Subservicer oversight, explained.

Owning the servicing while another company does it: the arrangement in plain words

One loan's servicing in five steps, and where oversight sits

1. The owner acquires the servicing rightsMeridale keeps the rights on loans it makes and buys others. It services none of them itself.
2. A subservicing agreement sets the workAshgrove's agreement lists 24 service levels in Schedule B, each with a floor, and credits for misses in Schedule C.
3. The subservicer services every loan, every dayPayments, escrow, calls, letters, loss mitigation, foreclosure referrals, investor reporting, for 63,410 loans.
4. The owner checks the monthThe report pack, the loan tape and the loan files, against the agreement and Reg X. This is where two foreclosure sales are found, or missed.
5. A committee decides, and the fix is re-testedDirections to the subservicer, credits, remediation items, the annual onsite visit, and next month's pack.

Step 4 is the subject of this guide. The companies, people and figures in the example are fictional.

Retained liability and a self-graded scorecard: what MSR owners learn late

Four subservicing terms, from master servicer to service-level credit

Fourteen terms are defined in the one-page summary.

What a subservicer does each day, and the decisions that stay with the owner

In shortA subservicer runs nearly all of a loan's daily servicing: payments, escrow, borrower contact, loss mitigation, foreclosure referrals and investor reporting. The owner keeps the servicing rights, the investor relationship, the money the investors reserve to it, the choice of subservicer, and the duty to check the work. The subservicing agreement draws the line, and the investors' rules draw some of it for them.

The Financial Stability Oversight Council describes two kinds of owner that hire subservicers: lenders without a servicing operation that "still value the servicing income and will retain the servicing while contracting out the loan administration", and owners that hold the rights as passive investors, such as mortgage real estate investment trusts, which are "more likely to outsource loan administration duties to a subservicer".8 Banks hire subservicers too, and some large servicers subservice for others while using a subservicer themselves.

The pieces of a subservicing arrangement

The federal duty to oversee a service provider: Reg X 1024.38(b)(3), Bulletin 2016-02 and the bank guidance, as of 2026

In shortReg X 1024.38(b)(3) is the core duty: procedures that let the owner see what its providers did and audit them. CFPB Bulletin 2016-02 says the relationship does not absolve the owner, and it survived the CFPB's 2025 withdrawals. Banks also follow the 2023 interagency guidance on third parties, which four agencies proposed to replace in a notice published on September 15, 2026; the proposal keeps the sentence that matters: the responsibility stays with the bank.

The bulletin's five steps

1. Due diligence: verify the provider "understands and is capable of complying with Federal consumer financial law".4
2. Read its rulebook: request and review its policies, procedures, internal controls and training materials.
3. Write consequences into the contract: clear compliance expectations and "appropriate and enforceable consequences" for violations. A service-level credit is one.
4. Monitor: internal controls and on-going monitoring of whether the provider complies.
5. Act: address problems fully and promptly, up to ending the relationship.

Fannie Mae, Freddie Mac and Ginnie Mae on subservicing: approval, one subservicer per pool, full liability

In shortAll three agencies require the subservicer to be one of their approved servicers or issuers. Fannie Mae and Ginnie Mae state in their guides that the owner stays fully liable, and Fannie Mae requires the owner to evaluate the subservicer's work and asks to see "the master servicer's audits and QC reviews of the subservicer's performance" on request. Ginnie Mae approves each arrangement in writing, allows one subservicer per pool and holds the issuer liable for everything the subservicer reports in its name.

Two practical consequences follow. First, a Ginnie Mae issuer that wants to move servicing between subservicers moves whole pools, and it needs a new approval before the new subservicer starts. Second, because the issuer is liable for what the subservicer reports in its name, the monthly pool and loan data deserve a loan-level check by the issuer every month: a report that does not tie to its own tape is the issuer's misstatement too.3

Investor loss mitigation rules keep moving, and each change becomes a new test of the subservicer. FHA's Mortgagee Letter 2026-08, for example, made a borrower's third failure to accept a trial payment plan in one default episode a plan failure and limited the repeat reviews that hold off foreclosure, to be in place no later than September 21, 2026.19 An owner checking FHA loans in October 2026 tests against those rules, whatever the subservicer's procedures said in June.

State licenses and the CSBS prudential standards: why state examiners read the owner's oversight file

In shortNonbank servicers are licensed and examined by the states, and in some states, Pennsylvania among them, the owner of the servicing rights needs a servicer license even when a subservicer does all the work. The CSBS model standards were enacted in 12 states by the end of 2025, by FSOC's count; a state regulators' representative put the number with "some form" of them at 17 by April 2026. They require board-overseen risk management and name vendor oversight among a servicer's core functions.

Licensing rules differ by state. Pennsylvania is explicit: "Both the owner of master servicing rights and the subservicer are required to obtain mortgage servicer licenses."20 A licensed owner is examined by the state, and the examiner asks the same question the CFPB does: show how you know your subservicer serviced our residents' loans correctly.

The Conference of State Bank Supervisors (CSBS) adopted model prudential standards for nonbank servicers in July 2021. They cover servicers with "2,000 or more 1 – 4-unit residential mortgage loans serviced or subserviced for others" in two or more states. Their capital and liquidity parts have limited application to firms that only subservice; their governance parts apply to all.

Every covered servicer "must establish a risk management program under the oversight of the board of directors", internal audit suited to its size and risk, and the standards list "Vendor oversight" among the functions a servicer performs.21

The owner's own testing has to stand whichever way a regulator acts. The 2026 proposal makes the same point about the agencies' examination reports on large service providers: relying on them "without performing independent due diligence would be inconsistent with sound risk management principles".14

The Reg X and Reg Z deadlines a subservicer runs, and the event that starts each one

In shortMost service levels in a subservicing agreement are borrower deadlines from Reg X and Reg Z: acknowledge in 5 business days, decide a complete loss mitigation application in 30 days, contact a delinquent borrower by day 36, pay escrow bills before the penalty date, send a payoff statement within 7 business days. Each runs from a start event the rule names. That start event is what an owner has to check.

One loan's clocks, in the example

The tape's date, September 18, would put the decision deadline at October 18 and show nothing late. The borrower's protection runs from August 21. Fictional example.

How to re-measure a subservicer's service level: start event, population, sample and widening

In shortA service level is a count of items that met a deadline divided by the items that should have. Re-measure it in four steps: take the rule's start and stop events, recount the population from the tape, test every loan the tape can answer, and read files where it cannot. If a file sample fails, read every file; the sample rate is never the answer.

The four steps, worked on the example

Why the denominator matters as much as the clock

One late decision among 362 applications moves that rate by 0.28 points. One late premium among 4,812 moves the insurance rate by 0.02 points. The populations with the shortest clocks and the gravest consequences are also the smallest, so a single portfolio-wide score that averages loss mitigation with payment posting on 63,410 loans will look healthy almost every month. Report each service level separately, with its population next to it.

How big a file sample has to be

That arithmetic explains the method: draw the sample toward risk so it finds a problem if there is one, then measure the true rate from every file. Owners who sample at random and report the sample's rate get both halves wrong: the sample often finds nothing, and when it does, its rate is the wrong number.

Re-measuring a count: complaints

Complaints per 1,000 loans is complaints received in the month across every channel, divided by loans serviced, times 1,000. Written complaints arrive labeled. Phone complaints arrive as call notes, and whether a call becomes a complaint depends on someone applying a definition during the call. In the example the subservicer logged 311 (4.9 per 1,000); applying its own complaint definition to the call notes found 107 more, coded as inquiries: 418, or 6.6 per 1,000, against 4.8 in August.

The service-level credit

In the example: 63,410 loans × $7.25 = $459,722.50 base fee; 2 × 2.5% × $459,722.50 = $22,986.13, within the 10% cap of $45,972.25. Measured with the subservicer's start events, the same month shows no misses and no credit.

Where subservicing fails: late decisions, unpaid escrow bills, uncounted complaints and reports that do not tie

In shortThe same failures recur in exam reports and enforcement orders: escrow payments that do not reach the payee, loss mitigation decisions sent late, notices that leave out what the rule requires, and foreclosures that move while an application waits. In an oversight file they show up as a scorecard that says "met", a definition nobody read and a sample too small to see the problem.

What CFPB examiners found at mortgage servicers

The CFPB's 2024 mortgage servicing edition of Supervisory Highlights covers exams from April to December 2023. It reported:31

• escrow payments that "did not reach the payees" and were not resent "until months after the initial payment attempts";
• acknowledgment notices "that failed to specify whether the borrowers' applications were complete or incomplete";
• servicers that "did not provide timely notices stating the servicers' determination regarding loss mitigation options";
• offer letters without a deadline to accept;
• late fees charged although a loss mitigation agreement should have prevented them;
• property inspection fees that investor guidelines prohibit.

Every one of those is a test an owner can run on its subservicer's tape and files.

Enforcement: the cost lands as redress

We found no public enforcement action that penalized an owner of servicing rights specifically for its subservicer's failures, as of October 2026. Investors, state examiners and borrowers' lawyers are where an owner's file is tested.

What borrowers are telling the CFPB

Complaints sent to the CFPB about mortgages from January to September rose from 17,740 in 2025 to 26,540 in 2026.34 Those are complaints a borrower took to a regulator. The ones a subservicer logs, and the calls it codes as inquiries, are where an owner can see the same trouble months earlier.

Which failures to test first

The subservicing market in 2025 and 2026: about $4 trillion, a few large operators, more delinquent loans

In shortSubservicers handled about half of the balances on which a nonbank owns the servicing rights at the end of 2023, against about a quarter in 2015, in a market FSOC sized at $3.99 trillion. Four firms held more than half of it. Bulk servicing sales kept the owner side moving in 2025, and delinquency rose, most on FHA loans. A non-performing loan costs nearly nine times as much to service as a performing one.

FSOC's 2024 report found that "of the mortgage balances for which an NMC [nonbank mortgage company] held the servicing rights, the administrative duties were handled by a third-party subservicer for approximately half", up from about 25% in 2015, and that five of the 20 largest agency servicers rely on subservicers while six subservice for others.8 Nonbanks serviced 59% of outstanding mortgages by mid-2025.22 Against $13.1 trillion of mortgage debt in June 2026, the subservicing estimate is close to a third of the market, though the two figures come from different dates and sources.35

FSOC also named the risk this concentration creates: "Since NMCs have similar business models and share financing sources and subservicing providers, distress in the NMC sector may be widespread during times of strain", and it asked Congress to consider giving FHFA and Ginnie Mae authority "to directly examine nonbank mortgage servicer counterparties".8 Many owners share the same few operations. Each owner sees only its own loans, so each owner's monthly testing is one of the few places a slipping operation shows up early.

Every point of delinquency adds loans to the populations where Reg X's clocks are shortest and a miss is hardest to reverse: early intervention, loss mitigation, foreclosure. A subservicer whose clients' books turn delinquent at the same time needs more trained staff at the moment it is least likely to have them. In the example, the subservicer's loss mitigation underwriters fell from 46 to 33 in a year while complete applications rose from 281 to 362 a month.

Clock tests, file reading and complaint recounts by machine, and how SR 26-2 and the Enterprises' AI terms apply

In shortSoftware can run the clock tests on every loan on the tape, read the notices and letters where the tape cannot show a date, recount every reported figure, and read every complaint and call note. The April 2026 model risk guidance (SR 26-2) leaves out generative AI, the kind that reads files and drafts, and AI that acts on its own; other AI stays in its scope. Controls for those two kinds come from third-party guidance, the investors' new AI requirements and your own policy. The evidence still has to exist, and a person still decides and signs.

Testing every loan changes oversight from reading a sample of the subservicer's account to measuring the population. A tape with one row per loan can answer most timing questions directly: when a payment arrived and when it posted, when a bill was due and when it was paid, when a borrower became delinquent and when the first contact was logged. Where the tape holds a date the subservicer's system stamped, and the rule depends on another event, software can read the document that carries the right date, such as the notice of complete application, and compare.

What the investors and supervisors now expect of AI

Where machine testing of a subservicer stops

• A test can only read evidence the agreement delivers. If the tape has no bill due date or the owner has no access to letters and call notes, the test cannot run.
• A file read is as good as its sample design: a risk-based sample to find a problem, then every file to measure it.
• Severity, credits, directions to the subservicer, escalation and termination are decisions. The 2013 rule's test is whether the owner "has been able to use its information to oversee its service providers effectively", which means a person acted on it.10
• Software that grades a subservicer is itself a third party to the owner, with its own due diligence.9

Six roles and fifteen working days: how an owner's team reviews a subservicer's month by hand

In shortA small oversight team reads part of the pack, tests a sample of loans, reviews the complaint log, ties a few figures and writes the memo; vendor management runs the committee and the annual onsite; compliance acknowledges the serious findings; internal audit tests the program once a year. By hand, most of about three weeks goes to reading and pulling files, and the measures nobody had time for are taken from the subservicer's own scorecard.

Who reviews a subservicer's month, from oversight manager to internal audit

Report pack to committee: four hands on each monthly review

Pack reading and loan testing fill most of a three-week review

A monthly rhythm has a second weak spot. A borrower clock that expires inside the month, such as a sale set after an undecided complete application, cannot wait for the memo. Catching it takes a daily check of sale dates against pending applications, from a daily file the subservicer sends.

In-house analysts, servicing audit firms or vendor risk platforms

Ashgrove's September, graded: 24 of 24 claimed, 2 missed, two foreclosure sales stopped by 9:30 am

In shortThis is the example from the top of the page, inside the product. On Monday morning, October 12, Renée Okafor, Meridale's subservicer oversight manager, presses one button. Six agents read Ashgrove's 14 reports, test all 63,410 loans and read 156 loan files; each area's grade changes from what Ashgrove reported to what the evidence supports. She directs two foreclosure sales postponed, applies the credit and signs the memo, and the chief compliance officer acknowledges the critical finding, before 9:30 am.

1

The pack is in, and every area reads A

Ashgrove's September pack landed on Thursday, October 8 at 5:40 pm, a day before it was due: 14 reports, a tape of 63,410 loans with 412 fields each, and an invoice for $612,480.40. Its own scorecard, Report 1, says 24 of 24 service levels met.

The scorecard opens on that claim and marks every line "not yet tested". Each service level shows its floor (a red tick) and what Ashgrove said (a hollow ring); the solid dot for what the evidence shows is still missing.

2

"Grade from the evidence"

Renée presses one button and the run plays in the panel on the right. The report pack reader reads the 14 reports, 214 pages, and records every reported figure with its page. The loan-level tester runs 18 tests on every loan, then reads a sample of 156 files where the tape cannot show when a clock started.

As each area finishes, its grade changes. Timeliness drops to a C on the insurance line: 99.23% of premiums paid by their due date against a 99.8% floor, though Ashgrove reported 99.9%.

3

19 met, 3 on watch, 2 missed, and a D

Two minutes and 25 seconds later the verdict band reads: Ashgrove says 24 of 24, the evidence says 19 met, 3 on watch and 2 missed. The oversight score falls from 91 in August to 84, under the 85 that sends a subservicer to the vendor committee.

Loss mitigation outcomes drop to a D. The panel on the right lists what the grades call for: a critical finding, two foreclosure sales to postpone, a $22,986.13 credit and a memo drafted for signature.

4

The D, opened: 14 files read, 3 late

Renée opens "Loss-mit decisions on time". On the left is Report 3, page 4, as Ashgrove sent it: 99.4%, "Measured from the date the file was received by underwriting." On the right are the 14 sampled loans, each with the complete date from the notice the borrower received beside the tape's date, struck through.

Three were late. Loan 0047-118-2093 in Dayton, Ohio was complete on August 21, has no decision, and has a sale set for Tuesday, October 20. The tape says the application arrived September 18.

5

The sample widens to every file

A failed sample stops being a sample. The tester read all 362 complete applications: 345 decided within 30 days of the complete date, 15 late, and 2 late with a sale set. That is 95.3% against the 99% floor: finding F1, critical.

The strip shows every file as one square, so the committee sees the size of the miss across all 362 applications.

6

Both sales directed postponed the same morning

The instruction is drafted for her: postpone both sales and confirm by 5:00 pm; for the Lakeland, Florida loan, withdraw the motion for judgment filed September 29; decide both applications; send a plan for the other 15 late applications by Monday, October 19. Renée sends it to Marcus Delaney at Ashgrove at 9:18 am.

Ashgrove's own foreclosure report, Report 4, had shown zero sales with a complete application pending.

7

Credit applied, memo signed, finding acknowledged

The memo writer drafted the memo: a summary, five findings each with what Ashgrove must do and by when, the two missed service levels, and the credit under Schedule C: 2 × 2.5% × $459,722.50 = $22,986.13 off the September invoice.

Renée applies the credit and signs at 9:21 am. Daniel Whitford, the chief compliance officer, acknowledges the critical finding at 9:23 am. Five remediation items open, R-26-033 to R-26-037, each closed only when it is re-tested on the loan data.

The solution's design targets are every loan tested every month and two days from the pack landing to a signed memo. They are targets, to be measured on your own packs. Monday, October 12, 2026 is Columbus Day, a Federal Reserve holiday;43 in the example Meridale's team works that morning, and nothing in the story depends on a payment moving that day.

Loan tests, one loan's timeline, recounted complaints, 13-month trends and the settings that hold your agreement

In shortOne month is the story. These screens show the rest: the review with its run log and findings, the 18 tests with their exception loans, one loan's timeline, complaints recounted from call notes, 13 months of trends, the insurance miss, all three subservicers, the remediation tracker and the settings that turn Schedule B into measures.

Select any screen to open it larger. The owner, subservicers, people, loans and fees are fictional; the loan drawer is shown without its top rows, whose day count does not match the sample loan's dates.

The narrow job each of six agents does, and the oversight manager's signature on every direction and credit

In shortEach agent has one job and limits it does not cross. None of them contacts a borrower, changes a loan, edits a figure the subservicer reported, or sends anything to the subservicer or a regulator. The oversight manager directs the subservicer, applies credits and signs the memo; the chief compliance officer acknowledges every critical finding the same day.

Six agents, from the report pack reader to the oversight memo writer

The oversight manager directs and signs; compliance acknowledges critical findings

Service levels, thresholds and approvers are versioned settings. Every agent step and every human decision, the direction, the credit and the signature, is on the audit trail. A remediation item closes when the agents re-test it on the loan data, whatever the subservicer reports.

Meridale's oversight team and Ashgrove's relationship manager

Reports, tape, files and your agreement become a graded scorecard, a signed memo and an evidence pack

In shortThe solution reads what the subservicer already sends: the monthly reports, the loan tape, loan files and letters, complaints and call notes, the invoice and reconciliations, and your subservicing agreement. It returns a scorecard graded from that evidence, findings with their loans and pages, the credit, a signed memo, a remediation tracker and an evidence pack. The subservicer's systems stay where they are.

Subservicer portal, daily loss mitigation file and payables: the connections

For each, check whether it has an API, a file feed or only screens, and who owns it at your company and at the subservicer.

Your agreement, committee and auditors stay; the subservicer changes nothing

Start events, every loan, signed directions: how each month is graded

What a subservicer's slip costs you when your review finds it late, or not at all

In shortThe review costs little next to what it misses. A missed borrower protection becomes redress paid to borrowers, a repurchase or indemnity demand from an investor, an examiner's finding with your name on it, and service-level credits you never collected. Default servicing, where the clocks are shortest, costs the most to run and the most to get wrong. Start from your own numbers.

Pricing review time, uncollected credits and redress from your own records

What a service-level credit never repays: a wrongful sale, an exam finding

The money in re-measuring each service level: analyst hours and the credits your agreement already provides for

In shortPut in your own numbers. The calculator values the review hours released and the service-level credits your agreement already provides for, less what the tool and your testing cost. Every default marked illustrative is an assumption to replace; the borrower harm avoided is left out because it cannot be priced in advance.

Six returns from re-measuring, from review hours to an examiner-ready file

Your review hours and credits across every subservicer you oversee

An owner whose agreement has no credit schedule, or whose service levels are defined by the subservicer's start events, collects nothing in any of these rows. The schedule and the definitions are the first thing to read before a pilot.

Score your oversight program on its agreement, tape, file access, definitions and sponsor

In shortPick the answer closest to your program today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

From fixing the tape to grading every subservicer: the three bands

Seventeen questions that show whether oversight software re-measures your subservicer or repackages its scorecard

In shortAsk every vendor the same questions, us included. The answers show whether a tool re-measures the subservicer or repackages its scorecard: what it reads, where each clock starts, how it samples, what evidence you keep, and who signs.

We found no published independent test of any subservicer oversight tool, as of October 2026. A parallel run on your own months, compared with your current review, is the fairest test, and it also measures your current process.

Re-grade three closed months, then run one live month beside your team: a pilot the vendor committee can judge

In shortFix the data access first, then grade three past months and one live month of your largest subservicer alongside your current review, then decide with four numbers. None of these steps commits you to a vendor.

1. Read your agreement: list each service level with its floor, its start and stop events, its credit and the tape fields and file access it needs.
2. Ask for the evidence: three months of packs and tapes, file and call-note access, and a daily loss mitigation file.
3. Re-measure the past: grade three closed months and compare with what your memos said.
4. Run live in parallel for one monthly cycle and a month of daily sale-date checks, with your manager signing.
5. Decide with four numbers: findings each method found, hours per review, days from pack to signed memo, and the evidence an auditor can re-perform.

Findings, re-measured service levels, review hours and days to a signed memo

Subservicer oversight questions MSR owners ask: liability, Reg X, Ginnie Mae, credits and dual tracking

In shortThe questions servicing owners and oversight teams search for most, each answered on its own.