Mortgage compliance software tests closed or closing loans against TILA, RESPA, ECOA, flood and state rules, and the way to choose one is to make it answer a single question on your own loans: does it reach the results our testers would reach, find what they missed, and flag little that is not there? Demonstrations on a vendor's files cannot answer that. The cleanest test is to replay a month that has already been tested. Take every loan closed in that month, run them through the software against your own rule checklists, and compare loan by loan with the results your team signed. The loans your sample covered measure agreement; the loans it did not cover measure what full coverage adds. Botminds' Loan Compliance Testing is built to be judged this way, and the decision rests on measures agreed in advance, so that the pilot can fail.
The pilot below is the plan we propose to a lender, written as a target of about three weeks from receiving the files to the decision. It does not describe a past engagement. The figures used to illustrate it come from the fictional sample bank used throughout this series.
Who does what in the pilot weeks
Today
Signed last quarter's sample workpaper; owns the rule checklists and tolerances.
With agents
Writes the pass measures before the run, reviews each new finding the run produces, and makes the decision.
Still theirs: The decision, and which differences count against the software.
Today
Tested the sampled loans by hand.
With agents
Resolves the reviews the run sends to a person, and checks a random set of results against their pages.
Still theirs: The judgment on every result the rules cannot settle.
Today
Maintains fee tables, payer defaults and the document export.
With agents
Exports one month of loan system data and documents, read only, and answers configuration questions on any data-integrity fail.
Still theirs: Every change to the loan system.
Today
Reviews the testing programme once a year.
With agents
Observes the comparison, re-performs a handful of results, and reads the draft workpaper.
Still theirs: An independent view of whether the pilot was fair.
How to choose mortgage compliance software
Choose on coverage, evidence and control, in that order, and prove all three on your own files. Coverage is which rules it applies to which loans, and whether it tests every closed loan or a sample. Evidence is whether every result shows the page and value it rests on, so a tester or auditor can re-perform it. Control is whether your testing manager, not the vendor, owns the rules, the tolerances and the decision on every finding. A product that is strong on speed and weak on any of these three will not survive its first examination.
What should mortgage compliance software test?
Every rule that applies to a closed loan, which for a mortgage lender means nine families, not only TRID. Disclosure timing and tolerances get the attention, but RESPA notices, Equal Credit Opportunity appraisal rules, flood, higher-priced and QM thresholds, and state law make up most of a real library. The library in the sample bank's run held 212 rules, and its split is a useful checklist for any product's scope: if a family is thin or missing, ask why.
What mortgage compliance software should test: one library, by rule family
| Rule family | Examples | Rules |
|---|---|---|
| TILA loan calculations | APR within 1/8 point; finance charge within $100; amount financed; total of payments | 18 |
| TRID timing | Loan Estimate by the third business day; Closing Disclosure received three business days before consummation | 14 |
| TRID tolerance | Zero and 10% buckets; changed circumstances; cures within 60 days | 16 |
| RESPA notices | Homeownership counseling list; initial escrow statement; servicing disclosures | 22 |
| Equal Credit Opportunity | Appraisal copy three business days before consummation; adverse action notices | 15 |
| Higher-priced and high-cost | HPML, HOEPA and QM points and fees and price tests | 21 |
| Flood | Determination before closing; notice to the borrower; insurance in place | 9 |
| Data integrity | Loan system values against the disclosures the borrower received | 26 |
| State overlays | State high-cost and disclosure laws for the states the lender serves | 71 |
What questions to ask a mortgage compliance software vendor
Ask questions whose answers you can check on screen, and ask about change as much as about function. Regulation Z's thresholds move every January, as the 2026 points-and-fees and HOEPA figures did (90 FR, 15 December 2025), and the CFPB has asked for comment on replacing the TRID timing rules with a materiality-based standard (CFPB request for information, 9 July 2026). The OCC expects a bank's change management to include "systems and applications ... to re-test results when regulatory changes occur" (OCC Comptroller's Handbook, Compliance Management Systems). A vendor that cannot show how a rule change is tested before it goes live is asking you to take that on trust.
Questions for any mortgage compliance software vendor
- Does it test from the documents, or only from loan system data?
Only the documents show what the borrower received; data alone cannot find a configuration error.
- Can every result be traced to a page and value?
Open ten results at random during the demonstration and look.
- Who changes rules and tolerances, and how is a change tested?
Your manager should approve, and a new version should run on a past month first; tolerances should only tighten.
- What happens when a value is missing?
The right answer is a review for a person, never an inferred value.
- Where are the files processed and kept, and for how long?
TRID evidence for three years and Closing Disclosures for five under §1026.25(c); your own retention may be longer.
- Can examiners and auditors get read-only access?
Workpapers, results and evidence, locked once signed.
- What leaves with you if you stop?
Results, evidence and workpapers in a format your next tool or your auditors can read.
How do you pilot mortgage compliance software? Replay a month you already tested
Pick the most recent month whose loans your team tested and whose workpaper is signed. Three things make it the right month. Your testers' results exist, so there is something to compare against. The files are complete: a lender must keep each Closing Disclosure and its related documents for five years after consummation, and other evidence of TRID compliance for three (12 CFR 1026.25(c)), so last month's files are all on hand. And the month is recent enough that any real finding can still be acted on.
A month inside a quarter where your sample found something is especially useful. If the sample found a late counseling list on three files, the full run should find the same three, and will show whether there were more. That single comparison tests agreement and coverage at once.
A three-week pilot from files received to decision (target)
- Library from your checklists4 days
- Run1 night
- Compare and resolve6 days
- Review findings, draft workpaper3 days
- Decide1 day
What data does mortgage compliance software need?
The data list is short because the solution reads the file the way a tester does. It needs the documents, the loan system's own view of each loan, the rules you test against and what you found last time. Nothing is written back to the loan system; the access is read only.
The files a one-month pilot needs
- Every loan file closed in the month
Loan Estimates (initial and revised), Closing Disclosures (initial and corrected), note, notices, appraisal delivery evidence, flood determination, rate-lock confirmation and changed-circumstance documentation.
- The loan system export for those loans
Fees with payer, section and fee code; application, lock, issue, delivery, receipt and closing dates; rate, points and pricing. Read only.
- Your rule checklists by product and state
Including state overlays and any in-house rules tighter than the regulation, with the tolerances you apply.
- Last period's testing results and findings
Loan-level results for the sampled loans, and the signed workpaper, so agreement can be measured loan by loan.
- Rate sheets and APOR for the month
For rate spread, higher-priced and high-cost tests, and to settle bona fide discount points.
- Your workpaper format
So the draft written from the run matches what your auditors and examiners already read.
How to measure the accuracy of compliance testing software
A pilot whose criteria are set after the results are in proves nothing. Before the run, the testing manager writes down what counts as agreement, what counts as a false flag and what thresholds would stop the project. The four measures below are the ones that matter for a second-line testing programme; the thresholds are the lender's.
What to measure, how, and what would count as a fail
| Measure | How it is measured | What would count as a fail |
|---|---|---|
| Agreement on the loans you tested | Each sampled loan, rule by rule: same result, or a difference with the page that explains it. | Any difference where the software was wrong and the page shows it. |
| Arithmetic | APR and finance charge on a random set of loans recomputed independently, for example with the FFIEC APR Computational Tool. | Any recomputed APR or finance charge that differs beyond rounding. |
| New findings | Every fail on a loan your sample did not cover, investigated by a tester: real or false. | A false-flag share above the threshold the manager set. |
| Citations and reviews | A tester opens a random set of results and checks the page and value; the share of tests sent to a person. | A citation that does not show the value it claims; a review share too high to staff. |
The arithmetic check deserves an independent tool. The FFIEC's APR Computational Tool, which replaced the OCC's APRWIN program in 2020, "supports the process by which examiners and financial institutions can verify applicable calculations included on consumer loan disclosures" (OCC Bulletin 2020-40). Using the examiners' own calculator on a sample of the software's results is a check nobody can call circular.
Agreement needs care in both directions. When the software and the tester differ, open the page. Sometimes the tester was right; sometimes the sample result was wrong and the software found it, which is a finding about the manual programme. Count each case. The timing tests are where differences most often turn out to be the tester's: Regulation Z uses one definition of business day for the Loan Estimate and another, which counts Saturdays, for Closing Disclosure receipt (§1026.19). The tolerances and timing rules set out each line.
Write the fail conditions down before the run. A pilot that cannot fail is a demonstration.
What a pilot of Loan Compliance Testing produces, and how long it takes
About three weeks from files to decision on the plan above, and at the end of it the testing manager has three things. Results for every loan in the month, with each pass, fail and review tied to its page. Drafted findings, grouped by cause and ranked, each with its affected loans and a proposed owner. And a draft workpaper written from the run, in the lender's own format, setting out the objective, the population, the method, the results by rule family and the findings, ready for the manager to review.
The workpaper a run produces: scope, method, results, findings
Compare the scope lines: 64 of 3,712 against every loan, no sample.
The pilot also tells the manager something no vendor claim can: the review load. In the sample bank's August run, 167 of 31,592 tests went to a person, about one in 190, mostly on tolerance and timing questions where a changed circumstance or receipt date had to be confirmed. A lender's own number will differ with its products and its file quality, and it determines how many tester hours the programme needs once it is live.
What happens to findings a software pilot turns up
If the measures pass, the decision is about cadence and scope: monthly or nightly, all channels at once or one first. If one fails, the useful question is why. A disagreement caused by a rule in the library that did not match the lender's checklist is fixed by changing the rule; one caused by a misread page is a problem with the software and should count against it.
A replay of real loans can find real problems, and the pilot plan has to say what happens then. A finding from the pilot is the lender's finding, discovered through the lender's own procedures, and it goes through the lender's normal process: confirmed by the testing manager, assigned to an owner, remediated. It also starts a clock. TILA relieves a creditor of liability for an APR or finance-charge error it corrects "within sixty days after discovering an error ... through the creditor's or assignee's own procedures" (15 U.S.C. 1640(b)), so a pilot should not begin until someone owns remediation for whatever it finds. Responsibility for the conclusion stays with the institution whatever tool produced it; as a Federal Reserve examiner wrote, "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements" (Consumer Compliance Outlook, 2019).
Bring internal audit in from the start. Under the Federal Reserve's 2026 operating principles, examiners rely on internal audit's validation that a remediation is complete rather than repeat it (Federal Reserve, 2026), so audit's view of how the new testing was proven will matter later.
Coverage and results after the replay, loan by loan
Automated compliance testing against a sample explains why the uncovered loans are where most of the pilot's new findings come from, and AI mortgage compliance testing describes what each agent does with the files. The Loan Compliance Testing page follows a full month from closing to the signed workpaper.
Questions people ask
How long does a mortgage compliance software pilot take?
Our target is about three weeks from receiving the files to a decision, most of it spent comparing results and reviewing new findings. The run itself is overnight for a month of a mid-size lender's closings: 1,284 loans took one night in the sample bank.
Do we need to send loan files outside the bank?
The pilot needs read access to the files and a read-only loan system export. Where the files are processed, and under what agreement, is a third-party risk question to settle before the pilot, not during it.
What if our checklists include rules tighter than the regulation?
They go into the library as written. Tolerances can be set tighter than Regulation Z, never looser, and each rule names its source, so a reviewer can tell a regulatory rule from an in-house one.
Should the pilot cover every channel or start with one?
Every channel, if the files allow it. Systemic faults are often channel-specific: in the sample bank the fee-table fault touched only wholesale loans, and a retail-only pilot would have shown a clean month.
How many results should go to a person?
It depends on products and file quality, which is why the pilot measures it. In the sample bank's August run, 167 of 31,592 tests, about one in 190, went to a tester, mostly tolerance and timing questions that needed a changed circumstance or a receipt date confirmed.