CFPB mortgage origination exams: Work smarter, not harder

Download RFP
CFPBexamComplying with Dodd-Frank Wall Street Reform and Consumer Protection Act provisions can be daunting because it requires sifting through piles of legislation, staying abreast of new developments, struggling to determine what it means to be compliant, and then knowing what to do to comply. This is certainly true for institutions that lend money directly to consumers, including all mortgage originators, as the Consumer Financial Protection Bureau (CFPB) prepares to examine the industry’s approach to compliance, as well as its day-to-day implementation of regulatory controls.

From inception to conclusion, a CFPB mortgage origination exam can take up to six months and hundreds of hours to complete, and can result in rapidly escalating costs, resource constraints and delayed business objectives. And this is just one aspect of the supervision with which most financial services institutions must contend: At most banks and mortgage companies, the staff could work fulltime on just compliance — even if CFPB compliance is not their primary role, this sort of resource strain can result in overtime hours and relegation of daily business issues. Many organizations facing a CFPB exam find that it is complicated work to maintain daily business activity and good customer service while responding to regulators’ requests.

The good news: There is a smarter way to organize your compliance efforts. Organizations often lack the resources and time to conduct a thorough pre-emptive examination readiness review. A trusted and objective third party can manage a review and identify potential weaknesses that may be corrected before a regulator sets foot in your door. A review can also help clarify which business line managers are in charge of what tasks so that when exam time comes, the process runs more smoothly. The keys to preparedness lie in educating managers not only on the laws and regulations that touch their daily routines, but also on how those routines affect other lines of business and everyone’s ability to be in compliance.

From assigning a worthy point of contact to liaise with the CFPB to knowing how to manage exam questionnaires in a timely and professional manner, there are several ways to ensure a smooth process. An institution’s interaction with the CFPB need not be adversarial; in fact, a collegial, compliant approach must be ingrained in the culture and expected from the top down. All employees must understand the importance of the examination and do their part to effectively incorporate the new CFPB rules into the mortgage origination process. If they fail, they risk reputational issues, government fines and legal fees. Additionally, organizations that don’t meet requirements will be prohibited from expanding to new locations and product lines, hampering growth in a highly competitive environment where diversification is key.

Before the exam: How ready is your organization? An exam can happen at any time, so organizations need to be ready. In our experience, a two-part approach best reflects the examiner’s actual approach and prepares you for the real deal:
  1. Complete a high-level review and assessment of your mortgage origination compliance program.
  2. Conduct comprehensive transactional testing to help identify remediation strategies.

At both of these stages, it is imperative that the compliance and risk teams conducting the reviews have a comprehensive understanding of CFPB guidelines, and how they apply to both business lines and the enterprise as a whole. Those qualified to conduct these sorts of reviews typically hold high-level certification — such as certified regulatory compliance manager, certified community bank compliance officer, or certified risk and compliance management professional, among others — and have a complete understanding of CFPB guidelines, the potential nuances and all potential business implications.

Furthermore, your compliance teams must understand that the individual routines of your employees —from entry level employees up through to senior management and the board of directors — can and will have an impact on organizational compliance. It is not just about having the proper governance and knowledge; it is also about properly managing your people. Without their input and collaboration, you stand the risk of inadequately incorporating the new CFPB rules into the mortgage origination process.

Complete a high-level internal review A proactive and complete internal compliance examination covering the full range of consumer protection laws — including the 19 regulations for which the CFPB has been granted rulemaking authority — can bolster your organization’s mastery of the inevitable exam.

A high-level review should start with understanding the CFPB mortgage origination examination procedures, which consist of seven modules covering the various elements of the mortgage origination process, plus a summary (see sidebar: Get to know the 8 examination modules).

Conduct comprehensive transactional testing Once the initial high-level review is completed, transactional testing should ensure that all loan files, documentation, record keeping, requested deadlines and customer interactions — in other words, all aspects of the actual lending transaction — are compliant with CFPB guidance. This internal review should cover all the same areas that the examination will. The review should conclude with remediation strategies to bolster your compliance program, such as adding system controls, updating procedures, enhancing training programs, adding checklists to daily processes, operationalizing daily routines, and adding detail to loan file and internal documentation.

During the exam: Tips for working with the CFPB Once an organization is notified of an impending exam, knowing what to expect from the CFPB and how to effectively interact with them can significantly shorten the time it takes to complete the exam, and even improve the end result.

Effectively dealing with an exam, however, can place an enormous strain on an organization’s resources. The employees who are assigned to work directly with the CFPB must proactively engage with examiners, including but not limited to anticipating their questions, following up multiple times on a daily basis, and introducing the examiners to different heads of business and corporate offices.

Advanced preparation in three areas can help your organization understand their expectations and work well with examiners.

Designate internal contacts who are up for the task When the regulator walks in the door, companies can avoid a last-minute scramble by having a clear network of individuals in place ready to handle exam activities. It is important that your institution designate a primary internal point of contact
responsible for coordinating communication with the CFPB, including setting up the necessary staff meetings and interviews during the exam process. To support the main point of contact, it might be beneficial to name a second person to coordinate
questionnaire distribution and response collection. These individuals are typically drawn from the legal, compliance or risk areas of the business, and possess an overall understanding of the institutions’ processes and the scope of the exam. Having a qualified designated point of contact who is able to bridge internal silos cannot be underestimated — it can make the difference between compliance and failure.

Next, it is important to identify a senior contact for each line of business, to ensure that responses are accurate and to help coordinate exam presentations or interviews. Contacts should be able to speak to the overall function of their areas, as well as answer questions related to the history and future of their business lines. These individuals likely will also meet with the CFPB during the exam to go over provided responses, expand on them and describe a day in the life of their business lines.

Use meetings to your advantage Typically, prior to the start of the exam, the CFPB will schedule an on-site meeting to introduce the field manager and the examiner in charge. During this meeting, CFPB representatives will go through the overall scope, review period and timing of your exam. This meeting is also an opportunity to give an overview of your institution and, if the CFPB has previously examined your company, to highlight any organizational changes. Having executives and senior management at the meeting not only displays an institution’s commitment to a successful exam, but also helps assure that they understand both the importance of the exam and what to expect during the exam period. In this meeting, you should inform the CFPB of the point of contact for the exam, identify anyone else who should be copied on information requests and establish a preferred contact method.

During the first week of the exam, you should schedule an opening meeting with key management and the previously identified network of plugged-in business managers to meet all the examiners. Though the examiner in charge and field manager will already have an overview of your organization, this introductory meeting will allow you to provide an overview to all your examiners. These discussions will allow both teams to understand the scope of the exam, set expectations on both sides for future meeting and document requests, schedule regular meeting times, and answer further questions.

Throughout the exam, it is important that your point of contact and management team meet with the examiners on a weekly basis to address any possible exceptions or unexpected findings. These meetings will not only allow you to work through and address issues while the exam team is on-site, but also keep your key management team informed of progress.

Get to know the 8 examination modules CFPB procedures consist of eight modules covering the various elements of the mortgage origination process. Here is an overview of each module and important (though not comprehensive) issues to consider when conducting your internal review:
  1. Company business model: The first module of the exam is focused on your business model. Examiners will conduct interviews with relevant department heads to identify mortgage origination channels; determine funding sources; and identify product volume, mix, ends and concentrations. Additionally, you will be asked to provide organizational charts and reporting structures for mortgage originations, including responsibilities for key management team members. Finally, examiners will review your compliance management system, company policies and procedures.
  2. Advertising and marketing: The exam team will aim for a detailed understanding of your marketing program, and determine whether marketing policies, procedures and practices are consistent with legal and regulatory requirements. They will also evaluate any third parties, such as lead generators, and affiliations with other service providers for advertising and offering loan products and services. Finally, marketing and promotional materials will be reviewed for all applicable legal and regulatory requirements. This portion of the exam will include a review of the Truth in Lending Act (TILA), Regulation Z; Real Estate Settlement Procedures Act (RESPA), Regulation X; Equal Credit Opportunity Act (ECOA), Regulation B; Secure and Fair Enforcement Act for Mortgage Licensing Act; and Fair Credit Reporting Act (FCRA), Regulation V.
  3. Loan disclosures and terms: Examiners will review policies, procedures, systems and controls to ensure that disclosures are accurate and timely. They may review complaints and conduct consumer interviews. This portion of the exam will include a review of the TILA, Regulation Z; RESPA, Regulation X; ECOA, Regulation B; FCRA, Regulation V; and Homeowners Protection Act.
  4. Underwriting, appraisals and loan originators: Examiners will determine whether you meet the requirements to consider borrowers’ ability to repay, and whether you verify and maintain a record of the information on which you relied to make underwriting decisions. As part of this section, examiners will generally compare loan documentation to the inputs of any automated underwriting systems. They will also review appraisal policies and procedures to ferret out potential conflicts of interest with regard to independent thirdparty appraisers, as well as with any affiliated appraisal or appraisal management companies. A review of loan originator qualification and compensation policies will be conducted, and used to compare loan files to compensation agreements and the internal policies and procedures that ensure compliance. Examiners will validate individual and company licensing and registration to the extent required. This portion of the exam will include a review of the TILA, Regulation Z, and ECOA, Regulation B.
  5. Closing: Along with ensuring that disclosure requirements are upheld, examiners also look at the manner in which closings are conducted. Consumer complaints in this area can be reviewed — and follow-up interviews with consumers may be conducted — in search of potential violations. In addition, examiners will review whether your institution allows consumers to choose their own title insurer or if they’re steered toward an affiliated service provider. They will also look for any indication of payment referrals or unearned fees. This portion of the exam will include a review of the TILA, Regulation Z, and RESPA, Regulation X.
  6. Fair lending: The purpose of this portion of the exam is to find potential discriminatory practices in any credit operation, and it usually involves a separate request list of documentation, policy, procedures and, sometimes, files for review. Most likely your exam team will work with staff from CFPB headquarters to perform statistical modeling and analysis based on entity-specific information and data. On-site examiners are typically responsible for collecting and reviewing policies and procedures, interviewing employees, and conducting comparative file reviews. This portion of the exam will include a review of the Home Mortgage Disclosure Act, Regulation C, and ECOA, Regulation B.
  7. Privacy: The main objective for evaluating privacy and information sharing will be to ensure that consumers’ nonpublic information is protected as required by federal law. This portion of the exam will include a review of the Gramm-Leach-Bliley Act, Regulation P, and FCRA, Regulation V.
  8. Examiner conclusions and wrap-up: This final examination stage involves delivering a summary of findings, supervisory concerns and regulatory violations, as well as the examiner’s opinion on root causes and whether violations are one-off problems or constitute a pattern of practice.

A CFPB mortgage origination examination can take up to six months to complete and tax your organization’s resources to the hilt. Responding to regulators’ requests while keeping day-to-day business running well means identifying weaknesses that may be corrected before a regulator ever sets foot in your office. Once the CFPB arrives, designating the right internal contacts to liaise with the examiners is key to success, as is understanding that the process needn’t be adversarial. Working toward productive meetings and building collegial relationships with examiners can — and often does — shorten exam times and make the difference between success and failure. Manage exam questionnaires efficiently and effectively The CFPB expects institutions to respond to exam questionnaires within 30 days. This quick turnaround necessitates an immediate review of the questionnaires as they come in. Within 24 hours of receipt, the point of contact should review and forward all questionnaire and document requests to the relevant business managers, assigning each task and setting deadlines for responses and supporting documentation.

Some of the questionnaires, such as the one covering mortgage origination, require weekly or biweekly calls with the CFPB. It is important for the contact to prepare for these calls, which include asking questions on gathering data or clarification of requests. The examiner in charge and field manager are meant to be resources for the institutions — communication with them should be open and consistent. Proactive efforts will lead to a better understanding of the issues from all sides and a better end result.

As the point of contact receives completed materials from the business lines, the contact should review them to verify that the responses and documents are complete and accurate, then organize them so they closely follow the questionnaire and can be easily identified by the institution and the CFPB.

Contacts should ensure that the CFPB understands how to use their institutions’ secure internal file transfer systems and notify the CFPB just before they’re ready to submit the data. Once submitted, the contact should confirm that the CFPB has received the documentation, usually through a notification of receipt and download function.

Download the PDF.

Contact Leslie Watson
Manager, Business Advisory Services
T +1 214 561 2544

Content in this publication is not intended to answer specific questions or suggest suitability of action in a particular case. For additional information about the issues discussed, consult a Grant Thornton LLP client service partner or another qualified professional.

“Grant Thornton” refers to Grant Thornton LLP, the U.S. member firm of Grant Thornton International Ltd (GTIL). GTIL and its member firms are not a worldwide partnership. All member firms are individual legal entities separate from GTIL. Services are delivered by the member firms. GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions. Please visit for details.