26. What still governs a specific file is the agency's and the investor's tolerance, expressed through the automated underwriting system — which is layer 4, not layer 1.

D.7 Loan Originator Compensation — Reg Z §1026.36

This is the rule that governs how you get paid, and it is the rule most likely to be violated by someone acting in good faith.

What "based on a term" reaches, and what it does not.

⚠️ The pricing-concession trap. The instinct to shave your own commission to fix a fee problem is a good instinct and a compliance hazard. The circumstances in which an originator may reduce compensation to cover an increase in a closing cost are narrow and specific. Do not improvise this at the closing table. Route it to compliance, and understand that on Linden Street the \$914.38 lock extension was absorbed by the lender, not carved out of an originator's check.

D.8 ⚠️ Two different definitions of "loan originator" — and they are not the same

This is the single most reliably confused point in mortgage compliance, and it is confused by licensed practitioners as often as by exam candidates. Two federal statutes define a term that sounds identical. They were written for different purposes, they cover different populations, and they are imperfectly overlapping — not nested, not synonymous.

Read the structure of the two tests again. Regulation Z's is a list joined by "or." S.A.F.E.'s is joined by "and." That single conjunction produces the practical result:

• A person can be a Reg Z loan originator — subject to the compensation rule — without meeting the S.A.F.E. two-prong test that would require a license.
• A processor who assists a consumer with an application but never offers or negotiates terms may fall outside S.A.F.E.'s definition while still needing to be watched under Reg Z's — and if that processor starts discussing rate and term with the borrower, the analysis changes for both.

Why the merge is so persistent: Reg Z §1026.36(f) imposes qualification requirements on loan originators that expressly point back to S.A.F.E. Act licensing and registration. So the two regimes really do touch — which is exactly why people conclude they are the same regime. They are not.

The practical rule for a working originator: when you ask "am I a loan originator," always ask "under which statute, and for what consequence." Licensing questions go to the S.A.F.E. Act and your state regulator. Compensation and steering questions go to Regulation Z and your compliance department. See §3 for licensing and §24 for compensation.

D.9 ECOA — Equal Credit Opportunity Act

What it does. ECOA makes it unlawful to discriminate against an applicant with respect to any aspect of a credit transaction on a prohibited basis. Note the breadth of "any aspect": it covers discouragement before an application, the terms offered, the underwriting, and the collection.

The prohibited bases — Reg B §1002.2(z)

  race
  color
  religion
  national origin
  sex  ..............  the CFPB has interpreted this to include sexual
                       orientation and gender identity
  marital status
  age  ..............  provided the applicant has the capacity to contract
  the fact that all or part of the applicant's income derives from any
      public assistance program
  the fact that the applicant has in good faith exercised any right under
      the Consumer Credit Protection Act

Discouragement counts. Reg B §1002.4(b) prohibits a creditor from making any oral or written statement that would discourage on a prohibited basis a reasonable person from making or pursuing an application. This reaches the friendly, well-meant sentence — "honestly, with your situation you might want to keep renting a while" — spoken to one kind of applicant and not another. If you would not say it to every applicant with those numbers, do not say it (§25, §9).

Adverse action — Reg B §1002.9

A counteroffer is not automatically adverse action — but a counteroffer the applicant does not accept, or that expires, generally becomes one. Know your shop's process. Never let a file simply go quiet: withdrawal is not a lawful substitute for a denial, and papering a denial as a borrower withdrawal is a finding waiting to happen (§19).

Notice of incompleteness — Reg B §1002.9(c)

If an application is incomplete regarding information the applicant can provide, the creditor must either send a written notice of incompleteness specifying what is needed and giving a reasonable period to supply it, or take action on the incomplete application. This is the rule that governs the "we're still waiting on the borrower" file. You may not park a file indefinitely because a condition is outstanding.

Spousal signatures — Reg B §1002.7(d)

⚠️ Do not confuse "the spouse must sign the mortgage" with "the spouse must be an applicant." The first can be required by state law; the second is prohibited when the applicant qualifies alone. The distinction is state-specific and it varies enormously. Ask your closing department per state (§25, §31, §35).

Government monitoring information — Reg B §1002.13

For applications for credit primarily for the purchase or refinancing of a dwelling occupied or to be occupied as a principal residence, secured by that dwelling, the creditor must request the applicant's ethnicity, race, sex, marital status, and age. The applicant may decline to provide it. When the application is taken in person (or by other means the rule specifies) and the applicant declines, the rule directs the creditor to note the information on the basis of visual observation or surname.

⚠️ This is one of the few places in federal law where you are told to record an observation about someone's race. It feels wrong the first time. It exists because the alternative — a monitoring dataset with a hole exactly where discrimination would hide — is worse. What you may never do is use that information in the credit decision. Collection is mandated; use is prohibited. See §25.

Appraisal and valuation copies — Reg B §1002.14

For a first-lien loan secured by a dwelling, the creditor must provide the applicant a copy of each appraisal and other written valuation, free of charge, promptly upon completion or commonly three business days before consummation, whichever is earlier — and must disclose the right to receive them commonly within three business days of application. The applicant may waive the timing, not the copy. (§18)

Records — Reg B §1002.12

Commonly stated as 25 months for consumer credit applications and related records. Verify; other rules and your investors will impose longer periods on the same file.

D.10 Fair Housing Act

What it does. The Fair Housing Act prohibits discrimination in the sale, rental, and financing of housing. §3605 specifically reaches residential real estate-related transactions, which includes making and purchasing loans and providing other financial assistance to purchase, construct, improve, repair, or maintain a dwelling.

⚠️ The protected-class list is NOT the same as ECOA's. This matters and it is tested.

Read the table both ways. ECOA does not list familial status or disability. The Fair Housing Act does not list age, marital status, or public-assistance income. A mortgage application is covered by both statutes at once, so in practice the operative list for a loan officer is the union of the two — but you must know which statute you are standing on, because the enforcement agencies, the remedies, and the statutes of limitations differ.

What it requires of you:

• Do not describe neighborhoods, schools, or "who lives there." Answer with data sources, not characterizations, and hand the question back to the real estate professional and public data (§25, §9).
• Do not steer, and do not let a well-meaning attempt at helpfulness become steering.
• Redlining is a marketing offense as much as an underwriting offense. Where you buy leads, which agents you cultivate, which ZIP codes your mailers reach, and which languages your materials exist in are all examinable (§38).
• Reasonable accommodation obligations reach the application process itself.
• Note that maternity or parental leave cases sit at the intersection of familial status, sex, and income documentation — an area with a real enforcement history. Treat temporary-leave income by the guide, uniformly, and document it (§16).

D.11 HMDA — Home Mortgage Disclosure Act

What it does. HMDA requires covered institutions to collect and report data about applications for and originations and purchases of certain dwelling-secured loans, on a Loan/Application Register (LAR). It creates no underwriting rule at all. It creates a record.

Who is covered turns on institution type, asset size, location, and origination volume, and the reporting thresholds have changed more than once — verify the current coverage tests.

What goes on the LAR — a long list including, in outline:

  the applicant's ethnicity, race, sex, and age
  income relied on
  loan amount, loan type, loan purpose, lien status, occupancy
  property location down to the census tract
  action taken and the date
  reasons for denial
  rate spread, HOEPA status
  credit score(s) relied on
  debt-to-income ratio, combined loan-to-value
  total loan costs or total points and fees, origination charges,
      discount points, lender credits, interest rate
  loan term, introductory rate period, non-amortizing features
  the automated underwriting system used and its result
  the universal loan identifier and the originator's NMLS identifier

Who reads it. This is the part loan officers underestimate. A modified version of the LAR is made public. Regulators, journalists, community groups, researchers, plaintiffs' counsel, and your competitors read it.

⚠️ Every file you touch is a row. A pattern that is invisible from your desk — that your denials cluster, that your rate spreads run higher for one group, that your applications stop at the edge of a particular set of census tracts — is visible in aggregate to anyone who downloads the data. A HMDA row is not created by an examiner. It is created by you, at the moment you act on the file (§25).

Filing. Commonly submitted annually by March 1 following the calendar year, with quarterly submissions required of larger filers. Verify. Data quality is examined: a wrong action-taken code or a mis-keyed rate spread is a finding even when nothing discriminatory happened.

D.12 FCRA — Fair Credit Reporting Act

Permissible purpose — 15 U.S.C. §1681b

You may obtain a consumer report only for a permissible purpose. For originators the operative one is a credit transaction involving the consumer — one the consumer has initiated, or for which the consumer has given written instructions.

What this means at the desk:

• You may not pull a borrower "just to see." Not for a friend, not for a family member, not for the referral partner who asks you to check on a prospect, not before the consumer has initiated a transaction. Impermissible pulls are among the most reliably career-ending small acts in this business.
• Keep the authorization in the file (Appendix E §E.2).
• Reissuing or re-pulling in the same transaction is generally fine; using the report for a different purpose is not.

Adverse action and risk-based pricing

⚠️ A denial commonly requires two notices, not one. The ECOA adverse action notice and the FCRA adverse action content are separate legal requirements that are usually satisfied on a single combined form. If your shop's form is combined, fine — but understand that a defect in one half is a violation of a different statute than a defect in the other (§19, §25).

Disputes and furnishers

What this means for a loan officer: a mortgage-file dispute is not a place to be creative. Rapid rescore processes are run by the reporting agencies under their own rules; you do not dispute on the borrower's behalf, and an unresolved dispute flag can itself stop an approval because some AUS results require it cleared (§12).

Prescreening and trigger leads

Consumer reporting agencies may furnish reports for firm offers of credit (15 U.S.C. §1681b(c)) without the consumer's specific authorization. This is the legal basis for trigger leads — the calls a borrower gets within hours of your credit pull. It is lawful. Consumers may opt out. Tell your borrowers at the credit-pull conversation that the calls are coming and that they are not from you. It costs thirty seconds and it saves files (§10, §38).

Two smaller FCRA duties that reach your desk

• The disposal rule under Regulation V requires reasonable measures to protect against unauthorized access when disposing of consumer report information. Shredding is a compliance control, not housekeeping.
• The Red Flags Rule requires an identity-theft prevention program. It was issued under FCRA by the FTC and the federal banking agencies rather than by the CFPB, so find your own regulator's version rather than looking for it in Regulation V.

D.13 GLBA — Gramm-Leach-Bliley Act

What it does. GLBA governs nonpublic personal information — and a mortgage file is one of the densest concentrations of it that exists outside a hospital. Two obligations:

What it requires of you personally. Almost all of a loan officer's GLBA exposure is behavioral:

• Never email an unencrypted document containing a Social Security number, an account number, or a full tax return. Use the portal. The portal is annoying and that is not a reason.
• Do not text screenshots of paystubs. Do not photograph documents on a personal phone.
• Do not work a file on public Wi-Fi without the company's VPN.
• Do not leave a file open on a screen in a coffee shop, and do not discuss a borrower's income in a restaurant.
• Do not use a personal email address for borrower correspondence — it puts data outside every control your company has.
• Wire fraud is a GLBA problem before it is a wire problem. The criminal who redirects a closing wire usually got in through a compromised email account and learned the closing date from a message that should not have existed. Verify wire instructions by calling a number you already had, never a number in the email (§35, §36).
• Report a suspected compromise immediately. Delay is the thing that turns an incident into a breach notification — and breach notification is largely state law, with fifty variations and short clocks.

Pretexting — obtaining customer information by false pretenses — is separately prohibited. If someone calls your office claiming to be the borrower and asking for the file, that is exactly the attack the statute names.

D.14 The S.A.F.E. Act — licensing and registration

What it does. Before 2008 an individual could originate mortgages in one state, be barred, and reappear in the next state under a different employer. The S.A.F.E. Act created a national registry with a unique identifier that follows the individual for life, and it set a federal floor under state licensing. States may — and do — impose more.

The two tracks

⚠️ This asymmetry surprises people and it matters to your career. A bank-registered originator who moves to an independent lender must become licensed — education, test, background, the whole path — and years of experience do not substitute. Plan the move before you make it (§3, §37).

The licensing floor, commonly stated

  20 hours of NMLS-approved pre-licensing education, including
       3 hours federal law and regulations
       3 hours ethics, including fraud, consumer protection, and fair lending
       2 hours nontraditional mortgage lending
     ( the remaining hours are electives or state-specific content )

  the SAFE MLO national test, passed with a score of at least 75%

  8 hours of continuing education annually, of similar composition

  fingerprints and a criminal background check through NMLS
  a credit report and a financial responsibility review
  a surety bond, net worth, or state-set financial requirement
  annual renewal within the state's renewal window

Statutory disqualifiers, commonly stated: a revoked MLO license in any governmental jurisdiction; a felony conviction in the seven years preceding application; and a felony at any time involving fraud, dishonesty, breach of trust, or money laundering.

Verify all of the above with the NMLS resource center and your state regulator — hours, composition, retake rules, renewal deadlines, and state-specific education requirements change, and they differ by state.

What it requires of you daily: display your NMLS ID where the rule requires it — on advertisements and on the loan documents Reg Z §1026.36(g) names — keep your record current within the required window when your address or employment changes, complete continuing education before the renewal crush, and never originate in a state you are not licensed in. Where the borrower and the property are located determines which license you need, not where your desk is.

And re-read §D.8: being a "loan originator" under Regulation Z and a "mortgage loan originator" under the S.A.F.E. Act are two different findings under two different statutes.

D.15 HERA (2008) and Dodd-Frank (2010) — what each created

These two acts are why the modern rulebook looks the way it does. Practitioners routinely credit one with the other's work.

HERA created or did:

• The Federal Housing Finance Agency (FHFA), consolidating GSE oversight and providing the authority under which Fannie Mae and Freddie Mac entered conservatorship weeks later (§28).
• The S.A.F.E. Act (Title V) — national MLO licensing and registration (§3, §D.14).
• FHA modernization, including changes to loan limits and the prohibition on seller-funded down payment assistance — the reason DPA today comes from government and nonprofit sources rather than from the seller (§33, and the Harlow Street file).
• Temporary homebuyer tax relief and refinance programs, most now expired.

Dodd-Frank created or did:

• The Consumer Financial Protection Bureau (Title X), and transferred rulewriting authority for the enumerated consumer financial laws — TILA, RESPA, ECOA, FCRA, HMDA, GLBA privacy, S.A.F.E., HOEPA — from a scattering of agencies to one. This is why Regulation Z, X, B, C, V, P, G, H, N, and O all now sit in 12 C.F.R. Parts 1002–1030.
• Title XIV — the Mortgage Reform and Anti-Predatory Lending Act, which is where nearly everything in this appendix's TILA sections comes from: Ability-to-Repay and QM, the loan originator compensation rule, expanded HOEPA coverage, appraisal independence and the HPML appraisal rules, HPML escrow requirements, the prohibition on mandatory arbitration in dwelling-secured credit, the prohibition on financing single-premium credit insurance, and the mortgage servicing rules.
• TRID — Dodd-Frank directed the integration of the TILA and RESPA disclosures (§D.5).
• UDAAP — the authority to police unfair, deceptive, or abusive acts or practices, 12 U.S.C. §5531 and §5536. "Abusive" was new. It is a standard, not a list, and it reaches conduct that no specific rule names.
• Authority for state attorneys general to enforce certain provisions — which is why a compliance failure can arrive from a state capital as easily as from Washington.

⚠️ UDAAP is the backstop you should think about most and can research least. There is no checklist. The question examiners ask is whether a practice takes unreasonable advantage of a consumer's lack of understanding, or of their reasonable reliance on you to act in their interests. A technically compliant file can still be a UDAAP finding. See §24 and §26.

D.16 The Homeowners Protection Act — PMI cancellation

⚠️ Read the scope line before the rules. The HPA applies to conventional, borrower-paid private mortgage insurance on a single-family principal residence. It does not apply to FHA MIP. It does not apply to VA (there is no monthly insurance) or USDA's annual fee. It does not govern lender-paid MI, which is priced into the rate and does not cancel because there is nothing to cancel. Getting this wrong in front of a borrower creates a promise you cannot keep — five years later, when the borrower calls the servicer, they will remember who told them.

"Original value" is the whole trick. It is the lesser of the sales price or the appraised value at the time of origination — not today's value. A borrower whose home appreciated does not reach 78% of original value any faster.

Worked on the Linden Street file (loan \$365,750.00, original value \$385,000.00):

Total MI paid to termination: \$24,218.86. Contrast the FHA option on the same file, where the LTV exceeded 90% at origination and the annual MIP therefore runs for the life of the loan — \$62,374.40**, a difference of **\$38,155.54 in mortgage insurance. (That is the MI difference, not the total-cost difference; see §13 and Appendix A §A.10 before you quote it.)

Separately, the HPA requires disclosures at consummation and annually about cancellation and termination rights. A borrower may also request cancellation based on current value under investor rules rather than the HPA — Fannie Mae and Freddie Mac have their own value-based cancellation provisions with seasoning requirements and their own appraisal rules. That is layer 4, not the statute. Verify with the current guide (§5, §39).

D.17 SCRA — Servicemembers Civil Relief Act

What it does. The SCRA suspends or modifies certain civil obligations so that servicemembers can devote their full attention to duty. It is not an underwriting rule and it does not require you to make a loan. It governs what happens to obligations a servicemember already has.

The 6% cap requires action by the servicemember: written notice to the creditor with a copy of the military orders, within the period the statute allows. The relief is retroactive to the date military service began. A borrower who does not know to ask does not get it — which is why an originator who works with military families should know the rule exists even though it operates after closing (§17).

Where originators get caught: telling a servicemember that a VA loan "gets 6%," which conflates the SCRA cap on pre-service debt with new loan pricing; and quoting a payoff or a refinance to a deployed borrower without accounting for a rate already reduced under the SCRA.

⚠️ The Military Lending Act is a different statute and generally does NOT cover your loan. The MLA — 10 U.S.C. §987, implemented at 32 C.F.R. Part 232 — caps the Military Annual Percentage Rate at 36% and imposes disclosure and arbitration restrictions on consumer credit to covered borrowers, but it excludes residential mortgages (loans secured by a dwelling, including purchase, refinance, construction, and home equity) and purchase-money vehicle loans. Do not cite the MLA at a mortgage borrower. Do not assume its exclusion means the SCRA also doesn't apply — the SCRA does. Two statutes, two scopes.

D.18 Bank Secrecy Act — AML and Suspicious Activity Reports

What it does. Since FinCEN's rule bringing non-bank RMLOs into the regime, an independent mortgage company is a "financial institution" for Bank Secrecy Act purposes. It must maintain an anti-money-laundering program and file Suspicious Activity Reports.

The AML program's pillars, commonly stated:

  1. written policies, procedures, and internal controls
  2. a designated compliance officer
  3. ongoing training for appropriate personnel
  4. independent testing of the program
     ( depository institutions carry an additional customer due diligence
       pillar that generally does not apply to RMLOs — verify your own
       institution's obligations )

Suspicious Activity Reports.

⚠️ Confidentiality is absolute, and this is the rule most likely to be broken by a helpful loan officer. It is unlawful to disclose the existence of a SAR — to the borrower, to the real estate agent, to the borrower's attorney, on a phone call, in a text, or by hinting. You may not tell a borrower that their file was reported. You may not tell them it was not. If asked, say you cannot discuss it and route the call. "Tipping off" is a federal offense, not a policy violation.

What actually triggers SAR consideration in an origination shop — the things a loan officer is positioned to see first:

• Documents that appear altered — fonts that change mid-page, arithmetic that does not foot, a W-2 whose employer identification number does not match the paystub.
• A borrower who is indifferent to rate, terms, and cost — the classic tell that closing is the point, not financing.
• Funds arriving from sources the borrower cannot or will not explain, or from third parties with no relationship to the transaction.
• Straw-buyer patterns: an occupant who is not an applicant, an applicant who has never seen the property, an "investor" arranging everything.
• Structuring — deposits deliberately kept below reporting thresholds.
• Sudden, unexplained changes in the transaction's shape late in the file.

⚠️ Do not confuse a large-deposit condition with a SAR. A large deposit that the borrower sources with a paystub and a commission statement is an underwriting condition under an agency guide (§14, and Appendix E §E.12). It becomes a BSA matter only if it stops making sense. On the Linden Street file, the \$4,900 deposit sourced on day 33 was ordinary compensation — the net of a \$6,900 gross quarterly commission after \$2,000 of withholding — documented and closed. That is a condition being cleared, not a suspicion being formed. Knowing the difference is what keeps you from either under-reporting or over-reporting, and both are failures.

Related and moving: FinCEN has used Geographic Targeting Orders requiring title companies to report the beneficial owners behind certain all-cash residential purchases in named jurisdictions, and has expanded reporting obligations around non-financed residential transfers. Both areas have changed repeatedly. Verify the current scope and effective dates.

D.19 The MAP Rule / Regulation N — advertising you cannot run

What it does. Regulation N prohibits any material misrepresentation, expressly or by implication, in any commercial communication regarding any term of any mortgage credit product. "Commercial communication" is broad: it reaches your website, your social media posts, your mailers, your open-house flyers, your email signature, your video, and the text you send a referral partner to forward.

The regulation lists specific subjects on which misrepresentation is prohibited (§1014.3), including the interest rate, the APR, the existence and amount of fees, the amount of the payment, whether payments are fixed, the type of product, the existence of a prepayment penalty, the amount of cash or credit available, the source of the communication, the existence of any government endorsement or affiliation, and the terms of any counseling service.

The practitioner translation — advertising failures that actually happen:

Records. Reg N requires retention of copies of materially different commercial communications, sales scripts, training materials, and marketing materials — commonly 24 months. Verify.

⚠️ The rule applies to you personally, not only to your marketing department. A loan officer's own social media post is a commercial communication. Get advertising approved before it runs, keep the approval, and keep the copy. "I only posted it on my personal page" has never worked (§38).

D.20 Appraiser independence

What it prohibits. Coercion, extortion, inducement, bribery, intimidation, compensation, or instruction of a person preparing a valuation for the purpose of causing the value to be based on any factor other than the appraiser's independent judgment. It also prohibits mischaracterizing the value, and prohibits a person with an interest in the transaction from materially influencing the valuation.

What is permitted — and originators regularly believe none of this is:

  YOU MAY ask an appraiser to consider additional information about the
     property or about comparable properties
  YOU MAY ask an appraiser to correct factual errors
  YOU MAY request further detail, substantiation, or explanation of the
     conclusion
  YOU MAY obtain multiple valuations to select the most reliable, subject
     to the rule's conditions
  YOU MAY withhold payment for a valuation that is substandard or breaches
     contract

  YOU MAY NOT communicate a "value needed to make the deal work"
  YOU MAY NOT condition the appraiser's compensation or future assignments
     on reaching a value
  YOU MAY NOT select or remove an appraiser because of the values they return

The line is the purpose, not the phone call. Sending comparable sales the appraiser did not have is legitimate reconsideration of value. Sending them with "we need \$540,000 to close this" is coercion. On the Cypress Court file the appraisal returned \$505,000** against a \$540,000 contract — \$35,000 low, 6.48%** under — and the correct path was a documented reconsideration of value and a renegotiation, not a call to the appraiser (§18, §20, §21).

Two more duties:

• Customary and reasonable compensation for fee appraisers is required by the statute.
• Mandatory reporting: a person who reasonably believes an appraiser has materially failed to comply with USPAP, with applicable law, or has otherwise engaged in unethical or unprofessional conduct that materially affects the valuation must refer the matter to the applicable state appraiser board. That obligation runs the other way from the one originators expect.

D.21 Flood insurance — the requirement nobody teaches until it bites

• A flood determination must be made using the Standard Flood Hazard Determination Form for loans secured by improved real estate.
• If the improved property is in a Special Flood Hazard Area in a participating community, flood insurance is mandatory for a federally regulated lender, in an amount set by the rule.
• The borrower must receive notice of the hazard area and of the requirement, commonly a reasonable period — often stated as 10 days — before closing. Verify.
• Escrow of flood premiums is generally required for loans made, increased, extended, or renewed after a statutory date, with exceptions for small lenders and certain loan types. Verify.
• Determinations are commonly purchased with life-of-loan tracking, because maps are redrawn and a property can enter a hazard area after closing.
• Private flood insurance must be accepted when it meets the statutory and regulatory criteria.

On the Linden Street file the flood determination returned outside the special flood hazard area — which is why the frozen PITI of \$3,033.72 carries no flood premium. Had it come back inside, the payment would have changed, the ratios would have moved, and the disclosure would have had to be redone (§18, §23).

D.22 Adjacent rules that reach a loan officer's day

D.23 Who examines you

The examination you should expect is not a raid. It is a request for a file sample, a review of your advertising, a look at your compensation plan, an interview about your process, and a comparison of your outcomes across groups. Everything in this appendix is examined through the files you built. That is why Appendix E exists.

D.24 Retention — a table you must verify before you use

⚠️ Retention periods vary by rule, by regulator, by state, and by investor, and they change. The longest applicable period governs the file. The figures below are the periods commonly stated for the federal rules named. Confirm every one with your compliance department before relying on it, and remember that your investor's requirement and your state's licensing requirement will often be longer than anything here.

D.25 The Linden Street file, read as a compliance record

The same 51 days that produced a closed loan produced a compliance file. Here is where the law touched it.

Note what is missing from that table: a rescission period. Linden Street is a purchase, so Reg Z §1026.23 does not apply and the loan funds at closing. Run the same file as a refinance and day 51 becomes day 51 plus three business days (§31).

D.26 Five sentences worth memorizing

1. A referral is a thing of value — RESPA §8 does not require a check to change hands.
2. The six items are an application — and the Loan Estimate clock starts whether you meant it to or not.
3. "Business day" means two different things in the same regulation — and the CD count uses the one that includes Saturday.
4. Regulation Z's "loan originator" and the S.A.F.E. Act's "mortgage loan originator" are different definitions in different statutes for different purposes — always ask which one, and for what consequence.
5. When someone says "we can't," ask which layer — statute, regulation, agency guide, or overlay. Only the last one has an exception process.

Cross-references: §2 (the regulatory architecture) · §3 (licensing) · §4–§5 (the arithmetic and the programs) · §10 (credit) · §14–§16 (documentation and underwriting) · §17 (VA and military lending) · §18 (appraisal) · §19 (conditions and adverse action) · §22 (disclosure) · §23 (escrow) · §24 (compliance) · §25 (fair lending) · §26 (ability to repay) · §27 (fraud and AML) · §35 (closing) · §36 (data security) · §38 (marketing) · Appendix A (formulas) · Appendix E (documentation checklists).