The Private Lender’s Guide to Mortgage Compliance

Private mortgage lenders operating across federal and state frameworks face compliance exposure at every stage – from origination disclosures under TILA and RESPA to state-level licensing, usury limits, and foreclosure procedures. If your note portfolio spans multiple states or involves seller financing, understanding each layer of regulation is foundational to protecting your capital and your license.

Federal Disclosure and Consumer Protection Laws

Truth in Lending Act (TILA) / Regulation Z

TILA, implemented through Regulation Z, requires lenders to disclose the Annual Percentage Rate (APR), total finance charges, and the complete payment schedule before closing. For private lenders, this means delivering early disclosures and a Closing Disclosure in the timeframes the regulation prescribes. Violations can trigger rescission rights – giving borrowers the legal ability to unwind a transaction – which makes accurate, timely disclosure non-negotiable. The common TILA/RESPA misconceptions seller financiers make are worth reviewing before structuring any seller-carry transaction.

Real Estate Settlement Procedures Act (RESPA) / Regulation X

RESPA governs settlement cost disclosures, escrow account administration, and mortgage servicing transfers. It prohibits kickbacks and unearned fees and requires standardized forms including the Loan Estimate and Closing Disclosure. For private servicers, the servicing transfer rules carry particular weight – failure to notify borrowers correctly when a note changes hands creates legal exposure and borrower complaints. Compliant escrow administration under RESPA requires consistent process documentation regardless of loan size.

Home Ownership and Equity Protection Act (HOEPA)

HOEPA, an amendment to TILA, imposes additional protections on “high-cost mortgages” that exceed defined APR or points-and-fees thresholds. When a private loan triggers HOEPA classification, balloon payments and most prepayment penalties are restricted, and additional disclosures are required before closing. Assignee liability under HOEPA means investors who purchase high-cost notes inherit the originator’s compliance risk – making proper threshold analysis at origination essential for anyone buying or selling private mortgage paper.

Equal Credit Opportunity Act (ECOA) / Regulation B

ECOA prohibits discrimination in any credit transaction based on race, color, religion, national origin, sex, marital status, age, or receipt of public assistance. Private lenders must apply underwriting criteria consistently and issue adverse action notices whenever credit is denied, modified, or conditioned on additional requirements. Inconsistent documentation of credit decisions is the most common ECOA exposure point for private lenders operating without formal written underwriting policies.

Fair Credit Reporting Act (FCRA)

FCRA governs how consumer credit information is obtained, used, and disputed. Private lenders and servicers must have a permissible purpose before pulling a credit report and must issue adverse action notices citing the specific reporting agency when a credit report influences a denial. For servicers, FCRA also creates obligations around responding to borrower disputes regarding payment history reported to credit bureaus – a point that becomes operationally significant once a portfolio scales past a handful of notes.

Gramm-Leach-Bliley Act (GLBA)

GLBA requires financial institutions – including private mortgage lenders and servicers – to provide borrowers with privacy notices explaining how nonpublic personal information (NPI) is collected and shared. Borrowers must have the opportunity to opt out of certain third-party data sharing. Beyond disclosure, GLBA mandates a written information security program. For smaller private lending operations, this typically means formalizing data handling procedures that were previously informal or undocumented.

Origination Standards and Federal Regulatory Oversight

Dodd-Frank Wall Street Reform and Consumer Protection Act

Dodd-Frank reshaped mortgage regulation after the 2008 financial crisis, most consequentially by creating the Consumer Financial Protection Bureau (CFPB) and establishing the Ability-to-Repay and Qualified Mortgage rules. For private lenders, the Act’s mortgage servicing rules – covering loss mitigation procedures, dual-tracking restrictions, and communication standards with delinquent borrowers – carry the most day-to-day operational weight. Servicers who bypass the required loss mitigation framework before initiating foreclosure face serious legal exposure and potential liability.

Consumer Financial Protection Bureau (CFPB)

The CFPB is the primary federal regulator covering private mortgage lenders and servicers across most of the frameworks in this guide – from TILA and RESPA disclosures to ongoing mortgage servicing conduct. The CFPB’s supervisory focus has expanded steadily to include non-bank lenders and servicers. Monitoring CFPB supervisory highlights and updated examination procedures is a practical way for private lenders to calibrate their compliance programs without waiting for formal rule amendments.

Ability-to-Repay (ATR) Rule

The ATR rule requires a documented, good-faith determination that a borrower has the financial capacity to repay a residential mortgage before closing. For private lenders, this means verifying and retaining records of income, assets, employment, and debt-to-income ratio at underwriting. ATR violations can surface as borrower defenses in foreclosure proceedings – a costly complication when a non-performing note reaches the loss mitigation or default stage of its lifecycle.

Qualified Mortgage (QM) Rule

QM status provides a legal safe harbor from ATR liability for loans that meet defined criteria: no negative amortization, no interest-only periods past specified thresholds, and points and fees within regulatory limits. Not every private loan needs to be QM, but understanding QM parameters at origination determines how much liability protection a note carries through its life – including if it is later sold, transferred, or placed with a professional servicer. These seven compliance mistakes private lenders make include misunderstanding QM eligibility at the origination stage.

Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act)

The SAFE Act requires Mortgage Loan Originators (MLOs) to be licensed and registered through the Nationwide Multistate Licensing System (NMLS). Anyone taking a residential mortgage loan application or negotiating loan terms on behalf of a private lender must hold a valid MLO license in each applicable state. Private lenders who use unlicensed personnel for origination functions – even informally – face significant regulatory and civil exposure. See how SAFE Act compliance structure protected one private lender’s operation for a concrete example of what proper licensing discipline can mean.

State-Level Compliance Requirements

State Mortgage Licensing Requirements

Beyond the SAFE Act, individual states impose their own licensing requirements on lenders, servicers, and investors – covering minimum net worth, surety bonds, continuing education, and background checks. Requirements vary materially from state to state, and lending across jurisdictions without the correct licenses is one of the most common compliance failures in private mortgage operations. Multi-state private lenders should map their licensing footprint against every state where borrower properties secure notes in their portfolio. These 10 SOPs for hard money lenders include licensing management as a foundational operational control.

State Usury Laws

Usury laws cap the maximum interest rate a lender may charge on a loan. Rates that exceed a state’s usury ceiling can render the loan unenforceable in that jurisdiction – and in some states, violations trigger forfeiture of collected interest or the principal balance itself. Usury limits vary widely by state, loan type, and borrower classification (individual vs. business entity). Private lenders operating across multiple states need current legal guidance on applicable exemptions before quoting rates on any new origination.

State Foreclosure Laws

Foreclosure procedures, timelines, and borrower rights are governed entirely at the state level. Judicial foreclosure states require court proceedings; non-judicial states permit a trustee sale process under a deed of trust. Notice requirements, redemption periods, and mandatory mediation programs differ significantly by jurisdiction. Private lenders and servicers who manage foreclosure without state-specific legal counsel routinely encounter procedural defects that delay recovery and, in some cases, invalidate the foreclosure entirely. These real-world default servicing and foreclosure administration examples show what a professionally managed process looks like from notice through resolution.

Mortgage Servicing Rules (Federal and State)

After origination, private notes are governed by a layered body of federal servicing rules – primarily from the CFPB under Dodd-Frank – and state-specific requirements that often exceed federal minimums. These rules cover payment processing standards, escrow account reconciliation procedures, borrower communication timelines, loss mitigation workflows, and dual-tracking restrictions that prohibit advancing foreclosure while a loss mitigation application is pending. Robust written policies and consistently trained servicing staff are the operational baseline for maintaining compliance across a growing note portfolio. The 2026 compliance checkpoints for private mortgage servicers offer a current-year framework for auditing this layer of requirements.

Expert Take

Compliance in private mortgage lending is not a one-time checklist. It is a continuous operational requirement that shifts as your portfolio grows, as you cross state lines, and as regulators update guidance. The private lenders who carry the least legal exposure are not the ones with the most elaborate programs. They are the ones who document underwriting decisions consistently, apply criteria uniformly, and use a professional servicer who tracks regulatory changes as a core function – not an afterthought. If you want to pressure-test your current compliance posture, this self-audit guide for private lenders walks through the key checkpoints. Note Servicing Center services private mortgage notes and manages the regulatory compliance requirements of ongoing loan administration – contact us to discuss your portfolio.