Non-QM Is Now Roughly One Loan in Ten. Nobody Agrees How Big That Is.
Two credible sources sized the 2025 non-QM market last year. Polygon Research put it at approximately $239 billion, around 10% of total US origination volume. [1] Bank of America Securities put 2025 originations at $108 billion, projecting $175 billion for 2026. [2]
The gap is more than two to one. Neither number is wrong.
That is the most useful fact about this segment, and it is worth understanding before any operational conclusion is drawn from either figure.
Why the two figures differ, and what is still unverified
The likely explanation is that the numbers measure different things, because "non-QM" is not one definition. State that as a hypothesis, because it is one. Polygon publishes its HMDA-based methodology, [1] the methodology behind the Bank of America estimate has not been obtained, [2] and without both it is not possible to attribute the whole $131 billion difference to any single cause. Two credible estimates can differ without either being wrong, and reconciling them requires the workings, not an inference from the totals.
The wider figure counts loans that fall outside the Qualified Mortgage standard: an underwriting and legal-safe-harbour boundary defined by Regulation Z. A loan can sit outside QM for many reasons: it exceeds the points-and-fees threshold, it uses an income calculation the QM rules do not accommodate, it is interest-only, or its term is unconventional. On that definition, roughly one in ten US mortgages now falls outside QM. [1]
The narrower figure counts what the capital markets treat as non-QM: loans originated to expanded-guideline programmes and aggregated for securitisation. That is a funding-channel definition, and it excludes a great deal of portfolio lending that is technically non-QM but never leaves the originator's balance sheet.
So the plausible reading is that one number describes a regulatory boundary and the other describes a securitisation pipeline. Quoted side by side without that distinction: as they frequently are: they produce an apparent contradiction. What this article does not establish is that the definitional difference accounts for the entire gap; sampling, coverage and vintage could each contribute. Treat the two figures as answering different questions, and ask any vendor or analyst quoting either one which question they meant.
For an operations team the practical question is which boundary your own exposure is measured against. If a risk estimate was built from a securitisation-based figure, it may be counting the funding channel rather than the compliance boundary, and it is the compliance boundary that determines which review requirements attach to a file. Whether that makes your exposure larger, and by how much, depends on your own book. We cannot tell you from published aggregates, and neither can anyone else quoting them.
What is actually inside the segment
The product mix is where the operational difficulty lives, and it has been moving.
On July 2025 rate-lock data, non-QM reached about 8% of total volume, with bank statement loans at roughly 34% of non-QM and investor/DSCR loans at about 29%. [4] By July 2026 the ordering had reversed: investor and DSCR products at 33.5%, bank statement loans at 30.6%, and other expanded-guideline products making up the remaining 35.9%. [4]
Keep two denominators apart here. Those percentages are shares of non-QM rate locks: a measure of what lenders are originating at the point of lock. Separately, DSCR and investor products have been described as around half of non-QM securitisation collateral, which is a different population measured at a different point in the loan's life. [2] The two are not comparable, and a 33.5% lock share does not contradict an "about half" collateral share.
That reversal matters more than the growth rate. A bank statement loan and a DSCR loan are not variations on a theme. They are different qualification logics that fail in different places.
Three qualification logics, three failure modes
Bank statement income. Qualification runs on twelve or twenty-four months of deposits, with an expense factor applied to derive qualifying income. The failure modes are arithmetic and definitional: deposits that are transfers rather than revenue, an expense factor applied inconsistently with the programme, a period that does not match the stated months, or business and personal accounts commingled. None of these is visible in any single document. All of them are visible when the deposit summary, the programme parameters and the income calculation worksheet are compared against each other.
DSCR. Qualification rests on the ratio of property income to debt service, so the borrower's personal income is largely irrelevant and the property's numbers carry the whole file. The failure modes concentrate in the inputs: a rent figure taken from a lease that has expired, a market rent from the appraiser's 1007 that disagrees with the lease, taxes or insurance understated in the debt-service denominator, or an HOA charge omitted. The ratio can be computed correctly from wrong inputs, and a correct computation on wrong inputs is the hardest kind of defect to see.
Asset depletion and foreign national files. Qualification derives income from asset balances over a defined horizon, or documents a borrower with no domestic credit profile. The failure modes are eligibility and sourcing: assets counted that the programme excludes, a depletion period that does not match the programme, documentation that satisfies identity but not source of funds.
What these share is that the defect is a relationship between documents, not an error inside one. Each document can be internally correct and correctly read, and the file still be wrong.
Why conventional QC tooling under-performs here
Most quality control tooling encodes conventional agency logic, because that is where the volume has historically been. Presented with a twelve-month bank statement income calculation or a DSCR file, such a system typically has no rule that applies.
The dangerous part is what happens next. A system with no applicable rule usually reports nothing, and nothing is indistinguishable, in a summary, from a clean file. The absence of a finding gets read as a passed check.
This is why the distinction between a rule ran and passed and no rule ran is not a technical nicety in this segment. In conventional lending, rule coverage is broad enough that the difference rarely bites. In non-QM, where programmes are numerous and bespoke, it is the difference between a review and the appearance of one.
Any system used for non-QM review should be able to answer three questions about every file: which programme was applied, which rules ran, and which rules were skipped. If the third question has no answer, the review's coverage is unknown.
What to take from the numbers
The segment is growing on any definition, and the mix is shifting toward the products with the most input-sensitive qualification logic. Both facts point the same way: the review burden is growing faster than the volume, because the newer mix is harder to check.
The gap between $108 billion and $239 billion is worth carrying into any internal conversation about exposure: as an open question rather than a settled distinction. If a risk estimate was built on a securitisation-based figure, it may be measuring the funding channel rather than the compliance boundary. Establish which, before relying on it.
One further distinction matters more than the sizing, because it changes which rules apply at all. Non-QM is a market label, not a statement about regulatory scope. The ability-to-repay requirement in Regulation Z applies to consumer credit secured by a dwelling; § 1026.43(a) excludes extensions of credit made primarily for a business, commercial or agricultural purpose. [3] A DSCR loan to an investor entity on a rental property is commonly a business-purpose transaction outside ATR, while a bank-statement loan to a self-employed borrower buying a primary residence is consumer credit squarely inside it. Both sit under the same "non-QM" heading and carry materially different obligations. Determine applicability from the purpose and the transaction's characteristics, never from the product label.
Sources
- Polygon Research, How big is the non-QM market?: approximately $239bn for 2025 on an HMDA-based methodology. Polygon supports its own estimate; it does not reconcile to another firm's.
- Bank of America Securities, non-QM origination estimates of $108bn for 2025 and a $175bn projection for 2026. The methodology behind this estimate has not been obtained, so the difference from Polygon's $239bn is not reconciled and should not be attributed to any single cause.
- Regulation Z, 12 C.F.R. § 1026.43. The ability-to-repay requirement applies to consumer credit secured by a dwelling; § 1026.43(a) excludes extensions of credit primarily for a business, commercial or agricultural purpose.
- Optimal Blue rate-lock data. Rate-lock share is a measure of origination mix at lock, and is not the same denominator as securitisation collateral mix; the two should not be compared directly.