Less enforcement now, same risk later
IN Partnership with
With deregulation dominating the headlines, it would be easy to relax on compliance. But little has actually changed, and SitusAMC’s Scott McNulla makes the case that the risk hasn’t gone away − only the current methods of getting caught have shifted
More
Even a driver who only occasionally speeds on the freeway may be pulled over by a police officer and receive a speeding ticket. The patrol car may not be sitting on the side of the road during your current trip, but eventually they will be there.
The same logic applies to mortgage compliance right now. With enforcement at the federal level easing, the headlines read like a reprieve, and it would be easy for a lender to follow suit. But Scott McNulla, senior managing director of compliance solutions at SitusAMC, urges caution before anyone takes their foot off the brakes.
History shows that the compliance problems that surface in a downturn are rarely the loans written that month. In the economic crisis of 2008, for example, examiners were poring over files from years prior, back as far as 2004 in some cases. That lag is exactly why McNulla is wary of the current mood: the laws on the books haven’t moved, and the risk hasn’t disappeared so much as relocated.
SitusAMC is a leading independent solutions provider to the commercial and residential real estate finance industry. We support many of the world’s top real estate lenders, investors, banks, private equity firms, asset managers, mortgage originators, servicers, issuers, and insurance companies. We help clients originate, transact, manage, and value real estate debt and equity across the full life cycle of commercial and residential real estate finance. Our solutions include advisory, strategic outsourcing, talent, technology, data, analytics, underwriting, servicing, asset management, due diligence, and valuation support. In simple terms, we help real estate finance companies work smarter, faster, and with greater confidence.
“There shouldn’t be a lull or relaxation in a lender’s approach to compliance just because of the headlines”
Scott McNulla,
SitusAMC
Share
Published Jul 27, 2026
“Potential deregulation or lack of enforcement is a current condition, but the possibility of enforceability doesn’t go away − the laws are still out there”
Scott McNulla,
SitusAMC
Same rules, new enforcers While there has been much discussion around deregulation, little has actually changed. Though a March executive order on mortgage credit directs federal agencies, including the Consumer Financial Protection Bureau (CFPB), to consider tailoring the ability-to-repay and qualified mortgage requirements, it doesn’t impact the existing laws in and of itself. Any amendments must move through the proper channels, and until that happens, existing statutes and rules are still in place.
The one genuine shift is at the CFPB: although the agency hasn’t lost any of its authority, it does not appear to be as focused on active enforcement. It’s difficult to predict the direction it will take, since a new director may bring a huge swing in priorities. But, to borrow a battlefield analogy, standing down now doesn’t mean they won’t surge forward at any moment.
In the gap created by the regulator’s pullback, however, other enforcers have taken up the fight. States are introducing more rigorous compliance testing and enforcing the same laws the CFPB does, on their own terms. In short, scrutiny hasn’t gone away – it’s changed hands.
The clearest example is California, which folded its Department of Financial Protection and Innovation and its Department of Real Estate into a single new body, the Business and Consumer Services Agency. Giving the state one coordinated point of oversight, along with the appointment of former CFPB director Rohit Chopra to lead it,
signals an enforcement-minded approach the industry already knows well.
This sets a powerful precedent, with the expectation being that other states will mirror the model. Some states fund their examination work partly through the fines and penalties they collect, providing a strong incentive to coordinate, and shared exams also ease the long-standing staffing constraint. McNulla reads the shift toward more frequent, joined-up oversight as the direction the whole system is taking.
The company you keep Setting the threat of monetary fines aside, there’s a reputational risk that you can’t put a price on. Brokers may not be held to the same standard as the lenders they place business with, but the choice of partner still lands on them.
In wholesale lending, the broker is the face of the loan as far as the borrower is concerned, so a lender that cuts a corner becomes the broker’s problem when something goes wrong. A less scrupulous lender might approve a file a compliant lender would decline, which looks like a win − until the loan goes delinquent. At that point a borrower’s complaint may not stop at the lender. Additional parties may include the broker, the servicer, even the real estate agent who pointed the consumer to the broker in the first place. A bad partner reflects on everyone in the chain. The long-term broker’s relationships with consumers and real estate agents can be impacted long after any short-term benefit is gone.
The stakes can be much higher than a single soured deal because reputation news travels. Consent orders are posted publicly nationwide through systems like NMLS Consumer Access, so a problem in one state follows a firm into every other, and a consumer comparing options may simply walk away. Play fast and loose, as McNulla puts it, and not only can future growth opportunities fail to materialize but the operation may also face volume reductions.
The file tells the story: document the why, not just the what Documentation is an important part of managing risk − it’s the one part of the process fully within the lender’s control. When done well, documentation is the strongest protection for stakeholders if a loan is questioned later. It’s only what’s recorded in the file that moves forward; the catch is that key information that matters may never make it out of the loan origination system.
Intent to proceed is the common example. A borrower can authorize charges for an appraisal only after they’ve said they want to move ahead, but that authorization is often just entered as a note in the platform rather than memorialized in the file itself. If litigation surfaces two years on, by which point the loan may sit with a different owner, a note buried in the platform − or worse, in a broker or borrower’s memory − is of little help.
The deeper point is about the reasoning behind changes. Systems are good at tracking what was done, but they rarely capture why. A rate that was increased or a fee that was updated needs the reasoning attached, because the person who made the update won’t remember it nine months and dozens of borrowers later, if they’re even reachable.
When a loan is sold, it’s not on trust alone. The investor buying it commissions a third-party review − a post-closing check of credit, compliance, and valuation before the deal goes through. A loan that was tested and documented as it was originated moves through that diligence with fewer exceptions, while a disorganized or lacking file is where questions start.
A call to get your house in order A wait-and-see approach carries real risk because compliance pressure is about to increase as state regulators work with the Mortgage Bankers Association and MISMO on a standardized mortgage compliance data set. Regulators will require examination files to be extracted directly from origination
systems, with the extracted data run through an automated compliance engine, and McNulla expects this approach to roll out over the next few quarters.
The effect is scale. A manual review might cover 20 to 40 files while an automated one can process hundreds of loan files (with the possibility of increasing the sample size based on the prevalence of compliance exceptions), reserving deep dives for the loans identified to have compliance exceptions. The response that fits this environment is to test the way the examiners soon will. That post-closing review an investor commissions is exactly what a third-party review firm (TPR) like SitusAMC performs.
SitusAMC also offers a compliance engine, ComplianceEase, that checks loan data throughout the origination lifecycle and post closing, so issues are caught and resolved before the file reaches either a TPR or regulator review. Compliance findings can be addressed so loans will be presented cleaner, with fewer exceptions.
The takeaway? Do what you can to get your house in order now and keep a tidy house in the future.
“There shouldn’t be a lull or relaxation in a lender’s approach to compliance just because of the headlines,” McNulla says. “Potential deregulation or lack of enforcement is a current condition, but the possibility of enforceability doesn’t go away − the laws are still out there. Stay vigilant.”
Federal enforcement falls sharply
Source: Wolters Kluwer Regulatory Violations Intelligence Index
Enforcement actions against financial services firms fell 37% in the first half of 2025, with monetary penalties down 32%
The CFPB retreat
The bureau moved to lay off about 90% of its staff, roughly 1,482 of its employees, and dismissed 16 enforcement actions with prejudice under the new administration
Source: Government Executive and GAO report summary
