AI mortgage compliance testing: what five agents check, and don't

AI mortgage compliance testing is software that reads a closed loan file, works out which disclosure rules apply, recomputes the figures the borrower was shown, counts the business days between each delivery and the closing, and returns a pass, fail or review for each rule with the page it rests on. Done well, it tests every closed loan rather than a sample, which is the point: TRID and TILA errors that examiners cite are mostly systemic, and a sample rarely lands on them. In Botminds' Loan Compliance Testing the work is split across five agents, because the jobs are different in kind: reading a page, choosing rules, doing arithmetic, counting a calendar and grouping results. Behind them sit two people, a compliance tester who resolves what the rules cannot settle and a testing manager who alone confirms a finding.

For a buyer, the question that separates one product from another is where the limits are, more than what the software can do. The table below is the division of labour on one test script: the Whitcombe loan, a fictional $412,000 wholesale purchase from the sample bank used throughout this series, tested against 26 of the 212 rules in the library in 41 seconds.

Can AI test loan files for TRID compliance?

Yes, for the parts of testing that are reading, arithmetic and counting, which is most of the hours; no, for the parts that are judgment about evidence and consequence. TRID testing is unusually well suited to software because almost every rule has an exact answer: a Loan Estimate is delivered by the third business day after application or it is not; an APR is within 0.125 of a point or it is not. What software cannot see is evidence that lives outside the file, such as whether a changed circumstance was real or whether discount points bought a rate, and what a failure means for the bank and its borrowers. A credible design draws that line on purpose and shows it on screen.

How does automated mortgage compliance testing work, agent by agent?

The run starts from the file, not from a data feed. A loan origination system holds what the lender thinks it disclosed; the Closing Disclosure is what the borrower actually received. Testing from the data alone tests the system against itself. In the sample bank's August run the file reader read 17,940 documents and 241,306 pages across 1,284 closed loans in four hours and 51 minutes, and every value it took carries the page and position it came from.

The file reader leaves a value blank rather than guess it

The file reader's job is extraction with a citation: each fee with its payer and its Closing Disclosure section, each date of issue, delivery and receipt, the rate and the lock date. On the Whitcombe file it took 214 values from 14 documents and 212 pages, plus the loan system's fee screen, in six and a half seconds. Its one hard rule matters more than its speed: a value it cannot find is marked missing, not inferred. A missing receipt date becomes a review for a person, not a presumed date.

That rule follows from what a test is for. A test that fills gaps with likely values passes files that ought to fail, and a check that cannot fail is not a check. The citation does the opposite job: a tester or auditor can open the page behind any result and see the same number the agent saw.

The rule selector explains every rule it leaves out

Not every rule applies to every loan. A purchase has no right of rescission; a fixed-rate loan has no adjustable-rate disclosures; a loan outside a special flood hazard area needs no flood notice. The rule selector reads the loan's product, lien, purpose, occupancy, state, channel and the application and closing dates, and chooses the rules from the library that apply. For the Whitcombe loan, a conventional first-lien purchase in Ohio closed on 14 August, that was 26 rules. Across August the selector chose 31,592 tests for 1,284 loans, about 25 a loan.

Each rule left out carries its reason, and the reason is visible. That is what lets a reviewer tell "not applicable" from "not tested". The library itself is not the agents' to change: rules and tolerances are versioned, dated and approved by the testing manager, and a new version is tested on the previous month's loans before it goes live.

One test script in Loan Compliance Testing: every rule with its page

Each result names a page: CD p.5, LE p.1. Selecting a row opens that page with the value marked.

The independent calculator never reads the APR it is checking

The calculator recomputes the figures the borrower was shown from their inputs: the payment stream and the itemised fees. It classifies each fee as a finance charge or not under §1026.4, rebuilds the prepaid finance charges and the amount financed, solves the actuarial APR, and compares the result with the disclosure against the tolerance in §1026.22. It does not start from the disclosed APR, because a test that starts from the answer inherits its errors.

On the Whitcombe loan the Closing Disclosure counted $10,423.27 of prepaid finance charges and showed 6.875%. The calculator counted $16,723.27, because the borrowers paid $5,150.00 of discount points and a $1,150.00 rate-lock extension fee that the disclosure left out. Solving 360 payments of $2,638.08 against an amount financed of $395,276.73 gives 7.031%, which is 0.156 of a point over and outside the 0.125 tolerance. The finance charge was understated by $6,300.00 against a $100 tolerance. The working is on the screen beside the page.

The APR rebuilt from the payment stream, fee by fee

The timing checker knows there are two kinds of business day

Regulation Z defines a business day twice. For most purposes it is a day "on which the creditor's offices are open to the public for carrying on substantially all of its business functions". For Closing Disclosure receipt, the seven-day wait before closing, revised Loan Estimate receipt and rescission, it is "all calendar days except Sundays and the legal public holidays" (12 CFR 1026.2(a)(6)). A Saturday counts in one count and may not count in the other. Testers who carry one calendar for both get some loans wrong in each direction.

The timing checker applies the right definition to each test. It also handles the mailbox rule: when a disclosure is not handed over in person, the consumer "is considered to have received the disclosures three business days after they are delivered or placed in the mail" (§1026.19(e)(1)(iv)). The checker uses that presumption only when there is no evidence of actual receipt, such as an e-signature, and says so on the result. In August it counted 11,556 deliveries in nine minutes. The Whitcombe Closing Disclosure was e-signed on Monday 10 August for a Friday 14 August closing: Tuesday, Wednesday and Thursday make three, so it passed.

The findings analyst groups the fails, and a person decides what they mean

A run of 1,284 loans produces hundreds of failed tests, and a list of 318 fails is not something a manager can act on. The findings analyst groups them by rule and cause, ranks them by severity and the number of loans affected, and looks for a shared factor: a branch, a channel, a product, a settlement agent, a change to the loan system. In the sample run it produced eight findings by 05:52. The first put seven wholesale loans under one cause: fee table v14, deployed on 28 July, coded the discount points and lock extension as seller-paid.

The analyst proposes; it does not decide. A proposed root cause is a hypothesis for the testing manager to accept or reject, and a proposed owner is a suggestion. Remediation, whether to re-disclose, refund or reimburse and how far back, is a business decision under the bank's own restitution policy. The agents never contact a borrower or change a loan.

Is automated compliance testing a model under model risk management?

The arithmetic is not; the reading may need governance of its own. The interagency model risk guidance of April 2026, which replaced SR 11-7, defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories" and says the term "excludes simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use" (Federal Reserve SR 26-2). An APR solve, a tolerance comparison and a business-day count are exactly that kind of deterministic process.

The same guidance places generative and agentic AI outside its scope "as novel and rapidly evolving", adding that a bank's "risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered". In practice that means a buyer should expect to govern the reading step as a third-party tool: know what it extracts, see the page behind every value, and measure how often it is wrong. That is the reason to keep the deterministic parts deterministic and to cite every value read.

Four limits apply to every agent in the solution: no agent confirms a finding, changes a loan, contacts a borrower or loosens a tolerance below Regulation Z. When a bank relies on software for a compliance conclusion, it still owns the conclusion: "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements" (Consumer Compliance Outlook, 2019).

The arithmetic is deterministic and the reading is cited. Everything between those two is a person's call, and the screen says whose.

Is AI compliance testing accurate? How to check before you buy

Accuracy is something to measure on your own loans, not to accept from a brochure, and there are three ways to do it. Replay a month your team already tested by hand and compare result by result. Feed it files with known answers, including planted errors. And check the calculator against the regulators' own tool: the OCC retired APRWIN "in favor of the FFIEC Federal Disclosure Computational Tools", whose APR tool "supports the process by which examiners and financial institutions can verify applicable calculations included on consumer loan disclosures" (OCC Bulletin 2020-40). A product whose APR disagrees with the FFIEC tool on the same inputs has a problem no interface will hide.

Measure four numbers: fails the software missed that your testers found, fails it raised that were wrong, the share of results it sent to a person, and new fails it found that your sample never reached. The first matters most, because a check that cannot fail is not a check. A high review share is not a defect in itself; it is honest about what a file can show. A pilot of mortgage compliance software on last month's loans sets those measures out in detail.

For the tolerances the calculator applies, field by field, see APR tolerance under Reg Z. For the one review the Whitcombe loan needed, see QM points and fees. The Loan Compliance Testing page follows the whole August run.

The month the agents tested, loan by loan

Questions people ask

Can AI replace mortgage compliance testers?

No. It replaces most of the reading and arithmetic, which is where the hours go, and leaves the tester the results a file cannot settle. In the sample bank's August run, 167 of 31,592 tests needed a person, and every finding still needed the testing manager's signature.

How do regulators view AI in compliance work?

Cautiously, and in the same terms as this design. Regulators told the GAO they use AI "to help detect errors or outliers in data" and were "not using AI to make decisions autonomously or relying on it as a sole source of input" (GAO, May 2025). We know of no regulator statement endorsing or barring AI for loan-file testing.

What happens when the file reader cannot find a value?

The value is marked missing and the test becomes a review, with the document that would settle it named. Nothing is filled in by inference, so a missing receipt date can never turn into a presumed one.

Does the calculator handle irregular transactions?

The rule selector picks the tolerance: 1/8 of a point for a regular transaction and 1/4 of a point for an irregular one, such as a loan with multiple advances or irregular payments, as §1026.22(a) defines it. The calculator then applies the matching tolerance to its own result.

How long must compliance testing evidence be kept?

Regulation Z requires a creditor to keep evidence of TRID compliance for three years, counted from the later of consummation or the date the disclosure or action was due, and each Closing Disclosure for five years after consummation (§1026.25(c)(1)). Many banks keep testing workpapers longer; the sample bank keeps them for seven.