Reg X §§1024.35 and 1024.36 on the AI Servicing Desk: The Five-Day Ack, the Thirty-Day Substantive Response, and the Categorization Problem That Decides Everything

Why This Rule Produces More Findings Than the Rest of Reg X Combined

Regulation X's response-to-borrower-inquiries architecture at 12 CFR 1024.35 (Notice of Error, "NOE") and 12 CFR 1024.36 (Request for Information, "RFI") is the single largest source of CFPB servicing findings we see in our customers' recent examination cycles. The CFPB's Supervisory Highlights has flagged servicer NOE and RFI handling in multiple editions since 2021, and the Fall 2023 Supervisory Highlights on mortgage servicing called out specific failure modes: missed clocks, categorization that took a covered error out of scope, responses that did not correct the error, and policies and procedures under 12 CFR 1024.38 that could not produce the record on examination.

The failure mode is almost never that the servicer refused to respond. The failure mode is that the servicer's intake channel categorized the inbound as something other than an NOE or RFI, the clock never started, the response happened outside the covered process, and the record the examiner asked for did not exist in the form the rule expects. The AI agent that is the servicer's first-touch on the phone, on chat, on email, and on the borrower portal is the categorization decision point, and the categorization is the decision that everything else depends on.

We build the agent that handles inbound borrower communications on servicing platforms. The architecture below is what we run to keep the response clocks, the categorization decisions, and the audit record aligned with what the Fall 2023 Supervisory Highlights and the earlier Spring 2022 Highlights on Reg X have told us the examiners will look for.

The Two Clocks and What Each One Requires

The two clocks the rule sets are close in structure and different enough in substance that a servicer that runs them as one process will get one of them wrong. The NOE clock at 1024.35(d) and (e) requires the servicer to acknowledge receipt within five business days and to substantively respond within thirty business days, with a one-time fifteen-business-day extension available on written notice to the borrower before the initial thirty is up. The substantive response has to either correct the error and notify the borrower of the correction, or state after a reasonable investigation that no error occurred and provide the reasoning with contact information for the borrower to request the documents the servicer relied on.

The RFI clock at 1024.36(c) and (d) requires the same five-business-day acknowledgment and the same thirty-business-day response, with the same fifteen-business-day extension available. The response either provides the information requested or states that the information is not available. Two exceptions cut the RFI response window. A request for the current owner or assignee of the loan is a ten-business-day response, not thirty. A request for a payoff statement is not covered by 1024.36 at all; it is covered by the payoff-statement provision in the Truth in Lending Act servicing rules at 12 CFR 1026.36(c)(3), which sets the federal clock: the servicer must send an accurate payoff statement within a reasonable time, and in no case more than seven business days after receipt of a written request. State law can shorten that window further, and the agent tracks the shorter of the applicable clocks per loan.

The servicer that treats the extension window as free is the servicer that will find the CFPB's position on the extension in the next exam. The extension exists for a specific reason and the notice has to happen before the initial thirty is up, has to state the reason for the extension, and has to be documented in the file. A servicer that habitually invokes the extension is a servicer whose reasonableness of the investigation gets questioned in aggregate, and the aggregate pattern is what the examiner is measuring.

The Categorization Decision the Agent Makes on Every Inbound

The rule's covered-error list at 1024.35(b) enumerates the errors that trigger the NOE response process. The list includes failure to accept a payment that conforms to the servicer's written requirements, failure to apply an accepted payment to principal, interest, escrow, or other charges, failure to credit a payment as of the receipt date, imposition of a fee or charge without reasonable basis, failure to provide an accurate payoff balance, failure to provide accurate information about loss mitigation options and foreclosure, transfer of servicing errors, moving to foreclose in violation of the pre-foreclosure protections at 1024.41, and an "any other error relating to the servicing of a borrower's mortgage loan" catchall at 1024.35(b)(11) that the CFPB reads broadly.

The catchall at (b)(11) is the categorization landmine. The CFPB's official commentary to 1024.35 states that (b)(11) covers "errors that servicers may reasonably identify as errors" and the CFPB has been unwilling to accept narrow interpretations. A borrower's letter complaining about the servicer's communication frequency, about the servicer's handling of a hazard-insurance issue, about the servicer's response time on a prior inquiry, or about the servicer's treatment during a hardship conversation is potentially within (b)(11) if it identifies a servicing error the servicer can reasonably act on.

The RFI categorization at 1024.36 is broader still. Any information request "with respect to the borrower's mortgage loan" is an RFI, subject to the exclusions at 1024.36(f) for duplicative requests, overbroad or unduly burdensome requests, information that is not directly related to the borrower's mortgage loan, information that is confidential or proprietary, or requests submitted at an address the servicer has not designated. The categorization can only exclude an RFI if the servicer can defend the exclusion on the specific rule text; a servicer that concludes a request was "overbroad" without a documented reasonableness analysis is a servicer whose exclusion will not hold.

The agent's classification model runs on every inbound with the categorization decision as the primary output. The model's confidence threshold is set high; a borderline inbound is classified as covered by default because the cost of the false positive (running the covered process on a non-covered inbound) is far smaller than the cost of the false negative (missing a covered inbound and losing the clock). The agent that classifies conservatively is the agent that keeps the servicer's covered-inbound rate at the level the examiner will consider reasonable.

The Designated Address Problem Every Servicer Under-Runs

The rule allows the servicer to designate an address (physical, email, or online portal) for NOE and RFI submissions at 1024.35(c) and 1024.36(b). The designation, if made, has to be disclosed to the borrower with the annual escrow statement, on the periodic statements under 1026.41, and on the servicer's website. A borrower who submits to a designated address is covered by the response process. A borrower who submits to a non-designated address is not, and the servicer's response obligation on the non-designated submission is not triggered.

The "not triggered" language does not, in practice, save the servicer from the exam finding. The CFPB has consistently taken the position that the servicer's actual receipt of a communication that meets the substance of an NOE or RFI creates a de facto response obligation, whether or not the borrower routed the communication to the designated address. The 1024.38 policies-and-procedures requirement compounds this: a servicer whose staff receives an NOE-substance communication and does not route it to the designated intake is a servicer with a policies-and-procedures problem regardless of the technical categorization of the inbound.

The AI agent's role is to intercept these misrouted communications at the point of intake and either route them to the designated intake with the clock starting from receipt, or accept them at the intake with the clock starting from receipt. The agent's boundary is clear: the servicer's actual receipt is the clock-starting event, and the agent does not have the discretion to reject an inbound on the technical designated-address ground because the CFPB's expectation is that the servicer would not use the ground even if it applied.

The audit posture we build is that every borrower communication the agent handles that could substantively be an NOE or RFI is routed through the covered process, with the routing decision logged with the timestamp of receipt, the classification, and the assigned response owner. The examiner asking "did the servicer receive a communication that should have been treated as an NOE and route it correctly" gets an affirmative answer with the record to support it.

The Duplicative-and-Overbroad Exceptions the CFPB Has Narrowed

The 1024.35(g) and 1024.36(f) exceptions for duplicative, overbroad, or unduly burdensome inbounds are narrower in the CFPB's reading than the plain text suggests. The Fall 2023 Supervisory Highlights called out servicers who applied the duplicative-request exception to borrower communications that shared the substance of an earlier inquiry but raised new facts or additional issues, and the CFPB required correction and remediation. The duplicative exception applies when the servicer has previously responded on the substance of the same issue and the borrower is not raising new information or a new issue. It does not apply to a borrower whose second letter is asking for a status update on the first response's remediation, or to a borrower whose second letter is raising a new fact the first letter did not cover.

The overbroad exception is similarly narrow. A borrower who asks for "all communications between the servicer and any third party regarding my loan" is asking for something overbroad on the plain text, but the CFPB's expectation is that the servicer will either narrow the scope by conversation with the borrower or produce what is producible within the scope of the request. A servicer that categorically rejects the request on overbroad grounds without an attempt to narrow is a servicer whose exception will not hold.

The agent's application of the exceptions runs through a validator that requires the exception's factual basis to be documented in the response, that requires a prior-response reference for a duplicative-exception invocation with a specific citation to the prior response, and that requires an offer to narrow the scope for an overbroad-exception invocation. The exceptions are usable, but they are not usable at scale as a way to reduce the servicer's substantive response volume. The examiner's read of the exception's use will be against the population, not against the individual case.

The Investigation Standard the Response Has to Meet

The NOE substantive response has to reflect "a reasonable investigation" of the alleged error. What "reasonable" means in the CFPB's reading is that the servicer looked at the loan history, the payment application record, the escrow account activity, the fee assessments, the loss-mitigation history, and any other records that could bear on the error. A response that says "we investigated and found no error" without any indication of what was reviewed is a response the CFPB has treated as inadequate. The Spring 2022 and Fall 2023 Supervisory Highlights both flagged this pattern specifically.

The response the agent generates for the servicer's review has to include the specific records that were reviewed, the findings of the review, and the reasoning for the conclusion. If the servicer concludes no error occurred, the response has to state the reasoning with enough specificity that the borrower can identify what the servicer relied on and request the underlying documents under 1024.35(e)(1)(ii). If the servicer concludes an error occurred, the response has to identify the correction, the effective date, any refunds or fee reversals, and any credit-reporting corrections.

The agent's role in the investigation is to pull the records the response depends on, to present them to the human reviewer with the alleged error's specific claims mapped to the record evidence, to draft the response with the specific findings and reasoning, and to hold the response for the human reviewer's signoff. The agent does not autonomously conclude the investigation; the substantive response is the servicer's, and the servicer's designated reviewer signs off on the record and the conclusion. The agent's contribution is the assembly, the drafting, and the record-keeping. The judgment is the human's.

The Adverse-Action Interlock With Reg V and Credit Reporting

The NOE response process interacts with the servicer's Fair Credit Reporting Act obligations at Regulation V 1022.42 and the servicer's obligations as a furnisher of credit information. A borrower's NOE alleging inaccurate credit reporting triggers both the NOE response process and the FCRA furnisher-investigation process at Reg V 1022.43. The two processes have different clocks (the FCRA direct-dispute rule has thirty calendar days rather than thirty business days), and the servicer's response has to satisfy both.

We wrote separately on the FCRA furnisher accuracy architecture that runs alongside the NOE process. The interaction point is that the NOE covering a credit-reporting error has to trigger the furnisher investigation, the furnisher investigation has to conclude and report the correction to the credit reporting agencies within its own clock, and the NOE response has to reflect the furnisher investigation's outcome. A borrower's NOE that alleges the servicer reported a late payment that the borrower actually made on time is an NOE, a furnisher direct dispute, and potentially a payment-application error under 1024.35(b)(2). All three tracks have to close cleanly, and the closing of one track has to feed the response the borrower receives.

The agent's interlock is that any NOE identified as involving credit reporting is flagged to the furnisher investigation queue with the NOE clock and the FCRA clock both tracked in the case file. The response the borrower receives references the furnisher investigation's conclusion, and the furnisher's report to the credit reporting agencies is attached to the case file for the exam record. The two processes are separate rules and one process on the operational side, and the agent is the coordination layer that keeps them synchronized.

The 1024.38 Policies and Procedures Backbone the Agent Has to Encode

12 CFR 1024.38 requires the servicer to maintain policies and procedures reasonably designed to achieve specific objectives including accessing and providing accurate and timely information to borrowers, properly evaluating loss-mitigation applications, facilitating oversight of and compliance by service providers, facilitating transfer of information during servicing transfers, and informing borrowers of the availability of resources and options during delinquency.

The NOE and RFI processes are the operational implementation of several 1024.38 objectives. The examiner reading the servicer's 1024.38 posture on the NOE/RFI processes will look for documented procedures, evidence that the procedures were followed on a sample of cases, evidence that exceptions were flagged and addressed, and evidence that the procedures were updated as the exam feedback or the CFPB guidance evolved.

The agent's contribution to the 1024.38 posture is that every case the agent handles is a documented case in the servicer's record system, with the intake decision, the categorization, the clock start and end, the response content, the reviewer signoff, and any exceptions or extensions all recorded in the case file. The examiner asking "show me the procedure and show me the cases" gets both from the servicer's system, with the agent's record as the operational evidence that the procedure was followed. The servicer whose 1024.38 posture depends on manual compilation of NOE/RFI case files at exam time is the servicer whose posture is weakest; the servicer whose case files are the natural output of the agent's operation has the strongest posture.

The Loss-Mitigation Interaction With 1024.41

The NOE process interacts with the loss-mitigation rules at 12 CFR 1024.41 in a way that surfaces frequently in exam findings. A borrower who submits a loss-mitigation application and also alleges an error under 1024.35 is a borrower whose case is running under both rules. The 1024.41 dual-tracking prohibition prevents the servicer from moving to foreclosure while a complete loss-mitigation application is under evaluation, and the borrower's NOE alleging an incomplete loss-mitigation evaluation can be an error under 1024.35(b)(9) (moving to foreclose in violation of the pre-foreclosure protections) or 1024.35(b)(10) (failure to comply with the loss-mitigation procedures).

We wrote separately on the 1024.41 loss-mitigation servicer playbook, and the NOE interaction is that a loss-mitigation-adjacent NOE has to trigger a review of the servicer's loss-mitigation conduct on the loan, the correction of any procedural error the review identifies, and the response to the borrower reflecting the corrections. A servicer that responds to a loss-mitigation NOE by pointing back at the loss-mitigation team's file without a documented review of the file against the 1024.41 requirements is a servicer whose response will not hold at exam.

The agent's routing of loss-mitigation-adjacent NOEs runs through a specific queue that flags the case for a dual review: the NOE reviewer reviews the alleged error, and the loss-mitigation reviewer reviews the loss-mitigation conduct. The two reviews converge on a single response that either identifies and corrects errors or documents the specific record supporting the servicer's position. The dual review is more expensive than a single track but the cost of getting the interaction wrong is the exam finding on both rules simultaneously.

The Fee-Charging Prohibition and the Common Mistake

1024.35(h) and 1024.36(h) both prohibit the servicer from charging a fee for responding to an NOE or an RFI. The prohibition is absolute; a fee that is nominally for the servicer's time in producing records or for the servicer's investigation of an alleged error is a fee prohibited by the rule. The CFPB has flagged fee-charging violations in multiple supervisory cycles, and the pattern typically is that the servicer's fee schedule includes a "research fee" or a "records production fee" that is triggered by a customer request, and that fee is being applied to what are, on the substance, NOE or RFI responses.

The agent's role is to ensure that any borrower-facing communication that responds to an NOE or RFI does not carry a fee and that any related back-office ticket does not accrue billable time that ends up on the borrower's account. The validator blocks any response that would apply a fee, flags the case for review if the borrower's account has a research or records-production fee pending, and produces the record that the response was fee-free. The examiner's fee-charging test will not find a fee, because the agent's response architecture does not have the ability to add one.

The Payoff Statement Line the RFI Does Not Cross

A borrower's request for a payoff statement is not an RFI under 1024.36. The federal clock is set by 12 CFR 1026.36(c)(3) on the TILA servicing side, which requires the servicer to provide an accurate payoff statement within a reasonable time, and in no case more than seven business days after receipt of a written request. RESPA §6 at 12 USC 2605(k)(1)(D) reinforces the obligation, and state law may shorten the clock further; the agent tracks the shorter of the applicable windows per loan.

The agent's handling of a payoff-statement request routes through the payoff-statement process rather than the RFI process, with the seven-business-day federal clock (or the shorter state-law clock) and the specific payoff-statement content the rules require. A borrower who asks a broader question that includes a payoff-statement element gets the payoff-statement portion routed to the payoff process and the RFI portion routed to the RFI process, with the two responses coordinated to arrive together and to reference each other so the borrower does not receive contradictory or confusingly-timed responses.

The categorization at the intake is the decision point. An agent that misclassifies a payoff request as an RFI would give the borrower the longer response window, and the servicer would be out of compliance with the payoff-statement rule even though it was in compliance with 1024.36. The classification model has payoff requests as a distinct class from RFIs and does not conflate them.

The Audit File the Agent Produces Per Case

The artifact set the servicer's compliance team and the CFPB examiner will pull for any given NOE or RFI case is the artifact the agent produces as it operates. Per case, the file contains the borrower's original communication with the receipt timestamp and the intake channel; the classification decision with the reasoning and the model's confidence; the acknowledgment sent within five business days with the timestamp and the delivery confirmation; the investigation the servicer conducted with the specific records reviewed; the substantive response with the timestamp, the content, and the reviewer signoff; any extension notice sent with the reason and the delivery confirmation; any fee-charging attempt blocked by the validator; the credit-reporting or loss-mitigation interlocks activated for the case; and the case's final disposition with any downstream account adjustments, credit reporting corrections, or refunds.

A file that produces this set for every NOE and RFI the servicer handled in the exam period is the file the examiner asks for and finds complete. A file that is compiled after the exam request lands is the file the examiner reads as evidence that the servicer's 1024.38 policies-and-procedures posture is weaker than the servicer represents.

The Failure Mode We Engineer Against

The pattern that produces the worst outcomes in this area is not the servicer that refuses to respond; it is the servicer whose intake channel treats NOE-substance and RFI-substance communications as general customer-service inquiries, whose response happens outside the covered process, and whose record of the response does not have the timestamps and categorizations the covered process requires. When the exam lands, the servicer's population of NOE and RFI cases as reported is small (because most substantive inquiries were classified as general inquiries), but the CFPB's review of the servicer's underlying inbound population identifies dozens or hundreds of communications that should have been treated as NOE or RFI and were not. The finding is not a missed clock on one case; it is a systematic under-categorization across the population.

The architecture we build engineers against this by classifying every inbound conservatively, routing every classification-borderline case through the covered process, keeping the audit file for every case at the covered-process level of detail, and running the classification model against the CFPB's guidance and supervisory highlights on a continuous basis so the categorization aligns with what the current examiner will expect. The result is a servicer whose covered-inbound population is larger than a servicer that classifies aggressively toward "general inquiry," and whose covered-process record is complete for the entire population.

The cost of the conservative classification is real; the covered process is more work per case than the general-inquiry process. The savings from the aggressive classification are visible immediately in the operational metrics, and the cost of the aggressive classification is invisible until the exam. The economics of the exam finding, the remediation, and the CFPB's public order that follows a systematic pattern make the conservative classification the correct decision at the population level even when it looks expensive per case.

The Honest Read

Regulation X §§1024.35 and 1024.36 are two of the most operationally consequential rules in mortgage servicing and two of the most misunderstood. The rule's text is short; the CFPB's expectations layered on top are extensive; the supervisory highlights have been consistent in describing the failure modes; and the servicers whose systems have not been rebuilt against the specific requirements are the servicers whose exam findings on these rules keep repeating. The AI agent on the intake channel is the categorization decision point and the record-keeping engine for the covered process, and the servicer whose agent is architected against the rule's actual requirements rather than against the servicer's legacy intake logic is the servicer whose next exam will read differently on this rule than the last one did.

The other Regulation X rules the servicer handles run alongside this one. We wrote separately on the 1024.41 loss-mitigation process, on the 1024.37 force-placed insurance rules, and on the 1024.17 escrow analysis rules that share the servicer's operational surface with the response-to-borrower-inquiries process. The rules are the same borrower's servicer relationship viewed through the different lenses the regulator uses to examine it, and the agent that runs across all of them with the same architectural discipline is the agent that gives the servicer a coherent posture across the exam's full scope.