Compliance testing in banks: who tests a loan, who fixes the cause

Compliance testing in banks is the check, usually run by the second line of defense, that loans and other transactions actually met the consumer-protection rules. For a closed mortgage that means the APR and finance charge disclosed within tolerance under Regulation Z, the Loan Estimate and Closing Disclosure delivered on time under TRID, fees inside their tolerance buckets, and the RESPA, ECOA and flood notices sent. A compliance tester does the loan-by-loan work, a testing manager decides which failures are findings, and the fix belongs to someone else: the head of a lending channel, or the team that configures fees in the loan origination system. Internal audit then tests the testers. Botminds' Loan Compliance Testing is software in which five agents test every closed loan and cite the page behind each result, so that the people in these seats spend their week deciding and fixing rather than reading.

The work is hard for a reason no single seat controls. Each person sees one slice: the tester sees the file, the manager sees the sample, the channel head sees a finding months later, and the person who changed the fee table never sees the test at all. The cost sits in the handoffs.

Who performs compliance testing in a bank?

A compliance tester or analyst in the compliance function performs it, under a testing manager who owns the programme; at smaller banks one compliance officer may do both. The CFPB's examination procedures list "monitoring and/or audit" as one of the components every compliance programme needs, next to policies, training and complaint response, and ask examiners to "determine whether and to what extent monitoring includes calculation tools, the content of consumer disclosures and notices" (CFPB compliance management review procedures). Loan compliance testing is that monitoring, applied to closed loans.

Around the two testing seats sit three more. The control owner, typically the head of the lending channel, owns the process that produced the loan. A loan system or pricing administrator owns the configuration that produced the disclosure. Internal audit, the third line, tests whether the whole arrangement works. Examiners read all of it.

Is compliance testing first or second line of defense?

It is normally second line, because its value depends on not being run by the people whose work it tests. The OCC's heightened standards for banks of $50 billion or more define a "front line unit" as one that generates revenue, "provides operational support or servicing", or "provides technology services" to the business, and "independent risk management" as the units that identify, measure and monitor risk with their own reporting line to the board (12 CFR part 30, appendix D). By that definition the team that configures the loan system is first line, the same as the loan officers.

Smaller banks have more latitude. The CFPB describes monitoring as "generally more frequent and less formal than audit", noting that it "may be carried out by the business unit, and does not require the same level of independence" that audit does (CFPB CMR procedures). What examiners do look for is a chief compliance officer with "independence from business units" and access to the board. A testing desk that reports to the head of lending can produce honest results, but it will struggle to make a channel head own a fix.

What does a compliance tester or loan compliance analyst do?

The tester proves, one loan at a time, that each rule that applies to the loan was met. By hand that means opening the Loan Estimates, the Closing Disclosure, the note, the notices and the loan system's fee screen, copying the values the checklist needs, recomputing the APR, counting business days and writing down each result. Most of the hours go to finding and copying, not to judgment, which is why most teams test a sample rather than every loan.

The judgment, when it comes, is the part that matters. A tester decides whether a $75 appraisal increase was cured at closing, whether a changed circumstance really justified a revised Loan Estimate, whether discount points were bona fide. The regulation does not answer those from the page alone. In the sample bank used throughout this series, a fictional lender, 167 of 31,592 August tests ended as "needs a person", and those 167 are the tester's real work. On the Whitcombe loan, a $412,000 wholesale purchase, the qualified mortgage points-and-fees test came out at 3.69% of the total loan amount counting the discount points and 2.38% without them, against a 3% limit; only the rate sheet could say whether the points could come out. The QM points-and-fees test covers that decision.

What does a compliance testing manager do?

The manager owns the programme: what is tested, how often, against which rules and tolerances, and which failed tests add up to a finding. A failed test is evidence. A finding is a judgment that a rule was broken in a way that matters, with a cause, a scope and an owner. Examiners weigh violations by "root cause, severity, duration, and pervasiveness", in the words of the FFIEC consumer compliance rating system, so a manager who signs a finding is answering those four questions in advance.

Today most of the manager's time goes to assembly: collecting results, grouping fails, chasing loan numbers and writing the workpaper. In the sample run, the findings agent grouped 318 failed tests into eight ranked findings before the morning. The most serious, F-01, put seven wholesale loans together under one cause, with $38,940 of finance charges understated. The manager's work became checking that grouping and deciding whether to sign it.

The manager signs, and the signature says what it means

Who is responsible for fixing compliance testing findings?

The first line is: the business owner of the process and, for a system cause, whoever maintains the system. A late counseling list is fixed by the correspondent channel and its partners. A missed escrow statement is fixed with the settlement agents. An understated finance charge caused by a fee mapping is fixed by whoever maintains the fee table, often a pricing or operations team outside both lending and compliance. Compliance confirms the finding and re-tests the fix; it should not own the remediation.

The two owners need different things. The channel head needs to know what broke, how many borrowers it touched, what it costs and since when. The administrator needs the exact configuration. In the sample bank, fee table v14 for wholesale, deployed on 28 July by Pricing Operations, set fee codes 802 and 811 to "Paid by: Seller", so the loan system left the discount points and the lock-extension fee out of the finance charge on every wholesale loan that carried them. The OCC expects banks to complete "sufficient testing and monitoring of automated processes to be able to rely on the accuracy of the outcomes, calculations, and disclosures generated" (OCC Comptroller's Handbook, Compliance Management Systems).

Using a vendor or a central team does not move the responsibility. A Federal Reserve examiner put it plainly: "the institution remains responsible for ensuring that the output from vendor-provided systems and services meets regulatory requirements" (Consumer Compliance Outlook, 2019). The CFPB found the pattern in practice: a loan origination system "not programmed to round" as the note required, so every affected adjustable-rate disclosure was wrong until the system was reconfigured (CFPB Supervisory Highlights, Issue 30). Closing Disclosure errors that start in the loan system shows how to test the configuration itself.

What is the difference between compliance testing and internal audit?

Compliance testing is the second line checking transactions often; internal audit is the third line checking, less often and independently, whether the whole compliance programme works. The CFPB draws the line in one paragraph: audit "is generally less frequent and more formal than monitoring, may be carried out by an institution's internal audit department or outside contracted party, and is generally independent of the business or compliance function that does the monitoring". It should be "independent of both the compliance program and business functions" and give the board "a determination of whether policies and procedures ... are being implemented and followed" (CFPB CMR procedures).

Audit's role has grown. Under the Federal Reserve's April 2026 operating principles, examiners "should not perform their own duplicative validations of whether a firm has fully remediated" a matter requiring attention unless internal audit "has not validated the remediation" (Federal Reserve, 2026). A remediation is closed on audit's evidence, so audit needs testing it can re-perform: a workpaper that names the page behind every result, the rule version and the signer.

How are compliance testing results reported to the board?

Through management to the board or its compliance committee, as findings with cause, owner, remediation and status, while audit reports separately and directly. The CFPB asks examiners to confirm that "findings as a result of monitoring reviews are escalated to management and to the board of directors, as appropriate" and to review "reporting for the identification and resolution of issues and the timeliness and completeness of corrective actions" (CFPB CMR procedures). The FFIEC rating system credits "self-identification of consumer compliance issues and corrective action undertaken as such issues are identified" (FFIEC, 2016).

A useful board report therefore answers five questions: how many loans were tested and against which rule version; the fail rate by rule family; each finding's cause, owner and due date; borrowers affected and dollars owed; and which findings are repeats. The last matters most. In the sample bank, three of the eight August findings had already appeared in the second-quarter sample, with the same rule and the same cause, at a higher count once every loan was tested. A repeat finding is a finding about the fix.

The middle figure is the one to read twice. Almost every TILA violation the FDIC cited in 2025 was graded as systemic or recurring, not as an isolated slip. A systemic violation is usually a setup problem, and setup problems are fixed by the control owner and the system administrator, not by the tester who found them.

How Loan Compliance Testing changes each seat, and what stays with each person

The agents take the reading, the arithmetic, the day-counting and the first grouping. They do not take a seat. In the sample bank the same four people carry the August run that carried the quarterly sample; what changed is the question each of them spends the week on.

Two of these changes are larger than they look. The tester's time moves from reading to deciding, and decisions are what a reviewer will later question. The manager's evidence moves from a sample to the whole month, which changes what a signature can claim: not "the 64 files tested were compliant" but how many loans failed each rule, and why. Automated compliance testing against a sample works through that difference with numbers.

The tester finds the failure; the fix lives in a seat the test report rarely reaches. Organise the testing around that path.

What the control owner receives from Loan Compliance Testing: the cause and the loans

What to change first if you run a loan testing desk today

Teams that keep testing by hand can still fix the handoffs. Name an owner for every finding before it is signed, not after. Write down the configuration behind each systemic finding: the table, the version, the date it changed. Send the system administrator the failing tests, not only the summary. And report repeat findings as their own line, so the board sees whether fixes hold.

The United States had 417,070 compliance officers in May 2025 by the Bureau of Labor Statistics count, across every industry, but the testing desk at any one lender is small. Small teams are where handoffs cost most, because one person often fills two seats and nobody fills the one that owns the fix. The Loan Compliance Testing page shows the August run seat by seat, and a pilot of mortgage compliance software on your own loans shows who does what in a first week.

Questions people ask

Is post-closing QC the same as compliance testing?

They overlap but answer different questions. Post-closing quality control usually re-verifies underwriting, income, appraisal and eligibility for investors; compliance testing checks the consumer-protection rules: disclosures, timing, tolerances, notices and pricing thresholds. Many lenders run both on the same files, by different people.

Should the tester and the person who confirms a finding be different people?

Most programmes separate them, and the solution enforces it: testers resolve reviews, and only the testing manager confirms a finding. The separation is what makes the signature mean something to an auditor.

Can a bank outsource compliance testing?

Yes, and many do, especially for audit, which the CFPB says "may be carried out by an institution's internal audit department or outside contracted party". Responsibility does not move with the work: the bank still answers for the results and must act on them.

How often should a bank do loan compliance testing?

No rule fixes a frequency; it should follow the bank's risk assessment. Examiners ask for the monitoring schedule for the review period and the next 12 months, and they look harder at areas where volume, change or past findings raise the risk, such as a new loan system release or a new channel.

Does a small bank need both compliance testing and a compliance audit?

Not always. The CFPB accepts that a small, non-complex institution with low-risk products may have only one of the two functions, provided its coverage is commensurate with its size, complexity and risk profile.