Private lenders operating in the U.S. face a layered compliance framework spanning federal statutes and state-specific rules. Mastering regulations like TILA, RESPA, ECOA, and state usury laws protects your capital, ensures enforceable loan terms, and shields your operation from penalties that threaten portfolio performance and borrower relationships.

Federal Regulations Every Private Mortgage Lender Must Know

Federal law sets the baseline for private mortgage lending compliance, and the penalties for violations range from loan unenforceability to civil and criminal exposure. Understanding each statute’s scope lets you build systems that protect your portfolio from origination through payoff.

Dodd-Frank Wall Street Reform and Consumer Protection Act

Dodd-Frank, enacted in 2010 in direct response to the financial crisis, expanded federal oversight across the entire mortgage lifecycle. It created the Consumer Financial Protection Bureau (CFPB) to enforce lending and servicing standards, and introduced stricter requirements for disclosures, fair lending, and foreclosure procedures. For private lenders, your loan products and servicing procedures must meet CFPB-enforced federal standards from initial application through payoff—compliance audits, documentation requirements, and loss mitigation protocols all flow from this statute.

Consumer Financial Protection Bureau (CFPB)

The CFPB is the primary federal enforcement body for private mortgage lenders and servicers. It writes and enforces rules covering disclosures, fair lending, servicing transfers, and loss mitigation. Violations carry significant penalties—monetary fines, required remediation, and reputational harm that erodes borrower trust and investor confidence. Treat CFPB guidance as mandatory, not advisory.

Truth in Lending Act (TILA) / Regulation Z

TILA requires lenders to deliver clear, standardized disclosures of loan terms before consummation. Regulation Z implements TILA and mandates disclosure of the annual percentage rate (APR), finance charges, payment schedule, and total cost of credit. For private mortgage lenders, TILA compliance is non-negotiable at origination. Proper disclosures reduce disputes, defend against legal challenges, and set clear borrower expectations from day one. See 7 Costly TILA/RESPA Misconceptions Every Seller Financier Must Avoid for common structuring pitfalls.

Real Estate Settlement Procedures Act (RESPA) / Regulation X

RESPA protects borrowers from abusive settlement practices and governs the full servicing relationship on private mortgage notes. Regulation X implements RESPA and sets requirements for servicing transfers, escrow account administration, and borrower communications about payments and loss mitigation options. RESPA prohibits kickbacks and unearned fees at settlement. Violations at any stage of the loan lifecycle expose lenders and servicers to regulatory action and borrower litigation.

Home Mortgage Disclosure Act (HMDA) / Regulation C

HMDA requires covered institutions to collect and publicly disclose data on mortgage loan applications and originations. Regulation C sets reporting thresholds based on asset size and origination volume. Private lenders who meet those thresholds must report applicant demographics, loan type, and property location. Smaller lenders below the threshold are exempt, but tracking your volume against current thresholds is essential as your portfolio scales.

Fair Credit Reporting Act (FCRA)

The FCRA governs how lenders access, use, and report consumer credit information. Private lenders and servicers must obtain proper authorization before pulling credit reports, report payment history accurately to credit bureaus, and maintain processes for investigating and correcting disputed information. Inaccurate reporting exposes your operation to borrower lawsuits, regulatory scrutiny, and reputational harm that undermines future originations.

Equal Credit Opportunity Act (ECOA) / Regulation B

ECOA prohibits lenders from discriminating against applicants based on race, color, religion, national origin, sex, marital status, age, or receipt of public assistance. Regulation B implements ECOA and requires consistent, non-discriminatory treatment throughout the application and underwriting process, including adverse action notices that meet specific content and timing standards. Private mortgage lenders must audit their underwriting criteria and approval patterns regularly to confirm ECOA compliance. For a full disclosure checklist, see 7 Mandatory Disclosures for Private Mortgage Lenders.

Gramm-Leach-Bliley Act (GLBA)

The GLBA requires financial institutions to protect the nonpublic personal information (NPI) of their customers and to disclose their data-sharing practices in writing. For private mortgage lenders and servicers, this means robust data security controls covering borrower names, addresses, Social Security numbers, and financial details—paired with a clear, current privacy notice delivered to each borrower. Data breaches without demonstrated GLBA compliance expose lenders to regulatory penalties and borrower harm claims.

Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act)

The SAFE Act requires all mortgage loan originators (MLOs) to register or obtain a license through the Nationwide Multistate Licensing System & Registry (NMLS). MLOs must pass a national exam, complete continuing education, and clear background checks before originating loans. Private lenders who employ or contract with individuals originating loans on their behalf must verify NMLS registration status before those individuals act. Failing to ensure proper licensing exposes your business to state enforcement action and loan-level defects that threaten enforceability. See how one private lender avoided six-figure exposure through SAFE Act compliance.

Servicemembers Civil Relief Act (SCRA)

The SCRA provides active-duty servicemembers with legal and financial protections that private mortgage servicers must honor without exception. Eligible servicemembers can request an interest rate reduction to the statutory cap during active duty, and receive protections against foreclosure proceedings without court approval. Servicers must verify military status through federal databases before initiating any collection or foreclosure action on a potentially protected borrower. SCRA violations carry federal penalties and civil exposure.

State-Level Compliance Requirements for Private Lenders

Federal law establishes the floor, but state rules govern the specific terms, rates, and practices private lenders use in each market. A loan that passes federal review can still be unenforceable if it violates a single state-level requirement.

State Usury Laws

State usury laws cap the maximum interest rate a lender can charge on a private mortgage note. These caps vary by state and apply differently based on loan type, borrower classification, and loan amount. Charging a rate above the applicable usury ceiling renders the loan unenforceable in most jurisdictions and exposes the lender to forfeiture of interest—or in some states, of principal as well. Before originating in any state, confirm the applicable usury limit with qualified legal counsel.

State Licensing Requirements

Most states require mortgage lenders and servicers to obtain a state-issued license before conducting business within their borders. Requirements include background checks, financial condition reviews, surety bonds, and ongoing annual reporting. Operating without the required license subjects your business to cease-and-desist orders, fines, and forced loan rescission. Maintain a license tracking system that monitors renewal deadlines and regulatory changes across every state where your portfolio operates. For a broader review, see 9 Compliance Checkpoints for Private Mortgage Loan Servicers in 2026.

State Anti-Predatory Lending Laws

Many states layer additional consumer protections on top of federal requirements, targeting loan structures that regulators have identified as predatory. These statutes restrict origination practices involving excessive fees, mandatory balloon payments, repeated equity-stripping refinances, and lending without meaningful analysis of the borrower’s ability to repay. Private lenders must review the anti-predatory lending statutes of each operating state before structuring loan terms. Violations trigger borrower rescission rights, statutory damages, and attorney fee awards that can exceed the economics of the original loan.

Ability-to-Repay and Qualified Mortgage Rules

The Ability-to-Repay (ATR) rule, implemented by the CFPB under TILA, requires mortgage lenders to make a documented, good-faith determination that the borrower has the capacity to repay the loan before extending credit. This means verifying and documenting income, assets, employment status, and existing debt obligations at underwriting.

Qualified Mortgage (QM) loans carry a presumption of ATR compliance when they meet specific structural criteria—no interest-only payments, no negative amortization, and defined limits on points and fees. Non-QM private mortgage notes, which represent the majority of the private lending market, must demonstrate ATR compliance through thorough underwriting documentation rather than structural eligibility. The burden falls on the lender to show a disciplined evaluation occurred—not that the borrower will perform, but that the lender looked carefully before extending credit. For the most common documentation failures, see 7 Compliance Mistakes Private Lenders Make.

Expert Take

The compliance framework governing private mortgage lending is not static. It shifts with CFPB rulemaking cycles, state legislative sessions, and court decisions that reinterpret existing statutes in ways that surprise even experienced lenders. Private lenders who treat compliance as a one-time setup task face the highest regulatory exposure. Build a quarterly review cadence into your operations, and treat each new state market as a fresh due diligence exercise—not an extension of existing assumptions. The lenders who scale successfully are the ones who institutionalize compliance review before a regulator forces them to.

Frequently Asked Questions

Does TILA apply to private mortgage lenders?

Yes. TILA applies to most private mortgage lenders who extend credit secured by a consumer’s principal dwelling. The disclosure requirements under Regulation Z are mandatory at origination and must meet CFPB standards for content, format, and delivery timing. Failure to deliver compliant disclosures exposes lenders to borrower rescission rights and regulatory enforcement.

Are private lenders subject to RESPA?

RESPA applies to federally related mortgage loans, which covers a broad range of private mortgage transactions secured by residential real estate. If your loans are secured by 1–4 family residential properties and involve federally regulated lenders or federally related programs, RESPA applies. Review your specific loan types with legal counsel to confirm coverage scope and servicing obligations.

What happens if a private lender charges above a state’s usury limit?

Charging above the usury cap renders the loan—or the excess interest—unenforceable in most states. Some states impose forfeiture of all interest charged; others give the borrower the right to rescind the loan entirely. The financial and legal exposure varies by jurisdiction, but exceeding a usury limit is always a material defect that a court will not cure in your favor.

Do private lenders need NMLS licenses?

Private lenders whose employees or contractors originate mortgage loans must ensure those individuals hold active NMLS registrations or state-issued licenses under the SAFE Act. Depending on the state and the nature of lending activity, the lending entity itself also requires an NMLS license. Confirm requirements in each state where you originate before hiring or contracting with any MLO.

How does the ATR rule apply to non-QM private mortgage loans?

Non-QM loans lack the QM safe harbor but remain subject to the ATR rule. Lenders must document a reasonable, good-faith repayment analysis using verified income, employment, assets, and debt information. The legal standard is not that the borrower will repay—it is that the lender conducted a thorough, documented evaluation before extending credit. Inadequate documentation is the most common ATR enforcement trigger for private lenders.