Loan compliance testing, explained.

What loan compliance testing is: a post-closing compliance review done the way an examiner does it

From application to a signed workpaper: the Whitcombe loan's five stages

1. Application and disclosuresThe Whitcombes apply on Thursday, June 4, 2026. A Loan Estimate goes the next day; the rate is locked on Wednesday, June 17.
2. ClosingThey receive the Closing Disclosure on Monday, August 10 and sign on Friday, August 14. Their loan becomes one of 1,284 the bank closes in August.
3. The loan is testedRules picked for this loan; APR, finance charge and points and fees rebuilt; dates counted; notices checked; every result tied to a page. This is where a fee coded to the wrong payer is caught.
4. Findings are confirmedFailed tests grouped by cause, ranked, confirmed by the testing manager and sent to the business owner who must fix them.
5. Remediation and the workpaperBorrowers re-disclosed or reimbursed, the system fixed, later loans re-tested, and the testing workpaper signed for audit and the examiners.

Step 3 is the subject of this guide. The bank, borrowers and figures in this example are fictional.

Four surprises for someone new to mortgage compliance testing

Tolerance, APOR, finding, workpaper: four terms of the trade

Fourteen terms are defined in the one-page summary.

Nine families of rules a closed-mortgage compliance test runs, and where each one's evidence lives

In shortA typical test of a closed first-lien mortgage runs two to three dozen checks drawn from nine families: the Truth in Lending loan calculations, TRID timing, TRID fee tolerances, RESPA notices, the Equal Credit Opportunity Act appraisal copy, the higher-priced and high-cost tests, flood insurance, state overlays, and the match between the loan system and the documents. Some can be settled from the forms alone; others need the rate sheet, the lock record, the delivery log or the loan system's fee screen.

This guide covers the whole test. Several of its parts have complete guides of their own that go deeper than this one can: the TRID fee tolerance guide works through buckets, changed circumstances and cures; the mortgage quality control guide covers the investor-driven QC sample and defect grading; the SCRA and MLA guide and the adverse action notice guide cover servicemember rules and decline letters.

Regulation Z's 2026 dollar limits, and why a federal pullback left every test in force

In shortThe accuracy tolerances, the price tests and the notice rules are the same in 2026 as in 2025. The dollar limits for high-cost mortgages and qualified mortgages were indexed on January 1, 2026: the QM points and fees limit is 3% for loans of $137,958 or more. The CFPB has narrowed its supervision and ended some orders early, but the FDIC, the Federal Reserve and the states still examine, and the law still lets borrowers sue.

The 2026 numbers a test must use

The tiers mean a test must place each loan by its note amount first, then apply the percentage to the total loan amount, a figure built from the amount financed. The CFPB's commentary (comment 43(e)(3)(i)-2) says the tier is chosen "based on the face amount of the note" while the percentage applies to the "total loan amount", which may differ.7 Section 05 works the difference through on a real-sized loan.

Who still examines mortgage disclosures in 2026

Rebuilding the APR and finance charge from the payments: the Whitcombe loan, line by line

In shortSort every fee the borrower paid into finance charges and other charges; subtract the prepaid finance charges from the loan amount to get the amount financed; solve for the rate that makes the payments worth exactly that amount. Compare the result with the disclosure. On the Whitcombe loan, two fees left out of the finance charge make the APR 0.156 points too low and the finance charge $6,300 too low, both past their tolerances.

Page 5 of the Closing Disclosure states the price of the loan three ways: the amount financed, the finance charge in dollars and the APR as a yearly rate. The test works each one out again from two things the file holds for certain, the payments in the note and the fees on page 2, then measures the gap against the tolerance Regulation Z allows. Each step below says what to do; the panel beside it shows the Whitcombe numbers.

The APR and finance charge test on the Whitcombe loan, in six steps

Where the loan calculations go wrong

Higher-priced, high-cost and QM points-and-fees tests, with bona fide discount points worked through

In shortThree federal price tests compare the loan with the average prime offer rate for the week the rate was locked: a higher-priced mortgage loan needs escrows and stricter appraisals; a high-cost mortgage triggers HOEPA's restrictions and its own disclosure; a loan whose points and fees exceed the QM limit loses qualified mortgage status, with no cure for loans consummated after January 10, 2021. Discount points can be left out of the count only if they bought the rate down, which takes the lender's rate sheet to prove.

The three federal price lines, and what crossing each one brings

A tester takes the Whitcombe loan through all three in this order: first the two rate tests, which compare the APR with APOR, then the points-and-fees count, which feeds both the HOEPA test and the QM test.

The higher-priced and HOEPA rate tests on the Whitcombe loan, in four steps

The Whitcombe points and fees, counted in five steps

Points and fees for the QM and HOEPA tests start from the finance charge and remove interest, some mortgage insurance, bona fide third-party charges the lender does not keep, and qualifying bona fide discount points; they add loan originator compensation and some real-estate charges.12

Were the Whitcombe discount points bona fide?

Six results for the Whitcombe loan

State high-cost overlays: New York's triggers and Fannie Mae's list

States add their own high-cost and anti-predatory tests, with different indexes, triggers and loan-size cut-offs. New York's high-cost home loan, for example, is triggered by an APR more than eight points over the Treasury yield on a first lien, or by points and fees over 5% of the total loan amount on loans of $50,000 or more, or the greater of 6% or $1,500 below that.15

Fannie Mae's Selling Guide, dated June 5, 2024, makes loans subject to HOEPA ineligible and names twelve states whose "state higher-priced loans" it will not buy.30

Delivery dates and notices: the counselor list, the appraisal copy, the flood warning and the Closing Disclosure

In shortHalf of a compliance test is calendar work. Each notice has its own clock: the housing counselor list within three business days of application, the appraisal copy promptly or three business days before consummation, the flood notice a reasonable time before closing (the agencies generally read that as 10 calendar days), the Closing Disclosure received three business days before consummation. The test needs the date each was sent or received, and the right definition of a business day for each.

The TRID clocks, the two definitions of a business day and the mailbox rule are worked through in detail in the TRID fee tolerance guide. A tester uses the same counts after the fact.

HMDA data integrity and RESPA Section 8: the reported fields and the referral payments a tester checks

In shortTwo families reach past the borrower's documents. HMDA requires lenders to report dozens of fields about each application, and errors in them were the single most cited violation in Federal Reserve consumer exams in 2024. RESPA Section 8 bans paying for referrals; testing it means checking that each payment to a broker or partner matches real services worth that much. Both have produced published penalties.

HMDA: the data must match the loan

Lenders covered by the Home Mortgage Disclosure Act record each application's details: borrower demographics and income, loan amount, purpose, type, action taken, location, and pricing fields such as the rate spread over APOR. For 2025, HMDA reporters recorded 6,827,891 originated loans nationwide.31

The FDIC reports that 82% of the HMDA violations it cited in 2025 were under §1003.4(a), the rule that sets what data must be collected.25 Regulation C protects an error that "was unintentional and occurred despite the maintenance of procedures reasonably adapted to avoid such an error", and gives a good-faith safe harbor for quarterly recording corrected before the annual submission.16 Both lean on a lender having a testing process.

A compliance test checks the HMDA fields against the documents they came from. The rate spread field, for example, must equal the APR minus the APOR for the lock week: if the test rebuilds the APR and finds 7.031% where the system holds 6.875%, the rate spread is wrong too.

RESPA Section 8: what a payment to a referral source buys

Section 8 of the Real Estate Settlement Procedures Act forbids giving or taking "any fee, kickback, or thing of value" for referrals of settlement business on a federally related mortgage loan.32,33 Violations carry a criminal fine of up to $10,000 or a year in prison, and civil liability of "three times the amount of any charge paid for such settlement service".32 An affiliated business arrangement is lawful only with a written disclosure, no requirement to use the affiliate, and no payment beyond a return on ownership.32

The FDIC's March 2024 highlights described Section 8 findings in mortgage broker relationships. Many banks kept checklists showing a broker performed at least five services, the first half of HUD's test, but had not "developed processes to sufficiently address the second test": whether the payments "are reasonably related to the value" of the services.34 For a tester, that means comparing broker compensation on each loan with the services the file shows.

Truth in Lending leads FDIC exam citations: the three disclosure provisions cited most

In shortTruth in Lending is the most cited consumer law in FDIC exams, 40% of all violations in 2025. Its three most cited provisions were the Loan Estimate's good-faith rule, the Closing Disclosure's cost tables, and the Closing Disclosure's loan calculations, which include the finance charge and APR. Flood insurance and HMDA complete the list of laws a mortgage compliance test covers. Examiners' written findings point again and again at system configuration.

Unrounded rates, untested broker fees, short HMDA fields: findings in writing

The pattern in these findings is mechanical. A rule set up wrong in a system, or a check that covers half of a test, repeats on every loan until someone looks at enough loans to see it. That is the case for testing the full population: one loan reveals the error, the population reveals the pattern.

How TILA reimbursement works, and the restitution and penalties regulators have published

In shortAn understated APR or finance charge can oblige the lender to pay borrowers back. The law requires regulators to order reimbursement when the error is a pattern or practice, gross negligence or willful; their joint policy reaches back to the previous examination of any kind, and two years for loans already paid off. A lender that finds and corrects the error within 60 days of discovering it avoids both the order and borrower lawsuits over it. FDIC-supervised banks paid between $4.5 million and $33.3 million a year in voluntary restitution from 2021 to 2025.

When TILA reimbursement is required, how far back and how much

On the Whitcombe loan the two measures land near each other, because one pair of uncounted fees drives both errors: the lump sum that brings the finance charge back to the disclosed figure is about the $6,300 left out, less whatever tolerance the policy applies. Across the seven loans in the fictional finding, the understated finance charges total $38,940. Each month the coding stays wrong adds the next month's wholesale loans to that list.

Compliance transaction testing by sample: the odds a 5% sample misses a seven-loan fault

In shortSampling works for estimating a rate. It is weak at finding a fault that touches a few loans, because a small sample usually misses them. A 64-loan random sample from 1,284 closings has about a 30% chance of including even one of seven affected loans. No rule fixes a compliance sample size; examiners judge whether monitoring is "comprehensive, timely, and successful at identifying" risk.

Where a compliance sample still earns its place

Which compliance tests software can settle, which need a person, and where model risk rules apply

In shortRecalculating the APR, the finance charge, points and fees, rate spreads and business-day counts is deterministic arithmetic. The bank regulators' April 2026 model risk guidance excludes that kind of calculation from its definition of a model. Reading values off scanned documents and grouping failures by cause is where AI helps, and where a bank's own governance applies. Deciding whether points were bona fide, whether a fail is a finding, and what the remedy is stays with people.

SR 26-2 and the bona fide error defense

Decisions the testing manager and testers keep

• Deciding results the rules cannot settle: bona fide points, reasonable notice, a broker's services against the fee.
• Confirming that a group of failed tests is a finding, and its severity.
• Choosing the remedy: re-disclosure, reimbursement under the 60-day correction rule, a system fix, re-testing.
• Approving changes to the rule library and the tolerances it uses.
• Signing the workpaper and answering the examiner.

A test can only be as good as the mapping it reads. If the loan system calls a borrower-paid fee seller-paid and the test believes the system, the test agrees with the error. Reading the signed Closing Disclosure beside the system record is what exposes it.

Testers, a testing manager, control owners and auditors: how a compliance sample moves through a bank today

In shortMost second-line teams pull a monthly or quarterly sample, gather each file and its loan system record, tick a checklist of forty-odd rules by hand, and send exceptions to the business for a response before confirming them. Results reach the business weeks or months after the loans closed. Most of the time goes to waiting for the loan to be picked and reading the file.

Five roles around a compliance test, and what each one wants from it

A sampled loan's path from the quarterly pull to a confirmed finding

Days from closing to a compliance finding, stage by stage

Checklists in house, outside testing firms, post-closing software

Wage benchmark for the people who do this work: compliance officers had a median wage of $38.81 an hour in 2025, with 436,400 employed.43 Wages were 70.0% of private employers' compensation costs in June 2026, so a loaded hour is about $55.44

The Whitcombe loan from test script to signed finding: 26 rules, one rebuilt APR, 19 days

In shortThis is the example from the top of the page, inside the product. The overnight run tests all 1,284 loans the bank closed in August. On the Whitcombe loan it picks 26 of 212 rules, reads 14 documents, rebuilds the APR from the payments, finds the two fees the disclosure left out, traces them to a loan system setting, and leaves one question, whether the discount points were bona fide, for a tester. Graham Feld, the compliance testing manager, confirms the finding on Wednesday, September 2.

1

The test script runs down the loan

The rule selector reads the loan: conventional 30-year fixed, purchase, first lien, Ohio, wholesale through a broker, closed Friday, August 14. It picks 26 of the bank's 212 rules and explains the rest. The script then runs them in order, grouped by regulation: Truth in Lending loan calculations, TRID timing, TRID tolerances, RESPA notices, Equal Credit Opportunity, the higher-priced and high-cost tests, flood.

Each row turns green, red or amber with the value observed, the value expected and a chip naming the page. The APR row stops red: disclosed 6.875%, recalculated 7.031%, understated by 0.156 against a 0.125 tolerance. The page on the right shows Closing Disclosure page 5 with the figure marked.

2

The APR is rebuilt from the payments

The independent calculator never takes the disclosed APR as its answer. It lists every fee on Closing Disclosure page 2, marks each as a finance charge or not, and adds up the prepaid finance charges: $16,723.27, where the disclosure counted $10,423.27. The two rows in red are the $5,150.00 of discount points and the $1,150.00 rate-lock extension fee.

From there it is arithmetic: amount financed $412,000 − $16,723.27 = $395,276.73; 360 payments of $2,638.08 against that amount give an actuarial APR of 7.031%.

3

Why the disclosure was wrong

The data-integrity test puts the loan system's fee screen beside the signed Closing Disclosure. Fee codes 802 and 811, the discount points and the lock extension, are marked "Paid by: Seller" in the loan system. The Closing Disclosure shows both paid by the borrowers at closing. A seller-paid fee is no part of the borrower's finance charge, so the disclosure software left them out.

The loan system's change log names the cause: a new fee table for the wholesale channel, version 14, went live on July 28.

4

One question left for a person

One row stays amber: qualified mortgage points and fees. With the 1.25 discount points counted, the loan is over the 3% limit; if the points are bona fide they drop out and it is well under. The undiscounted rate of 6.990% is within one point of the APOR the bank's file uses, so both points could be excluded, but only the wholesale rate sheet of June 17 shows whether they bought the rate down.

The review goes to Nadia Ozoemena, a compliance tester. She attaches page 4 of that rate sheet, which shows 1.25 points taking the rate from 6.990% to 6.625%, chooses pass and signs.

5

Seven loans, one finding, signed 19 days after closing

The findings analyst groups the month's 318 failed tests into eight findings. F-01, APR and finance charge understated, is critical: seven wholesale loans closed between August 3 and August 22, 28 failed tests, $38,940 of finance charges understated, every loan listed with its disclosed and recalculated APR. The proposed owner is Victor Ames, Head of Wholesale Lending.

Graham Feld reads the evidence and signs on Wednesday, September 2. His signature records what it means: he reviewed the evidence and confirms the finding. F-01 goes to Victor Ames and onto the August workpaper.

The August wall of 1,284 loans, ranked findings, root cause by channel, the rule library and the signed workpaper

In shortOne loan is the story. These screens show the rest of the month: every loan on one wall, the loan list with its coverage against last quarter's sample, the eight findings, where each one comes from, the rule library with tolerances and versions, the workpaper written from the run, the settings, and a second loan with a different fault.

Select any screen to open it larger. The bank, borrowers, brokers and figures are fictional.

The division of labor on a compliance test run: what five agents prepare and what people sign

In shortEach agent has one job and limits it does not cross. None of them changes a loan record, contacts a borrower or confirms a finding. Testers resolve every result the rules cannot settle, with the evidence attached; only the testing manager confirms findings and signs workpapers; control owners accept and carry out remediation.

File reader, rule selector, calculator, timing checker, findings analyst

Three sign-offs on every compliance finding

Agent steps and human decisions are kept apart on the audit trail. Signed workpapers are locked and kept for seven years in the sample settings; examiners get read-only access to them.

Graham, Nadia, Celia and Victor: the Corrin Valley testing team

What the test run reads from the loan file and the loan system, and the workpaper evidence it leaves

In shortIt reads what the bank already keeps for each closed loan and leaves behind a result for every rule on every loan with its page, findings ranked with their cause and owner, and a workpaper for audit and the exam. The loan system stays the system of record and is never written to.

Document, pricing, e-delivery and HMDA systems to connect

For each, check whether it has an API, a file feed or only screens, and who owns it.

Where post-closing testing sits beside your LOS and compliance engine

A page, the working and a signer behind every test result

What an untested fee-mapping fault costs a mortgage lender for every month it runs

In shortThe expensive error is the repeating one. A system setting that drops a fee from the finance charge produces a new set of affected borrowers every month until someone sees it, and a pattern of them is exactly what obliges a regulator to order reimbursement. Count your own exposure from three numbers: how many loans a fault touches each month, how many months your testing takes to see it, and what each affected loan would cost to put right.

Your testing lag, refunds and repeat findings, measured in a week

Repeat findings, unsalable loans and open rescission windows

Testing hours and reimbursement exposure: a return on testing every closed loan, built from your volumes

In shortTwo levers do most of the work. Testing time changes shape: testers stop working checklists and resolve only the results a rule cannot settle. Exposure shrinks: a repeating fault is caught after weeks instead of a quarter, so fewer borrowers need reimbursing. The calculator starts from a published wage and the fictional example's figures; replace every illustrative default with your own.

Six ways testing every closed loan pays back

Your tester hours and remediation on 15,000 closings a year

A lender with few repeating faults and clean exams may find the testing-time lever too small to justify a purchase on its own. Then the question is coverage: whether a 5% sample is enough for the risks in your products and channels.

Readiness for full-population compliance testing: eight questions on your rule library, data and sign-off

In shortPick the answer closest to your program today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score, and each question says why it matters and what a strong answer sounds like.

Explore, pilot or implement: what your testing score points to

Testing software that rebuilds the APR or copies it: sixteen questions that tell them apart

In shortAsk every vendor the same questions, us included. The answers show whether the tool rebuilds figures or copies them, uses the right threshold for the right date, shows its working, and leaves findings and remedies to your people.

We found no published independent test of any compliance testing vendor's accuracy as of October 2026. A back-test on a month your own testers already reviewed is the fairest comparison, and it measures your current process at the same time.

Prove full-population testing on your own closings in twelve weeks, with last quarter's sample as the answer key

In shortWrite down your rule library, back-test the loans your testers already reviewed, then test every loan closed in one month beside them and decide with four numbers. None of these steps commits you to a vendor.

1. Gather last quarter's sample: the files, your testers' results and the findings. That is your answer key.
2. Write the rule library down: rules by product, lien, channel and state, with 2026 thresholds and tolerances.
3. Back-test the sample and explain every difference from your testers' results.
4. Test every loan closed in one month beside your normal sample, with your testing manager confirming findings.
5. Decide with four numbers: agreement with your testers, faults found that the sample missed, false fails per hundred loans, and days from closing to a confirmed finding.

Agreement, missed faults, false fails, days and minutes: the trial's scorecard

Loan compliance testing FAQ: APR tolerance, the $100 finance charge rule, HOEPA, QM points and fees, sample sizes

In shortThe questions people search most often about loan compliance testing, each answered on its own in a few sentences.