The Mortgage AI Field Guide
Page 6 of 11
Ability-to-Repay Under Reg Z 1026.43 in AI-Assisted Underwriting: The Eight Factors, the Revised General QM Price Test, and the Documentation Boundary the Agent Cannot Cross Alone
The ATR/QM rule at Reg Z 1026.43 has been through three rounds of major revision since 2013, and the current General QM definition anchors on an APR-to-APOR price threshold rather than the old 43-percent DTI cap. AI underwriting participates in ATR analysis by producing the eight-factor computation, but the documentation of the third-party verification the rule requires and the qualification decision the rule allocates to the creditor are places the agent's autonomy stops. Where AI actually sits in the ATR workflow and what the audit file has to contain.
RESPA Section 8 and AI-Driven Mortgage Referrals: The Anti-Kickback Architecture for Lead Routing, MSAs, and Co-Marketing
Lead-routing scores, AI co-marketing tools, and pay-per-application platforms have rebuilt the mortgage referral economy in vocabulary that maps very cleanly onto the RESPA Section 8 'thing of value' standard. The posture we put in front of marketing and partnerships so an AI workflow does not produce a 12 CFR 1024.14 finding the next exam catches.
HMDA Data Integrity for AI-Driven Loan Origination: The Reg C LAR Fields, the Resubmission Threshold, and the Audit File That Survives
AI agents on the mortgage intake desk now populate a meaningful share of the 110 HMDA LAR fields before a human ever looks at the file. The Reg C accuracy rules and the CFPB resubmission threshold catch the gaps before fair-lending analysis ever runs, and the architecture has to make field provenance and correction provable per loan.
The SAFE Act Line for AI Mortgage Assistants: When Quoting a Rate Becomes Loan Origination and What NMLS Cares About
The SAFE Act and Reg G/H were written for human MLOs and the definition of 'loan originator' bites on any person who takes an application or offers or negotiates loan terms. AI assistants on the mortgage intake desk straddle that line without realizing it, and the state regulators that examine NMLS are starting to ask. The boundaries we hold the agent to so the institution does not have to sponsor a license for software.
GLBA Safeguards for AI Vendors: 16 CFR 314, the Interagency Guidelines, and the 30-Day Notification Bank IT Cannot Push to Anyone Else
The FTC's 2023 Safeguards amendments added a 30-day breach-notification duty and a list of nine information-security elements every covered non-bank financial institution has to encode. Banks operate under parallel Interagency Guidelines with their own notification rule. AI vendors sit inside both perimeters and the institutions we serve are running diligence and contract terms that anticipate what the next regulator will ask for.
UCC Article 4A and the AI Wire-Verification Architecture: Commercially Reasonable Security Procedures When the Caller Is Verified But the Instruction Is Not
Wire fraud losses are running at multi-billion-dollar annual totals and the legal allocation of those losses runs through UCC Article 4A's commercially-reasonable-security-procedure standard. AI voice authentication of the caller does not, by itself, satisfy the security procedure for a payment instruction. The architecture we run so the bank's Article 4A position holds in court when the instruction was the fraud.
California's Final ADMT Regulations for Banks and Lenders: What the CPPA Lands on Significant Decisions and What Is Due in 2027
The California Privacy Protection Agency finalized its automated decisionmaking technology regulations in late 2025, with phased compliance through 2027 and 2028. The pre-use notice, the access and opt-out rights, the risk assessment attestation, and the cybersecurity audit, applied to a bank or non-bank lender's AI agent on a California consumer.
Regulation F for AI Voice Debt Collection: The 7-in-7 Ledger, the Limited-Content Message, and the Per-Debt Architecture
The CFPB's Regulation F call-frequency presumption, post-conversation wait, limited-content message, and channel opt-out rules are mechanical and per-debt. The agent design we run so an AI voice program does not inherit a 1006.14 harassment finding from a dialer it replaced.
The Interagency 36-Hour Computer-Security Incident Notification Rule Applied to Bank AI Systems
The OCC's Part 53, the FDIC's Part 304 Subpart C, and the Federal Reserve's Part 225 Subpart N gave banks a 36-hour clock on notification incidents. The architecture we run so an AI agent failure, a model-vendor outage, or a prompt-injection-driven exfiltration is detected, classified, and reported inside the window.
Colorado SB 26-189 for Banks and Lenders: The ADMT Framework Replacing the 2024 AI Act and What is Due by January 2027
Colorado repealed and reenacted its 2024 AI Act in May 2026. The replacement is SB 26-189, effective January 1, 2027, which drops the algorithmic-discrimination duty and the impact-assessment regime and instead lands pre-decision notice, a 30-day post-adverse-outcome explanation, and a meaningful human-review right on any 'covered ADMT' that materially influences a financial or lending decision. The version that actually maps to a bank or non-bank lender's operations.
Force-Placed Insurance Under Regulation X 1024.37: What an AI Servicing Agent Has to Get Right Before the Charge Posts
Force-placed insurance is one of the most expensive servicing mistakes a mortgage program can make and the noticing rules at 12 CFR 1024.37 are mechanical. The agent design we run to keep the 45-and-30-day clocks, the reasonable-basis standard, the refund duty, and the credit-bureau correction synchronized across the systems that touch the loan.
Voice Cloning and the End of Voice Biometrics as a Sole Factor: A Caller-Verification Architecture for Banks
Cheap, high-fidelity voice cloning has collapsed voiceprint and knowledge-based authentication as standalone factors on bank phone channels. The NIST 800-63 level we hold caller authentication to, the phishing-resistant factors that survive a synthetic caller, and the agent-side controls we wire around them.
You Ain't Seen Nothin' Yet
- Any loan type, any agency guideline or custom investor overlays.
- Every finding cited to the guideline or document it came from