The 2026 Compliance Cheat Codes your team will actually finish.

Your borrowers trust you with their most sensitive financial data. This module delivers practical, operational guidance on protecting that data, from clean desk policies to cybersecurity hygiene to the evolving landscape of consumer privacy rights.

• Clean desk and digital security fundamentals LOs can act on immediately
• Password hygiene, screen-locking, and document handling best practices
• Gramm-Leach-Bliley Act (GLBA) privacy notice requirements and delivery
• State-specific privacy notice requirements (including California)
• The emerging consumer right to access, request deletion, and control their data
• Breach response: HUD notification timelines and company protocol requirements
• Regulators' "look like you're compliant" standard, and how to pass the walk-through test

Fair lending is never just a box to check, it's a mindset. This module goes beyond protected class lists to explore how overt discrimination, disparate impact, and disparate treatment can show up in everyday decisions, and how to recognize and correct them before they become exam findings.

• The three forms of discrimination: overt, disparate impact, and disparate treatment
• Policy-level disparate impact: the minimum loan amount example and economic defense
• Disparate treatment in everyday LO behavior: answered calls, pricing exceptions, responsiveness
• The "Ask Why Five Times" method for uncovering unintentional bias
• Proactive tools (video resources, templated communications) that level the playing field for borrowers
• Management vs. LO roles in fair lending risk

A complaint is one of the most valuable signals your company can receive. This module reframes complaints as compliance intelligence, and shows teams how to investigate, document, respond, and learn from them in a way that satisfies regulators and strengthens your operation.

• Why complaints are feedback, not attacks, and how to use them operationally
• Building a monthly complaint task force and multi-channel feedback monitoring system
• Proper documentation: complaint logs, investigation notes, and regulatory response files
• Distinguishing regulatory complaints from informal feedback and online reviews
• NPI risks in public responses: what you absolutely cannot say on social media
• The internal hand-off rule: when to remove yourself from a complaint response
• What regulators expect to see when they review your complaint management process

ECOA adverse action compliance is one of the most frequently cited exam findings in the industry, and it's almost entirely avoidable. This module gives originators and operations teams the practical pipeline management habits that keep adverse actions timely, accurate, and defensible.

• The 30-day adverse action clock: when it starts and how to manage it in active pipelines
• Notice of incompleteness: a powerful pipeline management tool most shops underuse
• The critical distinction between withdraw vs. decline, and why misusing "withdraw" is a compliance violation
• Decline reason requirements: how to select accurate denial codes and disclose credit bureau sources
• Suspense management and the danger of burying files instead of acting on them
• Operations vs. sales perspective: what each side of the org needs to know
• Go ugly early: why facing a bad file sooner is always better than hoping it resolves

Electronic consent is a compliance prerequisite, not a convenience. This module clarifies the rules around e-consent, document delivery, and IP-based audit trails, and flags the most common assumptions that create avoidable TRID and ECOA problems.

• E-SIGN Act basics: when electronic delivery is valid and when it is not
• The e-consent requirement, and what happens when you assume it without evidence
• How LOS/POS two-factor authentication creates a built-in e-consent audit trail
• IP address tracking and what it means for signature authenticity
• The TRID timing trap: how missing e-consent invalidates your three-day disclosure count
• ECOA appraisal delivery and the e-sign requirement most shops overlook
• When paper delivery is required, and how to pivot without losing days

The credit report is sacred to consumers. Permissible purpose, written authorization, and consumer expectations are all in play every time you pull. This module covers the practical threshold for FCRA compliance in origination, and the simple documentation habits that prevent the most common complaints.

• Permissible purpose in origination: what the law actually requires vs. consumer expectations
• The 1003-as-authorization approach and why verbal confirmation on a recorded line is your best defense
• Simple email confirmation practices that create an inexpensive, defensible paper trail
• Borrower-pay credit report models as a permissible purpose best practice
• Soft vs. hard pull implications and managing consumer expectations around credit impacts
• FACTA overview: consumer rights, dispute obligations, and technology's role in compliance
• Bridging the consumer expectation gap before it becomes a complaint

Borrowers have a right to their appraisal, and that right applies regardless of loan outcome. This module covers the ECOA requirement to deliver appraisals and AVMs, the three-business-day timing rule, waiver mechanics, and the e-disclosure connection most shops forget.

• ECOA mandate: every borrower who has an appraisal or AVM on file gets a copy, period
• Three-business-day delivery requirement before consummation (Saturdays count; federal holidays do not)
• Consummation defined: signing day, not funding day
• Appraisal delivery on adverse action and withdrawn files: the carve-out that does not exist
• Consumer waiver mechanics: how, when, and why to use them
• E-sign consent and appraisal delivery: why emailing without consent creates an ECOA exposure
• AVMs count: why the AVM-only workflow still triggers the same delivery obligation

Timing and fee accuracy are the two fault lines in TRID compliance. This module focuses on the operational habits that keep disclosures on time, fees defensible, and tolerance cures rare, because late disclosures are unrecoverable, and tolerance cures come directly off LO income.

• The three-business-day initial disclosure rule and why a late disclosure is a fatal loan defect
• E-sign's effect on the three-day clock and the most common assumption that blows up closings
• Fee disclosure philosophy: assume fees cannot change and disclose in good faith from day one
• Valid change of circumstance: what qualifies, what does not, and the re-disclosure requirement
• Tolerance cures: what they are, what they cost LOs, and how better pipeline management eliminates most of them
• Technology tools (smart fee engines, LOS integrations) that reduce fee variability
• Why TRID is consistently cited in NMLS Multi-State Mortgage Committee exam findings year after year

UDAAP is the gap-filler, the rule that applies when everything else was technically compliant but the outcome was still wrong. This module explains how UDAAP works in practice, where it shows up in origination and marketing, and how social media posts can become advertising violations without anyone realizing it.

• UDAAP as the regulatory backstop: when technical compliance is not enough
• The "ought to be a law against that" standard and how regulators apply it
• Marketing compliance triggers: when a social media success story becomes deceptive advertising
• Bait-and-switch risk: advertising scenarios you cannot replicate and the UDAAP exposure they create
• Setting consumer expectations as a UDAAP risk management strategy
• Abusive acts defined: taking advantage of consumer vulnerabilities or gaps in understanding
• UDAAP in the context of fee practices, product design, and pipeline management

Social media is advertising, full stop. State regulators are actively hiring examiners specifically to audit LO and company social media for NMLS ID omissions, missing equal housing logos, deceptive rate claims, and fair lending violations in audience targeting. This bonus module covers the minimum required disclosures for any mortgage-related post, the three pillars of a defensible social media compliance program, and the real-world scenarios where well-intentioned posts cross the line.

Required on every mortgage-related social post: company name, company NMLS #, NMLS Consumer Access link, Equal Housing Lender logo, and the LO's name and NMLS ID.