Quality Control

Thursday, 9:40 a.m. A fair lending review pulls thirty declined applications from last month. Every adverse action notice is on time. Every reason is specific. Every disclosure is signed. On file 19, the notice lists two reasons — and neither one is why the file was declined. The loan officer’s notes say something else entirely.

Nobody approved that step. Nobody owns it. The reason codes on those adverse action notices are not in the QC checklist, the mapping from policy screen to decline reason is not in the exception log, and nobody has reconciled a reason to what drove the decision since the models changed.

This is the least dramatic version of what just happened to mortgage compliance.

What the CFPB Published on October 1

On October 1, 2026, the CFPB released its Fair Lending Report for 2025 to Congress. The enforcement numbers look like a retreat. The Bureau closed 76% of its supervisory actions — nearly 1,500 matters — roughly 12% of them fair-lending related. It initiated no new fair lending supervisory activity, cited no institution for a fair lending violation, and made no ECOA referrals to the Department of Justice. Across the eleven agencies with ECOA enforcement authority, 140 institutions were cited for ECOA or Regulation B violations, and no public ECOA enforcement action was brought in 2025.

Here is the part that should change your review schedule. The same report says ECOA examination work now focuses on three things: direct evidence of intentional discrimination on a prohibited basis, systemic failures to provide applicants with legally required notices of adverse actions, and the systems a lender uses to identify ECOA and Regulation B risk. HMDA exam work focuses on validating the accuracy of key data points.

Read that list again. Two of the three ECOA exam priorities are about the file in front of you, not the portfolio behind you. The statistical screen you scaled back in July is not what a 2026 exam is testing. The notice is.

Then on October 14, the OCC released Guaranteeing Fair Banking for All Americans, its review of debanking practices at the nine largest national banks it supervises — JPMorgan Chase, Bank of America, Citibank, Wells Fargo, U.S. Bank, Capital One, PNC, TD and BMO. The review covered September 2020 through September 2025, drawing on nearly 100,000 complaints and about 50,000 documents totaling roughly 420,000 pages. The OCC found broad reputation risk policies lacking clear standards and objective, risk-based criteria, plus industry-specific restrictions on oil and gas, coal, firearms, detention facilities, tobacco and digital assets.

Be precise about what that report does and does not say. It identifies no violation of law and announces no enforcement action. It did remove reputation risk from the OCC’s own supervisory framework, issue Bulletin 2025-22 allowing debanking to be considered in licensing and CRA exams, and signal further rulemaking. Hours later, the CFPB announced it will fully investigate whether the institutions in the report and others complied with federal consumer financial laws — naming ECOA, FCRA “particularly the adverse action notice requirements,” and UDAAP.

Four Risks That Replaced the Statistical Screen

Stripped down, a fair lending file is one of four things, and they are nowhere near equal in risk. The tiers are our suggested placements for your own scoring — no examiner grades declination files for you, so treat them as a starting position, not an official classification.

The inaccurate reason. The notice is timely, specific, and still wrong, because the reason the borrower was given is not the reason the file was decided. The CFPB has named systemic failures in adverse action notices as an exam priority, so a notice that cannot be tied to the decision is a finding waiting for a file. Our suggested tier: High.

The reputation-risk screen. A decline that passed through a policy screen — an industry, a brand, an ESG or reputation review, a manual escalation — and left no trace on the notice, because the screen is not a “credit reason.” The risk is what the OCC documented: criteria broad enough to apply inconsistently, and outcomes nobody can reconstruct later. Our suggested tier: High.

The stale notice regime. Templates, timing and disclosures that were correct in 2024 and have not been re-read since. Section 1002.9 was not amended by the April rule, so the 30-day notice requirement and the specific-reasons standard still apply exactly as they did. The risk is that the file reads like a rulebook from a year ago. Our suggested tier: Moderate.

The data that does not reconcile. HMDA data points that do not tie back to the source document, or a reason code in the loan system but not on the notice. The exam focus the CFPB named for HMDA is the accuracy of the key data points. Our suggested tier: Moderate.

The line worth memorizing: a statistical test tells you what your portfolio looks like. An adverse action notice tells the examiner what your lender did to one applicant.

What the Rules Actually Say Now

Last verified against primary sources October 21, 2026. This is a moving target — state law changes and the regulators are still writing. Re-verify before you rely on any of it.

What the April rule changed, and what it did not

Start with what did not change, because the volume of material saying otherwise is the problem. The CFPB’s final rule amending Regulation B was published April 22, 2026 and took effect July 21, 2026 (91 FR 21620, Docket No. CFPB-2025-0039). It removed the effects test and states ECOA does not authorize disparate impact liability. It did not amend 12 CFR 1002.9: the duty to give the specific principal reasons for adverse action within 30 days of a completed application is untouched, as is FCRA’s adverse action requirement and the credit score key factor disclosure. Disparate treatment survives in full under ECOA.

And the rule amended Regulation B only. Disparate impact remains available under the Fair Housing Act, which the CFPB cannot amend, under HUD’s FHA disparate impact standard, whose rulemaking is still open, and under state regimes — New Jersey, New York, and Illinois from January 1, 2027 — plus private litigation. We covered that in why state fair lending rules now drive your testing and in what the ECOA rule eliminated and what lenders must fix in fair lending QC. The short version has not changed.

The scope of what the CFPB can actually reach

One scope point, and it matters. ECOA reaches credit, not deposit accounts, and does not list political beliefs as a prohibited basis. The OCC placed state-law compliance outside its scope. So the live theories are the three the CFPB named: ECOA, FCRA — especially the adverse action notice requirements — and UDAAP. Debanking is the context. The document you can be held to is the notice.

Watch three things. HUD’s FHA disparate impact rulemaking. State adoption of new testing expectations, and the multi-state letter opposing the federal rule. And further OCC rulemaking on reputation risk and pretextual account terminations.

The risk nobody has absorbed

The risk most operators have not absorbed is the mapping. The CFPB now describes an exam that looks for a lender’s systems for identifying ECOA risk and for systemic failures in adverse action notices. Accurate reasons with no evidence that the reasons came from the decision is half of what that exam needs. The Massachusetts Attorney General’s 2025 Earnest settlement is the most detailed published template of what a state regulator expects: interpretable models, every decline reason validated, principal reasons stated specifically and accurately. It binds one lender, not you — but it is a template you can be examined against.

The Numbers Vendors Want You to Believe

Before the controls, a word about the arithmetic, because these numbers will reach a board deck whether you are ready or not. The headline number in fair lending software right now is relief: disparate impact testing is no longer a federal requirement, the effects test is gone, and the statistical review that ate a quarter of your compliance calendar can be scaled back. For ECOA that is largely true, and we wrote about it.

The second number is certainty, and that is where the risk is. Some vendors still sell disparate impact testing as the requirement it no longer is. Some sell “compliant with the 2026 Reg B” as if the April rule resolved fair lending exposure. Others quote guidance the CFPB has withdrawn — 67 documents, seven fair-lending related, in May 2026 — while vendor pages kept citing a “CFPB Circular 2026-03” that does not exist.

Which regime are you actually answering to? A vendor’s “compliant” claim is a claim about ECOA. Your book is also covered by the Fair Housing Act, HUD’s FHA standard, and the state regimes where you operate. Ask which regimes it maps to.
What is the denominator? Coverage of a statistical test is not coverage of the notice. A product that scans your portfolio and reports a pass has not tested one declination notice.
What is the measurement window? Ask when the vendor last reviewed its regulatory content against the April 22 rule and the July 21 effective date. Where guidance is withdrawn quarterly, content with a 2024 review date is a liability.

Keep the ROI column separate from the evidence column. A lender with both a credible efficiency claim and a defensible file walks into a review with an answer. A lender with only the first one is negotiating one.

Six Controls to Put Around Your Adverse Action Process

None of this requires a data scientist. All of it is something an examiner can ask for on the record.

Test the notice against the file, not the template. Pull the notice and the credit file together. Confirm the reasons on the notice are reasons that appear in the file, and that nothing else drove the outcome.
Map every decline reason to what actually drove the decision. If a model or a policy screen is in the path, document the mapping and validate it the way the Massachusetts settlement describes: interpretable models, every reason validated, no reason invented to fill a menu.
Inventory every screen that can end a file. Reputation risk, brand, ESG, industry, manual escalation. For each, write down the objective criteria, who applies it, and where it shows up in the file. A screen that can decline a file and never appears on the notice is the gap the OCC documented.
Stop letting reason codes be a dropdown. The Earnest assurance alleged that staff picked an available reason when the real one was not on the menu, and that auto-generated reasons sometimes produced nothing specific. Both are cheap to prevent, expensive to catch.
Reconcile your HMDA data points to source. The exam focus is accuracy. Sample the fields, trace them to source, and fix the definition, not the file.
Date and version your fair lending policy. Record what changed, when, on whose authority, and re-verify the citations before each exam cycle. A 2024 review date is a finding waiting to happen.

Where to Start on Monday

You do not need a program. You need a week. Pull thirty declination files closed in the last 90 days. For each, produce the notice, the credit file, the reason-code mapping, the source of the decision, the policy behind any screen, and the HMDA data points. Any gap you find now is a roadmap. The same gap, found by an examiner, is a finding — and if you would rather someone else pull the sample, our fair lending compliance assessment runs that review.

Adverse action notices are the cheapest artifact in a mortgage file and the most expensive one to get wrong. The CFPB has told you what it is looking at. Now it is whether your file can answer it.

Compliance guidance for discussion, not legal advice. Requirements vary by lender, product, and state, and state adoption is still moving. Consult counsel on your facts.

Synergy supports mortgage banks and credit unions that have to answer for fair lending in a file, not a slide deck — adverse action notice review, declination file testing, and policy work that holds up on the record. Book a 30-minute call and we will send our one-page declination review checklist for last quarter’s files.

The biggest FHA quality control changes in years arrived in June 2026 with very little fanfare, and many lenders are still running QC plans written for the old rules. Mortgagee Letter 2026-09 and Mortgagee Letter 2026-10, both effective immediately, removed the requirement to obtain appraisal field reviews on 10% of QC-selected loans, eliminated the mandate to analyze loan performance data for patterns of noncompliance, and made the early payment default exception for disaster areas permanent. If your written QC plan still describes those requirements as mandatory, it no longer matches HUD policy, and that gap is exactly what an auditor will notice first.

Here is what changed, what did not, and how to rewrite your plan so it holds up.

The Five Mortgagee Letters HUD Issued in June 2026

HUD issued five Mortgagee Letters together in June 2026 (HUD’s summary is dated June 23, 2026), all framed as burden reduction under Executive Order 14393, Promoting Access to Mortgage Credit. HUD stated the changes will be incorporated into HUD Handbook 4000.1. Two of them go directly to your QC program:

Mortgagee Letter 2026-09, Eliminating Requirements for FHA Mortgagee Approval and Quality Control. Effective immediately.
Mortgagee Letter 2026-10, Updates to FHA Quality Control Requirements for Appraisal Field Reviews. Effective immediately.

The other three touch operations your QC team reviews:

Mortgagee Letter 2026-06 raised the number of disbursements allowed per draw request under the Limited 203(k) program.
Mortgagee Letter 2026-07 permanently rescinded Form HUD-92900-B, Important Notice to Homebuyers. You no longer provide it at application or retain a signed copy.
Mortgagee Letter 2026-08 updated loss mitigation requirements, including trial payment plan rules. It was optional on issuance and mandatory no later than September 21, 2026.

If your pre-funding or post-closing checklists still test for an executed HUD-92900-B, remove that line item now. Citing a defect against a document HUD no longer requires inflates your defect rate and distorts your trending.

FHA Quality Control Changes in Mortgagee Letter 2026-09

Trend analysis of loan performance data is no longer a stand-alone mandate

Before ML 2026-09, FHA required lenders to review their loan performance data for patterns of noncompliance, and to document the methodology, the results, and any corrective action taken. That requirement is gone.

HUD gave three reasons. Other FHA policy already requires lenders to expand loan-level QC reviews when fraud or patterns of deficiencies surface. Focusing on loan quality, not loan performance, is the more direct way to find control weaknesses. And HUD’s Credit Watch termination provisions indirectly address performance anyway.

What this means for you: you can stop producing a separate FHA loan-performance analysis solely to satisfy HUD. You should not stop trending your QC findings. Fannie Mae and Freddie Mac still expect management reporting and trend analysis of QC results (verify current requirements in Fannie Mae Selling Guide Subpart D1 and Freddie Mac Guide Chapter 3402), and HUD can still pull your approval if your early default and claim rates run too high relative to your peers under Credit Watch (verify current compare-ratio thresholds). Losing the FHA mandate does not remove the business reason to watch performance. It removes the FHA-specific paperwork.

Permanent EPD review exception for presidentially declared disasters

FHA requires lenders to review all loans that experience an early payment default, whether or not the lender services the loan. ML 2026-09 creates a permanent exception when the property is in a Presidentially Declared Major Disaster Area. The exception applies only if both conditions are met:

The loan closed before the start of the incident period FEMA established for the disaster.
The default occurred after the start of that incident period.

HUD had previously issued repeated waivers for disaster-related EPDs. Its reasoning is sound: defaults after a hurricane or wildfire usually trace to job loss, property damage, or relocation, not to underwriting defects.

What this means for you: build the exception into your EPD intake process, but document it loan by loan. Record the FEMA declaration number, the incident period start date, the closing date, and the date of default. A loan that closed one day after the incident period began does not qualify. Because the exception removes loans from review entirely, expect auditors to sample excluded EPDs and ask you to prove eligibility.

Officer in Charge and access to FHA guidance

ML 2026-09 also removed the requirement that a lender’s Officer in Charge be a full-time employee working exclusively for the lender. The OIC must still be a corporate officer designated to manage FHA operations. It also dropped the requirement to give loan administration and QC staff access to FHA guidance online or in hard copy, since all current guidance is online and lenders remain responsible for compliance either way.

Neither change requires a QC plan rewrite, but update your FHA approval file and organizational documentation if you restructure the OIC role.

Mortgagee Letter 2026-10: Appraisal Field Reviews Are Now Optional

Under the prior rule, lenders had to obtain appraisal field reviews on at least 10% of FHA loans selected for origination and underwriting QC review. ML 2026-10 removes that quota. Field reviews are now an optional component of appraisal QC, used when needed to adequately assess whether the appraisal report complies with FHA requirements.

HUD’s stated rationale is cost. Field reviews often cost more than the risk they mitigated, especially when lenders were already using third-party tools and desk reviews.

This is the change most likely to be mishandled. “Optional” does not mean “eliminated.” You still own appraisal quality, and you still have to show how your QC process tests it. A plan that simply deletes the field review section leaves an obvious hole.

Replace the quota with a risk-based trigger

The better approach is to replace a fixed percentage with defined triggers. A defensible appraisal QC section should state:

Baseline testing: every QC-selected FHA loan gets an appraisal desk review against FHA property and appraisal requirements, including minimum property requirements and the appraiser’s FHA roster status.
Escalation triggers: a field review is ordered when the desk review or an automated valuation tool flags a material variance, when comparables appear unsupported, when the property type is higher risk (for example, manufactured housing, 2-4 units, or rural properties with thin comparable data), or when an appraiser or appraisal management company shows a pattern of findings.
Pattern response: repeated findings tied to one appraiser, AMC, branch, or loan officer trigger targeted field reviews and expanded sampling.
Documentation: the reviewer records why a field review was or was not ordered.

That structure keeps your appraisal QC credible, cuts unnecessary spend, and gives an auditor a clear decision logic to test.

What Did Not Change

Lenders sometimes read burden-reduction letters as broader than they are. The core of FHA’s QC framework in Handbook 4000.1 is intact:

You still need a written QC plan that covers origination, underwriting, and servicing, as applicable.
You still sample loans for full QC review on a monthly basis (verify the current sampling standard in Handbook 4000.1, commonly 10% of closed loans or a statistically random sample at a 95% confidence level with 2% precision).
You still review early payment defaults outside the new disaster exception (verify the current EPD definition in Handbook 4000.1).
You still expand review scope when you identify fraud or patterns of deficiencies.
You still report findings to senior management and track corrective action to completion.
You still self-report material findings through the Loan Review System as required.

Six Steps to Update Your FHA QC Plan

Here is the work, in order:

Redline the plan against ML 2026-09 and 2026-10. Strike the 10% field review requirement and the stand-alone performance-data analysis. Add the disaster EPD exception with its two eligibility tests.
Rewrite the appraisal QC section around desk reviews and escalation triggers, as described above.
Retire the HUD-92900-B checklist item and any defect codes tied to it, so your defect rates stay comparable over time.
Confirm your loss mitigation procedures reflect ML 2026-08, which became mandatory September 21, 2026, if you service FHA loans or review servicing files.
Keep your trending, but reframe it. Trend QC findings by defect category, channel, branch, underwriter, and vendor. That analysis still satisfies GSE expectations and is your early warning for Credit Watch exposure.
Date and approve the revision. Record the effective date of each change, who approved it, and the governing Mortgagee Letter. A plan with a June 2026 policy change and no 2026 revision date tells an auditor your program is not maintained.

If you outsource post-closing QC, send your vendor the revised plan and confirm in writing that their FHA checklists and sampling logic have been updated. Your vendor’s checklist is your QC program in practice.

Why This Matters Beyond FHA

These FHA quality control changes fit a broader 2026 pattern. Regulators are removing prescriptive, fixed-percentage requirements and replacing them with an expectation that lenders apply documented, risk-based judgment. That is good news for efficiency. It also shifts the burden. When the rule said “10%,” compliance was a count. When the rule says “as needed to adequately assess,” compliance is an argument, and you need the documentation to win it.

Our compliance services team has been helping lenders redline QC plans against the June Mortgagee Letters. You can read the source documents directly: Mortgagee Letter 2026-09 and Mortgagee Letter 2026-10.

Frequently Asked Questions

Do we still have to obtain any FHA appraisal field reviews?

No fixed number is required anymore. Under Mortgagee Letter 2026-10, field reviews are optional and used when needed to adequately assess an appraisal’s compliance with FHA requirements. You still need a documented method for testing appraisal quality, and field reviews remain the right tool when desk reviews or automated tools flag material concerns.

Can we stop tracking FHA loan performance entirely?

You can stop producing the stand-alone FHA performance-data analysis that ML 2026-09 removed. You should keep trending QC findings and monitoring early defaults. GSE QC requirements still expect trend analysis, and HUD’s Credit Watch program still evaluates your default and claim performance against peers.

Which early payment defaults qualify for the disaster exception?

The property must be in a Presidentially Declared Major Disaster Area, the loan must have closed before the FEMA incident period began, and the default must have occurred after the incident period began. Document all three facts in the file. If any one is missing, review the EPD under your normal procedures.

When do these FHA quality control changes take effect?

Mortgagee Letters 2026-09 and 2026-10 were effective immediately on issuance in June 2026. Mortgagee Letter 2026-08 on loss mitigation was mandatory no later than September 21, 2026. Your QC plan should already reflect all three.

Need help rewriting your FHA QC plan or recalibrating your appraisal review triggers? Synergy supports QC and compliance teams at mortgage banks and credit unions nationwide. Book a 30-minute call to talk through your program.

Archives

Adverse Action Notices: What the CFPB Will Actually Examine Now