Federal Mortgage Law — HMDA and Consumer Protection
mlopractice study guide with diagrams.
Federal Mortgage Law — HMDA and Consumer Protection
Learning Objectives
By the end of this chapter, you should be able to:
5.Identify the purpose, coverage thresholds, and reporting requirements of the Home Mortgage Disclosure Act (HMDA) and Regulation C.
6.Distinguish between HMDA data collection requirements and the public disclosure obligations of lending institutions.
7.Explain the key consumer protection statutes that govern mortgage origination, including the Equal Credit Opportunity Act (ECOA), Fair Credit Reporting Act (FCRA), and the Fair Debt Collection Practices Act (FDCPA).
8.Recognize the scope and prohibitions of the Gramm-Leach-Bliley Act (GLBA) and its Privacy Rule.
9.Define Unfair, Deceptive, or Abusive Acts or Practices (UDAAP) and apply the standard to common origination scenarios.
10.Understand the interplay between federal consumer protection laws and the SAFE Act’s licensing requirements.
1.1 The Home Mortgage Disclosure Act (HMDA) — 12 U.S.C. 2801, Regulation C (12 CFR 1003)
Purpose and Rationale
Congress enacted HMDA in 1975 to address concerns that lending institutions were redlining — denying credit to borrowers in certain neighborhoods based on racial or ethnic composition, regardless of creditworthiness. HMDA does not prohibit discrimination; rather, it creates transparency by requiring covered institutions to report loan-level data to their regulator. The public and regulators use this data to determine whether a lender is serving the credit needs of all communities it operates in.
Who Must Report
A financial institution must report under HMDA if it meets all three of the following tests:
Asset test: Total assets exceed a threshold set annually by the Consumer Financial Protection Bureau (CFPB). For 2024, the threshold is $54 million.
Location test: The institution has a home or branch office in a Metropolitan Statistical Area (MSA).
Activity test: The institution originated at least 25 closed-end mortgages or 500 open-end lines of credit in each of the two preceding calendar years.
What Data Must Be Collected
For each application, covered institutions must record:
Application date, loan type (conventional, FHA, VA, USDA), and loan purpose (purchase, refinance, home improvement, cash-out refinance).
Loan amount, property value, and lien status (first or subordinate).
Applicant demographic information: race, ethnicity, sex — collected via the Uniform Residential Loan Application (URLA) and based on self-identification.
Action taken (originated, approved-not-accepted, denied, withdrawn, incomplete).
Rate spread for higher-priced loans, and whether the loan is subject to HOEPA rules.
Property location by census tract.
Reporting Deadlines
Institutions must submit HMDA data to the CFPB by March 1 of the year following the reporting year.
The CFPB publishes modified disclosure statements and aggregate data annually.
Common Confusion: HMDA vs. Fair Lending
HMDA data alone does not prove discrimination. It is a screening tool. If HMDA data shows disparities, regulators may conduct a fair lending review under ECOA and the Fair Housing Act. HMDA does not require lenders to make loans in every neighborhood; it requires them to report what they did.
ECOA prohibits discrimination in any aspect of a credit transaction on the basis of:
Race, color, religion, national origin, sex, marital status, or age (provided the applicant has the capacity to contract).
Receipt of public assistance income.
Exercising, in good faith, any right under the Consumer Credit Protection Act.
Key Rules for Mortgage Originators
Notification of adverse action: If a lender denies, terminates, or changes the terms of credit less favorably than requested, it must provide an adverse action notice within 30 days of receiving the application. The notice must state the specific reasons for denial or inform the applicant of their right to request reasons within 60 days.
Prohibited inquiries: A creditor may not ask about an applicant’s race, color, religion, national origin, or sex — except for HMDA reporting, where collection is mandatory but optional for the applicant. Marital status questions are limited to certain circumstances (e.g., secured credit).
Spousal signatures: A creditor may not require a spouse’s signature unless the applicant does not qualify independently and the loan is secured by property owned jointly.
Age and income: A creditor may not discount or ignore income from part-time employment, alimony, child support, or public assistance, provided the applicant demonstrates reliability.
Adverse Action Timing
The 30-day rule applies to completed applications. If an application is incomplete, the creditor must notify the applicant of incompleteness within 30 days and allow a reasonable time to complete it.
FCRA regulates the collection, dissemination, and use of consumer credit information. It ensures that credit reporting agencies (CRAs) maintain accurate records and that consumers can access and correct their files.
Key Mortgage Origination Rules
Permissible purpose: A mortgage originator may obtain a credit report only for a legitimate business need — e.g., in connection with a credit transaction initiated by the consumer.
Adverse action based on credit report: If a lender denies credit based on a credit report, it must provide the applicant with:
An adverse action notice.
The name, address, and phone number of the CRA that supplied the report.
A statement that the CRA did not make the decision and cannot explain it.
Risk-based pricing notice: If a lender offers credit on less favorable terms based on a credit report, it must provide a risk-based pricing notice or a credit score disclosure.
Furnisher obligations: Lenders that report information to CRAs must ensure its accuracy and investigate consumer disputes.
FCRA vs. ECOA Adverse Action
ECOA requires an adverse action notice for all denials, regardless of whether a credit report was used. FCRA adds specific requirements when the denial is based on a credit report. In practice, a single notice can satisfy both statutes if it includes the CRA information.
FDCPA applies to debt collectors — third parties collecting debts on behalf of others — not to original creditors (lenders collecting their own debts). However, mortgage servicers may be treated as debt collectors under certain circumstances.
Key Prohibitions for Collectors
Harassment: No threats of violence, obscene language, or repeated phone calls with intent to annoy.
False representations: A collector may not misrepresent the amount owed, imply legal action that is not intended, or falsely claim to be an attorney.
Unfair practices: Collectors may not collect amounts not authorized by law or agreement, or deposit post-dated checks prematurely.
Validation notice: Within five days of initial communication, the collector must send a written notice stating the amount owed, the creditor’s name, and the consumer’s right to dispute the debt within 30 days.
Mortgage-Specific Relevance
Foreclosure attorneys and servicers handling defaulted loans must comply with FDCPA when engaging in collection activities. Originators are rarely debt collectors, but they must know the rules to avoid referring borrowers to non-compliant third parties.
1.5 Gramm-Leach-Bliley Act (GLBA) — 15 U.S.C. 6801, Privacy of Consumer Financial Information (Regulation P, 12 CFR 1016)
Purpose
GLBA requires financial institutions to protect the privacy of consumer financial information and to disclose their information-sharing practices.
Key Requirements
Privacy notice: At the time of establishing a customer relationship, and annually thereafter, the institution must provide a clear notice of its privacy policies, including what information is collected, with whom it is shared, and how consumers can opt out.
Opt-out right: Consumers must be given a reasonable opportunity to opt out of having their nonpublic personal information shared with non-affiliated third parties.
Safeguards rule: Institutions must implement administrative, technical, and physical safeguards to protect customer records.
Pretexting prohibition: Obtaining customer information under false pretenses is illegal.
Mortgage Originator Application
When a borrower applies for a mortgage, the originator must provide the initial privacy notice. If the borrower becomes a customer (loan closes), annual notices are required. Sharing information with settlement agents, appraisers, or title companies for the purpose of completing the transaction is generally permitted without opt-out because it is necessary to effect the transaction.
1.6 Unfair, Deceptive, or Abusive Acts or Practices (UDAAP) — Dodd-Frank Act, 12 U.S.C. 5531, 5536
The Three Prongs
Unfair: An act is unfair if it causes or is likely to cause substantial injury to consumers, that injury is not reasonably avoidable, and the injury is not outweighed by countervailing benefits to consumers or competition.
Deceptive: An act is deceptive if it involves a material representation, omission, or practice that misleads or is likely to mislead a consumer acting reasonably under the circumstances.
Abusive: An act is abusive if it materially interferes with a consumer’s ability to understand a term or condition, or takes unreasonable advantage of a consumer’s lack of understanding, inability to protect their interests, or reasonable reliance on the covered person.
Mortgage-Specific Examples
Deceptive: Advertising a “fixed rate” when the rate adjusts after two years.
Unfair: Charging a fee for a service that is never performed (e.g., a “processing fee” with no processing).
Abusive: Steering a borrower into a higher-cost loan when a lower-cost loan is available, especially when the borrower is unsophisticated or in distress.
UDAAP vs. ECOA
ECOA prohibits discrimination based on specific protected classes. UDAAP is broader — it prohibits conduct that harms any consumer, regardless of class. A practice may violate UDAAP even if it does not violate ECOA.
1.7 TILA-RESPA Integrated Disclosures (TRID) — Regulation Z (12 CFR 1026) and Regulation X (12 CFR 1024)
Background
TRID, effective October 2015, combined the disclosures required by the Truth in Lending Act (TILA) and the Real Estate Settlement Procedures Act (RESPA) for closed-end consumer mortgage loans. The result is two forms: the Loan Estimate and the Closing Disclosure.
Loan Estimate (LE)
Must be provided within three business days of receiving a complete application.
Contains loan terms, projected payments, closing costs, and a comparison of the loan over five years.
The lender may not charge a fee to obtain the LE except a reasonable credit report fee.
Closing Disclosure (CD)
Must be provided at least three business days before loan closing.
Contains final loan terms, closing costs, and cash-to-close.
If the APR increases by more than 0.125% (0.25% for irregular loans), or if a loan product change occurs, a new three-day waiting period is triggered.
Tolerance Categories
Zero tolerance: Fees that cannot increase from LE to CD (e.g., lender fees, origination charges, fees paid to the lender or its affiliates).
10% tolerance: Fees for services where the provider is not on the lender’s written list, and recording fees. Total increases cannot exceed 10% of the LE amount.
No tolerance: Fees for services where the borrower shopped and chose a provider not on the lender’s list, and property taxes, insurance, and other prepaid items.
1.8 SAFE Act — 12 U.S.C. 5101, Secure and Fair Enforcement for Mortgage Licensing Act
Purpose
The SAFE Act requires states to license and register mortgage loan originators (MLOs). It created the Nationwide Multistate Licensing System and Registry (NMLS).
Key Requirements for MLOs
Pass a written test covering federal and state law, ethics, and general mortgage knowledge.
Complete 20 hours of pre-licensure education (including 3 hours of federal law, 3 hours of ethics, 2 hours of non-traditional mortgage products, and 3 hours of electives).
Complete 8 hours of annual continuing education.
Submit fingerprints and undergo criminal background checks.
Maintain a unique identifier through NMLS.
Prohibited Conduct
An MLO may not engage in any act that constitutes fraud, misrepresentation, or deceit.
An MLO may not be convicted of a felony involving dishonesty, breach of trust, or money laundering within the past seven years (ten years for certain financial crimes).
1.9 FHA, VA, and USDA Program Rules
FHA (Federal Housing Administration)
FHA loans are insured by the federal government and offered by approved lenders.
Borrowers pay an upfront mortgage insurance premium (UFMIP) of 1.75% of the base loan amount, plus an annual mortgage insurance premium (MIP).
FHA requires a minimum down payment of 3.5% for borrowers with a credit score of 580 or higher.
FHA loans are subject to a loan-to-value (LTV) limit of 96.5%.
The property must meet minimum standards and be appraised by an FHA-approved appraiser.
VA (Department of Veterans Affairs)
VA loans are available to eligible veterans, active-duty service members, and certain reservists and National Guard members.
No down payment is required.
A funding fee is charged (waived for veterans with service-connected disabilities).
The VA does not set a minimum credit score, but lenders may impose their own overlays.
The property must be appraised by a VA-approved appraiser, and the veteran must receive a Certificate of Eligibility (COE).
USDA (U.S. Department of Agriculture)
USDA loans are for low- and moderate-income borrowers in eligible rural areas.
No down payment is required.
The program charges an upfront guarantee fee and an annual fee.
Income limits apply based on household size and location.
The property must be owner-occupied and located in a designated rural area.
1.10 Common Exam Traps
Trap 1: Confusing the 3-Day Rescission with the 3-Business-Day CD Rule
Rescission (TILA): For a refinance of a primary residence (not a purchase), the borrower has three business days after closing to rescind the loan. This right does not apply to purchase-money mortgages.
TRID CD rule: The lender must deliver the Closing Disclosure three business days before closing. If the APR changes by more than the tolerance threshold, the waiting period restarts.
Why candidates miss it: Both involve “three days,” but one is a post-closing right and the other is a pre-closing delivery requirement. The rescission period applies to the borrower’s right to cancel; the CD rule applies to the lender’s duty to disclose.
Trap 2: Confusing Broker vs. Lender Duties
A mortgage broker does not fund the loan; a lender does. Under TRID, the lender is responsible for the Loan Estimate and Closing Disclosure. The broker may assist but is not the party required to deliver the LE within three days.
Under RESPA, a broker may not receive a fee that exceeds the reasonable value of services performed.
Why candidates miss it: Many candidates assume the broker is the “creditor” for disclosure purposes. The creditor is the person to whom the obligation is initially payable.
Trap 3: Wrong Tolerance Category on the Closing Disclosure
Zero tolerance: Lender origination charges, points, and fees paid to the lender or its affiliates.
10% tolerance: Third-party services where the provider is on the lender’s written list (e.g., title search, appraisal).
No tolerance: Third-party services where the borrower chose the provider independently, and all prepaid items (taxes, insurance).
Why candidates miss it: Candidates often place appraisal fees in zero tolerance because they are “required.” The correct rule is based on who chose the provider, not whether the service is required.
Trap 4: HMDA Reporting Thresholds
The 25 closed-end / 500 open-end threshold applies to the preceding two years, not the current year. A new institution with no history does not report until it meets the test for two consecutive years.
Why candidates miss it: Candidates assume the threshold applies to the current year’s activity.
Trap 5: ECOA Adverse Action Timing
The 30-day rule applies to completed applications. For incomplete applications, the creditor must notify within 30 days but the applicant has additional time to complete.
Why candidates miss it: Candidates confuse the 30-day adverse action deadline with the 30-day incompleteness notice deadline.
Trap 6: UDAAP vs. FCRA
FCRA requires disclosure of the source of a credit report. UDAAP prohibits misleading statements. A lender that denies a loan for “low credit score” without explaining the score may violate ECOA, not UDAAP.
Why candidates miss it: Candidates over-apply UDAAP to any conduct they find unfair, ignoring the specific statutory framework.
Summary
HMDA provides transparency; ECOA prohibits discrimination; FCRA governs credit information; FDCPA regulates collectors; GLBA protects privacy; UDAAP prohibits harmful conduct; TRID standardizes disclosures; the SAFE Act licenses MLOs; and FHA/VA/USDA impose program-specific rules. Master the timing, thresholds, and tolerance categories — these are the most frequently tested details.
