Federal Mortgage Laws on the SAFE MLO Test: RESPA, ECOA, TILA, HMDA and the Rest of the 24%

Federal Mortgage Related Laws is worth 24% of the SAFE MLO Test, about 28 of the 115 scored questions on Passy's arithmetic. It's also the area whose rules leak into the others: TRID timing comes back under origination activities, RESPA's kickback ban under Ethics. NMLS tells candidates to answer on current law, so every rule below comes from the regulation or statute text as published in October 2026, not from older course summaries.

The SAFE MLO federal laws at a glance

RESPA and Regulation X on the SAFE MLO Test

RESPA applies to federally related mortgage loans (12 CFR 1024.5). The exemptions the outline's "RESPA prohibitions, limitations, & exemptions" line points to include business-purpose loans; temporary financing such as a construction loan (with exceptions, for example when it can be converted to permanent financing by the same lender); loans on vacant land unless a structure or manufactured home will be built or placed on it with the loan proceeds within two years; assumptions the lender has no right to approve; conversions to new terms allowed by the original note without a new note; and bona fide secondary-market transfers.

Definitions worth knowing in Regulation X's words (1024.2):

• Mortgage broker: a person, other than an employee of a lender, who renders origination services and serves as an intermediary between a borrower and a lender, including one who closes in its own name in a table-funded transaction
• Settlement service: any service provided in connection with a prospective or actual settlement
• Application: the six TRID items plus "any other information deemed necessary by the loan originator"

The escrow rules in 1024.17 supply several numbers. A servicer may require a cushion of no more than one-sixth of the estimated total annual disbursements from the account, must give an initial escrow account statement at settlement or within 45 calendar days, and must send an annual escrow statement within 30 days after the end of each computation year.

On servicing and foreclosure, the outline's "foreclosure process" line connects to 1024.41(f): a servicer can't make the first notice or filing for foreclosure until the loan is more than 120 days delinquent (with narrow exceptions such as a due-on-sale violation). When servicing is transferred, the old servicer's notice is due at least 15 days before the transfer and the new servicer's within 15 days after (1024.33).

RESPA's Section 8 ban on referral fees, kickbacks and unearned fee splits (1024.14) is the core of the Ethics area; the SAFE MLO ethics guide works through it with scenarios.

ECOA and Regulation B on the SAFE MLO Test

ECOA bars discrimination "on a prohibited basis regarding any aspect of a credit transaction" (1002.4(a)). Regulation B's list of prohibited bases (1002.2(z)) is: race, color, religion, national origin, sex, marital status, age (if the applicant can contract), receiving public assistance income, and having exercised in good faith a right under the Consumer Credit Protection Act.

The rules most often tested:

• Notice of action taken within 30 days after a completed application, 30 days after adverse action on an incomplete one, and 90 days after a counteroffer the applicant doesn't accept or use (1002.9(a)(1))
• Adverse action notices must be written and give the specific reasons, or tell the applicant they can request them within 60 days; the creditor then has 30 days to provide them (1002.9(a)(2))
• "Elderly" means age 62 or older (1002.2(o)); a creditor may use age in its favor
• Marital status may be asked only as married, unmarried or separated when the credit isn't individual unsecured credit (1002.5(d)(1)); alimony and child support may be asked about only after telling the applicant such income needn't be disclosed if they don't want it considered
• Signatures: a creditor can't require a spouse's signature, other than a joint applicant's, if the applicant qualifies alone (1002.7(d)(1)). For secured credit, though, it may require the spouse's signature on an instrument state law makes necessary to reach the property if the borrower defaults, such as one that creates a valid lien (1002.7(d)(4))
• Monitoring information for a home purchase or refinance of a principal residence: the creditor must ask for ethnicity, race, sex, marital status and age, the applicant may decline, and the creditor then notes ethnicity, race and sex, to the extent possible, by visual observation or surname (1002.13)
• Appraisals: a notice of the right to a copy within 3 business days of a first-lien application, and copies of all appraisals and valuations promptly upon completion or 3 business days before consummation, whichever is earlier, at no charge for the copy (1002.14)
• Records kept for 25 months after notifying the applicant of action taken (1002.12(b))

Since July 21, 2026, Regulation B also reflects a CFPB final rule published April 22, 2026: section 1002.6(a) now states that the Act doesn't provide that the "effects test" applies, and the discouragement rule in 1002.4(b) was reworded. Course materials written before July 2026 may still describe an ECOA "effects test" (disparate impact); study the current text, because NMLS tells candidates to answer on current rules. Ethics questions on fair lending lean on these rules too, and 222 Federal Mortgage-related Laws practice questions are planned for full SAFE MLO prep.

TILA and Regulation Z on the SAFE MLO Test

Regulation Z requires creditors to disclose the cost of credit in standard terms. The definitions questions test:

• Finance charge: the cost of consumer credit as a dollar amount, including charges imposed as an incident to or a condition of the credit (1026.4(a)). For real estate loans, bona fide and reasonable title, appraisal, credit report, notary and document-preparation fees and escrow deposits are excluded (1026.4(c)(7))
• Annual percentage rate: the cost of credit as a yearly rate; it's accurate if it's within 1/8 of 1 percentage point of the correct figure in a regular transaction, or 1/4 point in an irregular one (1026.22(a))
• Dwelling: a residential structure with one to four units, attached to real property or not, including condominium and cooperative units and mobile homes used as residences (1026.2(a)(19))
• Residential mortgage transaction: a loan to buy or initially build the consumer's principal dwelling (1026.2(a)(24))

Right of rescission (1026.23). When a loan puts a security interest on the consumer's principal dwelling, each owner can rescind until midnight of the third business day after the last of consummation, the rescission notice and the material disclosures; if the notice or disclosures are never delivered, the right lasts up to 3 years. It doesn't apply to a residential mortgage transaction (a purchase loan), or to a same-creditor refinance except for new money. After a rescission, the creditor has 20 calendar days to return money and release the security interest.

Advertising (1026.24). If a mortgage ad states a triggering term (a down payment amount or percentage, the number of payments or repayment period, a payment amount, or a finance charge amount), it must also state the down payment, the repayment terms and the APR.

High-cost mortgages (HOEPA, 1026.32). A loan secured by the principal dwelling is high-cost if any trigger is met:

• The APR exceeds the average prime offer rate by more than 6.5 percentage points for most first liens, or 8.5 points for a subordinate lien or a first lien under $50,000 on a dwelling that's personal property
• Points and fees exceed 5% of the total loan amount (for loans at or above a threshold of $27,592 in 2026), or the lesser of 8% or $1,380 for smaller loans. These are the 2026 figures; they adjust every January 1, and the 2027 values hadn't been published in the Federal Register as of October 28, 2026
• A prepayment penalty can apply more than 36 months after consummation or exceed 2% of the amount prepaid

High-cost mortgages require pre-loan counseling from a HUD-approved counselor (1026.34(a)(5)) and extra disclosures at least 3 business days before consummation (1026.31(c)), and they ban terms such as most balloon payments (1026.32(d)).

Higher-priced mortgage loans (1026.35) are a lower tier: a first-lien APR 1.5 or more points above the average prime offer rate (2.5 for first liens above the Freddie Mac purchase limit), or 3.5 points for a subordinate lien. A first-lien HPML needs an escrow account for taxes and insurance, which can't be cancelled at the consumer's request until 5 years after consummation, and only if the balance is under 80% of the original value and the consumer isn't delinquent.

MLO compensation (1026.36(d)). An MLO's pay can't be based on a term of the transaction or a proxy for one, though a fixed percentage of the loan amount is allowed. An MLO paid directly by the consumer can't also be paid by anyone else for that transaction, except that a loan originator organization paid by the consumer may pay its own individual MLOs. Steering and its safe harbor are in the ethics guide, and the TRID disclosures have their own SAFE MLO TRID guide.

HMDA, the FCRA and the Red Flags Rule

HMDA (Regulation C) exists to give the public loan data that help show whether institutions serve their communities' housing needs, guide public investment, and identify possible discriminatory lending patterns (1003.1(b)). A nondepository lender reports if it had an office in a metropolitan statistical area on the preceding December 31 and originated at least 25 closed-end mortgage loans (or 200 open-end lines) in each of the two preceding calendar years (1003.2(g)), and the annual loan/application register is due by March 1 (1003.5(a)).

The FCRA has three mortgage-specific duties to know:

• Credit score disclosure: a lender that uses a credit score for a home loan must give the applicant the score, key factors and the "notice to the home loan applicant" as soon as reasonably practicable (15 U.S.C. 1681g(g))
• Adverse action based on a credit report: notice to the consumer, the score used, the reporting agency's name, address and phone number, a statement that the agency didn't make the decision, and the right to a free report within 60 days and to dispute errors (1681m(a))
• Reporting time limits: most adverse items older than 7 years, and bankruptcies older than 10 years, can't be reported, but those limits don't apply to a report for credit of $150,000 or more (1681c(a)–(b))

The Red Flags Rule (16 CFR 681.1), the FTC's identity theft rule under the FCRA, requires a financial institution or creditor with covered accounts to have a written Identity Theft Prevention Program with policies to identify relevant red flags, detect them, respond to them, and update the program periodically.

BSA/AML and the USA PATRIOT Act for MLOs

Nonbank residential mortgage lenders and originators are "loan or finance companies" under FinCEN's rules (31 CFR 1010.100(lll)). That brings two duties:

• An AML program in writing, approved by senior management, with internal policies and controls, a compliance officer, ongoing training and independent testing (31 CFR 1029.210). The USA PATRIOT Act of 2001 is what made these programs mandatory for financial institutions, through its amendment of 31 U.S.C. 5318(h)
• Suspicious activity reports for transactions of at least $5,000 that the company knows or suspects involve illegal funds, are structured to evade reporting, have no apparent lawful purpose, or facilitate crime. A SAR is due within 30 calendar days of initial detection, extendable to 60 days to identify a suspect, and records are kept 5 years (1029.320)

A SAR is confidential: the company and its staff can't disclose it or reveal its existence, including to the person involved.

Privacy, safeguards and Do-Not-Call on the SAFE MLO Test

GLBA privacy (Regulation P). A financial institution must give a customer a privacy notice no later than when the customer relationship is established, and give a consumer a notice before sharing nonpublic personal information with nonaffiliated third parties outside the rule's exceptions, with a reasonable way to opt out (1016.4, 1016.7). The FTC's own privacy rule (16 CFR 313), also on the reference list, now covers only certain motor vehicle dealers.

The FTC Safeguards Rule (16 CFR 314) names mortgage brokers as financial institutions it covers. It requires a written information security program with a designated Qualified Individual, multi-factor authentication for anyone accessing information systems (unless an equivalent control is approved in writing), and notice to the FTC within 30 days of discovering a security event involving the information of at least 500 consumers.

Do-Not-Call. Under the Telemarketing Sales Rule, outbound telemarketing calls to a residence are allowed only between 8 a.m. and 9 p.m. local time at the called person's location (16 CFR 310.4(c)). National registry entries are honored indefinitely, and a request not to be called again must be honored within 10 business days (47 CFR 64.1200). An established business relationship lasts 540 days after a purchase or financial transaction and 90 days after an inquiry or application (16 CFR 310.2(q)).

Advertising, E-Sign, PMI and the regulators

Regulation N (12 CFR 1014.3) prohibits any material misrepresentation, express or implied, in a commercial communication about any term of a mortgage credit product, including the interest rate, APR, fees and payment amounts. Copies of ads and related materials must be kept 24 months (1014.5).

The E-Sign Act (15 U.S.C. 7001(c)) lets a required written disclosure be delivered electronically only if the consumer, before consenting, is told of the right to paper and to withdraw consent, and consents electronically in a way that shows they can access the format. Regulations B and Z point to these consent rules for electronic disclosures.

The Homeowners Protection Act covers PMI on single-family principal residences financed since July 29, 1999. A borrower with a good payment history can request cancellation when the balance reaches 80% of original value; PMI ends automatically at 78% on the original amortization schedule if the borrower is current; and for a borrower who is current it can't continue past the midpoint of the amortization period (12 U.S.C. 4902). For a purchase, "original value" is the lesser of the sales price or the appraised value (4901). The SAFE MLO math guide computes those points.

Dodd-Frank and the regulators. The Dodd-Frank Act established the Consumer Financial Protection Bureau (12 U.S.C. 5491), which now writes Regulations B, C, P, X, Z and the SAFE Act's Regulation H, and holds the authority over unfair, deceptive or abusive acts and practices (12 U.S.C. 5531). HUD keeps a role the outline also tests, for example approving the housing counselors required for high-cost mortgages. Numbers like these are the reason 125 Federal Mortgage-related Laws flashcards are planned for launch.

A Passy federal-law practice question

This is an original Passy practice question, not an NMLS test item.

A borrower's loan has PMI. The home was bought for $300,000 and appraised at $310,000 at closing, and the borrower has a good payment history and is current. Under the Homeowners Protection Act, at what principal balance can the borrower first ask the servicer to cancel PMI?

• A. $248,000
• B. $240,000
• C. $234,000
• D. $232,500

Answer: B. Original value is the lesser of the sales price and the appraised value, $300,000, and borrower-requested cancellation is available at 80% of it: $240,000. A uses the appraised value, C is the 78% automatic termination point, and D takes 75% of the appraised value, which isn't a Homeowners Protection Act threshold.

Next step for the federal laws

Learn the laws as a table first (purpose, coverage, two or three numbers each), then go deep where the questions cluster: the TRID guide for disclosures and the Uniform State Content guide for the SAFE Act itself. Test recall early with the free SAFE MLO practice questions, and if you want answers tied back to the rule text, planned SAFE MLO questions cite the Regulation Z, X and B sections behind each answer.