Category Archives: Regulatory Updates

Regulatory Updates

Adverse Action Notices: What the CFPB Will Actually Examine Now

Thursday, 9:40 a.m. A fair lending review pulls thirty declined applications from last month. Every adverse action notice is on time. Every reason is specific. Every disclosure is signed. On file 19, the notice lists two reasons — and neither one is why the file was declined. The loan officer’s notes say something else entirely.

Nobody approved that step. Nobody owns it. The reason codes on those adverse action notices are not in the QC checklist, the mapping from policy screen to decline reason is not in the exception log, and nobody has reconciled a reason to what drove the decision since the models changed.

This is the least dramatic version of what just happened to mortgage compliance.

What the CFPB Published on October 1


On October 1, 2026, the CFPB released its Fair Lending Report for 2025 to Congress. The enforcement numbers look like a retreat. The Bureau closed 76% of its supervisory actions — nearly 1,500 matters — roughly 12% of them fair-lending related. It initiated no new fair lending supervisory activity, cited no institution for a fair lending violation, and made no ECOA referrals to the Department of Justice. Across the eleven agencies with ECOA enforcement authority, 140 institutions were cited for ECOA or Regulation B violations, and no public ECOA enforcement action was brought in 2025.

Here is the part that should change your review schedule. The same report says ECOA examination work now focuses on three things: direct evidence of intentional discrimination on a prohibited basis, systemic failures to provide applicants with legally required notices of adverse actions, and the systems a lender uses to identify ECOA and Regulation B risk. HMDA exam work focuses on validating the accuracy of key data points.

Read that list again. Two of the three ECOA exam priorities are about the file in front of you, not the portfolio behind you. The statistical screen you scaled back in July is not what a 2026 exam is testing. The notice is.

Then on October 14, the OCC released Guaranteeing Fair Banking for All Americans, its review of debanking practices at the nine largest national banks it supervises — JPMorgan Chase, Bank of America, Citibank, Wells Fargo, U.S. Bank, Capital One, PNC, TD and BMO. The review covered September 2020 through September 2025, drawing on nearly 100,000 complaints and about 50,000 documents totaling roughly 420,000 pages. The OCC found broad reputation risk policies lacking clear standards and objective, risk-based criteria, plus industry-specific restrictions on oil and gas, coal, firearms, detention facilities, tobacco and digital assets.

Be precise about what that report does and does not say. It identifies no violation of law and announces no enforcement action. It did remove reputation risk from the OCC’s own supervisory framework, issue Bulletin 2025-22 allowing debanking to be considered in licensing and CRA exams, and signal further rulemaking. Hours later, the CFPB announced it will fully investigate whether the institutions in the report and others complied with federal consumer financial laws — naming ECOA, FCRA “particularly the adverse action notice requirements,” and UDAAP.

Four Risks That Replaced the Statistical Screen


Stripped down, a fair lending file is one of four things, and they are nowhere near equal in risk. The tiers are our suggested placements for your own scoring — no examiner grades declination files for you, so treat them as a starting position, not an official classification.

The inaccurate reason. The notice is timely, specific, and still wrong, because the reason the borrower was given is not the reason the file was decided. The CFPB has named systemic failures in adverse action notices as an exam priority, so a notice that cannot be tied to the decision is a finding waiting for a file. Our suggested tier: High.

The reputation-risk screen. A decline that passed through a policy screen — an industry, a brand, an ESG or reputation review, a manual escalation — and left no trace on the notice, because the screen is not a “credit reason.” The risk is what the OCC documented: criteria broad enough to apply inconsistently, and outcomes nobody can reconstruct later. Our suggested tier: High.

The stale notice regime. Templates, timing and disclosures that were correct in 2024 and have not been re-read since. Section 1002.9 was not amended by the April rule, so the 30-day notice requirement and the specific-reasons standard still apply exactly as they did. The risk is that the file reads like a rulebook from a year ago. Our suggested tier: Moderate.

The data that does not reconcile. HMDA data points that do not tie back to the source document, or a reason code in the loan system but not on the notice. The exam focus the CFPB named for HMDA is the accuracy of the key data points. Our suggested tier: Moderate.

The line worth memorizing: a statistical test tells you what your portfolio looks like. An adverse action notice tells the examiner what your lender did to one applicant.

What the Rules Actually Say Now


Last verified against primary sources October 21, 2026. This is a moving target — state law changes and the regulators are still writing. Re-verify before you rely on any of it.

What the April rule changed, and what it did not


Start with what did not change, because the volume of material saying otherwise is the problem. The CFPB’s final rule amending Regulation B was published April 22, 2026 and took effect July 21, 2026 (91 FR 21620, Docket No. CFPB-2025-0039). It removed the effects test and states ECOA does not authorize disparate impact liability. It did not amend 12 CFR 1002.9: the duty to give the specific principal reasons for adverse action within 30 days of a completed application is untouched, as is FCRA’s adverse action requirement and the credit score key factor disclosure. Disparate treatment survives in full under ECOA.

And the rule amended Regulation B only. Disparate impact remains available under the Fair Housing Act, which the CFPB cannot amend, under HUD’s FHA disparate impact standard, whose rulemaking is still open, and under state regimes — New Jersey, New York, and Illinois from January 1, 2027 — plus private litigation. We covered that in why state fair lending rules now drive your testing and in what the ECOA rule eliminated and what lenders must fix in fair lending QC. The short version has not changed.

The scope of what the CFPB can actually reach


One scope point, and it matters. ECOA reaches credit, not deposit accounts, and does not list political beliefs as a prohibited basis. The OCC placed state-law compliance outside its scope. So the live theories are the three the CFPB named: ECOA, FCRA — especially the adverse action notice requirements — and UDAAP. Debanking is the context. The document you can be held to is the notice.

Watch three things. HUD’s FHA disparate impact rulemaking. State adoption of new testing expectations, and the multi-state letter opposing the federal rule. And further OCC rulemaking on reputation risk and pretextual account terminations.

The risk nobody has absorbed


The risk most operators have not absorbed is the mapping. The CFPB now describes an exam that looks for a lender’s systems for identifying ECOA risk and for systemic failures in adverse action notices. Accurate reasons with no evidence that the reasons came from the decision is half of what that exam needs. The Massachusetts Attorney General’s 2025 Earnest settlement is the most detailed published template of what a state regulator expects: interpretable models, every decline reason validated, principal reasons stated specifically and accurately. It binds one lender, not you — but it is a template you can be examined against.

The Numbers Vendors Want You to Believe


Before the controls, a word about the arithmetic, because these numbers will reach a board deck whether you are ready or not. The headline number in fair lending software right now is relief: disparate impact testing is no longer a federal requirement, the effects test is gone, and the statistical review that ate a quarter of your compliance calendar can be scaled back. For ECOA that is largely true, and we wrote about it.

The second number is certainty, and that is where the risk is. Some vendors still sell disparate impact testing as the requirement it no longer is. Some sell “compliant with the 2026 Reg B” as if the April rule resolved fair lending exposure. Others quote guidance the CFPB has withdrawn — 67 documents, seven fair-lending related, in May 2026 — while vendor pages kept citing a “CFPB Circular 2026-03” that does not exist.

  • Which regime are you actually answering to? A vendor’s “compliant” claim is a claim about ECOA. Your book is also covered by the Fair Housing Act, HUD’s FHA standard, and the state regimes where you operate. Ask which regimes it maps to.
  • What is the denominator? Coverage of a statistical test is not coverage of the notice. A product that scans your portfolio and reports a pass has not tested one declination notice.
  • What is the measurement window? Ask when the vendor last reviewed its regulatory content against the April 22 rule and the July 21 effective date. Where guidance is withdrawn quarterly, content with a 2024 review date is a liability.

Keep the ROI column separate from the evidence column. A lender with both a credible efficiency claim and a defensible file walks into a review with an answer. A lender with only the first one is negotiating one.

Six Controls to Put Around Your Adverse Action Process


None of this requires a data scientist. All of it is something an examiner can ask for on the record.

  1. Test the notice against the file, not the template. Pull the notice and the credit file together. Confirm the reasons on the notice are reasons that appear in the file, and that nothing else drove the outcome.
  2. Map every decline reason to what actually drove the decision. If a model or a policy screen is in the path, document the mapping and validate it the way the Massachusetts settlement describes: interpretable models, every reason validated, no reason invented to fill a menu.
  3. Inventory every screen that can end a file. Reputation risk, brand, ESG, industry, manual escalation. For each, write down the objective criteria, who applies it, and where it shows up in the file. A screen that can decline a file and never appears on the notice is the gap the OCC documented.
  4. Stop letting reason codes be a dropdown. The Earnest assurance alleged that staff picked an available reason when the real one was not on the menu, and that auto-generated reasons sometimes produced nothing specific. Both are cheap to prevent, expensive to catch.
  5. Reconcile your HMDA data points to source. The exam focus is accuracy. Sample the fields, trace them to source, and fix the definition, not the file.
  6. Date and version your fair lending policy. Record what changed, when, on whose authority, and re-verify the citations before each exam cycle. A 2024 review date is a finding waiting to happen.


Where to Start on Monday


You do not need a program. You need a week. Pull thirty declination files closed in the last 90 days. For each, produce the notice, the credit file, the reason-code mapping, the source of the decision, the policy behind any screen, and the HMDA data points. Any gap you find now is a roadmap. The same gap, found by an examiner, is a finding — and if you would rather someone else pull the sample, our fair lending compliance assessment runs that review.

Adverse action notices are the cheapest artifact in a mortgage file and the most expensive one to get wrong. The CFPB has told you what it is looking at. Now it is whether your file can answer it.

Compliance guidance for discussion, not legal advice. Requirements vary by lender, product, and state, and state adoption is still moving. Consult counsel on your facts.

Synergy supports mortgage banks and credit unions that have to answer for fair lending in a file, not a slide deck — adverse action notice review, declination file testing, and policy work that holds up on the record. Book a 30-minute call and we will send our one-page declination review checklist for last quarter’s files.

Regulatory Updates

Disparate Impact Isn’t Dead: Why State Fair Lending Rules Now Drive Your Testing

On September 3, 2026, the Mortgage Bankers Association sued New Jersey in federal court to block the state’s disparate impact rules, and the lawsuit captures the fair lending problem lenders face going into 2027. Federal agencies have spent the past year dismantling disparate impact as an enforcement theory. Some states are moving the opposite direction and writing it into regulation. State disparate impact rules now create real liability even where federal exposure has narrowed, and any lender that scales back statistical fair lending testing on the strength of federal headlines alone is taking a risk it may not be able to see.

Here is the current landscape and how to calibrate your program.

The Federal Retreat, in Five Steps

The federal shift has been broad and fast:

  1. DOJ. On December 9, 2025, the Department of Justice published a final rule rescinding the disparate impact provisions of its Title VI regulations.
  2. HUD. On January 14, 2026, HUD proposed to remove its Fair Housing Act discriminatory effects regulation at 24 CFR 100.500 entirely, leaving disparate impact questions to the courts. Comments closed February 13, 2026 (verify whether a final rule has issued).
  3. CFPB. The CFPB’s amended Regulation B, issued April 22, 2026 and effective July 21, 2026, removed disparate impact liability from its ECOA framework, narrowed the discouragement standard, and restricted for-profit Special Purpose Credit Programs.
  4. CFPB, again. In June 2026, the CFPB rescinded its December 2020 advisory opinion on Special Purpose Credit Programs as inconsistent with the amended Regulation B.
  5. FTC. In August 2026, the FTC announced it was abandoning disparate impact and unfair discrimination theories in its consumer protection work (verify scope before relying on it).

The direction is clear. But three facts limit how far it reaches.

The Fair Housing Act has not changed

Removing a regulation does not amend a statute. In Texas Department of Housing and Community Affairs v. Inclusive Communities Project (2015), the Supreme Court held that disparate impact claims are cognizable under the Fair Housing Act, subject to safeguards. HUD’s proposal itself says it is leaving interpretation to the courts, not eliminating the theory. Private plaintiffs and fair housing organizations can still bring FHA disparate impact claims, and residential mortgage lending sits squarely within the FHA.

The amended Regulation B is being challenged

Advocacy groups and private companies filed suit in mid-2026 challenging the revised ECOA rule, including the Special Purpose Credit Program provisions. A court ruling could change the federal baseline again.

Policy can reverse

Disparate impact policy has flipped with nearly every administration since 2013. A program built only to today’s federal posture may need to be rebuilt in a few years. Testing infrastructure that is cheap to maintain is far easier to keep than to rebuild.

New Jersey: The Clearest Example of State Disparate Impact Rules

In December 2025, the New Jersey Division on Civil Rights adopted rules codifying disparate impact discrimination under the New Jersey Law Against Discrimination. The rules cover employment, housing, places of public accommodation, contracting, and housing financial assistance, which includes mortgage lending. The state’s press release was explicit that federal rollbacks do not change state law standards.

According to the MBA’s complaint, filed in the U.S. District Court for the District of New Jersey, the rules:

  • Treat a facially neutral practice as a violation if it actually or predictably results in a disproportionately negative effect on a protected class, even if the effect is not substantial or statistically significant, and even before the practice is implemented.
  • Allow a challenger to establish disparate impact using national, state, and local statistics, census data, and survey data, rather than requiring a disparity among the lender’s own applicants.
  • Place the burden on the lender, in housing and housing financial assistance, to prove there is no less discriminatory alternative that would serve its legitimate interest. In effect, the lender must prove a negative.

The MBA argues the rules lack the safeguards Inclusive Communities requires, violate the Equal Protection Clause, and are preempted by the FHA and ECOA. It seeks declaratory relief and a permanent injunction, or alternatively invalidation of the housing and housing financial assistance provisions.

The complaint also makes a point every multistate lender should note: compliance may require New Jersey-specific underwriting, pricing, and servicing policies that differ from what the lender uses elsewhere. That is the operational cost of a fragmented fair lending map.

Until a court rules, New Jersey’s rules are in effect. Lenders originating or servicing loans on New Jersey properties should treat them as binding.

What This Means for Your Fair Lending Program

The federal retreat changes your risk weighting. It does not remove the need for evidence. Here is a practical calibration.

Keep statistical testing, and segment it by state

If you lend in New Jersey or any state with an active civil rights enforcement posture, run your pricing, underwriting, and exception analyses at the state level, not only in aggregate. A disparity that disappears in a national dataset can be obvious in a single state. Maintain regression-based pricing analysis that controls for legitimate credit and loan characteristics, and keep the methodology documented so it can be reproduced.

Document business justification before you need it

Under New Jersey’s framework, a lender may have to show that a challenged practice is necessary to achieve a substantial, legitimate, nondiscriminatory interest. Write that justification down for your credit overlays, minimum loan amounts, pricing adjustments, compensation plans, and marketing footprint now. Contemporaneous documentation is far more persuasive than an explanation assembled after a complaint arrives.

Build a less discriminatory alternative review into change management

When you add or change an overlay, a pricing grid, or a model, record the alternatives you considered and why you chose the one you did. That habit directly addresses the burden New Jersey’s rules place on lenders, and it is good model governance regardless of jurisdiction.

Watch discretion closely

Pricing exceptions, fee waivers, and underwriting exceptions are where disparities most often arise because they rely on individual judgment. Require documented reasons for each exception, review them monthly, and test them by protected class where data allows. This is often the highest-value fair lending control a lender can run.

Keep intentional discrimination controls sharp

The amended Regulation B still prohibits disparate treatment. Redlining analysis, marketing reviews, comparative file reviews, and complaint monitoring remain core expectations under every federal and state framework.

Extend testing to models and vendors

If a vendor’s model or automated tool influences underwriting, pricing, or marketing decisions, its outputs belong in your fair lending analysis. Ask vendors what variables their tools use, whether they have tested for disparities, and whether they can support a less discriminatory alternative review. A disparity created by a vendor’s model is still your disparity under the Fair Housing Act and under New Jersey’s rules.

Track the litigation calendar

Two cases matter most: the MBA’s challenge to New Jersey’s rules, and the challenge to the amended Regulation B. Either could change your obligations quickly. Assign someone to monitor both and brief your compliance committee when rulings issue.

A Right-Sized Approach

Fair lending programs built during the 2021 to 2024 enforcement peak may be larger than today’s federal environment requires, and trimming low-value work is reasonable. The mistake is cutting the analytics that let you see your own disparities. Those analyses protect you in state examinations, private litigation, and the next federal policy shift. They also tell you whether your own practices are fair, which is the point.

Our fair lending compliance assessment is designed to right-size testing to your footprint, including state-level segmentation for jurisdictions like New Jersey. For the federal background, see HUD’s proposed rule on its disparate impact standard in the Federal Register.

Frequently Asked Questions

If the CFPB removed disparate impact from Regulation B, can we stop disparate impact testing?

Not safely. The Fair Housing Act still supports disparate impact claims under Inclusive Communities, private plaintiffs can still sue, and states such as New Jersey have codified disparate impact under their own laws. Reduce scope thoughtfully if warranted, but keep the statistical testing that shows you where disparities exist.

Do New Jersey’s disparate impact rules apply to out-of-state lenders?

The rules apply to housing financial assistance covered by the New Jersey Law Against Discrimination, which generally reaches lending on New Jersey properties and to New Jersey consumers. Confirm your specific exposure with counsel, but any lender with meaningful New Jersey volume should assume the rules apply while the MBA lawsuit is pending.

What is the “less discriminatory alternative” burden?

Under New Jersey’s rules, once a lender shows a challenged practice serves a substantial, legitimate, nondiscriminatory interest, the lender must also show there is no less discriminatory way to achieve that interest. Documenting the alternatives you considered when adopting a policy is the most practical way to prepare.

Has HUD finalized the removal of its disparate impact rule?

HUD proposed removing its discriminatory effects regulation on January 14, 2026, with comments due February 13, 2026. Verify whether a final rule has issued before relying on it. Either way, the Fair Housing Act itself and the Supreme Court’s Inclusive Communities decision still stand.

Want an outside view of whether your fair lending testing fits your actual risk, state by state? Synergy helps mortgage lenders and credit unions calibrate fair lending programs. Book a 30-minute call to start the conversation.

Regulatory Updates

Mortgage AI Governance: Fannie, Freddie, and State Examiners Now Expect a Program

Mortgage AI governance stopped being a best practice in 2026 and became a condition of doing business. Freddie Mac’s AI requirements took effect March 3, Fannie Mae’s took effect August 6, and on September 16 the Conference of State Bank Supervisors gave state examiners a structured framework for asking how you use AI. Two weeks later, a joint survey from state mortgage regulators and the Mortgage Bankers Association showed where the industry is weakest: most lenders have an AI policy, but far fewer actually monitor their AI tools once they go live.

If your institution uses AI anywhere in origination, servicing, or quality control, including inside a vendor’s platform, you now answer to three layers of oversight. Here is what each one requires and how to close the gaps before someone asks.

Layer One: The GSE Requirements Are Already in Force

Freddie Mac Guide Section 1302.8

Freddie Mac moved first. Section 1302.8 of the Seller/Servicer Guide, added through Bulletin 2025-16 and effective March 3, 2026, requires Seller/Servicers that use AI or machine learning to maintain documented governance, establish executive accountability, implement risk management practices, and provide information about their AI safeguards when Freddie Mac requests it.

Fannie Mae Lender Letter LL-2026-04

Fannie Mae published Lender Letter LL-2026-04, Governance framework on use of artificial intelligence and machine learning, on April 8, 2026, with an effective date of August 6, 2026. If you use AI/ML in connection with loans sold to or guaranteed by Fannie Mae, or loans you service for Fannie Mae, you must:

  • Maintain written policies and procedures covering the AI/ML life cycle that reflect an understanding of applicable legal and regulatory requirements and sound risk management.
  • Comply with the Fannie Mae Information Security and Business Resiliency Supplement.
  • Manage the risks of subcontractor and vendor AI/ML use with governance that is no less protective than your own requirements.
  • Promptly disclose, on request, the types of AI/ML you use, the purpose and manner of use, the safeguards you have implemented, and anything else Fannie Mae requires.

Two points deserve emphasis. First, neither GSE requires you to adopt AI. The requirements apply only if you use it. Second, “use” is broader than most lenders assume. An automated document classification engine, an income calculation tool, a chatbot answering borrower questions, a servicing call-summary tool, or a QC platform that flags defects with machine learning all count. If you are approved by both GSEs, you must satisfy both sets of requirements, and they are not identical (verify current text of each).

The enforcement mechanism is familiar: a loan that does not meet Guide requirements is a repurchase risk.

Layer Two: State Examiners Now Have an AI Playbook

On September 16, 2026, CSBS released its Artificial Intelligence Supervisory Framework for state financial examiners. It has four parts:

  • Core Examiner Guide: scoping questions, a document request list, and procedures covering AI governance and oversight, AI inventories and use cases, and generative AI and other emerging uses.
  • Examiner Work Program: detailed guidance for applying the core guide.
  • Nonbank AI Supplements: focused on third-party and vendor risk, model risk, and consumer protection.
  • AI Use Case Risk Tiering Worksheet: an optional tool for assessing individual AI applications and deciding whether deeper review is warranted.

CSBS describes the framework as a discretionary supervisory tool, not a new set of legal requirements, and each state agency will decide how much of it to adopt. Do not read that as permission to wait. State mortgage regulators, through the American Association of Residential Mortgage Regulators (AARMR), are evaluating it for the nonbank mortgage industry, and multistate exam tools tend to spread quickly once adopted. The document request list is effectively a preview of what you will be asked to produce.

There is also a federal gap the framework fills. The banking agencies’ 2026 revisions to model risk management guidance expressly exclude generative and agentic AI, so for many institutions the CSBS framework is the most specific supervisory roadmap available.

Layer Three: The Industry’s Own Report Card

On September 28, 2026, AARMR, the MBA, and Boston Consulting Group released The State of AI Among Mortgage Lenders and Servicers. The respondents were roughly 30 lenders and servicers representing about 40% of the market. Key findings:

  • 87% have written AI policies or standards, but only 58% reported ongoing monitoring for issues such as accuracy and model drift.
  • Among smaller lenders, only about 40% reported ongoing monitoring, compared with about 80% of larger lenders.
  • 59% named regulatory and compliance uncertainty as their biggest barrier to scaling AI, ahead of unclear return on investment (45%) and data quality (24%).
  • Only about a quarter had scaled at least one AI use case, and adoption is concentrated in productivity and document-processing work.

Read those numbers as an examiner would. The weakest point in mortgage AI governance is not the policy. It is what happens after deployment. Examiners and GSE reviewers will ask to see evidence of monitoring, not just a policy that promises it.

Building a Mortgage AI Governance Program That Holds Up

You do not need a large data science team to meet these expectations. You need a disciplined program with six components.

1. An AI inventory you can produce on demand

List every AI or machine-learning use case, internal or vendor-supplied. For each one, capture the business function, the owner, the vendor (if any), what data it consumes, whether it touches nonpublic personal information, what decision or output it influences, and whether a human reviews the output before it affects a borrower. Both GSEs and the CSBS framework start here. If you cannot produce the list in a day, that is your first finding.

2. Risk tiering

Not every use case deserves the same scrutiny. A tool that summarizes internal policy documents is low risk. A tool that calculates qualifying income, influences pricing, decides which files get escalated, or drafts adverse action language is high risk because it can affect credit decisions, fair lending outcomes, or required disclosures. The CSBS risk tiering worksheet is a reasonable starting template. Document the tier and the reasoning.

3. Accountability at the executive level

Name an accountable executive and a governance forum that approves new use cases, reviews tier assignments, and receives monitoring results. Record it in board or committee minutes. “IT handles it” will not satisfy Freddie Mac’s executive accountability expectation.

4. Vendor oversight that is “no less protective”

This is where most lenders are exposed, because most mortgage AI arrives inside vendor products. Update vendor due diligence questionnaires to ask whether the product uses AI/ML, for what, how it is tested and monitored, what data trains it, where that data is processed, and how errors are reported. Add contract language requiring notice before material model changes and cooperation with GSE or regulator information requests. Fannie Mae’s “no less protective” standard means a vendor’s AI is your AI for governance purposes.

5. Post-deployment monitoring

This is the gap the survey exposed. For each high-tier use case, define what accuracy means, how often you test it, and what threshold triggers escalation. For document extraction and income calculation tools, the cleanest control is QC sampling: compare AI outputs to human-verified results on a defined sample each month and trend the error rate. Your existing QC function is already built for this kind of testing. Use it.

6. Records

Keep the inventory, tiering decisions, approvals, vendor assessments, monitoring results, and incident logs in one place. Both GSEs can request this information, and CSBS’s document request list assumes it exists.

The Fair Lending and Disclosure Overlay

AI governance is not a separate silo. Any tool that influences underwriting, pricing, or adverse action still has to work within ECOA and Regulation B, including the requirement to give specific principal reasons for adverse action. If a model contributes to a denial, you must still be able to explain the reasons in terms the borrower can understand. State laws are moving too. Colorado’s Department of Law published draft automated decision-making technology rules on August 11, 2026, with a public hearing scheduled for October 26 (verify current status). Build your program so it can absorb state requirements without a rebuild.

Where to Start This Quarter

If you are behind, sequence the work: inventory first, tiering second, vendor questionnaires third, monitoring for your top three high-tier use cases fourth. That order gives you something defensible to show within 60 days. Our compliance services team can help you build the inventory and design QC-based monitoring that fits your existing review cycle.

Frequently Asked Questions

Do the GSE AI requirements apply if we only use AI through vendors?

Yes. Fannie Mae requires you to manage vendor and subcontractor AI/ML risk with governance no less protective than its requirements, and Freddie Mac’s Section 1302.8 applies to your use of AI or machine learning regardless of who built it. If a vendor’s tool touches loans you sell to or service for the GSEs, it belongs in your inventory and your oversight program.

Is the CSBS AI Supervisory Framework binding?

No. CSBS calls it a discretionary supervisory tool, and each state decides how to incorporate it. In practice, it tells you what state examiners are likely to ask for, so treat its document request list as an exam-readiness checklist.

What is the most common gap in mortgage AI governance?

Ongoing monitoring. The September 2026 AARMR, MBA, and BCG survey found 87% of respondents had written AI policies but only 58% monitored tools after deployment, with smaller lenders at roughly 40%. A policy without monitoring evidence will not hold up in a GSE review or state exam.

Does using AI change our adverse action obligations?

No. ECOA and Regulation B still require specific principal reasons for adverse action. If an AI tool contributes to a credit decision, you need to be able to identify and explain those reasons accurately, which is one reason high-impact tools belong in your highest risk tier.

Need help building an AI inventory or designing monitoring that satisfies Fannie Mae, Freddie Mac, and state examiners? Synergy works with mortgage QC and compliance teams nationwide. Book a 30-minute call to map out your program.

Regulatory Updates

FHA Quality Control Changes: What Mortgagee Letters 2026-09 and 2026-10 Mean for Your QC Plan

The biggest FHA quality control changes in years arrived in June 2026 with very little fanfare, and many lenders are still running QC plans written for the old rules. Mortgagee Letter 2026-09 and Mortgagee Letter 2026-10, both effective immediately, removed the requirement to obtain appraisal field reviews on 10% of QC-selected loans, eliminated the mandate to analyze loan performance data for patterns of noncompliance, and made the early payment default exception for disaster areas permanent. If your written QC plan still describes those requirements as mandatory, it no longer matches HUD policy, and that gap is exactly what an auditor will notice first.

Here is what changed, what did not, and how to rewrite your plan so it holds up.

The Five Mortgagee Letters HUD Issued in June 2026

HUD issued five Mortgagee Letters together in June 2026 (HUD’s summary is dated June 23, 2026), all framed as burden reduction under Executive Order 14393, Promoting Access to Mortgage Credit. HUD stated the changes will be incorporated into HUD Handbook 4000.1. Two of them go directly to your QC program:

  • Mortgagee Letter 2026-09, Eliminating Requirements for FHA Mortgagee Approval and Quality Control. Effective immediately.
  • Mortgagee Letter 2026-10, Updates to FHA Quality Control Requirements for Appraisal Field Reviews. Effective immediately.

The other three touch operations your QC team reviews:

  • Mortgagee Letter 2026-06 raised the number of disbursements allowed per draw request under the Limited 203(k) program.
  • Mortgagee Letter 2026-07 permanently rescinded Form HUD-92900-B, Important Notice to Homebuyers. You no longer provide it at application or retain a signed copy.
  • Mortgagee Letter 2026-08 updated loss mitigation requirements, including trial payment plan rules. It was optional on issuance and mandatory no later than September 21, 2026.

If your pre-funding or post-closing checklists still test for an executed HUD-92900-B, remove that line item now. Citing a defect against a document HUD no longer requires inflates your defect rate and distorts your trending.

FHA Quality Control Changes in Mortgagee Letter 2026-09

Trend analysis of loan performance data is no longer a stand-alone mandate

Before ML 2026-09, FHA required lenders to review their loan performance data for patterns of noncompliance, and to document the methodology, the results, and any corrective action taken. That requirement is gone.

HUD gave three reasons. Other FHA policy already requires lenders to expand loan-level QC reviews when fraud or patterns of deficiencies surface. Focusing on loan quality, not loan performance, is the more direct way to find control weaknesses. And HUD’s Credit Watch termination provisions indirectly address performance anyway.

What this means for you: you can stop producing a separate FHA loan-performance analysis solely to satisfy HUD. You should not stop trending your QC findings. Fannie Mae and Freddie Mac still expect management reporting and trend analysis of QC results (verify current requirements in Fannie Mae Selling Guide Subpart D1 and Freddie Mac Guide Chapter 3402), and HUD can still pull your approval if your early default and claim rates run too high relative to your peers under Credit Watch (verify current compare-ratio thresholds). Losing the FHA mandate does not remove the business reason to watch performance. It removes the FHA-specific paperwork.

Permanent EPD review exception for presidentially declared disasters

FHA requires lenders to review all loans that experience an early payment default, whether or not the lender services the loan. ML 2026-09 creates a permanent exception when the property is in a Presidentially Declared Major Disaster Area. The exception applies only if both conditions are met:

  1. The loan closed before the start of the incident period FEMA established for the disaster.
  2. The default occurred after the start of that incident period.

HUD had previously issued repeated waivers for disaster-related EPDs. Its reasoning is sound: defaults after a hurricane or wildfire usually trace to job loss, property damage, or relocation, not to underwriting defects.

What this means for you: build the exception into your EPD intake process, but document it loan by loan. Record the FEMA declaration number, the incident period start date, the closing date, and the date of default. A loan that closed one day after the incident period began does not qualify. Because the exception removes loans from review entirely, expect auditors to sample excluded EPDs and ask you to prove eligibility.

Officer in Charge and access to FHA guidance

ML 2026-09 also removed the requirement that a lender’s Officer in Charge be a full-time employee working exclusively for the lender. The OIC must still be a corporate officer designated to manage FHA operations. It also dropped the requirement to give loan administration and QC staff access to FHA guidance online or in hard copy, since all current guidance is online and lenders remain responsible for compliance either way.

Neither change requires a QC plan rewrite, but update your FHA approval file and organizational documentation if you restructure the OIC role.

Mortgagee Letter 2026-10: Appraisal Field Reviews Are Now Optional

Under the prior rule, lenders had to obtain appraisal field reviews on at least 10% of FHA loans selected for origination and underwriting QC review. ML 2026-10 removes that quota. Field reviews are now an optional component of appraisal QC, used when needed to adequately assess whether the appraisal report complies with FHA requirements.

HUD’s stated rationale is cost. Field reviews often cost more than the risk they mitigated, especially when lenders were already using third-party tools and desk reviews.

This is the change most likely to be mishandled. “Optional” does not mean “eliminated.” You still own appraisal quality, and you still have to show how your QC process tests it. A plan that simply deletes the field review section leaves an obvious hole.

Replace the quota with a risk-based trigger

The better approach is to replace a fixed percentage with defined triggers. A defensible appraisal QC section should state:

  • Baseline testing: every QC-selected FHA loan gets an appraisal desk review against FHA property and appraisal requirements, including minimum property requirements and the appraiser’s FHA roster status.
  • Escalation triggers: a field review is ordered when the desk review or an automated valuation tool flags a material variance, when comparables appear unsupported, when the property type is higher risk (for example, manufactured housing, 2-4 units, or rural properties with thin comparable data), or when an appraiser or appraisal management company shows a pattern of findings.
  • Pattern response: repeated findings tied to one appraiser, AMC, branch, or loan officer trigger targeted field reviews and expanded sampling.
  • Documentation: the reviewer records why a field review was or was not ordered.

That structure keeps your appraisal QC credible, cuts unnecessary spend, and gives an auditor a clear decision logic to test.

What Did Not Change

Lenders sometimes read burden-reduction letters as broader than they are. The core of FHA’s QC framework in Handbook 4000.1 is intact:

  • You still need a written QC plan that covers origination, underwriting, and servicing, as applicable.
  • You still sample loans for full QC review on a monthly basis (verify the current sampling standard in Handbook 4000.1, commonly 10% of closed loans or a statistically random sample at a 95% confidence level with 2% precision).
  • You still review early payment defaults outside the new disaster exception (verify the current EPD definition in Handbook 4000.1).
  • You still expand review scope when you identify fraud or patterns of deficiencies.
  • You still report findings to senior management and track corrective action to completion.
  • You still self-report material findings through the Loan Review System as required.

Six Steps to Update Your FHA QC Plan

Here is the work, in order:

  1. Redline the plan against ML 2026-09 and 2026-10. Strike the 10% field review requirement and the stand-alone performance-data analysis. Add the disaster EPD exception with its two eligibility tests.
  2. Rewrite the appraisal QC section around desk reviews and escalation triggers, as described above.
  3. Retire the HUD-92900-B checklist item and any defect codes tied to it, so your defect rates stay comparable over time.
  4. Confirm your loss mitigation procedures reflect ML 2026-08, which became mandatory September 21, 2026, if you service FHA loans or review servicing files.
  5. Keep your trending, but reframe it. Trend QC findings by defect category, channel, branch, underwriter, and vendor. That analysis still satisfies GSE expectations and is your early warning for Credit Watch exposure.
  6. Date and approve the revision. Record the effective date of each change, who approved it, and the governing Mortgagee Letter. A plan with a June 2026 policy change and no 2026 revision date tells an auditor your program is not maintained.

If you outsource post-closing QC, send your vendor the revised plan and confirm in writing that their FHA checklists and sampling logic have been updated. Your vendor’s checklist is your QC program in practice.

Why This Matters Beyond FHA

These FHA quality control changes fit a broader 2026 pattern. Regulators are removing prescriptive, fixed-percentage requirements and replacing them with an expectation that lenders apply documented, risk-based judgment. That is good news for efficiency. It also shifts the burden. When the rule said “10%,” compliance was a count. When the rule says “as needed to adequately assess,” compliance is an argument, and you need the documentation to win it.

Our compliance services team has been helping lenders redline QC plans against the June Mortgagee Letters. You can read the source documents directly: Mortgagee Letter 2026-09 and Mortgagee Letter 2026-10.

Frequently Asked Questions

Do we still have to obtain any FHA appraisal field reviews?

No fixed number is required anymore. Under Mortgagee Letter 2026-10, field reviews are optional and used when needed to adequately assess an appraisal’s compliance with FHA requirements. You still need a documented method for testing appraisal quality, and field reviews remain the right tool when desk reviews or automated tools flag material concerns.

Can we stop tracking FHA loan performance entirely?

You can stop producing the stand-alone FHA performance-data analysis that ML 2026-09 removed. You should keep trending QC findings and monitoring early defaults. GSE QC requirements still expect trend analysis, and HUD’s Credit Watch program still evaluates your default and claim performance against peers.

Which early payment defaults qualify for the disaster exception?

The property must be in a Presidentially Declared Major Disaster Area, the loan must have closed before the FEMA incident period began, and the default must have occurred after the incident period began. Document all three facts in the file. If any one is missing, review the EPD under your normal procedures.

When do these FHA quality control changes take effect?

Mortgagee Letters 2026-09 and 2026-10 were effective immediately on issuance in June 2026. Mortgagee Letter 2026-08 on loss mitigation was mandatory no later than September 21, 2026. Your QC plan should already reflect all three.

Need help rewriting your FHA QC plan or recalibrating your appraisal review triggers? Synergy supports QC and compliance teams at mortgage banks and credit unions nationwide. Book a 30-minute call to talk through your program.

Regulatory Updates

Inside the CFPB’s 2026 Regulatory Agenda: 5 Mortgage Rules Compliance Officers Must Track This Fall

The CFPB’s 2026 regulatory agenda, published August 14, 2026, is the clearest signal yet of how far the mortgage deregulation push triggered by Executive Order 14393 is going to reach — and it names five specific rulemakings that belong on every compliance officer’s Q4 calendar, not just a general sense that “things are changing.” The agenda itself is technically the delayed Fall 2025 edition, and the Bureau’s own preamble notes the timelines should be read as approximations given the Bureau is currently operating under interim leadership pending confirmation of a permanent director. Approximate or not, these are the items driving actual rulemaking activity right now, and waiting for a final rule to publish before you start tracking it means you’re always reacting instead of preparing.

The Executive Order Driving All of This

Executive Order 14393, “Promoting Access to Mortgage Credit,” signed March 13, 2026, directs the CFPB, FDIC, OCC, Federal Reserve, NCUA, and FHFA to review and reduce regulatory requirements that the administration argues have increased mortgage origination and servicing compliance costs and discouraged bank participation in the mortgage market. The order specifically calls out ability-to-repay and qualified mortgage requirements, TRID disclosure timing, and points-and-fees thresholds for small-balance loans as areas ripe for reform. Nearly every mortgage-related item on the CFPB’s 2026 agenda traces back to this directive.

Five Items for Your Q4 Compliance Calendar

1. Ability-to-Repay and Qualified Mortgage Reconsideration

The CFPB upgraded its review of ATR requirements and QM definitions from a long-term action item on the prior agenda to an active pre-rule item, with anticipated activity in August 2026. This is early-stage — pre-rule status means no proposed text yet — but it’s the most consequential item on the entire agenda if it moves, since ATR/QM standards touch every conventional mortgage originated in the country. Compliance officers should not wait for a proposed rule to start scenario-planning; the general direction (reducing compliance costs and expanding the QM safe harbor) is already signaled by the executive order.

2. TRID Disclosure Timing Review

EO 14393 specifically flags TRID disclosure timing as a target for reform. No proposed rule text has published as of this writing — verify current status before making operational assumptions — but any change to Loan Estimate or Closing Disclosure delivery timelines has direct systems and workflow implications for origination and closing teams. This is worth flagging to your loan origination system vendor now so you’re not waiting on a vendor update queue once a rule actually publishes.

3. Points-and-Fees Threshold Adjustments for Small-Balance Loans

The executive order directs regulators to consider adjusting points-and-fees thresholds specifically for small-balance loans — a longstanding industry concern, since fixed origination costs make small loans disproportionately likely to trip QM points-and-fees caps regardless of actual borrower cost. If your institution originates smaller-balance loans in lower-cost markets, this is the item most likely to directly expand your lending box if finalized.

4. The Regulation X Mortgage Servicing Overhaul

Still in the final rule stage as of the August 2026 agenda, this is the most mature item in the pipeline — proposed back in July 2024, with a comment period that closed in September 2024. It’s covered in depth elsewhere in this issue, but it belongs on this list because it’s the mortgage rulemaking most likely to actually finalize before year-end.

5. Larger Participant NPRMs Touching Consumer Reporting

Following advance notices of proposed rulemaking issued in August 2025, the Bureau anticipates proposed rules in September 2026 reconsidering the “larger participant” tests across four markets — automobile financing, consumer debt collection, consumer reporting, and international money transfers. The consumer reporting market item is the one mortgage lenders should watch most closely: it governs which consumer reporting agencies fall under CFPB supervisory authority, which has downstream implications for how your credit report and tri-merge vendors are regulated and examined.

A Smaller Item Worth Noting: The 2026 HPML Appraisal Threshold

Separate from the agenda items above, the CFPB, Federal Reserve, and OCC jointly announced that the 2026 threshold for higher-priced mortgage loans subject to special appraisal requirements increased from $33,500 to $34,200. It’s a routine annual CPI-based adjustment, not a policy shift, but it’s exactly the kind of housekeeping item that gets missed when compliance attention is consumed by the bigger rulemakings above — confirm your HPML appraisal exemption logic in your LOS reflects the current threshold.

Building a Q4 Regulatory Change Calendar

With this many moving parts, ad hoc tracking doesn’t work. A structured approach:

  • Assign one owner per agenda item — not one owner for “CFPB rulemaking” generally — so accountability doesn’t diffuse across a broad topic no one fully covers.
  • Set a recurring monthly check against the CFPB’s regulatory agenda and final rules pages, since the Bureau itself has flagged that its own timelines are approximate under current leadership transitions.
  • Separate “monitor” items (ATR/QM, TRID timing, points-and-fees — all pre-rule or undetermined) from “prepare now” items (Regulation X servicing, which is in the final rule stage and could publish with limited notice).
  • Brief your board quarterly on cumulative regulatory exposure, not just individual rules, so governance understands the scale of change moving through the pipeline simultaneously.

The Supervisory Backdrop

All of this rulemaking activity is happening against a CFPB operating with constrained resources. The Bureau’s acting leadership told Congress it needs $279.6 million just to maintain statutorily required operations through the end of fiscal year 2026, which closes September 30, 2026. Reduced Bureau capacity doesn’t mean reduced compliance obligations — it likely means more reliance on state regulators and other federal prudential agencies for exam coverage, and it means final rules, once issued, may carry less accompanying implementation guidance than lenders have historically relied on. Build your own interpretive documentation accordingly.

Frequently Asked Questions

What is Executive Order 14393?

Signed March 13, 2026, and titled “Promoting Access to Mortgage Credit,” it directs the CFPB and other federal financial regulators to review and reduce mortgage origination and servicing regulatory requirements, specifically naming ATR/QM standards, TRID disclosure timing, and points-and-fees thresholds for small-balance loans as reform targets.

Which item on the CFPB’s agenda is most likely to finalize first?

The Regulation X mortgage servicing overhaul, since it’s already in the final rule stage with a proposal and closed comment period dating back to 2024. ATR/QM and TRID timing reforms are still at the pre-rule stage, meaning no proposed text has published yet.

What is the 2026 HPML appraisal threshold?

The threshold for higher-priced mortgage loans subject to special appraisal requirements increased from $33,500 to $34,200 for 2026, under the routine annual CPI-based adjustment jointly announced by the CFPB, Federal Reserve, and OCC.

Why does CFPB funding matter for compliance planning?

The Bureau’s acting leadership has told Congress it needs $279.6 million to maintain required operations through the end of fiscal year 2026 (September 30, 2026), signaling constrained resources. That can mean less implementation guidance accompanying new final rules and shifted exam capacity toward state regulators and other prudential agencies — lenders should document their own interpretive positions more thoroughly than they might have in years with fuller Bureau guidance.

Five active rulemakings, one executive order, and a Bureau operating with constrained resources — that’s a lot to track manually. Synergy helps mortgage banks build regulatory change management processes that catch items like these before they become exam findings — see our compliance services and mortgage loan closing support, or book a 30-minute call to build your Q4 regulatory calendar.

Regulatory Updates

The CFPB’s Regulation X Servicing Overhaul Could Drop Any Week: How Servicers Should Prepare Now

The Regulation X final rule that would rewrite how servicers handle loss mitigation is still sitting at the CFPB as of its August 14, 2026 regulatory agenda, which means it could publish next week, next month, or slip further — and that uncertainty is exactly the problem. The proposal, first issued July 10, 2024 under the title “Streamlining Mortgage Servicing for Borrowers Experiencing Payment Difficulties,” would eliminate the “complete application” framework that’s anchored 12 C.F.R. § 1024.41 loss mitigation procedures for more than a decade. Servicers who wait for the final rule to publish before touching their loss mitigation workflow will be doing emergency implementation on a compressed timeline. Servicers who start now will have a working head start.

What the Proposed Rule Would Actually Do

The proposal reflects a genuine structural shift, not a set of tweaks. Understanding the mechanics matters because the operational build is substantial regardless of exactly when the final rule lands.

Removing the Complete Application Trigger

Under current Regulation X, most loss mitigation protections — including the prohibition on dual tracking toward foreclosure — hinge on the borrower submitting a “complete” loss mitigation application. That completeness threshold has long been a source of servicer-borrower disputes and litigation risk: borrowers claim they submitted enough information, servicers claim the application was incomplete, and foreclosure timelines hang in the balance. The proposed rule would remove most of the application-based provisions from § 1024.41 entirely, replacing the completeness gate with a continuous “loss mitigation review cycle” triggered simply by a borrower’s request for assistance.

Foreclosure Safeguards Attach Earlier

Instead of waiting for a complete application to trigger foreclosure procedural protections, the proposal would require servicers to provide those safeguards as soon as a borrower requests loss mitigation assistance — a meaningfully earlier trigger point than current rules. For servicers, this means foreclosure referral holds and early intervention procedures need to activate off a borrower’s initial contact, not off a completed document package.

New Notice and Explanation Requirements

Early intervention notices would need to include phone and website contact information covering all available loss mitigation options — not just the general servicer contact info many templates currently use. Servicers would also be required to provide detailed explanations for loss mitigation decisions, moving away from boilerplate denial language toward decision-specific reasoning that borrowers (and examiners, and plaintiffs’ attorneys) can actually evaluate. The proposal also introduces Spanish-language requirements for certain borrower communications.

Why This Rule Is Likely to Move — and Why It Might Not Track the 2024 Draft Exactly

Executive Order 14393, signed March 13, 2026, directly instructs the CFPB and prudential regulators to simplify loss mitigation requirements as part of a broader push to reduce mortgage origination and servicing compliance costs. Finalizing the Regulation X overhaul is widely read as the Bureau’s direct response to that instruction, which is why it remains an active final-rule-stage item on the August 2026 agenda even as other, lower-priority rulemakings have been pushed to long-term status.

That said, don’t assume the final rule will track the 2024 proposal word for word. Industry commenters, including the Conference of State Bank Supervisors, raised specific concerns during the comment period that closed September 9, 2024 — particularly around state law preemption, since several states independently require a complete loss mitigation application before foreclosure protections attach, creating a potential conflict between a federal rule eliminating that requirement and state statutes that still impose it. Expect the final rule to address preemption more explicitly than the proposal did, and expect at least some revision from the original draft in response to comments. Treat the specific provisions above as directional, not final, until the rule publishes — verify current text against the Federal Register release when it lands.

The Small Servicer Question

The proposal leaves the existing small servicer exemption in place for institutions servicing 5,000 or fewer mortgage loans, which are largely excused from Regulation X’s loss mitigation procedures already. If your institution qualifies as a small servicer, the direct rule impact is limited — but if your loss mitigation process is modeled on Regulation X’s structure even though you’re exempt (a common practice for consistency and investor requirements), you should still track how the final rule reshapes that structure, since your own internal policy references it.

How to Prepare Before the Rule Publishes

  1. Map your current loss mitigation workflow against the proposed continuous review cycle model — identify every process step currently gated by “complete application” status and flag it for redesign.
  2. Inventory your state-by-state loss mitigation requirements now, since several states impose completeness standards independent of federal law; a federal rule change won’t necessarily relieve those state obligations.
  3. Review early intervention notice templates and confirm whether your current contact information and loss mitigation option disclosures could be expanded to meet a “detailed explanation” standard without a full rebuild.
  4. Assess your Spanish-language communication capability across loss mitigation touchpoints — call center scripting, notice templates, and web content — so you’re not building translation infrastructure under a compressed compliance date once the rule finalizes.
  5. Brief your board and senior management now on the scope of this change, so budget and staffing conversations aren’t happening for the first time after the final rule publishes with a short effective date.

Why Waiting Is the More Expensive Option

CFPB final rules of this scale typically carry effective dates measured in months, not years, especially under an administration prioritizing rapid deregulatory implementation. A servicing shop that starts workflow redesign, vendor system updates, and staff retraining only after the Federal Register publication is compressing a multi-month project into whatever window the effective date allows. Given that the underlying policy direction — earlier foreclosure protections, continuous review cycles, detailed decision explanations — has been publicly known since July 2024, there’s no credible argument for treating this as a surprise when it lands.

Frequently Asked Questions

Has the CFPB’s Regulation X servicing rule been finalized yet?

Not as of the CFPB’s August 14, 2026 regulatory agenda, which still lists it as an active item in the final rule stage. Verify current status against the CFPB’s rules and policy page before making implementation decisions based on assumed timing.

What’s the biggest operational change in the proposal?

Removing the “complete application” framework and replacing it with a continuous loss mitigation review cycle triggered by a borrower’s request for assistance, rather than by a completed document package. This shifts when foreclosure procedural safeguards attach and changes how servicers need to track borrower engagement.

Does the small servicer exemption still apply?

Yes, under the proposal, servicers of 5,000 or fewer mortgage loans retain their existing exemption from most Regulation X loss mitigation procedures. Servicers near that threshold should confirm their current loan count and monitor whether the final rule adjusts the exemption.

Will state loss mitigation laws still require a complete application even after this rule?

Possibly, in states that independently codify a completeness requirement for foreclosure protections. State regulator groups flagged this preemption question directly during the comment period, so expect the final rule to address it — but until it publishes, servicers in those states should assume dual compliance obligations rather than assuming federal preemption.

A loss mitigation program built for the current rule isn’t ready for the one that’s coming. Synergy helps mortgage banks and servicers stress-test loss mitigation workflows against pending regulatory change — see our compliance services and mortgage loan fulfillment support, or book a 30-minute call to map your Regulation X readiness gaps now.

Regulatory Updates

CFPB’s New ECOA Rule Eliminates Disparate Impact: What Lenders Must Fix in Fair Lending QC Now

The CFPB’s ECOA disparate impact rule has been the law of the land since July 21, 2026, which means it’s been sitting on your fair lending QC program for roughly two months — long enough that any gap between what your testing methodology assumes and what Regulation B now actually requires has already generated data you’ll have to explain to an examiner. On April 22, 2026, the Bureau finalized a rule that strips the “effects test” out of Regulation B and affirmatively states that the Equal Credit Opportunity Act does not recognize disparate-impact liability. If your QC team is still running fair lending testing built around the old effects-based framework, you’re not just behind — you’re generating findings against a legal standard that no longer exists.

What the Rule Actually Changed

The final rule amends Regulation B in three specific ways, and each one has direct operational consequences for a mortgage bank’s compliance management system.

Disparate Impact Is Out

The CFPB removed the “effects test” from Regulation B and stated plainly that ECOA does not recognize disparate-impact liability — a theory the Bureau had relied on for over a decade to pursue lenders whose facially neutral policies produced statistically disproportionate outcomes for a protected class, regardless of intent. Under the amended rule, ECOA claims require proof of disparate treatment: differential handling tied to a prohibited basis, not just a statistical gap in outcomes.

Discouragement Now Requires Intent

The rule also narrows the “discouragement” prohibition. Previously, a lender could face liability for statements or practices that merely created a negative impression and discouraged a reasonable person from applying, even absent any intent to discriminate. Under the amended standard, the Bureau is focused on statements of intent to discriminate — a materially higher bar. Marketing language, loan officer scripts, and website messaging that were previously scrutinized for “chilling effect” now get evaluated for actual discriminatory intent.

Special Purpose Credit Programs Get New Guardrails

If your institution runs — or is considering — a Special Purpose Credit Program (SPCP) under Regulation B § 1002.8, the rule now prohibits using race, color, national origin, or sex as common characteristics defining program eligibility, and it imposes additional documentation requirements on for-profit creditors that want to operate one. Programs designed around those characteristics need immediate legal review; this isn’t a phase-in situation.

Why Your Fair Lending QC Testing Needs to Change Now

Most mortgage banks built their fair lending monitoring programs — matched-pair analysis, marginal-effect regression testing, redlining geospatial review — around a dual-track standard: disparate treatment and disparate impact. That was the right architecture for the last decade of CFPB enforcement priorities. It’s the wrong architecture now, for one simple reason: your QC team is going to keep finding statistical disparities, because pricing and underwriting outcomes are never perfectly uniform across demographic groups, and none of those findings are actionable under the amended ECOA standard unless you can also show intent or differential treatment.

That doesn’t mean disparate-impact analysis is worthless — it doesn’t. Here’s why:

  • State fair lending laws in several states retain disparate-impact standards independent of federal ECOA, so multi-state lenders can’t simply drop the analysis.
  • Fannie Mae, Freddie Mac, and FHA/VA overlays and seller/servicer guides may still expect fair lending self-testing regardless of the federal liability standard.
  • A future administration or a future CFPB director could reverse this rule, and lenders who dismantled their testing infrastructure entirely will have to rebuild it from scratch.
  • Statistical disparity findings remain useful as an early-warning signal for underwriting or pricing drift, even when they’re no longer independently actionable under ECOA.

The right move isn’t to eliminate disparate-impact-style statistical monitoring — it’s to re-tier it. Keep it as an internal risk indicator that triggers deeper review, but stop treating a marginal-effect finding by itself as a fair lending violation requiring remediation under federal law. Reserve remediation resources for findings that show actual differential treatment or documented intent.

Updating Loan Officer Scripts and Marketing Under the New Discouragement Standard

The shift from “negative impression” to “intent to discriminate” changes what your marketing and pre-qualification review process should be looking for. Under the old standard, compliance reviewers flagged language that could plausibly discourage a protected class applicant even without any discriminatory intent — things like imagery, neighborhood targeting in geo-fenced digital ads, or loan officer talking points that emphasized certain buyer profiles. Under the amended rule, review should focus on whether language or conduct evidences an intent to discourage applicants on a prohibited basis.

This is a genuine loosening of compliance burden, but it comes with a practical trap: your marketing team may read this as a green light to revert to targeting practices that were curtailed years ago. Don’t let that happen without documented legal sign-off. The standard changed under federal law; state UDAP and mini-ECOA statutes did not necessarily move with it.

What to Do Before Your Next Fair Lending Exam

  1. Update your fair lending policy and QC testing plan to reflect the disparate-treatment-only standard, with a documented rationale for why (and how) you’re retaining statistical monitoring as a risk-tiering tool.
  2. Re-run your last two quarters of fair lending testing results through the new framework and document which findings would no longer independently trigger remediation — this becomes your baseline for board and examiner conversations.
  3. Audit any active SPCP for prohibited common characteristics and documentation gaps under the amended rule.
  4. Review loan officer scripts, ad targeting parameters, and pre-qualification messaging against the intent-based discouragement standard, with legal counsel sign-off on any changes.
  5. Confirm your state-level fair lending exposure hasn’t shifted — some states retained disparate-impact standards that federal deregulation doesn’t touch.

The Exam Risk of Doing Nothing

Examiners will not penalize you for having updated your testing methodology to reflect current law. They will absolutely ask questions if your QC files show you’re still applying — or worse, still citing — a legal standard the CFPB itself eliminated five months ago. A compliance management system that hasn’t been updated to reflect a final rule that’s been in effect since July signals to an examiner that your regulatory change management process isn’t working, and that finding tends to generate broader scope creep into other areas of the exam.

Frequently Asked Questions

Does this rule mean disparate impact claims are gone entirely?

Under federal ECOA and the amended Regulation B, yes — the effects test has been removed and the CFPB has stated ECOA does not recognize disparate-impact liability. But state fair lending and UDAP statutes in several states retain independent disparate-impact standards, so multi-state lenders still face exposure at the state level. Verify current state-level standards before assuming full relief.

Should we stop running statistical fair lending testing altogether?

No. Statistical testing remains a useful early-warning tool for pricing and underwriting drift, and it may still be expected under investor overlays or state law. The change is in how you classify and act on the results — a statistical disparity is now a signal for deeper review, not an independently actionable federal violation.

What happened to Special Purpose Credit Programs under this rule?

The rule prohibits using race, color, national origin, or sex as common characteristics defining SPCP eligibility, and adds documentation requirements for for-profit creditors operating one. Any active SPCP built around those characteristics needs immediate legal review — this took effect July 21, 2026, alongside the rest of the rule.

Could this rule be reversed under a future CFPB director?

It’s possible — ECOA rulemaking has shifted with administration priorities before, and this rule itself reversed prior CFPB guidance. That’s exactly why lenders should retain their statistical testing infrastructure rather than dismantling it: rebuilding a fair lending monitoring program from scratch under exam pressure is far more expensive than maintaining a scaled-down version now.

Fair lending QC testing that’s still built on a standard the CFPB retired in April is a finding waiting to happen. Synergy helps mortgage banks and credit unions rebuild fair lending testing methodology, SPCP documentation, and QC frameworks to match current Regulation B requirements — read more about our fair lending compliance assessment services or book a 30-minute call to walk through where your program stands.

Regulatory Updates

State AI/ML Enforcement for Mortgage Lenders: What You Need to Know in 2026

Federal AI/ML guidance for mortgage lending remains a patchwork. The CFPB has issued interpretive guidance, the GSEs have published AI governance frameworks, and Congress has considered — but not passed — federal AI legislation. In the absence of a unified federal standard, state regulators have moved ahead with their own rules.

For mortgage lenders operating in multiple states, the practical effect is a growing set of state-specific AI/ML obligations layered on top of federal and GSE requirements. This article walks through the state rules that affect mortgage lenders in 2026, how they interact with each other and with federal frameworks, and what a defensible multi-state AI compliance program looks like.

Why State AI/ML Regulation Matters for Mortgage Lenders

State AI/ML rules were not written with mortgage lending as the primary use case. Most originate in consumer protection, employment, or insurance contexts. But the definitions of “automated decision tool,” “high-risk AI system,” and “consumer” are broad enough to capture mortgage lending activity — and state regulators have signaled that they will apply their AI rules to financial services, not just to the originally-targeted industries.

The compliance exposure is not theoretical. State AGs have been active in 2025 and 2026, with several settlements against financial services firms involving AI/ML use. Mortgage lenders that treat state AI compliance as a low-priority “tech company” issue are misreading the landscape.

Colorado AI Act (SB 24-205)

The Colorado AI Act took effect on February 1, 2026. It is the most comprehensive state AI statute in the United States and the one most likely to set a template for other states.

Who It Applies To

The Act applies to “developers” and “deployers” of “high-risk AI systems” used in Colorado. A deployer is any entity that uses a high-risk AI system to make decisions that affect Colorado residents. Mortgage lenders that use AI/ML systems for Colorado residents — including in origination, servicing, marketing, or customer service — are deployers under the Act.

What Counts as a High-Risk AI System

The Act specifies categories of high-risk systems. The relevant categories for mortgage lenders include:

  • AI systems used to make decisions about access to financial services, including credit
  • AI systems used for employment decisions (relevant for HR, recruiting, and internal loan officer evaluation)
  • AI systems that materially affect access to housing

Automated underwriting systems, AI-driven pricing tools, lead scoring systems that influence credit decisions, and AI-driven appraisal valuation models are all high-risk under the Act.

What Deployers Must Do

Deployers must implement a risk management program and policy, complete an impact assessment for each high-risk system, provide notice to consumers that an AI system is being used, and allow consumers to request human review of an AI-driven decision. The impact assessment must be made available to the Colorado AG on request.

The Act also prohibits algorithmic discrimination — defined in ways that overlap significantly with federal fair lending law but include additional categories of protected activity.

California AI Rules

California does not yet have a comprehensive AI statute, but the state has a layered set of AI-related rules that affect mortgage lenders.

AB 2013 (Generative AI Training Data)

AB 2013 requires developers of generative AI systems to publish a summary of the training data used. The rule is targeted at generative AI providers, not at deployers. For mortgage lenders, the relevance is downstream: if you use a generative AI tool (e.g., for document drafting, customer service), the underlying provider’s compliance affects your vendor risk profile.

SB 942 (AI Transparency)

SB 942 requires AI providers to offer a free AI detection tool to users. The rule is targeted at AI providers, not at deployers. The relevance is the same as AB 2013 — vendor due diligence.

California Department of Financial Protection and Innovation (DFPI)

The California DFPI has been the most active state financial regulator on AI/ML. The DFPI has issued multiple guidance documents on AI use in lending, conducted examinations focused on AI/ML systems, and entered into consent orders with lenders involving AI/ML model risk management and fair lending testing.

The DFPI’s approach is consistent with the federal and GSE frameworks, but it includes California-specific requirements on consumer notification, model documentation, and the right to human review. For lenders operating in California, DFPI expectations are effectively a fourth layer of AI/ML governance on top of CFPB, GSE, and other state rules.

New York State and City

New York has not passed a comprehensive state AI statute, but the New York Department of Financial Services (DFS) has issued guidance on AI/ML use by regulated financial institutions. The DFS guidance is supervisory in nature — not a binding regulation — but it sets the expectation for AI/ML governance programs for insurers and banks under DFS jurisdiction.

For mortgage lenders operating in New York, the DFS guidance effectively requires an AI/ML governance program consistent with the GSE frameworks. Examiners will look for documentation of model risk management, fair lending testing, and consumer protection controls.

New York City Local Law 144 (automated employment decision tools) affects mortgage lenders that use AI in hiring — for loan officer recruiting, underwriting staff screening, or any other employment decision. The law requires an annual bias audit and public posting of the audit results.

Texas: UDAP Authority

Texas has not passed a state AI statute, but the Texas Attorney General and state financial regulators have used existing Unfair, Deceptive, or Abusive Acts or Practices (UDAP) authority to bring AI/ML-related actions. The state has been particularly active on AI-driven decisions that result in disparate impact on protected classes — using UDAP rather than a separate AI statute.

For Texas-licensed mortgage lenders, the practical implication is that AI/ML use is regulated — even without a specific AI statute. The compliance program that satisfies the Texas SML for the SSSF, the GSE AI/ML frameworks, and the federal fair lending rules is the foundation for UDAP defensibility.

Other State Activity

State AI/ML activity is moving fast. The states that have either passed AI rules or have active rulemaking in 2026 include Illinois, New Jersey, Virginia, Washington, and Oregon. The rules vary in scope and approach, but the direction is consistent: more state regulation, with mortgage lending in scope.

A practical approach for mortgage lenders operating nationally: design the AI/ML governance program to the strictest applicable state requirement, and apply it uniformly. The marginal cost of running a single, conservative program is much lower than the cost of running multiple state-specific programs.

How State AI Rules Interact with Federal and GSE Frameworks

A consolidated view of the AI/ML compliance landscape for mortgage lenders in 2026:

  • CFPB: interpretive guidance, focus on adverse action notices, fair lending, and accuracy of AI-driven decisions. Exam focus in 2026.
  • Fannie Mae LL-2026-04: AI/ML governance framework, effective August 6, 2026. Six governance obligations, annual attestation.
  • Freddie Mac Section 1302.8: companion AI/ML governance framework, effective March 3, 2026. Substantively similar to LL-2026-04.
  • Colorado AI Act: high-risk AI system requirements, impact assessments, consumer notice, right to human review. Effective February 1, 2026.
  • California DFPI: AI/ML supervisory guidance, focused on documentation, fair lending testing, and consumer protection.
  • New York DFS: supervisory guidance, treated as effective standard for New York-licensed institutions.
  • State AGs: UDAP authority, used to bring AI/ML-related actions in states without specific AI statutes.

These frameworks are additive. A lender that satisfies Fannie Mae LL-2026-04 still has separate Colorado, California, and New York obligations. The Colorado impact assessment is not a substitute for the LL-2026-04 attestation.

Building a Multi-State AI/ML Compliance Program

A defensible program has five components.

1. Unified AI/ML Use Case Inventory

Maintain a single inventory that flags which systems are in scope under which state rules. The inventory is the foundation — without it, you cannot determine your compliance obligations.

2. State-Overlay Documentation

For each state with AI/ML rules, maintain an overlay document that maps the state requirements to your existing governance program. The overlay identifies the gaps and the remediation work.

3. Consumer Notice and Human Review Workflows

Colorado and other state rules require consumer notice of AI use and a right to human review. The workflows should be designed to comply with the strictest applicable state requirement.

4. Impact Assessment Library

Maintain an impact assessment for each high-risk AI system, updated annually or after material model changes. The assessment is a state regulatory document, not a federal one — different states may require different formats.

5. Multi-State Vendor Oversight

Your vendor oversight program must cover state-specific requirements. A vendor providing AI/ML services in Colorado has different disclosure obligations than a vendor providing the same services in Texas.

Frequently Asked Questions

Does the Colorado AI Act Apply If We Don’t Have a Physical Office in Colorado?

Yes. The Act applies to any deployer that uses a high-risk AI system to make decisions affecting Colorado residents. If you originate or service a mortgage for a Colorado resident and use an AI/ML system in connection with that loan, the Act applies.

How Do State AI Rules Interact with Fair Lending Law?

State AI rules typically add anti-discrimination requirements that overlap with federal fair lending law but are not identical. A fair lending test that satisfies the CFPB may not satisfy the Colorado AI Act. The conservative approach is to test to the strictest applicable standard.

What If a Vendor Provides Our AI/ML System? Are We Still Liable?

Yes. Under the Colorado AI Act, the GSE frameworks, and most state-level approaches, the lender is the deployer and remains accountable for the system’s compliance. Vendor contracts can shift some financial risk, but not regulatory risk.

What Records Must We Retain?

Three years for most state requirements, but some state rules require longer retention for impact assessments. Document the retention requirement for each state in scope and apply the longest applicable period uniformly.

Need help designing or auditing your multi-state AI/ML compliance program? Synergy supports mortgage lenders with state overlay documentation, impact assessment design, and multi-state governance program reviews. Book a 30-minute program review.

Regulatory Updates

Q2 2026 MCR Filing Cycle: What Went Right, What Went Wrong

The Q2 2026 NMLS Mortgage Call Report cycle closed on August 14, 2026. It was the second cycle under MCR Form Version 7 and the first full quarter where the Texas SML applied normal — not transitional — enforcement to the new State-Specific Supplemental Form. With the cycle now in the books, the data is clear about what worked, what didn’t, and where the gaps are heading into Q3.

This is a practitioner’s post-mortem. It walks through the most common filing issues observed in the Q2 cycle, the structural improvements that worked, and the priorities for the Q3 2026 filing window (deadline November 14).

What Went Right

The headline: most filers made the August 14 deadline with accurate data. The Q2 2026 cycle did not produce the wave of placeholder filings some state regulators had feared. Three factors drove the improvement.

FV7 Field Mappings Stabilized

The Q1 2026 cycle was the debut of FV7. Lenders that built their filing templates from FV6 documentation — or that did not have time to fully reconcile the new field structure before the May 15 deadline — produced filings with systematic field-mapping errors. The Q2 cycle showed a measurable improvement: most lenders had updated their internal mappings, retrained their teams, and validated against the current NMLS field definitions before the August 14 window opened.

Texas SSSF Transition Period Closed Cleanly

The Texas SML signaled in March 2026 that it would not actively pursue enforcement for Q1 2026 SSSF late filings absent other compliance concerns. The SML’s calibrated posture gave Texas-licensed lenders room to bring their SF600/SF610 data quality up to standard without the immediate risk of a violation.

By Q2 2026, normal enforcement was in effect. Filers had a clear deadline, a clear signal that the transition was over, and a quarter of operational experience. The result: clean SSSF submissions for most filers, with the SML reporting no widespread data quality issues at the cycle close.

Reconciliation Discipline Took Hold

Lenders that built HMDA-MCR reconciliation into their monthly close process — rather than scrambling at filing time — produced filings with materially fewer reconciliation gaps. The structural investment paid off.

What Went Wrong

Three categories of issues showed up repeatedly in the Q2 cycle.

1. Ginnie Mae Issuer Field Gaps

FV7 introduced new conditional fields for Ginnie Mae Issuers that did not exist in FV6. In Q1, the issue was that lenders were unaware of the fields. In Q2, the issue is that lenders are aware but have not fully populated them — particularly the fields that depend on data from upstream systems (e.g., pool composition, issuer monthly volume).

The fix is data lineage: trace each Ginnie Mae field back to its source system, validate the data, and document the lineage for examiner review.

2. Servicing Portfolio Segment Misclassification

FV7 restructured how servicing activity is reported across investors. The misclassification pattern in Q2 is the same as Q1: companies using FV6 mappings for FV7 data.

If your Q1 MCR was filed under FV6 mappings, the Q2 filing should have been the cycle to correct the issue. If it was not, the misclassification will be flagged in your next examination — and the longer it persists, the more filing periods you have to amend.

3. Origination Count Drift vs. HMDA LAR

Q2 origination counts in the MCR are being compared by examiners to Q2 origination counts in HMDA LAR. The most common drift comes from brokered-out loans (MCR typically excludes, HMDA may include) and from loans in process at quarter-end (MCR uses settlement date, HMDA uses application date).

The fix is documented scope rules plus a quarterly reconciliation. If the delta persists, the answer is not “we’re right” — it is “here is the documented scope difference and here is the supporting reconciliation.”

The Texas SSSF Normal-Enforcement Reality

Q2 2026 was the first SSSF cycle under normal enforcement. Three observations from the cycle.

SF600 and SF610 accuracy was the focus. The SML reviewed SSSF submissions for consistency with the NMLS MCR and with internal origination data. Filers with material variance received follow-up requests from the SML within a week of submission. Most variance was attributable to either scope-rule ambiguity (own-account vs. third-party processing) or timing (settled-file vs. application-based volume).

SF630 and SF660 stayed empty. The reserved fields remained reserved. Filers that entered data in SF630 or SF660 (a few did, by mistake) received validation errors. No enforcement action was taken in Q2 for SF630/SF660 errors, but the SML is treating these as validations to flag, not as substantive violations — yet.

Amended filings are working as designed. Several filers filed amended SSSFs after discovering post-filing errors. The SML accepted the amendments without enforcement action. The amendment process is functioning as a self-correction mechanism, which is the right outcome — but it requires filers to actually run post-filing QC, which not all do.

Three Things to Fix Before Q3 2026

The Q3 2026 MCR cycle closes on November 14. The window between mid-August and mid-November is the right time to address the most common Q2 issues.

1. Build or Refresh the FV7 Field Map

Pull the current NMLS MCR field definitions and instructions. Compare them against your internal mapping. Document the differences. Update your filing template.

The current field definitions are the only authoritative source. Documentation from FV6, third-party vendor field lists, and templates from prior cycles are not sufficient — they will replicate errors rather than fix them.

2. Run HMDA-MCR Reconciliation Monthly

Quarterly reconciliation is not enough. Monthly reconciliation catches drift early, when it is easy to remediate, rather than at filing time, when the remediation is an amendment.

Set a reconciliation tolerance (0.5% at the aggregate level is a reasonable starting point) and document any exceptions. The documentation is what examiners will ask for.

3. Tie MLO Headcount to NMLS Records

MLO headcount in the MCR should reconcile to NMLS licensing records for the reporting period. The Q2 cycle saw headcount drift in institutions that have had MLO turnover — particularly layoffs, acquisitions, or MLO migration to a different sponsor.

A monthly tie between HR data and NMLS licensing records catches the drift before it shows up in the MCR. The fix is process, not a one-time clean-up.

The Q3 Calendar

For the Q3 2026 MCR cycle, the key dates are:

  • October 1, 2026 — Q3 reporting period begins (the September 30 cutoff is the data boundary)
  • October 31, 2026 — internal books should be closed (recommended 14 days before the deadline)
  • November 7, 2026 — internal QC and pre-submission reconciliation (recommended hard stop)
  • November 14, 2026 — NMLS filing deadline

A common Q3 challenge: the November 14 deadline is three weeks after the federal election. Election years tend to compress close calendars at the back end of Q3 and Q4 — the Q3 close gets squeezed by election prep, holiday coverage planning, and year-end activity stacking up. Build the Q3 close calendar now to avoid the squeeze.

Frequently Asked Questions

Will the SML Provide Q2 2026 SSSF Feedback to All Filers?

The SML has signaled that it will provide substantive feedback on the first full normal-enforcement cycle. Filers should expect to receive follow-up requests if there are scope-rule ambiguities, data quality issues, or reconciliation gaps with the NMLS MCR. The window for resolving the feedback is typically 30 days.

What Happens If We Discover an MCR Error After the August 14 Filing?

File an amended MCR. The NMLS amendment process is the same as the original filing process. Self-discovered and promptly amended errors are treated more favorably by examiners than errors discovered during an examination. Maintain an internal amendment log so you can answer examiner questions about specific filings quickly.

How Should We Handle the FV6 Mappings in the Q3 Cycle?

If you are still using any FV6 mappings for FV7 data, the Q3 cycle is the right time to fix them. The longer the legacy mappings persist, the more filing periods you have to amend retrospectively. Build the corrected mapping now, validate it against the current NMLS field definitions, and document the change.

What Is the Examiner Focus for Q3 2026?

Based on Q1 and Q2 examination findings, the focus areas are FV7 field mapping (Ginnie Mae Issuer fields, servicing portfolio segments), HMDA-MCR reconciliation gaps, MLO headcount reconciliation, and Texas SSSF data quality. Q3 will likely see a continuation of these focus areas with a particular emphasis on the Q1-to-Q2-to-Q3 trend — examiners will be looking for whether issues are being remediated or persisting across cycles.

Need help hardening your Q3 2026 MCR process? Synergy supports mortgage lenders with FV7 field mapping reviews, monthly reconciliation design, and exam-readiness assessments. Book a 30-minute Q3 review.

Regulatory Updates

Fannie Mae AI/ML Governance: What Lenders Must Do by August 6

Fannie Mae’s AI/ML governance framework — Lender Letter LL-2026-04 — took effect on August 6, 2026. For any single-family seller or servicer using artificial intelligence or machine learning in connection with mortgages sold to Fannie Mae, the framework is now in force. The compliance bar is no longer aspirational; it is operational.

LL-2026-04 is the companion to Freddie Mac’s Seller/Servicer Guide Section 1302.8, which took effect March 3, 2026. Together, the two frameworks establish the GSE position on AI/ML governance: lenders are accountable for the design, performance, and outcomes of any AI/ML system used in the mortgage lifecycle, regardless of whether the system is built in-house, provided by a third-party vendor, or accessed through a marketplace platform.

This guide walks through what LL-2026-04 requires, how it interacts with Freddie Mac Section 1302.8 and state-level AI rules, and what a defensible AI/ML governance program looks like for a mortgage lender as of August 2026.

What LL-2026-04 Actually Requires

LL-2026-04 is structured around six governance obligations. Each is a stand-alone compliance topic and each requires documentary evidence.

1. AI/ML Use Case Inventory

Lenders must maintain a complete inventory of every AI/ML system used in the mortgage lifecycle. The inventory should identify the system, the business function it supports, the data inputs, the model owner, the deployment date, and the underlying vendor (if third-party).

In scope: automated underwriting, appraisal valuation models, fraud detection, lead scoring, marketing optimization, customer service chatbots, document classification, income and asset verification, and any pricing or margin optimization tool that uses statistical learning.

Out of scope: rule-based decision engines that do not learn from data, simple statistical scoring (e.g., credit score lookups without model adjustment), and standard business intelligence dashboards.

2. Model Risk Management Framework

Each inventoried AI/ML system must be classified by risk tier based on its impact on loan decisions, borrower outcomes, and regulatory exposure. High-impact systems (underwriting, pricing, fraud, valuations) require the most rigorous controls.

The framework should document validation activities (pre-deployment testing, ongoing monitoring, periodic revalidation), performance thresholds, change management procedures, and override mechanisms for human review.

3. Fair Lending Testing

Each AI/ML system that affects loan decisions, pricing, or adverse action notices must be tested for fair lending impact. Testing should include disparate impact analysis across prohibited basis categories (race, national origin, sex, religion, familial status, age, disability), proxy variable analysis (identifying features that correlate with protected classes even when the protected class is not a direct input), and segment-level performance review.

The testing should occur before deployment, after material model changes, and at a defined cadence (typically annually for high-impact systems).

4. Governance Documentation

LL-2026-04 requires a written AI/ML governance policy that is approved at the board or senior committee level. The policy should cover roles and responsibilities, model lifecycle controls, escalation paths, exception handling, and incident response.

Documentation must be maintained for the life of each model plus a defined retention period. The retention floor is generally three years post-decommissioning, consistent with other mortgage compliance records.

5. Third-Party Vendor Oversight

Lenders remain accountable for AI/ML systems provided by third parties. The oversight program should include vendor due diligence (model documentation review, validation access, audit rights), ongoing monitoring (performance reports, incident notification, regulatory change tracking), and contractual protections (indemnification, data security, model decommissioning rights).

A common gap: lenders that treat vendor systems as “off the shelf” and skip validation. LL-2026-04 treats this as a compliance failure. The lender is responsible for validating the model in the context of its own use, even if the vendor provides the validation methodology.

6. Annual Attestation

Lenders must attest annually to Fannie Mae that they have an AI/ML governance program in place that meets LL-2026-04 requirements. The attestation is a senior officer certification, not a procedural check-the-box. Officers signing the attestation should expect to defend the substance of the program if challenged.

How LL-2026-04 Interacts with Freddie Mac Section 1302.8

If your institution sells to both GSEs, you do not need to maintain two separate AI/ML governance programs. A unified program that satisfies both frameworks is acceptable, and Fannie Mae and Freddie Mac have signaled that they will accept each other’s attestations in most cases.

The two frameworks differ in three operational details:

  • Effective dates: Freddie Mac Section 1302.8 took effect March 3, 2026. Fannie Mae LL-2026-04 took effect August 6, 2026. If you implemented a Section 1302.8 program in the spring, you should be in good shape on the substance of LL-2026-04. The remaining work is typically attestation timing and documentation reconciliation.
  • Attestation cadence: Freddie Mac requires annual attestation. Fannie Mae requires annual attestation. The two attestations can be filed separately even if the underlying program is the same.
  • High-impact system definition: The two frameworks use slightly different definitions of “high-impact.” Where they differ, the more conservative definition should govern.

If your institution sells to only one of the two GSEs, you only need to meet that GSE’s framework. But state-level AI rules may still apply regardless of GSE relationship — see the August 2026 article on state AI/ML enforcement.

What “In Connection With Mortgages Sold to Fannie Mae” Means

LL-2026-04 applies to AI/ML systems used in connection with mortgages sold to Fannie Mae. The phrase is interpreted broadly. If a system touches a loan that may eventually be sold to Fannie Mae, the governance obligations apply.

In practice, this covers:

  • Systems used at the point of application (lead scoring, prequalification)
  • Systems used during origination (automated underwriting, fraud detection, document processing)
  • Systems used post-closing (servicing decisioning, loss mitigation, default management)
  • Marketing and customer service systems if they influence the loan pipeline that includes Fannie Mae-sold loans

A practical approach: inventory every AI/ML system in your mortgage technology stack. If any of them touch a loan that may be sold to Fannie Mae, the system is in scope.

The Fair Lending Layer

The fair lending testing requirement under LL-2026-04 is the area where most lenders are least prepared. Standard model risk management covers performance, drift, and stability. Fair lending testing is a separate discipline with its own methodology, its own tooling, and its own documentation requirements.

If your institution has not yet built a fair lending testing program for AI/ML, the August 6 effective date is the trigger to either build it or engage external support. The testing cadence is at least annual for high-impact systems, and the documentation must be available for Fannie Mae review on request.

Two common testing approaches:

  • Outcomes-based testing: Compare actual loan decisions, pricing, or other outcomes across demographic segments. Identifies disparate impact at the output level.
  • Input-based testing: Audit model features for proxies that correlate with protected classes. Identifies structural risk before the model produces an outcome.

The most defensible approach is both. Outcomes-based testing identifies what the model is doing. Input-based testing identifies how the model could produce a problematic outcome before it happens.

Action Steps for August 2026

If your institution has not yet built a LL-2026-04 program, the immediate priorities are:

This month: Inventory every AI/ML system in the mortgage technology stack. Identify model owners, deployment dates, and vendors. This is the foundation for everything else.

This quarter: Classify each system by risk tier. Document the validation activities already performed. Identify gaps relative to LL-2026-04 requirements.

By year-end: Complete the governance policy. Establish fair lending testing for high-impact systems. Build the vendor oversight program. Stand up the annual attestation process.

By Q1 2027: Complete the first attestation cycle. Document the validation work performed. Build the exam-ready binder.

Frequently Asked Questions

We Don’t Use AI/ML Anywhere. Does LL-2026-04 Still Apply?

If you genuinely use no AI/ML systems in connection with mortgages sold to Fannie Mae, the framework does not impose substantive obligations. The annual attestation, however, is still required — you attest that you have no in-scope systems. Document the basis for that conclusion (the inventory and the analysis) so the attestation is defensible.

What About AI Tools Used by Individual Loan Officers?

If a loan officer uses a third-party AI tool (e.g., a ChatGPT-style assistant) in connection with a loan, the tool is in scope. The lender’s vendor oversight program must cover the tool, including the data security and confidentiality controls.

How Does LL-2026-04 Interact With State AI Laws?

LL-2026-04 is a GSE framework. State AI laws are separate obligations. In most cases, the state law is additive — you must satisfy both. See the August 2026 article on state AI/ML enforcement for the specific state rules that apply to mortgage lenders.

What Records Must We Retain?

Three years post-decommissioning for each model, consistent with other mortgage compliance records. The retention applies to model documentation, validation results, fair lending testing, governance decisions, vendor contracts, and attestation records.

Ready to build or audit your AI/ML governance program? Synergy supports mortgage lenders with model inventory design, governance policy drafting, fair lending testing frameworks, and AI/ML exam-readiness reviews. Book a 30-minute governance review.

© Copyright 2017 Synergy. All Rights Reserved. - Designed by MPP Freelance
Web Statistics