Mastering Compliance: Federal & State Lending Regulations for Private Lenders

Private lenders must comply with more than a dozen federal and state regulations governing loan origination, disclosure, servicing, and consumer protection. These laws, including TILA, RESPA, Dodd-Frank, ECOA, and the SAFE Act, determine whether your private mortgage notes are enforceable, your servicing operations are licensed, and your business is protected from legal liability.

Federal Consumer Protection Laws Every Private Lender Must Know

Federal regulation sets the compliance floor for every private mortgage lender in the country. The laws below govern disclosure accuracy, fair lending, data privacy, and borrower rights from application through payoff.

Truth in Lending Act (TILA) / Regulation Z

TILA, implemented by Regulation Z, requires private lenders to disclose loan costs with precision – including the Annual Percentage Rate (APR), finance charges, payment schedule, and total cost of credit. Errors in these disclosures create enforceability risk and regulatory exposure. Accurate TILA disclosure is the foundation of every compliant private mortgage note. For a deeper look at where lenders get tripped up, see 7 Costly TILA/RESPA Misconceptions Every Seller Financier Must Avoid.

Real Estate Settlement Procedures Act (RESPA) / Regulation X

RESPA, governed by Regulation X, protects borrowers from excessive settlement costs and abusive servicing practices. It requires timely Loan Estimates and Closing Disclosures, prohibits kickbacks between settlement service providers, and mandates proper handling of escrow accounts and servicing transfer notices. Private lenders who fail RESPA requirements face borrower claims and note enforceability challenges throughout the servicing relationship.

Dodd-Frank Act and the Consumer Financial Protection Bureau

Enacted in 2010, the Dodd-Frank Act overhauled residential mortgage regulation and created the Consumer Financial Protection Bureau (CFPB). The CFPB enforces TILA, RESPA, ECOA, and the ATR/QM rules with broad authority to examine lenders, issue regulations, and take enforcement action. Private mortgage lenders fall within the CFPB’s reach – ongoing CFPB compliance is central to managing legal and reputational risk across all origination and servicing activities.

Ability-to-Repay (ATR) / Qualified Mortgage (QM) Rule

The ATR rule requires lenders to make a reasonable, good-faith determination that a borrower can repay before extending credit on a residential mortgage. Qualified Mortgages meet specific underwriting and product-feature criteria that create a legal presumption of ATR compliance. Private lenders who structure loans to QM standards reduce litigation risk and strengthen note enforceability throughout the servicing lifecycle.

Equal Credit Opportunity Act (ECOA) / Regulation B

ECOA prohibits discrimination in any aspect of a credit transaction based on race, color, religion, national origin, sex, marital status, age, or public assistance income. Private lenders must apply underwriting criteria and servicing practices consistently across all borrowers. Fair lending violations expose lenders to regulatory enforcement and private lawsuits – and can undermine the enforceability of individual notes. For a breakdown of common ECOA missteps, see 7 Compliance Mistakes Private Lenders Make.

Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act)

The SAFE Act requires Mortgage Loan Originators (MLOs) engaged in residential mortgage origination to be licensed and registered through the Nationwide Mortgage Licensing System and Registry (NMLS). Private lenders with unlicensed MLOs face fines, injunctions, and loan unenforceability. Licensing compliance at origination protects every note in your portfolio downstream. For a real-world case study, see A Private Lender’s SAFE Act Compliance Story.

Fair Credit Reporting Act (FCRA)

The FCRA regulates how private lenders access, use, and furnish consumer credit information. Lenders who pull credit reports for underwriting must have a permissible purpose, provide adverse action notices when credit is denied, and ensure accuracy in any data furnished to credit bureaus. FCRA violations carry both regulatory and civil liability, making accurate credit data handling a core compliance requirement at origination and throughout servicing.

Gramm-Leach-Bliley Act (GLBA)

The GLBA requires private lenders, as financial institutions, to protect the privacy of borrower financial information. Compliance means providing clear privacy notices at the start of the lending relationship, disclosing information-sharing practices, and implementing data security safeguards. Borrowers must receive annual privacy notices detailing how their nonpublic personal information is collected, used, and protected throughout the servicing relationship.

Servicemembers Civil Relief Act (SCRA)

The SCRA protects active-duty military borrowers with enforceable limits on interest rates, restrictions on foreclosure proceedings, and protections against eviction. Private lenders and servicers must verify military status before advancing any enforcement action – particularly in default situations. Violations of the SCRA carry severe federal penalties, including punitive damages and injunctive relief.

Fair Debt Collection Practices Act (FDCPA)

The FDCPA prohibits abusive, deceptive, and unfair collection practices by third-party debt collectors. Private lenders servicing their own notes fall outside the FDCPA’s direct scope in most circumstances, but lenders who hire third-party collection firms or purchase defaulted debt inherit FDCPA compliance obligations. Aligning collection practices with FDCPA standards protects private lenders from liability regardless of who performs the collections work.

High-Cost Mortgage Rules: HOEPA / Section 32 of TILA

HOEPA, enacted as Section 32 of TILA, imposes additional disclosure requirements and term restrictions on loans whose APR or points and fees exceed federal thresholds. High-cost loans face limits on balloon payments, prepayment penalties, and certain other terms. Private lenders must evaluate every loan at origination for HOEPA triggers – non-compliance creates assignee liability and extended rescission rights that follow the note through any sale or transfer.

Right of Rescission: TILA Section 125

TILA Section 125 gives borrowers a three-business-day right to cancel certain refinance transactions where a security interest is taken in their primary residence. Private lenders must provide proper rescission notices before disbursing funds or perfecting the lien. Failure to deliver the required notice extends the rescission window to three years, creating sustained and significant risk to note enforceability.

State-Level Requirements

State law adds a second compliance layer that varies significantly by jurisdiction. Private lenders must research and satisfy state requirements in every state where they originate or service loans – there is no single national standard that covers everything.

State Usury Laws

Every state sets maximum interest rate limits for mortgage loans, and those limits vary by loan type, borrower category, and lender classification. Private lenders must verify the usury rules in the state where the collateral property is located before closing any note. Non-compliance can result in forfeiture of interest, forfeiture of principal, or a note rendered entirely unenforceable under state law.

State Mortgage Servicing Licensing Requirements

Most states require mortgage servicers – including private individuals and companies servicing their own portfolios – to hold a state-issued servicing license. Licensing requirements vary by state and cover financial solvency, background checks on principals, and operational standards. Operating without the required license exposes private lenders to fines, cease-and-desist orders, and the inability to legally enforce loan terms in that state. See 9 Compliance Checkpoints for Private Mortgage Loan Servicers in 2026 for a current-year licensing overview.

Expert Take

The compliance exposure private lenders face is not theoretical – it lives inside every note in the portfolio. A disclosure error under TILA, an unlicensed originator under the SAFE Act, or a missed SCRA check before foreclosure can each render a note unenforceable or trigger federal enforcement. Lenders who protect their portfolios treat compliance as a servicing discipline, not a one-time closing checklist. That means tracking regulatory changes by state, auditing origination files before a note goes into default, and working with a servicer who builds compliance into every payment cycle – not just during a crisis.

Building a Compliance Framework That Holds

Federal and state lending regulations interact across every phase of the private mortgage lifecycle, from origination disclosures to default management to year-end tax reporting. No single regulation operates in isolation, and a gap in one area routinely surfaces as a problem in another.

The practical approach is layered compliance: start with a documented origination checklist that confirms TILA, RESPA, ATR, ECOA, and SAFE Act requirements are satisfied at closing. Layer state usury and licensing verification on top. Then build ongoing servicing protocols that address SCRA status checks, FCRA reporting accuracy, GLBA privacy notices, and HOEPA monitoring for any loan modifications.

For lenders building internal programs, 7 Essential Policies for New Private Lender Compliance Manuals is a direct starting framework. 10 Critical SOPs Every Hard Money Lender Needs for Compliance and Growth takes it a step further with operational procedures built to hold up under examination.

Private lenders who outsource to a qualified servicer gain built-in compliance infrastructure across all of these layers. Note Servicing Center handles private mortgage notes with compliance-first servicing from loan boarding through payoff. Visit NoteServicingCenter.com or contact us directly to discuss how we can protect your portfolio and streamline your operations.