Before hiring a private mortgage note subservicer, fund managers need to assess six due-diligence categories: initial documentation review, Subservicing Agreement provisions, SOC audit reports, contractual audit rights, trust account fiduciary controls, and investor-reporting obligations. Each carries distinct regulatory exposure and will surface directly in the fund’s own annual audit.

What due diligence does the fund run against a subservicer?

Diligence on a private mortgage note subservicer centers on four document categories. The fund reviews the subservicer’s SOC 1 Type II report and SOC 2 Type II report, a current certificate of insurance confirming errors-and-omissions and cyber-liability coverage, and the GLBA Safeguards Rule written information security plan.

Licensing diligence requires reviewing the subservicer’s NMLS company record, state-by-state mortgage servicer license status, and — for California-based subservicers — the Department of Real Estate broker license record. The fund should also review the subservicer’s litigation history, regulatory enforcement record, and formal complaint log before executing any agreement.

Expert Take

SOC reports and insurance certificates are the minimum, not the finish line. A subservicer that cannot produce a clean SOC 1 Type II covering at least the prior 12-month operating period is not ready for a fund relationship. That gap will appear in the fund’s own audit as a service-organization finding — an outcome the fund absorbs, not the subservicer.

What does the Subservicing Agreement need to cover?

A well-drafted Subservicing Agreement for a private mortgage note fund addresses four operational areas:

• Service levels. Payment posting within 24 hours of receipt, call answer within two minutes, payoff statement delivery within five to seven business days, and IRS-deadline compliance for 1098 and 1099 issuance.
• Trust account controls. Fiduciary structure naming the fund as beneficiary, monthly three-way reconciliation, and a maintained audit-record framework.
• Records custody. Original notes held by the fund’s collateral custodian; working copies held by the subservicer.
• Termination mechanics. Immediate termination for cause; 30- to 90-day notice for convenience terminations, with a documented deboarding process and records-transfer protocol specified in advance.

Funds that skip the service-level and termination clauses during negotiation encounter the consequences during default events — exactly when a clean exit and rapid deboarding matter most. A review of common pitfalls in managing a fund as a private lender reinforces why contractual specificity on these points is not optional.

Why does the fund need a SOC 1 Type II report?

SOC 1 Type II is the baseline audit standard for a fund-subservicer relationship. It tests Internal Controls over Financial Reporting across a six- to twelve-month operating period, confirming that controls are not just designed correctly but functioning consistently over time.

The fund’s financial-statement auditor incorporates the subservicer’s SOC 1 Type II report into the fund’s own audit under AS 2601 service-organization standards. A qualified opinion on the SOC 1 report appears as a service-organization finding in the fund’s audit and triggers extended procedures — additional cost and scrutiny the fund absorbs. That downstream exposure is why requiring a clean SOC 1 Type II before onboarding is non-negotiable.

Is SOC 2 Type II also required?

After the 2024 GLBA Safeguards Rule notification amendment under FTC 16 CFR §314, SOC 2 Type II has become a baseline expectation for any fund-level subservicing engagement involving private mortgage notes. It tests five Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy — across the same operating-effectiveness window as SOC 1.

The fund should validate the subservicer’s SOC 2 report against its written information security plan and confirm the subservicer has a documented process for notifying affected parties within the FTC’s 30-day window on a reportable data security event. A subservicer without a current SOC 2 report cannot credibly represent GLBA compliance to a fund’s investor base.

What audit rights should the Subservicing Agreement include?

The agreement should give the fund access to the subservicer’s loan files, trust-account records, and compliance documentation within five business days of a written request. It should also provide for at least one annual audit — on-site or virtual — covering a defined loan sample: performing notes, delinquent notes, modified loans, and loans in foreclosure.

Audit scope should extend to the trust account’s three-way reconciliation, the investor-reporting remittance file, and all federal and state compliance covenants. Any audit findings trigger the Subservicing Agreement’s remediation framework, with response deadlines and escalation paths defined in writing before the engagement begins — not negotiated after a finding surfaces.

How does the trust account work on a fund engagement?

The subservicer holds all borrower payments in a segregated fiduciary trust account on behalf of the fund. The fund is the beneficial owner. The borrower is the source of funds. The subservicer is the fiduciary administrator — it does not commingle those funds with its own operating accounts at any point in the payment cycle.

The trust account reconciles monthly across three points: the bank statement, the subservicer’s control ledger, and the beneficiary ledger the fund receives. A California broker-licensed subservicer operates this account under Business and Professions Code §10145 and the Title 10 §2830–§2835 trust fund regulations. Subservicers licensed in other states follow equivalent state-level fiduciary frameworks.

For funds holding fractionated or multi-lender note structures, the trust account framework requires additional precision: each lender’s beneficial interest must be tracked separately, and the remittance logic must match the note’s pro-rata or priority waterfall exactly. The five things to know about multi-lender fractionated mortgage notes covers how that tracking obligation differs from single-lender servicing.

How does the subservicer support the fund’s investor reporting?

The subservicer provides the loan-level remittance data that feeds the fund’s investor-reporting cycle. That data flows into two reporting layers:

• Monthly loan-level reporting. Principal received, interest received, escrow analysis, delinquency status, and reserve position for each note in the portfolio.
• Quarterly waterfall distribution. The fund administrator applies the remittance data against the fund’s preferred-return structure, catch-up provisions, and carried-interest calculation to produce distribution statements for investors.

Annual K-1 issuance is the fund administrator’s responsibility under partnership tax rules, not the subservicer’s — but the accuracy of every K-1 depends on clean monthly loan-level data from the subservicer throughout the year. A remittance file with errors in principal and interest allocation propagates through every downstream report. For a detailed breakdown of what complete investor reporting requires at the note level, see the seven critical elements every trustworthy private mortgage investor report must include. For the tax reporting obligations that flow from servicer-generated data, see the 1098 vs. 1099-INT private mortgage tax reporting guide.

Related Topics

• §3(c)(5)(C) vs. §3(c)(1) for Mortgage Funds
• §3(c)(5)(C) Questions Fund Managers Ask
• 5 Common Pitfalls in Managing a Fund as a Private Lender
• 6 Ways Fractionated Loan Servicing Differs From Single-Lender Notes
• 7 Critical Elements Every Trustworthy Private Mortgage Investor Report Must Include
• §10238 Multi-Lender vs. §25102(f) Private Offering

This article is educational and does not constitute legal advice. Mortgage fund subservicing operates under 12 CFR §1024.31 (RESPA Regulation X), the GLBA Safeguards Rule under FTC 16 CFR §314, and the Investment Company Act §3(c)(5)(C) real estate exception. California broker-licensed subservicers are additionally governed by Business and Professions Code §10145 and Title 10 §2830–§2835. Consult qualified legal counsel and a qualified fund administrator for any specific fund portfolio.

Sources

• 12 CFR §1024.31 — RESPA Regulation X Definitions. Consumer Financial Protection Bureau.
• AICPA SSAE 18 — SOC 1 and SOC 2 Service Organization Control Reporting. American Institute of Certified Public Accountants.
• FTC 16 CFR §314 — Standards for Safeguarding Customer Information. Federal Trade Commission.
• Investment Company Act §3(c)(5)(C) — Real Estate Exception. Securities and Exchange Commission.
• California Business and Professions Code §10145 — Trust Fund Handling. California Legislative Information.