Subservicing oversight is the program through which the owner of mortgage servicing rights checks, every month, that the subservicer doing its servicing meets the subservicing agreement and the law, and acts on what it finds. Setting it up is mostly a question of order: first turn the agreement’s service levels into tests with the regulation’s own start dates, then load the subservicer’s report pack and loan tape, run the tests on every loan, and only then write findings into a memo for the vendor committee that a named person signs. Owners that start from the memo template end up restating the subservicer’s scorecard. Botminds’ Subservicer Oversight is set up in the same order, from the owner’s agreement and one of its own monthly packs, so the first memo it drafts is already graded from evidence.
The example owner is fictional: Meridale Home Lending, with three subservicers, preparing its September review of Ashgrove Servicing. Every person, company and loan in it is invented.
The order of work for subservicing oversight, from agreement to signed memo
- Read the agreement into tests
List every service level in the schedule with its floor, its credit and its definition, and set each beside the regulation’s start event. Where the two differ, record the gap before any data arrive.
- Agree what the subservicer sends
The monthly report pack, the loan-level tape with the fields each test needs, access to loan files and letters, complaint logs with call notes, invoices and reconciliations.
- Load one real month
Use a recent pack and tape, not a test file, so the first run meets the real formats, gaps and late reports.
- Test every loan, read files where the tape is blind
Run the loan tests on the full tape; sample files only for the dates the tape cannot show; widen when a sample fails.
- Compare reported with measured
Keep the subservicer’s figure, with its page, beside the measured one. The gap, measure by measure, is the first draft of the findings.
- Decide and escalate
The oversight manager decides findings and same-day actions; critical findings go to the chief compliance officer that day.
- Sign and send the memo
Findings with evidence, what is required and by when, the service-level credit, and remediation items that close only on a re-test.
How to set up subservicer oversight: start with the agreement, not the memo
Start with the subservicing agreement, because every later step inherits its definitions. If the agreement measures loss-mitigation turnaround from the day underwriting receives a file, a perfectly run oversight program will report that measure faithfully and still miss the clock Reg X sets, which runs from receipt of a complete application.
The sample owner’s Schedule B carries 24 service levels across timeliness, accuracy, complaints, loss-mitigation outcomes and regulatory items. The set-up task is a table: each level, its floor, its credit, the subservicer’s stated definition, the rule’s start event, and where the evidence for each will come from. Two of the 24 failed this test before any data arrived: loss-mitigation decisions, measured from underwriting receipt, and insurance payments, measured against the subservicer’s scheduled date rather than the bill’s due date. Both became the month’s missed service levels. The clause that decides when each clock starts shows how to fix the wording.
The agreement as settings: each service level with the rule it is measured against
What should the first month of subservicer oversight cover?
The first month should cover everything once, on real data, rather than a few measures well. Its purpose is to find out which reports arrive late or in a changed format, which tape fields are missing, which dates the tape cannot show, and where the subservicer’s numbers and the owner’s will disagree. Those answers shape the steady-state program more than any template.
Four weeks from signed agreement to the first evidence-graded memo
- Agreement to testsWeek 1
- Data and access agreedWeek 2
- First full run, reconcileWeek 3
- Findings, memo, sign-offWeek 4
Week three is where most programs learn the most. In the sample, the first full run tested 63,410 loans on 18 tests, read 156 files and tied 46 reported figures to the tape; 45 tied. The one that did not was the delinquency report: 1,184 loans 60 or more days delinquent reported, 1,211 on the tape. That kind of finding is about the pack, not the servicing, and it is better found in set-up than in front of an examiner.
Is CFPB Bulletin 2016-02 still in effect?
Yes. Bulletin 2016-02 on service providers was not among the 67 guidance documents the CFPB withdrew on 12 May 2025 (90 FR 20084), and it is still listed on the CFPB’s supervisory guidance index (CFPB supervisory guidance). That withdrawal did take two mortgage-servicing items, the 2017 policy guidance on early compliance with the 2016 amendments and a 2014 bulletin on surviving family members, so it is worth checking each document by name rather than assuming.
The bulletin is short and its five steps read as a set-up plan: due diligence on the provider’s ability to comply; review of its “policies, procedures, internal controls, and training materials”; a contract with “clear expectations about compliance, as well as appropriate and enforceable consequences”; “internal controls and on-going monitoring”; and “prompt action to address fully any problems identified through the monitoring process, including terminating the relationship where appropriate” (CFPB Bulletin 2016-02).
While due diligence does not provide a shield against liability for actions by the service provider, it could help reduce the risk that the service provider will commit violations for which the supervised bank or nonbank may be liable.
CFPB Compliance Bulletin and Policy Guidance 2016-02, Service Providers
The sentence matters for set-up because it defines what the program is for. Due diligence at onboarding is necessary and gives no protection by itself; the monthly monitoring is what reduces risk, and only if it finds things and acts on them.
What does the interagency third-party guidance require?
The 2023 interagency guidance from the Federal Reserve, FDIC and OCC is principles-based and applies to the banks those agencies supervise; for a bank that owns servicing rights and uses a subservicer, it sets out the life cycle, from planning and due diligence through contract, ongoing monitoring and termination, plus governance. The agencies stress that its examples “are not intended to be interpreted as exhaustive or to be used as a checklist” (88 FR 37920).
Three of its expectations shape an oversight program directly. Ongoing monitoring should include “review of reports regarding the third party’s performance and the effectiveness of its controls” and, based on risk, “direct testing of the third party’s own controls”. Management should be “escalating significant issues to the board and monitoring any resulting remediation, including actions taken by the third party”. And the documentation it lists, from “risk and performance reports required and received from the third party” to “remediation plans” and “reports related to customer complaint and inquiry monitoring”, is close to a table of contents for the monthly memo. Nonbank owners face similar expectations through the CSBS model standards adopted in 12 states, which require a board-overseen risk-management program (FSOC 2025 Annual Report).
What goes in a vendor committee memo?
A vendor committee memo for a subservicer should state what the subservicer reported, what the owner’s testing found, each finding with its evidence and the action required by a date, any service-level credit, and who signed. The committee should be able to read the month in a page and open any line to its evidence.
The sections of a monthly subservicer oversight memo, with the sample month’s entries
| Section | What it holds | Sample month |
|---|---|---|
| Summary | Reported against measured, the score and whether it crosses the committee threshold | 24 of 24 reported met; measured 19 met, 3 watch, 2 missed; score 84 from 91, below the 85 threshold |
| Critical findings and same-day actions | Anything that could not wait, and what was directed | Two foreclosure sales set while complete applications waited; postponement directed at 09:18 |
| Findings | Each with evidence, rule, required action and due date | Five: 1 critical, 2 high, 2 medium |
| Service-level credit | The schedule, the missed levels and the arithmetic | 2 × 2.5% × $459,722.50 = $22,986.13 |
| Trend | Measures falling or forecast to breach, with the cause | Error-notice acknowledgments 99.6% → 98.8% → 97.4%, forecast 96.0%; underwriters 46 → 33 |
| Remediation | Open items with owners and dates; how each will be proven fixed | R-26-033 to R-26-037, each closed on a re-test of the loan data |
| Sign-off | Who signed, who acknowledged, when | Oversight manager signed; chief compliance officer acknowledged the critical finding the same morning |
Who signs a subservicer oversight memo?
A named person who owns the relationship signs, usually the subservicer oversight manager or the head of servicing oversight, and critical findings should carry a second acknowledgment from compliance the same day. In the sample configuration the oversight manager signs, the chief compliance officer acknowledges every critical finding, and the vendor management lead can be set as an alternate signer. Nothing goes to the subservicer or a regulator unsigned.
The signature is what turns monitoring into evidence. Reg X asks for procedures that let the owner’s staff audit a provider’s compliance (12 CFR 1024.38(b)(3)); an examiner judging whether those procedures work looks for proof they were used. A signed direction, a credit applied and a remediation item closed on re-test are that proof, with a name and a time on each.
How do you close a subservicer finding?
Close a finding when a re-test on the loan data shows the problem fixed, not when the subservicer reports it fixed. A remediation plan is a promise; the next month’s tape is the proof. The remediation register should therefore hold, for each item, the original evidence, the required action, the due date, the re-test that will prove it and its result.
Every finding across subservicers until it is fixed and proven fixed
Why monitoring matters more now that federal exams are narrower
The CFPB changed how it supervises in November 2025. Its “Humility Pledge” says examination times, “which used to be 8 weeks, will be reduced commensurate with the defined scope of exams”, and that the Bureau will avoid duplicating supervision “where States or other regulators are already doing that job” (CFPB, 21 November 2025). For owners, that does not remove the obligation in Reg X; it moves more of the checking to state regulators and investors, who see the owner’s name on the servicing.
A narrower federal exam is also less likely to find a subservicer’s slide early. The owner’s own monthly review becomes the place where a falling measure is caught before it is a pattern. That is the case for setting up subservicing oversight properly now, and the case for a program that tests every loan rather than a sample.
Going live with Subservicer Oversight on your own pack
Going live means bringing the inputs the program needs anyway: the subservicing agreement with its service-level and credit schedules, one recent monthly report pack with its loan tape, file access for the dates the tape cannot show, and the memo template the committee expects. The solution is set up from those, and an owner can see it run on one of its own monthly packs before deciding.
Where it does not fit: an owner whose agreement gives it no loan-level tape or file access will get a scorecard graded from reports alone, which is better reading but not testing. Fix the contract first. Where it fits, Botminds’ Subservicer Oversight takes the order on this page and runs it every month; the requirements behind each step are set out source by source.
Questions people ask
How long does it take to set up subservicer oversight?
There is no regulatory timetable. On our plan, about four weeks for the first subservicer: one to turn the agreement into tests, one to agree data and access, one for a full run and reconciliation, one for findings and the first memo.
Does an owner need a vendor committee?
No rule names one, but the interagency guidance expects reporting to the board or a designated committee and escalation of significant issues, and the CSBS standards require board-overseen risk management. A committee is the usual way to meet both.
What should happen when a subservicer misses a service level?
The memo records the miss with its evidence, applies any credit in the agreement, requires a cause and a plan by a date, and opens a remediation item that closes only on re-test. Repeated misses are a reason to review the relationship, including termination, as Bulletin 2016-02 contemplates.
Can oversight start before the agreement is renegotiated?
Yes. Measure both ways: the subservicer’s definition for the credit the contract allows, and the rule’s start event for compliance. The difference is evidence for the renegotiation.
How many subservicers can one oversight team cover?
It depends on how much of the reading is automated. In the sample owner, one analyst covers two subservicers and the manager signs for all three, which is workable only because the agents test every loan and read the files.