The Regulatory Framework Behind Modern Mortgage Lending, and the Part That Is a Timing Problem

Mortgage compliance is usually taught as a catalogue. Here is Regulation Z, here is Regulation X, here is Regulation B, here are their requirements. The catalogue is necessary and it is not sufficient, because it obscures the property that most of these rules share.

Very few mortgage compliance obligations are satisfied by the content of a single document. Most are satisfied by a relationship: between one document and another, between a document and a date, between a figure disclosed early and the same figure at closing. That structural fact determines what compliance review has to be capable of, and it explains why compliance keeps resurfacing as the leading source of critical defects.

Where the obligations actually sit

Six regimes carry most of the weight in a first-lien residential transaction.

Truth in Lending Act, implemented by Regulation Z. Cost-of-credit disclosure. The annual percentage rate, the finance charge, and the accuracy tolerances applied to both.

Real Estate Settlement Procedures Act, implemented by Regulation X. Settlement services, prohibited referral fees, and servicing transfer requirements.

The TILA-RESPA Integrated Disclosure rule. Introduced to merge overlapping TILA and RESPA disclosures into the Loan Estimate and Closing Disclosure, and now the most frequently cited area of mortgage compliance. [1]

Equal Credit Opportunity Act, implemented by Regulation B. Prohibited bases for discrimination, and the requirement to give specific and accurate reasons for adverse action.

Home Mortgage Disclosure Act, implemented by Regulation C. Reporting of application and origination data.

Ability-to-Repay and Qualified Mortgage. The requirement to make a reasonable, good-faith determination of repayment ability, with the associated verification standards.

The TRID example, which is the general case

TRID is worth examining closely, because it makes the structural point unavoidable.

A creditor must ensure a Loan Estimate is delivered to the consumer, or placed in the mail, no later than the third business day after receipt of the consumer's application. [1] For the Closing Disclosure, the consumer must receive the disclosure at least three business days before consummation, and certain changes: the APR becoming inaccurate, or the disclosed loan product becoming inaccurate: require a corrected disclosure and restart that waiting period. [1]

Now consider what testing that requires.

Business day is defined, and the definition is not the same in every part of the rule. Application is defined by the receipt of six specific pieces of information, so the clock starts on a fact that must itself be established from the file. Received is not the same as sent, and where receipt is presumed rather than evidenced, the presumption has its own timing rule. Whether the APR became inaccurate is a comparison between a figure on one document and a figure on another, assessed against a tolerance.

Not one of those tests can be performed by reading a single document. Every one of them requires holding at least two artefacts against each other and applying a rule that lives outside both.

Why this shows up in the defect data

The industry's own figures now reflect this. Legal, Regulatory and Compliance returned to the top critical defect category in Q4 2025 at 24.66% of findings, up roughly 30% from 18.97% in the prior quarter and rising for a third consecutive quarter. [2]

It is worth being careful about what that does and does not mean. A rising share does not establish that lenders became less careful. Share is relative: it can rise because other categories fell, and Income and Employment did fall over the same period. [2] What the figure does establish is that compliance is now where the largest single block of critical findings sits.

The reason is not mysterious. Compliance obligations are disproportionately relational, and relational defects are the ones a document-by-document review process is least likely to catch.

The consequence for how review is organised

If most compliance obligations are relationships, then a compliance review organised around documents is organised around the wrong unit.

The unit has to be the file, and the test has to be expressible as a rule over multiple artefacts: the Closing Disclosure receipt date must be at least three business days before the consummation date, where business day carries this definition, unless one of these conditions applies. Written that way, a rule can be versioned, applied identically across reviewers, and evidenced at scale. An experienced reviewer applies the same test and can document it: the difference is not that professional judgement is unauditable, but that a written rule makes consistency and evidence a property of the system rather than of individual diligence under time pressure.

Versioning deserves particular emphasis in a regulatory context. Rules change. A file originated in March was subject to March's requirements, and a review programme that cannot demonstrate which version of a rule it applied, and when that version took effect, cannot defend its own findings retrospectively.

What the borrower gets from this

Disclosure timing rules can look like paperwork formalism. They are not.

The three-day windows exist so that a borrower has time to read what they are committing to before they are committed, and time to react when the terms move late in the process. A Closing Disclosure that arrives inside the window is not a technical breach of an arbitrary rule. It is a borrower who did not get the interval the law reserved for them to understand a thirty-year obligation.

That is worth holding onto when compliance review is described, as it often is, as a cost of doing business. The cost framing is accurate from the lender's side. From the borrower's side these are among the few protections that operate automatically, without them having to know they exist or ask for them.

Sources

1. Regulation Z, 12 C.F.R. § 1026.19. Delivery and timing requirements for the Loan Estimate and Closing Disclosure; the corrected-disclosure waiting-period triggers are at § 1026.19(f)(2)(ii), which include the addition of a prepayment penalty.
2. ACES Quality Management, Mortgage QC Industry Trends Report, Q4 and CY 2025. Critical defect rate 1.50% for CY 2025 against 1.52% for CY 2024. Category figures are shares of critical defects, not defect incidence, and are drawn from the report's sample of reviewed loans.