Essential Lending Regulations for Private Mortgage Lenders & Servicers

Private mortgage lenders and servicers operating in the U.S. face a layered compliance environment spanning federal disclosure laws, anti-discrimination statutes, data privacy requirements, and state usury limits. If you originate or service private mortgage notes, each of these regulatory frameworks directly shapes your legal exposure and operational continuity.

This reference covers the core federal and state regulations that govern private mortgage lending and servicing — what each law requires, why it applies to you, and where compliance gaps create the most risk.

Truth in Lending Act (TILA)

TILA requires clear, accurate disclosure of key credit terms before a loan closes. For private lenders, that means Loan Estimates and Closing Disclosures that accurately reflect the interest rate, payment schedule, and total loan cost. Borrowers who don’t receive proper TILA disclosures have grounds to rescind the transaction, which makes documentation a first-line defense rather than a formality. Common TILA and RESPA misconceptions create costly exposure for private lenders who assume their transactions fall outside its reach.

Real Estate Settlement Procedures Act (RESPA)

RESPA governs the settlement process and prohibits kickbacks, unearned fees, and referral arrangements that inflate settlement costs. During servicing, RESPA sets specific requirements for how servicers handle borrower inquiries, process payments, and manage escrow accounts — including response timelines and recordkeeping standards. Private lenders frequently underestimate RESPA’s reach because they associate it with institutional lending, but the statute applies broadly to private mortgage transactions.

Equal Credit Opportunity Act (ECOA)

ECOA prohibits credit discrimination based on race, color, religion, national origin, sex, marital status, age, or public assistance income. For private mortgage servicers, compliance extends past origination — it governs how you process payments, assess late fees, and handle defaults. Inconsistent treatment of borrowers with similar loan profiles is the most common trigger for ECOA scrutiny. Documented, uniform servicing policies are the practical backstop.

Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act)

The SAFE Act established minimum licensing and registration standards for mortgage loan originators. Private lenders who employ or partner with MLOs need to verify those individuals hold current, valid licenses in every state where they operate. Originating through an unlicensed MLO creates liability that follows the loan, not just the originator. One documented case shows how SAFE Act compliance protected a private lender from a significant enforcement action.

Dodd-Frank Wall Street Reform and Consumer Protection Act

Dodd-Frank reshaped mortgage regulation after the 2008 financial crisis. For private lenders, its practical impact runs through two channels: the creation of the CFPB and the Ability-to-Repay and Qualified Mortgage rules. Understanding how Dodd-Frank underpins those specific requirements is more useful than treating it as abstract background legislation — the rules that directly govern your origination and servicing operations trace back to it.

Consumer Financial Protection Bureau (CFPB)

The CFPB enforces TILA, RESPA, ECOA, and a range of other federal consumer financial laws. It sets disclosure standards, issues servicing guidance, and has authority to examine and penalize non-compliant lenders and servicers. Private mortgage operations aren’t exempt — the CFPB has taken enforcement action against non-bank lenders and servicers. Monitoring CFPB bulletins and rule updates is a standing compliance task, not a one-time review.

Ability-to-Repay (ATR) Rule

The ATR Rule requires lenders to make a reasonable, good-faith determination that a borrower can repay the loan before origination. That determination must be based on income, assets, employment, credit history, and existing debt obligations. For private mortgage lenders, the practical implication is documentation: a well-supported underwriting file is your defense if a borrower later challenges the loan on ATR grounds. Thin files create litigation exposure that follows the note throughout its life.

Qualified Mortgage (QM) Rule

A Qualified Mortgage meets specific structural criteria — stable payments, no negative amortization, no interest-only periods, and points-and-fees within regulatory thresholds. Originating QM loans provides a legal safe harbor against ATR challenges. Private lenders who originate non-QM loans carry full ATR documentation responsibility and higher litigation exposure if a borrower disputes repayment ability. The QM designation is an upstream compliance investment that simplifies downstream servicing.

Home Mortgage Disclosure Act (HMDA)

HMDA requires covered institutions to collect and publicly report loan application and origination data. Reporting thresholds are asset-based and transaction-volume-based, so not every private lender qualifies as a covered institution. Lenders approaching those thresholds need to track them actively. Regulators use HMDA data to identify fair lending patterns, so lenders who fall under its scope face scrutiny that extends well beyond the filing itself.

Fair Credit Reporting Act (FCRA)

FCRA regulates how lenders access and use consumer credit information. Private lenders must have a permissible purpose to pull a credit report at origination and must furnish accurate payment history to credit bureaus during servicing. Inaccurate furnishing generates dispute-investigation obligations, and failing to investigate correctly creates additional liability. Sound recordkeeping practices are the practical foundation for FCRA accuracy compliance.

Gramm-Leach-Bliley Act (GLBA)

GLBA requires financial institutions — including private mortgage lenders — to disclose their information-sharing practices and maintain a written information security program. The Safeguards Rule requires institutions to protect nonpublic borrower financial data against unauthorized access and breach. For private servicers handling sensitive loan information, GLBA compliance is not optional, and the FTC enforces it actively against non-bank financial institutions.

Mortgage Servicing Rules

The CFPB’s Mortgage Servicing Rules under TILA and RESPA govern borrower communication, payment processing, error resolution, and loss mitigation. The rules specify response timelines for borrower inquiries, procedures for handling disputed payments, and requirements for offering loss mitigation options when a borrower falls behind. For private mortgage servicers, adherence to these procedures is the line between defensible servicing and regulatory action. Nine specific compliance checkpoints anchor a sound private servicing operation in 2026.

High-Cost Mortgage Loans (HOEPA)

HOEPA, a provision within TILA, defines a category of high-cost loans based on APR and points-and-fees thresholds. Loans that cross those thresholds trigger mandatory additional disclosures, required borrower counseling, and prohibitions on certain loan terms. Private lenders need to run HOEPA threshold tests on every origination. Inadvertent creation of a HOEPA loan without meeting its requirements generates rescission rights and significant liability.

Usury Laws

Usury statutes set state-level caps on interest rates. The applicable limit is typically tied to the state where the property is located, though choice-of-law provisions in the loan documents and the lender’s home state add complexity. Private mortgage lenders operating across multiple states need a current, jurisdiction-specific rate compliance review for each origination — what’s permitted in one state renders a loan unenforceable in another. Violations void the interest provision or the entire note depending on the jurisdiction.

Servicemembers Civil Relief Act (SCRA)

SCRA provides active-duty military members with specific protections on loans originated before their service began, including statutory interest rate caps on pre-service obligations and restrictions on foreclosure without a court order. Private mortgage servicers must verify military status before initiating any foreclosure and apply SCRA protections when applicable. Willful SCRA violations carry civil penalties and void the foreclosure. The Department of Justice enforces SCRA against non-bank servicers.

Expert Take

These regulations don’t operate as parallel tracks — they overlap. A loan that crosses the HOEPA threshold also demands heightened ATR documentation. A borrower dispute triggers FCRA, RESPA, and mortgage servicing rules simultaneously. Private lenders who build compliance around individual statutes in isolation find the gaps between them are where violations actually occur. The more reliable framework maps the full transaction lifecycle — origination, boarding, payment processing, borrower communication, and default — to every applicable statute at each stage. That’s where durable compliance lives.

For private mortgage lenders and servicers managing these obligations across active portfolios, NSC provides the operational infrastructure to keep servicing compliant throughout the loan’s life. Learn more at NoteServicingCenter.com.