Third-party report review, explained.

Why a lender pays four specialists to look at a building before it lends

Ordering, reading and approving a report set, in five steps

1. Term sheet and ordersThe bank agrees terms and orders the Phase I, PCA, zoning report and seismic assessment, often through a due diligence firm.
2. Reports arrive, one by oneOver two to four weeks. In the example, 744 pages from four firms, with one reliance letter still missing.
3. The report set is reviewedEach report checked for date, standard and reliance, every finding read, facts compared across reports, and conditions, escrows and reserves drafted. This guide is about this step.
4. Credit approves the conditionsThe credit officer signs; the environmental risk manager concurs on environmental findings; the commitment letter and credit memo carry the result.
5. Closing, then the covenantsConditions cleared, escrows funded, reserves collected monthly, repairs verified before money is released, covenants monitored for the life of the loan.

Step 3 is the subject of this guide. The bank, property, firms and figures in the example are fictional.

Four surprises about Phase I age, seismic loss and lender protection

REC, immediate repairs, legal nonconforming and SEL

Thirteen terms are defined in the one-page summary.

Phase I, property condition, zoning and seismic: the question each report answers for the loan

In shortEach report answers one question about the collateral and is written to its own standard. None covers the others' ground, and several facts, such as the floor area, the year built and the parking count, appear in more than one. Reading the set as one file is where findings get linked and contradictions get caught.

How big a report set gets

Most of a Phase I's length is appendices: database search results, city directory pages, fire insurance maps, aerial photographs, regulatory files. The findings that matter for the loan often sit on a handful of pages, which is why a reviewer needs the page reference for every one.

Who sets the rules for Phase I, PCA, zoning and seismic reports, as of October 2026

In shortOne federal rule governs the Phase I. The other reports are governed by industry standards, the loan program the loan is going into, and the bank's own policy, which examiners then test. Between 2023 and 2026 the Phase I practice, the PCA, seismic and survey standards, the PFAS designation, the dry-cleaning solvent rule, SBA's lending rules and the model risk guidance all changed.

The standards each report should cite in October 2026

How long a Phase I ESA is good for: the 180-day parts, the one-year limit, and the program clocks

In shortThe whole inquiry must be done within one year before the purchase. Five parts of it must be done or updated within 180 days before the purchase. So a Phase I expires 180 days after its earliest part, can be refreshed by updating those parts, and cannot be refreshed past one year. Loan programs add clocks of their own.

The rule sits in 40 CFR 312.20. All appropriate inquiries must be completed within one year before acquisition, and five components "must be conducted or updated within 180 days of and prior to the date of acquisition": interviews with owners, operators and occupants; searches for recorded environmental cleanup liens; reviews of government records; the visual inspection of the property and its neighbors; and the environmental professional's signed declaration.1 Earlier work can be reused if it was collected or updated within one year and the five parts are inside 180 days.1

The trap in the example is easy to fall into: the declaration is dated next to the signature, so it reads like the report date, and it is the latest of the five. Counted from it, the report would seem good until October 25, two days after closing. Counted from the records review, as the rule requires, it ends on October 14.

The clocks that apply to one loan

SBA accepts a Phase I "dated within one year of the date of issuance of the SBA loan number", "notwithstanding the EPA's regulations on updating Phase I ESAs after 180 days", and adds that parties "may still wish to strictly comply with EPA's regulatory timeframes".19 The two tests answer different questions. SBA's decides the guaranty. EPA's decides whether the buyer can claim CERCLA's defenses against cleanup liability.

No federal rule sets an age limit for a PCA or a zoning report. Banks set one in policy; the example bank accepts each report up to 180 days old at closing.

Whose protection the clock is about

The 180-day clock protects the purchaser. EPA's fact sheet for lenders says the rule "primarily applies to borrowers who want to claim protection from CERCLA liability", and that banks "may choose to further protect themselves from loss" by requiring borrowers to qualify.3

A borrower that closes on a stale Phase I may lose the bona fide prospective purchaser defense, CERCLA's protection for a buyer who made the inquiry before buying, and a borrower with a cleanup bill may not repay. The OCC puts the collateral side plainly: the lender exemptions "do not protect the lender from the decline in value that contamination can cause".4

REC, CREC, HREC, vapor and PFAS: reading the Phase I findings a lender must act on

In shortThe environmental professional classifies each condition; the lender decides what each means for the loan. A REC usually leads to more testing or a cleanup plan, a CREC to a covenant that keeps its controls in place, an HREC to a note in the file. Vapor from old solvents and, since 2024, two PFAS chemicals are the findings that have changed most.

The categories come from ASTM E1527-21. Fannie Mae's guide requires action on "any Recognized Environmental Condition (REC)/Controlled Recognized Environmental Condition (CREC), as those terms are defined in ASTM E1527", its approval before rate lock where any are found, and a remediation plan whose cost goes into the repair escrow at "at least 125%".22

Dry cleaners, vapor and a daycare

SBA warns that dry cleaners' solvents "may present significant clean-up costs" once they reach the soil, soil vapor or groundwater.19 Many cleaners used tetrachloroethylene (PCE), a solvent that sinks through soil into groundwater and gives off vapor that can rise into the rooms above. That path, vapor intrusion, has its own EPA technical guide.24

A Phase I can include a vapor encroachment screen under ASTM E2600-22, the guide written for it;25 a positive screen leads to sampling under the floor and in the indoor air. A daycare, school or home above the source raises the stakes, because children and residents spend long hours there.

SBA treats dry cleaning as a category of its own: for any property with on-site dry cleaning, "whether currently in operation or operated historically at the site", it requires "a Phase I followed by a Phase II", addressing "soil, groundwater, and soil vapor", performed by a licensed engineer or geologist.19

EPA's December 2024 rule phases PCE out of dry cleaning over 10 years; EPA reopened it for reconsideration in July 2025 and in July 2026 extended some worker-protection dates into 2027.16 The rule changes how operating cleaners work. A cleaner that left in 2004 left its solvent in the ground.

PFAS since 2024

EPA designated PFOA and PFOS, two of the PFAS "forever chemicals" that break down very slowly, as CERCLA hazardous substances effective July 8, 2024.15 EPA said on September 17, 2025 that it would keep the designation, and the D.C. Circuit upheld it on August 18, 2026.26,18 For a Phase I, that puts the two chemicals inside the scope of the hazardous-substance search.

Turning a property condition assessment into an escrow, a reserve and a coverage ratio

In shortA PCA has two cost tables. Immediate repairs become work required before or soon after closing, funded by an escrow of at least 125% of cost under Fannie Mae's guidance. The capital replacement table becomes a monthly reserve, which comes straight out of the cash flow the loan was sized on. Life safety items come first, whatever their cost.

Fannie Mae's guide says the escrow "should be at least 125% of the estimated cost of the required Completion/Repairs", lets a lender fund less only with the borrower's written assurances, and requires the lender to verify every repair "whether the Completion/Repair Escrow was funded or not".12

Its PCA FAQ closes the most common shortcut: "Regardless of the Borrower's planned CAPEX, all Immediate Repairs, including Life Safety Items" stay on the schedule. It does not define life safety and points to the Mortgage Bankers Association's description of a "visually obvious" hazard, adding that life safety issues "are, by their nature, not 'minor'".6

How long the borrower gets, by kind of repair

The reserve is where the PCA moves the coverage ratio

The PCA's capital table lists every system expected to need replacing over the evaluation period. Fannie Mae's PCAs cover the loan term "plus 2 years", and a PCA consultant without roof access should give "a more conservative Replacement Reserve estimate".6 In the example, the 12-year table averages $33,880 a year, $0.35 per square foot, while underwriting had carried $0.15.

A repair escrow is funded once, from loan proceeds or a borrower deposit, and released as each repair is verified. A replacement reserve is collected monthly for the life of the loan. The same PCA feeds both, so a reviewer checks that no item sits in both tables, and that the PCA's summary ties to its line items.

Accessible parking is a repair line and a lawsuit risk

California led the 2024 count with 3,252 suits.27 Fannie Mae treats repairs needed to comply with the Americans with Disabilities Act as critical repairs, due within six months.12 The example center's $96,500 of accessible parking and path-of-travel work sits in a state where these suits are most frequent.

Legal nonconforming property: what a zoning report says about rebuilding after a fire

In shortA building that met the code when built can keep standing after the code changes. After heavy damage, though, the city may require any rebuild to meet today's code: fewer square feet, more parking, bigger setbacks. The lender's job is to find out where that line is, what the property would be worth if rebuilt under today's rules, and what insurance pays for the difference.

Fannie Mae's guide spells out the analysis. For a legal nonconforming use, the lender must confirm the "destruction threshold", the percentage of damage at which the city would stop the property being rebuilt to its old use, and may not deliver the loan "if the destruction threshold is less than 50%".13

For nonconforming characteristics such as parking, height or setbacks, it must confirm whether the buildings "can be fully rebuilt to the pre-casualty condition" and, if not, test whether the as-rebuilt property still supports the loan, weighing ordinance or law insurance and the extra cost of building to today's code.13

The example's parking count

In the example, the city's code lets the center be rebuilt as it stands only if damage is under 50% of replacement cost, and the pad building's front setback is 12 feet against today's 20. A real case shows how far the gap can run: one office building lawfully built under older rules would, under current code, lose about 18,000 square feet, nine feet of height, and need 99 more parking spaces.29

Ordinance or law insurance, in three parts

Owners buy these three coverages as an endorsement to the property policy, such as ISO form CP 04 05.30 Lenders also ask the title insurer for a zoning endorsement, and should confirm which form the insurer will issue when a building is legally nonconforming, because an insurer will not insure compliance it cannot confirm. Since February 23, 2026, new ALTA/NSPS surveys follow the 2026 standards, which add an optional summary of significant observed conditions, such as encroachments into setback areas.11,31

Seismic loss by building: SEL, SUL and why one building can fail while the property passes

In shortA seismic assessment estimates how much of each building a rare, strong earthquake would destroy, as a share of what it costs to replace. The expected figure (SEL) and a pessimistic one (SUL) describe the same quake. Fannie Mae's limit is 20% for every income-producing building and 40% as a hard stop; a bank can adopt the same numbers in its own policy. Earthquake insurance pays after the damage; only a retrofit lowers the loss.

The trigger is the site's shaking. Under Fannie Mae's guide, a property where the peak ground acceleration with a 10% chance in 50 years is 0.15g or more is high seismic risk; the lender screens the buildings, and orders an assessment dated "within 12 months before the Commitment Date" if a structural risk factor appears. The assessment must give the SEL and the SUL at "a 10% probability of exceedance in a 50-year period", the quake expected once in about 475 years.2

Every income-producing building must have "an SEL of 20% or less", and no loan may be delivered on a property "having any Improvements with an SEL greater than 40%".2

Older tilt-up concrete buildings, with heavy wall panels and light wood roofs, are vulnerable where wall meets roof: without anchors, the panels can pull away and the roof edge comes down with them. In the example, Building B's walls were never anchored; the engineer prices anchors and cross-ties at $184,000, which brings its SEL to 11%.

How likely a large California earthquake is in the next 30 years

USGS UCERF3 forecast, published in 2015. The likelihoods describe whole regions; for a given property, the assessment's own hazard figures govern. The example site's peak ground acceleration is 0.62g, four times the 0.15g trigger.

Reliance letters, report age and the facts that must agree from one report to the next

In shortBefore reading any finding, a reviewer checks three things about each report: who may rely on it, whether it is still current on closing day, and which standard it follows. Then the facts shared across reports are compared. Where they disagree, the bank's policy should say which document governs, and the reviewer records both values.

What a reliance letter has to do

A reliance letter extends a report to parties other than the consultant's client, usually the lender, its successors and assigns, and any agency buying or guaranteeing the loan. SBA's version is the most complete public model: it must accompany every transaction screen, Phase I and Phase II on an SBA loan, "even if the Environmental Investigation Report is addressed to the SBA Lender", and its wording "may not be modified".19

A letter that names only the original bank stops helping the day the loan is sold or participated, which is why the words "successors and assigns" matter. And a new letter on an old report does not make the report current.

The facts four reports and a survey should agree on

Shared facts usually disagree for ordinary reasons: one consultant counted from an old site plan, or measured differently. They matter because each report's conclusions rest on its own count: a zoning conformance finding built on the wrong parking count is wrong, and a reserve per square foot built on the wrong area is off by the same proportion.

Findings that belong to the same building

The more useful cross-check links findings on the same building. In the example, Building B carries a leaking roof in the PCA ($128,600 to replace the membrane), a seismic loss above the limit because its walls are not anchored to that roof, and a retrofit that the engineer says is cheapest during re-roofing. Read separately, they are two escrows and two contractors. Read together, they are one job on one schedule.

Ten ways a report set reaches the closing table with a risk nobody priced

In shortReviews fail in four places: the report's authority (age, reliance, signer, standard), the reading (a finding missed or softened), the translation into terms (a recommendation that never becomes a condition), and the links between reports. Most failures are quiet: the loan closes, and the gap shows up at the first casualty, sale or default.

Contamination, exam findings and a reliance claim that expires

How many reports lenders order, and the property loans that need them in 2026

In shortLenders and buyers ordered roughly 54,000 to 62,000 Phase I reports a quarter in late 2024 and early 2025, and the activity index rose through mid-2025. Banks hold about $3.1 trillion of commercial property and construction loans, $875 billion of commercial and multifamily mortgages mature in 2026, and lending volume rose 40% in 2025. Each new loan and many refinances bring a new report set.

A typical Phase I on a conventional property with no special issues took 16 business days and cost $3,083 on average in LightBox's May 2023 survey of environmental professionals, and writing the report was the longest single task, at 6.8 hours.38 LightBox's mid-2025 report traced demand to "investors and lenders re-entering the market albeit selectively, growing pressure to refinance maturing loans, distress-driven acquisitions", affordable housing projects and merger diligence.37

Multifamily was the largest property type in 2025, at an estimated $413 billion.41 A refinance does not start EPA's acquisition clock, but a lender's own policy can still require a current Phase I, PCA and, where it applies, seismic assessment, so maturities can bring report sets of their own. No public figure counts property condition, zoning or seismic reports, or measures how long lenders take to review a set.

Software that reads third-party reports: what the 2026 model and vendor guidance cover

In shortSoftware can read the reports, pull the dates and tables, compare facts across reports and draft conditions with page references. It cannot visit the site, test the soil, price a repair or change a consultant's classification, and people still sign. The April 2026 model guidance leaves generative AI, and AI that acts on its own, outside its scope, so the controls come from vendor oversight and the bank's own policy.

OCC Bulletin 2026-13, issued jointly with the Federal Reserve's SR 26-2 and the FDIC's FIL-15-2026 on April 17, 2026 and replacing SR 11-7, defines a model as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories" and calls generative AI, along with AI that takes actions on its own, "novel and rapidly evolving" and "not within the scope of this guidance".17

Banks govern such tools through third-party risk management, guidance the agencies proposed to rewrite in September 2026 (comments due November 16, 2026), and through their own AI policies.42 NIST's AI Risk Management Framework, which is voluntary, gives those policies a structure.43

Classifications, repair costs and concurrence stay with people

• The environmental professional classifies conditions; the engineer prices repairs; the bank decides what it will lend against. Software that rewrites either opinion has overstepped.
• A report missing a page, a letter not yet received, or a closure letter that was never sent waits on people outside the bank.
• Concurrence and approval: the environmental risk manager and the credit officer sign, and the record should show what each saw.

How you would know a tool works: plant findings and count

The useful test runs on your own closed loans. Take report sets whose findings you know, add some you plant (an earlier component date, a missing reliance line, a building over the seismic limit, a life safety line moved deep in a table), and count what the tool catches and what it flags wrongly on clean sets. Small tests prove less than they appear to.

How lenders review third-party reports today: who reads what, and where the days go

In shortReports are ordered by the originator or a due diligence firm, read by three or four different people, and stitched into conditions by the credit officer and the closing officer. In one vendor's estimate, most of the time goes to reading the Phase I and pulling the PCA's tables. The work bunches in the last two weeks before closing, when the reports arrive.

Who reads a report set: credit, environmental risk, underwriter, closing

Four readers between the report order and approved conditions

A ten-day review, half on the Phase I and drafting conditions

The days are rarely consecutive. Reports arrive at different times, readers have other loans, and the conditions often wait on the last report. In the example, the seismic reliance letter was still missing ten days before closing.

One reader per report, a due diligence firm or report-reading software

Arroyo Vista's 744 pages: margin notes that become Schedule C conditions, escrows and an approval

In shortThis is the example from the top of the page, inside the product. Seven agents read the 744 pages as each report lands and mark what matters on the page itself. Nora Lindqvist, the senior credit officer, reads the marked pages, accepts each margin note into Schedule C of the commitment letter, and approves; Martin Ashdale, the environmental risk manager, concurs on the environmental findings.

1

Eight loans closing, the worst first

Nora opens Loans closing on Monday morning: eight loans and $158.5 million closing in the next 30 days, 27 of 29 reports in, seven open high findings. Each loan carries a chip per report (environmental, property condition, zoning, seismic) and is ranked by its most serious open finding and its days to closing.

Arroyo Vista sits at the top: a recognized environmental condition under a daycare, a Phase I that runs out on October 14, and Building B's seismic loss at 23%.

2

The reports open as documents, already marked

Nora selects the loan, and the Phase I opens at page 47, the most serious finding first, with the passage on the former dry cleaner highlighted in red: Belmora Cleaners used PCE in Suite B-112 from 1981 to 2004, no investigation or closure is on record, and the suite is now a licensed daycare for 46 children.

A margin note beside it drafts the condition in commitment letter language, with its cost: a Phase II of sub-slab vapor and indoor air, $18,500 on the consultant's quote, mitigation of $185,000 to $240,000 only if needed. The read log on the left shows which agent read what, and when.

3

A margin note becomes condition 1

Nora reads the page and the note, and accepts it. "Phase II required before closing" moves into Schedule C, section A, as condition precedent 1, naming the consultant, the results date of Wednesday, October 21, and the cost. She could edit the wording, keeping its citation, or mark it "not a condition", which the product treats as a waiver: it needs a reason and the chief credit officer's sign-off.

4

The Phase I clock, from page 12

The report screen lays out the Phase I's standard, signer, reliance and the five component dates the intake and standards checker read from page 12. The earliest, the government records review, was April 17; the report is good to Wednesday, October 14, nine days before the Friday, October 23 closing. The update of the stale parts is drafted as condition 2, and the reliance letter is confirmed to name Calder Pacific Bank, its successors and assigns.

The screen dates the one-year limit from the April 28 declaration; 40 CFR 312.20 counts it from the oldest information the report uses, so on this report it ends no later than April 17, 2027 (section 04).1

Below, the Phase I's findings in the professional's own classes: one REC, one CREC, one HREC, a de minimis stain, a data gap judged not significant, and suspected asbestos outside the Phase I's scope.

5

Escrows, the reserve and the coverage ratio, then approval

The conditions and reserves drafter sized the escrows at the bank's 125%: $515,750 for $412,600 of immediate repairs and $230,000 for the Building B anchorage retrofit, $745,750 in all. The PCA's reserve of $0.35 a square foot replaces the $0.15 underwritten, so net cash flow falls to $2,347,040 and coverage moves from 1.28x to 1.27x. The bank's policy offers earthquake insurance on Building B as the alternative; it would bring coverage to 1.25x and leave the building's loss unchanged.

Nora approves six conditions precedent, the escrows, a $2,823 monthly reserve and three post-closing covenants, choosing the meaning of her signature. Martin concurs on the environmental findings, and the loan is cleared to close on October 23.

On the sample loan, the run that read all 744 pages finished in 2 minutes 10 seconds. The solution's design targets are a reviewed set of findings and conditions the same day the last report lands, and 100% of findings cited to their report and page. They are targets, to be measured on your own report sets.

The PCA, seismic and zoning pages, the four-report comparison and the bank's own policy

In shortThe same marked-page view works for every report: the property condition assessment's fire alarm and cost tables, the seismic loss by building, the zoning report's rebuild limit. Beside it sit the side-by-side comparison, the findings register, the credit memo section, the report clock for every loan, and the settings that hold the bank's policy.

Select any screen to open it larger. The sample seismic report cites the 2016 editions of ASTM E2026 and E2557; ASTM published 2024 editions in June 2024 (section 03), so a bank should set in policy which editions it accepts. The bank, consultants, people and figures are fictional.

Every margin note is a draft: the senior credit officer accepts it and the environmental risk manager concurs

In shortEach agent has one job and limits it does not cross. None of them changes a consultant's opinion or cost, waives a condition, or approves a loan. Every note is a draft until a person accepts, edits or rejects it, and approval stays blocked until every note is decided.

Seven agents, from intake checker to conditions and reserves drafter

The credit officer signs each condition; environmental risk concurs

Agent steps and human decisions are kept apart on the loan's activity record, with who and when. Settings changes are versioned. Nothing is ordered from a consultant until the credit officer approves.

Nora Lindqvist's eight closings and the people who concur

From four consultants' reports to findings by building, sized escrows, drafted covenants and the memo section

In shortThe solution reads the reports the bank already orders, applies the bank's environmental and credit policy, and leaves behind findings by severity and building with their pages, the age and reliance check, sized escrows and reserve, drafted conditions and covenants, and the credit memo section. The loan origination system and document store stay where they are.

Origination, ordering portal and closing checklist a review reads

For each, check whether it has an API, a file feed, or only screens, and who owns it.

Your consultants, commitment letter and credit memo stay as they are

Every finding paged, consultants' opinions kept, people approve

What a late or missed finding costs you: reviewer days, refreshed reports, unfunded repairs

In shortStart from your own files. No regulator or study publishes how long lenders take to review a report set or how often a finding misses the loan documents, so the numbers that matter are yours. A few published figures frame them: what a Phase I costs and how long it takes, how much an escrow should hold, and how many loans come due this year.

Logging reviewer minutes and counting Phase I updates you reordered

Contamination you lent against and a building that cannot be rebuilt

Reviewer hours and refreshed Phase Is avoided: the return on marked pages and dated reports

In shortPut in your own numbers. The calculator starts from one published figure, the average price of a Phase I, and asks you for the rest: how many report sets you review, the hours they take, the hours you expect after, how often a report runs out before closing, and what the tool and your testing cost. Every default marked illustrative is an assumption to replace.

Reviewer hours, Phase I updates in time and no lost recommendation

Your reviewer hours and Phase I reorders avoided each year

A lender that closes ten or more CRE loans a month, most with a full four-report set, sits near the first line. A lender that closes twenty a year on small owner-occupied buildings, most with only a transaction screen, sits below the last line on time saved alone; for that lender the costs no calculator counts carry the case.

Report sets a year, a written environmental policy and past findings: scoring your review desk

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Explore, re-read 20 to 40 closed sets, or review every report set

Report dates, reliance and the consultant's own opinion: seventeen questions for report review software

In shortAsk every vendor the same questions, us included. The answers show what the tool reads, how it dates and checks each report, whether it respects the consultants' opinions, how findings become loan terms, and how you would measure it on your own files.

We found no published independent test of any report review tool's accuracy, as of October 2026. A planted-finding test on your own files is the fairest comparison, and the same test measures your current process.

Ten closed report sets re-read against their commitment letters, then live loans in parallel: ten weeks

In shortMeasure first, then test on closed files where you already know the answers, add findings you plant, run in parallel on live loans, and decide with three numbers. None of these steps commits you to a vendor.

1. Time three live report sets, every reader, every minute. That is your baseline.
2. Re-read ten closed sets against their commitment letters and credit memos. List every recommendation, date and reliance gap you find.
3. Build a test set of 30, with your policy in writing, and plant findings in ten copies: an earlier component date, a missing reliance line, a building over the seismic limit, a life safety item deep in a table.
4. Run in parallel on live loans for four weeks, with your credit officers approving every condition.
5. Decide with three numbers: catch rate by finding type, false alarms on clean sets, and reviewer hours per set.

Planted findings caught, false alarms and citations checked

Phase I shelf life, REC versus CREC, repair escrows, reliance letters and SEL: what lenders ask

In shortThe questions lenders and buyers search for, each answered on its own.