Mortgage Compliance Q&A: Your Top Questions on the CFPB’s 2026 Deregulatory Wave, Answered

September 1, 2026 Synergy

Compliance officers have been asking us some version of the same ten questions all summer, so here are the straight answers on the CFPB’s 2026 mortgage rule changes — what’s already law, what’s still pending, and what to actually do about each one before Q4 exams.

Fair Lending and ECOA

Is disparate impact really gone from ECOA now?

Under federal law, yes. The CFPB’s final rule, issued April 22, 2026 and effective July 21, 2026, removed the “effects test” from Regulation B and affirmatively states that ECOA does not recognize disparate-impact liability. But several states retain independent disparate-impact standards under their own fair lending or UDAP statutes, so multi-state lenders should verify current state-level exposure rather than assuming full relief.

Should we shut down our statistical fair lending testing?

No. Keep it, but re-tier how you act on results. A marginal-effect or matched-pair finding is no longer independently actionable as a federal ECOA violation, but it’s still a useful early-warning signal for pricing or underwriting drift, and it may still be expected under state law or investor overlays. Treat statistical disparities as a trigger for deeper review, not an automatic finding.

What changed for Special Purpose Credit Programs?

The April 2026 rule prohibits using race, color, national origin, or sex as common characteristics defining SPCP eligibility, and adds documentation requirements for for-profit creditors running one. If you operate an SPCP built around those characteristics, get legal review immediately — this has been in effect since July 21, 2026.

Mortgage Servicing and Regulation X

Has the Regulation X loss mitigation overhaul been finalized yet?

Not as of the CFPB’s August 14, 2026 regulatory agenda, which still shows it as an active item in the final rule stage. Verify current status against the CFPB’s rules and policy page before making implementation timing assumptions. It’s the most mature mortgage item in the pipeline — originally proposed in July 2024 with a comment period that closed that September — so it’s the one most likely to finalize before year-end.

What’s the biggest change coming in that rule?

Removing the “complete application” framework that currently gates loss mitigation and foreclosure procedural protections, and replacing it with a continuous loss mitigation review cycle triggered by a borrower’s request for assistance — a materially earlier trigger point than current rules require.

Will state loss mitigation laws still require a complete application?

Possibly. Several states independently codify a completeness requirement for foreclosure protections, and industry commenters flagged this preemption question directly during the comment period. Servicers in those states should plan for potential dual compliance obligations rather than assuming automatic federal preemption once the final rule publishes.

Trigger Leads and Data Practices

Is the trigger lead restriction under the Homebuyers Privacy Protection Act still in effect?

Yes. The Homebuyers Privacy Protection Act, passed in September 2025, took effect March 4, 2026 and restricts consumer reporting agencies from sharing consumer credit report data for unsolicited marketing purposes — the trigger lead practice. Third parties can only receive that data with explicit consumer consent, unless they’re the consumer’s current mortgage originator, loan servicer, or have an established banking relationship with them. Lenders should confirm their consent capture process for any marketing lists sourced through CRA relationships is airtight, since this restricts the CRA side of the transaction but lenders still bear reputational and referral-source risk if a marketing partner isn’t compliant.

Broader Regulatory Calendar

What is Executive Order 14393 and why does it keep coming up?

Signed March 13, 2026 and titled “Promoting Access to Mortgage Credit,” it directs the CFPB and other federal financial regulators to review and reduce mortgage compliance costs, specifically naming ability-to-repay/QM requirements, TRID disclosure timing, and points-and-fees thresholds for small-balance loans. It’s the policy driver behind nearly every mortgage rulemaking currently active at the CFPB, including the ECOA rule and the pending Regulation X overhaul.

What is the current HPML special appraisal threshold?

For 2026, the threshold for higher-priced mortgage loans subject to special appraisal requirements increased from $33,500 to $34,200, under the routine annual CPI-based adjustment jointly announced by the CFPB, Federal Reserve, and OCC. Confirm your loan origination system reflects the current threshold.

Should we expect fewer CFPB exams given the Bureau’s funding situation?

Don’t count on it. The Bureau’s acting leadership told Congress it needs $279.6 million just to maintain statutorily required operations through the end of fiscal year 2026 (September 30, 2026), which signals constrained capacity — but constrained CFPB capacity often shifts exam and enforcement weight toward state regulators and other prudential agencies (FDIC, OCC, NCUA, state banking departments) rather than eliminating scrutiny. Multi-state lenders in particular should not assume a quieter exam calendar.

What’s the single most important thing to do this quarter given all of this?

Build a regulatory change log with one owner per item — ECOA/Reg B implementation, Regulation X readiness, trigger lead consent verification, HPML threshold accuracy, and the broader EO 14393 pipeline — rather than treating “CFPB changes” as one undifferentiated compliance project. The lenders who get exam findings this cycle won’t be the ones facing the most regulatory change; they’ll be the ones who never assigned clear ownership for tracking it.

A lot changed this year, and more is coming before year-end. Synergy helps mortgage banks, credit unions, and depository institutions turn regulatory change into a managed process instead of a scramble — explore our compliance services and fair lending compliance assessment, or book a 30-minute call to talk through where your program stands heading into Q4.

Regulatory Updates

CFPB Section 1071 Small Business Lending Data Collection

July 6, 2026 Synergy

The CFPB’s Section 1071 rule reshapes how mortgage lenders collect, store, and report data on credit applications from small businesses. For Tier 1 filers — the largest originators — the compliance date is July 1, 2026. For most mortgage lenders operating in the small business and commercial space, this is the most consequential data collection rule since HMDA.

On October 2, 2025, the CFPB finalized an interim final rule extending compliance dates for Section 1071 of the Dodd-Frank Act. Under the revised schedule, Tier 1 filers — those originating 2,500 or more covered small business credit transactions in each of 2024 and 2025 — must begin collecting and reporting data on or before July 1, 2026, with first filings due June 1, 2027.

For mortgage lenders, this is a meaningful expansion of the data collection perimeter. Until now, HMDA has been the dominant data regime. Section 1071 extends a parallel reporting requirement to small business lending, and the two regimes are designed to work together — examiners will increasingly look for consistency between them.

This guide walks through what Tier 1 status means for mortgage lenders, what counts as a covered application, the data points required, and how to build a Section 1071 program that holds up under CFPB examination.

Who Counts as a Tier 1 Filer

The CFPB’s tier structure is based on originator volume, not portfolio or servicing. Under the 2025 interim final rule, tiers are:

Tier 1: 2,500+ covered transactions in each of 2024 and 2025 — compliance date July 1, 2026 — first filing June 1, 2027.

Tier 2: 500–2,499 covered transactions in each of 2024 and 2025 — compliance date January 1, 2027 — first filing June 1, 2028.

Tier 3: 100–499 covered transactions in each of 2024 and 2025 — compliance date October 1, 2027 — first filing June 1, 2029.

Exempt: Fewer than 100 covered transactions in each year — not required to file.

Volume is measured at the legal entity level, not the holding-company level — though there are aggregation rules for commonly controlled entities. The CFPB has signaled that aggregation will follow Regulation B’s control-person framework, with limited exceptions for certain minority-owned institutions and CDFIs.

The threshold applies to covered credit transactions, not portfolio or servicing. If your institution has any commercial or small business lending activity and your overall originator volume puts you in any tier, you must include that activity in your Section 1071 count. The threshold is firm-wide, not line-of-business.

What Applications and Loans Are Covered

Section 1071 covers applications for credit from a small business. The CFPB’s definition of “small business” is the SBA’s size standard for the applicant’s industry — generally a business with $5 million or less in gross annual revenue (calculated across the applicant’s three most recent fiscal years) and 500 or fewer employees.

A “covered credit transaction” is a closed-end or open-end credit product originated for a small business, including:

Commercial mortgages and refinances
Commercial real estate loans
Working capital lines of credit
SBA-guaranteed loans
Equipment financing
Business credit cards (with limited exceptions for corporate cards)
Merchant cash advances (treated as credit under the rule)

Key exclusions include trade credit (credit extended for the purchase of goods and services from the creditor itself), public utilities, securities transactions, credit to financial institutions, credit to governments, and credit extended to a business with gross revenue above the size standard.

The 19 Data Points You Must Collect

For every covered application, the rule requires collection of 19 data points organized into three categories.

Applicant-Identifying Data

1. Legal name

2. Trade name (if different)

3. Address (physical, not PO Box)

4. Taxpayer Identification Number (TIN / EIN)

5. Application date

6. Application method (in-person, phone, online, mail)

7. Application recipient (where the application was submitted)

Application Characteristics

1. Application type (covered application, prequalification, or incomplete)

2. Action taken (approved, denied, withdrawn, incomplete)

3. Action date

4. Denial reason(s) — enumerated list (main reason + up to four additional)

5. Credit type (closed-end vs. open-end)

6. Credit purpose (working capital, equipment, real estate, etc.)

7. Amount applied for

8. Amount approved or originated

9. Term

Pricing Data

1. Interest rate

2. Total origination charges

3. Broker fees and lender compensation

Demographic data on the applicant’s principal owners (race, ethnicity, sex) is collected on a voluntary basis, consistent with the rule’s fair-lending intent.

Pricing data sensitivity: The pricing fields (interest rate, origination charges, broker fees) are the most contested parts of the rule. For mortgage lenders, these overlap with HMDA rate spread reporting. Treat 1071 pricing data as separate and validate at the loan level — examiners will compare 1071 pricing against HMDA LAR, internal loan files, and the closing disclosure.

Where Section 1071 Meets Mortgage Lending

For most residential mortgage lenders, Section 1071 will be a peripheral obligation. But the rule applies where the lines blur — and for diversified lenders, the overlap is significant.

Residential Mortgages That Touch 1071

Investment property mortgages held in the name of a small business entity (LLC, corporation, partnership) — not in the borrower’s personal name. These are commercial loans, even if secured by 1–4 family residential property.
Mixed-use property loans where the borrower is a small business.
Construction loans to small business developers, including single-purpose entity (SPE) borrowers.
Diversified lenders with both consumer mortgage and commercial / small business lending arms, where total originator volume pushes the institution into a tier.

Residential Mortgages That Do NOT Touch 1071

Personal mortgages on a borrower’s primary residence (HMDA-only)
Personal second homes and vacation homes (HMDA-only)
Refinances of personal mortgages (HMDA-only)
Reverse mortgages for individuals (HMDA-only)

The test is who the applicant is, not what the property is. Loans to individuals — even on non-owner-occupied investment property — are generally HMDA territory. Loans to small business entities are 1071 territory.

HMDA and 1071: The Overlap You’ll Want to Plan For

This is the part of Section 1071 that gives mortgage compliance officers heartburn — and the part examiners will look at most closely.

HMDA and Section 1071 both collect credit-application data. For the small (but growing) population of loans that could plausibly be reported under either regime, you need a clear written policy on which regime applies and why. Examiners will compare:

Total application counts under HMDA vs. 1071
Volume consistency between HMDA LAR and 1071 data
Denial reason patterns across both regimes
Pricing data, where both regimes capture rate-related fields
Demographic data handling (both are voluntary but collected separately)

The CFPB and prudential regulators have signaled that cross-regime consistency will be a supervisory priority beginning in 2027. Build the policy now, while you have time.

Building a Single Source of Truth

For institutions in scope for both HMDA and 1071, the right architecture is a single application-level data store that feeds both regimes — not two parallel pipelines. This reduces data integrity risk, simplifies examiner requests, and improves your ability to identify and remediate discrepancies.

Building a Defensible Compliance Program

A Section 1071 program that will survive CFPB examination has five moving parts.

1. Written Policies and Procedures

Your 1071 policy should document tier classification and how it was determined; scope (which products, which channels, which entities are included); application intake process; data storage and retention (3 years from application date); reporting process; quality control; exception handling; training requirements; and oversight and audit cadence.

2. Application Intake Controls

Capture the data points at the point of application, not after origination. The intake controls should include LOS / origination system integration that captures the data at submission, validation rules at the field level, required-field enforcement on the controlled fields, and a demographic data collection workflow.

3. Data Quality Controls

Pre-submission QC is the single biggest determinant of exam-readiness. At minimum: reconciliation against origination system totals, reconciliation against HMDA LAR (for any overlap), denial reason accuracy check on a sample basis, pricing data validation against closing disclosures, and edit checks before submission.

4. Filing Platform Readiness

The CFPB is building a dedicated filing platform for Section 1071 (parallel to the HMDA Platform). Confirm your institution’s readiness to integrate with the platform ahead of your first filing deadline.

5. Exam-Readiness Documentation

Maintain an exam binder that includes the Section 1071 written policy, tier classification analysis with supporting data, data lineage documentation (where each field comes from), QC results for the most recent filing, reconciliation against HMDA LAR for overlap period, and any voluntary demographic data collection materials.

Compliance Timeline and What to Do by July 1

If you’re a Tier 1 filer with a July 1, 2026 compliance date, the clock is short. Here’s the practical action sequence:

Now: Confirm tier classification using 2024 and 2025 originator volume.
Now – end of month: Stand up the written policy and get it approved by compliance committee.
Next 60 days: Map current data capture against the 19 data points; identify gaps.
Next 90 days: Update LOS / origination systems to capture missing fields.
Next 120 days: Train intake and operations staff.
By July 1, 2026: Begin collecting all 19 data points on every covered application.
By Q4 2026: Run your first pre-submission QC cycle.
By Q1 2027: Validate the full pipeline end-to-end with test data.
June 1, 2027: First filing due.

Frequently Asked Questions

Do I Have to Collect Demographic Data on the Applicant’s Owners?

No — demographic data (race, ethnicity, sex) is collected on a voluntary basis. You must offer the applicant the opportunity to provide it, but you cannot require it, and you must clearly disclose that providing the information is voluntary.

What If My Institution’s Originator Volume Was Above the Tier 1 Threshold in 2024 but Below in 2025?

You must meet the threshold in both years to qualify for Tier 1. If you drop below in either year, you move down a tier (or become exempt).

How Does Section 1071 Interact With State-Level Small Business Reporting?

Several states have their own small business lending reporting requirements (notably California and New York). Section 1071 is federal and preempts conflicting state requirements. You still need to file state reports, but Section 1071 is the floor, not the ceiling.

Can I Use Third-Party Vendors to Handle Section 1071 Compliance?

Yes — most lenders will use LOS providers, compliance platforms, or specialized 1071 vendors to handle data capture, validation, and filing. Vendor selection and oversight is itself an exam topic, so document your due diligence and ongoing monitoring.

What Records Must I Retain?

Three years from the date of application. Records must be sufficient to reconstruct the application data as it was reported, including the response to any voluntary demographic question.

Ready to review your Section 1071 readiness before July 1? Synergy supports mortgage lenders with policy drafting, data-mapping, QC buildout, and pre-filing readiness reviews. Book a 30-minute readiness call.

Regulatory Updates

CFPB Fair Lending Rule 2026: What Mortgage Lenders Must Do Before July 21 to Stay Compliant

June 3, 2026 Synergy

What the CFPB Fair Lending Rule Means for Mortgage Lenders

The CFPB fair lending rule issued April 22, 2026, is one of the most consequential shifts in mortgage fair lending enforcement in decades — and it takes effect July 21. If your QC program hasn’t been updated to reflect the new intent-based standard, you’re behind.

For mortgage lenders, servicers, and quality control professionals, this is not a routine update. It is one of the most consequential regulatory shifts in fair lending enforcement in decades. And with the July 21 effective date approaching fast, lenders who haven’t begun adapting their compliance frameworks need to act immediately.

What Changed: Understanding the Regulation B Final Rule

The End of Disparate Impact Under Regulation B

The most significant change is the removal of the disparate impact standard from Regulation B. For years, lenders could be held liable under ECOA even without evidence of intentional discrimination — if a policy or practice had a “disproportionate adverse impact” on a protected class, and the lender couldn’t demonstrate “business necessity.”

The CFPB’s final rule eliminates this framework. ECOA, as interpreted through Regulation B, is now an intent-based statute. Liability will require showing that a lender intentionally discriminated on a prohibited basis.

It is critical to note: this change applies specifically to Regulation B. Other federal fair lending laws — including the Fair Housing Act — retain their disparate impact frameworks. HUD’s separate rulemaking on the FHA’s disparate impact standard remains ongoing. Lenders must not conflate the two.

Narrowed Discouragement Standard

The rule also tightens what constitutes “discouragement” under Regulation B. The prior standard captured a broad range of statements, practices, and even inaction that could discourage applicants. The new rule limits discouragement to explicit exclusionary messaging — making it harder for regulators to pursue claims based on ambiguous or indirect conduct.

New Restrictions on Special Purpose Credit Programs

Special Purpose Credit Programs (SPCPs) — programs designed to address historical discrimination by extending credit to underserved borrowers — remain permitted but face new procedural requirements and limitations under the final rule.

Why the CFPB Issued This Fair Lending Rule

The CFPB under Acting Director Russell Vought framed the rule as a return to “core statutory principles,” arguing that disparate impact liability was not authorized by the text of ECOA. The regulatory relief narrative also fits within the broader policy direction of the March 13, 2026 Executive Order, “Promoting Access to Mortgage Credit,” which signaled an intent to reduce compliance burden on lenders, particularly smaller institutions.

What This Means for Your QC Program

The elimination of disparate impact does not mean fair lending compliance becomes optional — it becomes different.

From Statistical Scrutiny to Intent Review: Your QC processes likely include statistical analysis — HMDA data reviews, denial rate comparisons across demographics, pricing disparities. While these remain valuable compliance tools, the legal standard for liability has shifted. QC teams must pivot toward identifying specific discriminatory intent in individual transactions or clearly discriminatory policies.

Updated Policies and Procedures: Lender fair lending policies must be updated to reflect the new intent-based framework. Discouragement policies, in particular, need to be redrawn to reflect the narrowed standard. Failure to update internal guidance before July 21 creates immediate mortgage compliance risk.

Enhanced Documentation of Intent: When reviewing loan files for fair lending red flags, QC reviewers should document not just statistical patterns but evidence of intent. What was said, what was written, what policy decisions were made — these become the evidentiary basis under the new standard.

AI/ML Accountability Gains New Urgency: Freddie Mac’s AI/ML governance requirements, codified in Guide Section 1302.8 and effective March 3, 2026, remain firmly in force and gain new importance in this environment. If a lender’s AI-driven underwriting or pricing models produce discriminatory outputs, intentional use of that tool could constitute intentional discrimination — regardless of the removed disparate impact standard. Lenders bear full responsibility for AI-driven decisions affecting loan outcomes.

HUD Fair Housing Act Remains Separate: Don’t conflate the Regulation B change with the Fair Housing Act. HUD has signaled a narrower enforcement focus, but the FHA’s disparate impact standard is a separate legal question. Both laws remain active and enforceable.

Key Action Steps Before July 21, 2026

1.Audit your fair lending QC protocols. Identify where your current program is built around disparate impact analysis and adapt accordingly.

2.Update internal policies and procedures. Align policy language with the new intent-based standard and narrowed discouragement definition.

3.Retrain QC staff and underwriting teams. Ensure everyone understands the shift from statistical to intent-based review.

4.Review all SPCPs. Confirm that any special purpose credit programs your institution offers meet the new procedural requirements.

5.Stress-test your AI governance framework. If you use AI or ML in loan origination, underwriting, or servicing, confirm that your governance documentation satisfies Freddie Mac Section 1302.8 requirements.

6.Engage legal counsel. Given the scope of this change, legal review of your compliance program before the effective date is strongly recommended.

The CFPB Fair Lending Rule in the Context of 2026 Regulatory Changes

The Regulation B final rule is one piece of a broader reshaping of mortgage regulation. The March 13 executive order also directs the CFPB to reconsider ATR/QM requirements and potentially modify TRID disclosure rules. HUD has updated fair housing guidance. Annual Regulation Z threshold adjustments took effect January 1, 2026. The volume of change is significant, and lenders who adapt fastest — with sharp, well-informed QC programs — will be best positioned to navigate the months ahead.

Stay Ahead of the Compliance Curve

The mortgage regulatory landscape in 2026 is shifting faster than many anticipated. New fair lending standards, AI governance mandates, executive orders on credit access — the pace of change demands more than static compliance procedures. It demands a proactive, adaptive quality control partner.

At Synergy, we specialize in helping mortgage lenders and servicers stay ahead of these developments. Our quality control and compliance solutions are built to evolve as the regulatory environment shifts — so your team doesn’t have to manage it alone.

Ready to review your QC program ahead of the July 21 effective date? Contact Synergy today to speak with a compliance specialist or book a demo of our quality control platform at simplifyqc.com.

Archives