If your loss-mitigation process relies on a calculation engine that produces denial decisions without secondary human review, you carry regulatory exposure that can compound silently for years before it surfaces. CFPB File No. 2022-CFPB-0011, issued December 20, 2022, is the cleanest available case study in what that structural gap produces when it goes uncorrected.

What did the CFPB find at Wells Fargo?

The consent order found software-driven loan-modification calculation errors spanning 2010 through 2018. Borrowers who qualified for modifications under Wells Fargo’s own criteria received denial letters because the calculation engine produced incorrect outputs. A substantial portion of the consumer redress package was directed specifically to mortgage borrowers harmed by those wrongful denials. The order also cited servicing-fee miscalculation and private-mortgage-insurance miscommunication as separate violations.

The enforcement action carried a civil money penalty and a consumer redress obligation that together made it the largest mortgage-servicing enforcement action of the modern era. For a private note portfolio, the scale of the penalty is less instructive than the mechanism: a calculation error that ran undetected for eight years because no secondary review was in place.

How did the calculation engine fail so quietly for so long?

The CFPB findings describe a control failure, not an isolated calculation anomaly. The engine was treated as authoritative. Denial outputs were communicated to borrowers without secondary review, and the error pattern never surfaced in routine quality assurance. Periodic loan-modification accuracy testing — a baseline expectation under §1024.38(b) standard policies and procedures — was either absent or failed to sample the right population. The same pattern repeated across multiple modification-program waves between 2010 and 2018.

The structural lesson for a private lender is direct: automated or formula-based outputs are only as reliable as the review process behind them. A yes/no modification decision that goes straight to a borrower denial letter — without human confirmation that the input data and the calculation are correct — is a latent compliance risk regardless of portfolio size.

What does the failure pattern teach a private lender?

Three lessons translate directly to a private-note portfolio.

Secondary review on every denial. Any calculation tool used to produce a modification approval or denial decision needs human confirmation before the denial letter sends — even on a 50-loan portfolio. Both the calculation and the data that fed it require verification. The servicer who lets the output stand without a second look is replicating the Wells Fargo control failure at whatever scale their portfolio happens to be.

Criterion-specific denial language. Denial letters must state the specific criterion the borrower failed, in plain language. The Fay Servicing consent order (2024-CFPB-0007) addressed this point separately: a borrower who cannot identify the basis for a denial cannot challenge it, and a servicer who cannot document the basis cannot defend it. A generic denial letter is not a defensible denial letter.

Decision-process documentation. File recordkeeping under §1024.38(c) must capture not just what was decided but how the decision was reached — who ran the calculation, what inputs were used, and who reviewed the output before the letter went out. The CFPB reads the file looking for that audit trail. If the trail stops at the output, the file fails the review. See 10 Record-Keeping Requirements for Private Mortgage Note Servicers for the documentation baseline every private servicer should have in place.

Expert Take

The Wells Fargo case is not a warning about technology. It is a warning about removing human review from decisions that affect borrowers. The same structural gap appears in self-serviced private note portfolios with some regularity: the borrower receives a denial letter, the lender believes the process was followed, and neither party can reconstruct how the decision was actually reached. The audit trail that §1024.38(c) requires is not bureaucratic overhead — it is the only proof that the process worked as intended. Any servicer who cannot produce that trail for a randomly pulled denial is carrying unquantified exposure right now.

What are the standalone facts a private lender should retain?

• File: 2022-CFPB-0011, Consumer Financial Protection Bureau, December 20, 2022.
• Respondent: Wells Fargo Bank, N.A.
• Action type: Civil money penalty plus consumer redress — the largest mortgage-servicing enforcement action of the modern era.
• Conduct window: 2010–2018 for the modification-calculation findings.
• Root cause: Calculation engine treated as authoritative without secondary review; error pattern not detected by quality assurance over eight years.
• Other findings in the same order: servicing-fee miscalculation, private-mortgage-insurance miscommunication.

What should a private servicer do this quarter?

Pull a sample of the last 12 months of loss-mitigation denials. For each denial, verify four things: (1) the calculation that drove the decision was correct and can be reproduced from the file; (2) the denial letter states the criterion the borrower failed; (3) the file documents who made the decision and when; and (4) the borrower received a written communication consistent with §1024.41(d) form requirements.

Findings on a small sample stay remediable. The same pattern undetected for eight years is what produced the Wells Fargo outcome. A quarterly denial-accuracy review is the structural control that closes this gap before it compounds. See 7 Steps to Streamlined Compliance: A Private Lender’s Self-Audit Guide for a repeatable audit framework, and 9 Compliance Checkpoints for Private Mortgage Loan Servicers in 2026 for current regulatory benchmarks.

Related Topics

• 7 Compliance Mistakes Private Lenders Make
• 10 Record-Keeping Requirements for Private Mortgage Note Servicers
• 12 Borrower Communication Standards Every Private Note Servicer Must Follow
• 7 Red Flags for Private Lenders Navigating Loan Workouts Safely
• 9 Compliance Checkpoints for Private Mortgage Loan Servicers in 2026