Supervision and Examination 

Manual

October 2011

This examination manual provides internal guidance to supervisory staff of the CFPB. It does not bind 

the CFPB and does not create any rights, benefits, or defenses, substantive or procedural, that are 

enforceable by any party in any manner. While every effort has been made to ensure accuracy, 

examination procedures should not be relied on as a legal reference.
October 13, 2011 

To the Reader:

This first edition of the CFPB Supervision and Examination Manual is a guide to how the 

Consumer Financial Protection Bureau (CFPB) will supervise and examine consumer financial 

service providers under its jurisdiction for compliance with Federal consumer financial law.

The Manual is divided into three parts. The first part describes the supervision and examination 

process. The second part contains examination procedures, including both general instructions 

and procedures for determining compliance with specific regulations. The third part presents

templates for documenting information about supervised entities and the examination process, 

including examination reports. 

To fulfill its statutory mandate to consistently enforce Federal consumer financial law, the 

procedures in this manual are designed to be used by examiners to examine supervised entities 

that offer similar types of consumer financial products or services, or conduct similar activities. 

While all supervised entities must operate in compliance with applicable laws, CFPB will tailor 

its expectations of how that is accomplished to fit particular entity profiles. 

In this first edition, we have incorporated examination procedures developed under the auspices 

of the Federal Financial Institutions Examination Council (FFIEC) for many of the laws now 

generally enforced by the CFPB, including the Truth in Lending Act, Real Estate Settlement 

Procedures Act, and the Fair Credit Reporting Act. CFPB will also use the Uniform Consumer 

Compliance Rating System established by the Federal Financial Institutions Examination 

Council. 

Our Manual will also include examination procedures organized by product and line of business, 

beginning with procedures for reviewing mortgage servicing. We expect to continually update 

the Manual as compliance requirements evolve. 

A dynamic supervision program depends on continual enhancement. Contributions from all 

stakeholders are critical in the accomplishment of this goal. CFPB welcomes feedback and 

suggestions for improvements from examiners, the banking industry, nonbank financial services 

companies, federal and state agencies, consumer and community groups, and the general public. 

Suggestions may be sent to CFPB_Supervision@CFPB.gov. 
Preface

• Preface

• Table of Contents

Part I – Compliance Supervision and Examination

Supervision and Examination Process

• Overview

• Examinations

Part II – Examinations Procedures

Compliance Management 

• Compliance Management Review

Unfair, Deceptive or Abusive Acts or Practices 

• Narrative

• Examination Procedures

Equal Credit Opportunity Act 

• Narrative

• Examination Program

• Interagency Fair Lending Examination Procedures

• Interagency Fair Lending Examination Procedures – Appendix

Home Mortgage Disclosure Act 

• Narrative

• Examination Procedures

• Home Mortgage Disclosure Act Checklist

Truth in Lending Act 

• Narrative

• Examination Procedures

• Appendix A: High-Cost Mortgage (§ 226.32) Worksheet

Real Estate Settlement Procedures Act 

• Narrative

• Examination Procedures

• Checklist

Homeowners Protection Act 

• Narrative

• Examination Procedures

Consumer Leasing Act 
• Narrative

• Consumer Leasing Act Examination Procedures

• Consumer Leasing Act Checklist

Fair Credit Reporting Act 

• Narrative

• Examination Procedures

Fair Debt Collection Practices Act 

• Narrative

• Examination Procedures

Electronic Fund Transfer Act 

• Narrative

• Examination Procedures

• Checklist

Truth in Savings Act 

• Narrative

• Examination Procedures

• Checklist

Privacy of Consumer Financial Information (502-508 of Gramm Leach Bliley Act)

• Narrative

• Examination Procedures 

• Examination Procedures Attachment

• Checklist

Mortgage Servicing

• Examination Procedures

Part III - Examination Process Templates

Templates

• Entity Profile

• Risk Assessment

• Supervision Plan

• Examination Scope Summary

• Examination Report 

• Examination Report cover page

• Examination Report cover letter
CFPB Supervision 

and Examination Process Overview

CFPB Overview 1

Statutory Background 

Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (the Act)1

established the Consumer Financial Protection Bureau (CFPB) and authorizes it to supervise

certain consumer financial services companies and large depository institutions and their 

affiliates for consumer protection purposes.

2 The Bureau’s purpose is set forth by Section 1021 

of the Act: 

(a) PURPOSE.—The Bureau shall seek to implement and, where applicable, enforce 

Federal consumer financial law consistently for the purpose of ensuring that all 

consumers have access to markets for consumer financial products and services and 

that markets for consumer financial products and services are fair, transparent, and 

competitive.3

Federal consumer financial law

Subject to the provisions of the Act, the CFPB has responsibility to implement, examine for 

compliance with, and enforce “Federal consumer financial law.”4 Those laws include, among 

other things, Title X itself, which prohibits unfair, deceptive, or abusive acts and practices in 

connection with consumer financial products and services,5 and the following “enumerated 

consumer laws”6 and the implementing regulations.7

• Alternative Mortgage Transaction Parity Act of 1982 (12 U.S.C. 3801 et seq.);

• Consumer Leasing Act of 1976 (15 U.S.C. 1667 et seq.);

• Electronic Fund Transfer Act (15 U.S.C. 1693 et seq.), except with respect to Section 920 of 

that Act;

• Equal Credit Opportunity Act (15 U.S.C. 1691et seq.);

• Fair Credit Billing Act (15 U.S.C. 1666 et seq.);

 1 The Act can be found here: http://www.gpo.gov/fdsys/pkg/PLAW-111publ203/pdf/PLAW-111publ203.pdf. 2

Sec. 1024 of the Act authorizes CFPB to supervise certain entities and individuals that engage in offering or providing a 

consumer financial product or service and their service providers that are not covered by Secs. 1025 or 1026 of the Act. 

Specifically, Sec. 1024 applies to those entities and individuals who offer or provide mortgage-related products or services and 

payday and private student loans as well as larger participants of other consumer financial service or product markets as defined 

by a CFPB rule, among others, plus their service providers. Sec. 1025 authorizes CFPB to supervise those entities that are large 

insured depository institutions and credit unions with more than $10 billion in total assets and all their affiliates (including 

subsidiaries), as well as service providers for such entities. Sec. 1026 provides the prudential regulators with consumer 

compliance examination authority for smaller depository institutions ($10 billion or less in total assets) not covered by Sec. 1025. 

The Bureau may, under Sec. 1026, include its examiners on a sampling basis at examinations of smaller insured depository 

institutions to assess compliance with the requirements of Federal consumer financial law. Under Sec. 1026, the Bureau has 

supervisory authority over a service provider to a substantial number of smaller depository institutions. “Insured depository 

institutions” include banks and savings associations. Under Sec. 1029, the Bureau may not exercise any authority over certain

dealers predominantly engaged in the servicing and sale or leasing of motor vehicles. For ease of reference for purposes of this 

manual, entities and individuals within the scope of Sec. 1024 are referred to as “non-depository consumer financial service 

companies,” and those within the scope of Sec. 1025 are referred to as “large depository institutions and their affiliates.” All 

entities and individuals covered by both sections are referred to collectively as “supervised entities.”

3 Emphasis added. See also Sec. 1021(b)(4). 4

See Sec. 1002(14) for the definition of “Federal consumer financial law.” 5

See Sec. 1036; see also 1031. 6

See Sec. 1002(12). Parts of Title XIV of the Act are also designated as enumerated consumer laws. See Sec. 1400(b). 7

See Sec. 1002(12).
CFPB Supervision 

and Examination Process Overview

CFPB Overview 2

• Fair Credit Reporting Act (15 U.S.C. 1681et seq.), except with respect to Sections 615(e) and 

628 of that Act (15 U.S.C. 1681m(e), 1681w);

• Home Owners Protection Act of 1998 (12 U.S.C.4901 et seq.);

• Fair Debt Collection Practices Act (15 U.S.C.1692 et seq.);

• Subsections (b) through (f) of Section 43 of the Federal Deposit Insurance Act (12 U.S.C. 

1831t(c)–(f));

• Sections 502 through 509 of the Gramm-Leach-Bliley Act of 2009 [Privacy of Consumer 

Financial Information](15 U.S.C. 6802–6809) except for Section 505 as it applies to Section

501(b);

• Home Mortgage Disclosure Act of 1975 (12 U.S.C. 2801 et seq.);

• Home Ownership and Equity Protection Act of 1994 (15 U.S.C. 1601 note);

• Real Estate Settlement Procedures Act of 1974 (12 U.S.C. 2601 et seq.);

• S.A.F.E. Mortgage Licensing Act of 2008 (12 U.S.C. 5101 et seq.);

• Truth in Lending Act (15 U.S.C. 1601 et seq.);

• Truth in Savings Act (12 U.S.C. 4301 et seq.);

• Section 626 of the Omnibus Appropriations Act of 2009, Public Law 111–8; and

• Interstate Land Sales Full Disclosure Act (15 U.S.C. 1701).

In addition, the CFPB may enforce the following rules issued by the Federal Trade Commission:

• Telemarketing Sales Rule (16 CFR Part 310),

8

• Use of Prenotification Negative Option Plans (16 CFR Part 425),

• Rule Concerning Cooling-Off Period for Sales Made at Homes or at Certain Other Locations

(16 CFR Part 429),

• Preservation of Consumers’ Claims and Defenses (16 CFR Part 433),

• Credit Practices (16 CFR Part 444),

• Mail or Telephone Order Merchandise (16 CFR Part 435),

• Disclosure Requirements and Prohibitions Concerning Franchising (16 CFR Part 436),

• Disclosure Requirements and Prohibitions Concerning Business Opportunities (16 CFR Part 

437).

 8

The CFPB may enforce the Telemarketing and Consumer Fraud and Abuse Prevention Act. 
CFPB Supervision 

and Examination Process Overview

CFPB Overview 3

Supervision and examination

The statutory frameworks for supervision of large depository institutions and their affiliates and 

for non-depository consumer financial service companies are largely the same,9 although the 

supervision authority for each is found in separate sections of the Act. The frameworks include:

• The purpose of supervision, including examination, to:

o assess compliance with Federal consumer financial laws,

o obtain information about activities and compliance systems or procedures, and

o detect and assess risks to consumers and to markets for consumer financial products and 

services;

• The requirement to coordinate with other Federal and state regulators; and

• The requirement to use where possible publicly available information and existing reports to 

Federal or state regulators pertaining to supervised entities.

Supervision and Examination Principles

Three main principles guide the CFPB supervision process. 

Focus on consumers

The CFPB will focus on risks to consumers when it evaluates the policies and practices of a 

financial institution. We expect that institutions will offer consumer financial products and 

services in accordance with Federal consumer financial laws and will maintain effective systems 

and controls to manage their compliance responsibilities. As we conduct our reviews, we will 

focus on an institution’s ability to detect, prevent, and correct practices that present a significant 

risk of violating the law and causing consumer harm.

10

Data Driven

Like all CFPB activities, the supervision function rests firmly on analysis of available data about 

the activities of entities it supervises, the markets in which they operate, and risks to consumers 

posed by activities in these markets. Supervision staff (examiners and analysts) will use data 

from a wide range of sources: data obtained from the entity and through direct observation 

during monitoring and examination; information provided by the CFPB’s Research, Markets and 

Regulations and Consumer Education and Engagement divisions, the Office of Fair Lending and 

Equal Opportunity, the Enforcement division, Consumer Response Center, and Offices 

addressing the special needs of students, Older Americans, Service members, and the 

underserved; and other state and Federal regulatory agencies. 

 9

Most of the differences in the grants of supervision and examination authority will not be relevant for examiners in 

their daily work; supervised entities will be examined consistent with the applicable statutory provision.

10 The discussion of the Risk Assessment under Pre-examination Planning in this Manual describes more fully what the CFPB 

means by risks or potential risks of consumer harm.
CFPB Supervision 

and Examination Process Overview

CFPB Overview 4

Consistency

The CFPB will supervise both depository institutions that offer a wide variety of consumer 

financial products and services and non-depository consumer financial services companies that 

offer one or more such products. In order to fulfill its statutory mandate to consistently enforce 

Federal consumer financial law, the CFPB will apply consistent standards in its supervision of 

both types of entities, to the extent possible. To help accomplish this, the CFPB will use the same 

procedures to examine all supervised entities that offer the same types of consumer financial 

products or services, or conduct similar activities. 

Such consistency, however, does not dictate uniformity in supervisory expectations. While all of 

the firms under our jurisdiction must follow the law, we understand that the means that they 

employ to achieve that goal will – and likely should – differ. We recognize that large, complex 

entities necessarily have different compliance oversight and management systems than smaller 

entities or those offering a more limited number of products or services. 

Examination Scheduling

Non-depository consumer financial services companies will be identified for examination on the 

basis of risks to consumers, including consideration of the company’s asset size, volume of 

consumer financial transactions, extent of state oversight, and other factors determined relevant 

by CFPB. Examinations will be coordinated with State and prudential regulators as applicable.

11

Regular examination schedules for large depository institutions and affiliates will depend on two

considerations: (1) an assessment of risks to consumers and (2) ensuring consistency with 

statutory requirements that CFPB and prudential regulators coordinate the scheduling of 

examinations of large depository institutions and affiliates and conduct “simultaneous” 

examinations of depository institutions, as well as coordinating examinations with State 

regulators.12

Supervised entities will generally be notified in advance of an upcoming examination.

General Description of Examinations

Examiners will coordinate throughout the supervision and examination process with Supervision 

managers, and analysts, experts, and attorneys from Supervision, Research, Markets and 

Regulations, the Office of General Counsel, and other CFPB divisions at Headquarters. 

Supervision will work especially closely with the Office of Fair Lending and Equal Opportunity 

(OFLEO) and the Enforcement division when reviewing fair lending compliance and evaluating 

other potential violations of Federal consumer financial laws. In this Manual the coordination 

process will generally be referred to as “consulting internally.” Alternatively, “Headquarters” 

 11See Sec. 1024(b)(3). 12See Sec. 1025(e).
CFPB Supervision 

and Examination Process Overview

CFPB Overview 5

will be used to signify the involvement of multiple divisions or offices in addition to 

Supervision.

Specific examination procedures will be similar to those of the prudential and, in some instances,

State regulators.13As appropriate and in accordance with CFPB policy, examiners and 

Supervision managers will generally do the following in the course of an examination: 

• Collect and review available information (from within the CFPB, from other Federal and 

state agencies, and from public sources), consistent with statutory requirements;

• Request and review supplementary documents and information from the entity to be 

examined;

• Develop and obtain internal approval for a preliminary risk focus and scope for the onsite

portion of the examination;

• Go onsite to observe, conduct interviews, and review additional documents and information;

• Consult internally if the examination indicates potential unfair, deceptive, or abusive acts or 

practices; discrimination; or other violations of law;

• Draw preliminary conclusions about the regulated entity’s compliance management and its 

statutory and regulatory compliance;

• Consult internally about follow-up corrective actions that the institution should take, whether 

through informal agreement or a formal enforcement action, if warranted by findings;

• Draft the examination report;

• Obtain appropriate internal review and approval for the examination work and draft 

examination report;

• Share the draft report with the prudential regulator and obtain and consider any comments

they may offer, consistent with statutory requirements; and

• After final internal clearance, finalize and transmit the report to the supervised entity.

During the examination, the Examiner in Charge will communicate with appropriate supervised 

entity personnel about preliminary findings and conclusions. CFPB will seek cooperation from 

the entity to correct any problems identified. 

The CFPB considers all supervisory information, including examination reports and 

ratings, highly confidential. Requirements for the handling of supervisory information not 

only by CFPB employees, but also by supervised institutions are described in its regulation 

on the Disclosure of Records and Information.

14

Detailed examination procedures are located in Part II of this Manual.

 13 Prudential regulators refer to the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, 

National Credit Union Association, and Office of the Comptroller of the Currency.

14 76 FR 45372) (July 28, 2011)
CFPB Supervision 

and Examination Process Overview

CFPB Overview 6

Examination Follow-up

How the CFPB addresses negative examination findings will depend, among other things, on the 

individual facts and circumstances at issue. Whether informal supervisory measures or formal 

enforcement action is necessary will depend on the type of problem(s) found and the severity of 

harm to consumers. Self-correction will be encouraged, but some circumstances may 

nevertheless be sufficiently serious to warrant a public enforcement action. With respect to large 

depository institutions and their affiliates, CFPB will share draft examination reports and consult 

with prudential regulators regarding supervisory action, consistent with statutory requirements.

15

Target and Horizontal Reviews 

In addition to regularly scheduled examinations, CFPB expects to conduct Target and Horizontal 

Reviews. Target Reviews will generally involve a single entity and will focus on a particular 

situation such as significant volume of particular customer complaints or a specific concern that 

has come to CFPB’s attention. Horizontal Reviews will look across multiple entities to examine

issues arising from particular products or practices and determine whether supervisory measures 

or enforcement actions are needed. 

Enforcement Authority

CFPB is authorized to conduct investigations to determine whether any person is, or has, 

engaged in conduct that violates Federal consumer financial law.

16Investigations may be 

conducted jointly with other regulators,

17 and may include subpoenas or civil investigative 

demands for testimony, responses to written questions, documents, or other materials.

18

CFPB may bring administrative enforcement proceedings19 or civil actions in Federal district 

court.20 The Bureau can obtain “any appropriate legal or equitable relief with respect to a 

violation of Federal consumer financial law,” including, but not limited to:

• Rescission or reformation of contracts.

• Refund of money or return of real property.

• Restitution.

• Disgorgement or compensation for unjust enrichment.

• Payment of damages or other monetary relief.

• Public notification regarding the violation.

• Limits on the activities or functions of the person against whom the action is brought.

• Civil monetary penalties (which can go either to victims or to financial education).

CFPB has no criminal enforcement authority.

 15See Sec.1025(e). 16Sec. 1051

17Sec. 1052(a)

18Sec. 1052(b) and (c)

19Sec. 1053

20Sec. 1054
CFPB Supervision 

and Examination Process Overview

CFPB Overview 7

Referral of Matters or Information to Other Agencies

Criminal Activity

In the course of their work, examiners may obtain evidence that a regulated entity or a customer 

has engaged in conduct that may constitute a violation of Federal criminal law. The CFPB is 

required by the Act21 to refer such findings to the Department of Justice (DOJ) for further review 

and action. Examiners who, during the course of conducting their examination duties, believe 

they have found evidence of criminal conduct should consult internally to discuss their findings 

and the appropriate next steps. Headquarters will handle referral of appropriate matters to DOJ.

Some examples of fact scenarios that may necessitate a referral to the DOJ include, but are not 

limited to, the following: 

• Based on documented information that the examiner has obtained, a regulated entity’s 

financial records are comprised of data that appear to be false.

• A regulated entity’s records or files show that it has direct business relationships with 

individuals or businesses based in a country that is the target of one or more types of United 

States government sanctions. (See sanctioned country lists at www.treasury.gov and 

www.state.gov.)

• A loan file or other type of file or record concerning a customer of a regulated entity contains 

one or more of the following documents that may indicate that the customer has engaged in 

potentially criminal conduct: 

o Bank statements that show that the customer has one or more bank accounts in a country 

that is a target of United States government sanctions. (See sanctioned country lists at 

www.treasury.gov and www.state.gov.)

o Based on documented information in a loan file, (1) a loan application appears to contain 

false information, (2) an appraisal for real property appears to contain false information, 

or (3) a document used to verify loan eligibility appears to contain false information. 

(Documents used to verify loan eligibility include but are not limited to bank statements, 

Forms 1099, Forms W-2, and/or federal income tax returns.)

Tax Law Non-Compliance

The CFPB is also required under the Act to refer information identifying possible tax law noncompliance to the Internal Revenue Service (IRS).

22Examiners who, during the course of 

conducting their examination duties, believe they have found evidence of tax law noncompliance should consult internally about the appropriate next steps. Headquarters will handle 

referral of matters to the IRS. 

 21See Sec. 1056 22See Secs. 1024(b)(6) and 1025(b)(5).
CFPB Supervision 

and Examination Process Overview

CFPB Overview 8

Some examples of fact scenarios that may necessitate a referral to the IRS include, but are not 

limited to, the following:

• Based on documented information that the examiner has obtained, a regulated entity’s tax 

returns are comprised of data that appear false. 

• A loan file or other type of file or record concerning a customer of a regulated entity contains 

one or more of the following documents that may indicate that the customer has failed to 

comply with the tax laws:

o Documents used to verify loan eligibility that clearly document that the customer has 

substantially greater income than the income that the customer reported on Federal

income tax returns. Documents used to verify loan eligibility include statements showing 

a customer’s investment portfolio, bank statements, and/or Forms 1099.

ECOA/pattern or practice

The Equal Credit Opportunity Act (ECOA) requires the CFPB to refer matters to DOJ whenever 

the CFPB “has reason to believe that one or more creditors has engaged in a pattern or practice 

of discouraging or denying applications for credit in violation of Section 1691(a)” of ECOA, 

which states ECOA’s basic prohibitions against discrimination.23 In matters that do not involve a 

pattern or practice of discouragement or denial, the CFPB may refer the matter to the DOJ 

whenever the agency has reason to believe that one or more creditors has violated Section

1691(a).24 Headquarters will handle referral of appropriate matters to DOJ.

Matters not within the CFPB’s authority

When examiners find information that may indicate violations of law that are not within the 

CFPB’s authority, the information will be passed on to the appropriate prudential, other Federal,

or state regulator. These situations will generally be handled by the Examiner in Charge, after 

consulting internally.

 2315 U.S.C. § 1691e(g).

24Id.
CFPB Supervision 

and Examination Process Overview

CFPB Overview 9

The Supervision and Examination Cycle

As shown in the graphic and described in more detail below, CFPB supervision will operate as a 

continuous cycle. Although specific examination procedures are consistent, there are some 

differences in the Bureau’s approach to supervising depository institutions, and non-depository

consumer financial services companies, as outlined below. 

 Review and analyze available 

information to identify risks, areas of 

inquiry, and focus

 Request and review documents and 

information needed to begin 

examination (e.g., internal policies, 

audit reports, training materials, 

recent data)

 Make initial plan for on-site testing 

and review

Pre-Examination / Scoping

Monitoring Communicate conclusions and required 

corrective action

Examination (offsite and onsite)

 Interview senior managers, loan 

officers, compliance officers, and 

account personnel as appropriate

 Observe operations (e.g., call 

center, branches)

 Compare policies and procedures to 

actual practices by reviewing a 

sample of transactions

 Compare conduct to legal 

requirements and policy guidance

 Communicate findings and expected 

corrective actions to management 

and Board of Directors

 Pursue appropriate supervisory 

agreement or formal enforcement 

action as needed

 Nonbank – Product / Market 

analysis

 Bank – Periodic checks on 

institution activities; calls and 

meetings

Both —

 Risk Assessment

 Review reports and information

 Review status of corrective actions

 Scoping for the next exam
CFPB Supervision 

and Examination Process Overview

CFPB Overview 10

Non-depository consumer financial services companies

The Nonbank Supervision Risk Analytics and Monitoring team (RAM) in Headquarters will 

provide risk-based analysis of consumer financial markets and participants in the financial 

marketplace to support the examination program. This team will acquire and analyze qualitative 

and quantitative information and data pertaining to consumer financial product and service

markets to determine what industries and institutions pose the greatest risk to consumers. The 

data will include external data, including, but not limited to, Home Mortgage Disclosure Act and 

Home Affordable Modification Program data, institution and industry reports, state and Federal

reports of examination, and legal documents. It will also include CFPB-generated data, such as 

complaints, reports of examination, and market and other reports. Using consumer risk indicators

for particular markets, RAM will provide a risk ranking of entities to program teams for use in 

scheduling examinations. Once a particular examination is scheduled, the examination team will 

follow the same general examination process used for all supervised entities, including 

preparation of a Risk Assessment and an Examination Scope Summary. The Supervision Plan

template will generally not be used for non-depository consumer financial services companies. 

These documents are described below and in Part II of this Manual.

Depository Institutions

Each large depository institution will be assigned a Lead Examiner who will, either individually 

or with a team, monitor information about the entity and its affiliates. That information will be 

collected in an Institution Profile and used as the basis for a Risk Assessment and a Supervision 

Plan. The Lead Examiner may or may not be the Examiner in Charge of a particular examination

of the entity. The Institution Profile, Risk Assessment, and Supervision Plan will be updated as 

appropriate with information gathered through regular monitoring as well as examinations.

Monitoring: The purpose of depository institution monitoring is to maintain reasonably current 

information about the institution’s activities in order to determine whether changes in risks to 

consumers or markets warrant a change in the CFPB Supervision Plan. Affiliated entities are 

considered together. The frequency and depth of monitoring will vary depending on the 

organization’s risk profile, but should be undertaken at least quarterly. As an initial matter, Lead 

Examiners and their supervisors will agree on a monitoring schedule.
CFPB Supervision 

and Examination Process Overview

CFPB Overview 11

Basic monitoring activities include:

• Reviewing supervisory and public information about the entity, such as:

o Prudential and state regulator examination reports

o Community Reinvestment Act (CRA) performance evaluations

o Current enforcement actions

o Call report data 

o Complaint data

o Home Mortgage Disclosure Act 

o Home Affordable Modification Program Data

o SEC filings

o Licensing or registration information

o Reports from the entity to prudential or state regulators, if any

o CFPB research analyst reports

o Institution website

• Contacting the appropriate officer of the institution to discuss new products or services, 

events that may impact compliance management, and any questions raised by information 

reviewed by the Lead Examiner.

• Contacting the prudential regulator to discuss any recent events and any questions raised by 

supervisory or public information about the institution.

• Consulting internally.

After reviewing periodic monitoring information, the Lead Examiner should update the 

Institution Profile, Risk Assessment, and Supervision Plan as appropriate. 

Institution Profile: The Institution Profile contains summary information about a depository 

institution and its affiliates and provides a quick reference guide. An Institution Profile template 

is provided in Part III.

Risk Assessment: The Lead Examiner completes and periodically updates a Risk Assessment for 

a large depository institution and its affiliates. The Risk Assessment may be the product of 

multiple individual Risk Assessments of specific lines of business or companies. It provides the 

basis for the Supervision Plan, which is the CFPB plan for supervising a depository institution 

and its affiliates and for allocating supervision resources to the organization. The same risk 

assessment process is also used to scope examinations, as discussed in Part II, where the process 

is discussed in more detail. A Risk Assessment template is provided in Part III.
CFPB Supervision 

and Examination Process Overview

CFPB Overview 12

Supervision Plan: The Supervision Plan, which is based on the Institution Profile and Risk 

Assessment, summarizes the plan for monitoring and examining the institution and its affiliates.

It describes the priorities for CFPB supervision activities to assist in allocating and scheduling 

examiner resources. It describes the plan and timeline for monitoring the institution, including 

any follow-up required for Matters Requiring Attention identified during examinations, other 

supervisory measures, or enforcement actions. The minimum monitoring schedule is quarterly. 

The Supervision Plan describes the proposed focus and scope of examination activities during 

the year (either a full examination or a series of limited examinations); information about 

scheduling coordination with the prudential and/or state regulators; and the proposed number of 

examiners, deployment schedule, and any special skills or knowledge needed.

The Plan should be updated at least annually and may be updated at any time as a result of 

changes in the Risk Assessment. A Supervision Plan template is provided in Part III.
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 1

Pre-Examination Planning

The goal of a risk-focused examination is to direct resources toward areas with higher degrees of 

risk. CFPB examinations focus on risks of harm to consumers, including the risk a supervised 

entity will not comply with Federal consumer financial law. The overall objective of preexamination planning is to collect information necessary to determine the examination’s scope, 

resource needs, and work plan. This information allows the Examiner in Charge (EIC) or 

designee and the examination team to plan and conduct its work both offsite and onsite during 

the examination. The information available, timing, and order in which steps are performed may 

vary by the type of examination or supervised entity.

Pre-examination planning consists of gathering available information and documents and 

preparation of an examination Information Request. The examination Information Request is a 

tailored list of information and documents that the supervised entity is asked to forward to CFPB 

for offsite review or make available when the examiners arrive onsite. It may include a request 

for an electronic data download. The pre-examination planning process will vary depending on 

the size, complexity, business strategy, products, systems, and risk profile of a particular 

supervised entity. This section provides a general overview of the process. 

Gather Available Information

The EIC and examination team members collect information about a supervised entity from both 

internal and external sources to aid in constructing the risk focus and scope of an examination.

Examiners should gather as much information as possible from within the CFPB, other 

regulatory agencies, and third-party public sources, because the Bureau is required by statute to 

use, to the fullest extent possible, information available from other agencies or reported 

publicly.1

The following key documents and information are relevant to understanding a supervised entity

and its ability to manage its compliance responsibilities and risks to consumers. Not all 

documents will necessarily be available for a particular entity.

From CFPB Internal Sources and Other Regulatory Agencies

• Monitoring information

• Most recent Risk Assessment 

• Prior Scope Summary, Supervision Plan, or similar document produced by state or prudential 

regulator

• Prior Examination Reports and supporting workpapers (internal and from Federal prudential 

regulator, state regulator(s), or other agency)

• Information about prior corrective actions (such as restitution) and responses to Examination 

Reports 

• Information on enforcement or other public actions (if applicable)

• Correspondence from prudential or state regulator(s) and CFPB correspondence files

• State licensing information for the entity

 1

See Secs. 1024(b)(4) and 1025(a)(3).
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 2

• Complaint information (internal, state, CFPB, other sources) 

• FTC Consumer Sentinel database

• Uniform Bank Performance Report (UBPR) and Call Reports 

• Previous years’ FFIEC Home Mortgage Disclosure Act Loan Application Registers (HMDA 

LARs)

• Home Affordable Modification Program data

• Fair lending analysis 

• Office of the Comptroller of the Currency (OCC) Federal Housing Home Loan Data System 

(FHHLDS) report

• Mortgage Call Report (MCR) from the Nationwide Mortgage Licensing System (NMLS) 

• Registration or licensing information for mortgage originators (Secure and Fair Enforcement 

for Mortgage Licensing Act (SAFE Act)

From Public Information or Third Parties

• Institution securities filings, its offered securitizations, and similar public records 

• Industry publications showing credit ratings, product performance, and areas of profitability

• Newspaper articles, web postings, or blogs that raise examination related issues 

• Neighborhood Watch: 

http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/sfh/lender/nw_home

• Vendor programs

• Content of the supervised entity’s website.

Before contacting the supervised entity to gather additional information, the EIC (or designee(s)) 

reviews the material gathered from these sources to help avoid duplicative requests. Of course, it 

may still be necessary to verify or update the information or documents with the supervised 

entity, but the burden of production will be reduced. 

Update or Prepare the Risk Assessment 

CFPB’s Risk Assessment is designed to evaluate on a consistent basis the extent of risk to 

consumers arising from the activities of a supervised entity or particular lines of business within 

it and to identify the sources of that risk. “Risk to consumers” for the purpose of the CFPB Risk 

Assessment is the potential for consumers to suffer economic loss or other legally-cognizable 

injury (e.g., invasion of privacy) from a violation of Federal consumer financial law. The risk 

assessment includes factors related particularly to the potential for unfair, deceptive or abusive 

practices, or discrimination. Two sets of factors interact to result in a finding that the overall risk 

in a business or entity is low, moderate, or high. The first set of factors relate to the inherent risk 

in the particular line of business or the entity overall. The second set of factors is the quality of 

controls that manage and mitigate that risk. The Risk Assessment also includes a judgment, 

based on current or recent information, about the expected change in the overall risk: decreasing, 

increasing, or unchanged.

The CFPB uses the Risk Assessment described below, and presented as a template in Part III, to 

develop its plan for supervising and examining large depository institutions and their affiliates 
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 3

(the Supervision Plan), and to determine the focus of particular examinations. Risk Assessments 

will be used to set priorities and focus examination and supervision activities.

Risk assessments are not used to reach conclusions about whether an entity has violated a 

particular law or regulation. 

The Lead Examiner completes or updates a Risk Assessment at least annually for a large 

depository institution and its depository and non-depository affiliates. When evaluating the group 

of entities as a whole, considerations include the extent to which these affiliates share or allocate 

risk (such as when one entity purchases or services loans originated by another) and the ways in 

which they manage risk under a corporate compliance program (quality of risk management).

CFPB’s Nonbank Supervision Risk Analytics and Monitoring unit and other Headquarters units,

including the Office of Fair Lending and Equal Opportunity, will collect data about and from 

supervised non-depository consumer financial services companies in order to help define and 

assess risk for purposes of examination prioritization. The examination team will perform a more 

specific Risk Assessment as part of the pre-examination process.

In undertaking a Risk Assessment, examiners should consider both the volume and the nature of 

consumer complaints received by the entity or by regulatory bodies including the CFPB. In 

addition to shedding important light on the extent and types of concerns of consumers utilizing 

the entity’s consumer financial products or services, complaints may provide indications of 

potential regulatory violations, including unfair, deceptive, or abusive acts or practices 

(UDAAPs). How the entity handles complaints is also a key element in evaluating its compliance 

management system.

Regulatory violations or matters requiring attention identified in prior examinations by the CFPB 

or by other regulatory agencies, including the prudential regulators, should also be considered 

when assessing risk and planning an examination.

Inherent Risk

For markets which involve the sale of financial services products or services to consumers, the 

key factors that are relevant in assessing risk are (i) the nature and structure of the products 

offered, (ii) the consumer segments to which such products are offered, (iii) the methods of 

selling the products, and (iv) the methods of managing the delivery of the products or services 

and the ongoing relationship with the consumer.2

 2 Some markets for consumer financial products or services operate on a business to business basis; this is true, for example, of 

the credit reporting market and the collections market. The factors that are indicative of inherent risk in these markets will be 

different from those in the business to consumer markets. Risk assessments for such businesses will be developed separately.
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 4

Quality of Controls and Mitigation of Inherent Risk

The second part of the Risk Assessment entails an evaluation of the extent to which the 

institution has established controls to monitor and mitigate inherent risks to consumers. Some of 

these controls will necessarily be established and assessed across the lines of business at the 

institution or enterprise level, while others will operate at the line of business level to mitigate 

identified risks.

After risks are identified, the focus and priorities for examination or review activities will take 

into account the number of consumers potentially harmed and the severity of that potential harm.

Expected Change/Direction of Risk

Finally, the Risk Assessment calls for a determination of the direction of risk at the entity:

increasing, decreasing, or stable. The direction determination should be based on the findings of 

very recent reviews or the most recent examination, recent changes in entity structure, new 

business strategy, monitoring information, or other information about prospective risk and risk 

management. The date of the most recent change in the direction of risk should also be noted. An 

institution that has been stable for a long time that suddenly changes will likely require a 

different supervisory response than one that has been on the same trajectory for some time, 

although both may be of serious concern.

A Risk Assessment template is provided in Part III.

Develop a Scope Summary

The Scope Summary is based in large part on the conclusions of the Risk Assessment. The table 

of risk conclusions from the Risk Assessment should be included in the Scope Summary.

The Examiner in Charge prepares the Scope Summary, which provides all members of the 

examination team with a central point of reference throughout the examination. The initial Scope 

Summary is based on internal consultation and a review of available information and documents 

gathered prior to sending the Information Request to the supervised entity, and is developed after 

preparing the Risk Assessment.
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 5

The initial Scope Summary addresses the following: 

• The basis for the Risk Assessment and

• Examination activities to be undertaken to review: 

o the compliance management system;

o potential legal violations involving unfair, deceptive, or abusive practices;

o fair lending compliance;

o issues arising from complaints; and

o specific regulatory compliance issues.

At the conclusion of the examination, the EIC updates the initial Scope Summary with the 

following:

• Description of changes to the examination scope during the course of the examination, and 

reasons for such changes;

• Recommendations for the scope of the following examination.

The initial Scope Summary, as well as any material changes to the scope of the examination 

during the examination, should be approved in accordance with current CFPB requirements. The 

Scope Summary is maintained with the examination records in the Supervision and Examination 

System.

A Scope Summary template is found in Part III and may be tailored to individual circumstances 

as appropriate.

Contact the Entity to be Examined

For most full-scope examinations, the EIC, or designee, contacts the supervised entity’s

management approximately 60 days prior to the scheduled onsite date for the examination to 

arrange either a telephone or in-person discussion of the examination Information Request. The 

principal purpose of the discussion is to gather current information to ensure that the request is 

tailored to what is necessary to properly conduct the examination of that particular institution.

The EIC or designee should also use the discussion to help determine whether certain 

information needed for the examination should be sent to the examination team for review offsite

or held for onsite review. The discussion should include the timing of production and the 

subsequent onsite examination. The EIC should use the discussions to apprise management about 

who should be available to be interviewed during the onsite portion of the examination. If not 

already known, the EIC should obtain information about the organization of the entity and where 

it maintains certain operations for the purpose of deciding which operation centers and/or 

branches the team will review.

For depository institutions under a continuous examination schedule, periodic requests will be 

necessary and the lead time may vary depending on the product, service, or regulation being 

reviewed. 
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 6

Early contact and review provides the EIC the opportunity to determine if specialized examiner 

or other CFPB resources are needed for particular examination activities and then to obtain them.

A customizable Interview template is available in the Supervision and Examination System. It 

may be used as a tool to help guide the discussion with the supervised entity and the subsequent 

tailoring of the Information Request.

Prepare and Send the Information Request

After conducting the review and discussion outlined above, the EIC or designee will use the 

monitoring information and any other relevant information to customize an Information Request 

that includes only items that are pertinent to the examination of a particular entity. Not all items 

will be relevant to every examination. In addition, the Information Request must specify the 

review period when it requests information or documentation such as periodic reports, ledgers,

policies and procedures, and administrative changes, to avoid receiving data not relevant to the 

examination.

The EIC or designee may provide the examination Information Request to entity management in 

either hard copy or electronic format, although electronic is preferred, indicating where the 

materials should be delivered and in what format. If at all possible, the requested materials 

should be delivered to the CFPB electronically. Examiners should consult with their field 

managers about what system should be used for secure requests and transmission of electronic 

examination files. The timing of the request and the response date must ensure that entity staff 

has sufficient time to assemble the requested information and the examination team has 

sufficient time to adequately review the materials. 

Contacting the supervised entity at least 60 days prior to the onsite date, whenever feasible, and 

sending the examination information request as soon as possible thereafter will generally ensure 

that staff of the supervised entity have sufficient time to properly gather and submit the response, 

and that the examination team has time to conduct its offsite review. To the extent possible and 

consistent with statutory requirements, coordinate the examination information request with the 

prudential and state regulator(s) and keep them abreast of monitoring efforts, correspondence 

with the supervised entity, and schedule planning.

The customizable Information Request template is available in the Supervision and Examination 

System.

Conduct the Examination

After receiving and reviewing the information and documents requested from the entity, the EIC 

will determine the specific examination procedures to use during the onsite review and how to 

deploy the examination team to conduct interviews, observations, transaction testing, and other 

processes. Guided by the Risk Assessment, every examination must include a review of 

compliance management, any potential unfair, deceptive, or abusive practices, and regulatory 

compliance matters presenting risks to consumers. Every examination of lending must also 

include a review for discrimination.
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 7

Available examination procedures are part of this Supervision / Examination Manual. Templates 

should be downloaded from the Supervision and Examination System and used to create 

workpapers.

Upon determining the onsite start date, the EIC should arrange an entrance meeting with the 

appropriate member(s) of the supervised entity’s management. At the meeting, the EIC can 

introduce the examination team, discuss generally the expected activities, clarify any questions 

about arrangements for being onsite at the entity (such as building security, work space, etc.), 

and set the tone for the examination.

Thereafter, the EIC should meet regularly with the entity point of contact to discuss interim 

findings and examination progress. The EIC should also communicate regularly with his or her

point of contact at the entity’s prudential or state regulator(s).

Throughout the examination, the EIC should coordinate with his or her Field Manager regarding

internal consultation and review requirements and should provide progress reports as required. 

Close the Examination

Closing Meeting

When the EIC determines that all onsite activities and internal CFPB consultations are complete, he 

or she should meet with the supervised entity’s management to discuss the preliminary examination 

findings, expected corrective actions, recommended rating, and next steps, if any. Management 

should be reminded that supervisory information, including ratings, is confidential and should not be 

shared except as allowed by CFPB regulation. Depending on the severity of the findings, other CFPB 

representatives may attend this meeting as well. Management should be alerted if a meeting with the 

board of directors or principals of the supervised entity will be required.

Entity management must be informed that examination findings, including compliance 

ratings, are not final until internal CFPB reviews are conducted and, in the case of an insured 

depository institution or affiliate, the prudential regulator has had the opportunity to review 

and comment on the draft report.

Determine the Compliance Rating

The CFPB has adopted the FFIEC Uniform Consumer Compliance Rating System.3

Under this

system, after an examination a supervised entity is assigned a confidential consumer compliance 

rating based upon an evaluation of its present compliance with Federal consumer financial law

and the adequacy of its systems designed to ensure compliance on a continuing basis. The rating 

system is based upon a scale of 1 through 5 in increasing order of supervisory concern. Thus, "1" 

represents the highest rating and consequently the lowest level of supervisory concern, while "5" 

represents the lowest, most critically deficient level of performance and therefore the highest 

degree of supervisory concern. Each of the five ratings is described in greater detail below. 

In assigning a consumer compliance rating, all relevant factors must be evaluated and weighed. 

In general, these factors include the nature and extent of present compliance with Federal 

 3 This description of the rating system is adapted for CFPB purposes from the 1980 FFIEC resolution adopting the 

rating system. 
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 8

consumer financial law, the commitment of management to compliance and its ability and 

willingness to take the necessary steps to assure compliance, and the adequacy of systems, 

including internal procedures, controls, and audit activities designed to ensure compliance on a 

routine and consistent basis. The assignment of a compliance rating may incorporate other 

factors that impact significantly the overall effectiveness of an institution's compliance efforts. 

While each type of entity supervised by the CFPB has differences in its general business powers, 

all generally are subject to the same Federal consumer financial laws covered by the rating 

system. Thus, there is no need to evaluate different types of entities on specific criteria relating to 

their particular industry. As a result, the assignment of a consumer compliance rating based on a 

set of uniform criteria will help direct supervisory attention in an efficient and consistent manner 

that does not depend solely upon the nature of the institution’s business. The primary purpose of 

the uniform rating system is to help identify those institutions whose compliance with Federal 

consumer financial law displays weaknesses requiring special supervisory attention and which 

are cause for more than a normal degree of supervisory concern. To accomplish this objective, 

the rating system identifies an initial category of institutions that have compliance deficiencies 

that warrant more than normal supervisory concern. These institutions are not deemed to present 

a significant risk of financial or other harm to consumers, but do require a higher than normal 

level of supervisory attention. Institutions in this category are generally rated "3." The rating 

system also identifies certain institutions whose weaknesses are so severe that they may 

represent a substantial or general disregard for the law. These institutions are, depending upon 

nature and degree of their weaknesses, rated "4" or "5." 

The uniform identification of institutions causing more than a normal degree of supervisory 

concern will help ensure: 

• That the degree of supervisory attention and the type of supervisory response are based upon 

the severity and nature of the institution's deficiencies; 

• That supervisory attention and action are, to the extent possible, administered consistently, 

regardless of the type of institution or the identity of the supervising agency; and 

• That appropriate supervisory action is taken with respect to those institutions whose 

compliance problems entail the greatest potential for financial or other harm to consumers. 
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 9

Consumer Compliance Ratings

Consumer Compliance Ratings are defined and distinguished as follows: 

One

An [entity] in this category is in a strong compliance position. Management is capable of and 

staff is sufficient for effectuating compliance. An effective compliance program, including an 

efficient system of internal procedures and controls, has been established. Changes in consumer 

statutes and regulations are promptly reflected in the institution's policies, procedures, and 

compliance training. The institution provides adequate training for its employees. If any 

violations are noted they relate to relatively minor deficiencies in forms or practices that are 

easily corrected. There is no evidence of discriminatory acts or practices, reimbursable

violations, or practices resulting in repeat violations. Violations and deficiencies are promptly 

corrected by management. As a result, the institution gives no cause for supervisory concern. 

Two

An [entity] in this category is in a generally strong compliance position. Management is capable 

of administering an effective compliance program. Although a system of internal operating 

procedures and controls has been established to ensure compliance, violations have nonetheless 

occurred. These violations, however, involve technical aspects of the law or result from oversight 

on the part of operating personnel. Modification in the institution's compliance program and/or 

the establishment of additional review/audit procedures may eliminate many of the violations.

Compliance training is satisfactory. There is no evidence of discriminatory acts or practices, 

reimbursable violations, or practices resulting in repeat violations. 

Three

Generally, an [entity] in this category is in a less than satisfactory compliance position. It is a 

cause for supervisory concern and requires more than normal supervision to remedy deficiencies. 

Violations may be numerous. In addition, previously identified practices resulting in violations 

may remain uncorrected. Overcharges, if present, involve a few consumers and are minimal in 

amount. There is no evidence of discriminatory acts or practices. Although management may 

have the ability to effectuate compliance, increased efforts are necessary. The numerous 

violations discovered are an indication that management has not devoted sufficient time and 

attention to consumer compliance. Operating procedures and controls have not proven effective 

and require strengthening. This may be accomplished by, among other things, designating a 

compliance officer and developing and implementing a comprehensive and effective compliance 

program. By identifying an institution with marginal compliance early, additional supervisory 

measures may be employed to eliminate violations and prevent further deterioration in the 

institution's less-than-satisfactory compliance position. 
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 10

Four

An [entity] in this category requires close supervisory attention and monitoring to promptly 

correct the serious compliance problems disclosed. Numerous violations are present. 

Overcharges, if any, affect a significant number of consumers and involve a substantial amount 

of money. Often practices resulting in violations and cited at previous examinations remain 

uncorrected. Discriminatory acts or practices may be in evidence. Clearly, management has not 

exerted sufficient effort to ensure compliance. Its attitude may indicate a lack of interest in 

administering an effective compliance program that may have contributed to the seriousness of 

the institution's compliance problems. Internal procedures and controls have not proven effective 

and are seriously deficient. Prompt action on the part of the supervisory agency may enable the 

institution to correct its deficiencies and improve its compliance position. 

Five

An [entity] in this category is in need of the strongest supervisory attention and monitoring. It is 

substantially in non-compliance with the consumer statutes and regulations. Management has 

demonstrated its unwillingness or inability to operate within the scope of consumer statutes and 

regulations. Previous efforts on the part of the regulatory authority to obtain voluntary 

compliance have been unproductive. Discrimination, substantial overcharges, or practices 

resulting in serious repeat violations are present. 

Draft the Examination Report

An Examination Report template is provided in Part III. Instructions are embedded in it.

The primary purpose of the report is to communicate examination findings to the board of 

directors or principals and senior executives of a supervised entity. The report narrative should

be concise, constructive, and direct. The commentaries for stable 1-rated entities with low 

consumer or compliance risk should be brief, while the commentaries for 2- through 5-rated 

institutions and those with elevated or increasing risk should successively provide more support 

and detail. 

Comments should clearly cite statutory or regulatory violations and describe the basis for the 

findings. This will ensure that the supervised entity understands the basis for the conclusions and 

so that enforcement actions, if required, are well supported. Matters Requiring Attention and 

Required Corrective Actions must include specific expectations and the expected time frame for 

implementation. 
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 11

For each specific area reviewed, the narrative sections of the report have three parts: conclusion, 

comments and supporting analysis, and required corrective actions:

• Conclusion – The Conclusion contains an overall conclusion followed by a concise summary 

of findings. The conclusion should match the tone and language of the rating definition. This 

section should include summary details or facts supporting the conclusion, including a 

summary of material deficiencies that support 3, 4, and 5 ratings. Avoid an overly detailed 

conclusion section. Include details supporting the conclusion in the Comments and 

Supporting Analysis section. Do not include cross-references within the Conclusion section.

• Comments and Supporting Analysis –Comments discuss major strengths and/or weaknesses 

to support the conclusions. Supporting Analysis is information that demonstrates 

conclusions. 

• Required Corrective Actions –Required Corrective Actions identify actions that management 

needs to take to resolve supervisory concerns. They should include specific action 

requirements and time frames for completion. If there are no corrective actions for a 

particular area, just insert “N/A.”

If a finding is sufficiently serious to bring to the attention of the board of directors or principals 

of an entity, the Required Corrective Action should be included in the Matters Requiring 

Attention section of the Examination Conclusions. Include repeat deficiencies as Matters 

Requiring Attention. 

Suggestions or ideas for management to consider may be included in the Recommendations 

section. The CFPB does not require follow-up for Recommendations; they are provided as 

suggestions to improve already satisfactory operations.

The Examination Report comments should focus on those matters that support the overall 

conclusion and rating; they do not need to cover every area reviewed during an examination. 

Submit Examination Report for Review

After the Examination Report draft is complete, the EIC uploads it into the Supervision and 

Examination System. The Field Manager or designee will review it and will obtain any other 

reviews required by internal CFPB policy.

If the report concerns an insured depository institution, the draft must be shared with the 

institution’s prudential regulator.4 The regulator must be given a reasonable opportunity to 

review and comment (not less than 30 days after the date of receipt of the report by the 

prudential regulator). The CFPB must take into consideration any concerns raised by the 

prudential regulator prior to issuing a final Examination Report or taking supervisory action. The 

interagency comment process will be managed by the CFPB’s regional offices, with input from 

CFPB headquarters as appropriate. If a conflict arises between the CFPB and the prudential 

regulator regarding a proposed supervisory determination, regional and Headquarters

management will seek to resolve the issue as expeditiously as possible, with due regard for each 

agency’s supervisory responsibilities.

 4 Sec. 1025(e)(1)(C)
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 12

If the report concerns other types of regulated entities, opportunities for comment by state 

regulators will depend on whether CFPB is conducting joint or coordinated examinations with 

the relevant state regulators. The comment process will also be handled by the regional offices.

Board of Directors or Principal(s) Meeting

The purpose of a meeting with a supervised entity’s board of directors or principal(s) is to 

convey the findings of an examination directly to those individuals ultimately responsible for the 

policies and procedures of the institution. Board meetings should be conducted after the closing 

meeting with management, and should be attended by at least a quorum of directors or by the 

entity principal(s). The EIC and appropriate CFPB management should attend. The board or 

principals should be reminded that the examination report and rating are confidential and should 

not be disclosed except as permitted by CFPB regulation.5

A board or principal(s) meeting is required when one or more of the following circumstances are 

present:

• The proposed compliance rating is “3,” “4,” or “5”; 

• An informal supervisory agreement or formal enforcement action is recommended; or

• The supervised entity’s management, board, or principal(s) requests such a meeting.

The meeting should be used to discuss examination findings, Matters Requiring Attention, and 

expected corrective actions; advise the board or principal(s) of the recommended compliance 

rating; and discuss any recommended enforcement actions. 

The timing of a board or principal(s) meeting will depend on the specific situation, and the EIC 

should work this out with his or her Field Manager, who will ensure the necessary internal 

coordination. Meetings should be coordinated with Federal prudential and state examiners, and 

planned for regularly scheduled meetings whenever possible. 

Send the Examination Report

The EIC signs the final Examination Report. Regional office administrative staff will handle 

transmission to the supervised entity.

Upload Final Examination Documents

At the conclusion of the examination, the EIC must finalize the Scope Summary, ensure all 

workpapers are complete, and be certain that all required documents and information are 

uploaded or entered into the Supervision and Examination System.

 5

See12 C.F.R. Sec. 1070.42
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 13

Examination Workpapers

During an examination, examiners collect and review information from the supervised entity to 

reach conclusions about its practices, its compliance management, and its compliance with 

specific laws and regulations. The records documenting the review are called workpapers.

Workpapers should contain sufficient information and supporting documents to explain – to a 

knowledgeable reviewer – the basis for the examination conclusions.

Purposes of Workpapers

Examiners develop and maintain workpapers for three principal purposes:

• To provide a record of the work performed during the examination that supports findings 

or recommendations made during the examination,

• To maintain the evidence necessary to support supervisory agreements or formal 

enforcement actions, and 

• To facilitate internal quality control reviews.

All information collected and all records created during the examination could potentially be 

included in the workpapers. For example, if an examiner interviews a Real Estate Lending 

Officer, the write-up of the interview notes becomes a workpaper. If the examiner also scans 

pages of the supervised entity’s RESPA procedures manual to help illustrate deviations from 

policy, the scanned pages should be included in the workpapers. Other examples of workpapers 

include, but are not limited to:

• Completed CFPB Examination Procedures (downloadable templates that allow the 

examiner to enter narrative findings as they follow the procedures); 

• Completed CFPB Checklists;

• Other documents such as spreadsheets created during the examination; 

• Documentation of staff and management interviews;

• Meeting agendas, attendance lists, and notes or minutes;

• Documentation of compliance research performed (e.g., legal opinions, regulation 

sections reviewed, regulatory alerts); and

• Scanned copies of material obtained from the supervised entity, such as policies, 

procedures, rate sheets, internal memos and reports, external audit reports, complaint 

letters.
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 14

Generally, workpapers should document or support the:

• Proposed scope of the examination and any changes to the scope during the course of the 

examination;

• Work performed during the examination (what you did);

• Sampling process used (how you did it);

• Findings and violations noted during the examination (what you found);

• Recommendations made (new and repeated);

• Communications with management regarding findings, corrective actions, and 

recommendations;

• Management’s response (oral and written) to findings and violations;

• Commitments made by management regarding corrective action, remediation, and 

financial relief;

• Changes to the Risk Assessment;

• Consumer Compliance Rating; and

• Changes to the Supervision Plan (where applicable).

The amount of supporting documentation from the entity’s records that is necessary to maintain 

in the workpapers will depend on the particular situation. The general principle is that 

examinations involving numerous problems in high-risk areas require especially thorough 

documentation to support the conclusions reached and any potential supervisory measures or 

enforcement action. Examination of areas of low risk and few problems normally require less 

documentation.

Examiner in Charge Review and Signoff

The EIC is responsible for the adequacy of the workpapers created during the examination. Since 

large team examinations require the EIC to delegate numerous specific areas of review to other 

examiners, the EIC must track the: 

• Workpapers developed,

• Responsible examination team member, and 

• EIC’s review and approval of the workpapers.

Workpapers that require additional analysis or support should be discussed with and returned to 

the responsible examiner for further development. The Workpaper Table of Contents and EIC 

Signoff document, found in the Supervision and Examination System, must be used to record the 

EIC’s review and sign off on all workpapers developed during the examination. After the EIC 

reviews and signs off on the workpapers, the Field Manager should also review and sign off on 

their adequacy.
CFPB Supervision

and Examination Process Examinations

CFPB Examinations 15

Electronic Format and Encryption

All workpapers and related documentation for the examination should be maintained in 

electronic form. If the supervised entity is only able to provide a document in hard copy form, 

the examiner should scan the document and return the original. Workpapers should be uploaded 

to the Supervision and Examination System with the completed examination to be preserved as 

part of the examination record and made available for future reference.

All electronic documents received from the supervised entity should be transmitted and 

maintained on encrypted media. Examiners should be mindful at all times of the need to protect 

personally identifiable information (e.g., names, social security numbers, account numbers) and 

confidential supervisory information. Hard copies should not be left anywhere unattended (even 

onsite at the entity), should not be removed from the examination site, and if printed while 

working offsite, should be kept in a locked cabinet when not being used. Consult CFPB’s 

Privacy and FOIA regulations and guidance for further information.6

Quality Control Reviews

Workpapers will also be reviewed through an internal quality control process. Workpapers 

should be sufficiently detailed so that an internal quality control reviewer will understand what 

the examiner did, follow the logic of the examiner's analyses, and understand how the examiner 

reached his or her conclusion(s). The level of documentation should be commensurate with the 

risks and problems associated with the areas under review. (The optional Workpaper Checklist 

can help ensure that workpapers are sufficient.)

 6

See Disclosure of Records and Information, 76 FR 45372 (July 28, 2011), and any subsequent related guidance that may be 

issued.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 1

General Principles and Introduction

Supervised entities within the scope of CFPB’s supervision and enforcement authority include 

both depository institutions and non-depository consumer financial services companies. These 

financial service providers operate in a dynamic environment influenced by challenges to 

profitability and survival, increased focus on outcomes to consumers, industry consolidation, 

advancing technology, market globalization, and changes in laws and regulations.

To remain competitive and responsive to consumer needs in such an environment, supervised 

entities continuously assess their business strategies and modify product and service offerings

and delivery channels. To maintain legal compliance, a supervised entity must develop and 

maintain a sound compliance management system that is integrated into the overall framework 

for product design, delivery, and administration – that is, the entire product and service lifecycle. 

Ultimately, compliance should be part of the day-to-day responsibilities of management and the 

employees of a supervised entity; issues should be self-identified; and corrective action should 

be initiated by the entity. Supervised entities are also expected to manage relationships with 

third-party service providers to ensure that these providers effectively manage compliance with 

Federal consumer financial laws applicable to the product or service being provided. 

Weaknesses in compliance management systems can result in violations of law or regulation and 

associated harm to consumers. Therefore, the CFPB expects every regulated entity under its 

supervision and enforcement authority to have an effective compliance management system 

adapted to its business strategy and operations. Each CFPB examination will include review and 

testing of components of the supervised entity’s compliance management system. An initial 

review will help determine the scope and intensity of an examination. The findings of more 

detailed reviews and transaction testing will determine the effectiveness of the compliance 

management system and whether enhancements or corrective actions are appropriate. 

CFPB understands that compliance will likely be managed differently by large banking 

organizations with complex compliance profiles and a wide range of consumer financial products 

and services1 at one end of the spectrum, than by entities that may be owned by a single 

individual and feature a narrow range of financial products and services, at the other end of the 

spectrum. Compliance may be managed on a firm- or enterprise-wide basis, and supervised 

entities may engage outside firms to assist with compliance management. However compliance 

is managed, a provider of consumer financial products or services under CFPB’s supervisory

purview is expected to comply with Federal consumer financial laws and appropriately address 

and prevent violations of law and associated harms to consumers through its compliance 

management process. 

 1 For example, the Federal Reserve Board of Governors expects large banking organizations with complex compliance profiles to 

implement firm-wide compliance risk management programs and have a corporate compliance function. SR 08-8 / CA 08-11, 

October 16, 2008. The CFPB will expect no less.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 2

CFPB also understands that supervised entities will organize compliance management to include 

compliance with consumer-related state and Federal laws that are outside the scope of CFPB’s 

supervision responsibilities, in addition to the matters that are within CFPB’s scope. CFPB,

therefore, expects that compliance management activities will be organized within a firm, legal 

entity, division, or business unit in the way that is most effective for the supervised entity, and 

that the manner of organization will vary from entity to entity.

This section of the Manual discusses the common elements of an effective consumer compliance

management system: board of directors and management oversight, the compliance program,

response to consumer complaints, and audit coverage of compliance matters.

Compliance Management System

A compliance management system is how a supervised entity:

• Establishes its compliance responsibilities;

• Communicates those responsibilities to employees;

• Ensures that responsibilities for meeting legal requirements and internal policies are 

incorporated into business processes;

• Reviews operations to ensure responsibilities are carried out and legal requirements are met; 

and

• Takes corrective action and updates tools, systems, and materials as necessary.

An effective compliance management system commonly has four interdependent control 

components:

• Board and management oversight;

• Compliance program;

• Response to consumer complaints; and

• Compliance audit.

When all of these four control components are strong and well-coordinated, a supervised entity

should be successful at managing its compliance responsibilities and risks.

Compliance Management Examination Procedures

Board of Directors and Management Oversight

In a depository institution, the board of directors is ultimately responsible for developing and 

administering a compliance management system that ensures compliance with Federal consumer 

financial laws and regulations and addresses and prevents associated risks of harm to consumers. 

In a non-depository consumer financial services company, that ultimate responsibility may rest 

with a board of directors in the case of a corporation or with a controlling person or some other 

arrangement. For the balance of this section of the Manual, references to the “board of directors” 

or “board” generally refer to the board of directors or other individual or group exercising similar 

oversight functions. In addition, some supervised entities may be governed by firm-wide 

standards, policies, and procedures developed by a holding company or other top-tier corporation 

for adoption, use, and modification, as necessary, by subsidiary entities. 
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 3

Board of Directors and Management Oversight –Examination 

Objectives

Because the effectiveness of a compliance management system is grounded in the actions taken 

by its board and senior management, CFPB examiners should seek to determine whether the 

board and senior management have:

1. Demonstrated clear expectations about compliance, not only within the entity, but also to

third-party service providers.

2. Adopted clear policy statements regarding consumer compliance.

3. Appointed an appropriately qualified and experienced chief compliance officer and provided 

for other compliance officers with authority and accountability. (In smaller or less complex 

entities where staffing is limited, a full-time compliance officer may not be necessary. 

However, management should have clear responsibility for compliance management and 

compliance staff should be assigned to carry out this function in a manner commensurate 

with the size of the entity and the nature and risks of its activities.)

4. Established a compliance function to set policies, procedures, and standards. 

5. Allocated resources to the compliance function commensurate with the size and complexity 

of the entity’s operations and practices, the Federal consumer financial laws and regulations 

to which the entity is subject, and necessary to avoid the potential consumer harm associated 

with violations of such laws and regulations.

6. Addressed consumer compliance issues and associated risks of harm to consumers 

throughout product development, marketing, and account administration, and through the 

entity’s handling of consumer complaints and inquiries.

7. Required audit coverage of compliance matters and reviewed the results of periodic 

compliance audits.

8. Provided for recurring reports of compliance risks, issues, and resolution through a 

committee structure or to the board.

Board of Directors and Management Oversight –Examination 

Procedures

Through pre-examination work or follow-up to previous examinations, examiners should request 

and review records and discuss issues and questions with senior management. With respect to 

board and senior management oversight, examiners should:

1. Review board meeting minutes and supporting materials during the period under review for 

coverage of compliance matters.

2. Determine board committee structures and delegated responsibility for compliance matters, 

such as to an audit committee or risk committee, and review the meeting minutes and 

supporting materials of those committees for coverage of compliance matters.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 4

3. Determine any management committees with delegated authority and accountability for 

compliance matters, and review their composition, functions, and reporting to committees of 

the board or to the board.

4. Determine the authority and accountability for compliance matters of regional or business 

unit governance bodies; and review their composition, functions, and reporting.

5. Review policies for clarity, comprehensiveness, currency, and appropriate reflection of risks 

to consumers posed by the organization’s practices, as well as compliance issues and risks 

facing the organization.

6. Review the formal written compliance function document adopted by the board of directors 

or an appropriate committee of the board, and determine the resource allocation to 

compliance as part of the entity’s budget and planning process.

7. Identify the chief compliance officer and other responsible individuals.

8. Review the role of the chief compliance officer for authority to lead a compliance program

and independence from business units.

9. Review board and board committee records for evidence of the chief compliance officer’s 

independent access to board members and governance bodies. 

10. Review processes for the identification of new regulatory requirements, changes in 

requirements, and planning for implementation.

11. Review processes for development and implementation of new consumer financial products

or services, distribution channels or strategies, to determine degree of compliance function 

participation. 

12. Determine degree of compliance review of draft marketing material (including scripts) and

their implementation.

13. Review reporting for the identification and resolution of issues and the timeliness and 

completeness of such actions.

14. Review board or committee consideration of compliance audit matters for coverage of key 

risks, independence from business functions, and resolution of identified issues. 

15. Draw preliminary conclusions about the strength, adequacy, or weakness of board and senior 

management oversight, subject to risk focused review and testing for compliance.

In the absence of a board of directors and board committee structure, the examiner should 

determine that the person or group exercising similar oversight functions receives relevant 

information about compliance and consumer protection matters and takes steps to ensure that the 

key elements, resources, and individuals necessary for a compliance management system 

commensurate with the supervised entity’s risk profile are in place and functioning.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 5

Compliance Program

A sound compliance program is essential to the efficient and successful operation of the 

supervised entity, much as a business plan. A compliance program includes the following

components:

• Policies and procedures,

• Training, and

• Monitoring and corrective action.

A supervised entity should establish a formal, written compliance program, and that program 

generally should be administered by a chief compliance officer. In addition to being a planned

and organized effort to guide the entity’s compliance activities, a written program represents an 

essential source document that may serve as a training and reference tool for employees. A well 

planned, implemented, and maintained compliance program will prevent or reduce regulatory

violations, protect consumers from non-compliance and associated harms, and help align 

business strategies with outcomes. The examination objectives and procedures for the 

compliance program are divided in this section of the Manual among the three components of a 

program. 

Policies and Procedures – Examination Objectives

Compliance policies and procedures should be documented and in sufficient detail to implement 

the board-approved policy documents. Overall, examiners should seek to determine whether

compliance policies and procedures:

1. Are consistent with board-approved policies.

2. Address compliance with applicable Federal consumer financial laws in a manner designed

to prevent violations and to detect and prevent associated risks of harm to consumers.

3. Cover product or service lifecycles.

4. Are maintained and modified to remain current and to serve as a reference for employees in 

their day-to-day activities.

Policies and Procedures – Examination Procedures

Examiners should request and review compliance policies and procedures and discuss elements 

with compliance officers or other responsible officers and employees of the supervised entity, as 

follows:

1. Request and review policies and procedures related to consumer compliance, including 

Federal consumer financial laws and policies and procedures related to offering consumer 

financial products and services.

2. Review policies and procedures for changes management committed to make following 

recent monitoring, audit, and examination findings and recommendations.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 6

3. Review policies and procedures to determine whether and how they address new or amended 

Federal consumer financial laws and regulations since the preceding examination or since the 

most recent consumer compliance examination by a state or prudential regulator, if 

applicable, if this is CFPB’s first examination.

4. Request and review policies and procedures to determine whether they cover consumer 

financial products or services introduced since the preceding examination or since the most 

recent consumer compliance examination by a state or prudential regulator, if applicable, if 

this is CFPB’s first examination.

5. Review policies and procedures relating to compliance with specific regulatory requirements 

(such as the privacy of consumer financial information) and their implementing procedures.

6. Review for outdated content, the names of unaffiliated entities, or other indicators that 

policies are overly general or not tailored to the needs and actual practices of the supervised 

entity being examined.

7. Review policies and procedures for products with features that may inhibit consumer 

understanding or otherwise pose heightened risks of unfair, deceptive, or abusive practices.

8. Review policies and procedures for products in which employee compensation structures, 

pricing or underwriting discretion, or other features may pose heightened risk of unlawful 

discrimination.

9. Review policies and procedures designed to ensure that the entity’s third-party service 

providers comply with legal obligations applicable to the product or service of the examined 

entity and the provider.2

10. Review policies and procedures maintained by different regional, business unit, or legal 

entities subject to the same corporate or board-level policies for consistency.

11. Review policies and procedures for record retention and destruction timeframes to ensure 

compliance with legal requirements.

12. If compliance procedures are embedded in automated tools or business unit procedures, 

determine that a qualified compliance officer or contractor reviewed these tools for 

consistency with policies and procedures and compliance with applicable Federal consumer 

laws and approved them for the purpose for which they are utilized.

13. Draw preliminary conclusions regarding the strength, adequacy, or weakness of policies and 

procedures, and identify business units, delivery channels, or offices for transaction testing. 

Test to confirm that actual practices are consistent with strong or adequate written policies 

and procedures. Test to determine the impact of apparently weak procedures.

 2 Although the CFPB has not yet issued guidance addressing third-party risk management, ample guidance exists 

from the prudential regulators explaining the need for strong oversight of third-party activities. See, for example, 

FDIC FIL-44-2008, Guidance for Managing Third-Party Risk, June 6, 2008, 

http://www.fdic.gov/news/news/financial/2008/fil08044.html, other interagency supervision guidance, and specific 

regulatory examination procedures such as those for Privacy requirements.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 7

Training – Examination Objectives

Education of an entity’s board of directors, management, and staff is essential to maintaining an

effective compliance program. Board members should receive sufficient information to enable 

them to understand the entity’s responsibilities and the commensurate resource requirements. 

Management and staff should receive specific, comprehensive training that reinforces and helps 

implement written policies and procedures. Requirements for compliance with Federal consumer 

financial laws, including prohibitions against unlawful discrimination and unfair, deceptive, and 

abusive acts and practices, should be incorporated into training for all relevant officers and 

employees, including audit personnel. Examiners should seek to determine whether:

1. Compliance training is current, complete, directed to appropriate individuals based on their 

roles, effective, and commensurate with the size of the entity and nature and risks to 

consumers presented by its activities. 

2. Training is consistent with policies and procedures and designed to reinforce those policies 

and procedures.

3. Compliance professionals have access to training that is necessary to administer a 

compliance program that is appropriate for that supervised entity and its business strategy

and operations.

Training – Examination Procedures

Examiners should request and review training records and interview management and staff as

appropriate to evaluate this element of the compliance program and to refine and focus the 

examination. Examiners should:

1. Request and review the schedule, record of completion, and materials for recent compliance 

training of board members and executive officers.

2. Determine the involvement of compliance officer(s) in selecting, reviewing, or delivering 

training content.

3. Request and review policies, standards, schedules, and records of completion for compliancespecific training of compliance professionals, managers, and staff, and documents 

demonstrating that third-party service providers who have consumer contact or compliance 

responsibilities are appropriately trained.

4. Request and review samples of the content of training materials and comprehension tests, 

including training related to new regulatory requirements, new products or channels of 

distribution, and marketing (including scripts). 

5. Request and review training developed as a result of management commitments to address 

monitoring, audit, or examination findings and recommendations or issues raised in 

consumer complaints and inquiries.

6. Determine whether the program is designed to provide training about the specific regulatory 

requirements relevant to the functions of particular positions, such as the Truth in Lending 

Act for loan officers. 
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 8

7. Review records of follow-up, escalation, and enforcement for units with training completion 

rates that do not meet the supervised entity’s standards or deadlines. 

8. Request and review the supervised entity’s plans for additions, deletions, or modifications to 

compliance training over the next 12 months and any plans for changes to the overall training 

resources and compare actual training activities to prior plans.

9. Draw preliminary conclusions about the strength, adequacy, or weakness of the training 

element of the compliance program, and select lines of business, organizational units, or 

other areas for more detailed review and testing.

Monitoring and Corrective Action – Examination Objectives

Monitoring is a compliance program element that seeks, in an organized and risk-focused way, to

identify procedural or training weaknesses in an effort to provide for a high level of compliance

by promptly identifying and correcting weaknesses. Monitoring and testing is generally more 

frequent and less formal than compliance audit coverage and reporting, may be carried out by the 

business unit, and does not require the same level of independence from the business or 

compliance function that an audit program does. Examiners should evaluate monitoring and

audit programs to determine whether, considered together, they are adequate and comprehensive.

Examiners review of compliance monitoring and testing should determine whether:

1. Monitoring is scheduled and completed and leads to timely corrective actions where 

appropriate.

2. The supervised entity is determining that transactions and other consumer contacts are 

handled according to the entity’s policies and procedures.

3. Monitoring and testing consider the results of risk assessments or other guides for prioritizing 

reviews.

4. Monitoring addresses deficiencies identified in internal or external audits, and the board’s or 

management’s directives on resolving the deficiencies.

5. Findings are escalated to management and to the board of directors if appropriate.

Monitoring and Corrective Action – Examination Procedures

Examiners should review monitoring, testing, and corrective action reports; sample supporting 

documents; and interview individuals responsible for compliance monitoring, testing, and 

corrective action. Examiners should:

1. Determine the chief compliance officer’s role in the compliance monitoring element of the 

compliance program.

2. Request and review the monitoring and testing schedule for the current year or next 12 

months, and review the currency of reviews in process against the current schedule.

3. Request and review the risk assessments or other documents that led to the monitoring and 

testing program plan.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 9

4. Discuss with the compliance officer or monitoring manager the coverage of third-party 

service providers that have contact with consumers.

5. Determine whether and to what extent monitoring includes calculation tools, the content of 

consumer disclosures and notices, marketing materials, and scripts or guides for employee 

contacts with consumers.

6. Request and review all compliance monitoring, testing and corrective action reports 

completed during a specific period of time.

7. Review reports for indications of systemic weaknesses, repeat violations of law and resulting 

risks or harms to consumers, or other matters of significant concern such as potential 

discriminatory effects of policies or procedures or particular business units with continuing 

or high levels of non-compliance.

8. Review a sample of reports and supporting documents covering potential unfair, deceptive, 

or discriminatory practices or related matters that pose heightened risks to consumers for 

thoroughness of review, accuracy of findings, and appropriateness of recommendations.

9. Determine whether monitoring results in corrective action that is timely and appropriate in 

size and scope. 

10. Draw a preliminary conclusion regarding the strength, adequacy, or weakness of the 

monitoring and corrective action element of the compliance program, and select areas for 

further review either because of lack of coverage by the monitoring program or to confirm 

monitoring or corrective action findings.

Consumer Complaint Response

An effective compliance management system should ensure that a supervised entity is responsive 

and responsible in handling consumer complaints and inquiries. Intelligence gathered from 

consumer contacts should be organized, retained, and used as part of an institution’s compliance 

management system.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 10

Consumer Complaint Response –Examination Objectives

Examiners will consider consumer complaints to determine whether:

1. Consumer complaints and inquiries, regardless of where submitted, are appropriately 

recorded and categorized.

2. Complaints and inquiries, whether regarding the entity or its third-party service providers, are 

addressed and resolved promptly.

3. Complaints that raise legal issues involving potential consumer harm from unfair treatment 

or discrimination, or other regulatory compliance issues, are appropriately escalated.

4. Complaint data and individual cases drive adjustments to business practices as appropriate.

5. Consumer complaints result in retrospective corrective action to correct the effects of the 

supervised entity’s actions when appropriate.

6. Weaknesses in the compliance management system exist, based on the nature or number of 

substantive complaints from consumers.

Consumer Complaint Response –Examination Procedures

Examiners should review records, interview management, and contact consumers if needed to 

evaluate this consumer response component of the compliance management system. Examiners 

should:

1. Obtain and review records of recent consumer complaints and inquiries received by CFPB

about the entity and its service providers.

2. Review industry or other benchmarking complaint data collected by CFPB. 

3. To the extent available, obtain and review records of recent consumer complaints against the 

institution from the prudential regulator, from state regulators, from state attorneys general 

offices or licensing and registration agencies, and from private or other industry sources.

4. Request and review from the institution being examined its policies and procedures for 

receiving, escalating, and resolving consumer complaints and inquiries.

5. Request and review the record of consumer complaints and inquiries received by the 

institution for a specific recent period of time.

6. Identify complaints alleging deception, unfair treatment, unlawful discrimination, or other 

significant consumer injury; and review some or all of those complaints for handling, 

timeliness, disposition, and any prospective and retrospective corrective actions.

7. Determine whether corrective action is offered or taken for any complaint resulting in a 

conclusion of violation of law or regulation.

8. Determine whether complaints involving third-party service providers or other third parties 

referring business to the supervised entity receive prompt and appropriate handling and 

follow-up by the entity.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 11

9. If a supervised entity maintains multiple consumer response centers or units, determine 

whether it employs a common set of best practices as applicable. 

10. Determine whether evaluations of consumer contacts are shared within the supervised entity 

and included in compliance management reporting to the Board and senior management, and 

whether such information is used in modifying policies, procedures, training, and monitoring.

11. Draw preliminary conclusions regarding the strength, adequacy, or weakness of the 

supervised entity’s response to consumer issues and concerns, and identify business conduct 

areas, specific regulations, or organizational units for more detailed review. 

Compliance Audit

Audit coverage of compliance matters is the fourth component of an effective compliance 

management system. The audit function should review an institution’s compliance with Federal 

consumer financial laws and adherence to internal policies and procedures and be independent of 

both the compliance program and business functions that include customer sales or service. 

A compliance audit program provides a board of directors or its designated committees with a 

determination of whether policies and standards adopted by the board to guide risk management 

are being implemented to provide for the level of compliance and consumer protection 

established by the board. The audit should also identify any significant gaps in board policies and 

standards.

Compliance Audit –Examination Objectives

Examiners will seek to determine whether:

1. The audit program is sufficiently independent and reports to the board or a committee of 

the board.

2. The audit program addresses compliance with all applicable Federal consumer financial 

laws.

3. The schedule and coverage of audit activities is appropriate to the size of the entity, its 

consumer financial product offerings, and its manner of conducting its consumer 

financial products business.

4. All appropriate compliance and business unit managers receive copies of audit reports in 

a timely manner.

5. Audit results lead to appropriate, timely corrective action.
CFPB Consumer

Laws and Regulations CMR

CFPB CMR 12

Compliance Audit – Examination Procedures

Examiners will review records of the compliance audit program and discuss the audit methods, 

results, and reporting with audit managers. Examiners should:

1. Request the supervised entity’s audit plans and schedules for the prior year, current year, and 

the following year.

2. If compliance audit is performed by a third party, request and review the engagement letters 

or contracts covering the prior year and the current year.

3. Determine the basis for the audit plan and schedule and whether reporting is to the board of 

directors or to an audit committee or other committee of the board.

4. Request and review all compliance audit reports for a specified period of time.

5. Determine whether written audit reports identify the scope, sampling techniques, 

findings/deficiencies, recommendations for corrective action, and management responses 

with time frames for corrective action.

6. Determine whether audit scopes include previous audit, and examination findings, new 

requirements, new products and channels, and self-identified higher risk areas of the 

supervised entity’s operations.

7. Request and review audit workpapers for a sample of audits covering fair lending laws and 

regulations; potential unfair, deceptive, or abusive practices; or other areas that may pose 

heightened risks to consumers.

8. Determine whether corrective actions are tracked and any delay in appropriate management 

response or lack of corrective action is escalated.

9. Determine whether the supervised entity’s chief compliance officer and appropriate business 

unit head(s) receive copies of audit reports, so that adjustments can be made to compliance 

program elements in a timely manner.

10. Review audit function structure and policies and procedures to ensure that the audit function,

whether internal or external, is sufficiently independent of the business line and compliance 

management function. 

11. Draw preliminary conclusions about the strength, adequacy, or weakness of the compliance 

audit component of the compliance management system, and identify areas for further review 

based on gaps in audit coverage or to confirm the accuracy of audit findings and reporting.
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 1

Unfair, Deceptive, or Abusive Acts or Practices 

Introduction

Unfair, deceptive, or abusive acts and practices (UDAAPs) can cause significant financial injury 

to consumers, erode consumer confidence, and undermine the financial marketplace. Under the 

Dodd-Frank Act, it is unlawful for any provider of consumer financial products or services or a 

service provider to engage in any unfair, deceptive or abusive act or practice.1 The Act also 

provides CFPB with rule-making authority and, with respect to entities within its jurisdiction, 

enforcement authority to prevent unfair, deceptive, or abusive acts or practices in connection 

with any transaction with a consumer for a consumer financial product or service, or the offering 

of a consumer financial product or service.

2

 In addition, CFPB has supervisory authority for 

detecting and assessing risks to consumers and to markets for consumer financial products and 

services.3

As examiners review products or services, such as deposit products or lending activities, they 

generally should identify the risks of harm to consumers that are particular to those activities. 

Examiners also should review products that combine features and terms in a manner that can 

increase the difficulty of consumer understanding of the overall costs or risks of the product and 

the potential harm to the consumer associated with the product. 

These examination procedures provide general guidance on:

• The principles of unfairness, deception, and abuse in the context of offering and 

providing consumer financial products and services;

• Assessing the risk that an institution’s practices may be unfair, deceptive, or abusive;

• Identifying unfair, deceptive or abusive acts or practices(including by providing

examples of potentially unfair or deceptive acts and practices); and 

• Understanding the interplay between unfair, deceptive, or abusive acts or practices and 

other consumer protection statutes.

 

1 Dodd-Frank Act, Title X, Subtitle C, Sec. 1036; PL 111-203 (July 21, 2010).

2 Sec. 1031 of the Act. The principles of “unfair” and “deceptive” practices in the Act are similar to those under Sec. 5 of the 

Federal Trade Commission Act (FTC Act). The Federal Trade Commission (FTC) and federal banking regulators have applied 

these standards through case law, official policy statements, guidance, examination procedures, and enforcement actions that may 

inform CFPB.

3 Sec. 1024; Sec. 1025(b)(1); Sec. 1026(b) of the Act.
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 2

Unfair Acts or Practices

The standard for unfairness in the Dodd-Frank Act is that an act or practice is unfair when:

(1) It causes or is likely to cause substantial injury to consumers, 

(2) The injury is not reasonably avoidable by consumers, and 

(3) The injury is not outweighed by countervailing benefits to consumers or to competition.

4

• The act or practice must cause or be likely to cause substantial injury to consumers. 

Substantial injury usually involves monetary harm. Monetary harm includes, for 

example, costs or fees paid by consumers as a result of an unfair practice.

5

An act or 

practice that causes a small amount of harm to a large number of people may be deemed 

to cause substantial injury.

Actual injury is not required in every case. A significant risk of concrete harm is also 

sufficient. However, trivial or merely speculative harms are typically insufficient for a 

finding of substantial injury. Emotional impact and other more subjective types of harm 

also will not ordinarily amount to substantial injury. Nevertheless, in certain

circumstances, such as unreasonable debt collection harassment, emotional impacts may 

amount to or contribute to substantial injury.

• Consumers must not be reasonably able to avoid the injury.

An act or practice is not considered unfair if consumers may reasonably avoid injury. 

Consumers cannot reasonably avoid injury if the act or practice interferes with their 

ability to effectively make decisions or to take action to avoid injury. Normally the 

marketplace is self-correcting; it is governed by consumer choice and the ability of 

individual consumers to make their own private decisions without regulatory 

intervention. If material information about a product, such as pricing, is modified after, or 

withheld until after, the consumer has committed to purchasing the product; however, the 

consumer cannot reasonably avoid the injury. Moreover, consumers cannot avoid injury 

if they are coerced into purchasing unwanted products or services or if a transaction 

occurs without their knowledge or consent. 

A key question is not whether a consumer could have made a better choice. Rather, the 

question is whether an act or practice hinders a consumer’s decision-making. For 

example, not having access to important information could prevent consumers from 

comparing available alternatives, choosing those that are most desirable to them, and 

avoiding those that are inadequate or unsatisfactory. In addition, if almost all market 

 

4 The standard for unfairness in the Dodd-Frank Act has the same three-part test as the FTC Act. This standard was first stated in 

the FTC Policy Statement on Unfairness (Dec. 17, 1980), available at: http://www.ftc.gov/bcp/policystmt/ad-unfair.htm. 

Congress later amended the FTC Act to include this specific standard in the Act itself. 15 U.S.C. § 45(n). 

5 FTC Policy Statement on Unfairness, at p. 3. 
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 3

participants engage in a practice, a consumer’s incentive to search elsewhere for better 

terms is reduced, and the practice may not be reasonably avoidable.

6

The actions that a consumer is expected to take to avoid injury must be reasonable. While 

a consumer might avoid harm by hiring independent experts to test products in advance 

or by bringing legal claims for damages in every case of harm, these actions generally 

would be too expensive to be practical for individual consumers and, therefore, are not 

reasonable.

• The injury must not be outweighed by countervailing benefits to consumers or 

competition.

To be unfair, the act or practice must be injurious in its net effects — that is, the injury 

must not be outweighed by any offsetting consumer or competitive benefits that also are 

produced by the act or practice. Offsetting consumer or competitive benefits of an act or 

practice may include lower prices to the consumer or a wider availability of products and 

services resulting from competition.

Costs that would be incurred for measures to prevent the injury also are taken into 

account in determining whether an act or practice is unfair. These costs may include the 

costs to the institution in taking preventive measures and the costs to society as a whole 

of any increased burden and similar matters.

Public policy, as established by statute, regulation, judicial decision, or agency determination,

may be considered with all other evidence to determine whether an act or practice is unfair. 

However, public policy considerations by themselves may not serve as the primary basis for 

determining that an act or practice is unfair. 

Examples

The examples described below stem from federal enforcement actions. They provide insight into 

practices that have been alleged to be unfair by other regulators and may inform CFPB’s 

determinations. However, the particular facts in a case are crucial to a determination of 

unfairness. It is important to bear in mind that a change in facts could change the appropriate 

determination. Moreover, the brief summaries below do not present all of the material facts 

relevant to the determinations in each case. The examples show how the unfairness standard may 

be applied. 

 

6 See Credit Practices Rule, 49 Fed. Reg. 7740, 7746 (1984).
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 4

Refusing to release lien after consumer makes final payment on a mortgage.7The FTC 

brought an enforcement action against a mortgage company based on allegations, described 

below, that repeatedly failed to release liens after consumers fully paid the amount due on their 

mortgages. 

• Substantial injury. Consumer’s sustained economic injury when the mortgage servicer 

did not release the liens on their properties after the consumers had repaid the total

amount due on the mortgages.

• Not outweighed by benefits. Countervailing benefits to competition or consumers did not 

result from the servicer’s alleged failure to appropriately service the mortgage loan and 

release the lien promptly. 

• Not reasonably avoidable. Consumers had no way to know in advance of obtaining the 

loan that the mortgage servicer would not release the lien after full payment. Moreover, 

consumers generally cannot avoid the harm caused by an improper practice of a mortgage 

servicer because the servicer is chosen by the owner of the loan, not the borrower. Thus, 

consumers cannot choose their loan servicer and cannot change loan servicers when they 

are dissatisfied with the quality of the loan servicing. 

Dishonoring credit card convenience checks without notice.

8 The OTS and FDIC brought 

enforcement actions against a credit card issuer that sent convenience checks with stated credit 

limits and expiration dates to customers. For a significant percentage of consumers, the issuer 

reduced credit lines after the checks were presented, and then the issuer dishonored the 

consumers’ checks. 

• Substantial injury. Customers paid returned-check fees and may have experienced a 

negative impact on credit history.

• Not outweighed by benefits. The card issuer later reduced credit limits based on credit 

reviews. Based on the particular facts involved in the case, the harm to consumers from 

the dishonored convenience checks outweighed any benefit of using new credit reviews.

• Not reasonably avoidable. Consumers reasonably relied on their existing credit limits and 

expiration dates on the checks when deciding to use them for a payment. Consumers had 

received no notice that the checks they used were being dishonored until they learned 

from the payees. Thus, consumers could not reasonably have avoided the injury. 

Processing payments for companies engaged in fraudulent activities.

9 The OCC brought an 

enforcement action in a case involving a bank that maintained deposit account relations with 

telemarketers and payment processors, based on the following allegations. The telemarketers 

 

7

FTC v. Capital City Mortgage Corp., Civil No. 98 CV-237 (D.D.C. Feb. 2005), available at

http://www.ftc.gov/opa/2005/02/capitalcity.shtm.

8

In re American Express Bank, FSB (Cease and Desist Order WN-09-016, and Order of Assessment of a Civil Money Penalty for 

$250,000, WN-09-017, June 29, 2009) OTS Docket No. 15648, available at http://www.ots.treas.gov/files/enforcement; and 

http://www.ots.treas.gov/_files/enforcement; press release available at http://www.ots.treas.gov/index.cfm?p=PressReleases; In 

re American Express Centurion Bank, (Cease and Desist Order, June 30, 2009) Docket FDIC-09-251b, available at 

http://www.fdic.gov/news.

9

In re Wachovia Bank, National Association, available at http://www.occ.treas.gov/ea2008-027.pdf and 

http://www.occ.treas.gov/ea2008-028.pdf.
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 5

regularly deposited large numbers of remotely created checks drawn against consumers’ 

accounts. A large percentage of the checks were not authorized by consumers. The bank failed to 

establish appropriate policies and procedures to prevent, detect, or remedy such activities. 

• Substantial injury. Consumers lost money from fraudulent checks created remotely and 

drawn against their accounts.

• Not outweighed by benefits. The cost to the bank of establishing a minimum level of due 

diligence, monitoring, and response procedures sufficient to remedy the problem would 

have been far less than the amount of injury to consumers that resulted from the bank’s 

avoiding those costs. 

• Not reasonably avoidable. Consumers could not avoid the harm because the harm 

resulted principally from transactions to which the consumers had not consented.

Deceptive Acts or Practices

A representation, omission, actor practice is deceptive when

(1) The representation, omission, act, or practice misleads or is likely to mislead the consumer, 

(2) The consumer’s interpretation of the representation, omission, act, or practice is reasonable 

under the circumstances, and 

(3) The misleading representation, omission, act, or practice is material.10

• There must be a representation, omission, act, or practice that misleads or is likely to 

mislead the consumer.

Deception is not limited to situations in which a consumer has already been misled. 

Instead, an act or practice may be deceptive if it is likely to mislead consumers. 

It is necessary to evaluate an individual statement, representation, or omission not in 

isolation, but rather in the context of the entire advertisement, transaction, or course of 

dealing, to determine whether the overall net impression is misleading or deceptive. A 

representation may be an express or implied claim or promise, and it may be written or 

oral. If material information is necessary to prevent a consumer from being misled, it may 

be deceptive to omit that information.

Written disclosures may be insufficient to correct a misleading statement or 

representation, particularly where the consumer is directed away from qualifying 

limitations in the text or is counseled that reading the disclosures is unnecessary. 

Likewise, oral or fine print disclosures or contract disclosures may be insufficient to cure 

a misleading headline or a prominent written representation. Similarly, a deceptive act or 

practice may not be cured by subsequent truthful disclosures.

Acts or practices that may be deceptive include: making misleading cost or price claims; 

offering to provide a product or service that is not in fact available; using bait-and-switch 

techniques; omitting material limitations or conditions from an offer; or failing to provide 

the promised services.

 

10See FTC Policy Statement on Deception, available at http://www.ftc.gov/bcp/policystmt/ad-decept.htm. Examiners should be 

informed by the FTC’s standard for deception. 
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 6

The FTC’s “four Ps” test can assist in the evaluation of whether a representation, 

omission, act, or practice is likely to mislead:

o Is the statement prominent enough for the consumer to notice? 

o Is the information presented in an easy-to-understand format that does not 

contradict other information in the package and at a time when the consumer’s 

attention is not distracted elsewhere? 

o Is the placement of the information in a location where consumers can be 

expected to look or hear? 

o Finally, is the information in close proximity to the claim it qualifies?11

• The representation, omission, act, or practice must be considered from the perspective 

of the reasonable consumer.

In determining whether an act or practice is misleading, one also must consider whether 

the consumer’s interpretation of or reaction to the representation, omission, act, or 

practice is reasonable under the circumstances. In other words, whether an act or practice 

is deceptive depends on how a reasonable member of the target audience would interpret 

the representation. When representations or marketing practices target a specific 

audience, such as older Americans, young people, or financially distressed consumers, 

the communication must be reviewed from the point of view of a reasonable member of 

that group.

Moreover, a representation may be deceptive if the majority of consumers in the target 

class do not share the consumer’s interpretation, so long as a significant minority of such 

consumers is misled. When a seller’s representation conveys more than one meaning to 

reasonable consumers, one of which is false, the seller is liable for the misleading 

interpretation. 

Exaggerated claims or “puffery,” however, are not deceptive if the claims would not be 

taken seriously by a reasonable consumer.

 

11FTC, Dot Com Disclosures, Information about On-Line Advertising, available at: http://business.ftc.gov/documents/bus41-dotcom-disclosures-information-about-online-advertising.pdf.
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 7

• The representation, omission, or practice must be material.

A representation, omission, act, or practice is material if it is likely to affect a consumer’s 

choice of, or conduct regarding, the product or service. Information that is important to 

consumers is material. 

Certain categories of information are presumed to be material. In general, information 

about the central characteristics of a product or service – such as costs, benefits, or 

restrictions on the use or availability – is presumed to be material. Express claims made 

with respect to a financial product or service are presumed material. Implied claims are 

presumed to be material when evidence shows that the institution intended to make the 

claim (even though intent to deceive is not necessary for deception to exist). 

Claims made with knowledge that they are false are presumed to be material. Omissions 

will be presumed to be material when the financial institution knew or should have 

known that the consumer needed the omitted information to evaluate the product or 

service.

If a representation or claim is not presumed to be material, it still would be considered material if 

there is evidence that it is likely to be considered important by consumers.

Examples

The examples described below stem from federal enforcement actions. They provide insight into 

practices that have been alleged to be deceptive by other regulators and may inform CFPB’s 

determinations. However, as with unfairness, the particular facts in a case are crucial to a 

determination of deception. It is important to bear in mind that a change in facts could change the 

appropriate determination. Moreover, the brief summaries below do not present all of the 

material facts relevant to the determinations in each case. The examples show how the deception 

standard may be applied. 

Inadequate disclosure of material lease terms in television advertising.

12 The FTC brought 

actions against vehicle leasing companies alleging that their television advertisements 

represented that consumers could lease vehicles for “$0 down” when advertising a monthly lease 

payment. However, the FTC alleged that the “blur” of “unreadable fine print” that flashed on the 

screen at the end of the advertisement disclosed costs of at least $1,000. The settlements 

prohibited the vehicle leasing companies from misrepresenting the amount consumers must pay 

when signing the lease. 

 

12In the matters of Mazda Motor of America, Inc.; Mitsubishi Motor Sales of America, Inc.; American Honda Motor Company, 

Inc.; General Motors Corporation; American Izusu Motors, Inc., available at http://www.ftc.gov/opa/1997/02/petapp09.shtm.
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 8

In addition, the FTC required that if the companies make any representation about the amounts 

due at lease signing, or that there is “no down payment,” the companies must make an equally 

prominent (readable and audible) disclosure of the total amount of all fees due when consumers 

sign the lease.

• Representation or omission likely to mislead: The television advertisements featured 

prominent statements of “no money down” or “$0 down” at lease signing. The 

advertisement also contained, at the bottom of the screen, a “blur” of small print in which 

disclosures of various costs required by Regulation M (the Consumer Leasing Act) were 

made. The FTC alleged that the disclosures were inadequate because they were not clear,

prominent, or audible to consumers.

• Reasonable consumer perspective. A reasonable consumer would believe that he did not 

have to put any money down and that all he owed was the regular monthly payment. 

• Material representation. The stated “no money down” or “$0 down” plus the low monthly 

lease payment were material representations to consumers. The fact that the additional, 

material costs were disclosed at signing of the lease did not cure the deceptive failure to 

disclose in the television advertising, the FTC claimed.

Misrepresentation about loan terms.

13 In 2004, the FTC sued a mortgage broker advertising

mortgage refinance loans at “3.5% fixed payment 30-year loan” or “3.5% fixed payment for 30 

years,” implying that the offer was for a 30-year loan with a 3.5% fixed interest rate. Instead, the 

FTC claimed that the broker offered adjustable rate mortgages (ARMs) with an option to pay 

various amounts, including a minimum monthly payment that represented only a portion of the 

required interest. As a result, unpaid interest was added to the principal of the loan, resulting in 

negative amortization.

14

• Practice likely to mislead. The FTC claimed that the advertisements were misleading 

because they compared payments on a mortgage that fully amortized to payments on a 

non-amortizing loan with payments that increased after the first year. In addition, the 

FTC claimed that after application, the broker provided Truth in Lending Act (TILA) 

disclosures that misstated the annual percentage rate (APR) and that failed to state that 

the loan was a variable rate loan.

• Reasonable consumer perspective. It was reasonable for consumers to believe that they 

would obtain fixed-rate mortgages, based on the representations.

• Material representation. The representations were material because consumers relied on 

them when making the decision to refinance their fully amortizing 30-year fixed loans. 

As a result, the consumers ended up with adjustable rate mortgages that would negatively

amortize if they made payments at the stated 3.5% payment rate. 

 

13FTC v. Chase Financial Funding, Inc., No. SACV04-549 (C.D.Cal. 2004), Stipulated Preliminary Injunction, 

available athttp://www.ftc.gov/os/caselist/0223287/0223287.shtm. 

14 In 2008, amendments to the Truth in Lending Act’s Regulation Z were adopted to prohibit certain advertising practices, such 

as misleading advertising of fixed rates and payments, for credit secured by a dwelling. Similar practices could be identified as 

deceptive in other product lines. (12 CFR 226.24)(73 FR 44522 (July 30, 2008)).
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 9

Abusive Acts or Practices

The Dodd-Frank Act makes it unlawful for any covered person or service provider to engage in 

an “abusive act or practice.”15An abusive act or practice: 

• Materially interferes with the ability of a consumer to understand a term or condition of a 

consumer financial product or service or

• Takes unreasonable advantage of –

o A lack of understanding on the part of the consumer of the material risks, costs, or 

conditions of the product or service;

o The inability of the consumer to protect its interests in selecting or using a 

consumer financial product or service; or

o The reasonable reliance by the consumer on a covered person to act in the 

interests of the consumer.

Although abusive acts also may be unfair or deceptive, examiners should be aware that the legal 

standards for abusive, unfair, and deceptive each are separate. 

The Role of Consumer Complaints in Identifying Unfair, 

Deceptive, or Abusive Acts or Practices

Consumer complaints play a key role in the detection of unfair, deceptive, or abusive practices. 

Consumer complaints have been an essential source of information for examinations, 

enforcement, and rule-making for regulators. As a general matter, consumer complaints can 

indicate weaknesses in elements of the institution’s compliance management system, such as 

training, internal controls, or monitoring. 

While the absence of complaints does not ensure that unfair, deceptive, or abusive practices are 

not occurring, complaints may be one indication of UDAAPs. For example, the presence of 

complaints alleging that consumers did not understand the terms of a product or service may be a 

red flag indicating that examiners should conduct a detailed review of the relevant practice. This 

is especially true when numerous consumers make similar complaints about the same product or 

service. Because the perspective of a reasonable consumer is one of the tests for evaluating 

whether a representation, omission, act, or practice is potentially deceptive, consumer complaints 

alleging misrepresentations or misunderstanding may provide a window into the perspective of 

the reasonable consumer. 

When reviewing complaints against an institution, examiners should consider complaints lodged 

against subsidiaries, affiliates, and third parties regarding the products and services offered 

through the institution or using the institution’s name. In particular, examiners should determine 

whether an institution itself receives, monitors, and responds to complaints filed against 

subsidiaries, affiliates, and third parties. Consumers can file complaints at a number of entities: 

the institution itself, the Better Business Bureau, State Attorneys General, the FTC’s Consumer 

Sentinel, the CFPB Consumer Response Center, other Federal and State agencies, or on-line 

consumer complaint boards such as www.ripoffreport.com or www.complaints.com.

 

15 Dodd-Frank Act, § 1036(a)(1)(B), 12 U.S.C. § 5536(a)(1)(B).
CFPB Consumer

Laws and Regulations UDAAP

CFPB Examination Handbook 2011 UDAAP 10

Analyzing Complaints

Analysis of consumer complaints may assist in the identification of potential unfair, deceptive, or 

abusive practices. Examiners should consider the context and reliability of complaints; every 

complaint does not indicate violation of law. When consumers repeatedly complain about an 

institution’s product or service, however, examiners should flag the issue for possible further 

review. Moreover, even a single substantive complaint may raise serious concerns that would 

warrant further review. Complaints that allege, for example, misleading or false statements, or 

missing disclosure information, may indicate possible unfair, deceptive, or abusive acts or 

practices needing review.

Another area that could indicate potential unfair, deceptive, or abusive acts or practices is a high 

volume of charge-backs or refunds for a product or service. While this information is relevant to 

the consumer complaint analysis, it may not appear in the institution’s complaint records.

Relationship to Other Laws

An unfair, deceptive, or abusive act or practice may also violate other federal or state laws. For 

example, pursuant to the TILA, creditors must “clearly and conspicuously” disclose the costs and 

terms of credit. An act or practice that does not comply with these provisions of TILA may also 

be unfair, deceptive, or abusive. 

Conversely, a transaction that is in technical compliance with other federal or state laws may 

nevertheless violate the prohibition against UDAAPs. For example, an advertisement may 

comply with TILA’s requirements, but contain additional statements that are untrue or 

misleading, and compliance with TILA’s disclosure requirements does not insulate the rest of the 

advertisement from the possibility of being deceptive.
CFPB

Examination Procedures UDAAP

CFPB Examination Procedures 2011 UDAAP 1

EXAMINATION OBJECTIVES

• To assess the quality of the regulated entity’s 

compliance risk management systems, 

including internal controls and policies and 

procedures, for avoiding unfair, deceptive,

or abusive acts or practices (UDAAP). 

• To identify acts or practices that materially increase the risk of consumers being treated 

in an unfair, deceptive, or abusive manner. 

• To gather facts that help determine whether a regulated entity engages in acts or practices 

when offering or providing consumer financial products or services that are likely to be 

unfair, deceptive, or abusive. 

• To determine, in consultation with Headquarters, whether an unfair, deceptive or abusive 

act or practice has occurred and whether further supervisory or enforcement actions are 

appropriate. 

GENERAL GUIDANCE

Based on the results of the risk assessment of the entity, examiners should review for potential 

unfair, deceptive, or abusive acts or practices, taking into account an entity’s marketing 

programs, product and service mix, customer base, and other factors, as appropriate. Even if the 

risk assessment has not identified potential unfair, deceptive, or abusive acts or practices, 

examiners should be alert throughout an examination for situations that warrant review. 

1. Document Review

a. To initially identify potential areas of UDAAP concerns, obtain and 

review copies of the following to the extent relevant to the examination: 

b. Training materials.

c. Lists of products and services, including descriptions, fee structure, 

disclosures, notices, agreements, and periodic and account statements. 

d. Procedure manuals and written policies, including those for servicing and 

collections. 

e. Minutes of the meetings of the Board of Directors and of management 

committees, including those related to compliance.

f. Internal control monitoring and auditing materials.

g. Compensation arrangements, including incentive programs for employees 

and third parties.

h. Documentation related to new product development, including relevant 

meeting minutes of Board of Directors, and of compliance and new 

product committees.

i. Marketing programs, advertisements, and other promotional material in 

all forms of media (including print, radio, television, telephone, Internet,

or social media advertising). 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB

Examination Procedures UDAAP

CFPB Examination Procedures 2011 UDAAP 2

j. Scripts and recorded calls for telemarketing and collections.

k. Organizational charts, including those related to affiliate relationships and 

work processes.

l. Agreements with affiliates and third parties that interact with consumers 

on behalf of the entity.

m. Consumer complaint files.

n. Documentation related to software development and testing, as applicable.

MANAGEMENT AND POLICY-RELATED EXAMINATION 

PROCEDURES 

1. Identify potential UDAAP concerns by reviewing all relevant written policies and 

procedures, customer complaints received by the entity or by the CFPB, internal 

and external audit reports, statistical and management reports, and examination 

reports. Determine whether:

a. The scope of the entity’s compliance audit includes a review of potential 

unfair, deceptive, or abusive acts or practices.

b. The compliance audit work is performed consistent with the audit plan and 

scope. 

c. The frequency and depth of audit review is appropriate to the nature of the 

activities and size of the entity.

d. Management and the Board of Directors are made aware of and review 

significant deficiencies and their causes.

e. Management has taken corrective actions to followup on any identified 

deficiencies.

f. The entity’s compliance programs ensure that policies are being followed 

through its sampling of relevant product types and decision centers, including 

sales, processing, and underwriting.

g. The entity has a process to respond to consumer complaints in a timely manner 

and determine whether consumer complaints raise potential UDAAP concerns.

h. The entity has been subject to any enforcement actions or has been investigated 

by a regulatory or law enforcement agency for violations of consumer protection 

laws or regulations that may indicate potential UDAAP concerns.

[Click&type]

2. Through discussions with management and a review of available information, 

determine whether the entity’s internal controls are adequate to prevent unfair, 

deceptive or abusive acts or practices. Consider whether:

a. The compliance management program includes measures aimed at avoiding 

unfair, deceptive, or abusive practices, including:
CFPB

Examination Procedures UDAAP

CFPB Examination Procedures 2011 UDAAP 3

o Organization charts and process flowcharts

o Policies and procedures

o Monitoring and audit procedures

b. The entity conducts prior UDAAP reviews of advertising and promotional 

materials, including promotional materials and marketing scripts for new 

products.

c. The entity evaluates initial and subsequent disclosures, including customer 

agreements and changes in terms, for potential UDAAP concerns.

d. The entity reviews new products and changes in the terms and conditions of 

existing products for potential UDAAP concerns.

e. The entity has a thorough process for receiving and responding to consumer 

complaints and has a process to receive complaints made to third parties, 

such as the Better Business Bureau or the CFPB.

f. The entity evaluates servicing and collections for UDAAP concerns.

g. The entity has established policies and controls relating to employee and 

third-party conduct, including

o Initial and ongoing training

o Performance reviews or audits

o Discipline policies and records of disciplinary actions

o Third-party agreements and contractual performance standards

o Compensation programs

o Monitoring

h. The entity’s internal control processesare documented.

i. Computer programs are tested and documented to ensure accurate and timely 

disclosures to consumers.

[Click&type]
CFPB

Examination Procedures UDAAP

CFPB Examination Procedures 2011 UDAAP 4

3. POTENTIAL AREAS FOR TRANSACTION TESTING

Through a high-level assessment of the entity’s products, services, and customer 

base, identify areas for potential transaction testing. This process should 

determine whether:

a. The entity does not underwrite a given credit product on the basis of ability 

to repay.

b. A product’s profitability depends significantly on penalty fees or “back-end” 

rather than upfront fees.

c. A product has high rates of repricing or other changes in terms.

d. A product combines features and terms in a manner that can increase the 

difficulty of consumer understanding of the overall costs or risks of the 

product and the potential harm.

e. Penalties are imposed on a customer when he terminates his relationship with 

the entity.

f. Fees or other costs are imposed on a consumer to obtain information about 

his account. 

g. A product is targeted to particular populations, without appropriate tailoring 

of marketing, disclosures, and other materials designed to ensure 

understanding by the consumers.

[Click&type]

TRANSACTION-RELATED EXAMINATION PROCEDURES

If upon conclusion of the management and policy-related examination procedures, procedural 

weaknesses, or other UDAAP risks require further investigation, conduct transaction testing, as 

necessary, using the following examination procedures. Use judgment in deciding to what extent 

to sample individual products, services, or marketing programs. Increase the sample size to 

achieve confidence that all aspects of the entity’s products and services are reviewed sufficiently. 

Consult with Headquarters to obtain assistance with the sampling process.

1. MARKETING AND DISCLOSURES

Through a review of marketing materials, customer agreements, and other 

disclosures, determine whether, before the consumer chooses to obtain the 

product or service:

a. All representations are factually based.

b. All materials describe clearly, prominently, and accurately:

o costs, benefits, and other material terms of the products or services being 

offered;

o related products or services being offered either as an option or required 

to obtained certain terms; and

o material limitations or conditions on the terms or availability of products 

and services, such as time limitations for favorable rates, promotional 
CFPB

Examination Procedures UDAAP

CFPB Examination Procedures 2011 UDAAP 5

features, expiration dates, prerequisites for obtaining particular products 

or services, or conditions for canceling services.

c. The customer’s attention is drawn to key terms, including limitations and 

conditions, that are important to enable the consumer to make an informed 

decision.

d. All materials clearly and prominently disclose the fees, penalties, and other 

charges that may be imposed and the reason for the imposition.

e. Contracts clearly inform customers of contract provisions that permit 

changes in terms and conditions of the product or service.

f. All materials clearly communicate the costs, benefits, availability, and other 

terms in language that can be understood when products are targeted to 

particular populations, such as reverse mortgage loans for the elderly.

g. Materials do not misrepresent costs, conditions, limitations, or other terms 

either affirmatively or by omission.

h. The entity avoids advertising terms that are generally not available to the 

typical targeted consumer.

[Click&type]

2. AVAILABILITY OF TERMS OR SERVICES AS ADVERTISED

Evaluate whether product(s) and service(s) that consumers are receiving are

consistent with the disclosures and policies. For each product and service being 

reviewed, select a sample that:

a. Is sufficient in size to reach a supportable conclusion about such consistency,

b. Includes, as appropriate, transactions from different origination and 

underwriting channels − for example, different geographical areas or 

different sectors of the entity’s organization structure, and

c. Includes approved and/or denied accounts.

Determine whether:

a. Consumers are reasonably able to obtain the products and services, including 

interest rates or rewards, as represented by the entity.

b. Consumers receive the specific product or service that they request.

c. Counter-offers clearly, prominently, and accurately explain the difference 

between the original product or services requested and the one being offered.

d. Actual practices are consistent with stated policies, procedures, or account 

disclosures.

[Click&type]
CFPB

Examination Procedures UDAAP

CFPB Examination Procedures 2011 UDAAP 6

3. AVAILABILITY OF ACTUAL CREDIT TO THE CONSUMER

Evaluate whether the entity represents the amount of useable credit that the 

consumer will receive in a truthful way. Consider whether:

a. The available credit is sufficient to allow the consumer to use the product as 

advertised and disclosed to the consumer.

b. The fees and charges, typically imposed on the average targeted customer, 

both initially and throughout the term of the loan, remain in a range that does 

not prevent the availability of credit.

c. The entity honors convenience checks when used by the customer in a 

manner consistent with introductory or promotional materials and 

disclosures.

[Click&type]

4. EMPLOYEES AND THIRD PARTIES INTERACTING WITH CONSUMERS

Evaluate how the entity monitors the activities of employees and third-party 

contractors, marketing sales personnel, vendors, and service providers to ensure 

they do not engage in unfair, deceptive, or abusive acts or practices with respect 

to consumer interactions. Interview employees and third parties, as appropriate. 

Specifically, consider whether:

a. The entity ensures that employees and third parties who market or promote 

products or services are adequately trained so that they do not engage in 

unfair, deceptive, or abusive acts or practices.

b. The entity conducts periodic evaluations or audits to check whether 

employees or third parties follow the entity’s training and procedures and has 

a disciplinary policy in place to deal withany deficiencies.

c. The entity reviews compensation arrangements for employees, third-party 

contractors, and service providers to ensure that they do not create 

unintended incentives to engage in unfair, deceptive, or abusive acts or 

practices, particularly with respect to product sales, loan originations, and 

collections.

d. Performance evaluation criteria do not create unintended incentives to 

engage in unfair, deceptive, or abusive acts or practices, including criteria for 

sales personnel based on sales volume, size, terms of sale, or account 

performance.

e. The entity implements and maintains effective risk and supervisory controls 

to select and manage third-party contractors and service providers.

[Click&type]

5. Servicing and Collections

Evaluate whether servicing and collections practices raise potential UDAAP concerns, by 

considering whether:

a. The entity has policies detailing servicing and collections practices and has

monitoring systems to prevent unfair, deceptive or abusive acts or practices.
CFPB

Examination Procedures UDAAP

CFPB Examination Procedures 2011 UDAAP 7

b. Call centers, either operated by the entity itself or by third parties, effectively respond 

to consumers’ calls.

c. The entity ensures that employees and third party contractors:

o represent fees or charges on periodic statements in a manner that is not 

misleading,

o post and credit consumer payments in a timely manner,

o apply payments in a manner that does not unnecessarily increase customer 

payments, without clear justification,

o only charge customers for products and services, such as insurance or credit 

protection programs, that are specifically agreed to, 

o mail periodic statements in time to provide the consumer ample opportunity to 

avoid late payments, and

o do not represent to consumers that they may pay less than the minimum 

amount without clearly and prominently disclosing any fees for paying the 

reduced amount.

d. The entity has policies to ensure compliance with the standards under the Fair Debt 

Collections Practices Act to prevent abusive, deceptive, or unfair debt collection 

practices.

e. Employees and third party contractors clearly indicate to consumers that they are 

calling about the collection of a debt.

f. Employees and third party contractors do not disclose the existence of a consumer’s 

debt to the public without the consent of the consumer, except as permitted by law.

g. The entity avoids repeated telephone calls to consumers that annoy, abuse, or harass 

any person at the number called.

[Click&type]

6. Interviews with Consumers

If potential UDAAP issues are identified that would necessitate interviews with consumers, 

consult with regional management who will confer with Headquarters.

[Click&type]

EXAMINER’S SUMMARY, RECOMMENDATIONS, AND 

COMMENTS 

[Click&type]
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 1

Federal Fair Lending Laws and Regulations

Equal Credit Opportunity Act (ECOA) and 

Regulation

Background

The Equal Credit Opportunity Act (ECOA), which is implemented by Regulation B, applies to 

all creditors. When originally enacted, ECOA gave the Federal Reserve Board responsibility for 

prescribing the implementing regulation. The Dodd-Frank Wall Street Reform and Consumer 

Protection Act of 2010 (Dodd-Frank Act) transferred this authority to the Consumer Financial 

Protection Bureau (“CFPB” or “Bureau”). The Dodd-Frank Act granted rule-making authority 

under ECOA to the CFPB and, with respect to entities within its jurisdiction, granted authority to 

the CFPB to supervise for and enforce compliance with ECOA and its implementing 

regulations.1

The statute provides that its purpose is to require financial institutions and other firms engaged in 

the extension of credit to “make credit equally available to all creditworthy customers without 

regard to sex or marital status.” Moreover, the statute makes it unlawful for “any creditor to 

discriminate against any applicant with respect to any aspect of a credit transaction (1) on the 

basis of race, color, religion, national origin, sex or marital status, or age (provided the applicant 

has the capacity to contract); (2) because all or part of the applicant’s income derives from any 

public assistance program; or (3) because the applicant has in good faith exercised any right 

under the Consumer Credit Protection Act.” The ECOA has two principal theories of liability: 

disparate treatment and disparate impact. Disparate treatment occurs when a creditor treats an 

applicant differently based on a prohibited basis such as race or national origin.2 Disparate 

impact occurs when a creditor employs facially neutral policies or practices that have an adverse 

effect or impact on a protected class unless it meets a legitimate business need that cannot 

reasonably be achieved as well by means that are less disparate in their impact.

3

In keeping with the broad reach of the statute’s prohibition, the regulation covers creditor 

activities before, during, and after the extension of credit. A synopsis of some of the more 

important points of Regulation B follows, and an examination program is provided for a more 

thorough review.

 1

Sec.1071 of the Dodd-Frank Act added a new Sec. 704B to ECOA to require the collection of small business loan data. 

Sec.1474 amended subsection 701(e) of ECOA to generally require creditors to provide applicants copies of written appraisals 

and valuations developed in connection with the applicant’s application for a loan that is secured or would have been secured by 

a first lien on a dwelling promptly upon completion. Those amendments will be reflected in this document at a later date once 

they become effective.

2

12 C.F.R. pt. 202 Supp. I § 202.4(a)-1; 12 C.F.R. pt. 202 Supp. I § 202.4(a)-1. “Disparate treatment” may be “overt” (when the 

creditor openly discriminates on a prohibited basis) or it may be found through comparing the treatment of applicants who 

receive different treatment for no discernable reason other than a prohibited basis. In the latter case, it is not necessary that the 

creditor acts with any specific intent to discriminate. 3

12 C.F.R. pt. 202 Supp. I § 202.6(a) – 2.
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 2

For fair lending scoping and examination procedures, the CFPB is temporarily adopting the 

FFIEC Interagency Fair Lending Examination Procedures that are referenced in the examination 

program. However, in applying those procedures the CFPB takes into account that the Fair 

Housing Act (FHAct), 42 U.S.C. 3601 et seq., unlike ECOA, is not a “Federal consumer 

financial law” as defined by the Dodd-Frank Act for which the CFPB has supervisory authority.

4

Applicability – Sections 202.2(e), 202.2(f), 202.2(j), 

202.2(l), 202.2(m) and 202.2(q)

Regulation B applies to all persons who, in the ordinary course of business, regularly participate 

in the credit decision, including setting the terms of the credit. The term “creditor” includes a 

creditor’s assignee, transferee, or subrogee who so participates. For purposes of discrimination or 

discouragement, Section 202.4(a) and (b), the term creditor also includes a person who, in the 

ordinary course of business, regularly refers applicants or prospective applicants to creditors, or 

selects or offers to select creditors to whom requests for credit may be made.

Regulation B’s prohibitions apply to every aspect of an applicant’s dealings with a creditor 

regarding an application for credit or an existing extension of credit (including, but not limited 

to: information requirements; investigation procedures; standards of creditworthiness; terms of 

credit; furnishing of credit information; revocation, alteration, or termination of credit; and 

collection procedures). The regulation defines “applicant” as any person who requests or who 

has received an extension of credit from a creditor and includes any person who is or may 

become contractually liable regarding an extension of credit. Under Regulation B, an 

“application” means an oral or written request for an extension of credit made in accordance with 

procedures used by a creditor for the type of credit requested. “Extension of credit” means “the 

granting of credit in any form (including, but not limited to, credit granted in addition to any 

existing credit [,] the refinancing or other renewal of credit...or the continuance of existing credit 

without any special effort to collect at or after maturity).” Because the ECOA and Regulation B 

prohibit discrimination in any aspect of a credit transaction, a creditor violates the statute and 

regulation when discriminating against borrowers on a prohibited basis in approving or denying

loan modifications. Moreover, as the definition of credit includes the right granted by a creditor 

to an applicant to defer payment of a debt, a loan modification is itself an extension of credit and 

subject to ECOA and Regulation B. Examples of loan modifications that are extensions of credit 

include, but are not limited to, the right to defer payment of a debt by capitalizing accrued 

interest and certain escrow advances, reducing the interest rate, extending the loan term, and/or 

providing for principal forbearance.5

 4

In addition to potential ECOA violations, an examiner may identify potential violations of the FHAct through the course of an

examination. The FHAct prohibits discrimination in the sale, rental, and financing of dwellings, and in other housing-related 

transactions, based on race, color, national origin, religion, sex, familial status (including children under the age of 18 living with 

parents or legal custodians, pregnant women, and people securing custody of children under the age of 18), and handicap 

(disability). The CFPB cooperates with the U.S. Department of Housing and Urban Development (HUD) to further the purposes 

of the FHAct. If a potential FHAct violation is identified, the examiner must consult with Headquarters to determine whether a 

referral to HUD or the U.S. Department of Justice and, if applicable, the creditor’s prudential regulator is appropriate. 

5

See Federal Reserve Board Consumer Affairs Letter 09-13 (December 4, 2009) 

(http://www.federalreserve.gov/boarddocs/caletters/2009/0913/caltr0913.htm).
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 3

Prohibited Practices – Section 202.4

Regulation B contains two basic and comprehensive prohibitions against discriminatory lending 

practices:

• A creditor shall not discriminate against an applicant on a prohibited basis regarding any 

aspect of a credit transaction.

• A creditor shall not make any oral or written statement, in advertising or otherwise, to 

applicants or prospective applicants that would discourage, on a prohibited basis, a 

reasonable person from making or pursuing an application.

Note that the regulation is concerned not only with the treatment of persons who have initiated 

the application process, but also with lender behavior before the application is even taken. 

Lending officers and employees must be careful to take no action that would, on a prohibited 

basis, discourage a reasonable person from applying for a loan. For example, a creditor may not 

advertise its credit services and practices in ways that would tend to encourage some types of 

borrowers and discourage others on a prohibited basis. In addition, a creditor may not use 

prescreening tactics likely to discourage potential applicants on a prohibited basis. Instructions to 

loan officers or brokers to use scripts, rate quotes, or other means to discourage applicants from 

applying for credit on a prohibited basis are also prohibited.

The prohibition against discouraging applicants applies to in-person oral and telephone inquiries 

as well as to written applications. Lending officers must refrain from requesting prohibited 

information in conversations with applicants during the pre-interview phase (that is, before the 

application is taken) as well as when taking the written application.

To prevent discrimination in the credit-granting process, the regulation imposes a delicate 

balance between the creditor’s need to know as much as possible about a prospective borrower 

with the borrower’s right not to disclose information irrelevant to the credit transaction as well as 

relevant information that is likely to be used in connection with discrimination on a prohibited 

basis. To this end, the regulation addresses taking, evaluating, and acting on applications as well 

as furnishing and maintaining credit information.

Electronic Disclosures–Section 202.4(d)

Disclosures required to be given in writing may be provided to the applicant in electronic form, 

generally subject to compliance with the consumer consent and other applicable provisions of the 

Electronic Signatures in Global and National Commerce Act (E-Sign Act) (15 U.S.C. 7001 et 

seq.).

Rules for Taking Applications—Section 202.5

Regulation B permits creditors to ask for any information in connection with a credit transaction, 

so long as they avoid certain clearly defined areas set forth in Section 202.5, which include both 

the specific prohibited bases of discrimination and certain types of information that often relates 

to discrimination on a prohibited basis. 
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 4

Applicant Characteristics

Creditors may not request or collect information about an applicant’s race, color, religion, 

national origin, or sex. Exceptions to this rule generally involve situations in which the 

information is necessary to test for compliance with fair lending rules or is required by a state or 

federal regulatory agency or other government entity for a particular purpose, such as to 

determine eligibility for a particular program. For example, a creditor may request prohibited 

information:

• In connection with a self-test being conducted by the creditor (provided that the self-test 

meets certain requirements) (Section 202.15);

• For monitoring purposes in relation to credit secured by real estate (Section 202.13; the 

Home Mortgage Disclosure Act, 12 U.S.C. 2801 (“HMDA”); Home Affordable Modification 

Program (“HAMP”)); or

• To determine an applicant’s eligibility for special-purpose credit programs (Section 202.8(b), 

(c) and (d)).

Information about a Spouse or Former Spouse (Section 

202.5(c))

A creditor may not request information about an applicant’s spouse or former spouse except 

under the following circumstances:

• The non-applicant spouse will be a permitted user of or joint obligor on the account. (NOTE: 

The term “permitted user” applies only to open-end accounts.)

• The non-applicant spouse will be contractually liable on the account.

• The applicant is relying on the spouse’s income, at least in part, as a source of repayment.

• The applicant resides in a community property state, or the property upon which the 

applicant is relying as a basis for repayment of the credit requested is located in such a state.

• The applicant is relying on alimony, child support, or separate maintenance income as a basis 

for obtaining the credit.
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 5

Inquiries Concerning Marital Status – Sections 202.5(d)(1) 

and 202.5(d)(3)

Individual Credit

When an applicant applies for individual credit, the creditor may not ask the applicant’s marital 

status. There are two exceptions to this rule:

• If the credit transaction is to be secured, the creditor may ask the applicant’s marital status. 

(This information may be necessary to determine what would be required to gain access to 

the collateral in the event of default.)

• If the applicant either resides in a community property state or lists assets to support the debt 

that are located in such a state, the creditor may ask the applicant’s marital status. (In 

community property states, assets owned by a married individual may also be owned by the 

spouse, thus complicating the availability of assets to satisfy a debt in the event of default.)

Joint Credit

When a request for credit is joint (made by two or more individuals who will be primarily liable), 

the creditor may ask the applicant’s marital status, regardless of whether the credit is to be 

secured or unsecured, but may use only the terms “married,” “unmarried,” and “separated.” This 

requirement applies to oral as well as written requests for marital status information. 

‘‘Unmarried’’ may be defined to include divorced, widowed, or never married, but the 

application must not be structured in such a way as to encourage the applicant to distinguish 

among these.

Alimony, Child Support, or Separate Maintenance Income

(Section 202.5(d)(2))

A creditor may ask if an applicant is receiving alimony, child support, or separate maintenance 

payments. However, the creditor must first disclose to the applicant that such income need not be 

revealed unless the applicant wishes to rely on that income in the determination of 

creditworthiness. An appropriate notice to that effect must be given whenever the creditor makes 

a general request concerning income and the source of that income. Therefore, a creditor either 

must ask questions designed to solicit only information about specific income (for example, 

“salary,” “wages,” “employment,” or other specified categories of income) or must state that 

disclosure of alimony, child support, or separate maintenance payments is not required.

Residency and Immigration Status (Section 202.5(e))

The creditor may inquire about the applicant’s permanent residence and immigration status in the 

United States in determining creditworthiness.
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 6

Rules for Evaluating Applications—Section 202.6

General Rule

A creditor may consider any information in evaluating applicants, so long as the use of the 

information does not have the intent or the effect of discriminating against an applicant on a 

prohibited basis. Generally, a creditor may not:

• Consider any of the prohibited bases, including age (providing the applicant is old enough, 

under state law, to enter into a binding contract) and the receipt of public assistance;

• Use child-bearing or child-rearing information, assumptions, or statistics to determine 

whether an applicant’s income may be interrupted or decreased;

• Consider whether there is a telephone listing in the applicant’s name (but the creditor may 

consider whether there is a telephone in the applicant’s home); or

• Discount or exclude part-time income from an applicant or the spouse of an applicant

Systems for Analyzing Credit

Regulation B neither requires nor endorses any particular method of credit analysis. Creditors 

may use traditional methods, such as judgmental systems that rely on a credit officer’s subjective 

evaluation of an applicant’s creditworthiness, or they may use more-objective, statistically 

developed techniques such as credit scoring.

Credit Scoring Systems

Section 202.2(p) of Regulation B prescribes the standards that a credit scoring system must meet 

to qualify as an ‘‘empirically derived, demonstrably and statistically sound, credit system.’’ All 

forms of credit analysis that do not meet the standards are automatically classified as 

‘‘judgmental’’ systems. This distinction is important because creditors that use a ‘‘demonstrably 

and statistically sound’’ system may take applicant age directly into account as a predictive 

variable,6 whereas judgmental systems may do so only to determine a pertinent element of 

creditworthiness or to favor an elderly applicant.

Judgmental Evaluation Systems

Any system other than one that is empirically derived and demonstrably and statistically sound,

is a judgmental system (including any credit scoring system that does not meet the prescribed 

technical standards). With limited exception, such a system may not take applicant age directly 

into account in evaluating creditworthiness. The act and the regulation permit a creditor to 

consider the applicant’s age for the purpose of evaluating other applicant information that has a 

demonstrable relationship to creditworthiness.7Additionally, in any system of evaluating 

creditworthiness, a creditor may consider the age of an elderly applicant to favor the applicant in 

extending credit. 

 6

This applies provided that the age of an elderly applicant is not assigned a negative factor or value.

7 Judgmental systems may consider the amount and probable continuance of income. A planned reduction in income 

due to retirement may, for example, be considered.
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 7

Rules for Extensions of Credit—Section 202.7

Section 202.7 of Regulation B provides a set of rules proscribing certain discriminatory practices 

regarding the creation and continuation of credit accounts.

Signature Requirements

The primary purpose of the signature requirements is to permit creditworthy individuals 

(particularly women) to obtain credit on their own. Two general rules apply:

• A creditor may not require a signature other than the applicant’s or joint applicant’s if under 

the creditor’s standards of creditworthiness the applicant qualifies for the amount and terms 

of the credit requested.

• A creditor has more latitude in seeking signatures on instruments necessary to reach property 

used as security, or in support of the customer’s creditworthiness, than it has in obtaining the 

signatures of persons other than the applicant on documents that establish the contractual 

obligation to repay.

When assessing the level of a creditor’s compliance with the signature requirements, examiners 

should consult with the Examiner-in-Charge if any questions arise.

Special-Purpose Credit Programs—Section 202.8

The ECOA and Regulation B allow creditors to establish special-purpose credit programs for 

applicants who meet certain eligibility requirements. Generally, these programs target an 

economically disadvantaged class of individuals and are authorized by federal or state law. Some 

are offered by not-for-profit organizations that meet certain IRS guidelines, and some by forprofit organizations that meet specific tests outlined in Section 202.8.

Examiners are encouraged, if an issue arises regarding such a program, to consult with 

Headquarters.

Notifications—Section 202.9

A creditor must notify an applicant of action taken on the applicant’s request for credit, whether 

favorable or adverse, within thirty days after receiving a completed application. Notice of 

approval may be expressly stated or implied (for example, the creditor may give the applicant the 

credit card, money, property, or services for which the applicant applied). 

Notification of adverse action taken on an existing account must also be made within thirty days.

Under at least two circumstances, the creditor need not comply with the thirty-day notification 

rule:

• The creditor must notify an applicant of adverse action within ninety days after making a 

counteroffer unless the applicant accepts or uses the credit during that time.

• The creditor may not have to notify an applicant of adverse action if the application was 

incomplete and the creditor sent the applicant a notice of incompleteness that met certain 

requirements set forth in Section 202.9(c).
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 8

Adverse Action Notice (Section 202.9(a)(2))

A notification of adverse action must be in writing and must contain certain information, 

including the name and address of the creditor and the nature of the action that was taken. In 

addition, the creditor must provide an ECOA notice that includes the identity of the federal 

agency responsible for enforcing compliance with the act for that creditor. This notice is 

generally included on the notification of adverse action. The creditor must also either provide the 

applicant with the specific principal reason for the action taken or disclose that the applicant has 

the right to request the reason(s) for denial within sixty days of receipt of the creditor’s 

notification, along with the name, address, and telephone number of the person who can provide 

the specific reason(s) for the adverse action. The reason may be given orally if the creditor also 

advises the applicant of the right to obtain the reason in writing upon request.

Incomplete Applications (Section 202.9(c))

When a creditor receives an incomplete application, it may send one of two alternative 

notifications to the applicant. One is a notice of adverse action; the other is a notice of 

incompleteness. The notice of incompleteness must be in writing and must specify the 

information the creditor needs if it is to consider the application; it must also provide a 

reasonable period of time for the applicant to furnish the missing information.

Applications Submitted Through a Third Party (Section 

202.9(g))

When more than one creditor is involved in a transaction and adverse action is taken with respect 

to the application for credit by all the creditors involved, each creditor that took such action must 

provide a notice of action taken. The notification may be given by a third party; however, the 

notice must disclose the identity of each creditor on whose behalf the notice is given. If one of 

the creditors approves the application, the creditors that took adverse action need not provide 

notification.

Notification to Business Credit Applicants (Section 

202.9(a)(3))

The notification requirements for business credit applicants are different from those for 

consumer credit applicants and are more extensive if the business had gross revenues of 

$1,000,000 or less in the preceding fiscal year. Extensions of trade credit, credit incident to a 

factoring agreement, and similar types of credit are subject to the same rules as those that apply 

to businesses that had gross revenues of more than $1,000,000.

Generally, a creditor must comply with the same notification requirements for business credit 

applicants with gross revenues of $1,000,000 or less as it does for consumer credit applicants. 

However, the creditor has more options when dealing with these business credit applicants. First, 

the creditor may tell the business credit applicant orally of the action taken. Second, if the 

creditor chooses to provide a notice informing the business credit applicant of the right to request 

the reason for action taken, it may, rather than disclose the reason itself, provide the notice at the 

time of application. If the creditor chooses to inform the applicant of the right to request a 
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 9

reason, however, it must provide a disclosure with an ECOA notice that is in retainable form and 

that gives the applicant the same information that must be provided to consumer credit applicants 

when this option is used (see Section 202.9(a)(2)(ii)). Finally, if the application was made 

entirely over the phone, the creditor may provide an oral statement of action taken and of the 

applicant’s right to a statement of reasons for adverse action.

The notification requirements for business credit applicants with gross revenues of more than 

$1,000,000 are relatively simple. The creditor must notify the applicant of the action taken 

within a reasonable time period. The notice may be oral or in writing; a written statement of the 

reasons for adverse action and the ECOA notice need be provided only if the applicant makes a 

written request within sixty days of the creditor’s notification of the action taken.

Designation of Accounts— Section 202.10(a)

A creditor that furnishes credit information to a consumer reporting agency must designate:

• Any new account to reflect the participation of both spouses if the applicant’s spouse is 

permitted to use or is contractually liable on the account; and

• Any existing account to reflect the participation of both spouses within ninety days after 

receiving a written request to do so from one of the spouses.

If a creditor furnishes credit information to a consumer reporting agency, the creditor must 

furnish the information in the name of the spouse about whom the information was requested.

Record Retention—Section 202.12

Applications

In general, a creditor must preserve all written or recorded information connected with an 

application for 25 months (12 months for business credit) after the date on which the creditor 

informed the applicant of action taken on an application or of incompleteness of an application.

Prohibited Information

A creditor may retain information in its files that it may not use in evaluating applications. 

However, the information must have been obtained inadvertently or in accordance with federal 

or state law or regulation.

Existing Accounts

A creditor must preserve any written or recorded information concerning adverse action on an 

existing account as well as any written statement submitted by the applicant alleging a violation 

of the ECOA or Regulation B. This evidence must be kept for 25 months (12 months for 

business credit).
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 10

Prescreened Solicitations

The 25-month retention rule also applies when a creditor makes an offer of credit to potential 

customers. In such cases, the creditor must retain for 25 months following the date of the 

solicitation:

• The text of any prescreened solicitation;

• The list of criteria the creditor used to select potential recipients of the solicitation; and

• Any correspondence related to complaints (formal or informal) about the solicitation.

Rules for Providing Appraisal Reports—Section 202.14

Regulation B requires that creditors provide a copy of the appraisal report used in connection 

with an application for credit to be secured by a lien on a dwelling. A creditor may provide the 

copy either routinely (whether or not credit is granted or the application is withdrawn) or upon an 

applicant’s written request. If the creditor provides an appraisal report only upon request, it must 

inform the applicant in writing of the right to receive a copy of the report.

Incentives for Self-Testing and Self-Correction—Section 

202.15

A self-test, as discussed in Section 202.15 of Regulation B, must meet two criteria. First, it must 

be a program, practice, or study that a lender designs and uses specifically to determine the 

extent or effectiveness of its compliance with the regulation. Second, the results of the self-test 

must create data or factual information that is otherwise not available and cannot be derived from 

loan or application files or other records related to credit transactions. The findings of a self-test 

that is conducted voluntarily by a creditor and that meets the conditions set forth in Section

202.15 are privileged against discovery or use by (1) a government agency in any examination or 

investigation related to the ECOA or Regulation B or (2) a government agency or an applicant in 

any legal proceeding involving an alleged violation of the ECOA or Regulation B. Privileged 

information includes the report or results of the test; data or other information created by the test; 

and any analysis, opinions, or conclusions regarding the results of the test.

To qualify for the privilege, appropriate corrective action is required when the results of a selftest show that it is more likely than not that there has been a violation of the ECOA or 

Regulation B.

8

The privilege does not cover information about whether a test was conducted; the 

methodology, scope, time period, or dates covered by the test; loan or application files or other 

business records; and information derived from such files and records, even if aggregated, 

summarized, or reorganized.

 8

12 C.F.R. 202.15(c)
CFPB Consumer Laws

and Regulations ECOA

CFPB ECOA 11

Enforcement, Penalties, and Liabilities—Section 202.16

In addition to actual damages, the Act provides for punitive damages of up to $10,000 in 

individual lawsuits and up to the lesser of $500,000 or 1 percent of the creditor’s net worth in 

class action suits. Successful complainants are also entitled to an award of court costs and 

attorney’s fees.

A creditor is not liable for failure to comply with the notification requirements of Section 202.9

or the reporting requirements of 202.10 if the failure was caused by an inadvertent error and the 

creditor, after discovering the error (1) corrects the error as soon as possible and (2) begins 

compliance with the requirements of the regulation. ‘‘Inadvertent errors’’ include mechanical, 

electronic, and clerical errors that the creditor can show(1) were not intentional and (2) occurred 

despite the fact that the creditor maintains procedures reasonably adapted to avoid such errors. 

Similarly, failure to comply with Sections 202.6(b)(6), 202.12, and 202.13 is not considered a 

violation if it results from an inadvertent error and the creditor takes the corrective action noted 

above. Errors involving Sections 202.12 and 202.13 may be corrected prospectively by the 

creditor.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 1

OVERALL EXAMINATION 

OBJECTIVES 

• To determine whether the creditor has 

established policies, procedures, and internal 

controls to ensure that it is in compliance with the Equal Credit Opportunity Act (ECOA) and 

its implementing Regulation B.

• To determine whether the creditor discriminated against members of one or more protected 

classes in any aspect of its credit operations.

• To determine whether the creditor is in compliance with those requirements of ECOA that 

are set forth in Regulation B.

NOTE: This document refers throughout to the Interagency Fair Lending Examination 

Procedures (“IFLEP”). When applying those procedures, it is important to keep in mind that the 

Fair Housing Act, unlike ECOA, is not a “Federal consumer financial law” for which the CFPB 

has supervisory authority.

Section A: ECOA / REGULATION B COMPLIANCE 

MANAGEMENT / RISK ASSESSMENT EXAMINATION 

PROCEDURES

A. Examination Objective & Purpose

• To determine whether the creditor has established policies, procedures and internal controls 

to ensure that it is in compliance with the ECOA and Regulation B. The intensity and scope 

of the current ECOA / Regulation B examination will depend in part on the adequacy of the 

creditor’s compliance management program.

B. Examination Procedures

1. Review the creditor’s overall compliance management program. Following the 

Compliance Management Review procedures in the CFPB’ Supervision/Examination 

Manual; verify that the ECOA and Regulation B compliance is effectively integrated into 

the creditor’s compliance management program.

2. Consult Part II (“Compliance Management Review”) of the IFLEP and apply the 

Compliance Management Analysis Checklist in the IFLEP Appendix.

NOTE: When performing 1 and 2 above, pay special close attention to the creditor’s compliance 

management policies and procedures with respect to the following:

• Does any aspect of the creditor’s credit operations appear to vary by any of the prohibited 

bases? Examples: (i) The creditor establishes most of its branches in predominately nonminority neighborhoods and does not have a presence in nearby minority neighborhoods; or 

(ii) Spanish and English advertisements emphasize different credit products.

• Do the creditor’s underwriting or pricing guidelines contain any unusual criteria that could 

have a possibly negative disparate impact on a protected class? (e.g., underwriting or price 

models that use ZIP codes.

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 2

• Are the creditor’s policies, procedures, or guidelines vague or unduly subjective with respect 

to (i) underwriting; (ii) pricing; (iii) referring applicants to subsidiaries, affiliates, or lending 

channels within the creditor; (iv) classifying applicants as “prime” or “sub-prime” borrowers; 

or (v) deciding what kinds of alternative loan products should be offered or recommended to 

applicants?

• Does the creditor allow exceptions to its underwriting, pricing, or product recommendation 

policies and procedures to be made subjectively or without clear guidance? Even if the 

policies and procedures are clear, does the creditor make a large number of such exceptions?

• Does the creditor give its employees significant discretion to decide what products to offer or 

the price to offer, including both interest rates and fees?

• Does any employee receive incentives depending, directly or indirectly, on the terms or 

conditions of the credit product sold or the price (including both interest rates and fees) 

charged?

• Does the creditor rely on third parties, such as brokers, for a significant part of its credit 

operations?

These factors create conditions under which the risk of fair lending violations may be increased.

Whether any particular factor constitutes a fair lending violation requires consideration of the 

particular facts and circumstances at issue.

C. Examiner’s Compliance Management / Risk Assessment Examination Summary, 

Recommendation and Comments

[Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 3

Section B: FAIR LENDING EXAMINATION 

PROCEDURES

A. Examination Objective & Purpose

• To determine whether the creditor discriminated against members of one or more protected 

classes in any aspect of its credit operations.

B. Pre-Examination Procedures – Data Request1

1. For mortgages, determine if the CFPB has received all the data typically used by 

creditors in pricing and underwriting decisions.

2 If not, in consultation with Headquarters, 

request from the creditor all relevant data in electronic format. 

2. For non-mortgage products, in consultation with Headquarters, request from the creditor

all relevant data in electronic format. 

NOTE: It may take a significant amount of time for the creditor to produce data and for 

Headquarters to review it. Data requests should be sent out as early as practicable to ensure the 

incorporation of all analyses in the examination.

C. Pre-Examination Procedures – Scoping 

No single fair lending examination can reasonably be expected to scrutinize every aspect of an 

institution’s credit operations. The purpose of pre-examination scoping is to help examiners 

target areas with the highest fair lending risk.

The examiners, together with Headquarters, should use statistical analyses whenever appropriate 

to scope fair lending examinations in addition to following the procedures in Part I of the IFLEP 

(“Examination Scope Guidelines”).

1. Review any preliminary data screens provided by Headquarters to identify possible 

examination focal points.3

2. Review information from previous compliance examinations that could inform potential 

focal points of the current examination.

3. Follow the steps in the Examination Scope Guidelines. Inform Headquarters of the 

information you gathered about the creditor. Consult Headquarters to determine what 

additional information would be helpful to improve data analyses and refine scoping.

4. Together with Headquarters, finalize the scope and intensity of the fair lending 

examination.

 1 If it is decided that statistical methods will not be used in the examination, this step can be skipped.

2 For some creditors, the CFPB routinely requests additional mortgage data fields beyond the HMDA data. For 

these creditors, the examiners will likely not have to make any pre-examination mortgage data requests. 3 A focal point is a combination of loan product(s), market(s), decision center(s), time frame and prohibited basis to 

be analyzed during the fair lending examination.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 4

D. Examination Procedures

The IFLEP’s examination procedures (Part III) are focused on conducting comparative file 

reviews and not statistical analysis. It is important to supplement the IFLEP examination 

procedures whenever statistical analysis is involved. 

1. When statistical analysis is not part of the examination, follow Part III of the IFLEP to 

examine the creditor. Working with Headquarters, assess possible violations, and follow 

Part IV of the IFLEP, Steps 1-3, when discussing results with the creditor and reviewing 

all responses.

2. When statistical analysis is part of the examination, examiners should work closely with 

Headquarters to do the following:

a. Follow Part III of the IFLEP to examine the creditor, including conducting 

comparative file reviews as appropriate. 

b. Integrate creditor-specific information into statistical models. Follow Part III.A of 

the IFLEP to verify the accuracy of the data. To the extent HMDA data is used, 

apply the HMDA / Regulation C examination procedures to verify data integrity. For 

non-mortgage data, consult with Headquarters on how to verify data integrity. If the 

most recent Compliance Management review indicates that the creditor does not have 

adequate policies and procedures in place to ensure data integrity, increase the sample 

size for the data verification.

c. Assess possible violations, and follow Part IV of the IFLEP, Step 1, to discuss results 

with the creditor, including sharing our statistical analyses with the creditor and 

asking for comments and explanations. 

d. Review the creditor’s response. Follow Part IV of the IFLEP, Steps 2-3. If 

necessary, in consultation with Headquarters, refine our statistical models and reanalyze. 

3. Consult with Headquarters to reach the final conclusions. Follow Part IV of the IFLEP, 

Steps 4-5.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 5

E. Examiner’s Fair Lending Examination Summary, Recommendation and Comments

[Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 6

Section C: REGULATION B EXAMINATION CHECKLIST

A. Examination Objective & Purpose

• To determine whether the creditor is in compliance with those requirements of ECOA that are set forth in Regulation B.

B. Examination Procedures

The ECOA and its implementing Regulation B not only prohibit discrimination in credit transactions, but also set forth additional 

requirements, such as requiring adverse action notices in appropriate circumstances. Thus, not all items on the checklist relate to 

discrimination. Some items on the checklist, however, do reflect a possible fair lending violation even though they are not stated 

in those terms. 

Accordingly, depending on the general risk profile of the creditor and the Section A Compliance Management/Risk Assessment, 

not all items on the checklist need be included in every fair lending exam. Examiners should consult with Headquarters to 

determine which sections of this checklist should be completed in an examination. 

The checklist, supporting documentation for any apparent violations, and management response should be included in the work 

papers. In consultation with Headquarters, the Examiner-in-Charge, and the Regional Manager, request that the management 

responsible for the transactions provide a response on any apparent violations. 

A “No” answer indicates a possible exception or deficiency and should be explained in the work papers.4

 If a line item is not 

applicable within the area you are reviewing, indicate “NA.”

 4 If the violation of Secs. 202.6(b)(6), 202.9, 202.10, 202.12, or 202.13 results from an inadvertent error, namely a mechanical, electronic, or clerical error that 

the creditor demonstrates was not intentional and occurred notwithstanding the maintenance of procedures reasonably adapted to avoid such errors, there is no 

violation. On discovering an inadvertent error under Secs. 202.9 and 202.10, the creditor must correct it as soon as possible; inadvertent errors under Secs. 202.12 

and 202.13 must be corrected prospectively. To determine whether an error is inadvertent, you should consult with the Examiner-in-Charge. 
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 7

All citations are to Regulation B, 12 CFR pt. 202.

Yes No Basis of Conclusion

Prohibited Practices [Click&type]

Discrimination [Click&type]

See Section B: Fair Lending Examination Procedures [Click&type]

Discouragement [Click&type]

Obtain and review marketing and advertising materials (including 

signs or other displays), prescreened solicitations, and the criteria 

used to determine the potential recipients of the particular 

solicitation, scripts, and interview forms used for pre-application 

interviews and for taking applications, and rate sheets and product 

information used in discussing available types of credit with 

applicants. Conduct loan agent interviews to determine whether they 

show an understanding of the regulatory requirements. 

 [Click&type]

1. Does the creditor not make any oral or written statements, in 

advertising or otherwise, to applicants or prospective 

applicants that would discourage on a prohibited basis a 

reasonable person from making or pursuing an application? 

(202.4(b))

 [Click&type]

2. Does the creditor not use statements that the applicant should 

not bother to apply based on a prohibited basis (e.g., you 

shouldn’t bother to apply because you are retired)? (Comment 

202.4(b)-1(i))

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 8

Yes No Basis of Conclusion

3. Does the creditor not use words, symbols, models or other 

forms of communication in advertising that express, imply, or 

suggest a discriminatory preference or a policy of exclusion in 

violation of the ECOA? (Comment 202.4(b)-1(ii))

 [Click&type]

4. Does the creditor not use scripts that discourage applications 

on a prohibited basis? (Comment 202.4(b)-1(iii)) [Click&type]

5. Are the criteria used for prescreened solicitations not 

discriminatory on a prohibited basis? (202.4(a), (b)) [Click&type]

6. Does the text of any prescreened solicitations avoid statements 

that would tend to discourage, on a prohibited basis, a 

reasonable person from making or pursuing an application? 

(202.4(b)) 

 [Click&type]

Rules for Taking Applications5

Obtain and review application forms (including scripts for telephone 

applications and screen shots of online applications), disclosures, a 

sample of loan files,6 creditor policies and procedures and audits 

pertaining to the taking of applications, and training materials. 

Conduct loan officer interviews to determine whether they show an 

understanding of the regulatory requirements and that policies and 

 5 A creditor may obtain information that is otherwise restricted to determine eligibility for a special purpose program, as provided in § 202.8(b), (c), and (d). To the 

extent there is an appropriately established and administered special purpose program under which any otherwise restricted information was requested, obtaining such 

information should not constitute a violation, and Headquarters and the Examiner-in-Charge should be consulted. 6 To the extent the institution maintains any information in its files that is prohibited by the ECOA or Regulation B for use in evaluating applications, that information 

may be retained if it was obtained (a) prior to March 23, 1977; (b) from consumer reporting agencies, an applicant, or others without the specific request of the 

creditor; or (c) as required to monitor compliance with the ECOA and Regulation B or other federal or state statutes or regulations. (202.12(a))
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 9

Yes No Basis of Conclusion

procedures are consistently applied.

7. Does the creditor use written applications for credit that is

primarily for the purchase or refinancing of dwellings that are 

occupied or to be occupied by the applicant as a principal 

residence and where the credit will be secured by the 

dwellings? (202.4(c), 202.13(a))

 [Click&type]

8. If the creditor collects information (in addition to information 

required for government monitoring purposes, such as 

§ 202.13, HMDA, and HAMP) on the race, color, religion, 

national origin, or sex of the applicant or any other person in 

connection with a credit transaction for purposes of a “selftest”:

a. Does the creditor meet the “self-test” requirements of 

202.15 (see Checklist Items 70-71)? [Click&type]

b. Does the creditor disclose to the applicant, orally or in 

writing, when requesting the information that: (1) the 

applicant is not required to provide the information; (2) 

the creditor is requesting the information to monitor its 

compliance with the federal ECOA; (3) Federal law 

prohibits the creditor from discriminating on the basis 

of this information, or on the basis of an applicant’s 

decision not to furnish the information; and (4) if 

applicable, certain information will be collected based 

on visual observation or surname if not provided by the 

applicant or other person? (202.5(b)(1))

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 10

Yes No Basis of Conclusion

9. If a designation of title, such as Ms., Miss, Mrs., or Mr. is 

requested on an application form, does the form disclose that 

such designation is optional, and does the application form

otherwise use only terms that are neutral as to sex? 

(202.5(b)(2))

 [Click&type]

10. Does the creditor only request any information concerning the 

spouse or former spouse of an applicant when:

a. The spouse will be permitted to use the account; [Click&type]

b. The spouse will be contractually liable on the account; [Click&type]

c. The applicant is relying on the spouse’s income as a 

basis for repayment of the credit requested; [Click&type]

d. The applicant resides in a community property state or 

is relying on property located in such a state as a basis 

for repayment of the credit requested; or

 [Click&type]

e. The applicant is relying on alimony, child support, or 

separate maintenance payments from a spouse or 

former spouse as a basis for repayment of the credit 

requested? (202.5(c)(2))

 [Click&type]

11. In the case of applications for individual unsecured credit, 

does the creditor inquire about the applicant’s marital status 

only when the applicant resides in a community property state 

or is relying on property located in such a state as a basis for 

repayment of the credit requested? (202.5(d)(1))

 [Click&type]

12. In the case of applications for other than individual unsecured [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 11

Yes No Basis of Conclusion

credit, are the creditor’s inquiries into marital status limited to 

the terms “married,” “unmarried,” and “separated” (a creditor 

may explain that the category “unmarried” includes single, 

divorced, and widowed persons)? (202.5(d)(1))

13. If the creditor inquires whether income stated in an application 

is derived from alimony, child support, or separate 

maintenance payments, does the creditor also disclose to the 

applicant that such income need not be revealed if the 

applicant does not want the creditor to consider the 

information in determining the applicant’s creditworthiness? 

(202.5(d)(2))

 [Click&type]

14. Does the creditor not inquire about birth control practices, 

intentions concerning the bearing or rearing of children, or 

capability to bear children? (A creditor may inquire about the 

number and ages of an applicant’s dependents or about 

dependent-related financial obligations or expenditures, 

provided such information is requested without regard to sex, 

marital status, or any other prohibited basis.) (202.5(d)(3))

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 12

Yes No Basis of Conclusion

Rules for Evaluating Applications

Obtain and review policies and procedures, training materials, a 

sample of loan files, audits pertaining to evaluating, and pricing 

applications for credit (including, but not limited to those regarding 

loan servicing, modifications, collections, and loss mitigation), and

information regarding statistical models used in credit evaluations. 

Conduct loan underwriter interviews to determine whether they show 

an understanding of the regulatory requirements and that policies and 

procedures are consistently applied.

15. To the extent that a creditor takes into account an applicant’s 

age (assuming that the applicant has the capacity to enter into 

a binding contract), determine whether the creditor uses age in 

an empirically derived, demonstrably and statistically sound, 

credit scoring system or a judgmental system. (202.2(p))

a. In an empirically derived, demonstrably and 

statistically sound, credit scoring system, is age a 

predictive variable and is the age of an elderly 

applicant (62 or older) not assigned a negative factor or 

value? (202.6(b)(2)(ii))

 [Click&type]

b. In a judgmental system of evaluating creditworthiness, 

is the applicant’s age considered only for the purpose 

of determining a pertinent element of creditworthiness? 

(202.6(b)(2)(iii))

 [Click&type]

c. Except as set forth in Checklist Item 15(b) above (use 

for pertinent element of creditworthiness), in any [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 13

Yes No Basis of Conclusion

system for evaluating creditworthiness, is the age of an 

applicant 62 or older considered only to favor him or 

her in extending credit? (202.6(b)(2)(iv))

16. Does the creditor only take into account whether an 

applicant’s income derives from any public assistance program 

in a judgmental system of evaluating creditworthiness and 

only for the purpose of determining a pertinent element of 

creditworthiness? (202.6(b)(2)(iii))

 [Click&type]

17. When evaluating creditworthiness, does the creditor not make 

assumptions or use aggregate statistics relating to the 

likelihood that any category of persons will bear or rear 

children or will, for that reason, receive diminished or 

interrupted income in the future? (202.6(b)(3))

 [Click&type]

18. Does the creditor not take into account whether there is a 

telephone listing in the name of an applicant for consumer 

credit? (202.6(b)(4))

 [Click&type]

19. Does the creditor count, and not discount or exclude from 

consideration, the income of an applicant or the spouse of an 

applicant because of a prohibited basis? (202.6(b)(5)) (A 

creditor may consider the amount and probable continuance of 

any income in evaluating an applicant’s creditworthiness.)

 [Click&type]

20. Does the creditor consider income derived from part-time 

employment, alimony, child support, separate maintenance 

payments, retirement benefits, or public assistance on an 

individual basis, and not on the basis of aggregate statistics? 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 14

Yes No Basis of Conclusion

(Comment 202.6(b)(5)-1)

21. Does the creditor count, and not discount or exclude from 

consideration, the income of an applicant or the spouse of an 

applicant because the income is derived from part-time 

employment, is an annuity, pension, or other retirement 

benefit, or comes from multiple income streams? (202.6(b)(5), 

Comment 202.6(b)(5)-4) (A creditor may consider the amount 

and probable continuance of any income in evaluating an 

applicant’s creditworthiness.) 

 [Click&type]

22. When an applicant relies on alimony, child support, or 

separate maintenance payments in applying for credit, does the 

creditor consider such payments as income to the extent that 

they are likely to be consistently made? (202.6(b)(5))

 [Click&type]

23. To the extent the creditor considers credit history in evaluating 

the creditworthiness of similarly qualified applicants for a 

similar type and amount of credit, in evaluating an applicant’s 

creditworthiness, does the creditor consider: 

 [Click&type]

a. The credit history, when available, of accounts 

designated as accounts that the applicant and the 

applicant’s spouse are permitted to use or for which 

both are contractually liable? (202.6(b)(6)(i)) 

 [Click&type]

b. On the applicant’s request, any information that the 

applicant may present that tends to indicate the credit 

history being considered by the creditor does not 

accurately reflect the applicant’s creditworthiness? 

(202.6(b)(6)(ii)) 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 15

Yes No Basis of Conclusion

c. On the applicant’s request, the credit history, when 

available, of any account reported in the name of the 

applicant’s spouse or former spouse that the applicant 

can demonstrate accurately reflects the applicant’s 

creditworthiness? (202.6(b)(6)(iii))

 [Click&type]

24. Does the creditor not deny credit in whole or in part based on 

the country an applicant is from? (Comment 202.2(z)-2)) [Click&type]

25. Are married and unmarried applicants evaluated by the same 

standards? (202.6(b)(8)) [Click&type]

26. In evaluating joint applicants, are joint applicants treated in the 

same manner regardless of the existence, absence, or 

likelihood of a marital relationship between the parties? 

(202.6(b)(8))

 [Click&type]

27. Does the creditor not consider race, color, religion, or sex (or 

an applicant’s or other person’s decision not to provide the 

information) in any aspect of a credit transaction? 

(202.6(b)(1), (9))

 [Click&type]

Rules for Extensions of Credit

Obtain and review policies and procedures, training materials, a 

sample of loan files, closing instructions on a sample of loans, and 

audits pertaining to extensions of credit (including, but not limited to 

signature requirements and account management). Conduct loan 

officer and closing agent interviews to determine whether they show 

an understanding of the regulatory requirements and that policies and 
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 16

Yes No Basis of Conclusion

procedures are consistently applied.

28. Does the creditor not refuse to grant an individual account to a 

creditworthy applicant on a prohibited basis? (202.7(a)) [Click&type]

29. Does the creditor not refuse to allow an applicant to open or 

maintain an account in a birth-given first name and a surname 

that is the applicant’s birth-given surname, the spouse’s 

surname, or a combined surname? (202.7(b))

 [Click&type]

30. With respect to applicants who are contractually liable on an 

existing open-end account, does the creditor on the basis of the 

applicant’s reaching a certain age or retiring or on the basis of 

a change in the applicant’s name or marital status, not require

reapplication (except as permitted by § 202.7(c)(2), see

Checklist Item 31), change the terms of the account, or 

terminate the account, unless there is evidence of the 

applicant’s inability or unwillingness to repay? (202.7(c)(1))

 [Click&type]

31. To the extent the creditor requires reapplication for an openend account on the basis of a change in the marital status of an 

applicant who is contractually liable:

a. Does it do so only when (1) the original credit granted 

was based in whole or in part on the income of the 

applicant’s spouse; and (2) the creditor has information 

available to it indicating that the applicant’s income 

may not support the amount of credit currently 

available; and 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 17

Yes No Basis of Conclusion

b. Does it allow the account holder full access to the 

account under the existing contract terms while the 

reapplication is pending? (202.7(c)(2), Comment 

202.7(c)(2)-1)

 [Click&type]

32. For joint applications, is there evidence of an intent to apply 

for joint credit at the time of application? (The creditor shall 

not deem the submission of a joint financial statement or other 

evidence of jointly held assets as an application for joint 

credit.) (202.7(d)(1), Comment 202.7(d)(1)-3)

 [Click&type]

33. Does the creditor allow an applicant who is individually 

creditworthy to obtain credit without a spouse’s or other 

person’s signature (other than as a joint applicant)? 

(202.7(d)(1), Comment 202.7(d)(1)-1)

 [Click&type]

34. Does the creditor require a signature of an applicant’s spouse 

or other person, other than a joint applicant, on any credit 

instrument in only the following circumstances and based only 

on existing forms of ownership and not on the possibility of a 

subsequent change (Comment 202.7(d)(2)-1(i)):

 [Click&type]

a. If an applicant requests unsecured credit and relies in 

part upon property that the applicant owns jointly with 

another person to satisfy the creditor’s standards of 

creditworthiness, the creditor requires the signature of 

the other person only on the instrument(s) necessary, or 

reasonably believed by the creditor to be necessary, 

under the law of the state in which the property is 

located, to enable the creditor to reach the property 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 18

Yes No Basis of Conclusion

being relied upon in the event of the death or default of 

the applicant. (202.7(d)(2))

b. If a married applicant requests unsecured credit and 

resides in a community property state, or if the 

applicant is relying on property located in such a state, 

the creditor requires the signature of the spouse only on 

any instrument necessary, or reasonably believed by 

the creditor to be necessary, under applicable state law 

to make the community property available to satisfy 

the debt in the event of default and (1) applicable state 

law denies the applicant power to manage or control 

sufficient community property to qualify for the credit 

requested under the creditor’s standards of 

creditworthiness; and (2) the applicant does not have 

sufficient separate property to qualify for the credit 

requested without regard to community property. 

(202.7(d)(3))

 [Click&type]

c. If an applicant requests secured credit, the creditor 

requires the signature of the applicant’s spouse or other 

person only on those instruments necessary, or 

reasonably believed by the creditor to be necessary, 

under applicable state law to make the property being 

offered as security available to satisfy the debt in the 

event of default (for example, an instrument to create a 

valid lien, pass clear title, waive inchoate rights, or 

assign earnings). (202.7(d)(4))

 [Click&type]

35. Does the creditor refrain from routinely requiring a non- [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 19

Yes No Basis of Conclusion

applicant joint owner to sign an instrument (such as a 

quitclaim deed) that would result in the forfeiture of the joint 

owner’s interest in the property? (Comment 7(d)(2)-1(ii)(C))

36. In those situations when under the creditor’s standards of 

creditworthiness, the personal liability of an additional party is 

necessary to support the credit requested, does the creditor 

allow the applicant to have either his or her spouse or someone 

other than his or her spouse to serve as the additional party? 

(202.7(d)(5))

 [Click&type]

37. If a borrower’s creditworthiness is reevaluated when a credit 

obligation is renewed, does the creditor determine whether an 

additional party is still warranted and, if not warranted, release 

the additional party? (Comment 202.7(d)(5)-3)

 [Click&type]

38. Does the creditor not refuse to extend credit and not terminate 

an account because credit life, health, accident, or disability 

insurance is not available because of the applicant’s age? 

(202.7(e))

 [Click&type]

Special-Purpose Credit Programs

Inquire as to whether the creditor offers a special-purpose credit 

program.

39. To the extent an issue arose regarding a special-purpose credit 

program, were the Examiner-in-Charge and Headquarters

consulted?

In the Basis of Conclusion section, describe the issue, the office 

(and person) consulted at Headquarters, and the resolution. If not 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 20

Yes No Basis of Conclusion

applicable, please note in the Basis of Conclusion.

Notifications

Obtain and review policies and procedures, training materials, a 

sample of loan files, and audits pertaining to notifications (including, 

but not limited to those that pertain to prequalification and 

preapproval processes, incomplete applications, counteroffers, loan 

modifications, and those that apply when there are third parties or 

multiple creditors). Conduct loan officer interviews to determine 

whether they show an understanding of the regulatory requirements 

and that policies and procedures are consistently applied.

Consumer Credit

40. With respect to consumer credit, the creditor appropriately 

notified applicants as follows:

a. Within 30 days after receiving a completed application, 

the creditor notified applicants concerning the 

creditor’s approval of, counteroffer to, or adverse 

action on the application (unless the parties 

contemplated that the applicant would inquire about 

the status, the application was approved, and the 

applicant failed to inquire within 30 days after 

applying, in which case the creditor may treat the 

application as withdrawn). (202.9(a)(1)(i), 202.9(e))

 [Click&type]

b. Within 30 days after taking adverse action on an 

incomplete application, the creditor notified applicants [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 21

Yes No Basis of Conclusion

of the adverse action in writing (unless written notice 

of incompleteness is provided within 30 days of receipt 

of the incomplete application, specifying the 

information needed, designating a reasonable period of 

time for the applicant to provide the information, and 

informing the applicant that failure to provide the 

information requested will result in no further 

consideration being given to the application), 

(202.9(a)(1)(ii), 202.9(c))

c. Within 30 days after taking adverse action on an 

existing account, the creditor notified applicants of the 

adverse action in writing; (202.9(a)(1)(iii))

 [Click&type]

d. Within 90 days after notifying the applicant of a 

counteroffer, if the applicant does not expressly accept 

or use the credit offered, the creditor notified 

applicants of the adverse action taken in writing (unless

the counteroffer was accompanied by the notice of 

adverse action on the credit terms originally sought)

(202.9(a)(1)(iv), Comment 202.9(a)(1)-6)

 [Click&type]

41. With respect to consumer credit, the creditor’s notifications 

given to an applicant when an adverse action is taken are in 

writing, capable of being retained, and contain all of the 

following:

 [Click&type]

a. A statement of the action taken; [Click&type]

b. The name and address of the creditor; [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 22

Yes No Basis of Conclusion

c. A statement of the provisions of Section 701(a) of the 

ECOA;7 [Click&type]

d. The name and address of the federal agency that 

administers compliance with respect to the creditor; 

and

 [Click&type]

e. Either: 

i. A statement of specific reasons for the action 

taken that is specific and indicates the principal 

reason(s) for the adverse action (Statements 

that the adverse action was based on the 

creditor’s internal standards or policies or that 

the applicant, joint applicant, or similar party 

failed to achieve a qualifying score on the 

creditor’s credit scoring system are 

insufficient); or

ii. A disclosure (which contains the name, address, 

and telephone number of the person or office 

from which the statement of reasons can be 

obtained) of the applicant’s right to a statement 

of specific reasons within 30 days, if the 

statement is requested within 60 days of the 

creditor’s notification (and if, the creditor 

chooses to provide the reasons orally, the 

creditor shall also disclose the applicant’s right 

 [Click&type]

 7 This statement must be substantially similar to the following: “The federal Equal Credit Opportunity Act prohibits creditors from discriminating against credit applicants on the 

basis of race, color, religion, national origin, sex, marital status, age (provided the applicant has the capacity to enter into a binding contract); because all or part of the applicant’s 

income derives from any public assistance program; or because the applicant has in good faith exercised any right under the Consumer Credit Protection Act. The federal agency 

that administers compliance with this law concerning this creditor is [name and address as specified by the appropriate agency listed in appendix A of this regulation].” 

(202.9(b)(1))
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 23

Yes No Basis of Conclusion

to have them confirmed in writing within 30 

days of receiving the applicant’s written request 

for confirmation). (202.4(d)(1), 202.9(a)(2), 

(b)(1), (b)(2))

Small Business Credit

42. Except for transactions conducted entirely by phone, in 

connection with business credit for businesses with gross 

revenues of $1 million or less in the preceding fiscal year or 

to start a new business (Comment 202.9(a)(3)-1) (other than an 

extension of trade credit, credit incident to a factoring 

agreement, or other similar types of business credit):

a. Within 30 days after receiving a completed application, 

the creditor notified applicants concerning the 

creditor’s approval of, counteroffer to, or adverse 

action on the application orally or in writing (unless the 

parties contemplated that the applicant would inquire 

about the status, the application was approved, and the 

applicant failed to inquire within 30 days after 

applying, in which case the creditor may treat the 

application as withdrawn). (202.9(a)(1)(i), 202.9(e), 

202.9(a)(3)(i)(A))

 [Click&type]

b. Within 30 days after taking adverse action on an 

incomplete application, the creditor notified applicants 

of the adverse action orally or in writing (unless

written notice of incompleteness is provided within 30 

days of receipt of the incomplete application,

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 24

Yes No Basis of Conclusion

specifying the information needed, designating a 

reasonable period of time for the applicant to provide 

the information, and informing the applicant that 

failure to provide the information requested will result 

in no further consideration being given to the 

application), (202.9(a)(1)(ii), 202.9(c)), 

202.9(a)(3)(i)(A))

c. Within 30 days after taking adverse action on an 

existing account, the creditor notified applicants of the 

adverse action orally or in writing; (202.9(a)(1)(iii), 

202.9(a)(3)(i)(A))

 [Click&type]

d. Within 90 days after notifying the applicant of a 

counteroffer, if the applicant does not expressly accept 

or use the credit offered, the creditor notified 

applicants of the adverse action orally or in writing 

(unless the counteroffer was accompanied by the notice 

of adverse action on the credit terms originally sought)

(202.9(a)(1)(iv), Comment 202.9(a)(1)-6, 

202.9(a)(3)(i)(A))

 [Click&type]

43. Except for transactions conducted entirely by phone, in 

connection with business credit for businesses with gross 

revenues of $1 million or less in the preceding fiscal year or 

to start a new business (Comment 202.9(a)(3)-1) (other than an 

extension of trade credit, credit incident to a factoring 

agreement, or other similar types of business credit), the 

creditor’s adverse action notices contained (orally or in 

writing):
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 25

Yes No Basis of Conclusion

a. A statement of the action taken; [Click&type]

b. The name and address of the creditor; [Click&type]

c. A statement of the provisions of Section 701(a) of the 

ECOA;8 [Click&type]

d. The name and address of the federal agency that 

administers compliance with respect to the creditor 

(namely, CFPB); and 

 [Click&type]

 8

 See supra note 7.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 26

Yes No Basis of Conclusion

e. Either:

i. A statement of specific reasons for the action 

taken (that is specific and indicates the 

principal reason(s) for the adverse action); or

ii. Unless provided at the time of application, a 

written, capable of being retained, disclosure 

(which contains the name, address, telephone 

number of the person or office from which the 

statement of reasons can be obtained, and, if 

given at the time of application, a statement of 

the provisions of Section 701(a) of the ECOA9) 

of the applicant’s right to a statement of 

specific reasons within 30 days, if the statement 

is requested within 60 days of the creditor’s 

notification (and if, the creditor chooses to 

provide the reasons orally, the creditor shall 

also disclose the applicant’s right to have them 

confirmed in writing within 30 days of 

receiving the applicant’s written request for 

confirmation). (202.9(a)(2), 202.9(a)(3)(i)(A), 

202.9(a)(3)(i)(B), 202.9(b)(1))

 [Click&type]

44. With respect to applications made entirely by telephone in 

connection with business credit for businesses with gross 

revenues of $1 million or less in the preceding fiscal year or 

to start a new business (Comment 202.9(a)(3)-1) (other than an 

 [Click&type]

 9

 See supra note 7.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 27

Yes No Basis of Conclusion

extension of trade credit, credit incident to a factoring 

agreement, or other similar types of business credit), the 

creditor at least made an oral statement of the action taken and 

of the applicant’s right to a statement of reasons for adverse 

action. (202.9(a)(3)(i)(C))

Large Business Credit

45. For businesses with gross revenues in excess of $1 million in 

the preceding fiscal year, or for extensions of trade credit, 

credit incident to a factoring agreement or other similar types 

of business credit, did the creditor at least: 

a. Communicate the notification of action taken within a 

reasonable time orally or in writing, and

b. In response to an applicant’s written request for the 

reasons within 60 days of the creditor’s notification, 

provide in writing the reasons for adverse action and a 

statement of the provisions of § 701(a) of the ECOA10? 

(202.9(a)(3)(ii))

 [Click&type]

All Credit Transactions [Click&type]

46. Within 30 days after receiving an application that is 

incomplete regarding matters than an applicant can complete, 

does the creditor (a) notify the applicant of adverse action (in 

the manner appropriate for the type of credit – business or 

 [Click&type]

 10 See supra note 7.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 28

Yes No Basis of Conclusion

consumer), or (b) send a written notice to the applicant 

specifying the information needed, designating a reasonable 

period of time for the applicant to provide the information, and 

informing the applicant that failure to provide the information 

requested will result in no further consideration being given to 

the application? (Although the creditor may inform the 

applicant orally of the need for additional information, if the 

application remains incomplete it must provide either notice 

within the specified time period.) (202.9(c))

47. When declining a request for a modification of a loan, does the 

creditor always provide an adverse action notice when the 

consumer is not delinquent or in default? (202.9(a)(1); see

Federal Reserve Board Consumer Affairs Letter 09-13 

(December 4, 2009)

(http://www.federalreserve.gov/boarddocs/caletters/2009/0913

/caltr0913.htm).

 [Click&type]

48. When an application involves multiple applicants, does the 

creditor provide notification of action to the primary applicant, 

when one is readily apparent? (202.9(f))

 [Click&type]

49. When an application is made on behalf of an applicant by a 

third party to multiple creditors, including the creditor, and no 

credit is offered or if the applicant does not expressly accept or 

use the credit offered, does the creditor provide the appropriate 

adverse action notice either directly or through the third party 

(disclosing the identify of each creditor on whose behalf the 

notice is given)? (202.9(g))

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 29

Yes No Basis of Conclusion

Designation of Accounts

Obtain and review policies and procedures, training materials, and 

audits pertaining to the designation of accounts on furnishing them to 

credit reporting agencies, as well as a sample of information reported 

to the credit reporting agencies. 

50. To the extent the creditor furnishes consumer credit 

information, does it designate any new account to reflect the 

participation of both spouses if the applicant’s spouse is 

permitted to use or is contractually liable on the account (other 

than as a guarantor, surety, endorser, or similar party) 

(202.10(a), Comment 202.10-1)

 [Click&type]

51. To the extent the creditor furnishes consumer credit 

information, does it designate any existing account to reflect 

the participation of both spouses if the applicant’s spouse is 

permitted to use or is contractually liable on the account (other 

than as a guarantor, surety, endorser, or similar party) within 

90 days after receiving a written request to do so from one of 

the spouses? (202.10(a), Comment 202.10-1)

 [Click&type]

52. To the extent the creditor furnishes consumer credit 

information to a consumer reporting agency concerning 

accounts designated to reflect the participation of both 

spouses, does the creditor furnish the information in a manner 

that enables the consumer reporting agency to provide access 

to the information in the name of each spouse? (202.10(b), 

Comment 202.10-1)

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 30

Yes No Basis of Conclusion

53. To the extent the creditor furnishes consumer credit 

information in response to inquiries about accounts designated 

to reflect the participation of both spouses, does the creditor 

furnish the information in the name of the spouse about whom 

the information is requested? (202.10(c), Comment 202.10-1)

 [Click&type]

Record Retention

Obtain and review policies and procedures, training materials, audits, 

a sample of loan files, relevant third-party contracts, and other 

records required to be retained (e.g., information relating to 

prescreened offers of credit and self-tests) that pertain to record 

retention (including but not limited to record retention schedules, 

retention of documents relating to prescreened offers of credit, and 

retention of documents relating to any self-tests). Inquire into 

whether there is any enforcement action or investigation involving the 

creditor. 

54. Does the creditor retain for 25 months (12 months for business 

credit regarding businesses with gross revenues of $1 million 

or less in the previous fiscal year, except an extension of trade 

credit, credit incident to a factoring agreement, or other similar 

types of business credit) after the date that the creditor notifies 

an applicant of action taken or of incompleteness, an original 

or copy of the following: 

 [Click&type]

a. The application and any other written or recorded 

information used in evaluating the application that is 

not returned to the applicant at the applicant’s request? 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 31

Yes No Basis of Conclusion

(202.12(b)(1)(i)) 

b. Any information required to be obtained concerning 

characteristics of the applicant to monitor compliance 

with the ECOA and Regulation B or other similar law, 

such as the Home Mortgage Disclosure Act or Home 

Affordable Modification Program? (202.12(b)(1)(i)) 

 [Click&type]

c. A copy of the notification of action taken, if written, or 

any notation or memorandum by the creditor, if made 

orally? (202.12(b)(1)(ii)(A)) 

 [Click&type]

d. A statement of specific reasons for adverse action, if 

written, or any notation or memorandum by the 

creditor, if made orally? (202.12(b)(1)(ii)(B)) 

 [Click&type]

e. Any written statement submitted by the applicant 

alleging a violation of the ECOA or Regulation B? 

(202.12(b)(1)(iii))

 [Click&type]

55. Does the creditor retain for 25 months (12 months for business 

credit regarding businesses with gross revenues of $1 million 

or less in the previous fiscal year, except an extension of trade 

credit, credit incident to a factoring agreement, or other similar 

types of business credit) after the date that the creditor notifies 

an applicant of adverse action regarding an existing account,

an original or copy of the following: 

a. Any written or recorded information concerning the 

adverse action? (202.12(b)(2)(i)) [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 32

Yes No Basis of Conclusion

b. Any written statement submitted by the applicant 

alleging a violation of the ECOA or Regulation B? 

(202.12(b)(2)(ii))

 [Click&type]

56. Does the creditor retain for 25 months (12 months for business 

credit regarding businesses with gross revenues of $1 million 

or less in the previous fiscal year, except an extension of trade 

credit, credit incident to a factoring agreement, or other similar 

types of business credit) after the date the creditor receives an 

application for which 202.9’s notification requirements do not 

apply (e.g., when an application is expressly withdrawn, or an 

application is submitted to more than one creditor on behalf of 

the applicant, and the application is approved by one of the 

other creditors) all written or recorded information in its 

possession concerning the applicant, including any notation of 

action taken? (202.12(b)(3), Comment 202.12(b)(3)-1)

 [Click&type]

57. If the creditor has actual notice that it is under investigation or 

is subject to an enforcement proceeding for an alleged 

violation of the ECOA or Regulation B by the Attorney 

General of the United States or by the CFPB or other 

enforcement agency charged with monitoring the creditor’s 

compliance with the ECOA and Regulation B, or if it has been 

served with notice of an action filed pursuant to Section 706 of 

the ECOA, did the creditor retain the foregoing information 

identified in Checklist Items 54-56 until final disposition of 

the matter (unless an earlier time is allowed by order of the 

agency or court). (202.12(b)(4))

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 33

Yes No Basis of Conclusion

58. For business credit from businesses with gross revenues of 

more than $1 million in the previous fiscal year, or an 

extension of trade credit, credit incident to a factoring 

agreement, or other similar types of business credit, does the 

creditor retain records for at least 60 days after notifying the 

applicant of the action taken, or for 12 months if the applicant 

requests in writing during the 60-day time period the reasons 

for adverse action or that records be retained? (202.12(b)(5))

 [Click&type]

59. If the creditor conducts a self-test pursuant to Section 202.15:

a. Does the creditor retain for 25 months after the self-test 

is completed, all written or recorded information about 

the self-test?

 [Click&type]

b. If the creditor has actual notice that it is under 

investigation or is subject to an enforcement 

proceeding for an alleged violation, or if it has been 

served with notice of a civil action, does the creditor 

retain the information until final disposition of the 

matter (unless an earlier time is allowed by the 

appropriate agency or court order)? (202.12(b)(6))

 [Click&type]

60. For prescreened solicitations, does the creditor retain for 25 

months (12 months for business credit except regarding 

businesses with gross revenues of more than $1 million in the 

previous fiscal year, or an extension of trade credit, credit 

incident to a factoring agreement, or other similar types of 

business credit) after the date on which an offer of credit was 

made to potential customers: (a) the text of any prescreened 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 34

Yes No Basis of Conclusion

solicitation; (b) the list of criteria the creditor used both to 

determine the potential recipients of the particular solicitation 

and to determine who will actually be offered credit; and (c) 

any correspondence related to complaints (formal or informal) 

about the solicitation? (202.12(b)(7), Comment 202.12(b)(7)-

2)

Information for Monitoring Purposes as to Applications from 

Natural Persons 

Obtain and review policies and procedures, training materials, a 

sample of loan files, quality control reports, and audits pertaining to 

information gathered for monitoring. Conduct loan officer interviews 

to determine whether they show an understanding of the regulatory 

requirements and that policies and procedures are consistently 

applied.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 35

Yes No Basis of Conclusion

61. With respect to applications for credit that are primarily for the 

purchase or refinancing of dwellings (as defined in 

Section 202.13(a)(2)) that are occupied or to be occupied by 

the applicant as a principal residence where the credit will be 

secured by the dwelling,11 does the creditor request (but not 

require) either on the application form or on a separate form 

that refers to the application (202.13(b)) the following 

information regarding the applicant: 

a. Ethnicity, using the categories “Hispanic or Latino,” 

and “Not Hispanic or Latino”; and race, using the 

categories “American Indian or Alaska Native,” 

“Asian,” “Black or African American,” “Native 

Hawaiian or Other Pacific Islander,” and “White,” and 

allowing applicants to select more than one racial 

designation? (202 .13(a)(i), Comment 202.13(b)-1)

 [Click&type]

b. Sex? (202.13(a)(ii)) [Click&type]

c. Marital status, using the categories married, unmarried, 

and separated? (202.13(a)(iii) [Click&type]

d. Age? (202.13(a)(iv)) [Click&type]

62. If an applicant chooses not to provide the requested [Click&type]

 11 Examiners should ensure that the institution limits its requests for government monitoring information under this section to only these loans, except 

as permitted by Sec. 202.5(a)&(b) (see Checklist Item 8) or as required by HMDA (reaching home purchase loans, home improvement loans, 

refinancings, and (optionally) home equity lines of credit made in whole or in part for the purpose of home improvement or home purchase), or other 

governmental program or directive such as the Home Affordable Modification Program (HAMP).
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 36

Yes No Basis of Conclusion

information or any part of it, does the creditor note that on the 

monitoring form and note on the form, to the extent possible, 

the ethnicity, race, and sex of the applicant(s) on the basis of 

visual observation or surname? (202.13(b))

63. If the creditor receives applications by mail, telephone, or 

electronic media and it is not evident on the face of an 

application how it was received, does the creditor indicate on 

the form or other application record how it was received? 

(Comment 202.13(b)-3(iii))

 [Click&type]

64. Does the creditor inform applicant(s) (a) that the information 

regarding ethnicity, race, sex, marital status, and age is being 

requested by the federal government for the purpose of 

monitoring compliance with federal statutes that prohibit 

creditors from discriminating against applicants on those 

bases; and (b) that if the applicant(s) chooses not to provide 

the information, the creditor is required to note the ethnicity, 

race and sex on the basis of visual observation or surname? 

(202.13(c))

 [Click&type]

Appraisal Reports12

Obtain and review policies and procedures, training materials, a 

sample of loan files, and audits pertaining to providing appraisal 

reports. Conduct loan officer interviews to determine whether they 

show an understanding of the regulatory requirements and that 

policies and procedures are consistently applied.

 12 A creditor that is subject to the National Credit Union Administration regulations on making copies of appraisal reports available is not subject to these 

requirements (202.14(b)).
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 37

Yes No Basis of Conclusion

65. With respect to applications for credit to be secured by a lien 

on a dwelling, does the creditor either:

a. Routinely provide a copy of an appraisal report to an 

applicant (whether credit is granted or denied or the 

application is withdrawn); or

b. Provide a copy upon an applicant’s written request and 

notify (at any time during the application process and 

no later than when the creditor provides notice of 

action taken) an applicant in writing of the right to 

receive a copy of the appraisal report, specifying (i) 

that the applicant’s request must be in writing, (ii) the 

creditor’s mailing address, and (iii) that the request 

must be received within 90 days after the creditor 

provides notice of action taken on the application or 90 

days after the application is withdrawn? (202.14(a))

 [Click&type]

66. Does the creditor mail or deliver a copy of the appraisal report 

promptly (generally within 30 days) after the creditor receives 

the applicant’s request, receives the report, or receives 

reimbursement from the applicant for the report, whichever is 

last to occur? (202.14(a)(2)(ii))

 [Click&type]

Disclosures

Obtain and review policies and procedures, training materials, and a 

sample of loan files, audits related to disclosures, and disclosures. 

67. Are the creditor’s written disclosures that are required by 

Regulation B clear, conspicuous, and except for those required 

by Sections 202.5 (self-tests) and 202.13 (monitoring), in a 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 38

Yes No Basis of Conclusion

form the applicant can retain? (202.4(d))

68. Are those disclosures that are required to be in writing that are 

made in electronic form provided in compliance with the 

consumer consent and other applicable provisions of the 

Electronic Signatures in Global and National Commerce (ESign) Act, where applicable? (202.4(d)(2)) 

 [Click&type]

69. If an applicant accesses a credit application electronically from 

a place other than the creditor’s office, did the creditor provide 

the disclosures in a timely manner on or with the application, 

namely in electronic form (such as with the applications form 

on its website)? (Comment 202.4(d)-2)

 [Click&type]

Voluntary Self-Tests

Identify whether the creditor purports to conduct self-tests. If so, 

request and review information required to be maintained under 

Section 202.12(b)(6), including but not limited to information 

regarding its design and expected outputs, corrective actions, the 

methodology used or the scope of the self-test, the time period covered 

by the self-test, the dates it was conducted, and entities to whom it was 

disclosed.
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 39

Yes No Basis of Conclusion

70. To the extent the creditor conducts voluntary self-tests:

a. Is the program, practice or study (1) designed and used 

specifically to determine the extent or effectiveness of 

the creditor’s compliance with the ECOA or 

Regulation B; and (2) resulting in data or factual 

information that is not available and cannot be derived 

from loan or application files or other records related to 

credit transactions; and

 [Click&type]

b. Has the creditor taken or is it taking appropriate and 

timely corrective action when the self-test shows that it 

is more likely than not that a violation occurred (even 

though no violation has been formally adjudicated), 

namely action that is reasonably likely to remedy the 

cause and effect of a likely violation by identifying the 

policies and practices that are the likely cause of the 

violation and assessing the extent and scope of any 

violation? (202.15(a)(2), (b)(1), (c), Comment 

202.15(a)(2)-2)

 [Click&type]

71. To the extent the creditor is claiming that the self-test privilege 

applies:

a. Is the creditor providing information that is not 

privileged, including (a) information about whether the 

creditor conducted a self-test, the methodology used or 

the scope of the self-test, the time period covered by 

the self-test, or the dates it was conducted; (b) loan and 

application files or other business records related to 

credit transactions, and information derived from such 

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 40

Yes No Basis of Conclusion

files and records, even if the information has been 

aggregated, summarized, or reorganized to facilitate 

analysis; and (c) the creditor’s property appraisal 

reports, minutes of loan committee meetings, analysis 

performed as part of processing or underwriting a 

credit application, or other documents reflecting the 

basis for a decision to approve or deny an application, 

loan policies or procedures, underwriting standards, 

and broker compensation records? (202.15(b)(3), 

Comments 202.15(b)(1)(ii)-2, 202.15(b)(3)(ii)-1)

b. Has the creditor not voluntarily disclosed any part of 

the report or results, or any other privileged 

information, as a self test, to an applicant, government 

agency, or the public? (202.15(d)(2)(i))

 [Click&type]

c. Has the creditor not disclosed any part of the report or 

results, or any other information privileged as a selftest, as a defense to charges that the creditor has 

violated the ECOA or Regulation B? (202.15(d)(2)(ii))

 [Click&type]

d. Has the creditor produced written or recorded 

information about the self-test that is required to be 

retained by Section 202.12(b)(6)? (202.15(d)(2)(iii))

 [Click&type]

e. As applicable, has the creditor provided the self-test 

report, results, and any other information privileged 

under Regulation B in order to determine a penalty or 

remedy for a violation of the ECOA or Regulation that 

has been adjudicated or admitted? (202.15(d)(3))

 [Click&type]
CFPB Consumer Laws ECOA

and Regulations Examination Procedures

CFPB FFEIC Draft 08/26/2011 ECOA 41

EXAMINER’S OVERALL SUMMARY, RECOMMENDATIONS, AND COMMENTS 

[Click&type]
__________________________________________________________________

Office of the Comptroller of the Currency

Federal Deposit Insurance Corporation

Federal Reserve Board

Office of Thrift Supervision

National Credit Union Administration

__________________________________________________________________

INTERAGENCY FAIR LENDING 

EXAMINATION PROCEDURES

August 2009
CONTENTS

INTRODUCTION 1

PART I: EXAMINATION SCOPE GUIDELINES 6

Background 6

Step One: Develop an Overview 10

Step Two: Identify Compliance Program Discrimination Risk Factors 11

Step Three: Review Residential Loan Products 11

Step Four: Identify Residential Lending Discrimination Risk Factors 12

Step Five: Organize and Focus Residential Risk Analysis 16

Step Six: Identify Consumer Lending Discrimination Risk Factors 17

Step Seven: Identify Commercial Lending Discrimination Risk Factors 17

Step Eight: Complete the Scoping Process 18

PART II: COMPLIANCE MANAGEMENT REVIEW 19

PART III: EXAMINATION PROCEDURES 20

A. Verify Accuracy of Data 20

B. Documenting Overt Evidence of Disparate Treatment 20

C. Transactional Underwriting Analysis - Residential and Consumer Loans. 21

D. Analyzing Potential Disparities in Pricing and Other Terms and Conditions 24

E. Steering Analysis 26

F. Transactional Underwriting Analysis - Commercial Loans. 29

G. Analysis of Potential Discriminatory “Redlining”. 31

H. Analysis of Potential Discriminatory Marketing Practices. 40

I. Credit Scoring. 41

J. Disparate Impact Issues. 41

PART IV: OBTAINING AND EVALUATING RESPONSES 

FROM THE INSTITUTION AND CONCLUDING THE EXAMINATION 42

APPENDIX

I. Compliance Management Analysis Checklist

II. Considering Automated Underwriting and Credit Scoring 

III. Evaluating Responses to Evidence of Disparate Treatment

IV. Fair Lending Sample Size Tables

V. Identifying Marginal Transactions

VI. Potential Scoping Information

VII. Special Analyses

VIII. Using Self-Tests and Self-Evaluations to Streamline the Examination
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 1

INTRODUCTION

Overview of Fair Lending Laws 

and Regulations

This overview provides a basic and abbreviated 

discussion of federal fair lending laws and regulations. It is adapted from the Interagency Policy 

Statement on Fair Lending issued in March 1994. 

1. Lending Discrimination Statutes and Regulations

The Equal Credit Opportunity Act (ECOA) prohibits discrimination in any aspect of a credit 

transaction. It applies to any extension of credit, including extensions of credit to small 

businesses, corporations, partnerships, and trusts.

The ECOA prohibits discrimination based on:

• Race or color

• Religion

• National origin

• Sex

• Marital status

• Age (provided the applicant has the capacity to contract)

• The applicant’s receipt of income derived from any public assistance program

• The applicant’s exercise, in good faith, of any right under the Consumer Credit Protection 

Act

The Federal Reserve Board’s Regulation B, found at 12 CFR part 202, implements the 

ECOA. Regulation B describes lending acts and practices that are specifically prohibited, 

permitted, or required. Official staff interpretations of the regulation are found in Supplement 

I to 12 CFR part 202.

The Fair Housing Act (FHAct) prohibits discrimination in all aspects of "residential real-estaterelated transactions," including but not limited to:

• Making loans to buy, build, repair, or improve a dwelling 

• Purchasing real estate loans

• Selling, brokering, or appraising residential real estate

• Selling or renting a dwelling

The FHAct prohibits discrimination based on:

• Race or color

• National origin

• Religion

• Sex

• Familial status (defined as children under the age of 18 living with a parent or legal 

custodian, pregnant women, and people securing custody of children under 18)

• Handicap

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 2

HUD’s regulations implementing the FHAct are found at 24 CFR Part 100. Because both the 

FHAct and the ECOA apply to mortgage lending, lenders may not discriminate in mortgage 

lending based on any of the prohibited factors in either list.

Under the ECOA, it is unlawful for a lender to discriminate on a prohibited basis in any aspect of 

a credit transaction, and under both the ECOA and the FHAct, it is unlawful for a lender to 

discriminate on a prohibited basis in a residential real-estate-related transaction. Under one or 

both of these laws, a lender may not, because of a prohibited factor

• Fail to provide information or services or provide different information or services regarding 

any aspect of the lending process, including credit availability, application procedures, or 

lending standards;

• Discourage or selectively encourage applicants with respect to inquiries about or applications 

for credit;

• Refuse to extend credit or use different standards in determining whether to extend credit;

• Vary the terms of credit offered, including the amount, interest rate, duration, or type of loan;

• Use different standards to evaluate collateral;

• Treat a borrower differently in servicing a loan or invoking default remedies; or

• Use different standards for pooling or packaging a loan in the secondary market.

A lender may not express, orally or in writing, a preference based on prohibited factors or 

indicate that it will treat applicants differently on a prohibited basis. A violation may still exist 

even if a lender treated applicants equally.

A lender may not discriminate on a prohibited basis because of the characteristics of

• An applicant, prospective applicant, or borrower;

• A person associated with an applicant, prospective applicant, or borrower (for example, a coapplicant, spouse, business partner, or live-in aide); or

• The present or prospective occupants of either the property to be financed or the 

characteristics of the neighborhood or other area where property to be financed is located.

Finally, the FHAct requires lenders to make reasonable accommodations for a person with 

disabilities when such accommodations are necessary to afford the person an equal opportunity 

to apply for credit.

2. Types of Lending Discrimination

The courts have recognized three methods of proof of lending discrimination under the ECOA 

and the FHAct:

• Overt evidence of disparate treatment

• Comparative evidence of disparate treatment

• Evidence of disparate impact
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 3

Disparate Treatment

The existence of illegal disparate treatment may be established either by statements revealing 

that a lender explicitly considered prohibited factors (overt evidence) or by differences in 

treatment that are not fully explained by legitimate nondiscriminatory factors (comparative

evidence).

Overt Evidence of Disparate Treatment. There is overt evidence of discrimination when a lender 

openly discriminates on a prohibited basis.

Example: A lender offered a credit card with a limit of up to $750 for applicants aged 21-

30 and $1,500 for applicants over 30. This policy violated the ECOA’s prohibition on 

discrimination based on age.

There is overt evidence of discrimination even when a lender expresses - but does not act on - a 

discriminatory preference:

Example: A lending officer told a customer, “We do not like to make home mortgages to 

Native Americans, but the law says we cannot discriminate and we have to comply with 

the law.” This statement violated the FHAct’s prohibition on statements expressing a 

discriminatory preference as well as Section 202.4(b) of Regulation B, which prohibits 

discouraging applicants on a prohibited basis.

Comparative Evidence of Disparate Treatment. Disparate treatment occurs when a lender treats a 

credit applicant differently based on one of the prohibited bases. It does not require any showing 

that the treatment was motivated by prejudice or a conscious intention to discriminate against a 

person beyond the difference in treatment itself. 

Disparate treatment may more likely occur in the treatment of applicants who are neither clearly 

well-qualified nor clearly unqualified. Discrimination may more readily affect applicants in this 

middle group for two reasons. First, if the applications are “close cases,” there is more room and 

need for lender discretion. Second, whether or not an applicant qualifies may depend on the 

level of assistance the lender provides the applicant in completing an application. The lender 

may, for example, propose solutions to credit or other problems regarding an application, 

identify compensating factors, and provide encouragement to the applicant. Lenders are under no 

obligation to provide such assistance, but to the extent that they do, the assistance must be 

provided in a nondiscriminatory way.

Example: A non-minority couple applied for an automobile loan. The lender found 

adverse information in the couple’s credit report. The lender discussed the credit report 

with them and determined that the adverse information, a judgment against the couple, 

was incorrect because the judgment had been vacated. The non-minority couple was 

granted their loan. A minority couple applied for a similar loan with the same lender. 

Upon discovering adverse information in the minority couple’s credit report, the lender 

denied the loan application on the basis of the adverse information without giving the 

couple an opportunity to discuss the report.

The foregoing is an example of disparate treatment of similarly situated applicants, apparently 

based on a prohibited factor, in the amount of assistance and information the lender provided. 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 4

If a lender has apparently treated similar applicants differently on the basis of a prohibited factor, 

it must provide an explanation for the difference in treatment. If the lender's explanation is found 

to be not credible, the agency may find that the lender discriminated.

Redlining is a form of illegal disparate treatment in which a lender provides unequal access to 

credit, or unequal terms of credit, because of the race, color, national origin, or other prohibited 

characteristic(s) of the residents of the area in which the credit seeker resides or will reside or in 

which the residential property to be mortgaged is located. Redlining may violate both the FHAct 

and the ECOA.

Disparate Impact 

When a lender applies a racially or otherwise neutral policy or practice equally to all credit 

applicants, but the policy or practice disproportionately excludes or burdens certain persons on a 

prohibited basis, the policy or practice is described as having a “disparate impact.”

Example: A lender’s policy is not to extend loans for single family residences for less 

than $60,000. This policy has been in effect for ten years. This minimum loan amount 

policy is shown to disproportionately exclude potential minority applicants from 

consideration because of their income levels or the value of the houses in the areas in 

which they live.

The fact that a policy or practice creates a disparity on a prohibited basis is not alone proof of a 

violation. When an Agency finds that a lender’s policy or practice has a disparate impact, the 

next step is to seek to determine whether the policy or practice is justified by “business 

necessity.” The justification must be manifest and may not be hypothetical or speculative. 

Factors that may be relevant to the justification could include cost and profitability. Even if a 

policy or practice that has a disparate impact on a prohibited basis can be justified by business 

necessity, it still may be found to be in violation if an alternative policy or practice could serve 

the same purpose with less discriminatory effect. Finally, evidence of discriminatory intent is 

not necessary to establish that a lender's adoption or implementation of a policy or practice that 

has a disparate impact is in violation of the FHAct or ECOA.

These procedures do not call for examiners to plan examinations to identify or focus on potential 

disparate impact issues. The guidance in this Introduction is intended to help examiners 

recognize fair lending issues that may have a potential disparate impact. Guidance in the 

Appendix to the Interagency Fair Lending Examination Procedures provides details on how to 

obtain relevant information regarding such situations along with methods of evaluation, as 

appropriate.

General Guidelines

These procedures are intended to be a basic and flexible framework to be used in the majority of 

fair lending examinations conducted by the FFIEC agencies. They are also intended to guide 

examiner judgment, not to supplant it. The procedures can be augmented by each agency as 

necessary to ensure their effective implementation. 

While these procedures apply to many examinations, agencies routinely use statistical analyses 

or other specialized techniques in fair lending examinations to assist in evaluating whether a 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 5

prohibited basis was a factor in an institution’s credit decisions. Examiners should follow the 

procedures provided by their respective agencies in these cases.

For a number of aspects of lending – for example, credit scoring and loan pricing – the “state of 

the art” is more likely to be advanced if the agencies have some latitude to incorporate promising 

innovations. These interagency procedures provide for that latitude.

Any references in these procedures to options, judgment, etc., of “examiners” means discretion 

within the limits provided by that examiner’s agency. An examiner should use these procedures 

in conjunction with his or her own agency’s priorities, examination philosophy, and detailed 

guidance for implementing these procedures. These procedures should not be interpreted as 

providing an examiner greater latitude than his or her own agency would. For example, if an 

agency’s policy is to review compliance management systems in all of its institutions, an 

examiner for that agency must conduct such a review rather than interpret Part II of these 

interagency procedures as leaving the review to the examiner’s option.

The procedures emphasize racial and national origin discrimination in residential transactions, 

but the key principles are applicable to other prohibited bases and to nonresidential transactions.

Finally, these procedures focus on analyzing institution compliance with the broad, 

nondiscrimination requirements of the ECOA and the FHAct. They do not address such explicit 

or technical compliance provisions as the signature rules or adverse action notice requirements in 

Sections 202.7 and 202.9, respectively, of Regulation B.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 6

PART I

EXAMINATION SCOPE GUIDELINES

Background

The scope of an examination encompasses the loan product(s), market(s), decision center(s), 

time frame, and prohibited basis and control group(s) to be analyzed during the examination. 

These procedures refer to each potential combination of those elements as a "focal point." Setting 

the scope of an examination involves, first, identifying all of the potential focal points that 

appear worthwhile to examine. Then, from among those, examiners select the focal point(s) that 

will form the scope of the examination, based on risk factors, priorities established in these 

procedures or by their respective agencies, the record from past examinations, and other relevant 

guidance. This phase includes obtaining an overview of an institution’s compliance management 

system as it relates to fair lending.

When selecting focal points for review, examiners may determine that the institution has 

performed “self-tests” or “self-evaluations” related to specific lending products. The difference 

between “self-tests” and “self-evaluations” is discussed in the Using Self-Tests and SelfEvaluations to Streamline the Examination section of the Appendix. Institutions must share all 

information regarding “self-evaluations” and certain limited information related to “self-tests.” 

Institutions may choose to voluntarily disclose additional information about “self-tests.” 

Examiners should make sure that institutions understand that voluntarily sharing the results of 

self-tests will result in a loss of confidential status of these tests. Information from “selfevaluations” or “self-tests” may allow the scoping to be streamlined. Refer to Using Self-Tests 

and Self-Evaluations to Streamline the Examination in the Appendix for additional details. 

Scoping may disclose the existence of circumstances – such as the use of credit scoring or a large 

volume of residential lending – which, under an agency's policy, call for the use of regression 

analysis or other statistical methods of identifying potential discrimination with respect to one or 

more loan products. Where that is the case, the agency’s specialized procedures should be 

employed for such loan products rather than the procedures set forth below.

Setting the intensity of an examination means determining the breadth and depth of the analysis 

that will be conducted on the selected loan product(s). This process entails a more involved 

analysis of the institution’s compliance risk management processes, particularly as they relate to 

selected products, to reach an informed decision regarding how large a sample of files to review 

in any transactional analyses performed and whether certain aspects of the credit process deserve 

heightened scrutiny.

Part I of these procedures provides guidance on establishing the scope of the examination. Part II 

(Compliance Management Review) provides guidance on determining the intensity of the 

examination. There is naturally some interdependence between these two phases. Ultimately, the 

scope and intensity of the examination will determine the record of performance that serves as 

the foundation for agency conclusions about institutional compliance with fair lending 

obligations. The examiner should employ these procedures to arrive at a well-reasoned and 

practical conclusion about how to conduct a particular institution’s examination of fair lending 

performance. 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 7

In certain cases where an agency already possesses information that provides examiners with 

guidance on priorities and risks for planning an upcoming examination, such information may 

expedite the scoping process and make it unnecessary to carry out all of the steps below. For 

example, the report of the previous fair lending examination may have included 

recommendations for the focus of the next examination. However, examiners should validate 

that the institution’s operational structure, product offerings, policies, and risks have not changed 

since the prior examination before condensing the scoping process.

The scoping process can be performed either off-site, onsite, or both, depending on whatever is 

determined appropriate and feasible. In the interest of minimizing burdens on both the 

examination team and the institution, requests for information from the institution should be 

carefully thought out so as to include only the information that will clearly be useful in the 

examination process. Finally, any off-site information requests should be made sufficiently in 

advance of the on-site schedule to permit institutions adequate time to assemble necessary 

information and provide it to the examination team in a timely fashion. (See "Potential Scoping 

Information" in the Appendix for guidance on additional information that the examiner might 

wish to consider including in a request).

Examiners should focus the examination based on:

• An understanding of the credit operations of the institution,

• The risk that discriminatory conduct may occur in each area of those operations, and

• The feasibility of developing a factually reliable record of an institution's performance and 

fair lending compliance in each area of those operations.

1. Understanding Credit Operations

Before evaluating the potential for discriminatory conduct, the examiner should review sufficient 

information about the institution and its market to understand the credit operations of the 

institution and the representation of prohibited basis group residents within the markets where 

the institution does business. The level of detail to be obtained at this stage should be sufficient 

to identify whether any of the risk factors in the steps below are present. Relevant background 

information includes:

• The types and terms of credit products offered, differentiating among broad categories of 

credit such as residential, consumer, or commercial, as well as product variations within such 

categories (fixed vs. variable, etc.);

• Whether the institution has a special purpose credit program or other program that is 

specifically designed to assist certain under-served populations;

• The volume of, or growth in, lending for each of the credit products offered;

• The demographics (e.g., race, national origin, etc.) of the credit markets in which the 

institution is doing business;

• The institution’s organization of its credit decision-making process, including identification 

of the delegation of separate lending authorities and the extent to which discretion in pricing 

or setting credit terms and conditions is delegated to various levels of managers, employees 

or independent brokers or dealers;

• The institution’s loan officer or broker compensation program;
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 8

• The types of relevant documentation/data that are available for various loan products and 

what is the relative quantity, quality and accessibility of such information (e.g., for which 

loan product(s) will the information available be most likely to support a sound and reliable 

fair lending analysis); and

• The extent to which information requests can be readily organized and coordinated with 

other compliance examination components to reduce undue burden on the institution. (Do not 

request more information than the exam team can be expected to utilize during the 

anticipated course of the examination.)

In thinking about an institution’s credit markets, the examiner should recognize that these

markets may or may not coincide with an institution’s Community Reinvestment Act (CRA) 

assessment area(s). Where appropriate, the examiner should review the demographics for a 

broader geographic area than the assessment area.

Where an institution has multiple underwriting or loan processing centers or subsidiaries, each 

with fully independent credit-granting authority, consider evaluating each center and/or 

subsidiary separately, provided a sufficient number of loans exist to support a meaningful 

analysis. In determining the scope of the examination for such institutions, examiners should 

consider whether:

• Subsidiaries should be examined. The agencies will hold a financial institution responsible 

for violations by its direct subsidiaries, but not typically for those by its affiliates (unless the 

affiliate has acted as the agent for the institution or the violation by the affiliate was known 

or should have been known to the institution before it became involved in the transaction or 

purchased the affiliate’s loans). When seeking to determine an institution’s relationship with 

affiliates that are not supervised financial institutions, limit the inquiry to what can be learned 

in the institution and do not contact the affiliate without prior consultation with agency staff.

• The underwriting standards and procedures used in the entity being reviewed are used in 

related entities not scheduled for the planned examination. This will help examiners to 

recognize the potential scope of policy-based violations.

• The portfolio consists of applications from a purchased institution. If so, for scoping 

purposes, examiners should consider the applications as if they were made to the purchasing 

institution. For comparison purposes, applications evaluated under the purchased

institution’s standards should not be compared to applications evaluated under the 

purchasing institution’s standards.)

• The portfolio includes purchased loans. If so, examiners should look for indications that the 

institution specified loans to purchase based on a prohibited factor or caused a prohibited 

factor to influence the origination process.

• A complete decision can be made at one of the several underwriting or loan- processing 

centers, each with independent authority. In such a situation, it is best to conduct on-site a 

separate comparative analysis at each underwriting center. If covering multiple centers is not 

feasible during the planned examination, examiners should review their processes and 

internal controls to determine whether or not expanding the scope and/or length of the 

examination is justified.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 9

• Decision-making responsibility for a single transaction may involve more than one 

underwriting center. For example, an institution may have authority to decline mortgage 

applicants, but only the mortgage company subsidiary may approve them. In such a 

situation, examiners should learn which standards are applied in each entity and the location 

of records needed for the planned comparisons.

• Applicants can be steered from the financial institution to the subsidiary or other lending 

channel and vice versa and what policies and procedures exist to monitor this practice. 

• Any third parties, such as brokers or contractors, are involved in the credit decision and how 

responsibility is allocated among them and the institution. The institution’s familiarity with 

third-party actions may be important, for an institution may be in violation if it participates in 

transactions in which it knew or reasonably ought to have known other parties were 

discriminating.

As part of understanding the financial institution’s own lending operations, it is also important to 

understand any dealings the financial institution has with affiliated and non-affiliated mortgage 

loan brokers and other third-party lenders.

These brokers may generate mortgage applications and originations solely for a specific financial 

institution or may broadly gather loan applications for a variety of local, regional, or national 

lenders. As a result, it is important to recognize what impact these mortgage brokers and other 

third-party lender actions and application processing operations have on the lending operations 

of a financial institution. Because brokers can be located anywhere in or out of the financial 

institution’s primary lending or CRA assessment areas, it is important to evaluate broker activity 

and fair lending compliance related to underwriting, terms and conditions, redlining, and 

steering, each of which is covered in more depth in sections of these procedures. Examiners 

should consult with their respective agencies for specific guidance regarding broker activity.

If the institution is large and geographically diverse, examiners should select only as many 

markets or underwriting centers as can be reviewed readily in depth, rather than selecting 

proportionally to cover every market. As needed, examiners should narrow the focus to the 

Metropolitan Statistical Area (MSA) or underwriting center(s) that are determined to present the 

highest discrimination risk. Examiners should use Loan Application Register (LAR) data 

organized by underwriting center, if available. After calculating denial rates between the control 

and prohibited basis groups for the underwriting centers, examiners should select the centers 

with the highest fair lending risk. This approach would also be used when reviewing pricing or 

other terms and conditions of approved applicants from the prohibited basis and control groups. 

If underwriting centers have fewer than five racial or national origin denials, examiners should 

not examine for racial discrimination in underwriting. Instead, they should shift the focus to 

other loan products or prohibited bases or examination types, such as a pricing examination.

However, if examiners learn of other indications of risks that favor analyzing a prohibited basis 

with fewer transactions than the minimum in the sample-size tables, they should consult with 

their supervisory office on possible alternative methods of analysis. For example, there is strong 

reason to examine a pattern in which almost all of 19 male borrowers received low rates, but 

almost all of four female borrowers received high rates, even though the number of each group is 

fewer than the stated minimum. Similarly, there would be strong reason to examine a pattern in 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 10

which almost all of 100 control group applicants were approved, but all four prohibited basis 

group applicants were not, even though the number of prohibited basis denials was fewer than 

five. 

2. Evaluating the Potential for Discriminatory Conduct

Step One: Develop an Overview

Based on his or her understanding of the credit operations and product offerings of an institution, 

an examiner should determine the nature and amount of information required for the scoping 

process and should obtain and organize that information. No single examination can reasonably 

be expected to evaluate compliance performance as to every prohibited basis, in every product, 

or in every underwriting center or subsidiary of an institution. In addition to information gained 

in the process of Understanding Credit Operations, above, the examiner should keep in mind the 

following factors when selecting products for the scoping review:

• Which products and prohibited bases were reviewed during the most recent prior 

examination(s), and conversely, which products and prohibited bases have not recently been 

reviewed?

• Which prohibited basis groups make up a significant portion of the institution’s market for 

the different credit products offered?

• Which products and prohibited basis groups the institution reviewed using either a 

voluntarily disclosed self-test or a self-evaluation?

Based on consideration of the foregoing factors, the examiner should request information for all 

residential and other loan products considered appropriate for scoping in the current examination 

cycle. In addition, wherever feasible, examiners should conduct preliminary interviews with the 

institution’s key underwriting personnel and those involved with establishing the institution’s 

pricing policies and practices. 

Using the accumulated information, the examiner should evaluate the following, as applicable:

• Underwriting guidelines, policies, and standards,

• Descriptions of credit scoring systems, including a list of factors scored, cutoff scores, extent 

of validation, and any guidance for handling overrides and exceptions. (Refer to Part A of the 

Considering Automated Underwriting and Credit Scoring section of the Appendix for 

guidance),

• Applicable pricing policies, risk-based pricing models, and guidance for exercising discretion 

over loan terms and conditions;

• Descriptions of any compensation system, including whether compensation is related to loan 

production or pricing;

• The institution’s formal and informal relationships with any finance companies, subprime

mortgage or consumer lending entities, or similar institutions

• Loan application forms;

• Home Mortgage Disclosure Act – Loan Application Register (HMDA-LAR) or loan registers 

and lists of declined applications;

• Description(s) of databases maintained for loan product(s) to be reviewed;

• Records detailing policy exceptions or overrides, exception reporting, and monitoring 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 11

processes;

• Copies of any consumer complaints alleging discrimination and related loan files;

• Compliance program materials (particularly fair lending policies), training manuals, 

organization charts, as well as record keeping, monitoring protocols, and internal controls; 

and

• Copies of any available marketing materials or descriptions of current or previous marketing 

plans or programs or pre-screened solicitations. 

Step Two: Identify Compliance Program Discrimination Risk Factors 

Review information from agency examination work papers, institutional records, and any 

available discussions with management representatives in sufficient detail to understand the 

organization, staffing, training, recordkeeping, auditing, policies, and procedures of the 

institution’s fair lending compliance systems. Review these systems and note the following risk 

factors:

C1. Overall institution compliance record is weak.

C2. Prohibited basis monitoring information required by applicable laws and 

regulations is nonexistent or incomplete.

C3. Data and/or recordkeeping problems compromised reliability of previous 

examination reviews.

C4. Fair lending problems were previously found in one or more institution products 

or in institution subsidiaries.

C5. The size, scope, and quality of the compliance management program, including 

senior management’s involvement, designation of a compliance officer, and 

staffing is materially inferior to programs customarily found in institutions of 

similar size, market demographics, and credit complexity.

C6. The institution has not updated compliance policies and procedures to reflect 

changes in law or in agency guidance.

C7. Fair lending training is nonexistent or weak.

Consider these risk factors and their impact on particular lending products and practices as you 

conduct the product specific risk review during the scoping steps that follow. Where this review 

identifies fair lending compliance system deficiencies, give them appropriate consideration as 

part of the Compliance Management Review in Part II of these procedures.

Step Three: Review Residential Loan Products

Although home mortgages may not be the ultimate subject of every fair lending examination, 

this product line must at least be considered in the course of scoping every institution that is 

engaged in the residential lending market.

Divide home mortgage loans into the following groupings: home purchase, home improvement, 

and refinancings. Subdivide those three groups further if an institution does a significant number 

of any of the following types or forms of residential lending and consider them separately:

• Government-insured loans
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 12

• Mobile home or manufactured housing loans

• Wholesale, indirect, and brokered loans

• Portfolio lending (including portfolios of Fannie Mae/Freddie Mac rejections)

In addition, determine whether the institution offers any conventional “affordable” housing loan 

programs special purpose credit programs or other programs that are specifically designed to 

assist certain borrowers, such as under-served populations and whether their terms and 

conditions make them incompatible with regular conventional loans for comparative purposes. 

If so, consider them separately.

If previous examinations have demonstrated the following, then an examiner may limit the focus 

of the current examination to alternative underwriting or processing centers or to other 

residential products that have received less scrutiny in the past:

• A strong fair lending compliance program;

• No record of discriminatory transactions at particular decision centers or in particular 

residential products;

• No indication of a significant change in personnel, operations or underwriting or pricing 

policies at those centers or in those residential products;

• No unresolved fair lending complaints, administrative proceedings, litigation or similar 

factors; or

• No discretion to set price or credit terms and conditions in particular decision centers or for 

particular residential products. 

Step Four: Identify Residential Lending Discrimination Risk Factors

• Review the lending policies, marketing plans, underwriting, appraisal and pricing guidelines, 

broker/agent agreements, and loan application forms for each residential loan product that 

represents an appreciable volume of, or displays noticeable growth in, the institution’s 

residential lending. 

• Review also any available data regarding the geographic distribution of the institution’s loan 

originations with respect to the race and national origin percentages of the census tracts 

within its assessment area or, if different, its residential loan product lending area(s). 

• Conduct interviews of loan officers and other employees or agents in the residential lending 

process concerning adherence to and understanding of the above policies and guidelines as 

well as any relevant operating practices. 

• In the course of conducting the foregoing inquiries, look for the following risk factors 

(factors are numbered alphanumerically to coincide with the type of factor, e.g., "O" for 

"overt"; "P" for "pricing", etc.).

NOTE: For risk factors below that are marked with an asterisk (*), examiners need not attempt to 

calculate the indicated ratios for racial or national origin characteristics when the institution is 

not an HMDA reporter. However, consideration should be given in such cases to whether or not 

such calculations should be made based on gender or racial-ethnic surrogates. 

Overt indicators of discrimination such as:

O1. Including explicit prohibited basis identifiers in the institution’s written or oral 

policies and procedures (underwriting criteria, pricing standards, etc.).
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 13

O2. Collecting information, conducting inquiries or imposing conditions contrary to 

express requirements of Regulation B.

O3. Including variables in a credit scoring system that constitute a basis or factor 

prohibited by Regulation B or, for residential loan scoring systems, the FHAct. (If a 

credit scoring system scores age, refer to Part E of the Considering Automated 

Underwriting and Credit Scoring section of the Appendix.).

O4. Statements made by the institution’s officers, employees, or agents that constitute an 

express or implicit indication that one or more such persons have engaged or do engage 

in discrimination on a prohibited basis in any aspect of a credit transaction.

O5. Employee or institutional statements that evidence attitudes based on prohibited 

basis prejudices or stereotypes. 

Indicators of potential disparate treatment in Underwriting such as:

U1. *Substantial disparities among the approval/denial rates for applicants by monitored 

prohibited basis characteristic (especially within income categories).

U2. *Substantial disparities among the application processing times for applicants by 

monitored prohibited basis characteristic (especially within denial reason groups).

U3. *Substantially higher proportion of withdrawn/incomplete applications from 

prohibited basis group applicants than from other applicants.

U4. Vague or unduly subjective underwriting criteria.

U5. Lack of clear guidance on making exceptions to underwriting criteria, including 

credit scoring overrides.

U6. Lack of clear loan file documentation regarding reasons for any exceptions to 

standard underwriting criteria, including credit scoring overrides.

U7. Relatively high percentages of either exceptions to underwriting criteria or overrides 

of credit score cutoffs.

U8. Loan officer or broker compensation based on loan volume (especially loans 

approved per period of time).

U9. Consumer complaints alleging discrimination in loan processing or in 

approving/denying residential loans.

Indicators of potential disparate treatment in Pricing (interest rates, fees, or points) such as:

P1. Financial incentives for loan officers or brokers to charge higher prices (including 

interest rates, fees, and points). Special attention should be given to situations where 

financial incentives are accompanied by broad pricing discretion (as in P2), such as 

through the use of overages or yield-spread premiums.

P2. Presence of broad discretion in loan pricing (including interest rate, fees, and points), 

such as through overages, underages, or yield-spread premiums. Such discretion may be 

present even when institutions provide rate sheets and fees schedules if loan officers or 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 14

brokers are permitted to deviate from those rates and fees without clear and objective 

criteria.

P3. Use of risk-based pricing that is not based on objective criteria or applied 

consistently.

P4. *Substantial disparities among prices being quoted or charged to applicants who 

differ as to their monitored prohibited basis characteristics.

P5. Consumer complaints alleging discrimination in residential loan pricing.

P6. *In mortgage pricing, disparities in the incidence or rate spreads1 of higher-priced 

lending by prohibited basis characteristics as reported in the HMDA data.

P7. *A loan program that contains only borrowers from a prohibited basis group or has 

significant differences in the percentages of prohibited basis groups, especially in the 

absence of a Special Purpose Credit Program under ECOA.

Indicators of potential disparate treatment by Steering such as:

S1. Lack of clear, objective, and consistently implemented standards for (i) referring 

applicants to subsidiaries, affiliates, or lending channels within the institution (ii) 

classifying applicants as “prime” or “sub-prime” borrowers or (iii) deciding what kinds of 

alternative loan products should be offered or recommended to applicants (product 

placement).

S2. Financial incentives for loan officers or brokers to place applicants in nontraditional 

products (e.g., negative amortization, “interest only”, “payment option” adjustable rate 

mortgages) or higher cost products. 

S3. For an institution that offers different products based on credit risk levels, any 

significant differences in percentages of prohibited basis groups in each of the alternative 

loan product categories.

S4. *Significant differences in the percentage of prohibited basis applicants in loan 

products or products with specific features relative to control group applicants. Special 

attention should be given to products and features that have potentially negative 

consequences for applicants (e.g., non-traditional mortgages, prepayment penalties, lack 

of escrow requirements, or credit life insurance).

S5. *For an institution that has one or more sub-prime mortgage subsidiaries or affiliates, 

any significant differences, by loan product, in the percentage of prohibited basis 

applicants of the institution compared to the percentage of prohibited basis applicants of 

the subsidiary(ies) or affiliate(s).

S6. *For an institution that has one or more lending channels that originate the same loan 

product, any significant differences in the percentage of prohibited basis applicants in one 

of the lending channels compared to the percentage of prohibited basis applicants of the 

other lending channel.

 1 Regulation C, Section 203.4(a)(12).
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 15

S7. Consumer complaints alleging discrimination in residential loan pricing or product 

placement.

S8. *For an institution with sub-prime mortgage subsidiaries, a concentration of those 

subsidiaries’ branches in minority areas relative to its other branches.

Indicators of potential discriminatory Redlining such as:

R1. *Significant differences, as revealed in HMDA data, in the number of applications 

received, withdrawn, approved not accepted, and closed for incompleteness or loans 

originated in those areas in the institution's market that have relatively high 

concentrations of minority group residents compared with areas with relatively low 

concentrations of minority residents.

R2. *Significant differences between approval/denial rates for all applicants (minority 

and non-minority) in areas with relatively high concentrations of minority group residents 

compared with areas with relatively low concentrations of minority residents.

R3. *Significant differences between denial rates based on insufficient collateral for 

applicants from areas with relatively high concentrations of minority residents and those 

areas with relatively low concentrations of minority residents.

R4. * Significant differences in the number of originations of higher-priced loans or loans 

with potentially negative consequences for borrowers, (e.g., non-traditional mortgages, 

prepayment penalties, lack of escrow requirements) in areas with relatively high 

concentrations of minority residents compared with areas with relatively low 

concentrations of minority residents.

R5. Other patterns of lending identified during the most recent CRA examination that 

differ by the concentration of minority residents.

R6. Explicit demarcation of credit product markets that excludes MSAs, political 

subdivisions, census tracts, or other geographic areas within the institution's lending 

market or CRA assessment areas and having relatively high concentrations of minority 

residents.

R7. Difference in services available or hours of operation at branch offices located in 

areas with concentrations of minority residents when compared to branch offices located 

in areas with concentrations of non-minority residents.

R8. Policies on receipt and processing of applications, pricing, conditions, or appraisals 

and valuation, or on any other aspect of providing residential credit that vary between 

areas with relatively high concentrations of minority residents and those areas with 

relatively low concentrations of minority residents.

R9. The institution’s CRA assessment area appears to have been drawn to exclude areas 

with relatively high concentrations of minority residents. 

R10. Employee statements that reflect an aversion to doing business in areas with 

relatively high concentrations of minority residents.

R11. Complaints or other allegations by consumers or community representatives that 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 16

the institution excludes or restricts access to credit for areas with relatively high 

concentrations of minority residents. Examiners should review complaints against the 

institution filed either with their agency or the institution; the CRA public comment file; 

community contact forms; and the responses to questions about redlining, discrimination, 

and discouragement of applications, and about meeting the needs of racial or national 

origin minorities, asked as part of obtaining local perspectives on the performance of 

financial institutions during prior CRA examinations.

R12. An institution that has most of its branches in predominantly non-minority 

neighborhoods at the same time that the institution's sub-prime mortgage subsidiary has 

branches which are located primarily in predominantly minority neighborhoods.

Indicators of potential disparate treatment in Marketing of residential products, such as:

M1. Advertising patterns or practices that a reasonable person would believe indicate 

prohibited basis customers are less desirable.

M2. Advertising only in media serving non-minority areas of the market.

M3. Marketing through brokers or other agents that the institution knows (or has reason

to know) would serve only one racial or ethnic group in the market.

M4. Use of marketing programs or procedures for residential loan products that exclude 

one or more regions or geographies within the institution’s assessment or marketing area 

that have significantly higher percentages of minority group residents than does the

remainder of the assessment or marketing area.

M5. Using mailing or other distribution lists or other marketing techniques for prescreened or other offerings of residential loan products that:

• Explicitly exclude groups of prospective borrowers on a prohibited basis or

• Exclude geographies (e.g., census tracts, ZIP codes) within the institution's 

marketing area that have significantly higher percentages of minority group 

residents than does the remainder of the marketing area.

M6. *Proportion of prohibited basis applicants is significantly lower than that group's 

representation in the total population of the market area.

M7. Consumer complaints alleging discrimination in advertising or marketing loans.

Step Five: Organize and Focus Residential Risk Analysis

Review the risk factors identified in Step 4 and, for each loan product that displays risk factors, 

articulate the possible discriminatory effects encountered and organize the examination of those 

loan products in accordance with the following guidance. For complex issues regarding these 

factors, consult with agency supervisory staff.

• Where overt evidence of discrimination, as described in factors O1-O5, has been found in 

connection with a product, document those findings as described in Part III, B, besides 

completing the remainder of the planned examination analysis. 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 17

• Where any of the risk factors U1-U9 are present, consider conducting an underwriting 

comparative file analysis as described in Part III, C.

• Where any of the risk factors P1-P7 are present, consider conducting a pricing comparative 

file analysis as described in Part III, D.

• Where any of the risk factors S1-S8 are present, consider conducting a steering analysis as 

described in Part III, E.

• Where any of the risk factors R1-R12 are present, consider conducting an analysis for 

redlining as described in Part III, G.

• Where any of the risk factors M1-M7 are present, consider conducting a marketing analysis

as described in Part III, H.

• Where an institution uses age in any credit scoring system, consider conducting an 

examination analysis of that credit scoring system’s compliance with the requirements of 

Regulation B as described in Part III, I.

Step Six: Identify Consumer Lending Discrimination Risk Factors

For any consumer loan products selected in Step One for risk analysis, examiners should conduct 

a risk factor review similar to that conducted for residential lending products in Steps Three 

through Five, above. Examiners should consult with agency supervisory staff regarding the 

potential use of surrogates to identify possible prohibited basis group individuals.

NOTE: The term surrogate in this context refers to any factor related to a loan applicant that 

potentially identifies that applicant’s race, color, or other prohibited basis characteristic in 

instances where no direct evidence of that characteristic is available. Thus, in consumer lending, 

where monitoring data is generally unavailable, a Hispanic or Asian surname could constitute a 

surrogate for an applicant’s race or national origin because the examiner can assume that the 

institution (which can rebut the presumption) perceived the person to be Hispanic or Asian. 

Similarly, an applicant's given name could serve as a surrogate for his or her gender. A surrogate 

for a prohibited basis group characteristic may be used to set up a comparative analysis with 

control group applicants or borrowers.

Examiners should then follow the rules in Steps Three through Five, above, and identify the 

possible discriminatory patterns encountered and consider examining those products determined 

to have sufficient risk of discriminatory conduct.

Step Seven: Identify Commercial Lending Discrimination Risk Factors

Where an institution does a substantial amount of lending in the commercial lending market, 

most notably small business lending, and the product has not recently been examined or the 

underwriting standards have changed since the last examination of the product, the examiner 

should consider conducting a risk factor review similar to that performed for residential lending 

products, as feasible, given the limited information available. Such an analysis should generally 

be limited to determining risk potential based on risk factors U4-U8; P1-P3; R5-R7; and M1-M3.

If the institution makes commercial loans insured by the Small Business Administration (SBA), 

determine from agency supervisory staff whether SBA loan data (which codes race and other 

factors) are available for the institution and evaluate those data pursuant to instructions 

accompanying them.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 18

For large institutions reporting small business loans for CRA purposes and where the institution 

also voluntarily geocodes loan denials, look for material discrepancies in ratios of approval-todenial rates for applications in areas with high concentrations of minority residents compared to 

areas with concentrations of non-minority residents.

Articulate the possible discriminatory patterns identified and consider further examining those 

products determined to have sufficient risk of discriminatory conduct in accordance with the 

procedures for commercial lending described in Part III, F. 

Step Eight: Complete the Scoping Process

To complete the scoping process, the examiner should review the results of the preceding steps 

and select those focal points that warrant examination, based on the relative risk levels identified 

above. In order to remain within the agency’s resource allowances, the examiner may need to 

choose a smaller number of focal points from among all those selected on the basis of risk. In 

such instances, set the scope by first, prioritizing focal points on the basis of (i) high number 

and/or relative severity of risk factors; (ii) high data quality and other factors affecting the 

likelihood of obtaining reliable examination results; (iii) high loan volume and the likelihood of 

widespread risk to applicants and borrowers; and (iv) low quality of any compliance program 

and, second, selecting for examination review as many focal points as resources permit.

Where the judgment process among competing focal points is a close call, information learned in 

the phase of conducting the compliance management review can be used to further refine the 

examiner’s choices.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 19

PART II

COMPLIANCE MANAGEMENT REVIEW

The Compliance Management Review enables the examination team to determine:

• The intensity of the current examination based on an evaluation of the compliance 

management measures employed by an institution.

• The reliability of the institution’s practices and procedures for ensuring continued fair 

lending compliance.

Generally, the review should focus on:

• Determining whether the policies and procedures of the institution enable management to 

prevent, or to identify and self-correct, illegal disparate treatment in the transactions that 

relate to the products and issues identified for further analysis under Part I of these 

procedures.

• Obtaining a thorough understanding of the manner by which management addresses its fair 

lending responsibilities with respect to (a) the institution’s lending practices and standards, 

(b) training and other application-processing aids, (c) guidance to employees or agents in 

dealing with customers, and (d) its marketing or other promotion of products and services.

To conduct this review, examiners should consider institutional records and interviews with 

appropriate management personnel in the lending, compliance, audit, and legal functions. The 

examiner should also refer to the Compliance Management Analysis Checklist contained in the 

Appendix to evaluate the strength of the compliance programs in terms of their capacity to 

prevent, or to identify and self-correct, fair lending violations in connection with the products or 

issues selected for analysis. Based on this evaluation:

• Set the intensity of the transaction analysis by minimizing sample sizes within the guidelines 

established in Part III and the Fair Lending Sample Size Tables in the Appendix to the extent 

warranted by the strength and thoroughness of the compliance programs applicable to those 

focal points selected for examination.

• Identify any compliance program or system deficiencies that merit correction or 

improvement and present these to management in accordance with Part IV of these 

procedures.

Where an institution performs a self-evaluation or has voluntarily disclosed the report or results 

of a self-test of any product or issue that is within the scope of the examination and has been 

selected for analysis pursuant to Part I of these procedures, examiners may streamline the 

examination, consistent with agency guidance, provided the self-test or self-evaluation meets the 

requirements set forth in Using Self-Tests and Self-Evaluations to Streamline the Examination

located in the Appendix.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 20

PART III

EXAMINATION PROCEDURES

Once the scope and intensity of the examination have been determined, assess the institution’s 

fair lending performance by applying the appropriate procedures that follow to each of the 

examination focal points already selected.

A. Verify Accuracy of Data

Prior to any analysis and preferably before the scoping process, examiners should assess the 

accuracy of the data being reviewed. Data verifications should follow specific protocols 

(sampling, size, etc.) intended to ensure the validity of the review. For example, where an 

institution’s LAR data are relied upon, examiners should generally validate the accuracy of the 

institution’s submitted data by selecting a sample of LAR entries and verifying that the 

information noted on the LAR was reported according to instructions by comparing information 

contained in the loan file for each sampled loan. If the LAR data are inconsistent with the 

information contained in the loan files, depending on the nature of the errors, examiners may not 

be able to proceed with a fair lending analysis until the LAR data have been corrected by the 

institution. In cases where inaccuracies impede the examination, examiners should direct the 

institution to take action to ensure data integrity (data scrubbing, monitoring, training, etc.). 

NOTE: While the procedures refer to the use of HMDA data, other data sources should be 

considered, especially in the case of non-HMDA reporters or institutions that originate loans, but 

are not required to report them on an LAR.

B. Documenting Overt Evidence of Disparate Treatment

Where the scoping process or any other source identifies overt evidence of disparate treatment, 

the examiner should assess the nature of the policy or statement and the extent of its impact on 

affected applicants by conducting the following analysis

Step 1: Where the indicator(s) of overt discrimination are found in or based on a written 

policy (for example, a credit scorecard) or communication, determine and document: 

a. The precise language of the apparently discriminatory policy or communication and 

the nature of the fair lending concerns that it raises;

b. The institution’s stated purpose in adopting the policy or communication and the 

identity of the person on whose authority it was issued or adopted;

c. How and when the policy or communication was put into effect;

d. How widely the policy or communication was applied; and

e. Whether and to what extent applicants were adversely affected by the policy or 

communication.

Step 2: Where any indicator of overt discrimination was an oral statement or unwritten 

practice, determine and document:

a. The precise nature of both the statement or practice and of the fair lending concerns 

that they raise

b. The identity of the persons making the statement or applying the practice and their 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 21

descriptions of the reasons for it and the persons authorizing or directing the use of the 

statement or practice

c. How and when the statement or practice was disseminated or put into effect

d. How widely the statement or practice was disseminated or applied

e. Whether and to what extent applicants were adversely affected by the statement or 

practice.

Assemble findings and supporting documentation for presentation to management in connection 

with Part IV of these procedures.

C. Transactional Underwriting Analysis - Residential and Consumer Loans.

Step 1: Set Sample Size 

a. For each focal point selected for this analysis, two samples will be utilized: (i) 

prohibited basis group denials and (ii) control group approvals, both identified either 

directly from monitoring information in the case of residential loan applications or 

through the use of application data or surrogates in the case of consumer applications.

b. Refer to Fair Lending Sample Size Tables, Table A in the Appendix and determine the 

size of the initial sample for each focal point, based on the number of prohibited basis 

group denials and the number of control group approvals by the institution during the 

twelve month (or calendar year) period of lending activity preceding the examination. In 

the event that the number of denials and/or approvals acted on during the preceding 12 

month period substantially exceeds the maximum sample size shown in Table A, reduce 

the time period from which that sample is selected to a shorter period. (In doing so, make 

every effort to select a period in which the institution’s underwriting standards are most 

representative of those in effect during the full 12-month period preceding the 

examination.) 

c. If the number of prohibited basis group denials or control group approvals for a given 

focal point that were acted upon during the 12-month period referenced in 1.b., above, do 

not meet the minimum standards set forth in the Sample Size Table, examiners need not 

attempt a transactional analysis for that focal point. Where other risk factors favor 

analyzing such a focal point, consult with agency supervisory staff on possible alternative 

methods of judgmental comparative analysis.

d. If agency policy calls for a different approach to sampling (e.g., a form of statistical 

analysis, a mathematical formula, or an automated tool) for a limited class of institutions, 

examiners should follow that approach.

Step 2: Determine Sample Composition.

a. To the extent the institution maintains records of loan outcomes resulting from 

exceptions to its credit underwriting standards or other policies (e.g., overrides to credit 

score cutoffs), request such records for both approvals and denials, sorted by loan product 

and branch or decision center, if the institution can do so. Include in the initial sample 

for each focal point all exceptions or overrides applicable to that focal point. 

b. Using HMDA/LAR data or, for consumer loans, comparable loan register data to the 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 22

extent available, choose approved and denied applications based on selection criteria that 

will maximize the likelihood of finding marginal approved and denied applicants, as 

discussed below.

c. To the extent that the above factors are inapplicable or other selection criteria are 

unavailable or do not facilitate selection of the entire sample size of files, complete the 

initial sample selection by making random file selections from the appropriate sample 

categories in the Sample Size Table.

Step 3: Compare Approved and Denied Applications

Overview: Although a creditor's written policies and procedures may appear to be 

nondiscriminatory, lending personnel may interpret or apply policies in a discriminatory manner. 

In order to detect any disparate treatment among applicants, the examiner should first eliminate 

all but "marginal transactions" (see 3.b. below) from each selected focal point sample. Then, a 

detailed profile of each marginal applicant's qualifications, the level of assistance received during 

the application process, the reasons for denial, the loan terms, and other information should be 

recorded on an Applicant Profile Spreadsheet. Once profiled, the examiner can compare the 

target and control groups for evidence that similarly qualified applicants have been treated 

differently as to either the institution's credit decision or the quality of assistance provided. 

a. Create Applicant Profile Spreadsheet

Based upon the institution's written and/or articulated credit standards and loan policies, 

identify categories of data that should be recorded for each applicant and provide a field 

for each of these categories on a worksheet or computerized spreadsheet. Certain data 

(income, loan amount, debt, etc.) should always be included in the spreadsheet, while the 

other data selected will be tailored for each loan product and institution based on 

applicable underwriting criteria and such issues as branch location and underwriter. 

Where credit bureau scores and/or application scores are an element of the institution’s 

underwriting criteria (or where such information is regularly recorded in loan files, 

whether expressly used or not), include a data field for this information in the 

spreadsheet. 

In order to facilitate comparisons of the quality of assistance provided to target and 

control group applicants, respectively, every work sheet should provide a "comments" 

block appropriately labeled as the site for recording observations from the file or 

interviews regarding how an applicant was, or was not, assisted in overcoming credit 

deficiencies or otherwise qualifying for approval. 

b. Complete Applicant Profiles 

From the application files sample for each focal point, complete applicant profiles for 

selected denied and approved applications as follows: 

• A principal goal is to identify cases where similarly qualified prohibited basis and 

control group applicants had different credit outcomes, because the agencies have 

found that discrimination, including differences in granting assistance during the 

approval process, is more likely to occur with respect to applicants who are not either 

clearly qualified or unqualified, e.g., “marginal” applicants. The examiner-in-charge 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 23

should, during the following steps, judgmentally select from the initial sample only 

those denied and approved applications which constitute marginal transactions. (See 

Appendix on Identifying Marginal Transactions for guidance.) 

• If few marginal control group applicants are identified from the initial sample, review 

additional files of approved control group applicants. This will either increase the 

number of marginal approvals or confirm that marginal approvals are so infrequent 

that the marginal denials are unlikely to involve disparate treatment.

• The judgmental selection of both marginal-denied and marginal-approved applicant 

loan files should be done together, in a “back and forth” manner, to facilitate close 

matches and a more consistent definition of “marginal” between these two types of 

loan files.

• Once the marginal files have been identified, the data elements called for on the 

profile spreadsheet are extracted or noted and entered.

• While conducting the preceding step, the examiner should simultaneously look for 

and document on the spreadsheet any evidence found in marginal files regarding the 

following.

o The extent of any assistance, including both affirmative aid and waivers or partial 

waivers of credit policy provisions or requirements, that appears to have been 

provided to marginal-approved control group applicants, which enabled them to 

overcome one or more credit deficiencies, such as excessive debt-to-income ratios, 

and

o The extent to which marginal-denied target group applicants with similar deficiencies 

were, or were not, provided similar affirmative aid, waivers, or other forms of 

assistance.

c. Review and Compare Profiles

• For each focal point, review all marginal profiles to determine if the underwriter 

followed institution lending policies in denying applications and whether the 

reason(s) for denial were supported by facts documented in the loan file and properly 

disclosed to the applicant pursuant to Regulation B. If any (a) unexplained deviations 

from credit standards, (b) inaccurate reasons for denial, or (c) incorrect disclosures 

are noted, (whether in a judgmental underwriting system, a scored system, or a mixed 

system) the examiner should obtain an explanation from the underwriter and 

document the response on an appropriate workpaper. 

NOTE: In constructing the applicant profiles to be compared, examiners must adjust 

the facts compared so that assistance, waivers, or acts of discretion are treated 

consistently between applicants. For example, if a control group applicant's DTI ratio 

was lowered to 42% because the institution decided to include short-term overtime 

income, and a prohibited basis group applicant who was denied due to "insufficient 

income" would have had his ratio drop from 46% to 41% if his short-term overtime 

income had been considered, then the examiners should consider 41%, not 46%, in 

determining the benchmark.

• For each reason for denial identified within the target group, rank the denied 

prohibited basis applicants, beginning with the applicant whose qualification(s) 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 24

related to that reason for denial were least deficient. (The top-ranked denied 

applicant in each such ranking will be referred to below as the “benchmark”

applicant.)

• Compare each marginal control group approval to the benchmark applicant in each 

reason-for-denial ranking developed in step (b), above. If there are no approvals who 

are equally or less qualified, then there are no instances of disparate treatment for the 

institution to account for. For all such approvals that appear no better qualified than 

the denied benchmark applicant:

o Identify the approved loan on the worksheet or spreadsheet as an “overlap 

approval” and

o Compare that overlap approval with other marginal prohibited basis denials in 

the ranking to determine whether additional overlaps exist. If so, identify all 

overlapping approvals and denials as above.

• Where the focal point involves use of a credit scoring system, the analysis for 

disparate treatment is similar to the procedures set forth in (c) above, and should 

focus primarily on overrides of the scoring system itself. For guidance on this type of 

analysis, refer to Considering Automated Underwriting and Credit Scoring, Part C, in 

the Appendix.

Step 4: If there is some evidence of violations in the underwriting process, but not enough 

to clearly establish the existence of a pattern or practice, the examiner should expand the 

sample as necessary to determine whether a pattern or practice does or does not exist.

Step 5: Discuss all findings resulting from the above comparisons with management and 

document both the findings and all conversations on an appropriate worksheet.

D. Analyzing Potential Disparities in Pricing and Other Terms and Conditions

Depending on the intensity of the examination and the size of the borrower population to be 

reviewed, the analysis of decisions on pricing and other terms and conditions may involve a 

comparative file review, statistical analysis, a combination of the two, or other specialized 

technique used by an agency. Each examination process assesses an institution’s credit-decision 

standards and whether decisions on pricing and other terms and conditions are applied to 

borrowers without regard to a prohibited basis. 

The procedures below encompass the examination steps for a comparative file review. 

Examiners should consult their own agency’s procedures for detailed guidance where 

appropriate. For example, when file reviews are undertaken in conjunction with statistical 

analysis, the guidance on specific sample sizes referenced below may not apply.

Step 1: Determine Sample Selection 

Examiners may review data in its entirety or restrict their analysis to a sample depending on the 

examination approach used and the quality of the institution’s compliance management system. 

The Fair Lending Sample Size Tables in the Appendix provide general guidance about 

appropriate sample sizes. Generally, the sample size should be based on the number of 

prohibited basis group and control group originations for each focal point selected during the 12 

months preceding the examination and the outcome of the compliance management system 

analysis conducted in Part II. When possible, examiners should request specific loan files in 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 25

advance and request that the institution have them available for review at the start of the 

examination.

Step 2: Determine Sample Composition and Create Applicant Profiles

Examiners should tailor their sample and subsequent analysis to the specific factors that the 

institution considers when determining its pricing, terms, and conditions. For example, while 

decisions on pricing and other terms and conditions are part of an institution’s underwriting 

process, general underwriting criteria should not be used in the analysis if they are not relevant to 

the term or condition to be reviewed. Additionally, consideration should be limited to factors 

which examiners determine to be legitimate.

a. While the period for review should be 12 months, prohibited basis group and control 

group borrowers should be grouped and reviewed around a range of dates during which 

the institution’s practices for the term or condition being reviewed were the same. 

Generally, examiners should use the loan origination date or the loan application date.

b. Identify data to be analyzed for each focal point to be reviewed and record this 

information for each borrower on a spreadsheet to ensure a valid comparison regarding 

terms and conditions. For example, in certain cases, an institution may offer slightly 

differentiated products with significant pricing implications to borrowers. In these cases, 

it may be appropriate to group these procedures together for the purposes of evaluation.

Step 3: Review Terms and Conditions; Compare with Borrower Outcomes

a. Review all loan terms and conditions (rates, points, fees, maturity variations, LTVs, 

collateral requirements, etc.) with special attention to those that are left, in whole or in 

part, to the discretion of loan officers or underwriters. For each such term or condition, 

identify (a) any prohibited basis group borrowers in the sample who appear to have been 

treated unfavorably with respect to that term or condition and (b) any control group 

borrowers who appear to have been treated favorably with respect to that term or 

condition. The examiner's analysis should be thoroughly documented in the workpapers. 

b. Identify from the sample universe any control group borrowers who appear to have been 

treated more favorably than one or more of the above-identified prohibited basis group 

borrowers and who have pricing or creditworthiness factors (under the institution’s 

standards) that are equal to or less favorable than the prohibited basis group borrowers.

c. Obtain explanations from the appropriate loan officer or other employee for any 

differences that exist and reanalyze the sample for evidence of discrimination. 

d. If there is some evidence of violations in the imposition of terms and conditions, but not 

enough to clearly establish the existence of a pattern or practice, the examiner should 

expand the sample as necessary to determine whether a pattern or practice does or does 

not exist. 

e. Discuss differences in comparable loans with the institution's management and document 

all conversations on an appropriate worksheet. For additional guidance on evaluating 

management’s responses, refer to Part A, 1 - 5, Evaluating Responses to Evidence of 

Disparate Treatment in the Appendix.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 26

E. Steering Analysis

An institution that offers a variety of lending products or product features, either through one 

channel or through multiple channels, may benefit consumers by offering greater choices and 

meeting the diverse needs of applicants. Greater product offerings and multiple channels, 

however, may also create a fair lending risk that applicants will be illegally steered to certain 

choices based on prohibited characteristics.

Several examples illustrate potential fair lending risk:

• An institution that offers different lending products based on credit risk levels may present 

opportunities for loan officers or brokers to illegally steer applicants to the higher-risk 

products;

• An institution that offers nontraditional loan products or loan products with potentially 

onerous terms (such as prepayment penalties) may present opportunities for loan officers or 

brokers to illegally steer applicants to certain products or features; and

• An institution that offers prime or sub-prime products through different channels may present 

opportunities for applicants to be illegally steered to the sub-prime channel.

The distinction between guiding consumers toward a specific product or feature and illegal 

steering centers on whether the institution did so on a prohibited basis, rather than based on an 

applicant’s needs or other legitimate factors. It is not necessary to demonstrate financial harm to 

a group that has been “steered.” It is enough to demonstrate that action was taken on a 

prohibited basis regardless of the ultimate financial outcome. If the scoping analysis reveals the 

presence of one or more risk factors S1 through S8 for any selected focal point, consult with 

agency supervisory staff about conducting a steering analysis as described below.

Step 1: Clarify what options are available to applicants.

Through interviews with appropriate personnel of the institution and review of policy manuals, 

procedure guidelines, and other directives, obtain and verify the following information for each 

product-alternative product pairing or grouping identified above:

a. All underwriting criteria for the product or feature and their alternatives that are 

offered by the institution or by a subsidiary or affiliate. Examples of products may 

include stated income, negative amortization, and options ARMs. Examples of terms and 

features include prepayment penalties and escrow requirements. The distinction between 

a product, term, and feature may vary institution to institution. For example, some 

institutions may consider “stated income” a feature, whiles others may consider that a 

distinct product.

b. Pricing or other costs applicable to the product and the alternative product(s), 

including interest rates, points, and all fees.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 27

Step 2: Document the policies, conditions or criteria that have been adopted by the 

institution for determining how referrals are to be made and choices presented to 

applicants.

a. Obtain not only information regarding the product or feature offered by the institution 

and alternatives offered by subsidiaries/affiliates, but also information on alternatives 

offered solely by the institution itself.

b. Obtain any information regarding a subsidiary of the institution directly from that 

entity, but seek information regarding an affiliate or holding company subsidiary only 

from the institution itself. 

c. Obtain all appropriate documentation and provide a written summary of all 

discussions with loan personnel and managers.

d. Obtain documentation and/or employee estimates as to the volume of referrals made 

from or to the institution, for each product, during a relevant time period.

e. Resolve to the extent possible any discrepancies between information found in the 

institution's documents and information obtained in discussions with loan personnel 

and managers by conducting appropriate follow-up interviews.

f. Identify any policies and procedures established by the institution and/or the subsidiary 

or affiliate for (i) referring a person who applies to the institution, but does not meet 

its criteria, to another internal lending channel, subsidiary, or affiliate; (ii) offering 

one or more alternatives to a person who applies to the institution for a specific 

product or feature, but does not meet its criteria; or (iii) referring a person who 

applies to a subsidiary or affiliate for its product, but who appears qualified for a loan 

from the institution, to the institution; or referring a person who applies through one 

internal lending channel for a product, but who appears to be qualified for a loan 

through another lending channel to that particular lending channel.

g. Determine whether loan personnel are encouraged, through financial incentives or 

otherwise, to make referrals, either from the institution to a subsidiary/affiliate or vice 

versa. Similarly, determine whether the institution provides financial incentives 

related to products and features.

Step 3: Determine how referral decisions are made and documented within the institution. 

Determine how a referral is made to another internal lending channel, subsidiary, or affiliate. 

Determine the reason for referral and how it is documented.

Step 4: Determine to what extent individual loan personnel are able to exercise personal 

discretion in deciding what loan products or other credit alternatives will be made 

available to a given applicant.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 28

Step 5: Determine whether the institution's stated policies, conditions, or criteria in fact are 

adhered to by individual decision makers. If not, does it appear that different policies or 

practices are actually in effect?

Enter data from the prohibited basis group sample on the spreadsheets and determine whether the 

institution is, in fact, applying its criteria as stated. For example, if one announced criterion for 

receiving a "more favorable" prime mortgage loan was a back-end debt ratio of no more than 

38%, review the spreadsheets to determine whether that criteria were adhered to. If the 

institution's actual treatment of prohibited basis group applicants appears to differ from its stated 

criteria, document such differences for subsequent discussion with management.

Step 6: To the extent that individual loan personnel have any discretion in deciding what 

products and features to offer applicants, conduct a comparative analysis to determine 

whether that discretion has been exercised in a nondiscriminatory manner.

Compare the institution's or subsidiary/affiliate's treatment of control group and prohibited basis 

group applicants by adapting the "benchmark" and "overlap" technique discussed in Part III, 

Section C, of these procedures. For purposes of this Steering Analysis, that technique should be 

conducted as follows:

a. For each focal point to be analyzed, select a sample of prohibited basis group

applicants who received "less favorable" treatment (e.g., referral to a finance company or 

a subprime mortgage subsidiary or counteroffers of less favorable product alternatives).

NOTE: In selecting the sample, follow the guidance of Fair Lending Sample Size Tables, 

Table B in the Appendix and select "marginal applicants" as instructed in Part III, Section 

C, above.

b. Prepare a spreadsheet for the sample which contains data entry categories for those 

underwriting and/or referral criteria that the institution identified in Step 1.b as used in 

reaching underwriting and referral decisions between the pairs of products.

c. Review the "less favorably" treated prohibited basis group sample and rank this sample 

from least qualified to most qualified.

d. From the sample, identify the best qualified prohibited basis group applicant based on 

the criteria identified for the control group, above. This applicant will be the "benchmark"

applicant. Rank order the remaining applicants from best to least qualified.

e. Select a sample of control group applicants. Identify those who were treated "more

favorably" with respect to the same product-alternative product pair as the prohibited 

basis group. (Again refer to the Sample Size Table B and marginal applicant processes 

noted above in selecting the sample.)

f. Compare the qualifications of the benchmark applicant with those of the control group 

applicants, beginning with the least qualified member of that sample. Any control group 

applicant who appears less qualified than the benchmark applicant should be identified on 

the spreadsheet as a "control group overlap."

g. Compare all control group overlaps with other, less qualified prohibited basis group 

applicants to determine whether additional overlaps exist.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 29

h. Document all overlaps as possible disparities in treatment. Discuss all overlaps and 

related findings (e.g., any differences between stated and actual underwriting and/or 

referral criteria) with management, documenting all such conversations.

Step 7: Examiners should consult with their agency’s supervisory staff if they see a need to 

contact control group or prohibited basis group applicants to substantiate the steering 

analysis.

F. Transactional Underwriting Analysis - Commercial Loans.

Overview: Unlike consumer credit, where loan products and prices are generally homogenous 

and underwriting involves the evaluation of a limited number of credit variables, commercial 

loans are generally unique and underwriting methods and loan pricing may vary depending on a 

large number of credit variables. The additional credit analysis that is involved in underwriting 

commercial credit products will entail additional complexity in the sampling and discrimination 

analysis process. Although ECOA prohibits discrimination in all commercial credit activities of 

a covered institution, the agencies recognize that small businesses (sole proprietorships, 

partnerships, and small, closely-held corporations) may have less experience in borrowing. 

Small businesses may have fewer borrowing options, which may make them more vulnerable to 

discrimination. Therefore, in implementing these procedures, examinations should generally be 

focused on small business credit (commercial applicants that had gross revenues of $1,000,000 

or less in the preceding fiscal year), absent some evidence that a focus on other commercial 

products would be more appropriate.

Step 1: Understand Commercial Loan Policies

For the commercial product line selected for analysis, the examiner should first review credit 

policy guidelines and interview appropriate commercial loan managers and officers to obtain 

written and articulated standards used by the institution in evaluating commercial loan 

applications.

NOTE: Examiners should consult their own agencies for guidance on when a comparative 

analysis or statistical analysis is appropriate and follow their agencies procedures for conducting 

such a review/analysis.

Step 2: Conduct Comparative File Review

a. Select all (or a maximum of 10) denied applications that were acted on during the 

three-month period prior to the examination. To the extent feasible, include denied 

applications from businesses that are (i) located in minority and/or integrated geographies 

or (ii) appear to be owned by women or minority group members, based on the names of 

the principals shown on applications or related documents. (In the case of institutions 

that do a significant volume of commercial lending, consider reviewing more than ten 

applications.)

b. For each of the denied commercial applications selected, record specific information 

from loan files and through interviews with the appropriate loan officer(s), about the 

principal owners, the purpose of the loan, and the specific, pertinent financial information 

about the commercial enterprise (including type of business - retail, manufacturing, 

service, etc.), that was used by the institution to evaluate the credit request. Maintenance 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 30

or use of data that identifies prohibited basis characteristics of those involved with the 

business (either in approved or denied loan applications) should be evaluated as a 

potential violation of Regulation B.

c. Select 10 approved loans that appear to be similar with regard to business type, 

purpose of loan, loan amount, loan terms, and type of collateral, as the denied loans 

sampled. For example, if the denied loan sample includes applications for lines of credit 

to cover inventory purchases for retail businesses, the examiner should select approved 

applications for lines of credit from retail businesses.

d. For each approved commercial loan application selected, obtain and record 

information parallel to that obtained for denied applications.

e. The examiner should first compare the credit criteria considered in the credit process 

for each of the approved and denied applications to established underwriting standards, 

rather than comparing files directly.

f. The examiner should identify any deviations from credit standards for both approved 

and denied credit requests and differences in loan terms granted for approved credit 

requests.

g. The examiner should discuss each instance where deviations from credit standards and 

terms were noted, but were not explained in the file, with the commercial credit 

underwriter. Each discussion should be documented.

Step 3: Conduct Targeted Sampling

a. If deviations from credit standards or pricing are not sufficiently explained by other 

factors either documented in the credit file or the commercial underwriter was not 

able to provide a reasonable explanation, the examiner should determine if deviations 

were detrimental to any protected classes of applicants.

b. The examiner should consider employing the same techniques for determining race 

and gender characteristics of commercial applicants as those outlined in the consumer 

loan sampling procedures.

c. If it is determined that there are members of one or more prohibited basis groups 

among commercial credit requests that were not underwritten according to established 

standards or received less favorable terms, the examiner should select additional 

commercial loans, where applicants are members of the same prohibited basis group 

and select similarly situated control group credit requests in order to determine 

whether there is a pattern or practice of discrimination. These additional files should 

be selected based on the specific applicant circumstance(s) that appeared to have been 

viewed differently by lending personnel on a prohibited basis.

d. If there are not enough similarly situated applicants for comparison in the original 

sample period to draw a reasonable conclusion, the examiner should expand the 

sample period. The expanded sample period should generally not go beyond the date 

of the prior examination.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 31

Sampling Guidelines

a. Generally, the task of selecting an appropriate expanded sample of prohibited basis 

and control group applications for commercial loans will require examiner judgment. 

The examiner should select a sample that is large enough to be able to draw a 

reasonable conclusion.

b. The examiner should first select from the applications that were acted on during the 

initial sample period, but were not included in the initial sample, and select 

applications from prior time periods as necessary.

c. The expanded sample should include both approved and denied, prohibited basis and 

control group applications, where similar credit was requested by similar enterprises 

for similar purposes. 

G. Analysis of Potential Discriminatory “Redlining”.

Overview: For purposes of this analysis, traditional “redlining” is a form of illegal disparate 

treatment in which an institution provides unequal access to credit, or unequal terms of credit, 

because of the race, color, national origin, or other prohibited characteristic(s) of the residents of 

the area in which the credit seeker resides or will reside or in which the residential property to be 

mortgaged is located. Redlining may also include “reverse redlining,” the practice of targeting 

certain borrowers or areas with less advantageous products or services based on prohibited 

characteristics.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 32

The redlining analysis may be applied to determine whether, on a prohibited basis:

• An institution fails or refuses to extend credit in certain areas;

• An institution targets certain borrowers or certain areas with less advantageous products;

• An institution makes loans in such an area, but at a restricted level or upon less-favorable 

terms or conditions as compared to contrasting areas; or

• An institution omits or excludes such an area from efforts to market residential loans or 

solicit customers for residential credit.

This guidance focuses on possible discrimination based on race or national origin. The same 

analysis could be adapted to evaluate relative access to credit for areas of geographical 

concentration on other prohibited bases – for example, age.

NOTE: It is true that neither the Equal Credit Opportunity Act (ECOA) nor the Fair Housing Act 

(FHAct) specifically uses the term “redlining.” However, federal courts as well as agencies that 

have enforcement responsibilities for the FHAct have interpreted it as prohibiting institutions 

from having different marketing or lending practices for certain geographic areas, compared to 

others, where the purpose or effect of such differences would be to discriminate on a prohibited 

basis. Similarly, the ECOA would prohibit treating applicants for credit differently on the basis 

of differences in the racial or ethnic composition of their respective neighborhoods. 

Like other forms of disparate treatment, redlining can be proven by overt or comparative 

evidence. If any written or oral policy or statement of the institution (see risk factors R6-10 in 

Part I, above) suggests that the institution links the racial or national origin character of an area 

with any aspect of access to or terms of credit, the examiners should refer to the guidance in 

Section B of this Part III, on documenting and evaluating overt evidence of discrimination. 

Overt evidence includes not only explicit statements, but also any geographical terms used by the 

institution that would, to a reasonable person familiar with the community in question, connote a 

specific racial or national origin character. For example, if the principal information conveyed 

by the phrase “north of 110th Street” is that the indicated area is principally occupied by 

Hispanics, then a policy of not making credit available “north of 110th Street” is overt evidence 

of potential redlining on the basis of national origin.

Overt evidence is relatively uncommon. Consequently, the redlining analysis usually will focus 

on comparative evidence (similar to analyses of possible disparate treatment of individual 

customers) in which the institution’s treatment of areas with contrasting racial or national origin 

characters is compared. 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 33

When the scoping process (including consultation within an agency as called for by agency 

procedures) indicates that a redlining analysis should be initiated, examiners should complete the 

following steps of comparative analysis:

1. Identify and delineate any areas within the institution’s CRA assessment area and 

reasonably expected market area for residential products that have a racial or national 

origin character;

2. Determine whether any minority area identified in Step 1 appears to be excluded, 

under-served, selectively excluded from marketing efforts, or otherwise lessfavorably treated in any way by the institution;

3. Identify and delineate any areas within the institution’s CRA assessment area and 

reasonably expected market area for residential products that are non-minority in 

character and that the institution appears to treat more favorably; 

4. Identify the location of any minority areas located just outside the institution’s CRA 

assessment area and market area for residential products, such that the institution may 

be purposely avoiding such areas;

5. Obtain the institution’s explanation for the apparent difference in treatment between 

the areas and evaluate whether it is credible and reasonable; and

6. Obtain and evaluate other information that may support or contradict interpreting 

identified disparities to be the result of intentional illegal discrimination.

These steps are discussed in detail below. 

Using information obtained during scoping

Although the six tasks listed are presented below as examination steps in the order given above, 

examiners should recognize that a different order may be preferable in any given examination. 

For example, the institution’s explanation (Step 5) for one of the policies or patterns in question 

may already be documented in the CRA materials reviewed (Step 1) and the CRA examiners 

may already have verified it, which may be sufficient for purposes of the redlining analysis.

As another example, as part of the scoping process, the examiners may have reviewed an 

analysis of the geographic distribution of the institution’s loan originations with respect to the 

racial and national origin composition of census tracts within its CRA assessment or residential 

market area. Such analysis might have documented the existence of significant discrepancies 

between areas, by degree of minority concentration, in loans originated (risk factor R1), 

approval/denial rates (risk factor R2), and/or rates of denials because of insufficient collateral 

(risk factor R3). In such a situation in which the scoping process has produced a reliable factual 

record, the examiners could begin with Step 5 (obtaining an explanation) of the redlining 

analysis below. 

In contrast, when the scoping process only yields partial or questionable information or when the 

risk factors on which the redlining analysis is based on complaints or allegations against the 

institution, Steps 1-4 must be addressed.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 34

Comparative analysis for redlining

Step 1: Identify and delineate any areas within the institution’s CRA assessment area and 

reasonably expected market area for residential products that are of a racial or national 

origin minority character.

NOTE: The CRA assessment area can be a convenient unit for redlining analysis because 

information about it typically already is in hand. However, the CRA assessment area may be too 

limited. The redlining analysis focuses on the institution’s decisions about how much access to credit 

to provide to different geographical areas. The areas for which those decisions can best be compared 

are areas where the institution actually marketed and provided credit and where it could reasonably 

be expected to have marketed and provided credit. Some of those areas might be beyond or 

otherwise different from the CRA assessment area.

If there are no areas identifiable for their racial or national origin minority character within the 

institution’s CRA assessment area or reasonably expected market area for residential products, a 

redlining analysis is not appropriate. (If there is a substantial, but dispersed minority population, 

potential disparate treatment can be evaluated by a routine comparative file review of applicants.)

This step may have been substantially completed during scoping, but unresolved matters may 

remain. (For example, several community spokespersons may allege that the institution is redlining, 

but disagree in defining the area.) The examiners should:

a. Describe as precisely as possible why a specific area is recognized in the community 

(perceptions of residents, etc.) and/or is objectively identifiable (based on census or other 

data) as having a particular racial or national origin minority character.

• The most obvious identifier is the predominant race or national origin of the residents of 

the area. Examiners should document the percentages of racial or national origin 

minorities residing within the census tracts that make up the area. Analyzing racial and 

national origin concentrations in quartiles (such as 0 to <=25%, >25% to < = 50%, >50% 

to <= 75%, and >75%) or based on majority concentration (0 to <=50%, and >50%) may 

be helpful. However, examiners should bear in mind that it is illegal for the institution to 

consider a prohibited factor in any way. For example, an area or neighborhood may only 

have a minority population of 20%, but if the area’s concentration appears related to 

lending practices, it would be appropriate to use that area’s level of concentration in the 

analysis. Contacts with community groups can be helpful to learn whether there are such 

subtle features of racial or ethnic character within a particular neighborhood.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 35

• Geographical groupings that are convenient for CRA may obscure racial patterns. For 

example, an under-served, low-income, predominantly minority neighborhood that 

lies within a larger low-income area that primarily consisted of non-minority

neighborhoods may seem adequately served when the entire low-income area is 

analyzed as a unit. However, a racial pattern of underservice to minority areas might 

be revealed if the low-income minority neighborhood shared a border with an underserved, middle-income, minority area and those two minority areas were grouped 

together for purposes of analysis. 

b. Describe how the racial or national origin character changes across the suspected 

redlining area’s various boundaries.

c. Document or estimate the demand for credit within the minority area. This may 

include the applicable demographics of the area, including the percentage of 

homeowners, the median house value, median family income, or the number of small 

businesses, etc. Review the institution’s non-originated loan applications from the 

suspected redlined areas. If available, review aggregate institution data for loans 

originated and applications received from the suspected redlined areas. Community 

contacts may also be helpful in determining the demand for such credit. If the 

minority area does not have a significant amount of demand for such credit, the area 

is not appropriate for a redlining analysis.

Step 2: Determine whether any minority area identified in Step 1 is excluded, underserved, selectively excluded from marketing efforts, or otherwise less-favorably treated in 

any way by the institution.

The examiners should begin with the risk factors identified during the scoping process. The 

unfavorable treatment may have been substantially documented during scoping and needs only to 

be finished in this step. If not, this step will verify and measure the extent to which HMDA data 

show the minority areas identified in Step 1 to be under-served and/or how the institution's 

explicit policies treat them less favorably.

a. Review prior CRA lending test analyses to learn whether they have identified any 

excluded or otherwise under-served areas or other significant geographical disparities 

in the institution’s lending. Determine whether any of those are the minority areas 

identified in Step 1.

b. Learn from the institution itself whether, as a matter of policy, it treats any separate or 

distinct geographical areas within its marketing or service area differently from other 

areas. This may have been done completely or partially during scoping analysis 

related to risk factors R5-R9. The differences in treatment can be in marketing, 

products offered, branch operations (including the services provided and the hours of 

operation), appraisal practices, application processing, approval requirements, 

pricing, loan conditions, evaluation of collateral, or any other policy or practice 

materially related to access to credit. Determine whether any of those less-favored 

areas are the minority areas identified in Step 1.

c. Obtain from the institution: (i) its reasons for such differences in policy, (ii) how the 

differences are implemented, and (iii) any specific conditions that must exist in an 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 36

area for it to receive the particular treatment (more favorable or less favorable) that 

the institution has indicated.

Step 3: Identify and delineate any areas within the institution’s CRA assessment area and 

reasonably expected market area for residential products that are non-minority in 

character and that the institution appears to treat more favorably.

To the extent not already completed during scoping: 

a. Document the percentages of control group and of racial or national origin minorities 

residing within the census tract(s) that comprise(s) the non-minority area

b. Document the nature of the housing stock in the area 

c. Describe, to the extent known, how the institution’s practices, policies, or its rate of 

lending change from less- to more-favorable as one leaves the minority area at its 

various boundaries. (Examiners should be particularly attentive to instances in which 

the boundaries between favored and disfavored areas deviate from boundaries the 

institution would reasonably be expected to follow, such as political boundaries or 

transportation barriers.) 

d. Examiners should particularly consider whether, within a large area that is composed 

predominantly of racial or national origin minority households, there are enclaves that 

are predominantly non-minority or whether, along the area’s borders, there are

irregularities where the non-minority group is predominant. As part of the overall 

comparison, examiners should determine whether credit access within those small 

non-minority areas differs from credit access in the larger minority area.

Step 4: Identify the location of any minority areas just outside the institution’s CRA 

assessment area and market area for residential products, such that the institution may be 

purposely avoiding such areas.

Review the analysis from prior CRA examinations of whether the assessment area appears to 

have been influenced by prohibited factors. If there are minority areas that the institution

excluded from the assessment area improperly, consider whether they ought to be included in the 

redlining analysis. Analyze the institution’s reasonably expected market area in the same 

manner.

Step 5: Obtain the institution’s explanation for the apparent difference in treatment 

between the areas and evaluate whether it is credible and reasonable.

This step completes the comparative analysis by soliciting from the institution any additional 

information not yet considered by the examiners that might show that there is a 

nondiscriminatory explanation for the apparent disparate treatment based on race or ethnicity.

For each matter that requires explanation, provide the institution full information about what 

differences appear to exist in how it treats minority and non-minority areas and how the 

examiners reached their preliminary conclusions at this stage of the analysis.

a. Evaluate whether the conditions identified by the institution in Step 2 as justifying 

more favorable treatment pursuant to institutional policy existed in minority 

neighborhoods that did not receive the favorable treatment called for by institutional 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 37

policy. If there are minority areas for which those conditions existed, ask the 

institution to explain why the areas were treated differently despite the similar 

conditions.

b. Evaluate whether the conditions identified by the institution in Step 2 as justifying 

less favorable treatment pursuant to institutional policy existed in non-minority

neighborhoods that received favorable treatment nevertheless. If there are nonminority areas for which those conditions existed, ask the institution to explain why 

those areas were treated differently, despite the similar conditions. 

c. Obtain explanations from the institution for any apparent differences in treatment 

observed by the examiners, but not called for by the institution’s policies

• If the institution’s explanation cites any specific conditions in the nonminority area(s) to justify more favorable treatment, determine whether the 

minority area(s) identified in Step 1 satisfied those conditions. If there are 

minority areas for which those conditions existed, ask the institution to 

explain why the areas were treated differently despite the similar conditions.

• If the institution’s explanation cites any specific conditions in the minority 

area(s) to justify less favorable treatment, determine whether the non-minority 

area(s) had those conditions. If there are non-minority areas for which those 

conditions existed, ask the institution to explain why those areas were treated 

differently, despite the similar conditions. 

d. Evaluate the institution’s responses by applying appropriate principles selected from 

the Appendix on Evaluating Responses to Evidence of Disparate Treatment.

Step 6: Obtain and evaluate specific types of other information that may support or 

contradict a finding of redlining.

As a legal matter, discriminatory intent can be inferred simply from the lack of a legitimate 

explanation for clearly less-favorable treatment of racial or national origin minorities. 

Nevertheless, if the institution’s explanations do not adequately account for a documented 

difference in treatment, the examiners should consider additional information that might support 

or contradict the interpretation that the difference in treatment constituted redlining.

a. Comparative file review. If there was a comparative file review conducted in 

conjunction with the redlining examination, review the results; or if it is necessary 

and feasible to do so to clarify what appears to be discriminatory redlining, compare 

denied applications from within the suspected redlining area to approved applications 

from the contrasting area. 

• Learn whether there were any denials of fully qualified applicants from the 

suspected redlining area. If so, that may support the view that the institution 

was avoiding doing business in the area. 

• Learn whether the file review identified instances of illegal disparate 

treatment against applicants of the same race or national origin as the 

suspected redlining area. If so, that may support the view that the institution 

was avoiding doing business with applicants of that group, such as the 

residents of the suspected redlining area. Learn whether any such identified 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 38

victims applied for transactions in the suspected redlining area. 

• If there are instances of either of the above, identify denied non-minority

residents, if any, of the suspected redlining area and review their application 

files to learn whether they appear to have been treated in an irregular or less 

favorable way. If so, that may support the view that the character of the area 

rather than of the applicants themselves appears to have influenced the credit 

decisions.

• Review withdrawn and incomplete applications for the suspected redlining 

area, if those can readily be identified from the HMDA-LAR, and learn 

whether there are reliable indications that the institution discouraged those 

applicants from applying. If so, that may support the view that the institution 

was avoiding conducting business in the area and may constitute evidence of a 

violation of Section 202.4(b) of Regulation B.

Conversely, if the comparisons of individual transactions show that the institution treated 

minority and non-minority applicants within and outside the suspected redlining area 

similarly, that tends to contradict the conclusion that the institution avoided the areas 

because it had minority residents.

b. Interviews of third parties. The perspectives of third parties will have been taken into 

account to some degree through the review of available materials during scoping. 

Later in the examination, in appropriate circumstances, information from third parties 

may help determine whether the institution’s apparent differences in treatment of 

minority and non-minority areas constitute redlining.

• Identify persons (such as housing or credit counselors, home improvement 

contractors, or real estate and mortgage brokers) who may have extensive 

experience dealing with credit applicants from the suspected redlined area. 

• After obtaining appropriate authorization and guidance from your agency, 

interview those persons to learn of their first-hand experiences related to:

o Oral statements or written indications by an institution’s 

representatives that loan applications from a suspected redlined area 

were discouraged;

o Whether the institution treated applicants from the suspected redlining 

area as called for in its own procedures (as the examiners understand 

them) and/or whether it treated them similarly to applicants from nonminority areas (as the examiners are familiar with those transactions);

o Any unusual delays or irregularities in loan processing for transactions 

in the suspected redlining area; and

o Differences in the institution’s pricing, loan conditions, property 

valuation practices, etc., in the suspected redlining area compared to 

contrasting areas.

Also, learn from the third parties the names of any consumers they described as having 

experienced the questionable behavior recounted by the third party, and consider 

contacting those consumers.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 39

If third parties witnessed specific conduct by the institution that indicates the institution 

wanted to avoid business from the area or prohibited basis group in question, this would 

tend to support interpreting the difference in treatment as intended. Conversely, if third 

parties report proper treatment or positive actions toward such area or prohibited basis 

group, this would tend to contradict the view that the institution intended to discriminate. 

c. Marketing. A clear exclusion of the suspected redlining area from the institution’s 

marketing of residential loan products supports the view that the institution did not 

want to do business in the area. Marketing decisions are affirmative acts to include or 

exclude areas. Disparities in marketing between two areas may reveal that the 

institution prefers one to the other. If sufficiently stark and supported by other 

evidence, a difference in marketing to racially different areas could itself be treated as 

a redlining violation of the Fair Housing Act. Even below that level of difference, 

marketing patterns can support or contradict the view that disparities in lending 

practices were intentional.

• Review materials that show how the institution has marketed in the suspected 

redlined area and in non-minority areas. Begin with available CRA materials and 

discuss the issues with CRA examiners, then review other materials as appropriate. 

The materials may include, for example, the institution’s guidance for the 

geographical distribution of pre-approved solicitations for credit cards or home equity 

lines of credit, advertisements in local media or business or telephone directories, 

business development calls to real estate brokers, and calls by telemarketers. 

d. Peer performance. Market share analysis and other comparisons to competitors are 

insufficient by themselves to prove that an institution engaged in illegal redlining. By 

the same token, an institution cannot justify its own failure to market or lend in an 

area by citing other institutions’ failures to lend or market there.

However, an institution’s inactivity in an under-served area where its acknowledged 

competitors are active would tend to support the interpretation that it intends to avoid 

doing business in the area. Conversely, if it is as active as other institutions that would 

suggest that it intends to compete for, rather than avoid, business in the area.

• Develop a list of the institution's competitors. 

• Learn the level of lending in the suspected redlining area by competitors. Check any 

public evaluations of similarly situated competitors obtained by the CRA examiners 

as part of evaluating the performance context or obtain such evaluations 

independently. 

e. Institution’s record. Request from the institution information about its overall record 

of serving or attempting to serve the racial or national origin minority group with 

which the suspected redlining area is identified. The record may reveal an intent to 

serve that group that tends to contradict the view that the institution intends to 

discriminate against the group.

NOTE: For any information that supports interpreting the situation as illegal discrimination, 

obtain and evaluate an explanation from the institution as called for in Part IV. If the 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 40

institution’s explanation is that the disparate results are the consequence of a specific, neutral 

policy or practice that the institution applies broadly, such as not making loans on homes below a 

certain value, review the guidance in the Special Analyses section of the Appendix under 

Disproportionate Adverse Impact Violations and consult agency managers.

H. Analysis of Potential Discriminatory Marketing Practices.

When scoping identifies significant risk factors (M1-M7) related to marketing, examiners should 

consult their agency’s supervisory staff and experts about a possible marketing discrimination 

analysis. If the supervisory staff agrees to proceed, the examiners should collect information as 

follows:

Step 1: Identify the institution’s marketing initiatives.

a. Pre-approved solicitations 

• Determine whether the institution sends out pre-approved solicitations:

o for home purchase loans,

o for home improvement loans, and 

o for refinance loans.

• Determine how the institution selects recipients for such solicitations:

o learn from the institution its criteria for such selections, and

o review any guidance or other information the institution provided credit-reporting 

companies or other companies that supply such lists

b. Media Usage

• Determine in which newspapers and broadcast media the institution advertises.

o identify any racial or national origin identity associated with those media and

o determine whether those media focus on geographical communities of a particular 

racial or national origin character.

• Learn the institution's strategies for geographic and demographic distribution 

of advertisements. 

• Obtain and review copies of the institution's printed advertising and promotional materials. 

• Determine what criteria the institution communicates to media about what is an attractive 

customer or an attractive area to cultivate business.

• Determine whether advertising and marketing are the same to racial and national origin 

minority areas as compared to non-minority areas.

c. Self-produced promotional materials

• Learn how the institution distributes its own promotional materials, both methods and 

geographical distribution and 

• Learn what the institution regards as the target audience(s) for those materials.

d. Realtors, brokers, contractors, and other intermediaries

• Determine whether the institution solicits business from specific realtors, brokers, home 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 41

improvement contractors, and other conduits.

o learn how the institution decides which intermediaries it will solicit;

o identify the parties contacted and determine the distribution between minority and 

non-minority areas;

o obtain and review the types of information the institution distributes to 

intermediaries; and

o determine how often the institution contacts intermediaries.

• Determine what criteria the institution communicates to intermediaries about the type of 

customers it seeks or the nature of the geographic areas in which it wishes to do business.

e. Telemarketers or predictive dialer programs

• Learn how the institution identifies which consumers to contact and whether the 

institution sets any parameters on how the list of consumers is compiled.

Step 2: Determine whether the institution's activities show a significantly lower level of 

marketing effort toward minority areas or toward media or intermediaries that tend to 

reach minority areas.

Step 3: If there is any such disparity, document the institution's explanation for it.

For additional guidance, refer to Part C of the Special Analyses section in the Appendix.

I. Credit Scoring.

If the scoping process results in the selection of a focal point that includes a credit or mortgage 

scored loan product, refer to the Considering Automated Underwriting and Credit Scoring 

section of the Appendix.

If the institution utilizes a credit scoring program which scores age for any loan product selected 

for review in the scoping stage, either as the sole underwriting determinant or only as a guide to 

making loan decisions, refer to Part E of the Considering Automated Underwriting and Credit 

Scoring section of the Appendix.

J. Disparate Impact Issues. 

These procedures have thus far focused primarily on examining comparative evidence for 

possible unlawful disparate treatment. Disparate impact has been described briefly in the 

Introduction. Whenever an examiner believes that a particular policy or practice of an institution 

appears to have a disparate impact on a prohibited basis, the examiner should refer to Part A of 

the Special Analyses section of the Appendix or consult with agency supervisory staff for further 

guidance.
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 42

PART IV

OBTAINING AND EVALUATING RESPONSES FROM 

THE INSTITUTION AND CONCLUDING THE 

EXAMINATION

Step 1: Present to the institution’s management for explanation: 

a. Any overt evidence of disparate treatment on a prohibited basis.

b. All instances of apparent disparate treatment (e.g., overlaps) in either the underwriting of 

loans or in loan prices, terms, or conditions.

c. All instances of apparent disparate treatment in the form of discriminatory steering, redlining, 

or marketing policies or practices.

d. All instances where a denied prohibited basis applicant was not afforded the same level of 

assistance or the same benefit of discretion as an approved control group applicant who was 

no better qualified with regard to the reason for denial.

e. All instances where a prohibited basis applicant received conspicuously less favorable 

treatment by the institution than was customary from the institution or was required by the 

institution's policy.

f. Any statistically significant average difference in either the frequency or amount of pricing 

disparities between control group and prohibited basis group applicants.

g. Any evidence of neutral policies, procedures, or practices that appear to have a disparate 

impact or effect on a prohibited basis.

Explain that unless there are legitimate, nondiscriminatory explanations (or in the case of 

disparate impact, a compelling business justification) for each of the preliminary findings of 

discrimination identified in this Part, the agency could conclude that the institution is in violation 

of the applicable fair lending laws.

Step 2: Document all responses that have been provided by the institution, not just its 

“best” or “final” response. Document each discussion with dates, names, titles, questions, 

responses, any information that supports or undercuts the institution's credibility, and any 

other information that bears on the issues raised in the discussion(s). 
CFPB Consumer

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFLP 43

Step 3: Evaluate whether the responses are consistent with previous statements, 

information obtained from file review, documents, reasonable banking practices, and other 

sources, and satisfy common-sense standards of logic and credibility.

a. Do not speculate or assume that the institution's decision-maker had specific intentions or 

considerations in mind when he or she took the actions being evaluated. Do not, for 

example, conclude that because you have noticed a legitimate, nondiscriminatory reason for a 

denial (such as an applicant’s credit weakness) that no discrimination occurred unless it is 

clear that, at the time of the denial, the institution actually based the denial on that reason. 

b. Perform follow-up file reviews and comparative analyses, as necessary, to determine the 

accuracy and credibility of the institution’s explanations.

c. Refer to Evaluating Responses to Evidence of Disparate Treatment in the Appendix for 

guidance as to common types of responses.

d. Refer to the Disproportionate Adverse Impact Violations portion of the Special Analyses 

section of the Appendix for guidance on evaluating the institution's responses to apparent 

disparate impact.

Step 4: If, after completing Steps 1 - 3 above, you conclude that the institution has failed to 

adequately demonstrate that one or more apparent violations had a legitimate 

nondiscriminatory basis or were otherwise lawful, prepare a documented list or discussion 

of violations, or a draft examination report, as prescribed by agency directives. 

Step 5: Consult with agency supervisory staff regarding whether (a) any violations should 

be referred to the Departments of Justice or Housing and Urban Development and (b) 

enforcement action should be undertaken by your agency.
INTERAGENCY FAIR LENDING EXAMINATION 

PROCEDURES

APPENDIX
TABLE OF CONTENTS

INTRODUCTION 3

I. COMPLIANCE MANAGEMENT ANALYSIS CHECKLIST 4

A. Preventive Measures 4

B. Corrective Measures 10

II. CONSIDERING AUTOMATED UNDERWRITING AND CREDIT SCORING 12

A. Structure and Organization of the Scoring System 12

B. Adverse Action Disclosure Notices 13

C. Disparate Treatment in the Application of Credit Scoring Programs 13

D. Disparate Impact and Credit Scoring Algorithms 14

E. Credit Scoring Systems That Include Age 14

F. Examination for Empirical Derivation and Statistical Soundness 15

III. EVALUATING RESPONSES TO EVIDENCE OF DISPARATE TREATMENT 16

A. Responses to Comparative Evidence of Disparate Treatment 16

B. Responses to Overt Evidence of Disparate Treatment 21

IV. FAIR LENDING SAMPLE SIZE TABLES 23

Table A: Underwriting (Accept/Deny) Comparisons 23

Table B: Terms and Conditions Comparisons 23

V. IDENTIFYING MARGINAL TRANSACTIONS 25

A. Marginal Denials 25

B. Marginal Approvals 26

VI. POTENTIAL SCOPING INFORMATION 27

A. Internal Agency Documents and Records 27

B. Information from the Institution 27

VII. SPECIAL ANALYSES 30

A. Disproportionate Adverse Impact Violations 30

B. Discriminatory Pre-application Screening 33

C. Possible Discriminatory Marketing 33

VIII. USING SELF-TESTS AND SELF-EXAMINATIONS TO STREAMLINE THE 

EXAMINATION 35
Introduction

This Appendix offers a full range of information that might conceivably be brought to bear in an 

examination. In that sense, it is a menu of resources to be considered and selected from, depending on the 

nature and scope of the examination being conducted.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 4

I. Compliance Management 

Analysis Checklist

This checklist is for use in conjunction with Part II of these 

procedures as a device for examiners to evaluate the

strength of an institution’s compliance program in terms of its capacity to prevent and to identify and

self-correct fair lending violations in connection with the products or issues selected for analysis. The 

checklist is not intended to be an absolute test of an institution’s compliance management program.

Programs containing all or most of the features described in the list may nonetheless be flawed for

other reasons; conversely, a compliance program that encompasses only a portion of the factors listed 

below may nonetheless adequately support a strong program under appropriate circumstances. In short,

the examiner must exercise his or her best judgment in utilizing this list and in assessing the overall

quality of an institution’s efforts to ensure fair lending compliance.

If the transactions within the proposed scope are covered by a listed preventive measure, and the

answer is “Yes,” check the box in the left column. You may then reduce the intensity (mainly the

sample size) of the planned comparative file review to the degree that the preventive measures cover

transactions within the proposed scope. Document your findings in sufficient detail to justify any

resulting reduction in the intensity of the examination.

You are not required to learn whether preventive measures apply to specific products outside the

proposed scope. However, if the information you have obtained shows that the measure is a general

practice of the institution, and thus applies to all loan products, check the box in the second column in

order to assist future examination planning.

A. Preventive Measures

Determine whether policies and procedures exist that tend to prevent illegal disparate treatment in the 

transactions you plan to examine. There is no legal or agency requirement for institutions to conduct 

these activities. The absence of any of these policies and practices is never, by itself, a violation.

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 5

1. Lending Practices and Standards

a. Principal policy issues YES NO NA

• Are underwriting practices clear, objective and generally consistent with 

industry standards?

• Is pricing within reasonably confined ranges with guidance linking 

variations to risk and/or cost factors?

• Does management monitor the nature and frequency of exceptions to its 

standards?

• Are denial reasons accurately and promptly communicated to unsuccessful 

applicants?

• Are there clear and objective standards for referring applicants to (i) 

subsidiaries, affiliates, or other lending channels within the institution, (ii) 

classifying applicants as “prime” or subprime” borrowers, or (iii) deciding 

what kinds of alternative loan products should be offered or recommended 

to applicants?

• Are loan officers required to document any deviation from the rate sheet?

• Does management monitor consumer complaints alleging discrimination in 

loan pricing or underwriting?

b. Do training, application-processing aids, and other guidance correctly and 

adequately describe:

• Prohibited bases under ECOA, Regulation B, and the Fair Housing Act?

• Other substantive credit access requirements of Regulation B (e.g., spousal 

signatures, improper inquiries, protected income)?

c. Is it specifically communicated to employees that they must not, on a 

prohibited basis:

• Refuse to deal with individuals inquiring about credit?

• Discourage inquiries or applicants by delays, discourtesy, or other means.

• Provide different, incomplete, or misleading information about the 

availability of loans, application requirements, and processing and approval 

standards or procedures (including selectively informing applicants about 

certain loan products while failing to inform them of alternatives)?

• Encourage or more vigorously assist only certain inquirers or applicants?

• Refer credit seekers to other institutions, more costly loan products, or 

potentially onerous features?

• Refer credit seekers to nontraditional products (i.e., negative amortization, 

“interest only,” “payment option” adjustable rate mortgages) when they 

could have qualified for traditional mortgages.

• Waive or grant exceptions to application procedures or credit standards?
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 6

• State a willingness to negotiate?

• Use different procedures or standards to evaluate applications?

• Use different procedures to obtain and evaluate appraisals?

• Provide certain applicants opportunities to correct or explain adverse or 

inadequate information, or to provide additional information?

• Accept alternative proofs or creditworthiness?

• Require co-signers?

• Offer or authorize loan modifications?

• Suggest or permit loan assumptions?

• Impose late charges, reinstatement fees, etc.?

• Initiate collection or foreclosure?

d. Has the institution taken specific initiatives to prevent the following 

practices?

• Basing credit decisions on assumptions derived from racial, gender, and 

other stereotypes, rather than facts?

• Seeking consumers from a particular racial, ethnic, or religious group, or of 

a particular gender, to the exclusion of other types of consumers, on the 

basis of how “comfortable” the employee may feel in dealing with those 

different from him/her?

• Limiting the exchange of credit-related information or the institution’s 

efforts to qualify an applicant from a prohibited basis group.

• Drawing the institution’s CRA assessment area by unreasonably excluding 

minority areas?

• Targeting certain borrowers or areas with less advantageous products?

e. Does the institution have procedures to ensure that it does not:

• State racial or ethnic limitations in advertisements?

• Employ words or use photos in advertisements that convey racial or ethnic 

limitations or preferences?

• Place advertisement that a reasonable person would regard as indicating 

minority consumers are less desirable?

• Advertise only in media serving predominately minority or nonminority 

areas of the market?
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 7

• Conduct other forms of marketing differentially in minority or nonminority 

areas of the market?

• Market only through brokers known to serve one racial or ethnic group in 

the market?

• Use a prohibited basis in any prescreened solicitation?

• Provide financial incentives for loan officers to place applicants in nontraditional products or higher-risk products?

2. Compliance Audit Function: Does the Institution Attempt to Detect

Prohibited Disparate Treatment by Self-Test or Self-Evaluation?

NOTE: A self-test is any program, practice, or study that is designed and specifically used to assess

the institution’s compliance with the ECOA and the Fair Housing Act. It creates data or factual 

information that is not otherwise available and cannot be derived from loan, application, or other

records related to credit transactions (12 CFR 202.15(b)(1) and 24 CFR 100.141). The report, results,

and many other records associated with a self-test are privileged unless an institution voluntarily

discloses the report or results or otherwise forfeits the privilege. See 12 CFR 202.15(b)(2) and 24 CFR

100.142(a) for a complete listing of the types of information covered by the privilege. A selfevaluation, while generally having the same purpose as a self-test, does not create any new data or

factual information, but uses data readily available in loan or application files and other records used

in credit transactions and, therefore, does not meet the self-test definition. See Using Self-Tests and

Self-Evaluations to Streamline the Examination in this Appendix for more information about selftests and self-evaluations.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 8

While you may request the results of self-evaluations, you should not request the results of self-tests

or any of the information listed in 12 CFR 202.15(b)(2) and 24 CFR 100.142(a). If an institution

discloses the self-test report or results to its regulator, it will lose the privilege. The following items

are intended to obtain information about the institution’s approach to self-testing and self-evaluation,

not the findings. Complete the checklist below for each self-evaluation and each self-test, where the

institution voluntarily discloses the report or results. Evaluating the results of self-evaluations and 

voluntarily disclosed self-tests is described in Using Self-tests Self-Evaluations to Streamline the

Examination in this Appendix.

a. Are the transactions reviewed by an independent analyst who: Yes No NA

• Is directed to report objective results?

• Has an adequate level of expertise?

• Produces written conclusions?

b. Does the institution’s approach for self-testing or self-evaluation call for:

• Attempting to explain major patterns shown in the HMDA or other loan 

data?

• Determining whether actual practices and standards differ from stated ones 

and basing the evaluation on the actual practices?

• Evaluating whether the reasons cited for denial are supported by facts relied 

on by the decision maker at the time of the decision?

• Comparing the treatment of prohibited basis group applicants to control 

group applicants?

• Obtaining explanations from decision makers for any unfavorable treatment 

of the prohibited basis group that departed from policy or customary 

practice?

• Covering significant decision points in the loan process where disparate 

treatment or discouragement might occur, including:

o The approve/deny decision?

o Pricing?

o Other terms and conditions?

• Covering at least as many transactions as examiners would independently, if 

using the Fair Lending Sample Size Tables for a product with the application 

volumes of the product to be evaluated?

• Maintaining information concerning personal characteristics collected as part 

of a self-test separately from application or loan files?

• Timely analysis of the data?

• Taking appropriate and timely corrective action?

c. In the institution’s plan for comparing the treatment of prohibited basis 

group applicants with that of control group applicants:
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 9

• Are control and prohibited basis groups based on a prohibited basis found in 

ECOA or the FHAct and defined clearly to isolate that prohibited basis for 

analysis?

• Are appropriate data to be obtained to document treatment of applicants and 

the relative qualifications vis-à-vis the requirement in question?

• Will the data to be obtained reflect the data on which decisions were based?

• Does the plan call for comparing the denied applicants’ qualifications related 

to the stated reason for denial with the corresponding qualifications for 

approved applicants?

• Are comparisons designed to identify instances in which prohibited basis 

group applicants were treated less favorably than control group applicants 

who were no better qualified?

• Is the evaluation designed to determine whether control and prohibited basis 

group applicants were treated differently in the processes by which the 

institution helped applicants overcome obstacles and by which their 

qualifications were enhanced?

• Are responses and explanations to be obtained for any apparent disparate 

treatment on a prohibited basis or other apparent violations of credit rights?

• Are reasons cited by credit decision makers to justify or explain instances of 

apparent disparate treatment to be verified?

d. For self-tests under ECOA that involved the collection of applicant personal 

characteristics, did the institution:

• Develop a written plan that describes or identifies the:

o Specific purpose of the self-test?

o Methodology to be used?

o Geographic area(s) to be covered?

o Type(s) of credit transactions to be reviewed?

o Entity that will conduct the test and analyze the data?

o Timing of the test, including start and end dates or the 

duration of the self-test

o Other related self-test data that is not privileged?

• Disclose at the time applicant characteristic information is requested, that:
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 10

o The applicant will not be required to provide the 

information?

o The creditor is requesting the information to monitor its 

compliance with ECOA?

o Federal law prohibits the creditor from discriminating on 

the basis of this information or on the basis of an 

applicant’s decision not to furnish the information?

o If applicable, certain information will be collected based on 

visual observation or surname if not provided by the 

applicant?

B. Corrective Measures

a. Determine whether the institution has provisions to take appropriate 

corrective action and provide adequate relief to victims for any violations in

the transactions you plan to review.

• Who is to receive the results of a self-evaluation or voluntarily disclosed selftest?

• What decision process is supposed to follow delivery of the information?

• Is feedback to be given to staff whose actions are reviewed?

• What types of corrective action may occur?

• Are consumers to be:

o Offered credit if they were improperly denied?

o Compensated for any damages, both out of pocket and 

compensatory?

o Notified of their legal rights?

b. Other corrective action:

• Are institutional policies or procedures that may have contributed to the 

discrimination to be corrected?

• Are employees involved to be trained and/or disciplined?

• Is the need for community outreach programs and/or changes in marketing 

strategy or loan products to better serve minority segments of the institution’s 

market to be considered?

• Are audit and oversight systems to be improved in order to ensure there is not 

recurrence of any identified discrimination?
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 11

COMMENTS

[Click&type]
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 12

II. Considering Automated Underwriting and Credit 

Scoring

These procedures are designed to help you in drawing and supporting fair lending conclusions in 

situations involving automated underwriting or credit scoring risk factors.

A. Structure and Organization of the Scoring System

Determine the utilization of credit scoring at the institution including:

1. For each customized credit scoring model or scorecard for any product, or for any credit scoring 

model used in connection with a product held in portfolio, identify and obtain:

a. The number and inter-relationship of each model or scorecard applied to a particular 

product.

b. The purposes for which each scorecard is employed (e.g., approval decision, set credit 

limits, set pricing, determine processing requirements, etc.).

c. The developer of each scorecard used (e.g., in-house department, affiliate, independent 

vendor name) and describe the development population utilized.

d. The types of monitoring reports generated (including front-end, back-end, account 

management, and any disparate impact analyses), the frequency of generation, and recent 

copies of each.

e. All policies applicable to the use of credit scoring.

f. Training materials and programs on credit scoring for employees, agents, and brokers 

involved in any aspect of retail lending.

g. Any action taken to revalidate or re-calibrate any model or scorecard used during the exam 

period and the reason(s) why.

h. The number of all high-side and low-side overrides for each type of override occurring 

during the exam period and any guidance given to employees on their ability to override.

i. All cutoffs used for each scorecard throughout the examination period and the reasons for 

the cutoffs and any change made during the exam period.

j. All variables scored by each product’s scorecard(s) and the values that each variable may 

take.

k. The method used to select for disclosure those adverse action reasons arising from 

application of the model or scorecard.

2. For each judgmental underwriting system that includes as an underwriting criterion a standard 

credit bureau or secondary market credit score identify:

a. The vendor of each credit score and any vendor recommendation or guidance on the usage 

of the score relied upon by the institution;

b. The institution’s basis for using the particular bureau or secondary market score and the 

cutoff standards for each product’s underwriting system, and the reasons for any changes to 

the same during the exam period;
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 13

c. The number of exceptions or overrides made to the credit score component of the 

underwriting criteria and the basis for those exceptions or overrides, including any guidance 

given to employees on their ability to depart from credit score underwriting standards, and;

d. Types of monitoring reports generated on the judgmental system or its credit scoring 

component (including front-end, back-end, differential processing, and disparate impact

analysis), and the frequency of generation and recent copies of each.

B. Adverse Action Disclosure Notices

Determine the methodology used to select the reasons why adverse action was taken on a credit 

application denied on the basis of the applicant’s credit score. Compare the methodology used to the 

examples recited in the Commentary to Regulation B and decide acceptability against that standard. 

Identify any consumer requests for reconsideration of credit score denial reasons and review the action 

taken by management for consistency across applicant groups.

Where a credit score is used to differentiate application processing and an applicant is denied for failure 

to attain a judgmental underwriting standard that would not be applied if the applicant had received a 

better credit score (thereby being considered in a different – presumably less stringent – application 

processing group), ensure that the adverse action notice also discloses the bases on which the applicant 

failed to attain the credit score required for consideration in the less stringent processing group.

C. Disparate Treatment in the Application of Credit Scoring 

Programs

1. Determine what controls and policies management has implemented to ensure that the 

institution’s credit scoring models or credit score criteria are not applied in a discriminatory 

manner, in particular:

a. Examine institution guidance on using the credit scoring system, on handling overrides, and 

on processing applicants and how well that guidance is understood and observed by the 

targeted employees and monitored for compliance by management; and 

b. Examine institution policies that permit overrides or that provide for different processing or 

underwriting requirements based on geographic identifiers or borrower score ranges to 

assure that they do not treat protected group applicants differently than other similarly 

situated applicants.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 14

2. Evaluate whether any of the bases for granting credit to control group applicants who are lowside overrides are applicable to any prohibited basis denials whose credit score was equal to or 

greater than the lowest score among the low-side overrides. If such cases are identified, obtain 

and evaluate management’s reason for why such different treatment is not a fair lending 

violation.

3. Evaluate whether any of the bases for denying credit to any prohibited basis applicants who are 

high side overrides are applicable to any control group approvals whose credit score was equal 

to or less than the highest score among the prohibited basis high-side overrides. If such cases are 

identified, obtain and evaluate management’s reason for why such different treatment is not a 

fair lending violation.

4. If credit scores are used to segment applicants into groups that receive different processing or 

are required to meet additional underwriting requirements (e.g., “tiered risk underwriting”), 

perform a comparative file review, or confirm the results and adequacy of management’s 

comparative file review, that evaluates whether all applicants within each group are treated 

equally.

D. Disparate Impact and Credit Scoring Algorithms

Consult with agency supervisory staff to assess potential disparate treatment issues relating to the credit 

scoring algorithm.

E. Credit Scoring Systems That Include Age

Regulation B expressly requires the initial validation and periodic revalidation of a credit scoring 

system that considers age. There are two ways a credit scoring system can consider age: 1) the system 

can be split into different scorecards depending on the age of the applicant and 2) age may be directly 

scored as a variable. Both features may be present in some systems. Regulation B requires that all credit 

scoring systems that consider age in either of these ways must be validated (in the language of the 

regulation, empirically derived, demonstrably and statistically sound (EDDSS)). 

1. Age-Split Scorecards: If a system is split into only two cards and one card covers a wide age 

range that encompasses elderly applicants (applicants 62 or older), the system is treated as 

considering, but not scoring, age. Typically, the younger scorecard in an age-split system is used 

for applicants under a specific age between 25 and 30. It de-emphasizes factors such as the 

number of trade lines and the length of employment and increases the negative weight of any 

derogatory information on the credit report. Systems such as these do not raise the issue of 

assigning a negative factor or value to the age of an elderly applicant. However, if age is 

directly scored as a variable (whether or not the system is age-split) or if elderly applicants are 

included in a card with a narrow age range in an age-split system, the system is treated as 

scoring age. 
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 15

2. Scorecards that Score Age: If a scorecard scores age directly, in addition to meeting the EDDSS 

requirement, the creditor must ensure that the age of an elderly applicant is not assigned a 

negative factor or value. (See the staff commentary about 12 CFR 202.2(p) and 202.6(b)(2)). A 

negative factor or value means utilizing a factor, value, or weight that is less favorable than the 

creditor’s experience warrants or is less favorable than the factor, value, or weight assigned to 

the most favored age group below the age of 62 (12 CFR 202.2(v)).

F. Examination for Empirical Derivation and Statistical 

Soundness

Regulation B requires credit scoring systems that use age to be empirically derived and demonstrably 

and statistically sound. This means that they must fulfill the requirements of 12 CFR Section

202.2(p)(1)(i)(iv). Obtain documentation provided by the developer of the system and consult your 

agency’s most recent guidance for making that determination.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 16

III. Evaluating Responses to Evidence of Disparate 

Treatment

A. Responses to Comparative Evidence of Disparate 

Treatment 

The following are responses that an institution may offer – separately or in combination – to attempt to

explain that the appearance of illegal disparate treatment is misleading and that no violation has in fact 

occurred. The responses, if true, may rebut the appearance of disparate treatment. You must evaluate 

the validity and credibility of the responses.

1. The institution’s personnel were unaware of the prohibited basis identity of the applicant(s).

If the institution claims to have been unaware of the prohibited basis identity (race, etc.) of an 

applicant or neighborhood, ask it to show that the application in question was processed in such a 

way that the institution’s staff could not have learned the prohibited basis identity of the applicant. 

If the product is one for which the institution maintains prohibited basis monitoring information, 

assume that all employees could have taken those facts into account. Assume the same when there 

was face-to-face contact between any employee and the consumer. 

If there are other facts about the application from which an ordinary person would have recognized 

the applicant’s prohibited basis identity (for example, the surname is an easily recognizable 

Hispanic one), assume that the institution’s staff drew the same conclusions. If the racial character 

of a community is in question, ask the institution to provide persuasive evidence why its staff would 

not know the racial character of any community in its service area.

2. The difference in treatment was justified by differences in the applicants (applicants not 

“similarly situated”).

Ask the institution to account for the difference in treatment by pointing out a specific difference 

between the applicants’ qualifications or some factor not captured in the application, but that 

legitimately makes one applicant more or less attractive to the institution or some nonprohibited 

factor related to the processing of their applications. The difference identified by the institution 

must be one that is important enough to justify the difference in treatment in question, not a 

meaningless difference.

The factors commonly cited to show that applicants are not similarly situated fall into two groups: 

those that can be evaluated by how consistently they are handled in other transactions, and those 

that cannot be evaluated in that way.

a. Verifying “not similarly situated” explanations by consistency

The appearance of disparate treatment remains if a factor cited by the institution to justify 

favorable treatment for a control group applicant also exists for an otherwise similar prohibited 

basis applicant who was treated unfavorably. Similarly, the appearance of disparate treatment 

remains if a factor cited by the institution to justify unfavorable treatment for a prohibited basis 

applicant also exists for a control group applicant that got favorable treatment. If this is not so, 

ask the institution to document that the factor cited in its explanation was used consistently for 

control group and prohibited basis applicants.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 17

Among the responses that should be evaluated this way are:

 Consumer relationship. Ask the institution to document that a consumer relationship 

was also sometimes considered to the benefit of prohibited basis applicants and/or that 

its absence worked against control group consumers. 

 “Loan not saleable or insurable.” If file review is still in progress, be alert for loans 

approved despite the claimed fatal problem. At a minimum, ask the institution to be able 

to produce the text of the secondary market or insurer’s requirement in question.

 Difference in standards or procedures between branches or underwriters. Ask the 

institution to provide transactions documenting that each of the two branches or 

underwriters applied its standards or procedures consistently to both prohibited basis and 

control group applications it processed and that each served similar proportions of the 

prohibited basis group.

 Difference in applying the same standard (difference in “strictness”) between 

underwriters, branches, etc. Ask the institution to provide transactions documenting 

that the stricter employee, branch, etc., was strict for both prohibited basis and control 

group applicants and that the other was lenient for both and that each served similar 

proportions of the prohibited basis group. The best evidence of this would be prohibited 

basis applicants who received favorable treatment from the lenient branch and control 

group applicants who received less favorable treatment from the “strict” branch. 

 Standards or procedures changed during period reviewed. Ask the institution to 

provide transactions documenting that during each period the standards were applied 

consistently to both prohibited basis and control group applicants.

 Employee misunderstood standard or procedure. Ask the institution to provide 

transactions documenting that the misunderstanding influenced both prohibited basis and 

control group applications. If that is not available, find no violation if the 

misunderstanding is a reasonable mistake.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 18

b. Evaluating “not similarly situated” explanations by other means.

If consistency cannot be evaluated, consider an explanation favorably even without examples of 

its consistent use if:

 The factor is documented to exist in (or be absent from) the transactions, as claimed by 

the institution.

 The factor is one a prudent institution would consider and is consistent with the 

institution’s policies and procedures.

 File review found no evidence that the factor is applied selectively on a prohibited basis 

(in other words, the institution’s explanation is “not inconsistent with available 

information”).

 The institution’s description of the transaction is generally consistent and reasonable.

Some factors that may be impossible to compare for consistency are:

 Unusual underwriting standard. Ask the institution to show that the standard is 

prudent. If the standard is prudent and not inconsistent with other information, accept 

this explanation even though there is no documentation that it is used consistently.

 “Close calls.” The institution may claim that underwriters’ opposite decisions on 

similar applicants reflect legitimate discretion that you should not second guess. That is 

not an acceptable explanation for identical applicants with different results, but is 

acceptable when the applicants have differing strengths and weaknesses that different 

underwriters might reasonably weigh differently. However, do not accept the 

explanation if other files reveal that these “strengths” or “weaknesses” are counted or 

ignored selectively on a prohibited basis.

 “Character loan.” Expect the institution to identify a specific history or specific facts 

that make the applicant treated favorably a better risk than those treated less favorably.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 19

 “Accommodation loan.” There are many legitimate reasons that may make a 

transaction appealing to an institution apart from the familiar qualifications demanded 

by the secondary market and insurers. For example, a consumer may be related to or 

referred by an important consumer, be a political or entertainment figure who would 

bring prestige to the institution, be an employee of an important business consumer, etc. 

It is not illegal discrimination to make a loan to an otherwise unqualified control group 

applicant who has such attributes while denying a loan to an otherwise similar prohibited 

basis applicant without them. However, be skeptical when the institution cites reasons 

for “accommodations” that an ordinary prudent institution would not value.

 “Gut feeling.” Be skeptical when institutions justify an approval or denial by a general 

perception or reaction to the consumer. Such a perception or reaction may be linked to a 

racial or other stereotype that legally must not influence credit decisions. Ask whether 

any specific event or fact generated the reaction. Often, the institution can cite 

something specific that made him or her confident or uncomfortable about the 

consumer. There is no discrimination if it is credible that the institution indeed 

considered such a factor and did not apply it selectively on a prohibited basis.

c. Follow up consumer contacts

If the institution’s explanation of the handling of a particular transaction is based on consumer 

traits, actions, or desires not evident from the file, consider obtaining agency authorization to 

contact the consumer to verify the institution’s description. Such contacts need not be limited to 

possible victims of discrimination, but can include control group applicants or other witnesses.

3. The different results stemmed from an inadvertent error.

If the institution claims an identified error such as miscalculation or misunderstanding caused the 

favorable or unfavorable result in question, evaluate whether the facts support the assertion that 

such an event occurred.

If the institution claims an “unidentified error” caused the favorable or unfavorable result in 

question, expect the institution to provide evidence that discrimination is inconsistent with its 

demonstrated conduct, and therefore that discrimination is the less logical interpretation of the 

situation. Consider the context (as described below). 

4. The apparent disparate treatment on a prohibited basis is a misleading portion of a larger pattern 

of random inconsistencies.

Ask the institution to provide evidence that the unfavorable treatment is not limited to the 

prohibited basis group and that the favorable treatment is not limited to the control group. Without 

such examples, do not accept an institution’s unsupported claim that otherwise inexplicable 

differences in treatment are distributed randomly. 

If the institution can document that similarly situated prohibited basis applicants received the 

favorable treatment in question approximately as frequently and in comparable degree as the 

control group applicants, conclude there is no violation.

NOTE: Transactions are relevant to “random inconsistency” only if they are “similarly situated” to 

those apparently treated unequally. 
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 20

5. Loan terms and conditions.

The same analyses described in the preceding sections with regard to decisions to approve or deny 

loans also apply to pricing differences. Risks and costs are legitimate considerations in setting 

prices and other terms and conditions of loan products. However, generalized reference by the 

institution to “cost factors” is insufficient to explain pricing differences. 

If the institution claims that specific borrowers received different terms or conditions because of 

cost or risk considerations, ask the institution to be able to identify specific risk or cost differences 

between them.

If the institution claims that specific borrowers received different terms or conditions because they 

were not similarly situated as negotiators, consider whether application records might provide 

relevant evidence. If the records are not helpful, consider seeking authorization to contact 

consumers to learn whether the institution in fact behaved comparably toward prohibited basis and 

control group consumers. The contacts would be to learn such information as the institution’s 

opening quote of terms to the consumer and the progress of the negotiations.

If the institution responds that an average price difference between the control and prohibited basis 

groups is based on cost or risk factors, ask it to identify specific risk or cost differences between 

individual control group applicants with the lowest rates and prohibited basis group applicants with 

the highest that are significant enough to justify the pricing differences between them. If the 

distinguishing factors cited by the institution are legitimate and verifiable as described in the 

sections above, remove those applications from the average price calculation. If the average prices 

for the remaining control group and prohibited basis group members still differ more than 

minimally, consult with agency supervisory staff about further analysis. Findings or violations 

based on disparate treatment or disparate impact regarding cost or risk factors should be discussed 

with agency supervisory staff.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 21

B. Responses to Overt Evidence of Disparate Treatment

1. Descriptive references vs. lending considerations 

A reference to race, gender, etc., does not constitute a violation if it is merely descriptive – for 

example, “the applicant was young.” In contrast, when the reference reveals that the prohibited 

factor influenced the institution’s decisions and/or consumer behavior, treat the situation as an 

apparent violation to which the institution must respond.

2. Personal opinions vs. lending considerations 

If an employee involved with credit availability states unfavorable views regarding a racial group, 

gender, etc., but does not explicitly relate those views to credit decisions, review that employee’s 

credit decisions for possible disparate treatment of the prohibited basis group described 

unfavorably. If there are no instances of apparent disparate treatment, treat the employee’s views as 

permissible private opinions. Inform the institution that such views create a risk of future violations.

3. Stereotypes related to credit decisions

There is an apparent violation when a prohibited factor influences a credit decision through a 

stereotype related to creditworthiness, even if the action based on the stereotype seems wellintended – for example, a loan denial because “a single woman could not maintain a large house.” If 

the stereotyped beliefs are offered as “explanations” for unfavorable treatment, regard such 

unfavorable treatment as apparent illegal disparate treatment. If the stereotype is only a general 

observation unrelated to particular transactions, review that employee’s credit decisions for possible 

disparate treatment of the prohibited basis group in question. Inform the institution that such views 

create a risk of future violations.

4. Indirect reference to a prohibited factor 

If negative views related to creditworthiness are described in nonprohibited terms, consider whether 

the terms would commonly be understood as surrogates for prohibited terms. If so, treat the 

situation as if explicit prohibited basis terms were used. For example, an institution’s statement that 

“It’s too risky to lend north of 110th Street” might be reasonably interpreted as a refusal to lend 

because of race if that portion of the institution’s lending area north of 110th Street were 

predominantly black and the area south white.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 22

5. Lawful use of a prohibited factor

a. Special Purpose Credit Program (SPCP)

If an institution claims that its use of a prohibited factor is lawful because it is operating an 

SPCP, ask the institution to document that its program conforms to the requirements of 

Regulation B. An SPCP must be defined in a written plan that existed before the institution 

made any decisions on loan applications under the program. The written plan must:

 Demonstrate that the program will benefit persons who would otherwise be denied credit 

or receive credit on less favorable terms.

 State the time period the program will be in effect or when it will be re-evaluated.

No provision of an SPCP should deprive people who are not part of the target group of rights or 

opportunities they otherwise would have. Qualified programs operating on an otherwiseprohibited basis will not be cited as a violation.

NOTE: Advise the institution that an agency finding that a program is a lawful SPCP is not 

absolute security against legal challenge by private parties. Suggest that an institution concerned 

about legal challenge from other quarters use exclusions or limitations that are not prohibited by 

ECOA or the FHAct, such as “first-time home buyer.”

b. Second review program

Such programs are permissible if they do no more than ensure that lending standards are applied 

fairly and uniformly to all applicants. For example, it is permissible to review the proposed 

denial of applicants who are members of a prohibited basis group by comparing their 

applications to the approved applications of similarly qualified individuals who are in the 

control group to determine if the applications were evaluated consistently.

Ask the institution to demonstrate that the program is a safety net that merely attempts to 

prevent discrimination, and does not involve underwriting terms or practices that are 

preferential on a prohibited basis. 

Statements indicating that the mission of the program is to apply different standards or efforts 

on behalf of a particular racial or other group constitute overt evidence of disparate treatment. 

Similarly, there is an apparent violation if comparative analysis of applicants who are processed 

through the second review and those who are not discloses dual standards related to the 

prohibited basis.

c. Affirmative marketing/advertising program:

Affirmative advertising and marketing efforts that do not involve application of different 

lending standards are permissible under both the ECOA and the FHAct. For example, special 

outreach to a minority community would be permissible.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 23

IV. Fair Lending Sample Size Tables

Table A: Underwriting (Accept/Deny) Comparisons

Sample 1 Sample 2

 

 Prohibited Basis Denials Control Group Approvals

Number of 

Denials or 

Approvals

5 - 50 51 - 150 > 150 20 - 50 51 – 250 > 250

Minimum to 

review: All 51 75 20 51 100

Maximum 

to review: 50 100 150

5x prohibited 

basis sample 

(up to 50)

5x prohibited 

basis sample

(up to 125)

5x prohibited

basis sample

(up to 300)

Table B: Terms and Conditions Comparisons

Sample 1 Sample 2

 Prohibited Basis Approvals Control Group Approvals

Number of 

Approvals 5-25 26 - 100 > 100 20 -50 51 – 250 > 250

Minimum to 

review: All 26 50 20 40 60

Maximum 

to review: 25 50 75

5x prohibited 

basis sample 

(up to 50)

5x prohibited 

basis sample

(up to 75)

5x prohibited

basis sample

(up to 100)

See Explanatory Notes on following page.

Explanatory Notes to Sample Size Tables

1. Examiners should not follow Table B when conducting a pricing review that involves a regression 

analysis. Consult with agency supervisory staff for specific protocol in these cases.

2. When performing both underwriting and terms and conditions comparisons, use the same control 

group approval sample for both tasks.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 24

3. If there are fewer than five prohibited basis denials or 20 control group approvals, refer to “Sample 

Size” instructions in the procedures.

4. “Minimum” and “maximum” sample sizes: select a sample size between the minimum and 

maximum numbers identified above. Examiners should base the size of their review on the level of 

risk identified during the preplanning and scoping procedures. Once the sample size has been 

determined, select individual transactions judgmentally. Refer to procedures.

5. If two prohibited basis groups (e.g., black and Hispanic) are being compared against one control 

group, select a control group that is five times greater than the larger prohibited basis group sample, 

up to the maximum.

6. Where the institution’s discrimination risk profile identifies significant discrepancies in 

withdrawal/incomplete activity between control and prohibited basis groups or where the number of 

marginal prohibited basis group files available for sampling is small, an examiner may consider 

supplementing samples by applying the following rules:

• If prohibited basis group withdrawals/incompletes occur after the applicant has received an 

offer of credit that includes pricing terms, this is a reporting error under Regulation C (the 

institution should have reported the application as approved, but not accepted) and therefore 

these applications should be included as prohibited basis group approvals in a terms and 

conditions comparative file analysis.

• If prohibited basis group incompletes occur due to lack of an applicant response with respect 

to an item that would give rise to a denial reason, then include them as denials for that 

reason when conducting an underwriting comparative file analysis. 
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 25

V. Identifying Marginal Transactions

These procedures are intended to assist an examiner in identifying denied and approved applications 

that were not either clearly qualified or unqualified, i.e., marginal transactions. 

A. Marginal Denials

Denied applications with any or all the following characteristics are “marginal.” Such denials are 

compared to marginal approved applications. Marginal denied applications include those that:

• Were close to satisfying the requirement that the adverse action notice said was the reason for 

denial.

• Were denied by the institution’s rigid interpretation of inconsequential processing requirements.

• Were denied quickly for a reason that normally would take a longer time for an underwriter to 

evaluate.

• Involved an unfavorable subjective evaluation of facts that another person might reasonably have 

interpreted more favorably (for example, whether late payments actually showed a “pattern” or 

whether an explanation for a break in employment was “credible”).

• Resulted from the institution’s failure to take reasonable steps to obtain necessary information.

• Received unfavorable treatment as the result of a departure from customary practices or stated 

policies. For example, if it is the institution’s stated policy to request an explanation of derogatory 

credit information, a failure to do so for a prohibited basis applicant would be a departure from 

customary practices or stated policies even if the derogatory information seems to be egregious.

• Were similar to an approved control group applicant who received unusual consideration or service, 

but were not provided such consideration or service.

• Received unfavorable treatment (for example, were denied or given various conditions or more 

processing obstacles), but appeared fully to meet the institution’s stated requirements for favorable 

treatment (for example, approval on the terms sought).

• Received unfavorable treatment related to a policy or practice that was vague, and/or the file lacked 

documentation on the applicant’s qualifications related to the reason for denial or other factor.

• Met common secondary market or industry standards even though failing to meet the institution’s 

more rigid standards.

• Had a strength that a prudent institution might believe outweighed the weaknesses cited as the basis 

for denial.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 26

• Had a history of previously meeting a monthly housing obligation equivalent to or higher than the 

proposed debt.

• Were denied for an apparently “serious” deficiency that might easily have been overcome. For 

example, an applicant’s total debt ratio of 50 percent might appear grossly to exceed the institutions 

guideline of 36 percent, but this may in fact be easily corrected if the application lists assets to pay 

off sufficient nonhousing debts to reduce the ratio to the guideline, or if the institution were to count 

excluded part-time earnings described in the application.

B. Marginal Approvals

Approved applications with any or all of the following characteristics are “marginal.” Such approvals 

are compared to marginal denied approved applications. Marginal approvals include those:

• Whose qualifications satisfied the institution’s stated standard, but very narrowly.

• That bypassed stated processing requirements (such as verifications or deadlines).

o For which stated creditworthiness requirements were relaxed or waived.

• That, if the institution’s own standards are not clear, fell short of common secondary market or 

industry lending standards.

• That a prudent conservative institution might have denied.

• Whose qualifications were raised to a qualifying level by assistance, proposals, counteroffers, 

favorable characterizations, or questionable qualifications, etc.

• That in any way received unusual service or consideration that facilitated obtaining the credit.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 27

VI. Potential Scoping Information

As part of the scoping process described in Part I of the procedures, you will need to gather documents 

and information to sufficiently identify their focal points for review. Below is a list of suggested 

information that you may wish to gather internally, as well as from the institution itself. 

A. Internal Agency Documents and Records

1. Previous examination reports and related work papers for the most recent Compliance/CRA 

and Safety and Soundness Examinations.

2. Complaint Information.

3. Demographic data for the institution’s community. 

Comment: The examiner should obtain the most recent agency demographic data for information on 

the characteristics of the institution’s assessment/market areas.

B. Information from the Institution

Comment: Prior to beginning a compliance examination, the examiner should request the 

institution to provide the information outlined below. This request should be made far enough in 

advance of the on-site phase of the examination to facilitate compliance by the institution. In 

some institutions, the examiner may not be able to review some of this information until the onsite examination. The examiner should generally request only those items that correspond to the 

product(s) and time period(s) being examined.

1. Institution’s Compliance Program. (For examinations that will include analysis of the 

institution’s compliance program.)

a. Organization charts identifying those individuals who have lending responsibilities or 

compliance, HMDA, or CRA responsibilities, together with job descriptions for each position.

b. Lists of any pending litigation or administrative proceedings concerning fair lending matters.

c. Results of self-evaluations or self-tests (where the institution chooses to share the self-test 

results), and copies of audit or compliance reviews of the institution’s program for compliance 

with fair lending laws and regulations, including both internal and independent audits.

NOTE: The request should advise the institution that it is not required to disclose the report or 

results of any self-tests of the type protected under amendments to ECOA and the FHAct 

programs.

d. Complaint file.

e. Any written or printed statements describing the institution’s fair lending policies and/or 

procedures. 

f. Training materials related to fair lending issues including records of attendance.

g. Records detailing policy exceptions or overrides, exception reporting, and monitoring processes.

2. Lending Policies / Loan Volume
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 28

a. Internal underwriting guidelines and lending policies for all consumer and commercial loan 

products. 

Comment: If guidelines or policies differ by branch or other geographic location, request copies 

of each variation.

b. A description of any credit scoring system(s) in use now or during the exam period.

Comment: Inquire as to whether a vendor or in-house system is used; the date of the last 

verification; the factors relied on to construct any in-house system; and, if applicable, any 

judgmental criteria used in conjunction with the scoring system.

c. Pricing policies for each loan product, and for both direct and indirect loans.

Comment: The institution should be specifically asked whether its pricing policies for any loan 

products include the use of “overages”. The request should also ask whether the institution 

offers any “subprime” loan products or otherwise uses any form of risk-based pricing. A 

similar inquiry should be made regarding the use of any cost-based pricing. If any of these 

three forms are or have been in use since the last exam, the institution should provide pricing 

policy and practice details for each affected product, including the institution’s criteria for 

differentiating between each risk or cost level and any policies regarding overages. Regarding 

indirect lending, the institution should be asked to provide any forms of agreement (including 

compensation) with brokers/dealers, together with a description of the roles that both the 

institution and the dealer/broker play in each stage of the lending process. 

d. A description of each form of compensation plan for all lending personnel and managers.

e. Advertising copy for all loan products.

f. The most recent HMDA LAR, including unreported data if available. 

Comment: The integrity of the institution’s HMDA LAR data should be verified prior to the 

pre-examination analysis. 

g. Any existing loan registers for each non-HMDA loan product.

Comment: Loan registers for the three-month period preceding the date of the examination, 

together with any available lists of declined loan applicants for the same period should be 

requested. Registers or lists should contain, to the extent available, the complete name and 

address of loan applicants and applicable loan terms, including loan amount, interest rate, fees, 

repayment schedule, and collateral codes.

h. A description of any application or loan-level databases maintained, including a description of 

all data fields within the database or that can be linked at the loan level.

i. Forms used in the application and credit evaluation process for each loan product. 

Comment: At a minimum, this request should include all types of credit applications, forms 

requesting financial information, underwriter worksheets, any form used for the collection of 

monitoring information, and any quality control or second-review forms or worksheets.

j. Lists of service providers. 
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 29

Comment: Service providers may include: brokers, realtors, real estate developers, appraisers, 

underwriters, home improvement contractors, and private mortgage insurance companies. 

Request the full name and address and geographic area served by each provider. Also request 

documentation of any fair lending requirements imposed on, or commitments required of, any 

of the institution’s service providers.

k. Addresses of any Internet site(s).

Comment: Internet “home pages” or similar sites that an institution may have on the Internet 

may provide information concerning the availability of credit, or means for obtaining it. All 

such information must comply with the nondiscrimination requirements of the fair lending laws. 

In view of the increasing capability to conduct transactions on the Internet, it is extremely

important for examiners to review an institution’s Internet sites to ensure that all of the 

information or procedures set forth therein are in compliance with any applicable provisions of 

the fair lending statutes and regulations. 

3. Community Information

a. Demographic information prepared or used by the institution.

b. Any fair lending complaints received and institution responses thereto.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 30

VII. Special Analyses

These procedures are intended to assist examiners who encounter disproportionate adverse impact 

violations, discriminatory pre-application screening and possible discriminatory marketing. 

A. Disproportionate Adverse Impact Violations

When all five conditions below exist, consult within your agency to determine whether to present the 

situation to the institution and solicit the institution’s response. Note that condition 5 can be satisfied by 

either of two alternatives.

The contacts between examiners and institutions described in this section are information-gathering 

contacts within the context of the examination and are not intended to serve as the formal notices and 

opportunities for response that an agency’s enforcement process might provide. Also, the five 

conditions are not intended as authoritative statements of the legal elements of a disproportionate 

adverse impact proof of discrimination; they are paraphrases intended to give you practical guidance on 

situations that call for more scrutiny and on what additional information is relevant.

NOTE: Even if it appears likely that a policy or criterion causes a disproportionate adverse impact on a 

prohibited basis (condition 3), consult agency supervisory staff if the policy or criterion is obviously

related to predicting creditworthiness and is used in a way that is commensurate with its relationship to 

creditworthiness or is obviously related to some other basic aspect of prudent lending, and there appears 

to be no equally effective alternative for it. Examples are reliance on credit reports or use of debt-toincome ratio in a way that appears consistent with industry standards and with a prudent evaluation of 

credit risk. 

Conditions

1. A specific policy or criterion is involved. 

The policy or criterion suspected of producing a disproportionate adverse impact on a prohibited 

basis should be clear enough that the nature of action to correct the situation can be determined. 

NOTE: Gross HMDA denial or approval rate disparities are not appropriate for disproportionate 

adverse impact analysis because they typically cannot be attributed to a specific policy or criterion. 

2. The policy or criterion on its stated terms is neutral for prohibited bases. 

3. The policy or criterion falls disproportionately on applicants or borrowers in a prohibited basis 

group. 

The difference between the rate at which prohibited basis group members are harmed or excluded 

by the policy or criterion and the rate for control group members must be large enough that it is 

unlikely that it could have occurred by chance. If there is reason to suspect a significant 

disproportionate adverse impact may exist, consult with agency supervisory staff, as appropriate.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 31

4. There is a causal relationship between the policy or criterion and the adverse result. 

The link between the policy or criterion and the harmful or exclusionary effect must not be 

speculative. It must be clear that changing or terminating the policy or criterion would reduce the 

disproportion in the adverse result.

5. Either a or b:

a. The policy or criterion has no clear rationale, appears to exist merely for convenience or to 

avoid a minimal expense, or is far removed from common sense or standard industry 

underwriting considerations or lending practices. 

The legal doctrine of disproportionate adverse impact provides that the policy or criterion that 

causes the impact must be justified by “business necessity” if the institution is to avoid a 

violation. There is very little authoritative legal interpretation of that term with regard to 

lending, but that should not stop examiners from making the preliminary inquiries called for in 

these procedures. For example, the rationale is generally not clear for basing credit decisions on 

factors such as location of residence, income level (per se rather than relative to debt), and 

accounts with a finance company. If prohibited basis group applicants were denied loans more 

frequently than control group applicants because they failed an institution’s minimum income 

requirement, it would appear that the first four conditions plus 5a existed; therefore, the 

examiners should consult within your agency about obtaining the institution’s response, as 

described in the next section below. 

b. Alternatively, even if there is a sound justification for the policy, it appears that there may be an 

equally effective alternative for accomplishing the same objective with a smaller 

disproportionate adverse impact.

The law does not require an institution to abandon a policy or criterion that is clearly the most 

effective method of accomplishing a legitimate business objective. However, if an alternative 

that is approximately equally effective is available that would cause a less severe impact, the 

policy or criterion in question will be a violation.

At any stage of the analysis of possible disproportionate adverse impact, if there appears to be 

such an alternative, and the first four conditions exist, consult within the agency how to evaluate 

whether the alternative would be equally effective and would cause a less severe impact. If the 

conclusion is that it would, solicit a response from the institution, as described in the next 

section. 
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 32

Obtaining the institution’s response

If the first four conditions plus either 5a or 5b appear to exist, consult with agency supervisory staff 

about whether and how to inform the institution of the situation and solicit the institution’s business 

justification. The communication with the institution may include the following:

• The specific neutral policy or criterion that appears to cause a disproportionate adverse impact.

• How the examiners learned about the policy.

• How widely the examiners understand it to be implemented.

• How strictly they understand it to be applied.

• The prohibited basis on which the impact occurs.

• The magnitude of the impact.

• The nature of the injury to individuals.

• The data from which the impact was computed.

The communication should request that the institution provide any information supporting the business 

justification for the policy and request that the institution describe any alternatives it considered before 

adopting the policy or criterion at issue. 

Evaluating and following up on the response

The analyses of “business necessity” and “less discriminatory alternative” tend to converge because of 

the close relationship of the questions of what purpose the policy or criterion serves and whether it is 

the most effective means to accomplish that purpose. 

Evaluate whether the institution’s response persuasively contradicts the existence of the significant 

disparity or establishes a business justification. Consult with agency supervisory staff as appropriate.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 33

B. Discriminatory Pre-application Screening

Obtain an explanation for any:

• Withdrawals by applicants in prohibited basis groups without documentation of consumer intent 

to withdraw.

• Denials of applicants in prohibited basis groups without any documentation of applicant 

qualifications; or 

• On a prohibited basis, selectively quoting unfavorable terms (for example, high fees or down 

payment requirements) to prospective applicants, or quoting unfavorable terms to all 

prospective applicants but waiving such terms for control group applicants. (Evidence of this 

might be found in withdrawn or incomplete files.)

• Delays between application and action dates on a prohibited basis.

If the institution cannot explain the situations, examiners should consider obtaining authorization from 

their agency to contact the consumers to verify the institution’s description of the transactions. 

Information from the consumer may help determine whether a violation occurred.

In some instances, such as possible “prescreening” of applicants by institution personnel, the results of 

the procedures discussed so far, including interviews with consumers, may be inconclusive in 

determining whether a violation has occurred. In those cases, examiners should, if authorized by their

agency, consult with agency supervisory staff regarding the possible use of “testers” who would pose as 

apparently similarly situated applicants, differing only as to race or other applicable prohibited basis 

characteristic, to determine and compare how the institution treats them in the application process. 

C. Possible Discriminatory Marketing 

1. Obtain full documentation of the nature and extent, together with management’s explanation, of 

any:

• Prohibited basis limitations stated in advertisements.

• Code words in advertisements that convey prohibited limitations.

• Advertising patterns or practices that a reasonable person would believe indicate prohibited 

basis consumers are less desirable or are only eligible for certain products.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 34

2. Obtain full documentation as to the nature and extent, together with management’s explanation, 

for any situation in which the institution, despite the availability of other options in the market:

• Advertises only in media serving either minority or nonminority areas of the market.

• Markets through brokers or other agents that the institution knows, or could reasonably be 

expected to know, to serve only one racial or ethnic group in the market.

• Utilizes mailing or other distribution lists or other marketing techniques for prescreened or other 

offerings of residential loan products* that:

 Explicitly exclude groups of prospective borrowers on a prohibited basis; 

 Exclude geographies (e.g., census tracts, ZIP codes, etc.) within the institution’s 

marketing area that have demonstrably higher percentages of minority group residents 

than does the remainder of the marketing area, but which have income and other creditrelated characteristics similar to the geographies that were targeted for marketing; or 

 Offer different products to such geographies, especially if subprime products are 

primarily marketed to racial or ethnic minorities.

*NOTE: Pre-screened solicitation of potential applicants on a prohibited basis does not 

violate ECOA. Such solicitations are, however, covered by the FHAct. Consequently, 

analysis of this form of potential marketing discrimination should be limited to 

residential loan products.

3. Evaluate management’s response particularly with regard to the credibility of any 

nondiscriminatory reasons offered as explanations for any of the foregoing practices. Refer to 

the Evaluating Responses to Evidence of Disparate Treatment section in this Appendix for 

guidance.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 35

VIII. Using Self-Tests and Self-Examinations to 

Streamline the Examination

Institutions may find it advantageous to conduct self-tests or self-evaluations to measure or monitor 

their compliance with ECOA and Regulation B. A self-test is any program, practice, or study that is 

designed and specifically used to assess the institution’s compliance with fair lending laws that creates 

data not available or derived from loan, application, or other records related to credit transactions (12 

CFR 202.15(b)(1) and 24 CFR 100.140-100.148). For example, using testers to determine whether 

there is disparate treatment in the pre-application stage of credit shopping may constitute a self-test. 

The information set forth in 12 CFR 202.15(b)(2) and 24 CFR 100.142(a) is privileged unless an 

institution voluntarily discloses the report or results or otherwise forfeits the privilege. A selfevaluation, while generally having the same purpose as a self-test, does not create any new data or 

factual information, but uses data readily available in loan or application files and other records used in 

credit transactions and, therefore, does not meet the self-test definition. 

Examiners should not request any information privileged under 12 CFR 202.15(b)(2) and 24 CFR

100.142(a), related to self-tests. If the institution discloses the results of any self-tests, or has performed 

any self-evaluations, and examiners can confirm the reliability and appropriateness of the self-tests or -

evaluations (or even parts of them), they need not repeat those tasks. 

NOTE: When the term self-evaluation is used below, it is meant to include self-tests where the 

institution has voluntarily disclosed the report or results.

If the institution has performed a self-evaluation of any of the product(s) selected for examination, 

obtain a copy thereof and proceed through the remaining steps of this section on Streamlining the 

Examination. 

Determine whether the research and analysis of the planned examination would duplicate the 

institution’s own efforts. If the answers to Questions A and B below are both Yes, each successive Yes 

answer to Questions C through L indicates that the institution’s work up to that point can serve as a 

basis for eliminating examination steps.

If the answer to either Question A or B2 is No, the self-evaluation cannot serve as a basis for 

eliminating examination steps. However, you should still consider the self-evaluation to the degree 

possible in light of the remaining questions and communicate the findings to the institution so that it 

can improve its self-evaluation process.
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 36

A. Did the transactions covered by the self-evaluation occur not longer than two years ago prior 

to the examination? If the self-evaluation covered more than two years prior to the 

examination, incorporate only results from transactions in the most recent two years.

B. Did it cover the same product, prohibited basis, decision center, and stage of the lending 

process (for example, underwriting, setting of loan terms) as the planned examination?

C. Did the self-evaluation include comparative file review? 

NOTE: One type of “comparative file review” is statistical modeling to determine whether 

similar control group and prohibited basis group applicants were treated similarly. If an 

institution offers self-evaluation results based on a statistical model, consult appropriately 

within your agency.

D. Were control and prohibited basis groups defined accurately and consistently with ECOA 

and/or the FHAct?

E. Were the transactions selected for the self-evaluation chosen so as to focus on marginal 

applicants or, in the alternative, selected randomly?

F. Were the data analyzed (whether abstracted from files or obtained from electronic 

databases) accurate? Were those data actually relied on by the credit decision makers at the 

time of the decisions? 

To answer these two questions and Question G for the institution’s control group sample and 

each of its prohibited basis group samples, request to review 10 percent (but not more than 50 

for each group) of the transactions covered by the self-evaluation. For example, if the 

institution’s self-evaluation reviewed 250 control group and 75 prohibited basis transactions, 

plan to verify the data for 25 control group and seven prohibited basis transactions.

G. Did the 10 percent sample reviewed for Question F also show that consumer assistance and 

institution judgment that assisted or enabled applicants to qualify were recorded 

systematically and accurately and were compared for differences on any prohibited bases?

H. Were prohibited basis group applicants’ qualifications related to the underwriting factor in 

question compared to corresponding qualifications of control group approvals? Specifically, 

for self-evaluations of approve/deny decisions, were the denied applicants’ qualifications 

related to the stated reason for denial compared to the corresponding qualifications for 

approved applicants?

I. Did the self-evaluation sample cover at least as many transactions at the initial stage of 

review as examiners would initially have reviewed using the sampling guidance in these 

procedures?

If the institution’s samples are significantly smaller than those in the sampling guidance but its 

methodology otherwise is sound, review additional transactions until the numbers of reviewed 

control group and prohibited basis group transactions equal the minimums for the initial stage of 

review in the sampling guidance.

J. Did the self-evaluation identify instances in which prohibited basis group applicants were 

treated less favorably than control group applicants who were no better qualified?
CFPB Consumer 

Laws and Regulations IFLP

CFPB Interagency Fair Lending Procedures IFL APX 37

K. Were explanations solicited for such instances from the persons responsible for the 

decisions?

L. Were the reasons cited by credit decision makers to justify or explain instances of apparent 

disparate treatment supported by legitimate, persuasive facts or reasoning?

If the questions above are answered Yes, incorporate the findings of the self-evaluation (whether 

supporting compliance or violations) into the examination findings. Indicate that those findings are 

based on verified data from the institution’s self-evaluation. In addition, consult appropriately within 

your agency regarding whether or not to conduct corroborative file analyses in addition to those 

performed by the institution.

If not all of the questions in the section above are answered Yes, resume the examination procedures at 

the point where the institution’s reliable work would not be duplicated. In other words, use the reliable 

portion of the self-evaluation and correspondingly reduce independent comparative file review by 

examiners. For example, if the institution conducted a comparative file review that compared 

applicants’ qualifications without taking account of the reasons they were denied, the examiners could 

use the qualification data abstracted by the institution (if accurate), but would have to construct 

independent comparisons structured around the reasons for denial. 
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 1

Home Mortgage Disclosure Act

Background and Summary

The Home Mortgage Disclosure Act (HMDA) was enacted by the Congress in 1975 and is 

implemented by Regulation C (12 CFR Part 203).1 The period of 1988 through 1992 saw 

substantial changes to HMDA. Especially significant were the amendments to the act resulting 

from the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA). 

Coverage was expanded in the FIRREA amendments to include many independent 

nondepository mortgage lenders, in addition to the previously covered banks, savings 

associations, and credit unions. Coverage of independent mortgage bankers was further 

expanded effective January 1, 1993, with the implementation of amendments contained in the 

Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA). For a more 

detailed discussion of the history of HMDA, see the FFIEC’s website at 

www.ffiec.gov/hmda/history2.htm.

HMDA grew out of public concern over credit shortages in certain urban neighborhoods. The 

Congress believed that some financial institutions had contributed to the decline of some 

geographic areas by their failure to provide adequate home financing to qualified applicants on 

reasonable terms and conditions. Thus, one purpose of HMDA and Regulation C is to provide 

the public with information that will help show whether financial institutions are serving the 

housing credit needs of the neighborhoods and communities in which they are located. A second 

purpose is to aid public officials in targeting public investments from the private sector to areas 

where they are needed. Finally, the FIRREA amendments of 1989 require the collection and 

disclosure of data about applicant and borrower characteristics to assist in identifying possible 

discriminatory lending patterns and enforcing antidiscrimination statutes.

As the name implies, HMDA is a disclosure law that relies upon public scrutiny for its 

effectiveness. It does not prohibit any specific activity of lenders, and it does not establish a 

quota system of mortgage loans to be made in any Metropolitan Statistical Area (MSA) or other 

geographic area as defined by the Office of Management and Budget. 

Financial institutions must report data regarding loan originations, applications, and loan 

purchases, as well as requests under a preapproval program (as defined in Section 203.2(b)) if 

the preapproval request is denied or results in the origination of a home purchase loan. HMDA 

requires lenders to report the ethnicity, race, gender, and gross income of mortgage applicants 

 1 Dodd-Frank Act, Pub. L. No. 111-203, §§ 1001 – 1100H, 124 Stat. 1955, 1955-2113 (2010), granted HMDA 

rulemaking, supervision, and enforcement authority to the Consumer Financial Protection Bureau (CFPB). Before 

the CFPA, the Federal Reserve Board had rulemaking authority for Regulation C. These procedures will be further 

modified in the future to reflect, as appropriate, the transfer of certain authorities from the Federal Reserve Board to the CFPB on 

July 21, 2011, effected by the Dodd-Frank Act.
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 2

and borrowers. Lenders must also report information regarding the pricing of the loan and 

whether the loan is subject to the Home Ownership and Equity Protection Act, 15 U.S.C. 1639. 

Additionally, lenders must identify the type of purchaser for mortgage loans that they sell. The 

Dodd-Frank Act requires that the CFPB amend Regulation C to require the reporting of 

additional data fields. Financial institutions will be required to comply with the additional 

reporting requirements after those amendments are finalized.

Regulation C requires institutions to report lending data to their supervisory agencies on a loanby-loan and application-by-application basis by way of a “register” reporting format. The 

supervisory agencies, through the Federal Financial Institutions Examination Council (FFIEC), 

compile this information in the form of individual disclosure statements for each institution, and 

in the form of aggregate reports for all covered institutions within each MSA. In addition, the 

FFIEC produces other aggregate reports that show lending patterns by median age of homes and 

by the central city or non-central city location of the property. The public may obtain the 

individual disclosures and aggregate reports from the FFIEC or from central depositories located 

in each MSA. Individual disclosure statements may also be obtained from financial institutions. 

Applicability 

The regulation covers two categories of financial institutions. The first category is a “depository 

institution,” which the regulation defines as a bank, savings association, or a credit union that 

meets the following criteria:

• On the preceding December 31, had assets in excess of the annually published asset 

threshold;

• On the preceding December 31, had a home or branch office in an MSA;

• In the preceding calendar year, originated at least one first-lien home purchase loan (or a 

refinancing of such loan) on a one-to-four-family dwelling; and 

• Meets one of the following criteria: (1) the institution is federally insured or regulated; 

(2) the mortgage loan referred to is federally guaranteed, insured, or supplemented; or 

(3) the institution intended to sell the loan to Fannie Mae or Freddie Mac. 
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 3

The second category is a for-profit, nondepository “mortgage lending institution.” A 

nondepository mortgage lending institution is covered if:

• In the preceding calendar year, it originated home purchase loans (including refinancings 

of home purchase loans) that either: (1) equaled ten percent or more of its loan 

origination volume, measured in dollars; or (2) equaled $25 million or more;

• On the preceding December 31, had a home or branch office in an MSA2; and

• Either: (1) on the preceding December 31, had total assets of more than $10 million, 

counting the assets of any parent corporation; or (2) in the preceding calendar year, 

originated at least 100 home purchase loans, or refinancings of home purchase loans.

For purposes of this discussion and the examination procedures, the term “financial institution” 

will signify both a depository and a nondepository institution. 

The definition of mortgage lending institution changed over time. It now covers mortgage 

lending subsidiaries and independent mortgage companies. Mortgage lending subsidiaries are 

treated as distinct entities from their “parent,” and must file separate reports with their parent’s 

supervisory agency. 

The CFPB may exempt from Regulation C state-chartered or state-licensed financial institutions 

if they are covered by a substantially similar state law that contains adequate provision for 

enforcement by the state. As of January 1, 2009, no exemptions are in effect. 

Compilation of Loan Data 

For each calendar year, a financial institution must report data regarding its applications, 

originations, and purchases of home purchase loans, home improvement loans, and refinancings. 

Loans secured by real estate that are neither refinancings nor made for home purchase or home 

improvements are not reported. Data must also be given for loan applications that did not result 

in originations: applications approved by the institution but not accepted by the applicant, 

denied, withdrawn, or closed for incompleteness. Required reporting also includes certain 

denials of requests for preapproval of a home purchase loan under a program in which a lender 

issues a written commitment to lend to a creditworthy borrower up to a specific amount for a 

specific time. 

Loan Information

For each application or loan, institutions are required to identify the purpose (home purchase, 

home improvement, or refinancing), lien status, and whether the property relating to the loan or 

loan application is to be owner-occupied as a principal dwelling. As defined by Regulation C, a 

 2 The institution may or may not have a physical presence in the MSA per Sec. 203.2(c)(2) of Regulation C. 
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 4

home purchase loan is a loan secured by a dwelling and made for the purpose of purchasing that 

(or another) dwelling. A dwelling is a residential structure that may or may not be attached to 

real property, located in a state, the District of Columbia or the Commonwealth of Puerto Rico. 

It includes an individual condominium or cooperative unit, a mobile or manufactured home, and 

a multifamily structure such as an apartment building. A home improvement loan is defined by 

the regulation as one that is at least in part for the purpose of repairing, rehabilitating, remodeling 

or improving a dwelling or the real property on which the dwelling is located. Home 

improvement loans not secured by a dwelling should be reported only if the institution classifies 

the loan as a home improvement loan, and dwelling secured home improvement loans should be 

reported without regard to classification. Finally, a refinancing is defined as a transaction in 

which a new obligation satisfies and replaces an existing obligation by the same borrower. For 

coverage purposes (i.e., to determine whether or not an institution is covered by HMDA), the 

existing obligation must be a home purchase loan and both the new and existing obligation must 

be secured by first liens on dwellings. For reporting purposes, both the existing obligation and 

the new obligations must be secured by liens on dwellings. 

In addition, the regulation requires financial institutions to identify the following general loan 

types: conventional, FHA-insured, VA-guaranteed, and FSA/RHS guaranteed. Institutions must 

report the property type as a one-to-four family dwelling, multifamily dwelling, or manufactured 

housing. The amount of the loan or loan application, application date, action date, and the type 

of action taken must also be reported. 

Property Location

Certain geographic location information must be reported by financial institutions for loans on, 

and applications for, properties in any MSA where the institution has a home or branch office.3

 

This geographic data is optional for loans on properties located outside these MSAs or outside 

any MSA, except in the case of large financial institutions subject to additional data reporting 

requirements under the Community Reinvestment Act (CRA). The geographic information 

consists of the MSA or MD number, state and county codes, and the census tract number of the 

property to which the loan or loan application relates. 

Large institutions subject to both the CRA and HMDA must collect and report geographic 

information for all loans and applications (whether located in an MSA or not), not just for loans 

and applications relating to property in MSAs where the institution has a home or branch office.4 

Under the CRA, a large institution is a bank or savings association that has assets of $1 billion or 

more. 

 3 In the case of an MSA divided into Metropolitan Divisions (MDs), the relevant unit for this purpose is the MD.

4 In a county with less than 30,000 in population, the institution may enter NA.
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 5

Applicant Information

In addition, institutions must report data regarding the ethnicity, race, sex, and annual income of 

applicants for applications and originated loans; reporting these data is optional for purchased 

loans. Information regarding the ethnicity, race, and the sex of the borrower or applicant must be 

requested by the lender, including for applications made entirely by telephone, mail, or Internet. 

If the information is not provided by the applicant and if the application is submitted in person, 

the lender is required to note the information on the basis of visual observation or surname. 

Regulation C contains a model form that can be used for the collection of data on ethnicity, race, 

and sex. Alternatively, the form used to obtain monitoring information under 12 C.F.R. § 202.13 

of Regulation B (Equal Credit Opportunity) may be used. 

If an institution originates or purchases a loan and then sells it in the same calendar year, it must 

report the type of entity that purchased the loan. Except in the case of large secondary market 

purchasers such as Fannie Mae and Freddie Mac, the exact purchaser need not be identified. For 

example, an institution may indicate that it had sold a loan to a bank, without identifying the 

particular bank. 

Pricing-Related Data

Institutions must report the rate spread between the annual percentage rate (APR) and the 

average prime offer rate for a comparable transaction as of the date the interest rate is set, if the 

spread is equal to or greater than 1.5 percentage points for first-lien loans, or equal to or greater 

than 3.5 percentage points for subordinate-lien loans.5 The rate-spread reporting is required only

on originations of home purchase loans, dwelling-secured home improvement loans, and 

refinancings. The following are excluded from the rate-spread reporting requirement: (1) 

applications that are incomplete, withdrawn, denied, or approved but not accepted; (2) purchased 

loans; (3) home-improvement loans not secured by a dwelling; (4) assumptions; (5) home equity 

lines of credit; and (6) loans not subject to Regulation Z. To determine the applicable rate 

spread, the financial institution may use the table published on the FFIEC’s website 

(www.ffiec.gov/hmda) entitled “Average Prime Offer Rates Tables.” 

 5 Lenders will use the new rate spread reporting test on loans for which applications are taken on and after October 

1, 2009, and for all loans consummated on or after January 1, 2010 (regardless of their application dates). For loans 

for which applications were taken before October 1, 2009, and that are consummated in 2009, the revised rules do 

not apply. Lenders will apply the existing rate spread reporting test, using Treasury security yield benchmarks, for 

those loans. For loans for which applications were taken before October 1, 2009, and that are consummated in 2010 

or later, the revised rules apply.
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 6

Lenders must also report whether the loan is subject to the Home Ownership and Equity 

Protection Act (HOEPA), 15 U.S.C. 1639. A loan becomes subject to HOEPA when the APR or 

the points and fees on the loan exceed the HOEPA triggers. (Additional information on HOEPA 

coverage is found in the FFIEC Truth in Lending Act and HOEPA examination procedures.)

Lenders must also report the lien status of the loan or application (first lien, subordinate lien, or 

not secured by a lien on a dwelling).

Optional Data 

Finally, under HMDA financial institutions may report the reasons for denying a loan 

application.6 Institutions may also choose to report certain requests for pre-approval that are 

approved by the institution but not accepted by the applicant and home equity lines of credit 

made in whole or in part for the purpose of home improvement or home purchase. 

Excluded Data 

A financial institution should not report loan data for: 

• Loans originated or purchased by the institution acting as trustee or in some other fiduciary 

capacity; 

• Loans on unimproved land; 

• Temporary financing (such as bridge or construction loans); 

• The purchase of an interest in a pool of loans (such as mortgage-participation certificates); 

• The purchase of mortgage loan servicing rights; or

• Loans originated prior to the current reporting year and acquired as part of a merger or 

acquisition or acquisition of all the assets and liabilities of a branch office.

 6 Financial institutions regulated by the OCC, including subsidiaries of national banks and savings associations, are 

required to provide reasons for denials. Credit unions regulated by the NCUA are also required to provide reasons 

for denial. These requirements are imposed by the respective prudential regulator for these institutions pursuant to 

laws within their jurisdiction. Apparent violations of these requirements should be referred to the applicable 

prudential regulator. 
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 7

Reporting Format 

Financial institutions are required to record data regarding each application for, and each 

origination and purchase of, home purchase loans, home improvement loans, and refinancings on 

a Loan/Application Register, also known as the HMDA-LAR. Financial institutions are also 

required to record data regarding requests under a preapproval program (as defined in § 

203.2(b)), but only if the preapproval request is denied or results in the origination of a home 

purchase loan. Transactions are to be reported for the year in which final action was taken. If a 

loan application is pending at the end of the calendar year, it will be reported on the HMDALAR for the following year, when the final disposition is made. Loans originated or purchased 

during the calendar year must be reported for the calendar year of origination even if they were 

subsequently sold.

The HMDA-LAR is accompanied by a listing of codes to be used for each entry on the form. 

Detailed instructions and guidance on the requirements for the register are contained in 

Appendix A to Regulation C. Additional information is available in the FFIEC publication, “A 

Guide to HMDA Reporting: Getting it Right!” and on the FFIEC website.

Financial institutions must record data on their HMDA-LAR within 30 calendar days of the end 

of the calendar quarter in which final action was taken. Financial institutions, however, have 

flexibility in determining how to maintain the HMDA-LAR since the entries need not be grouped 

in any prescribed fashion. For example, an institution could record home purchase loans on one 

HMDA-LAR and home improvement loans on another; alternatively, both types of loans could 

be reported on one register. Similarly, separate registers may be kept at each branch office, or a 

single register may be maintained at a centralized location for the entire institution. These 

separate registers must be combined into one consolidated register when submitted to the 

relevant supervisory agency. 

For each calendar year, a financial institution must submit to its supervisory agency its HMDALAR, accompanied by a Transmittal Sheet. Unless it has 25 or fewer reportable transactions, an 

institution is required to submit its data in automated form. For registers submitted in paper 

form, two copies must be mailed to the institution’s supervisory agency. For both automated and 

hard-copy submissions, the layout of the register that is used must conform exactly to that of the 

register published by the Federal Reserve Board as Appendix A to Regulation C. 

The HMDA-LAR must be submitted to the financial institution’s regulatory agency by March 1 

following the calendar year covered by the data. The FFIEC then will produce a disclosure 

statement for each institution, cross-tabulating the individual loan data in various groupings, as 

well as an aggregate report for each MSA. The FFIEC posts these disclosure statements at 

www.ffiec.gov/hmda. Disclosure statements are no longer mailed to financial institutions.
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 8

Disclosure 

As the result of amendments to HMDA incorporated within the Housing and Community 

Development Act of 1992, an institution must make its disclosure statement available to the 

public at its home office within three business days after it is posted on the FFIEC website. An 

institution must also either (1) make its disclosure statement available to the public in at least one 

branch office in each additional MSA or MD where it has offices within ten business days of its 

posting on the FFIEC website, or (2) post the address for requests in each branch office in each 

additional MSA or MD where it has offices, and send the disclosure statement within 15 calendar 

days after receiving a written request. 

Also, an institution must make its loan application register available to the public after deleting 

the following fields: application or loan number, date application received, and date of action 

taken. These deletions are required to protect the privacy interests of applicants and borrowers. 

The modified HMDA-LAR for a given year must be publicly available by March 31 of the 

following year for requests received on or before March 1, and within 30 days for requests 

received after March 1.

The FFIEC also produces aggregate tables to illustrate the lending activity of all covered 

financial institutions in each MSA or MD. These tables and the individual disclosure statements 

are available on the FFIEC website, www.ffiec.gov/hmda, and through central depositories, such 

as libraries, in each MSA or MD. A list of the depositories is also available on the FFIEC 

website. 

A financial institution must retain its full (unmodified) HMDA-LAR for at least three years for 

examination purposes. It must also be prepared to make each modified HMDA-LAR available 

for three years and each FFIEC disclosure statement available for five years. Institutions may 

impose reasonable fees for costs incurred in providing or producing the data for public release. 

Finally, institutions must post a notice at their home office and at each branch in an MSA, to 

advise the public of the availability of the disclosure statements. 
CFPB Consumer

Laws and Regulations HMDA

CFPB HMDA 9

Enforcement 

As set forth in Section 305 of HMDA (12 U.S.C. 2804),7 compliance with the act and regulation 

is enforced by the CFPB, Office of the Comptroller of the Currency, the Board of Governors of 

the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit 

Union Administration, and the U.S. Department of Housing and Urban Development. 

Administrative sanctions, including civil money penalties, may be imposed by the supervisory 

agencies. 

An error in compiling or recording loan data is not a violation of the act or the regulation if it 

was unintentional and occurred despite the maintenance of procedures reasonably adopted to 

avoid such errors.

References

Laws

12 USC 2801 et seq. Home Mortgage Disclosure Act

Regulations

Federal Reserve Board Regulations (12 CFR)

Part 203 Home Mortgage Disclosure (Regulation C)

 7 As amended by Dodd-Frank Act § 1094, 124 Stat. 2097-2101 (2010).
CFPB 

Examination Procedures HMDA

CFPB HMDA 1

Home Mortgage 

Disclosure Act

Examination Objectives 

• To appraise the quality of the financial institution’s compliance risk management system to 

ensure compliance with the Home Mortgage Disclosure Act (HMDA) and Regulation C. 

• To determine the reliance that can be placed on the financial institution’s compliance risk 

management system, including internal controls, policies, procedures, and compliance 

review and audit functions for the Home Mortgage Disclosure Act and Regulation C. 

• To determine the accuracy and timeliness of the financial institution’s submitted HMDALAR.

• To initiate corrective action when policies or internal controls are deficient, or when 

violations of law or regulation are identified.

Examination Procedures 

A. Initial Procedures

1. If the financial institution is a depository institution, determine whether it is subject to the 

requirements of HMDA and Regulation C by checking if the regulatory criteria addressed 

in Sections 203.2(e)(1)(i) - 203.2(e)(1)(iv) are met.

[Click&type]

2. If the financial institution is a for-profit nondepository mortgage-lending institution, 

determine whether it is subject to the requirements of HMDA and Regulation C by 

checking if the regulatory criteria addressed in Sections 203.2(e)(2)(i) - 203.2(e)(2)(iii) 

are met.

[Click&type]

3. If there were any mergers or acquisitions since January 1, of the preceding calendar year, 

determine whether all required HMDA data for the acquired financial institutions were 

reported separately or in consolidation. Examination procedures that follow concerning 

accuracy and disclosure also apply to an acquired financial institution’s data, even if 

separately reported. Use the following rules to decide if transactions by either institution 

during the year of the merger must be reported. 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Procedures HMDA

CFPB HMDA 2

a. If neither institution was required to report under HMDA that year the merged 

institution does not have to report transactions that occurred during the year of the 

merger. Data collection should begin on January 1, of the following calendar year.

b. If a reporting institution merged with a non-reporting institution, and the reporting 

institution is the surviving institution, for the year of the merger, data collection is 

required for the reporting institution’s transactions; data collection is optional for the 

transactions handled in offices of the previously exempt non-reporting institution.

c. If a reporting institution merged with a non-reporting institution, and the nonreporting institution is the surviving institution, or a new institution is formed, for the 

year of the merger, data collection is required for the reporting institution for 

transactions that occurred prior to the merger; data collection is optional for 

transactions that occurred after the merger date.

d. If both institutions were HMDA reporters, data collection is required for the entire 

year of the merger. The merged institution may file either a consolidated submission 

or separate submissions.

[Click&type]

NOTE: If HMDA and Regulation C are applicable, then the following examination procedures 

should be performed separately for the financial institution and any of its majority-owned 

mortgage subsidiaries. Complete a separate checklist for each institution subject to HMDA and 

Regulation C. Also, when determining whether a financial institution is subject to HMDA, the 

examiner should remain cognizant of any newly created MSAs and changes in MSA boundaries, 

including counties that may have been added or deleted from an MSA, thus causing a financial 

institution either to become a new HMDA reporter or no longer be a HMDA reporter. Refer to 

the FFIEC’s website and to the booklet, “A Guide to HMDA Reporting: Getting It Right!” This 

can be a source of reference, as it lists counties in an MSA by state.

B. Evaluation of Compliance Management 

Examiners should obtain information necessary to make a reasonable assessment regarding the 

institution’s ability to collect data regarding applications for, and originations and purchases of, 

home purchase loans, home improvement loans, and refinancings for each calendar year in 

accordance with the requirements of the HMDA and Regulation C.

Examiners should determine, through a review of written policies, internal controls, the HMDA 

Loan Application Register (HMDA-LAR), and discussions with management, whether the 

financial institution adopted and implemented comprehensive procedures to ensure adequate 

compilation of home mortgage disclosure information in accordance with Section 203.4(a)-(e). 
CFPB 

Examination Procedures HMDA

CFPB HMDA 3

During your review of the financial institution’s system for maintaining compliance with HMDA 

and Regulation C obtain and review policies and procedures along with any applicable audit and 

compliance program materials to determine whether:

1. Policies and procedures as well as training are adequate, on an ongoing basis, to ensure

compliance with the Home Mortgage Disclosure Act and Regulation C.

2. Internal review procedures and audit schedules comprehensively cover all of the pertinent 

regulatory requirements associated with HMDA and Regulation C.

3. The audits or internal analysis performed include a reasonable amount of transactional 

analysis, written reports that detail findings and recommendations for corrective actions.

4. Internal reviews include any regulatory changes that may have occurred since the prior 

examination. 

5. The financial institution has assigned one or more individuals responsibility for oversight, 

data update, and data entry, along with timeliness of the financial institution’s data 

submission. Also determine whether the Board of Directors is informed of the results of 

all analyses. 

6. The individuals who have been assigned responsibility for data entry receive appropriate 

training in the completion of the HMDA-LAR and receive copies of Regulation C, 

Instructions for Completion of the HMDA-LAR (Appendix A), the Staff Commentary to 

Regulation C, and the FFIEC’s “Guide to HMDA Reporting: Getting it Right!” in a 

timely manner.

7. The institution has ensured effective corrective action in response to previously identified 

deficiencies.

8. The financial institution performs HMDA-LAR volume analysis from year-to-year to 

detect increases or decreases in activity for possible omissions of data.

9. The financial institution maintains documentation for those loans it packages and sells to 

other institutions.

[Click&type]
CFPB 

Examination Procedures HMDA

CFPB HMDA 4

C. Evaluation of Policies and Procedures

Evaluate whether the institution’s informal procedures and internal controls are adequate to 

ensure compliance with HMDA and Regulation C. Consider the following:

1. Whether the individual(s) assigned responsibility for the institution’s compliance with 

HMDA and Regulation C possess(es) an adequate level of knowledge and has established 

a method for staying abreast of changes to laws and regulations.

2. If the institution ensures that individuals assigned compliance responsibilities receive 

adequate training to ensure compliance with the requirements of the regulation.

3. Whether the individuals assigned responsibility for the institution’s compliance with 

HMDA and Regulation C know whom to contact, at the financial institution or their 

supervisory agency, if they have questions not answered by the written materials.

4. If the institution has established and implemented adequate controls to ensure that 

separation of duties exists (e.g., data entry, review, oversight, and approval).

5. Any internal reports or records documenting policies and procedures revisions as well as 

any informal self-assessment of the institution’s compliance with the regulation.

6. If the institution offers preapprovals, whether the institution’s preapproval program meets 

the specifications detailed in the HMDA regulation. If so, whether the institution’s 

policies and procedures provide adequate guidance for the reporting of preapproval 

requests that are approved or denied in accordance with the regulation.

7. Whether the institution’s policies and procedures address the reporting of (1) nondwelling secured loans that are originated in whole or in part for home improvement and 

classified as such by the institution; and (2) dwelling-secured loans that are originated in 

whole or in part for home improvement, whether or not classified as such.

8. Whether the institution established a method for determining and reporting the lien status 

for all originated loans and applications.

9. Whether the institution’s policies and procedures contain guidance for collecting 

ethnicity, race, and sex for all loan applications, including applications made by 

telephone, mail, and Internet.

10. Whether the institution’s policies and procedures address the collection of the rate spread 

(difference between the APR and the average prime offer rate for a comparable 

transaction as of the date the interest rate is set) and whether the institution has 

established a system for tracking rate lock dates and calculating the rate spread.
CFPB 

Examination Procedures HMDA

CFPB HMDA 5

11. Whether the institution’s policies and procedures address how to determine if a loan is 

subject to the Home Ownership and Equity Protection Act and the reporting of 

applications involving manufactured home loans.

12. Whether the HMDA-LAR is updated within 30 days after the end of each calendar 

quarter.

13. Whether data are collected at all branches, and if so, whether the appropriate personnel 

are sufficiently trained to ensure that all branches are reporting data under the same 

guidelines.

14. Whether the financial institution’s loan officers, including loan officers in the commercial 

loan department who may handle loan applications reportable under HMDA (including 

loans and applications for multi-family or mixed-use properties and small business 

refinances secured by residential real estate), are informed of the reporting requirements 

necessary to assemble the information.

15. Whether the Board of Directors has established an independent review of the policies, 

procedures, and HMDA data to ensure compliance and accuracy, and is advised each 

year of the accuracy and timeliness of the financial institution’s data submissions.

16. What procedures the institution has put in place to comply with the requirement to submit 

data in machine-readable form and whether the institution has some mechanism in place 

to ensure the accuracy of the data that are submitted in machine-readable form.

17. Whether the financial institution’s loan officers are familiar with the disclosure, reporting 

and retention requirements associated with the loan application registers and the FFIEC 

public disclosure statements.

18. Whether the financial institution’s loan officers are familiar with the disclosure 

statements that will be produced from the data.

19. Whether the financial institution’s loan officers are aware that civil money penalties may 

be imposed when an institution has submitted erroneous data and has not established 

adequate procedures to ensure the accuracy of the data.

20. Whether the financial institution’s loan officers are aware that correction and 

resubmission of erroneous data may be required when data are incorrectly reported for 

at least 5 percent of the loan application records.

[Click&type]
CFPB 

Examination Procedures HMDA

CFPB HMDA 6

D. Transaction Testing

Verify that the financial institution accurately compiled home mortgage disclosure information 

on a register in the format prescribed in Appendix A, by testing a sample of loans and 

applications.

The review of the HMDA-LAR, for submitted data, should include a sample of the applications 

represented on the HMDA-LAR to verify the accuracy of each entry. A sample of the current 

year’s data should also be reviewed. The samples may include the following:

1. Approved and denied transactions subject to HMDA.

2. Housing-related purchased loans.

3. Withdrawn housing-related loan applications.

E. Disclosure and Reporting

1. Determine whether the financial institution:

a. Submits its HMDA-LAR to the appropriate supervisory agency no later than March 1 

following the calendar year for which the data are compiled and maintains its 

HMDA-LAR for at least three years thereafter. 

NOTE: Financial institutions that report twenty-five or fewer entries on their HMDALAR may collect and report HMDA data in a paper form. Any financial institution 

opting to submit its data in such a manner must send two copies that are typed or 

computer printed. They must use the format of the HMDA-LAR, but need not use 

the form itself.

b. Makes its FFIEC disclosure statement available to the public at its home office no 

later than three business days after receiving its statement from the FFIEC (which 

effectively occurs when the FFIEC posts its disclosure statement on the FFIEC 

website and provides notice of that fact to the institution).

c. Either (1) makes its FFIEC disclosure statement available to the public in at least one 

branch office in each additional MSA or MD where the financial institution has 

offices within ten business days after receiving the disclosure statement from the 

FFIEC (which effectively occurs when the FFIEC posts the disclosure statement on 

the FFIEC website and provides notice of that fact to the institution); or (2) posts the 

address for sending written requests for the disclosure statement in the lobby of each 

branch office in additional MSAs or MDs where the institution has offices and mails 

or delivers a copy of the disclosure statement within 15 calendar days of receiving the 

written request.
CFPB 

Examination Procedures HMDA

CFPB HMDA 7

d. Makes its modified HMDA-LAR (loan application number, date application received, 

and date action taken excluded from the data) available to the public by March 31, for 

requests received on or before March 1, and within 30 days for requests received after 

March 1.

e. Maintains its modified HMDA-LAR for three years and its disclosure statement for 

five years and has policies and procedures to ensure its modified HMDA-LAR and 

disclosure statement are available to the public during those terms. 

f. Makes available the modified HMDA-LAR and disclosure statement for inspection 

and copying during the hours the office is normally open to the public for business. If 

it imposes a fee for costs incurred in providing or reproducing the data, the fee is 

reasonable. 

g. Posts a general notice about the availability of its HMDA data in the lobby of its 

home office and of each branch office located in an MSA. 

h. Provides promptly upon request the location of the institution’s offices where the 

statement is available for inspection and copying, or includes the location in the lobby 

notice. 

[Click&type]

2. If the financial institution has a subsidiary covered by HMDA, determine that the 

subsidiary completed a separate HMDA-LAR and either submitted it directly or through 

its parent to the parent’s supervisory agency. 

[Click&type]

3. Determine that the HMDA-LAR transmittal sheet is accurately completed and that an 

officer of the financial institution signed and certified to the accuracy of the data 

contained in their register. See Appendix A. 

NOTE: If the HMDA-LAR was submitted via the Internet, this signature should be 

retained on file at the institution.

[Click&type]

4. Review the financial institution’s last disclosure statement, HMDA-LAR, modified

HMDA-LAR, and any applicable correspondence, such as notices of noncompliance. 

Determine what errors occurred during the previous reporting period. If errors did occur, 

determine what steps the financial institution took to correct and prevent such errors in 

the future. 

[Click&type]
CFPB 

Examination Procedures HMDA

CFPB HMDA 8

5. Determine if the financial institution has the necessary tools to compile the geographic 

information. 

a. Determine if the financial institution uses the U.S. Census Bureau’s Census Tract 

Street Address Lookup Resources for 2010, the Census Bureau’s 2000 Census Tract 

Outline Maps,1 LandView 6 equivalent materials available from the Census Bureau or 

from a private publisher, or an automated geocoding system in order to obtain the 

proper census tract numbers.

b. If the financial institution relies on outside assistance to obtain the census tract 

numbers (for example, private “geocoding” services or real estate appraisals), verify 

that adequate procedures are in place to ensure that the census tract numbers are 

obtained in instances where they are not provided by the outside source. For 

example, if the financial institution usually uses property appraisals to determine 

census tract numbers, it must have procedures to obtain this information if an 

appraisal is not received; such as in cases where a loan application is denied before an 

appraisal is made.

c. Verify that the financial institution has taken steps to ensure that the provider of 

outside services is using the appropriate 2000 Census Bureau data.

d. Verify that the financial institution uses current MSA and MD definitions to 

determine the appropriate MSA and MD numbers and boundaries. MSA definitions 

and numbers (and state and county codes) are available from the supervisory agency, 

the Office of Management and Budget, or the FFIEC’s publication “A Guide to 

HMDA Reporting: Getting it Right!”

[Click&type]

6. For banks required to report data on small-business, small-farm, and community 

development lending under the CRA, verify that they also collect accurate data on 

property located outside MSAs or MDs in which the institution has a home or branch 

office, or outside any MSAs or MDs. 

[Click&type]

Examination Conclusions

1. Summarize the findings, supervisory concerns, and regulatory violations.

[Click&type]

 1 Once the 2010 versions are available, the financial institution should use the latest versions.
CFPB 

Examination Procedures HMDA

CFPB HMDA 9

2. For the violations noted, determine the root cause by identifying weaknesses in internal 

controls, audit and compliance reviews, training, management oversight, or other factors; 

also, determine whether the violation(s) are repetitive or systemic.

[Click&type]

3. Identify action needed to correct violations and weaknesses in the institution’s compliance 

system.

[Click&type]

4. Discuss findings with the institution’s management and obtain a commitment for corrective 

action.

[Click&type]
CFPB 

Examination Checklist HMDA

CFPB HMDA 1

Home Mortgage 

Disclosure Act

Applicability 

Depository Institutions 

Yes No

1. Is the depository institution a bank or credit union that originated in the 

preceding calendar year at least one home purchase loan (or refinancing of a 

home purchase loan) secured by a first lien on a one-to-four family dwelling? 

(§203.2(e)(1)(iii))

2. Does the depository institution meet at least one of the criteria below? 

a. The depository institution is a federally insured or regulated institution 

(§203.2(e)(1)(iv)(A)); 

b. The depository institution originated a mortgage loan (reference checklist 

question #1) that was insured, guaranteed, or supplemented by a federal 

agency (§203.2(e)(1)(iv)(B)); or

c. The depository institution originated a mortgage loan (reference checklist 

question #1) intending to sell it to Fannie Mae or Freddie Mac 

(§203.2(e)(1)(iv)(C)).

3. Did the depository institution have either a home or branch office in an MSA 

on December 31, of the preceding calendar year? (§203.2(e)(1)(ii)) 

4. On the preceding December 31, did the depository institution have assets in 

excess of the asset threshold that is adjusted annually and published annually by 

the Federal Reserve Board? (§203.2(e)(1)(i))

If the answers to checklist questions #1 through #4 are “Yes,” then the depository institution is 

subject to the requirements of HMDA and Regulation C, and the examiner should complete the 

remaining portion of the checklist. 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Checklist HMDA

CFPB HMDA 2

For-Profit Non-depository Mortgage-Lending Institutions

Yes No

5. In the preceding calendar year, did the for-profit nondepository mortgagelending institution either:

a. Originate home purchase loans or refinancings of home purchase loans that 

equaled at least 10 percent of its total loan-origination volume, measured in 

dollars? (§203.2(e)(2)(i)(A)) or,

b. Originate home purchase loans or refinancings of home purchase loans that 

equaled at least $25 million? (§203.2(e)(2)(i)(B))

6. Did the for-profit nondepository mortgage-lending institution have a home or 

branch office1 in an MSA as of December 31, of the previous year? 

(§203.2(e)(2)(ii)) and,

7. Does the for-profit nondepository mortgage-lending institution meet at least one 

of the criteria below? (§203.2(e)(2)(iii)) 

a. The for-profit nondepository mortgage-lending institution had total assets 

(when combined with the assets of the parent corporation, if any) exceeding 

$10 million on the previous December 31, or 

b. The for-profit nondepository mortgage-lending institution originated at least 

100 home purchase loans (including refinancings of home purchase loans) 

in the preceding calendar year. 

If the answers to questions #5 through #7 are “Yes,” then the for-profit nondepository mortgagelending institution is subject to the requirements of HMDA and Regulation C. 

Subsidiaries 

8. If one financial institution has a majority interest in another financial institution, and both 

institutions are subject to HMDA and Regulation C, then the examiner should complete a 

separate checklist for each institution beginning with question #9. If only one of the 

institutions is subject to Regulation C and HMDA, the examiner should use the remaining 

portion of this checklist for that institution. The examiner should note to which financial 

institution the remaining checklist questions apply. 

 1 A nondepository institution is deemed to have a branch office in an MSA or MD if, in the preceding calendar year, 

it received applications for, originated, or purchased five or more home purchase loans, home improvement loans, or 

refinancings in that MSA or MD. 
CFPB 

Examination Checklist HMDA

CFPB HMDA 3

Compilation of Loan Data 

Yes No

9. Does the financial institution collect the following data in accordance with 

Section 203.4(a) and Appendix A? 

a. An identifying number (that does not include the applicant’s name or social 

security number) for the loan or loan application, and the date the 

application was received? (§203.4(a)(1))

b. The type of the loan or application? (§203.4(a)(2))

c. The purpose of the loan or application? (§203.4(a)(3))

d. Whether the application is for a preapproval and whether it resulted in a 

denial or an origination. (§203.4(a)(4))

e. The property type to which the loan or application relates? (§203.4(a)(5))

f. The owner-occupancy status of the property to which the loan or application 

relates? (§203.4(a)(6))

g. The loan amount or the amount requested on the application? 

(§203.4(a)(7))

h. The type of action taken? (§203.4(a)(8))

i. The date such action was taken? (§203.4(a)(8))

j. The location of the property to which the loan or application relates by 

(§203.4(a)(9)):

i. MSA or MD number (5 digits)?

ii. State (2 digits)?

iii. County (3 digits)?

iv. Census tract number (6 digits)?

k. The ethnicity and race of the applicant or borrower? (§203.4(a)(10))

l. The ethnicity and race of the co-applicant or co-borrower? (§203.4(a)(10))

m. The sex of the applicant or borrower? (§203.4(a)(10))

n. The sex of the co-applicant or co-borrower? (§203.4(a)(10))

o. The gross annual income relied on in processing the applicant’s request? 

(§203.4(a)(10))
CFPB 

Examination Checklist HMDA

CFPB HMDA 4

NOTE: Collection of data concerning ethnicity, race, and sex is mandatory for all 

transactions unless the financial institution purchased the loans or the borrower is not a 

natural person (a corporation or partnership). Data on annual income is mandatory for all 

transactions unless the financial institution purchased the loan, the borrower is not a natural 

person, the loan is for a multifamily dwelling, income was not relied upon in the credit 

decision, or the loan is to an employee. 

Yes No

p. The type of entity purchasing a loan that the financial institution originates 

or purchases and then sells within the same calendar year? (§203.4(a)(11))

q. For originated loans subject to Regulation Z, the difference between the 

loan’s APR and the average prime offer rate for a comparable transaction as 

of the date the interest is set, if that difference is equal to or greater than 1.5 

percentage points for first lien loans or equal to or greater than 3.5 

percentage points for subordinate lien loans on a dwelling. (§203.4(a)(12))

r. Whether the loan is subject to HOEPA? (§203.4(a)(13))

s. The lien status of the loan or application? (§203.4(a)(14))

t. Does the financial institution provide the reasons for denial of an 

application? (§203.4(c)(1)) If yes, are the reasons accurate?

u. Is the HMDA-LAR updated within 30 calendar days after the end of the 

quarter in which final action is taken? (§203.4(a))

10. Does the institution request ethnicity, race, and sex data for all telephone, mail 

and Internet applications in accordance with Appendix B? (§203.4(b)(1))

11. For applications taken face-to-face, does the financial institution note data 

concerning ethnicity, race, and sex on the basis of visual observation or 

surname if the applicant chooses not to provide this information? 

(§203.4(b)(1))

NOTE: If the applicant fails to provide this information in mail, telephone, or Internet 

applications, the ethnicity, race, and sex are not recorded; instead, an applicable code number 

is provided (ethnicity 3, race 6, and sex 3; NA should not be used for these three situations).

Disclosure and Reporting 

Yes No

12. Is the loan or applicant data presented in the format prescribed in Appendix A 

of the regulation? (§203.4(a))

13. Has the institution reported all applications for, originations of, and purchases 

of home-purchase loans, home-improvement loans, and refinancings? 
CFPB 

Examination Checklist HMDA

CFPB HMDA 5

Yes No

(§203.4(a))

14. Has the financial institution refrained from reporting: (§203.4(d))

a. Loans originated or purchased by the financial institution acting in a 

fiduciary capacity (such as trustee)?

b. Loans on unimproved land?

c. Temporary financing (such as a bridge or construction loan)?

d. Purchase of an interest in a pool of loans (such as mortgage-participation 

certificates, mortgage-backed securities, or real estate mortgage investment 

conduits)?

e. Purchase solely of the right to service loans?

f. Loans originated prior to the current reporting year and acquired as part of a 

merger or acquisition or as part of the acquisition of all assets and liabilities 

of a branch office?

g. A refinancing if, under the loan agreement, the financial institution is 

unconditionally obligated to refinance the obligation, or is obligated to 

refinance the obligation subject to conditions under the borrower’s control? 

(Appendix A, I.A.5a)

15. Did the financial institution submit its completed HMDA-LAR to the 

appropriate supervisory agency in automated machine-readable format by 

March 1 following the calendar year for which the data are compiled? 

(§203.5(a)) 

NOTE: Financial institutions that report twenty-five or fewer entries on their 

HMDA-LAR may collect and report their HMDA data in a paper form. Any 

financial institution opting to submit its data in such a manner must send two 

copies that are typed or computer printed. The institution must use the format of 

the HMDA-LAR, but need not use the form itself.

16. Has an officer of the financial institution signed the HMDA-LAR transmittal 

sheet certifying the accuracy of the data contained in the register? (Appendix A)

17. Is the transmittal sheet accurately completed? (Appendix A)

18. Has the financial institution maintained its HMDA-LAR in its records for at 

least three years? (§203.5(a))

19. Has the financial institution made its FFIEC prepared disclosure statement:

a. Available to the public at its home office no later than three business days 

after receiving it from the FFIEC (which effectively occurs when the FFIEC 
CFPB 

Examination Checklist HMDA

CFPB HMDA 6

Yes No

posts its disclosure statement on the FFIEC website and provides notice of 

that fact to the institution)? and

b. Available within ten business days in at least one branch office in each 

additional MSA or MD where the financial institution has offices or posted 

the address for sending written requests in the lobby of each branch office 

in other MSAs or MDs where the institution has offices and delivered a 

copy of the disclosure statement within fifteen calendar days of receiving a 

written request? (§203.5(b))

20. Has the financial institution made its modified HMDA-LAR (loan application 

number, date application received, and date action taken excluded from the 

data) for the preceding calendar year available to the public, by March 31 for 

requests received on or before March 1, and within 30 days for requests 

received after March 1? (§203.5(c))

21. Has the financial institution maintained its modified HMDA-LAR for three 

years? Does the financial institution have policies and procedures to ensure its 

modified HMDA-LAR is available to the public during that term? (§203.5(d))

22. Has the financial institution maintained its disclosure statement for five years? 

(§203.5(d))

23. Does the financial institution have policies and procedures to ensure its 

disclosure statement is available to the public during that term? (§203.5(d))

24. Does the financial institution make available the modified HMDA-LAR and 

disclosure statement for inspection and copying during the hours the office is 

normally open to the public for business? If it imposes a fee for costs incurred 

in providing or reproducing the data, is it reasonable? (§203.5(d)) 

25. Has the financial institution posted a general notice about the availability of its 

disclosure statement in the lobby of its home office and in each branch office 

located in an MSA? (§203.5(e))

26. Does the institution provide promptly upon request the location of the 

institution’s offices where the statement is available for inspection and copying, 

or include the location in the lobby notice? (§203.5(e))

27. Did errors occur in the previous reporting period? (Review the financial 

institution’s last disclosure statement, HMDA-LAR, modified HMDA-LAR, 

and any applicable correspondence from the regulatory agency, such as notices 

of noncompliance.)

28. If errors did occur, has the financial institution taken appropriate steps to 

correct and prevent such errors in the future?

a. Have individuals who are responsible for all data-entry:
CFPB 

Examination Checklist HMDA

CFPB HMDA 7

Yes No

i. Received appropriate training in the completion of the HMDA-LAR?

ii. Been provided copies of Regulation C, including the instructions for 

completion of the HMDA-LAR, and the “A Guide to HMDA Reporting: 

Getting it Right!?”

iii. Know whom to contact, at the financial institution or the institution’s 

supervisory agency, if they have questions not answered by the written 

materials?

b. Are the financial institution’s loan officers including loan officers in the 

commercial loan department who may handle loan applications for HMDA 

reportable loans (such as multi-family or mixed-use properties and small 

business refinances secured by residential real estate):

i. Informed of the reporting requirements so they can assemble the 

necessary information, and do they understand the importance of 

accuracy?

ii. Familiar with the disclosure statements that are produced from the data 

and cognizant of the ramifications for the financial institution if the data 

are wrong?

iii. Maintain appropriate documentation of the information entered on the 

HMDA-LAR?

c. If data are collected at more than one branch, are the appropriate personnel 

sufficiently trained to ensure that all branches report data using the same 

guidelines?

d. Does the financial institution have internal control processes to ensure that 

the persons who capture and code the data are doing so accurately and 

consistently?

e. Does the financial institution have controls established to ensure separation 

of duties (e.g., data entry, review, oversight approval, etc.)?
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 1

Truth in Lending Act

Background and Summary 

The Truth in Lending Act (TILA), 15 USC 1601 et seq., was enacted on May 29, 1968, as title I of 

the Consumer Credit Protection Act (Pub. L. 90-321). The TILA, implemented by Regulation Z (12 

CFR 226), became effective July 1, 1969. 

The TILA was first amended in 1970 to prohibit unsolicited credit cards. Additional major 

amendments to the TILA and Regulation Z were made by the Fair Credit Billing Act of 1974, the 

Consumer Leasing Act of 1976, the Truth in Lending Simplification and Reform Act of 1980, the 

Fair Credit and Charge Card Disclosure Act of 1988, and the Home Equity Loan Consumer 

Protection Act of 1988. 

Regulation Z also was amended to implement Section 1204 of the Competitive Equality Banking 

Act of 1987 and in 1988 to include adjustable rate mortgage loan disclosure requirements. All 

consumer leasing provisions were deleted from Regulation Z in 1981 and transferred to Regulation 

M (12 CFR 213). 

The Home Ownership and Equity Protection Act of 1994 amended TILA. The law imposed new 

disclosure requirements and substantive limitations on certain closed-end mortgage loans bearing 

rates or fees above a certain percentage or amount. The law also included new disclosure 

requirements to assist consumers in comparing the costs and other material considerations involved 

in a reverse mortgage transaction and authorized the Federal Reserve Board to prohibit specific acts 

and practices in connection with mortgage transactions.

The TILA amendments of 1995 dealt primarily with tolerances for real estate secured credit. 

Regulation Z was amended on September 14, 1996, to incorporate changes to the TILA. 

Specifically, the revisions limit lenders’ liability for disclosure errors in real estate secured loans 

consummated after September 30, 1995. The Economic Growth and Regulatory Paperwork 

Reduction Act of 1996 further amended TILA. The amendments were made to simplify and 

improve disclosures related to credit transactions. 

The Electronic Signatures in Global and National Commerce Act (the E-Sign Act), 15 USC 7001 et 

seq., was enacted in 2000 and did not require implementing regulations. On November 9, 2007, the 

amendments to Regulation Z and the official staff commentary were issued to simplify the 

regulation and provide guidance on the electronic delivery of disclosures consistent with the E-Sign 

Act.

In July 2008, Regulation Z was amended to protect consumers in the mortgage market from unfair, 

abusive, or deceptive lending and servicing practices. Specifically, the change applied protections to 

a newly defined category of “higher priced mortgages” that includes virtually all closed-end 

subprime loans secured by a consumer’s principal dwelling. The revisions also applied new 

protections to mortgage loans secured by a dwelling, regardless of loan price, and required the 

delivery of early disclosures for more types of transactions. The revisions also banned several 

advertising practices deemed deceptive or misleading. The Mortgage Disclosure and Improvement 

Act of 2008 (MDIA) broadened and added to the requirements of the Board’s July 2008 final rule 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 2

by requiring early truth-in-lending disclosures for more types of transactions and by adding a 

waiting period between the time when disclosures are given and consummation of the transaction. 

In 2009, Regulation Z was amended to address those provisions. The MDIA also requires disclosure 

of payment examples if the loan’s interest rate or payments can change, as well as disclosure of a 

statement that there is no guarantee the consumer will be able to refinance in the future. In 2010, 

Regulation Z was amended to address these provisions, which became effective on January 30, 

2011. 

In December 2008, the Board adopted two final rules pertaining to open-end (not home-secured) 

credit. The first rule involved Regulation Z revisions and made comprehensive changes applicable 

to several disclosures required for: applications and solicitations, new accounts, periodic statements, 

change in terms notifications, and advertisements. The second was a rule published under the 

Federal Trade Commission (FTC) Act and was issued jointly with the Office of Thrift Supervision 

and the National Credit Union Administration. It sought to protect consumers from unfair acts or 

practices with respect to consumer credit card accounts. Before these rules became effective, 

however, the Credit Card Accountability Responsibility and Disclosure Act of 2009 (Credit CARD 

Act) amended TILA and established a number of new requirements for open-end consumer credit 

plans. Several provisions of the Credit CARD Act are similar to provisions in the Board’s 

December 2008 TILA revisions and the joint FTC Act rule, but other portions of the Credit CARD

Act address practices or mandate disclosures that were not addressed in these rules. 

The Credit CARD Act provisions are effective in three stages. The provisions effective first 

required creditors to increase the amount of notice consumers receive before the rate on a credit 

card account is increased or a significant change is made to the account’s terms. These amendments 

also allowed consumers to reject such increases and changes by informing the creditor before the 

increase or change goes into effect. The provisions effective next involved rules regarding interest 

rate increases, over-the-limit transactions and student cards. Finally, the provisions effective last 

addressed the reasonableness and proportionality of penalty fees and charges and re-evaluation of 

rate increases.

In 2009, Regulation Z was amended following the passage of the Higher Education Opportunity Act 

(HEOA) by adding disclosure and timing requirements that apply to lenders making private 

education loans.

In 2009, the Helping Families Save Their Homes Act amended TILA to establish a new 

requirement for notifying consumers of the sale or transfer of their mortgage loans. The purchaser 

or assignee that acquires the loan must provide the required disclosures no later than 30 days after 

the date on which it acquired the loan. 

In 2010, the Board further amended Regulation Z to prohibit payment to a loan originator that is 

based on the terms or conditions of the loan, other than the amount of credit extended. The 

amendment applies to mortgage brokers and the companies that employ them, as well as to 

mortgage loan officers employed by depository institutions and other lenders. In addition, the 

amendment prohibits a loan originator from directing or “steering” a consumer to a loan that is not 

in the consumer’s interest to increase the loan originator’s compensation. Separately, the DoddFrank Wall Street Reform and Consumer Protection Act amended TILA to include several 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 3

provisions that protect the integrity of the appraisal process when a consumer’s home is securing the 

loan. The rule also requires that appraisers receive customary and reasonable payment for their 

services. The appraiser and loan originator compensation requirements became effective on April 1, 

2011.1 

The Dodd-Frank Act granted rule-making authority under the TILA to the Consumer Financial 

Protection Bureau (CFPB) and, with respect to entities under its jurisdiction, granted authority to 

the CFPB to supervise for and enforce compliance with TILA and its implementing regulations2 

Format of Regulation Z 

The disclosure rules creditors must follow differ depending on whether the creditor is offering 

open-end credit, such as credit cards or home-equity lines, or closed-end credit, such as car loans or 

mortgages. 

Subpart A (§§ 226.1 through 226.4) of the regulation provides general information that applies to 

open-end and closed-end credit transactions. It sets forth definitions and stipulates which 

transactions are covered and which are exempt from the regulation. It also contains the rules for 

determining which fees are finance charges.

Subpart B (§§ 226.5 through 226.16) of the regulation contains rules for disclosures for homeequity loans, credit and charge card accounts, and other open-end credit. 

Subpart B also covers rules for resolving billing errors, calculating annual percentage rates, credit 

balances, and advertising open-end credit. Special rules apply to credit card transactions only, such 

as certain prohibitions on the issuance of credit cards and restrictions on the right to offset a 

cardholder’s indebtedness. Additional special rules apply to home-equity lines of credit, such as 

certain prohibitions against closing accounts or changing account terms. 

Subpart C (§§ 226.17 through 226.24) includes provisions for closed-end credit. Residential 

mortgage transactions, demand loans, and installment credit contracts, including direct loans by 

financial institutions and purchased dealer paper, are included in the closed-end credit category. 

Subpart C also contains disclosure rules for regular and variable rate loans, refinancings and 

assumptions, credit balances, calculating annual percentage rates, and advertising closed-end credit. 

Subpart D (§§ 226.25 through 226.30), which applies to both open-end and closed-end credit, sets 

forth the duty of creditors to retain evidence of compliance with the regulation. It also clarifies the 

relationship between the regulation and state law, and requires creditors to set a cap for variable rate 

transactions secured by a consumer’s dwelling. 

 

1 These examination procedures do not include final amendments to Regulation Z implementing Dodd Frank Act amendment to 

TILA that increased the threshold for exempt consumer credit transactions from $25,000 to $50,000. This Regulation Z amendment 

became effective on July 21, 2011. 76 FR 18354 (April 4, 2011) These procedures also do not include clarifications to Regulation 

Z’s provisions related to credit cards. 76 FR 22948 (April 25, 2011). CFPB is working with prudential regulators to update 

examination procedures in a uniform manner as appropriate. 

2 Dodd-Frank Act Secs. 1002(12)(O), 1024(b)-(c), and 1025(b)-(c); 12 USC Secs. 5481(12)(O), 5514(b)-(c), and 5515(b)-(c). These 

procedures will be further modified in the future to reflect, as appropriate, the transfer of certain authorities from the Federal Reserve 

Board to the CFPB on July 21, 2011, effected by the Dodd-Frank Act.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 4

Subpart E (§§ 226.31 through 226.36) contains special requirements for mortgages that fit the 

criteria in Section 226.32(a) (“high cost mortgages”), Section 226.33 (a) (“reverse mortgages”) and 

Section 226.35(a) (“higher-priced mortgage loans”), as well as loans secured by a consumer’s 

principal dwelling.

Subpart F (§§ 226.46 through 226.48) includes disclosure and timing requirements that apply to 

creditors making private education loans. It also limits certain practices by creditors including “cobranding” products with educational institutions in the marketing of private student loans. The rule 

requires that creditors obtain a self-certification form signed by the consumer before consummating 

the loan. It also requires creditors with preferred lender arrangements with educational institutions 

to provide certain information to those institutions.

Subpart G (§§ 226.51 through 226.59) relates to credit card accounts under an open-end (not homesecured) consumer credit plan (except for §226.57(c), which applies to all open-end credit plans). 

This subpart contains rules on the evaluation of a consumer’s ability to pay, limits on fees during 

the first year after account opening, and rules on allocation of payments in excess of the minimum 

payment. The subpart also limits increases in the annual percentage rate (APR), fees, and charges, 

and prohibits the assessment of fees for over-the-limit transactions unless the consumer consents. 

There are also rules for reporting and marketing of college student open-end credit, requirements for 

the Internet posting of credit card account agreements under an open-end (not home-secured) 

consumer credit plan, and requirements to reevaluate rate increases.

The appendices to the regulation set forth model forms and clauses that creditors may use when 

providing open-end and closed-end disclosures. The appendices contain detailed rules for 

calculating the APR for open-end credit (appendix F) and closed-end credit (appendixes D and J). 

Appendices K and L provide total annual loan cost rate computations and assumed loan periods for 

reverse mortgage transactions. Appendices M1 and M2 provide guidance for calculating the 

minimum payment repayment estimate.

Official staff interpretations of the regulation are published in a commentary that is normally 

updated annually in March. Good faith compliance with the commentary protects creditors from 

civil liability under the act. In addition, the commentary includes mandates, which are not 

necessarily explicit in Regulation Z, on disclosures or other actions required of creditors. It is 

virtually impossible to comply with Regulation Z without reference to and reliance on the 

commentary.

NOTE: The following narrative does not discuss all the sections of Regulation Z, but rather 

highlights only certain sections of the regulation and the Truth in Lending Act. 

Subpart A - General 

Purpose of the TILA and Regulation Z 

The Truth in Lending Act is intended to ensure that credit terms are disclosed in a meaningful way 

so consumers can compare credit terms more readily and knowledgeably. Before its enactment, 

consumers were faced with a bewildering array of credit terms and rates. It was difficult to compare 

loans because they were seldom presented in the same format. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 5

Now, all creditors must use the same credit terminology and expressions of rates. In addition to 

providing a uniform system for disclosures, the act: 

• Protects consumers against inaccurate and unfair credit billing and credit card practices; 

• Provides consumers with rescission rights; 

• Provides for rate caps on certain dwelling-secured loans; 

• Imposes limitations on home equity lines of credit and certain closed-end home mortgages;

and

• Delineates and prohibits unfair or deceptive mortgage lending practices. 

The TILA and Regulation Z do not, however, tell financial institutions how much interest they may 

charge or whether they must grant a consumer a loan. 

Summary of Coverage Considerations (§§ 226.1 & 226.2)

Lenders must carefully consider several factors when deciding whether a loan requires Truth in 

Lending disclosures or is subject to other Regulation Z requirements. The coverage considerations 

under Regulation Z are addressed in more detail in the commentary to Regulation Z. For example, 

broad coverage considerations are included under Section 226.1(c) of the regulation and relevant 

definitions appear in Section 226.2. 

Exempt Transactions (§226.3)

The following transactions are exempt from Regulation Z: 

• Credit extended primarily for a business, commercial, or agricultural purpose; 3

• Credit extended to other than a natural person (including credit to government agencies or 

instrumentalities); 

• Credit in excess of $25,000 and not secured by real or personal property used as the 

principal dwelling of the consumer; 

• Public utility credit; 

• Credit extended by a broker-dealer registered with the Securities and Exchange Commission 

(SEC) or the Commodity Futures Trading Commission (CFTC), involving securities or 

commodities accounts; 

• Home fuel budget plans; and 

• Certain student loan programs. 

 

3 If a credit card is involved, generally exempt credit (e.g., business or agricultural purpose credit) is still subject to requirements that 

govern the issuance of credit cards and liability for their unauthorized use. Credit cards must not be issued on an unsolicited basis 

and, if a credit card is lost or stolen, the cardholder must not be held liable for more than $50 for the unauthorized use of the card. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 6

When determining whether credit is for consumer purposes, the creditor must evaluate all of the 

following: 

• Any statement obtained from the consumer describing the purpose of the proceeds. 

 For example, a statement that the proceeds will be used for a vacation trip would indicate a 

consumer purpose. 

 If the loan has a mixed purpose (e.g., proceeds will be used to buy a car that will be used 

for personal and business purposes), the lender must look to the primary purpose of the 

loan to decide whether disclosures are necessary. A statement of purpose from the 

consumer will help the lender make that decision. 

 A checked box indicating that the loan is for a business purpose, absent any 

documentation showing the intended use of the proceeds could be insufficient evidence 

that the loan did not have a consumer purpose. 

• The consumer’s primary occupation and how it relates to the use of the proceeds. The higher 

the correlation between the consumer’s occupation and the property purchased from the loan 

proceeds, the greater the likelihood that the loan has a business purpose. For example, 

proceeds used to purchase dental supplies for a dentist would indicate a business purpose. 

• Personal management of the assets purchased from proceeds. The lower the degree of the 

borrower’s personal involvement in the management of the investment or enterprise 

purchased by the loan proceeds, the less likely the loan will have a business purpose. For 

example, money borrowed to purchase stock in an automobile company by an individual 

who does not work for that company would indicate a personal investment and a consumer 

purpose. 

• The size of the transaction. The larger the size of the transaction, the more likely the loan 

will have a business purpose. For example, if the loan is for a $5,000,000 real estate 

transaction, that might indicate a business purpose. 

• The amount of income derived from the property acquired by the loan proceeds relative to 

the borrower’s total income. The lesser the income derived from the acquired property, the 

more likely the loan will have a consumer purpose. For example, if the borrower has an 

annual salary of $100,000 and receives about $500 in annual dividends from the acquired 

property, that would indicate a consumer purpose. 

All five factors must be evaluated before the lender can conclude that disclosures are not necessary. 

Normally, no one factor, by itself, is sufficient reason to determine the applicability of Regulation 

Z. In any event, the financial institution may routinely furnish disclosures to the consumer. 

Disclosure under such circumstances does not control whether the transaction is covered, but can 

assure protection to the financial institution and compliance with the law.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 7

Coverage Considerations under Regulation Z

Regulation Z applies

Regulation Z does not apply, except for the rules of issuance of and 

unauthorized use liability for credit cards. (Exempt credit includes loans with 

a business or agricultural purpose, and certain student loans. Credit extended 

to acquire or improve rental property that is not owner-occupied is 

considered business purpose credit.)

Is the 

purpose of 

the credit 

for 

personal, 

family, or 

household 

use?

Is the 

consumer 

credit 

extended to a 

consumer?

Is the 

consumer 

credit 

extended by 

a creditor?

Is the loan or 

credit plan 

secured by 

real property 

or by the 

consumer’s 

principal 

dwelling?

Is the 

amount 

financed or 

credit limit 

$25,000 or 

less?

Regulation Z does not apply. (Credit that is extended to a land trust is deemed to 

be credit extended to a consumer.)

The institution is not a “creditor” and Regulation Z does not apply unless at least 

one of the following tests is met:

1) The institution extends consumer credit regularly and 

 a) The obligation is initially payable to the institution and

 b) The obligation is either payable by written agreement in more than four 

installments or is subject to a finance charge.

2) The institution is a card issuer that extends closed-end credit that is subject to a 

finance charge or is payable by written agreement in more than four installments.

3) The institution is not the card issuer, but it imposes a finance charge at the time 

of honoring a credit card.

(NOTE: All persons, including noncreditors, must comply with the advertising 

provisions of Regulation Z.)

Regulation Z does not apply, but may apply later if the loan is 

refinanced for $25,000 or less. If the principal dwelling is taken 

as collateral after consummation, rescission rights will apply 

and, in the case of open-end credit, billing disclosures and 

other provisions of Regulation Z will apply.

No

Yes

No

Yes

No

Yes

No No

Yes Yes
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 8

Determination of Finance Charge and APR 

Finance Charge (Open-End and Closed-End Credit) (§ 226.4)

The finance charge is a measure of the cost of consumer credit represented in dollars and cents. 

Along with APR disclosures, the disclosure of the finance charge is central to the uniform credit 

cost disclosure envisioned by the TILA. 

The finance charge does not include any charge of a type payable in a comparable cash transaction. 

Examples of charges payable in a comparable cash transaction may include taxes, title, license fees, 

or registration fees paid in connection with an automobile purchase. 

Finance charges include any charges or fees payable directly or indirectly by the consumer and 

imposed directly or indirectly by the financial institution either as an incident to or as a condition of 

an extension of consumer credit. The finance charge on a loan always includes any interest charges 

and often, other charges. Regulation Z includes examples, applicable both to open-end and closedend credit transactions, of what must, must not, or need not be included in the disclosed finance 

charge (§ 226.4(b)). 

Accuracy Tolerances (Closed-End Credit) 

(§§ 226.18(d) & 226.23(h))

Regulation Z provides finance charge tolerances for legal accuracy that should not be confused with 

those provided in the TILA for reimbursement under regulatory agency orders. As with disclosed 

APRs, if a disclosed finance charge were legally accurate, it would not be subject to reimbursement. 

Under TILA and Regulation Z, finance charge disclosures for open-end credit must be accurate 

since there is no tolerance for finance charge errors. However, both TILA and Regulation Z permit 

various finance charge accuracy tolerances for closed-end credit. 

Tolerances for the finance charge in a closed-end transaction are generally $5 if the amount 

financed is less than or equal to $1,000 and $10 if the amount financed exceeds $1,000. Tolerances 

for certain transactions consummated on or after September 30, 1995, are noted below. 

• Credit secured by real property or a dwelling (closed-end credit only): 

 The disclosed finance charge is considered accurate if it does not vary from the actual 

finance charge by more than $100. 

 Overstatements are not violations. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 9

• Rescission rights after the three-business-day rescission period (closed-end credit only): 

 The disclosed finance charge is considered accurate if it does not vary from the actual 

finance charge by more than 1/2 of 1 percent of the credit extended. 

 The disclosed finance charge is considered accurate if it does not vary from the actual 

finance charge by more than 1 percent of the credit extended for the initial and subsequent 

refinancings of residential mortgage transactions when the new loan is made at a different 

financial institution. (This excludes high cost mortgage loans subject to § 226.32, 

transactions in which there are new advances, and new consolidations.) 

• Rescission rights in foreclosure: 

 The disclosed finance charge is considered accurate if it does not vary from the actual 

finance charge by more than $35. 

 Overstatements are not considered violations. 

 The consumer can rescind if a mortgage broker fee is not included as a finance charge. 

NOTE: Normally, the finance charge tolerance for a rescindable transaction is either 0.5 percent of 

the credit transaction or, for certain refinancings, 1 percent of the credit transaction. However, in the 

event of a foreclosure, the consumer may exercise the right of rescission if the disclosed finance 

charge is understated by more than $35. 

See the Finance Charge Tolerances charts within this handbook section for help in determining 

appropriate finance charge tolerances. 

Calculating the Finance Charge (Closed-End Credit) 

One of the more complex tasks under Regulation Z is determining whether a charge associated with 

an extension of credit must be included in, or excluded from, the disclosed finance charge. The 

finance charge initially includes any charge that is, or will be, connected with a specific loan. 

Charges imposed by third parties are finance charges if the financial institution requires use of the 

third party. Charges imposed by settlement or closing agents are finance charges if the financial 

institution requires the specific service that gave rise to the charge and the charge is not otherwise 

excluded. The Finance Charge Tolerances charts within this document briefly summarize the rules 

that must be considered. 

Prepaid Finance Charges Section (§ 226.18(b)(3))

A prepaid finance charge is any finance charge paid separately to the financial institution or to a 

third party, in cash or by check before or at closing, settlement, or consummation of a transaction, 

or withheld from the proceeds of the credit at any time. 

Prepaid finance charges effectively reduce the amount of funds available for the consumer’s use, 

usually before or at the time the transaction is consummated. 

Examples of finance charges frequently prepaid by consumers are borrower’s points, loan 

origination fees, real estate construction inspection fees, odd days’ interest (interest attributable to 

part of the first payment period when that period is longer than a regular payment period), mortgage 

guarantee insurance fees paid to the Federal Housing Administration, private mortgage insurance 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 10

(PMI) paid to such companies as the Mortgage Guaranty Insurance Company (MGIC), and, in nonreal-estate transactions, credit report fees. 

Pre-computed Finance Charges 

A pre-computed finance charge includes, for example, interest added to the note amount that is 

computed by the add-on, discount, or simple interest methods. If reflected in the face amount of the 

debt instrument as part of the consumer’s obligation, finance charges that are not viewed as prepaid 

finance charges are treated as precomputed finance charges that are earned over the life of the loan.

Instructions for the Finance Charge Chart

The finance charge initially includes any charge that is, or will be, connected with a specific loan. 

Charges imposed by third parties are finance charges if the creditor requires use of the third party. 

Charges imposed on the consumer by a settlement agent are finance charges only if the creditor 

requires the particular services for which the settlement agent is charging the borrower and the 

charge is not otherwise excluded from the finance charge. 

Immediately below the finance charge definition, the chart presents five captions applicable to 

determining whether a loan related charge is a finance charge. 

The first caption is charges always included. This category focuses on specific charges given in 

the regulation or commentary as examples of finance charges. 

The second caption, charges included unless conditions are met, focuses on charges that must be 

included in the finance charge unless the creditor meets specific disclosure or other conditions to 

exclude the charges from the finance charge. 

The third caption, conditions, focuses on the conditions that need to be met if the charges identified 

to the left of the conditions are permitted to be excluded from the finance charge. Although most 

charges under the second caption may be included in the finance charge at the creditor’s option, 

third party charges and application fees (listed last under the third caption) must be excluded from 

the finance charge if the relevant conditions are met. However, inclusion of appraisal and credit 

report charges as part of the application fee is optional. 

The fourth caption, charges not included, identifies fees or charges that are not included in the 

finance charge under conditions identified by the caption. If the credit transaction is secured by real 

property or the loan is a residential mortgage transaction, the charges identified in the column, if 

they are bona fide and reasonable in amount, must be excluded from the finance charge. For 

example, if a consumer loan is secured by a vacant lot or commercial real estate, any appraisal fees 

connected with the loan must not be included in the finance charge.
CFPB FFIEC Rev. 5/2011 TILA 11

Finance Charge Chart

FINANCE CHARGE = DOLLAR COST OF CONSUMER CREDIT: It includes any charge payable directly or indirectly by the 

consumer and imposed directly or indirectly by the creditor as a condition of or incident to the extension of credit.

CHARGES ALWAYS 

INCLUDED

CHARGES INCLUDED 

UNLESS CONDITIONS 

ARE MET

CONDITIONS

(Any loan)

CHARGES NOT 

INCLUDED 

(Residential mortgage 

transactions and loans secured 

by real estate)

CHARGES NEVER 

INCLUDED

Charges payable in a comparable 

cash transaction.

Fees for unanticipated late payments

Overdraft fees not agreed to in 

writing

Seller’s points

Participation or membership fees

Discount offered by the seller to 

induce payment by cash or other 

means not involving the use of a 

credit card

Interest forfeited as a result of 

interest reduction required by law

Charges absorbed by the creditor as a 

cost of doing business

Interest

Transaction fees

Loan origination fees 

Consumer points

Credit guarantee insurance premiums

Charges imposed on the creditor for 

purchasing the loan, which are 

passed on to the consumer

Discounts for inducing payment by 

means other than credit

Mortgage broker fees

Other examples: Fee for preparing 

TILA disclosures; real estate 

construction loan inspection fees; 

fees for post-consummation tax or 

flood service policy; required credit 

life insurance charges

Premiums for credit life, A&H, or 

loss of income insurance

Debt cancellation fees

Premiums for property or liability 

insurance

Premiums for vendor’s single interest 

(VSI) insurance

Security interest charges (filing fees), 

insurance in lieu of filing fees and 

certain notary fees

Charges imposed by third parties

Charges imposed by third party 

closing agents

Appraisal and credit report fees

Insurance not required, disclosures 

are made, and consumer authorizes

Coverage not required, disclosures 

are made, and consumer authorizes

Consumer selects insurance company 

and disclosures are made

Insurer waives right of subrogation, 

consumer selects insurance company, 

and disclosures are made

The fee is for lien purposes, 

prescribed by law, payable to a third 

public official and is itemized and 

disclosed

Use of the third party is not required 

to obtain loan and creditor does not 

retain the charge

Creditor does not require and does 

not retain the fee for the particular 

service

Application fees, if charged to all 

applicants, are not finance charges. 

Application fees may include 

appraisal or credit report fees.

Fees for title insurance, title examination, 

property survey, etc.

Fees for preparing loan documents, 

mortgages, and other settlement documents

Amounts required to be paid into escrow, if 

not otherwise included in the finance charge

Notary fees

Pre-consummation flood and pest inspection 

fees

Appraisal and credit report fees
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 12

The fifth caption, charges never included, lists specific charges provided by the regulation as 

examples of those that automatically are not finance charges (e.g., fees for unanticipated late 

payments). 

Annual Percentage Rate Definition (Closed-End Credit) 

(§ 226.22)

Credit costs may vary depending on the interest rate, the amount of the loan and other charges, the 

timing and amounts of advances, and the repayment schedule. The APR, which must be disclosed in 

nearly all consumer credit transactions, is designed to take into account all relevant factors and to 

provide a uniform measure for comparing the cost of various credit transactions. 

The APR is a measure of the cost of credit, expressed as a nominal yearly rate. It relates the amount 

and timing of value received by the consumer to the amount and timing of payments made. The 

disclosure of the APR is central to the uniform credit cost disclosure envisioned by the TILA. 

The value of a closed-end credit APR must be disclosed as a single rate only, whether the loan has a 

single interest rate, a variable interest rate, a discounted variable interest rate, or graduated 

payments based on separate interest rates (step rates), and it must appear with the segregated 

disclosures. Segregated disclosures are grouped together and do not contain any information not 

directly related to the disclosures required under Section 226.18. 

Since an APR measures the total cost of credit, including costs such as transaction charges or 

premiums for credit guarantee insurance, it is not an “interest” rate, as that term is generally used. 

APR calculations do not rely on definitions of interest in state law and often include charges, such 

as a commitment fee paid by the consumer, that are not viewed by some state usury statutes as 

interest. Conversely, an APR might not include a charge, such as a credit report fee in a real 

property transaction, which some state laws might view as interest for usury purposes. Furthermore, 

measuring the timing of value received and of payments made, which is essential if APR 

calculations are to be accurate, must be consistent with parameters under Regulation Z. 

The APR is often considered to be the finance charge expressed as a percentage. However, two 

loans could require the same finance charge and still have different APRs because of differing 

values of the amount financed or of payment schedules. For example, the APR is 12 percent on a 

loan with an amount financed of $5,000 and 36 equal monthly payments of $166.07 each. It is 13.26 

percent on a loan with an amount financed of $4,500 and 35 equal monthly payments of $152.18 

each and final payment of $152.22. In both cases the finance charge is $978.52. The APRs on these 

example loans are not the same because an APR does not only reflect the finance charge. It relates 

the amount and timing of value received by the consumer to the amount and timing of payments 

made. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 13

The APR is a function of: 

• The amount financed, which is not necessarily equivalent to the loan amount. For example, 

if the consumer must pay at closing a separate 1 percent loan origination fee (prepaid 

finance charge) on a $100,000 residential mortgage loan, the loan amount is $100,000, but 

the amount financed would be $100,000 less the $1,000 loan fee, or $99,000. 

• The finance charge, which is not necessarily equivalent to the total interest amount (interest 

is not defined by Regulation Z, but rather is defined by state or other federal law). For 

example:

 If the consumer must pay a $25 credit report fee for an auto loan, the fee must be included 

in the finance charge. The finance charge in that case is the sum of the interest on the loan 

(i.e., interest generated by the application of a percentage rate against the loan amount) 

plus the $25 credit report fee. 

 If the consumer must pay a $25 credit report fee for a home improvement loan secured by 

real property, the credit report fee must be excluded from the finance charge. The finance 

charge in that case would be only the interest on the loan. 

• The payment schedule, which does not necessarily include only principal and interest (P + I) 

payments. For example:

 If the consumer borrows $2,500 for a vacation trip at 14 percent simple interest per annum 

and repays that amount with 25 equal monthly payments beginning one month from 

consummation of the transaction, the monthly P + I payment will be $115.87, if all months 

are considered equal, and the amount financed would be $2,500. If the consumer’s 

payments are increased by $2.00 a month to pay a non-financed $50 loan fee during the 

life of the loan, the amount financed would remain at $2,500 but the payment schedule 

would be increased to $117.87 a month, the finance charge would increase by $50, and 

there would be a corresponding increase in the APR. This would be the case whether or 

not state law defines the $50 loan fee as interest.

 If the loan above has 55 days to the first payment and the consumer prepays interest at 

consummation ($24.31 to cover the first 25 days), the amount financed would be $2,500 -

$24.31, or $2,475.69. Although the amount financed has been reduced to reflect the 

consumer’s reduced use of available funds at consummation, the time interval during 

which the consumer has use of the $2,475.69, 55 days to the first payment, has not 

changed. Since the first payment period exceeds the limitations of the regulation’s minor 

irregularities provisions (see § 226.17(c)(4)), it may not be treated as regular. In 

calculating the APR, the first payment period must not be reduced by 25 days (i.e., the first 

payment period may not be treated as one month). 

Financial institutions may, if permitted by state or other law, precompute interest by applying a rate 

against a loan balance using a simple interest, add-on, discount or some other method, and may earn 

interest using a simple interest accrual system, the Rule of 78s (if permitted by law) or some other 

method. Unless the financial institution’s internal interest earnings and accrual methods involve a 

simple interest rate based on a 360-day year that is applied over actual days (even that is important 

only for determining the accuracy of the payment schedule), it is not relevant in calculating an APR,
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 14

since an APR is not an interest rate (as that term is commonly used under state or other law). Since 

the APR normally need not rely on the internal accrual systems of a financial institution, it always 

may be computed after the loan terms have been agreed upon (as long as it is disclosed before 

actual consummation of the transaction). 

Special Requirements for Calculating the Finance Charge and 

APR 

Proper calculation of the finance charge and APR are of primary importance. The regulation 

requires that the terms “finance charge” and “annual percentage rate” be disclosed more 

conspicuously than any other required disclosure. The finance charge and APR, more than any other 

disclosures, enable consumers to understand the cost of the credit and to comparison shop for credit. 

A creditor’s failure to disclose those values accurately can result in significant monetary damages to 

the creditor, either from a class action lawsuit or from a regulatory agency’s order to reimburse 

consumers for violations of law. 

Footnote 45d: If an APR or finance charge is disclosed incorrectly, the error is not, in itself, a 

violation of the regulation if: 

• The error resulted from a corresponding error in a calculation tool used in good faith by the 

financial institution. 

• Upon discovery of the error, the financial institution promptly discontinues use of that 

calculation tool for disclosure purposes. 

• The financial institution notifies the Federal Reserve Board in writing of the error in the 

calculation tool. 

When a financial institution claims a calculation tool was used in good faith, the financial institution 

assumes a reasonable degree of responsibility for ensuring that the tool in question provides the 

accuracy required by the regulation. For example, the financial institution might verify the results 

obtained using the tool by comparing those results to the figures obtained by using another 

calculation tool. The financial institution might also verify that the tool, if it is designed to operate 

under the actuarial method, produces figures similar to those provided by the examples in appendix 

J to the regulation. The calculation tool should be checked for accuracy before it is first used and 

periodically thereafter. 

Subpart B - Open-End Credit

Time of Disclosures (Credit Card Accounts) (§ 226.5(b))

For credit card accounts under an open-end (not home-secured) consumer credit plan, creditors 

must adopt reasonable procedures designed to ensure that periodic statements are mailed or 

delivered at least 21 days prior to the payment due date disclosed on the periodic statement and that 

payments are not treated as late for any purpose if they are received within 21 days after mailing or 

delivery of the statement. In addition, for all open-end consumer credit accounts, creditors must 

adopt reasonable procedures designed to ensure that periodic statements are mailed or delivered at 

least 21 days prior to the date on which a grace period (if any) expires and that finance charges are 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 15

not imposed as a result of the loss of a grace period if a payment is received within 21 days after 

mailing or delivery of a statement. For purposes of this requirement, a “grace period” is defined as a 

period within which any credit extended may be repaid without incurring a finance charge due to a 

periodic interest rate. 

Subsequent Disclosures (Open-End Credit) (§ 226.9)

Creditors are required to provide consumers with 45 days’ advance written notice of rate increases 

and other significant changes to the terms of their credit card account agreements. The list of 

“significant changes” includes most fees and other terms that a consumer should be aware of before 

use of the account. Examples of such fees and terms include:

• Penalty fees;

• Transaction fees;

• Fees imposed for the issuance or availability of the open-end plan;

• Grace period; and

• Balance computation method.

Changes that do not require advance notice include:

• Reductions of finance charges;

• Termination of account privileges resulting from an agreement involving a court proceeding;

• The change is an increase in an APR upon expiration of a specified period of time 

previously disclosed in writing;

• The change applies to increases in variable APRs that change according to an index not 

under the card issuer’s control; and

• Rate increases due to the completion of, or failure of a consumer to comply with, the terms 

of a workout or temporary hardship arrangement, if those terms are disclosed prior to 

commencement of the arrangement.

A creditor may lower the credit limit without notice, but may not impose an over limit fee or 

penalty rate as a result of exceeding the new credit limit without a 45-day advance notice that the

credit limit has been reduced. A creditor may suspend account privileges, terminate an account, or 

lower the credit limit without notice. However, a creditor that lowers the credit limit may not 

impose an over limit fee or penalty rate as a result of exceeding the new credit limit without a 45-

day advance notice that the credit limit has been reduced.

For significant changes in terms (with the exception of rate changes, increases in the minimum 

payment, certain changes in the balance computation method, and when the change results from the 

consumer’s failure to make a required minimum periodic payment within 60 days after the due 

date), a creditor must also provide consumers the right to reject the change. If the consumer does 

reject the change prior to the effective date, the creditor may not apply the change to the account

(§ 226.9(h)(2)(i)). 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 16

In addition, when a consumer rejects a change or increase, the creditor must not:

• Impose a fee or charge or treat the account as in default solely as a result of the rejection; or

• Require repayment of the balance on the account using a method that is less beneficial to the 

consumer than one of the following methods: (1) the method of repayment prior to the 

rejection; (2) an amortization period of not less than five year from the date of rejection; or 

(3) a minimum periodic payment that includes a percentage of the balance that is not more 

than twice the percentage included prior to the date of rejection.

Finance Charge (Open-End Credit) (§ 226.6(a))

Each finance charge imposed must be individually itemized. The aggregate total amount of the 

finance charge need not be disclosed. 

Determining the Balance and Computing the Finance Charge 

The examiner must know how to compute the balance to which the periodic rate is applied. 

Common methods used are the previous balance method, the daily balance method, and the average 

daily balance method, which are described as follows: 

• Previous balance method – The balance on which the periodic finance charge is computed 

is based on the balance outstanding at the start of the billing cycle. The periodic rate is 

multiplied by this balance to compute the finance charge. 

• Daily balance method – A daily periodic rate is applied to either the balance on each day in 

the cycle or the sum of the balances on each of the days in the cycle. If a daily periodic rate 

is multiplied by the balance on each day in the billing cycle, the finance charge is the sum of 

the products. If the daily periodic rate is multiplied by the sum of all the daily balances, the 

result is the finance charge. 

• Average daily balance method – The average daily balance is the sum of the daily balances 

(either including or excluding current transactions) divided by the number of days in the 

billing cycle. A periodic rate is then multiplied by the average daily balance to determine the 

finance charge. If the periodic rate is a daily one, the product of the rate multiplied by the 

average balance is multiplied by the number of days in the cycle. 

In addition to those common methods, financial institutions have other ways of calculating the 

balance to which the periodic rate is applied. By reading the financial institution’s explanation, the 

examiner should be able to calculate the balance to which the periodic rate was applied. In some

cases, the examiner may need to obtain additional information from the financial institution to 

verify the explanation disclosed. Any inability to understand the disclosed explanation should be 

discussed with management, who should be reminded of Regulation Z’s requirement that 

disclosures be clear and conspicuous. 

When a balance is determined without first deducting all credits and payments made during the 

billing cycle, that fact and the amount of the credits and payments must be disclosed. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 17

If the financial institution uses the daily balance method and applies a single daily periodic rate, 

disclosure of the balance to which the rate was applied may be stated as any of the following: 

• A balance for each day in the billing cycle. The daily periodic rate is multiplied by the 

balance on each day and the sum of the products is the finance charge. 

• A balance for each day in the billing cycle on which the balance in the account changes. The 

finance charge is figured by the same method as discussed previously, but the statement 

shows the balance only for those days on which the balance changed. 

• The sum of the daily balances during the billing cycle. The balance on which the finance 

charge is computed is the sum of all the daily balances in the billing cycle. The daily 

periodic rate is multiplied by that balance to determine the finance charge. 

• The average daily balance during the billing cycle. If this is stated, the financial institution 

may, at its option, explain that the average daily balance is or can be multiplied by the 

number of days in the billing cycle and the periodic rate applied to the product to determine 

the amount of interest.

If the financial institution uses the daily balance method, but applies two or more daily periodic 

rates, the sum of the daily balances may not be used. Acceptable ways of disclosing the balances 

include any of the following: 

• A balance for each day in the billing cycle.

• A balance for each day in the billing cycle on which the balance in the account changes.

• Two or more average daily balances. If the average daily balances are stated, the financial 

institution may, at its option, explain that interest is or may be determined by: 1) multiplying 

each of the average daily balances by the number of days in the billing cycle (or if the daily 

rate varied during the cycle); 2) multiplying each of the results by the applicable daily 

periodic rate; and 3) adding these products together.

In explaining the method used to find the balance on which the finance charge is computed, the 

financial institution need not reveal how it allocates payments or credits. That information may be 

disclosed as additional information, but all required information must be clear and conspicuous. 

Note that Section 226.54 prohibits a credit card issuer from calculating finance charges based on 

balances for days in previous billing cycles as a result of the loss of a grace period (a practice 

sometimes referred to as “double-cycle billing”).

Finance Charge Resulting from Two or More Periodic Rates 

Some financial institutions use more than one periodic rate in computing the finance charge. For 

example, one rate may apply to balances up to a certain amount and another rate to balances more 

than that amount. If two or more periodic rates apply, the financial institution must disclose all rates 

and conditions. The range of balances to which each rate applies also must be disclosed. It is not 

necessary, however, to break the finance charge into separate components based on the different 

rates. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 18

Annual Percentage Rate (Open-End Credit)

Determination of APR (§ 226.14)

The disclosed APR on an open-end credit account is accurate if it is within 1/8 of 1 percentage point 

of the APR calculated under Regulation Z. The regulation states two basic methods for determining 

the APR in open-end credit transactions. The first involves multiplying each periodic rate by the 

number of periods in a year. This method is used for disclosing all of the following: 

• The corresponding APR in the initial disclosures;

• The corresponding APR on periodic statements;

• The APR in early disclosures for credit card accounts;

• The APR in early disclosures for home-equity plans;

• The APR in advertising; and

• The APR in oral disclosures. 

The corresponding APR is prospective. In other words, it does not involve any particular finance 

charge or periodic balance. 

The second method is the quotient method, used in computing the APR for periodic statements. The 

quotient method reflects the annualized equivalent of the rate that was actually applied during a 

cycle. This rate, also known as the historical rate, will differ from the corresponding APR if the 

creditor applies minimum, fixed, or transaction charges to the account during the cycle. 

If the finance charge is determined by applying one or more periodic rates to a balance, and does 

not include any of the charges just mentioned, the financial institution may compute the historical 

rate using the quotient method. In that method, the financial institution divides the total finance 

charge for the cycle by the sum of the balances to which the periodic rates were applied and 

multiplies the quotient (expressed as a percentage) by the number of cycles in a year. 

Alternatively, the financial institution may use the method for computing the corresponding APR. 

In that method, the financial institution multiplies each periodic rate by the number of periods in 

one year. If the finance charge includes a minimum, fixed, or transaction charge, the financial 

institution must use the appropriate variation of the quotient method. When transaction charges are 

imposed, the financial institution should refer to appendix F of this handbook for computational 

examples. 

The regulation also contains a computation rule for small finance charges. If the finance charge 

includes a minimum, fixed, or transaction charge, and the total finance charge for the cycle does not 

exceed 50 cents, the financial institution may multiply each applicable periodic rate by the number 

of periods in a year to compute the APR. 

Optional calculation methods also are provided for accounts involving daily periodic rates 

(§ 226.14(d)). 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 19

Brief Outline for Open-End Credit APR Calculations on 

Periodic Statements 

NOTE: Assume monthly billing cycles for each of the following calculations.

I. APR when finance charge is determined solely by applying one or more periodic rates:

A. Monthly periodic rates:

1. Monthly rate x 12 = APR

or

2. (Total finance charge / applicable balance x 12 = APR4

This calculation may be used when different rates apply to different balances.

B. Daily periodic rates:

1. Daily rate x 365 = APR

or

2. (Total finance charge / average daily balance) x 12 = APR

or

3. (Total finance charge / sum of balances) x 365 = APR

II. APR when finance charge includes a minimum, fixed, or other charge that is not calculated 

using a periodic rate (and does not include charges related to a specific transaction, such as a 

cash advance fees):

A. Monthly periodic rates:

1. (Total finance charge / amount of applicable balance) x 12 = APR

B. Daily periodic rates

1. (Total finance charge / amount of applicable balance) x 365 = APR

2. The following may be used if at least a portion of the finance charge is determined by 

the application of a daily periodic rate. If not, use the formula above.

a. (Total finance charge / average daily balance) x 12 = APR

or

b. (Total finance charge / sum of balances) x 365 = APR

C. Monthly and daily periodic rates

1. If the finance charge imposed during the billing cycle does not exceed $.50 for a 

monthly or longer billing cycles (or pro rata part of $.50 for a billing cycle shorter than 

monthly), the APR may be calculated by multiplying the monthly rate by 12 or the daily 

rate by 365.

III. If the total finance charge included a charge related to a specific transaction (such as a cash 

advance fee), even if the total finance charge also included any other minimum, fixed, or other 

charge not calculated using a periodic rate, then the monthly and daily APRs are calculated as 

4 For the following formulas, the APR cannot be determined if the applicable balance is zero.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 20

follows: (total finance charge / the greater of: the transaction amounts that created the 

transaction fees or the sum of the balances and other amounts on which a finance charge was 

imposed during the billing cycle5

) x number of billing cycles in a year (12) = APR6

Timely Settlement of Estates (§ 226.11(c))

Issuers are required to establish procedures to ensure that any administrator of an estate can resolve 

the outstanding credit card balance of a deceased account holder in a timely manner. If an 

administrator requests the amount of the balance: 

• The issuer is prohibited from imposing additional fees on the account;

• The issuer is required to disclose the amount of the balance to the administrator in a timely 

manner (safe harbor of 30 days); and

• If the balance is paid in full within 30 days after disclosure of the balance, the issuer must 

waive or rebate any trailing or residual interest charges that accrued on the balance 

following the disclosure.

Minimum Payments (§ 226.7(b)(12))

For credit card accounts under an open-end credit plan, card issuers generally must disclose on 

periodic statements an estimate of the amount of time and the total cost (principal and interest) 

involved in paying the balance in full by making only the minimum payments, and an estimate of 

the monthly payment amount required to pay off the balance in 36 months and the total cost 

(principal and interest) of repaying the balance in 36 months. Card issuers also must disclose a 

minimum payment warning, and an estimate of the total interest that a consumer would save if that 

consumer repaid the balance in 36 months instead of making minimum payments.

Subpart C - Closed-End Credit 

Finance Charge (Closed-End Credit) (§ 226.17(a))

The aggregate total amount of the finance charge must be disclosed. Each finance charge imposed 

need not be individually itemized and must not be itemized with the segregated disclosures. 

 5 The sum of the balances may include amounts computed by the average daily balance, adjusted balance, or previous balance method. 

When a portion of the finance charge is determined by application of one or more daily periodic rates, the sum of the balances also means 

the average of daily balances.

6 If the product is less than the highest periodic rate applied, expressed as an APR, the higher figure must be disclosed as the APR.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 21

Annual Percentage Rate (Closed-End Credit) (§ 226.22)

Accuracy Tolerances

The disclosed APR on a closed-end transaction is accurate for: 

• Regular transactions (which include any single advance transaction with equal payments and 

equal payment periods, or an irregular first payment period and/or a first or last irregular 

payment), if it is within 1/8 of 1 percentage point of the APR calculated under Regulation Z 

(§ 226.22(a)(2)). 

• Irregular transactions (which include multiple advance transactions and other transactions 

not considered regular), if it is within 1/4 of 1 percentage point of the APR calculated under 

Regulation Z (§ 226.22(a)(3)).

• Mortgage transactions if: 

 The APR is within 1/8 of 1 percentage point for regular transactions or 1/4 of 1 

percentage point for irregular transactions; or

 The rate results from the disclosed finance charge and the disclosed finance charge is 

considered accurate under Sections 226.18(d)(1) or 226.23(g) or (h) (§ 226.22(a)(4)); or 

 The disclosed finance charge is calculated incorrectly but is considered accurate under 

Sections 226.18(d)(1) or 226.23(g) or (h) and either: 

⇒ (A) the finance charge is understated and the disclosed APR is also understated but is 

closer to the actual APR than the APR that would be considered accurate under 

Section 226.22(a)(4)or 

⇒ (B) the disclosed finance charge is overstated and the disclosed APR is also 

overstated but is closer to the actual APR than the APR that would be considered 

accurate under Section 226.22(a)(4).

For example, in an irregular transaction subject to a tolerance of 1/4 of 1 percentage 

point, if the actual APR is 9.00% and a $75 omission from the finance charge 

corresponds to a rate of 8.50% that is considered accurate under Section 226.22(a)(4), a 

disclosed APR of 8.65% is considered accurate under Section 226.22(a)(5). However, a 

disclosed APR below 8.50% or above 9.25% would not be considered accurate. 

Construction Loans (§226.17(c)(6) and Appendix D)

Construction and certain other multiple advance loans pose special problems in computing the 

finance charge and APR. In many instances, the amount and dates of advances are not predictable 

with certainty since they depend on the progress of the work. Regulation Z provides that the APR 

and finance charge for such loans may be estimated for disclosure. 

At its option, the financial institution may rely on the representations of other parties to acquire 

necessary information (for example, it might look to the consumer for the dates of advances). In 

addition, if either the amounts or dates of advances are unknown (even if some of them are known), 

the financial institution may, at its option, use appendix D to the regulation to make calculations and 

disclosures. The finance charge and payment schedule obtained through appendix D may be used 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 22

with volume one of the Federal Reserve Board’s APR tables or with any other appropriate 

computation tool to determine the APR. If the financial institution elects not to use appendix D, or if 

appendix D cannot be applied to a loan (e.g., appendix D does not apply to a combined 

construction-permanent loan if the payments for the permanent loan begin during the construction 

period), the financial institution must make its estimates under Section 226.17(c)(2) and calculate 

the APR using multiple advance formulas. 

On loans involving a series of advances under an agreement to extend credit up to a certain amount, 

a financial institution may treat all of the advances as a single transaction or disclose each advance 

as a separate transaction. If advances are disclosed separately, disclosures must be provided before 

each advance occurs, with the disclosures for the first advance provided before consummation. 

In a transaction that finances the construction of a dwelling that may or will be permanently 

financed by the same financial institution, the construction-permanent financing phases may be 

disclosed in one of three ways listed below. 

• As a single transaction, with one disclosure combining both phases. 

• As two separate transactions, with one disclosure for each phase. 

• As more than two transactions, with one disclosure for each advance and one for the 

permanent financing phase. 

If two or more disclosures are furnished, buyer’s points or similar amounts imposed on the 

consumer may be allocated among the transactions in any manner the financial institution chooses, 

as long as the charges are not applied more than once. In addition, if the financial institution 

chooses to give two sets of disclosures and the consumer is obligated for both construction and 

permanent phases at the outset, both sets of disclosures must be given to the consumer initially, 

before consummation of each transaction occurs. 

If the creditor requires interest reserves for construction loans, special appendix D rules apply that 

can make the disclosure calculations quite complicated. The amount of interest reserves included in 

the commitment amount must not be treated as a prepaid finance charge. 

If the lender uses appendix D for construction-only loans with required interest reserves, the lender 

must estimate construction interest using the interest reserve formula in appendix D. The lender’s 

own interest reserve values must be completely disregarded for disclosure purposes. 

If the lender uses appendix D for combination construction-permanent loans, the calculations can be 

much more complex. Appendix D is used to estimate the construction interest, which is then 

measured against the lender’s contractual interest reserves. 

If the interest reserve portion of the lender’s contractual commitment amount exceeds the amount of 

construction interest estimated under appendix D, the excess value is considered part of the amount 

financed if the lender has contracted to disburse those amounts whether they ultimately are needed 

to pay for accrued construction interest. If the lender will not disburse the excess amount if it is not 

needed to pay for accrued construction interest, the excess amount must be ignored for disclosure 

purposes. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 23

Calculating the Annual Percentage Rate (§ 226.22)

The APR must be determined under one of the following: 

• The actuarial method, which is defined by Regulation Z and explained in appendix J to the 

regulation. 

• The U.S. Rule, which is permitted by Regulation Z and briefly explained in appendix J to 

the regulation. The U.S. Rule is an accrual method that seems to have first surfaced 

officially in an early nineteenth century United States Supreme Court case, Story v. 

Livingston (38 U.S. 359). 

Whichever method is used by the financial institution, the rate calculated will be accurate if it is 

able to “amortize” the amount financed while it generates the finance charge under the accrual 

method selected. Financial institutions also may rely on minor irregularities and accuracy tolerances 

in the regulation, both of which effectively permit somewhat imprecise, but still legal, APRs to be 

disclosed. 

360-Day and 365-Day Years (§ 226.17(c)(3))

Confusion often arises over whether to use the 360-day or 365-day year in computing interest, 

particularly when the finance charge is computed by applying a daily rate to an unpaid balance. 

Many single payment loans or loans payable on demand are in this category. There are also loans in 

this category that call for periodic installment payments. 

Regulation Z does not require the use of one method of interest computation in preference to 

another (although state law may). It does, however, permit financial institutions to disregard the fact 

that months have different numbers of days when calculating and making disclosures. This means 

financial institutions may base their disclosures on calculation tools that assume all months have an 

equal number of days, even if their practice is to take account of the variations in months to collect 

interest. 

For example, a financial institution may calculate disclosures using a financial calculator based on a 

360-day year with 30-day months, when, in fact, it collects interest by applying a factor of 1/365 of 

the annual interest rate to actual days. 

Disclosure violations may occur, however, when a financial institution applies a daily interest factor

based on a 360-day year to the actual number of days between payments. In those situations, the 

financial institution must disclose the higher values of the finance charge, the APR, and the 

payment schedule resulting from this practice. 

For example, a 12 percent simple interest rate divided by 360 days results in a daily rate of .033333 

percent. If no charges are imposed except interest, and the amount financed is the same as the loan 

amount, applying the daily rate on a daily basis for a 365-day year on a $10,000 one year, single 

payment, unsecured loan results in an APR of 12.17 percent (.033333% x 365 = 12.17%), and a 

finance charge of $1,216.67. There would be a violation if the APR were disclosed as 12 percent or 

if the finance charge were disclosed as $1,200 (12% x $10,000). 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 24

However, if there are no other charges except interest, the application of a 360-day year daily rate 

over 365 days on a regular loan would not result in an APR in excess of the one eighth of one 

percentage point APR tolerance unless the nominal interest rate is greater than 9 percent. For 

irregular loans, with 1/4 of 1 percentage point APR tolerance, the nominal interest rate would have 

to be greater than 18 percent to exceed the tolerance. 

Variable Rate Information (§ 226.18(f))

If the terms of the legal obligation allow the financial institution, after consummation of the 

transaction, to increase the APR, the financial institution must furnish the consumer with certain 

information on variable rates. Graduated payment mortgages and step-rate transactions without a 

variable rate feature are not considered variable rate transactions. In addition, variable rate 

disclosures are not applicable to rate increases resulting from delinquency, default, assumption, 

acceleration, or transfer of the collateral. 

Some of the more important transaction-specific variable rate disclosure requirements under 

Section 226.18 follow. 

• Disclosures for variable rate loans must be given for the full term of the transaction and 

must be based on the terms in effect at the time of consummation. 

• If the variable rate transaction includes either a seller buy-down that is reflected in a contract 

or a consumer buy-down, the disclosed APR should be a composite rate based on the 

lower rate for the buy-down period and the rate that is the basis for the variable rate 

feature for the remainder of the term. 

• If the initial rate is not determined by the index or formula used to make later interest rate 

adjustments, as in a discounted variable rate transaction, the disclosed APR must reflect a 

composite rate based on the initial rate for as long as it is applied and, for the remainder of 

the term, the rate that would have been applied using the index or formula at the time of 

consummation (i.e., the fully indexed rate). 

 If a loan contains a rate or payment cap that would prevent the initial rate or payment, at 

the time of the adjustment, from changing to the fully indexed rate, the effect of that rate 

or payment cap needs to be reflected in the disclosures. 

 The index at consummation need not be used if the contract provides a delay in the 

implementation of changes in an index value (e.g., the contract indicates that future rate 

changes are based on the index value in effect for some specified period, like 45 days 

before the change date). Instead, the financial institution may use any rate from the date of 

consummation back to the beginning of the specified period (e.g., during the previous 

45-day period). 

• If the initial interest rate is set according to the index or formula used for later adjustments, 

but is set at a value as of a date before consummation, disclosures should be based on the 

initial interest rate, even though the index may have changed by the consummation date. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 25

For variable-rate loans that are not secured by the consumer’s principal dwelling or that are secured 

by the consumer’s principal dwelling but have a term of one year or less, creditors must disclose the 

circumstances under which the rate may increase, any limitations on the increase, the effect of an 

increase, and an example of the payment terms that would result from an increase 

(§ 226.18(f)(1)).

For variable-rate consumer loans secured by the consumer’s principal dwelling and having a 

maturity of more than one year, creditors must state that the loan has a variable-rate feature and that 

disclosures were previously given (§ 226.18(f)(2)). Extensive disclosures about the loan program 

are provided when consumers apply for such a loan (§ 226.19(b), and throughout the loan term 

when the rate or payment amount is changed (§ 226.20(c)).

Payment Schedule (§ 226.18(g))

The disclosed payment schedule must reflect all components of the finance charge. It includes all 

payments scheduled to repay loan principal, interest on the loan, and any other finance charge 

payable by the consumer after consummation of the transaction. 

However, any finance charge paid separately before or at consummation (e.g., odd days’ interest) is 

not part of the payment schedule. It is a prepaid finance charge that must be reflected as a reduction 

in the value of the amount financed. 

At the creditor’s option, the payment schedule may include amounts beyond the amount financed 

and finance charge (e.g., certain insurance premiums or real estate escrow amounts such as taxes

added to payments). However, when calculating the APR, the creditor must disregard such amounts. 

If the obligation is a renewable balloon payment instrument that unconditionally obligates the 

financial institution to renew the short-term loan at the consumer’s option or to renew the loan 

subject to conditions within the consumer’s control, the payment schedule must be disclosed using 

the longer term of the renewal period or periods. The long-term loan must be disclosed with a 

variable rate feature. 

If there are no renewal conditions or if the financial institution guarantees to renew the obligation in 

a refinancing, the payment schedule must be disclosed using the shorter balloon payment term. The 

short-term loan must be disclosed as a fixed rate loan, unless it contains a variable rate feature 

during the initial loan term. 

Amount Financed (§ 226.18(b))

Definition 

The amount financed is the net amount of credit extended for the consumer’s use. It should not be 

assumed that the amount financed under the regulation is equivalent to the note amount, proceeds, 

or principal amount of the loan. The amount financed normally equals the total of payments less the 

finance charge. 

To calculate the amount financed, all amounts and charges connected with the transaction, either 

paid separately or included in the note amount, must first be identified. Any prepaid, precomputed, 

or other finance charge must then be determined. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 26

The amount financed must not include any finance charges. If finance charges have been 

included in the obligation (either prepaid or precomputed), they must be subtracted from the face 

amount of the obligation when determining the amount financed. The resulting value must be 

reduced further by an amount equal to any prepaid finance charge paid separately. The final 

resulting value is the amount financed. 

When calculating the amount financed, finance charges (whether in the note amount or paid 

separately) should not be subtracted more than once from the total amount of an obligation. Charges 

not in the note amount and not included in the finance charge (e.g., an appraisal fee paid separately 

in cash on a real estate loan) are not required to be disclosed under Regulation Z and must not be 

included in the amount financed. 

In a multiple advance construction loan, proceeds placed in a temporary escrow account and 

awaiting disbursement in draws to the developer are not considered part of the amount financed 

until actually disbursed. Thus, if the entire commitment amount is disbursed into the lender’s 

escrow account, the lender must not base disclosures on the assumption that all funds were 

disbursed immediately, even if the lender pays interest on the escrowed funds. 

Required Deposit (§ 226.18(r))

A required deposit, with certain exceptions, is one that the financial institution requires the 

consumer to maintain as a condition of the specific credit transaction. It can include a compensating 

balance or a deposit balance that secures the loan. The effect of a required deposit is not reflected in 

the APR. Also, a required deposit is not a finance charge since it is eventually released to the 

consumer. A deposit that earns at least 5 percent per year need not be considered a required deposit. 

Calculating the Amount Financed 

A consumer signs a note secured by real property in the amount of $5,435. The note amount 

includes $5,000 in proceeds disbursed to the consumer, $400 in precomputed interest, $25 paid to a 

credit reporting agency for a credit report, and a $10 service charge. Additionally, the consumer 

pays a $50 loan fee separately in cash at consummation. The consumer has no other debt with the 

financial institution. The amount financed is $4,975. 

The amount financed may be calculated by first subtracting all finance charges included in the note 

amount ($5,435 - $400 - $10 = $5,025). The $25 credit report fee is not a finance charge because 

the loan is secured by real property. The $5,025 is further reduced by the amount of prepaid finance 

charges paid separately, for an amount financed of $5,025 - $50 = $4,975. The answer is the same 

whether finance charges included in the obligation are considered prepaid or precomputed finance 

charges. 

The financial institution may treat the $10 service charge as an addition to the loan amount and not 

as a prepaid finance charge. If it does, the loan principal would be $5,000. The $5,000 loan 

principal does not include either the $400 or the $10 precomputed finance charge in the note. The 

loan principal is increased by other amounts that are financed which are not part of the finance 

charge (the $25 credit report fee) and reduced by any prepaid finance charges (the $50 loan fee, not 

the $10 service charge) to arrive at the amount financed of $5,000 + $25 - $50 = $4,975. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 27

Other Calculations 

The financial institution may treat the $10 service charge as a prepaid finance charge. If it does, the 

loan principal would be $5,010. The $5,010 loan principal does not include the $400 precomputed 

finance charge. The loan principal is increased by other amounts that are financed which are not 

part of the finance charge (the $25 credit report fee) and reduced by any prepaid finance charges 

(the $50 loan fee and the $10 service charge withheld from loan proceeds) to arrive at the same 

amount financed of $5,010 + $25 - $50- $10 = $4,975. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 28

Closed-End Credit: Finance Charge Accuracy Tolerances

* See 15 USC 160 (aa) 

 and 12 CFR 226.32

Is the 

transaction 

secured by 

real estate or 

dwelling?

Did the 

transaction 

originate before 

9/30/95?

Is this a 

closed-end 

credit 

TILA claim 

asserting 

rescission 

rights?

Yes No

Yes

No

No

Finance charge 

tolerance is $35.

An overstated 

finance charge is 

not considered a 

violation.

Is the 

rescission 

claim a 

defense to 

foreclosure 

action?

Yes

No

Yes

Finance charge 

tolerance is $200

for 

understatements.

An overstated 

finance charge is 

not considered a 

violation.

Finance charge 

tolerance is $100

for 

understatements.

An overstated 

finance charge is 

not considered a 

violation.

The finance charge shall 

be considered accurate if 

it is not more than $5

above or below the exact 

finance charge in a 

transaction involving an 

amount financed of 

$1,000 or less, or not 

more than $10 above or 

below the exact finance 

charge in a transaction 

involving an amount 

financed of more than 

$1,000.

Finance charge tolerance is 1% of 

the loan amount or $100, 

whichever is greater.

An overstated finance charge is 

not considered a violation.

No

No

Yes

Does the 

refinancing involve 

a consolidation or 

new advance?

Yes

Is the 

transaction a 

high-cost 

mortgage 

loan?*

Finance charge 

tolerance is one-half 

of 1% of the loan 

amount or $100, 

whichever is greater.

An overstated finance 

charge is not 

considered a 

violation.

Is the 

transaction a 

refinancing?

No

Yes
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 29

No

Is the disclosed FC 

understated by more than 

$5?

No

Closed-End Credit: Accuracy and Reimbursement Tolerances for

UNDERSTATED FINANCE CHARGES

Is the loan secured by real estate or a 

dwelling?

Yes

Is the disclosed FC understated 

by more than $100 (or $200 if 

the loan originated before 

9/30/95)?

No Yes

No violation FC Violation

FC violation No violation FC violation

Yes No Yes

Is the disclosed FC 

understated by more than 

$10?

No Yes

Is the amount financed greater 

than $1,000?

Is the loan 

term greater 

than 10 years?

No Yes

Is the loan a 

regular loan?

No Yes

Is the disclosed FC plus the FC 

reimbursement tolerance (based 

on a one-quarter of 1 percentage 

point APR tolerance) less than 

the correct FC?

Is the disclosed FC plus the FC 

reimbursement tolerance (based 

on a one-eighth of 1 percentage 

point APR tolerance) less than the 

correct FC?

Yes No No Yes

No reimbursement

Subject to 

reimbursement
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 30

Closed-End Credit: Accuracy Tolerances for

OVERSTATED FINANCE CHARGES

Is the loan secured by real estate or a 

dwelling?

No Yes

No violation

Is the amount financed greater 

than $1,000?

No Yes

Is the disclosed FC less 

$10 greater than the 

correct FC?

Is the disclosed FC less 

$5 greater than the 

correct FC?

No Yes

No violation FC violation

No Yes

No violation FC violation
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 31

Closed-End Credit: Accuracy Tolerances for 

OVERSTATED APRs

APR Violation No violation

No Yes

Was the finance charge disclosure error the cause of 

the APR disclosure error?

APR Violation

Yes No

Is the finance charge disclosed greater than the 

correct finance charge?

Is this a “regular” loan?

(12 CFR 226, footnote 46)

No Yes

Is the disclosed APR greater than the correct 

APR by more than one-eighth of one percentage 

point?

Is the disclosed APR greater than the correct 

APR by more than one-quarter of one percentage 

point?

No No

No violation

Yes Yes

Is the loan secured by real estate or a dwelling?

No Yes

APR Violation
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 32

Closed-End Credit: Accuracy and Reimbursement Tolerances For

UNDERSTATED APRs

Is the loan a “regular” loan?

No Yes

Is the disclosed APR understated by more 

than one-quarter of one percentage point?

Is the disclosed APR understated by 

more than one-eighth of one percentage 

point?

Yes No

No violation

No Yes

Is the loan secured by real estate or a dwelling?

No Yes

APR violation

No Yes

Is the finance charge understated by more than:

• $100 if the loan originated on or after 9/30/95?

• $200 if the loan originated before 9/30/95?

APR violation

Was the finance charge disclosure error the cause of 

the APR disclosure error?

No Yes

APR violation No violation

Is the loan term greater than 10 years?

No Yes

Is the loan a “regular” loan?

Is the disclosed APR understated by more 

than one-quarter of one percentage point?

No Yes

Is the disclosed APR understated by more 

than one-eighth of one percentage point?

Yes No No Yes

No reimbursement

Subject to reimbursement
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 33

Refinancings (§ 226.20)

When an obligation is satisfied and replaced by a new obligation to the original financial institution 

(or a holder or servicer of the original obligation) and is undertaken by the same consumer, it must 

be treated as a refinancing for which a complete set of new disclosures must be furnished. A 

refinancing may involve the consolidation of several existing obligations, disbursement of new 

money to the consumer, or the rescheduling of payments under an existing obligation. In any form, 

the new obligation must completely replace the earlier one to be considered a refinancing under the 

regulation. The finance charge on the new disclosure must include any unearned portion of the old 

finance charge that is not credited to the existing obligation (§ 226.20(a)).

The following transactions are not considered refinancings even if the existing obligation is satisfied 

and replaced by a new obligation undertaken by the same consumer: 

• A renewal of an obligation with a single payment of principal and interest or with periodic 

interest payments and a final payment of principal with no change in the original terms. 

• An APR reduction with a corresponding change in the payment schedule. 

• An agreement involving a court proceeding. 

• Changes in credit terms arising from the consumer’s default or delinquency. 

• The renewal of optional insurance purchased by the consumer and added to an existing 

transaction, if required disclosures were provided for the initial purchase of the insurance. 

However, even if it is not accomplished by the cancellation of the old obligation and substitution of 

a new one, a new transaction subject to new disclosures results if the financial institution: 

• Increases the rate based on a variable rate feature that was not previously disclosed; or 

• Adds a variable rate feature to the obligation. 

If, at the time a loan is renewed, the rate is increased, the increase is not considered a variable rate 

feature. It is the cost of renewal, similar to a flat fee, as long as the new rate remains fixed during 

the remaining life of the loan. If the original debt is not canceled in connection with such a renewal, 

the regulation does not require new disclosures. Also, changing the index of a variable rate 

transaction to a comparable index is not considered adding a variable rate feature to the obligation. 

Advertising (§§ 226.16 and 226.24)

The regulation requires that loan product advertisements provide accurate and balanced

information, in a clear and conspicuous manner, about rates, monthly payments, and other loan 

features. The advertising rules ban several deceptive or misleading advertising practices, including 

representations that a rate or payment is “fixed” when in fact it can change. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 34

Advertising Rules for Open-End Plans (§ 226.16)

If an advertisement for credit states specific credit terms, it must state only those terms that actually 

are or will be arranged or offered by the creditor. If any finance charges or other charges are set 

forth in an advertisement, the advertisement must also clearly and conspicuously state the 

following:

• Any minimum, fixed, transaction, activity or similar charge that could be imposed;

• Any periodic rate that may be applied expressed as an APR as determined under Section

226.14(b). If the plan provides for a variable periodic rate, that fact must be disclosed; and

• Any membership or participation fee that could be imposed.

If any finance charges or other charge or payment terms are set forth, affirmatively or negatively, in 

an advertisement for a home-equity plan subject to the requirements of Section 226.5b, the 

advertisement also must clearly and conspicuously set forth the following:

• Any loan fee that is a percentage of the credit limit under the plan and an estimate of any 

other fees imposed for opening the plan, stated as a single dollar amount or a reasonable 

range;

• Any periodic rate used to compute the finance charge, expressed as an APR as determined 

under Section 226.14(b); and

• The maximum APR that may be imposed in a variable-rate plan.

Regulation Z’s open-end home-equity plan advertising rules include a clear and conspicuous 

standard for home-equity plan advertisements, consistent with the approach taken in the advertising 

rules for consumer leases under Regulation M. Commentary provisions clarify how the clear and 

conspicuous standard applies to advertisements of home-equity plans with promotional rates or 

payments, and to Internet, television, and oral advertisements of home-equity plans. The regulation 

allows alternative disclosures for television and radio advertisements for home-equity plans. The 

regulation also requires that advertisements adequately disclose not only promotional plan terms, 

but also the rates or payments that will apply over the term of the plan. 

Regulation Z also contains provisions implementing the Bankruptcy Abuse Prevention and 

Consumer Protection Act of 2005, which requires disclosure of the tax implications of certain 

home-equity plans. 

Closed-End Advertising (§ 226.24)

If an advertisement for credit states specific credit terms, it must state only those terms that actually 

are or will be arranged or offered by the creditor.

Disclosures required by this section must be made “clearly and conspicuously.” To meet this 

standard in general, credit terms need not be printed in a certain type size nor appear in any 

particular place in the advertisement. For advertisements for credit secured by a dwelling, a clear 

and conspicuous disclosure means that the required information is disclosed with equal prominence 

and in close proximity to the advertised rates or payments triggering the required disclosures.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 35

If an advertisement states a rate of finance charge, it must state the rate as an “annual percentage 

rate,” using that term. If the APR may be increased after consummation, the advertisement must 

state that fact.

If an advertisement is for credit not secured by a dwelling, the advertisement must not state any 

other rate, except that a simple annual rate or periodic rate that is applied to an unpaid balance may 

be stated in conjunction with, but not more conspicuously than, the APR.

If an advertisement is for credit secured by a dwelling, the advertisement must not state any other 

rate, except that a simple annual rate that is applied to an unpaid balance may be stated in 

conjunction with, but not more conspicuously than, the APR. That is, an advertisement for credit 

secured by a dwelling may not state a periodic rate, other than a simple annual rate, that is applied 

to an unpaid balance.

“Triggering terms” - The following are triggering terms that require additional disclosures:

• The amount or percentage of any down payment;

• The number of payments or period of repayment;

• The amount of any payment; and

• The amount of any finance charge.

An advertisement stating a triggering term must also state the following terms as applicable:

• The amount or percentage of any down payment;

• The terms of repayment, which reflect the repayment obligations over the full term of the 

loan, including any balloon payment; and

• The “annual percentage rate,” using that term, and, if the rate may be increased after 

consummation, that fact. 

For any advertisement secured by a dwelling, other than television or radio advertisements, that 

states a simple annual rate of interest and more than one simple annual rate of interest will apply 

over the term of the advertised loan, the advertisement must state in a clear and conspicuous 

manner:

• Each simple rate of interest that will apply. In variable-rate transactions, a rate determined 

by adding an index and margin must be disclosed based on a reasonably current index and 

margin.

• The period of time during which each simple annual rate of interest will apply.

• The APR for the loan. 

The regulation prohibits the following seven deceptive or misleading acts or practices in 

advertisements for closed-end mortgage loans: 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 36

• Stating that rates or payments for loans are “fixed” when those rates or payments can vary 

without adequately disclosing that the interest rate or payment amounts are “fixed” only for 

a limited period of time, rather than for the full term of the loan; 

• Making comparisons between credit payments or rates and any payment or rate available 

under the advertised product that are not available for the full term of the loan, with certain 

exceptions for advertisements for variable rate products;

• Characterizing the products offered as “government loan programs,” “government-supported 

loans,” or otherwise endorsed or sponsored by a federal or state government entity even 

though the advertised products are not government-supported or sponsored loans; 

• Displaying the name of the consumer’s current mortgage lender, unless the advertisement 

also prominently discloses that the advertisement is from a mortgage lender not affiliated 

with the consumer’s current lender; 

• Making claims of debt elimination if the product advertised would merely replace one debt 

obligation with another; 

• Creating a false impression that the mortgage broker or lender is a “counselor” for the 

consumer; and 

• In foreign-language advertisements, providing certain information, such as a low 

introductory “teaser” rate, in a foreign language, while providing required disclosures only 

in English.

Subpart D - Miscellaneous

Civil Liability (TILA §§ 130 and 131)

If a creditor fails to comply with any requirements of the TILA, other than with the advertising 

provisions of chapter 3, it may be held liable to the consumer for: 

• Actual damage, and 

• The cost of any legal action together with reasonable attorney’s fees in a successful action. 

If it violates certain requirements of the TILA, the creditor also may be held liable for either of the 

following: 

• In an individual action, twice the amount of the finance charge involved, but not less than 

$100 or more than $1,000. However, in an individual action relating to a closed-end credit 

transaction secured by real property or a dwelling, twice the amount of the finance charge 

involved, but not less than $200 or more than $2,000.

• In a class action, such amount as the court may allow. The total amount of recovery, 

however, cannot be more than $500,000 or 1 percent of the creditor’s net worth, whichever 

is less.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 37

Civil actions that may be brought against a creditor also may be maintained against any assignee of 

the creditor if the violation is apparent on the face of the disclosure statement or other documents 

assigned, except where the assignment was involuntary. 

A creditor that fails to comply with TILA’s requirements for loans that meet the criteria in 

Section 226.32 (a) (“high-cost mortgage loans”) or Section 226.35(a) (“higher priced mortgage 

loans”) may be held liable to the consumer for all finance charges and fees paid to the creditor. For 

high-cost mortgage loans (under § 226.32(a)) any subsequent assignee is subject to all claims and 

defenses that the consumer could assert against the creditor, unless the assignee demonstrates that it 

could not reasonably have determined that the loan was subject to Section 226.32.

Criminal Liability (TILA § 112)

Anyone who willingly and knowingly fails to comply with any requirement of the TILA will be 

fined not more than $5,000 or imprisoned not more than one year, or both. 

Administrative Actions (TILA § 108)

The TILA authorizes federal regulatory agencies to require financial institutions to make monetary 

and other adjustments to the consumers’ accounts when the true finance charge or APR exceeds the 

disclosed finance charge or APR by more than a specified accuracy tolerance. That authorization 

extends to unintentional errors, including isolated violations (e.g., an error that occurred only once 

or errors, often without a common cause, that occurred infrequently and randomly). 

Under certain circumstances, the TILA requires federal regulatory agencies to order financial 

institutions to reimburse consumers when understatement of the APR or finance charge involves: 

• Patterns or practices of violations (e.g., errors that occurred, often with a common cause, 

consistently or frequently, reflecting a pattern with a specific type or types of consumer 

credit).

• Gross negligence. 

• Willful noncompliance intended to mislead the person to whom the credit was extended. 

Any proceeding that may be brought by a regulatory agency against a creditor may be maintained 

against any assignee of the creditor if the violation is apparent on the face of the disclosure 

statement or other documents assigned, except where the assignment was involuntary (§131).

Relationship to State Law (TILA § 111)

State laws providing rights, responsibilities, or procedures for consumers or financial institutions for 

consumer credit contracts may be: 

• Preempted by federal law; 

• Not preempted by federal law; or 

• Substituted in lieu of TILA and Regulation Z requirements. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 38

State law provisions are pre-empted to the extent that they contradict the requirements in the 

following chapters of the TILA and the implementing sections of Regulation Z: 

• Chapter 1, “General Provisions,” which contains definitions and acceptable methods for 

determining finance charges and annual percentage rates. 

• Chapter 2, “Credit Transactions,” which contains disclosure requirements, rescission rights, 

and certain credit card provisions. 

• Chapter 3, “Credit Advertising,” which contains consumer credit advertising rules and 

annual percentage rate oral disclosure requirements. 

For example, a state law would be preempted if it required a financial institution to use the 

terms “nominal annual interest rate” in lieu of “annual percentage rate.”

Conversely, state law provisions are not preempted under federal law if they call for, without 

contradicting chapters 1, 2, or 3 of the TILA or the implementing sections of Regulation Z, either of 

the following: 

• Disclosure of information not otherwise required. A state law that requires disclosure of the 

minimum periodic payment for open-end credit, for example, would not be preempted 

because it does not contradict federal law. 

• Disclosures more detailed than those required. A state law that requires itemization of the 

amount financed, for example, would not be preempted unless it contradicts federal law by 

requiring the itemization to appear with the disclosure of the amount financed in the 

segregated closed-end credit disclosures. 

The relationship between state law and chapter 4 of the TILA (“Credit Billing”) involves two parts. 

The first part is concerned with Sections 161 (correction of billing errors) and 162 (regulation of 

credit reports) of the act; the second part addresses the remaining sections of chapter 4. 

State law provisions are preempted if they differ from the rights, responsibilities, or procedures 

contained in Sections 161 or 162. An exception is made, however, for state law that allows a 

consumer to inquire about an account and requires the financial institution to respond to such 

inquiry beyond the time limits provided by federal law. Such a state law would not be preempted 

for the extra time period. 

State law provisions are preempted if they result in violations of Sections 163 through 171 of 

chapter 4. For example, a state law that allows the card issuer to offset the consumer’s credit-card 

indebtedness against funds held by the card issuer would be preempted, since it would violate 12 

CFR 226.12(d). Conversely, a state law that requires periodic statements to be sent more than 14 

days before the end of a free-ride period would not be preempted, since no violation of federal law 

is involved. 

A financial institution, state, or other interested party may ask the Federal Reserve Board to 

determine whether state law contradicts chapters 1 through 3 of the TILA or Regulation Z. They 

also may ask if the state law is different from, or would result in violations of, chapter 4 of the 

TILA and the implementing provisions of Regulation Z. If the board determines that a disclosure 

required by state law (other than a requirement relating to the finance charge, (APR) or the 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 39

disclosures required under § 226.32) is substantially the same in meaning as a disclosure required 

under the act or Regulation Z, generally creditors in that state may make the state disclosure in lieu 

of the federal disclosure.

Subpart E - Special Rules for Certain Home Mortgage 

Transactions 

General Rules (§ 226.31)

The requirements and limitations of this subpart are in addition to and not in lieu of those contained 

in other subparts of Regulation Z. The disclosures for high cost and reverse mortgage transactions 

must be made clearly and conspicuously in writing, in a form that the consumer may keep. 

Credit Subject to § 226.32 

The requirements of this section apply to a consumer credit transaction secured by the consumer’s 

principal dwelling, in which either: 

• The APR at consummation will exceed by more than 8 percentage points for first-lien 

mortgage loans, or by more than 10 percentage points for subordinate-lien mortgage loans, 

the yield on Treasury securities having comparable periods of maturity to the loan’s maturity 

(as of the 15th day of the month immediately preceding the month in which the application 

for the extension of credit is received by the creditor); or 

• The total points and fees (see definition below) payable by the consumer at or before loan 

closing will exceed the greater of 8 percent of the total loan amount or $579 for the calendar 

year 2010. (This dollar amount is adjusted annually based on changes in the Consumer Price 

Index. See staff commentary to 32(a)(1)(ii) for a historical list of dollar amount 

adjustments.) (§ 226.32(a)(1))

Exemptions: 

• Residential mortgage transactions (generally purchase money mortgages),

• Reverse mortgage transactions subject to Section 226.33, or 

• Open-end credit plans subject to Subpart B of Regulation Z. 

Points and fees include the following: 

• All items required to be disclosed under Section 226.4(a) and (b), except interest or the timeprice differential;

• All compensation paid to mortgage brokers; and 

• All items listed in Section 226.4(c)(7), other than amounts held for future taxes, unless all of 

the following conditions are met:

 The charge is reasonable; 

 The creditor receives no direct or indirect compensation in connection with the charge; 

and

 The charge is not paid to an affiliate of the creditor; 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 40

and

• Premiums or other charges, paid at or before closing whether paid in cash or financed, for 

optional credit life, accident, health, or loss-of-income insurance, and other debt-protection 

or debt cancellation products written in connection with the credit transaction 

(§ 226.32(b)(1)).

Prohibited Acts or Practices in Connection with Credit 

Subject to § 226.32

Among other requirements, a creditor extending mortgage credit subject to Section 226.32 (“highcost” mortgage loans) must not make such loans based on the value of the consumer’s collateral 

without regard to the consumer’s repayment ability as of consummation, including mortgagerelated obligations. 

• Mortgage-related obligations are expected property taxes, premiums for mortgage-related 

insurance required by the creditor, and similar expenses. 

• A creditor must also verify amounts of income or assets that it relies on to determine 

repayment ability using tax returns, payroll receipts, financial institution records, or other 

third party documents that provide reasonably reliable evidence of the consumer’s income or 

assets. A creditor must also verify the consumer’s current obligations. 

A presumption of compliance is available for some transactions, but only if the creditor:

• Verifies the consumer’s repayment ability as required;

• Determines the consumer’s repayment ability using the largest payment of principal and 

interest scheduled in the first seven years following consummation and taking into account 

current obligations and mortgage-related obligations; and

• Assesses the consumer’s repayment ability taking into account either the ratio of total debts 

to income or the income the consumer will have after paying debt obligations.

For high-cost mortgage loans, the regulation prohibits the imposition of prepayment penalties under 

certain circumstances, and in no case may a penalty be imposed after two years following 

consummation (five years following consummation for loans for which an application was received 

before October 1, 2009). 

The regulation prohibits prepayment penalties at any time for high-cost mortgage if:

• Other applicable law (e.g., state law) prohibits such penalty;

• The penalty applies where the source of the prepayment funds is a refinancing by the same 

mortgage lender or an affiliate;

• The consumer’s mortgage payment can change during the first four years of the loan term 

(applicable only to loans originated on or after October 1, 2009); or
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 41

• The consumer’s total monthly debt payments (at consummation), including amounts owed 

under the mortgage, exceed 50 percent of the consumer’s monthly gross income.

The regulation prohibits creditors from structuring a home-secured loan as an open-end plan to 

evade these requirements.

Reverse Mortgages (§ 226.33)

A reverse mortgage is a non-recourse transaction secured by the consumer’s principal dwelling that

ties repayment (other than upon default) to the homeowner’s death or permanent move from, or 

transfer of the title of, the home. 

Higher-Priced Mortgage Loans (§ 226.35)

A mortgage loan subject to Section 226.35 (“higher-priced” mortgage loan) is a consumer credit 

transaction secured by the consumer’s principal dwelling with an APR that exceeds the average 

prime offer rate for a comparable transaction as of the date the interest rate is set by:

• 1.5 or more percentage points for loans secured by a first lien on a dwelling; or 

• 3.5 or more percentage points for loans secured by a subordinate lien on a dwelling. 

Average prime offer rate means an APR that is derived from average interest rates, points, and 

other loan pricing terms currently offered to consumers by a representative sample of creditors for 

mortgage transactions that have low-risk pricing characteristics. The Federal Reserve Board 

publishes average prime offer rates for a broad range of types of transactions in a table updated at 

least weekly, as well as the methodology it uses to derive these rates. These rates are available on 

the website of the Federal Financial Institutions Examination Council.

A higher-priced mortgage loan does not include:

• A transaction to finance the initial construction of a dwelling;

• A temporary “bridge” loan with a term of 12 months or less;

• A reverse mortgage subject to Section 226.33; or

• A home equity line of credit subject to Section 226.5(b).

The regulation prohibits prepayment penalties at any time for higher-priced mortgage loans if:

• Other applicable law (e.g., state law) prohibits such penalty;

• The penalty will apply after the two-year period following consummation;

• The source of the prepayment funds is a refinancing by the same mortgage lender or an 

affiliate; or

• The consumer’s mortgage payment can change during the first four years of the loan term.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 42

The regulation prohibits creditors from structuring a home-secured loan as an open-end plan to 

evade these requirements.

With few exceptions, a creditor may not extend a higher-priced mortgage loan secured by a first lien 

on a principal dwelling unless an escrow account is established before consummation for payment 

of property taxes and premiums for mortgage-related insurance required by the creditor. The 

exceptions involve loans secured by shares in a cooperative or condominium units where the 

condominium association has an obligation to maintain a master insurance policy. Additionally, a 

“jumbo” loan secured by a first lien is not subject to the escrow requirement unless its APR rate 

exceeds the average prime offer rate for a comparable transaction as of the date the interest rate is 

set by 2.5 or more percentage points. A “jumbo” loan is a transaction with a principal obligation at 

consummation that exceeds the limit in effect for the maximum principal obligation eligible for 

purchase by Freddie Mac (§ 226.35(b)(3)(v)).

A creditor may allow a consumer to cancel the escrow account one year after consummation if a 

consumer’s written cancellation request is received no earlier than 365 days after consummation. 

Prohibited Acts or Practices in Connection with Credit 

Secured by a Consumer’s Principal Dwelling (§ 226.36)

Loan Servicing Practices

Companies that service mortgage loans are prohibited from engaging in certain practices, such as 

pyramiding late fees. In addition, servicers are required to credit consumers’ loan payments as of 

the date of receipt and provide a payoff statement within a reasonable time of request.

Specifically, for a consumer credit transaction secured by a consumer’s principal dwelling, a loan 

servicer cannot:

• Fail, with limited exception, to credit a payment to the consumer’s loan account as of the 

date of receipt;

• Impose on the consumer any late fee or delinquency charge in connection with a timely 

payment made in full, when the only delinquency is attributable to late fees or delinquency 

charges assessed on an earlier payment; or

• Fail to provide, within a reasonable time after receiving a request from the consumer or 

person acting on behalf of the consumer, an accurate statement of the total outstanding 

balance that would be required to satisfy the consumer’s obligations in full as of a specific 

date.

Loan Originator Compensation

To protect borrowers in the residential mortgage market, certain unfair practices relating to 

compensation of mortgage brokers and other loan originators are prohibited. 

Loan originators include mortgage broker companies, including those companies that close loans in 

their own names in table-funded transactions, and loan officers and other employees of creditors 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 43

that originate loans. Creditors are not considered to be loan originators unless they use table funding 

or function as a mortgage broker in the transaction.

Loan originators cannot:

• Receive, and no person can pay directly or indirectly, compensation based on a loan’s terms 

or conditions other than the loan amount (and then only provided that such compensation is 

based on a fixed percentage of the loan amount);

• Receive compensation, directly or indirectly, from a creditor or another party for a loan 

when a consumer directly pays the loan originator’s compensation; or

• Direct or “steer” a consumer to a loan that is not in a consumer’s interest to increase the loan 

originator’s compensation.

A loan originator can obtain a “safe harbor” for compliance with the anti-steering requirement by 

obtaining loan options from a significant number of the creditors with which the loan originator 

regularly does business and, for each loan type in which the consumer has expressed interest, 

presenting the consumer with loan options for which the loan originator believes in good faith the 

consumer likely qualifies, that include:

1. The loan with the lowest interest rate;

2. The loan with the lowest interest rate without any risky features (such as prepayment 

penalties, negative amortization, or a balloon payment in the first seven years); and

3. The loan with the lowest total dollar amount for origination points or fees and discount 

points.

The loan originator compensation provisions do not apply to open-end home-equity lines of credit 

or to loans secured by a consumer’s interest in a timeshare plan. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 44

Notification or Sale or Transfer of Mortgage Loans

(§ 226.39)

Notice of new owner – No later than 30 calendar days after the date on which a mortgage loan is 

acquired by or otherwise sold, transferred or assigned to a third party, the “covered person”7 shall 

notify the borrower in writing of such transfer and include:

• An identification of the loan that was acquired or transferred;

• The identity, address, and telephone number of the covered person who owns the mortgage 

loan;

• The acquisition date recognized on the books and records of the covered person;

• How to reach an agent or party having authority to act on behalf of the covered person; 

• The location of the place where the transfer of ownership of the debt to the covered person is 

recorded (note, however, that if the transfer of ownership has not been recorded in public 

records at the time the disclosure is provided, the covered person complies with this 

paragraph by stating this fact); and

• At the option of the covered person, any other relevant information regarding the new 

transaction. 

This notice of sale or transfer must be provided for any consumer credit transaction that is secured 

by the principal dwelling of a consumer. Thus, it applies to both closed-end mortgage loans and 

open-end home equity lines of credit. This notification is required of the covered person even if the 

loan servicer remains the same. 

Regulation Z also establishes special rules regarding the delivery of the notice when there is more 

than one covered person. In a joint acquisition of a loan, the covered persons must provide a single 

disclosure that lists the contact information for all covered persons. However, if one of the covered 

persons is authorized to receive a notice of rescission and to resolve issues concerning the 

consumer’s payments, the disclosure may state contact information only for that covered person. In 

addition, if the multiple covered persons each acquire a partial interest in the loan pursuant to 

separate and unrelated agreements, they may provide either a single notice or separate notices. 

Finally, if a covered person acquires a loan and subsequently transfers it to another covered person, 

a single notice may be provided on behalf of both of them, as long as the notice satisfies the timing 

and content requirements with respect to each of them.

 

7 A “covered person” means any person, as defined in 12 CFR 226.2(a)(22), that becomes the owner of an existing mortgage loan by 

acquiring legal title to the debt obligation, whether through a purchase, assignment, or other transfer, and who acquires more than one 

mortgage loan in any 12-month period. For purposes of this section, a servicer of a mortgage loan shall not be treated as the owner of the 

obligation if the servicer holds title to the loan or it is assigned to the services solely for the administrative convenience of the servicer in 

servicing the obligation. See Sec. 226.39(a)(1).
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 45

In addition, there are three exceptions to the notice requirement to provide the notice of sale or 

transfer:

• The covered person sells, assigns, or otherwise transfers legal title to the mortgage loan on 

or before the 30th calendar day following the date of transfer on which it acquired the 

mortgage loan;

• The mortgage loan is transferred to the covered person in connection with a repurchase 

agreement that obligates the transferring party to repurchase the mortgage loan (unless the 

transferring party does not repurchase the mortgage loan); or

• The covered person acquires only a partial interest in the mortgage loan and the agent or 

party authorized to receive the consumer’s rescission notice and resolve issues concerning 

the consumer’s payments on the mortgage loan does not change as a result of that transfer.

Valuation Independence (§ 226.42)

Regulation Z seeks to ensure that real estate appraisers are free to use their independent professional 

judgment in assigning home values without influence or pressure from those with interests in the 

transactions. Regulation Z also seeks to ensure that appraisers receive customary and reasonable 

payments for their services. Regulation Z’s valuation rules apply to creditors and settlement 

services providers for consumer credit transactions secured by the consumer’s principal dwelling 

(“covered transaction”) and includes several provisions that protect the integrity of the appraisal 

process when a consumer’s principal dwelling is securing the loan. In general, the rule prohibits 

“covered persons” from engaging in coercion, bribery, and other similar actions designed to cause 

anyone who prepares a valuation to base the value of the property on factors other than the person’s 

independent judgment.8 More specifically, Regulation Z: 

• Prohibits coercion and other similar actions designed to cause appraisers to base the 

appraised value of properties on factors other than their independent judgment; 

• Prohibits appraisers and appraisal management companies hired by lenders from having 

financial or other interests in the properties or the credit transactions; 

• Prohibits creditors from extending credit based on appraisals if they know beforehand of 

violations involving appraiser coercion or conflicts of interest, unless the creditors determine 

that the values of the properties are not materially misstated; 

• Requires that creditors or settlement service providers that have information about appraiser 

misconduct file reports with the appropriate state licensing authorities; and 

• Requires the payment of reasonable and customary compensation to appraisers who are not 

employees of the creditors or of the appraisal management companies hired by the creditors. 

 

8 This section applies to any consumer credit transaction secured by the consumer’s principal dwelling. A “covered person” 

means a creditor with respect to a covered transaction or a person that provides “settlement services,” as defined in 12 USC 

2602(3) and implementing regulations, in connection with a covered transaction. A “covered transaction” means an 

extension of consumer credit that is or will be secured by the consumer’s principal dwelling, as defined in Sec. 226.2(a)(19).
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 46

Subpart F – Special Rules for Private Education Loans

Special Disclosure Requirements for Private Education Loans 

(§ 226.46)

The disclosures required under Subpart F apply only to private education loans. Except where 

specifically provided otherwise, the requirements and limitations of Subpart F are in addition to the 

requirements of the other subparts of Regulation Z.

A private education loan means an extension of credit that:

• Is not made, insured, or guaranteed under title IV of the Higher Education Act of 1965;

• Is extended to a consumer expressly, in whole or part, for postsecondary educational 

expenses, regardless of whether the loan is provided by the educational institution that the 

student attends; and

• Does not include open-end credit or any loan that is secured by real property or a dwelling.

A private education loan does not include an extension of credit in which the covered educational 

institution is the creditor if:

• The term of the extension of credit is 90 days or less; or

• An interest rate will not be applied to the credit balance and the term of the extension of 

credit is one year or less, even if the credit is payable in more than four installments.

Content of Disclosures (§ 226.47)

Disclosure Requirements

This section establishes the content that a creditor must include in its disclosures to a consumer at 

three different stages in the private education loan origination process:

1) Application or Solicitation Disclosures – With any application or solicitation;

2) Approval Disclosures – With any notice of approval of the private education loan; and

3) Final Disclosures – After the consumer accepts the loan. In addition, Section 226.48(d) 

requires that the disclosures must be provided at least three business days prior to 

disbursement of the loan funds. 

Rights of the Consumer

The creditor must disclose that, if approved for the loan, the consumer has the right to accept the 

loan on the terms approved for up to 30 calendar days. The disclosure must inform the consumer 

that the rate and terms of the loan will not change during this period, except for changes to the rate 

based on adjustments to the index used for the loan and other changes permitted by law. A 

consumer also has the right to cancel the loan, without penalty, until midnight of the third business 

day following the date on which the consumer receives the final disclosures.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 47

Limitations on Private Educational Loans (§ 226.48)

This section contains rules and limitations on private education loans, including:

1) A prohibition on co-branding in the marketing of private education loans;

2) Rules governing the 30-day acceptance period and three-business-day cancellation period

and prohibition on disbursement of loan proceeds until the cancellation period has expired;

3) The requirement that the creditor obtain a self-certification form from the consumer before 

consummation; and

4) The requirement that creditors in preferred lender arrangements provide certain 

information to covered educational institutions.

Co-Branding Prohibited

Regulation Z prohibits creditors from using the name, emblem, mascot, or logo of a covered 

institution (or other words, pictures, or symbols readily identified with a covered institution) in the 

marketing of private education loans in a way that implies endorsement by the educational 

institution. Marketing that refers to an educational institution does not imply endorsement if the 

marketing includes a clear and conspicuous disclosure that is equally prominent and closely 

proximate to the reference to the institution that the educational institution does not endorse the 

creditor’s loans, and that the creditor is not affiliated with the educational institution. There is also 

an exception in cases where the educational institution actually does endorse the creditor’s loans, 

but the marketing must make a clear and conspicuous disclosure that is equally prominent and 

closely proximate to the reference to the institution that the creditor, and not the educational 

institution, is making the loan.

Subpart G – Special Rules Applicable to Credit Card 

Accounts and Open-End Credit Offered to College 

Students

Evaluation of the Consumer’s Ability to Pay (§ 226.51)

Regulation Z requires credit card issuers to consider a consumer’s ability to pay before opening a 

new credit card account or increasing the credit limit for an existing credit card account. 

Additionally, the rule provides specific requirements before opening a new credit card account or 

increasing the credit limit on an existing account when the consumer is under the age of 21.

When evaluating a consumer’s ability to pay, credit card issuers must perform a review of a 

consumer’s income or assets and current obligations. Creditors are permitted, however, to rely on 

information provided by the consumer. The rule does not require issuers to verify a consumer’s 

statements. A card issuer may also consider information obtained through any empirically derived, 

demonstrably and statistically sound model that reasonably estimates a consumer’s income or 

assets. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 48

The rule also requires that issuers consider at least one of the following:

• The ratio of debt obligations to income;

• The ratio of debt obligations to assets; or

• The income the consumer will have after paying debt obligations (i.e., residual income).

The rule also provides that it would be unreasonable for an issuer not to review any information 

about a consumer’s income, assets, or current obligations, or to issue a credit card to a consumer 

who does not have any income or assets.

Because credit card accounts typically require consumers to make a minimum monthly payment 

that is a percentage of the total balance (plus, in some cases, accrued interest and fees), creditors are 

required to consider the consumer’s ability to make the required minimum payments. Card issuers 

must also establish and maintain reasonable written policies and procedures to consider a 

consumer’s income or assets and current obligations. Because the minimum payment is unknown at 

account opening, the rule requires that creditors use a reasonable method to estimate a consumer’s 

minimum payment. The regulation provides a safe harbor for issuers to estimate the required 

minimum periodic payment if the card issuer:

1. Assumes utilization, from the first day of the billing cycle, of the full credit line that the 

issuer is considering offering to the consumer; and

2. Uses a minimum payment formula employed by the issuer for the product the issuer is 

considering offering to the consumer or, in the case of an existing account, the minimum 

payment formula that currently applies to that account, provided that:

a) If the minimum payment formula includes interest charges, the card issuer estimates those 

charges using an interest rate that the issuer is considering offering to the consumer for 

purchases or, in the case of an existing account, the interest rate that currently applies to 

purchases; and

b) If the applicable minimum payment formula includes mandatory fees, the card issuer must 

assume that such fees have been charged to the account.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 49

Specific Requirements for Underage Consumers 

(§ 226.51(b)(1))

Regulation Z prohibits the issuance of a credit card to a consumer who has not attained the age of 

21 unless the consumer has submitted a written application and the creditor has:

• Information indicating that the underage consumer has an independent means of repaying 

any debts incurred in connection with the account; or

• The signature of a cosigner who has attained the age of 21, who has the means to repay 

debts incurred by the underage consumer in connection with the account, and who assumes 

joint liability for such debts. 

If the account is opened based on a cosigner’s ability to pay, the issuer must also obtain written 

consent from the cosigner before increasing the credit limit.

Limitations of Fees (§ 226.52)

Limitations during first year after account opening 

(§ 226.52(a))

During the first year after account opening, issuers are prohibited from requiring consumers to pay 

fees (other than fees for late payments, returned payments, and exceeding the credit limit) that in the 

aggregate exceed 25% of the initial credit limit.

Limitations on Penalty Fees (§ 226.52(b))

The regulation requires that penalty fees imposed by card issuers be reasonable and proportional to 

the violation of the account terms. Among other things, the regulation prohibits credit card issuers 

from charging a penalty fee of more than $25 for paying late or otherwise violating the account’s 

terms for the first violation (or $35 for an additional violation of the same type during the next six 

billing cycles) unless the issuer determines that a higher fee represents a reasonable proportion of 

the costs it incurs as a result of that type of violation.

The regulation also prohibits credit card issuers from charging penalty fees that exceed the dollar 

amount associated with the consumer’s violation. For example, card issuers are no longer permitted 

to charge a $39 fee when a consumer is late making a $20 minimum payment. Instead, in this 

example, the fee cannot exceed $20. The regulation also bans “inactivity” fees, such as fees based 

on the consumer’s failure to use the account to make new purchases, and it prevents issuers from 

charging multiple penalty fees based on a single late payment or other violation of the account 

terms.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 50

Payment Allocation (§ 226.53)

When different rates apply to different balances on a credit card account, issuers are required to 

allocate payments in excess of the minimum payment to first pay the balance with the highest APR, 

and any remaining portion to the other balances in descending order based on the applicable APR. 

For deferred interest programs, however, issuers must allocate excess payments first to the deferred 

interest balance during the last two billing cycles of the deferred interest period. In addition, during 

a deferred interest period, issuers are permitted (but not required) to allocate excess payments in the 

manner requested by the consumer.

Double-Cycle Billing and Partial Grace Period (§ 226.54)

Issuers are prohibited from imposing finance charges on balances for days in previous billing cycles 

as a result of the loss of a grace period. In addition, when a consumer pays some, but not all, of a 

balance prior to the expiration of a grace period, an issuer is prohibited from imposing finance 

charges on the portion of the balance that has been repaid.

General Prohibition on Applying Increased Rates to Existing 

Balances (§ 226.55)

There are some general exceptions to the prohibition against applying increased rates to existing 

balances:

• A temporary rate lasting at least six months expires, provided that the credit card issuer 

complied with applicable disclosure requirements;

• The rate is increased due to the operation of an index available to the general public and not 

under the issuer’s control (i.e., the rate is a variable rate);

• The minimum payment has not been received within 60 days after the due date;

• The consumer successfully completes or fails to comply with the terms of a workout 

arrangement; or

• The APR on an existing balance has been reduced pursuant to the Servicemembers Civil 

Relief Act (SCRA). The creditor is permitted to increase the rate once the SCRA ceases to 

apply, but only to the rate that applied prior to the reduction.

Regulation Z’s limitations on the application of increased rates to existing balances continue to 

apply when the account is closed, acquired by another institution through a merger or the sale of a 

credit card portfolio, or when the balance is transferred to another credit account issued by the same 

creditor (or its affiliate or subsidiary).

For new transactions, creditors are generally prevented from increasing the APR during the first 

year after an account is opened. After the first year, creditors are permitted to increase the APRs 

that apply to new transactions so long as the creditor complies with the regulation’s 45-day advance 

notice requirement (§ 226.9).
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 51

Fees for Transactions that Exceed the Credit Limit 

(§ 226.56)

Consumer consent requirement – Regulation Z requires an issuer to obtain a consumer’s express 

consent (or opt-in) before the issuer may impose any fees on a consumer’s credit card account for 

making an extension of credit that exceeds the account’s credit limit. Prior to providing such 

consent, the consumer must be notified by the issuer of any fees that may be assessed for an overthe-limit transaction. If the consumer consents, the issuer is also required to provide a notice of the 

consumer’s right to revoke that consent of any periodic statement that reflects the imposition of an 

over-the-limit fee.

Prior to obtaining a consumer’s consent to the payment of over-the-limit transactions, the issuer 

must provide the consumer with a notice disclosing, among other things, the dollar amount of any 

charges that will be assessed for an over-the-limit transaction, as well as any increased rate that may 

apply if the consumer exceeds the credit limit. Issuers are prevented from assessing any over-thelimit fee or charge on an account unless the consumer consents to the payment of transactions that 

exceed the credit limit.

Prohibited practices – Even if the consumer has affirmatively consented to the issuer’s payment of 

over-the-limit transactions, Regulation Z prohibits certain issuer practices in connection with the 

assessment of over-the-limit fees or charges. An issuer can only charge one over-the-limit fee or 

charge per billing cycle. In addition, an issuer cannot impose an over-the-limit fee on the account 

for the same transaction in more than three billing cycles. Furthermore, fees may not be imposed for 

the second or third billing cycle unless the consumer has failed to reduce the account balance below 

the credit limit by the payment due date in that cycle.

Regulation Z also prevents unfair or deceptive acts or practices in connection with the manipulation 

of credit limits in order to increase over-the-limit fees or other penalty charges. Specifically, issuers 

are prohibited from engaging in three practices:

• Assessing an over-the-limit fee because the creditor failed to promptly replenish the 

consumer’s available credit;

• Conditioning the amount of available credit on the consumer’s consent to the payment of 

over-the-limit transactions (e.g., opting in to an over-the-limit service to obtain a higher 

credit limit); and

• Imposing any fee if the credit limit is exceeded solely because of the issuer’s assessment of 

accrued interest charges or fees on the consumer’s account.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 52

Special Rules for Marketing to Students (§ 226.57)

Regulation Z establishes several requirements related to the marketing of credit cards and other 

open-end consumer credit plans to students at an institution of higher education. The regulation 

limits a creditor’s ability to offer a college student any tangible item to induce the student to apply 

for or participate in an open-end consumer credit plan offered by the creditor. Specifically, 

Regulation Z prohibits such offers:

• On the campus of an institution of higher education;

• Near the campus of an institution of higher education; or

• At an event sponsored by or related to an institution of higher education

A tangible item means physical items, such as gift cards, cash (currency or coins), T-shirts, or 

magazine subscriptions, but does not include non-physical items such as discounts, reward points, 

or promotional credit terms. With respect to offers “near” the campus, the commentary to the 

regulation states that a location that is within 1,000 feet of the border of the campus is considered 

near the campus.

Regulation Z also requires card issuers to submit an annual report to the Board containing the terms 

and conditions of business, marketing, or promotional agreements with an institution of higher 

education or an alumni organization or foundation affiliated with an institution of higher education.

Online Disclosure of Credit Card Agreements (§ 226.58)

The regulation requires that issuers post credit card agreements on their websites and to submit 

those agreements to the Board for posting on a website maintained by the Board. There are three 

exceptions for when issuers are not required to provide statements to the Board:

• The issuer has fewer than 10,000 open credit card accounts;

• The agreement currently is not offered to the public and is used only for one or more private 

label credit card plans with credit cards usable only at a single merchant or group of 

affiliated merchants and that involves fewer than 10,000 accounts; or

• The agreement currently is not offered to the public and is for one or more plans offered to 

test a new product offered only to a limited group of consumers for a limited time that 

involves fewer than 10,000 accounts.

Re-evaluation of Rate Increases (§ 226.59)

For any rate increase imposed on or after January 1, 2009, the regulation requires card issuers to 

review the account no less frequently than once each six months and, if appropriate based on that 

review, reduce the annual percentage rate. The requirement to reevaluate rate increases applies both 

to increases in annual percentage rates based on consumer-specific factors, such as changes in the 

consumer’s creditworthiness, and to increases in annual percentage rates imposed based on factors 

that are not specific to the consumer, such as changes in market conditions or the issuer’s cost of 

funds. If based on its review a card issuer is required to reduce the rate applicable to an account, the 

final regulation requires that the rate be reduced within 45 days after completion of the evaluation.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 53

Specific Defenses (TILA § 108)

Defense Against Civil, Criminal, and Administrative Actions 

A financial institution in violation of TILA may avoid liability by: 

• Discovering the error before an action is brought against the financial institution, or before 

the consumer notifies the financial institution, in writing, of the error. 

• Notifying the consumer of the error within 60 days of discovery. 

• Making the necessary adjustments to the consumer’s account, also within 60 days of 

discovery. (The consumer will pay no more than the lesser of the finance charge actually 

disclosed or the dollar equivalent of the APR actually disclosed.) 

The above three actions also may allow the financial institution to avoid a regulatory order to 

reimburse the customer. 

An error is “discovered” if it is: 

• Discussed in a final, written report of examination. 

• Identified through the financial institution’s own procedures. 

• An inaccurately disclosed APR or finance charge included in a regulatory agency 

notification to the financial institution. 

When a disclosure error occurs, the financial institution is not required to re-disclose after a loan has 

been consummated or an account has been opened. If the financial institution corrects a disclosure 

error by merely re-disclosing required information accurately, without adjusting the consumer’s 

account, the financial institution may still be subject to civil liability and an order to reimburse from 

its regulator. 

The circumstances under which a financial institution may avoid liability under the TILA do not 

apply to violations of the Fair Credit Billing Act (chapter 4 of the TILA). 

Additional Defenses Against Civil Actions 

The financial institution may avoid liability in a civil action if it shows by a preponderance of 

evidence that the violation was not intentional and resulted from a bona fide error that occurred 

despite the maintenance of procedures to avoid the error. 

A bona fide error may include a clerical, calculation, computer malfunction, programming, or 

printing error. It does not include an error of legal judgment. 

Showing that a violation occurred unintentionally could be difficult if the financial institution is 

unable to produce evidence that explicitly indicates it has an internal controls program designed to 

ensure compliance. The financial institution’s demonstrated commitment to compliance and its 

adoption of policies and procedures to detect errors before disclosures are furnished to consumers 

could strengthen its defense. 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 54

Statute of Limitations (TILA §§ 108 and 130)

Civil actions may be brought within one year after the violation occurred. For private education 

loans, civil actions may be brought within one year from the date on which the first regular payment 

of principal and interest is due. After that time, and if allowed by state law, the consumer may still 

assert the violation as a defense if a financial institution were to bring an action to collect the 

consumer’s debt. 

Criminal actions are not subject to the TILA one-year statute of limitations. 

Regulatory administrative enforcement actions also are not subject to the one-year statute of 

limitations. However, enforcement actions under the policy guide involving erroneously disclosed 

APRs and finance charges are subject to time limitations by the TILA. Those limitations range from 

the date of the last regulatory examination of the financial institution, to as far back as 1969, 

depending on when loans were made, when violations were identified, whether the violations were 

repeat violations, and other factors. 

There is no time limitation on willful violations intended to mislead the consumer. A summary of 

the various time limitations follows. 

• For open-end credit, reimbursement applies to violations not older than two years. 

• For closed-end credit, reimbursement is generally directed for loans with violations 

occurring since the immediately preceding examination.

Rescission Rights (Open-End and Closed-End Credit) 

(§§ 226.15 and 226.23)

TILA provides that for certain transactions secured by the consumer’s principal dwelling, a 

consumer has three business days after becoming obligated on the debt to rescind the transaction. 

The right of rescission allows consumers time to reexamine their credit agreements and cost 

disclosures and to reconsider whether they want to place their homes at risk by offering them as 

security for the credit. A higher-priced mortgage loan (whether or not it is a Home Ownership and 

Equity Protection Act (HOEPA) loan) having a prepayment penalty that does not conform to the 

prepayment penalty limitations (§ 226.32 (c) and (d) and (§ 226. 35(b)(2) is also subject to a threeyear right of rescission. Transactions exempt from the right of rescission include residential 

mortgage transactions (§ 226.2(a)(24)) and refinancings or consolidations with the original creditor 

where no “new money” is advanced.

If a transaction is rescindable, consumers must be given a notice explaining that the creditor has a 

security interest in the consumer’s home, that the consumer may rescind, how the consumer may 

rescind, the effects of rescission, and the date the rescission period expires.

To rescind a transaction, a consumer must notify the creditor in writing by midnight of the third 

business day after the latest of three events: consummation of the transaction, delivery of material 
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 55

TILA disclosures, or receipt9 of the required notice of the right to rescind. For purposes of 

rescission, business day means every calendar day except Sundays and the legal public holidays 

(§ 226.2(a)(6)). The term “material disclosures” is defined in Section 226.23(a)(3) to mean the 

required disclosures of the APR, the finance charge, the amount financed, the total of payments, the 

payment schedule, and the disclosures and limitations referred to in Section 226.32(c) and (d). 

The creditor may not disburse any monies (except into an escrow account) and may not provide 

services or materials until the three-day rescission period has elapsed and the creditor is reasonably 

satisfied that the consumer has not rescinded. If the consumer rescinds the transaction, the creditor 

must refund all amounts paid by the consumer (even amounts disbursed to third parties) and 

terminate its security interest in the consumer’s home.

A consumer may waive the three-day rescission period and receive immediate access to loan 

proceeds if the consumer has a “bona fide personal financial emergency.” The consumer must give 

the creditor a signed and dated waiver statement that describes the emergency, specifically waives 

the right, and bears the signatures of all consumers entitled to rescind the transaction. The consumer 

provides the explanation for the bona fide personal financial emergency, but the creditor decides the 

sufficiency of the emergency. 

If the required rescission notice or material TILA disclosures are not delivered or if they are 

inaccurate, the consumer’s right to rescind may be extended from three days after becoming 

obligated on a loan to up to three years.

References

Laws

15 USC 1601 et seq. Truth in Lending Act (TILA)

15 USC 1666 et seq. Fair Credit Billing Act

15 USC 7001 et seq. Electronic Signatures in Global and National Commerce Act

Regulations

Federal Reserve Board Regulations (12 CFR)

Part 226 Truth in Lending (Regulation Z)

Final Rules

75 FR 66554 Interim Final Rule to implement Section 129E of the Truth in 

Lending Act (Regulation Z) enacted on July 21, 2010, as 

Section 1472 of the Dodd-Frank Wall Street Reform and 

 

9 12 CFR 226.15(b) and 226.23(b)(1) were amended to include the electronic delivery of the notice of the right to rescind. If a paper 

notice of the right to rescind is used, a creditor must deliver two copies of the notice to each consumer entitled to rescind. However, 

under the final rule on electronic delivery of the disclosures if the notice is in electronic form, in accordance with the consumer consent 

and other applicable provisions of the E-Sign Act, only one copy to each customer is required.
CFPB Consumer Laws

and Regulations TILA

CFPB FFIEC Rev. 5/2011 TILA 56

Consumer Protection Act that establishes new requirements for 

appraisal independence for consumer credit transactions secured 

by the consumer’s principal dwelling (October 28, 2010) 

75 FR 58509 Final Rule amending Regulation Z to prohibit payments to loan 

originators based on the terms or conditions of the transaction, 

other than the amount of credit extended (September 24, 2010)

75 FR 58489 Final Rule amending Regulation Z to implement Section 131(g) 

of the Truth in Lending Act that established a new requirement 

for notifying consumers of the sale or transfer of their mortgage 

loans (September 24, 2010) 

75 FR 58470 Interim Rule amending Regulation Z to implement certain 

requirements of the Mortgage Disclosure Improvement Act of 

2008 (September 24, 2010) 

75 FR 37526 Final Rule Implementing Truth in Lending Act (Regulation Z) 

to implement provisions of the Credit CARD Act Open-End 

Credit Stage III (June 29, 2010) 

75 FR 7658 Final Rule Implementing Truth in Lending Act (Regulation Z) 

to implement provisions of the Credit CARD Act Open-End 

Credit Stage II (February 22, 2010)

74 FR 41194 Final Rule Implementing the Higher Education Opportunity Act 

(HEOA) adding disclosure and timing requirements for creditors 

making private education loans (August 14, 2009)

74 FR 40477 Final Rule amending the Staff Commentary Re: Annual Feebased Trigger for High-Cost Mortgage Disclosures (August 12, 

2009)

74 FR 36077 Interim Final Rule on Credit Cards (July 22, 2009)

74 FR 23289 Final Rule Implementing the Mortgage Disclosure Improvement 

Act (MDIA) (May 19, 2009)

74 FR 5244 Final Rule; Truth in Lending (January 29, 2009)

73 FR 44522 Final Rule Implementing Home Ownership and Equity 

Protection Act (HOEPA) (July 30, 2008)
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 1

Examination Objectives

• To appraise the quality of the financial 

institution’s compliance management system 

for the Truth in Lending Act (TILA) and 

Regulation Z. 

• To determine the reliance that can be placed on the financial institution’s compliance 

management system, including internal controls and procedures performed by the 

person(s) responsible for monitoring the financial institution’s compliance review 

function for the Truth in Lending Act and Regulation Z. 

• To determine the financial institution’s compliance with the Truth in Lending Act and 

Regulation Z. 

• To initiate corrective action when policies or internal controls are deficient, or when 

violations of law or regulation are identified. 

• To determine whether the institution will be required to make adjustments to consumer 

accounts under the restitution provisions of the Act. 

General Procedures

1. Obtain information pertinent to the area of examination from the financial 

institution’s compliance management system program (historical examination 

findings, complaint information, and significant findings from compliance 

review and audit).

[Click&type]

2. Through discussions with management and review of the following 

documents, determine whether the financial institution’s internal controls are 

adequate to ensure compliance in the area under review. Identify procedures 

used daily to detect errors/violations promptly. Also, review the procedures 

used to ensure compliance when changes occur (e.g., changes in interest rates, 

service charges, computation methods, and software programs).

• Organizational charts.

• Process flowcharts.

• Policies and procedures.

• Loan documentation and disclosures.

• Checklists/worksheets and review documents.

• Computer programs.

[Click&type]

3. Review compliance review and audit work papers and determine whether: 

a. The procedures used address all regulatory provisions (see Transactional 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 2

Testing section). 

b. Steps are taken to follow up on previously identified deficiencies. 

c. The procedures used include samples that cover all product types and 

decision centers. 

d. The work performed is accurate (through a review of some transactions). 

e. Significant deficiencies, and the root cause of the deficiencies, are 

included in reports to management/board. 

f. Corrective actions are timely and appropriate. 

g. The area is reviewed at an appropriate interval.

[Click&type]

4. Review the financial institution’s record retention practices to determine 

whether evidence of compliance (for other than the advertising requirements) 

is retained for at least two years after the disclosures were required to be 

made or other action was required to be taken (§ 226.25).

[Click&type]

Disclosure Forms

5. Determine if the financial institution has changed any TILA disclosure forms 

or if there are forms that have not been previously reviewed for accuracy. If 

so:

Verify the accuracy of each disclosure by reviewing the following: 

• Credit card application/solicitation disclosures (§ 226.5a(b)-(e)). 

• HELOC disclosures (§ 226.5b(d) and (e)). 

• Initial disclosures (§ 226.6(a)-(d)) and, if applicable, additional HELOC 

disclosures (§ 226.6(e)). 

• Periodic statement disclosures (§ 226.7).

• Statement of billing rights and change in terms notice (§ 226.9(a),(b),(c) 

or (g)). 

• Note and/or contract forms (including those furnished to dealers). 

• Notice of Right to Rescind/Cancel (§§ 226.15(b), 226.23(b)(1)) and 

226.47(c)(4).

• Standard closed-end credit disclosures (§§ 226.17(a) and 226.18).

• ARM disclosures (§ 226.19(b)). 

• High cost mortgage disclosures (§ 226.32(c)).

• Reverse mortgage disclosures (§ 226.33(b)).

• Private education loan disclosures (§ 226.47).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 3

[Click&type]

Closed-End Credit Disclosure Forms Review Procedures

a. Determine that the disclosures are clear, conspicuous, and grouped 

together or segregated as required. The terms “Finance Charge” and 

“Annual Percentage Rate” and corresponding rates or amounts should be 

more conspicuous than other terms, except for the creditor’s identity. For 

private student loans, the term “Annual Percentage Rate” and 

corresponding rate must be less conspicuous than the term “finance 

charge” and the corresponding amount, as well as less conspicuous than 

the interest rate and notice of the right to cancel and the creditor’s identity

(§§ 226.17(a), 226.47(b), and (c)).

[Click&type]

b. Determine the disclosures include the following as applicable (§ 226.18).

1. Identity of the creditor.

2. Brief description of the finance charge.

3. Brief description of the APR.

4. Variable rate information (§ 226.18(f)(1) or (2)).

5. Payment schedule.

6. Brief description of the total of payments.

7. Demand feature.

8. Description of total sales price in a credit sale.

9. Prepayment penalties or rebates.

10. Late payment amount or percentage.

11. Description for security interest.

12. Insurance conditions for finance charge exclusions (§ 226.4(d)).

13. Statement referring to the contract.

14. Statement regarding assumption of the note.

15. Statement regarding required deposits.

[Click&type]

c. Determine all variable rate loans with a maturity greater than one year 

secured by a principal dwelling are given the following disclosures at the 

time of application (§ 226.19). 

1. Consumer handbook on adjustable rate mortgages or substitute.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 4

2. Statement that interest rate payments and/or terms can change.

3. The index/formula and a source of information.

4. Explanation of the interest rate/payment determination and margin.

5. Statement that the consumer should ask for the current interest rate 

and margin.

6. Statement that the interest rate is discounted, if applicable.

7. Frequency of interest rate and payment changes.

8. Rules relating to all changes. 

9. Either a historical example based on 15 years, or the initial rate and 

payment with a statement that the periodic payment may substantially 

increase or decrease together with a maximum interest rate and 

payment.

10. Explanation of how to compute the loan payment, giving an example.

11. Demand feature, if applicable.

12. Statement of content and timing of adjustment notices.

13. Statement that other variable rate loan program disclosures are 

available, if applicable.

[Click&type]

d. Determine that the disclosures required for high-cost mortgage 

transactions (§ 226.32) clearly and conspicuously include the items below 

(§ 226.32(c), see Form H-16 in Appendix H).

1. The required statement “you are not required to complete this 

agreement merely because you have received these disclosures or 

have signed a loan application. If you obtain this loan, the lender will 

have a mortgage on your home. You could lose your home, and any 

money you have put into it, if you do not meet your obligations under 

the loan”.

2. APR.

3. Amount of the regular monthly (or other periodic) payment and the 

amount of any balloon payment. The regular payment should include 

amounts for voluntary items, such as credit life insurance or debtcancellation coverage, only if the consumer has previously agreed to 

the amount [See staff commentary to 32(c)(3)].

4. Statement that the interest rate may increase, and the amount of the 

single maximum monthly payment, based on the maximum interest 

rate allowed under the contract, if applicable.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 5

5. For a mortgage refinancing, the total amount borrowed, as reflected 

by the face amount of the note; and where the amount borrowed 

includes premiums or other charges for optional credit insurance or 

debt-cancellation coverage, that fact shall be stated (grouped together 

with the amount borrowed).

[Click&type]

e. For any closed-end mortgage loan (credit transaction that is secured by the 

principal dwelling of a consumer) that was sold or otherwise transferred 

or assigned to the covered person, determine that the covered person 

notifies the borrower in writing of such transfer, including (§ 226.39):

1. An identification of the loan that was acquired or transferred;

2. The identity, address, telephone number of the new covered person 

who owns the mortgage loan;

3. The acquisition date recognized on the books and records of the 

covered person;

4. How to reach an agent or party having authority to act on behalf of 

the covered person; 

5. The location of the place where the transfer of ownership of the debt 

to the covered person is recorded (note, however, that if the transfer 

of ownership has not been recorded in public records at the time the 

disclosure is provided, the covered person complies with this 

paragraph by stating this fact); and

6. At the option of the covered person, any other relevant information 

regarding the transaction.

NOTE: This notice of sale or transfer must be provided for any 

consumer credit transaction that is secured by the principal dwelling of 

a consumer. This notification is required even if the loan servicer 

remains the same.

[Click&type]

f. For private education loans subject to Subpart F, ensure that the required 

disclosures are accurate (§ 226.47) and contain the following information:

1. Application or solicitation disclosures disclose the following:

i. Interest rate, including:

a. Rate or range, and if the rate depends in part on a 

determination of the borrower’s creditworthiness or other 

factors, a statement to that effect;
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 6

b. Whether rate is fixed or variable;

c. If rate may increase after consummation, any limitations, or 

lack thereof, and if the limitation is imposed by law, that fact. 

Also, the creditor must state that the consumer’s actual rate 

may be higher or lower than that disclosed, if applicable; and

d. Whether the rate will typically be higher if the loan is not cosigned or guaranteed.

ii. Fees and default or late payment costs.

iii. Repayment terms, including:

a. Term of the loan, which is the period during which regularly 

scheduled payments of principal and interest will be due.

b. Deferral options, or if consumer does not have the option to 

defer, that fact. 

c. For each available deferral option applicable, information as 

to:

1. Whether interest will accrue during deferral period; 

2. If interest accrues, whether payment of interest may be 

deferred and added to the principal balance; and

3. A statement that, if the consumer files bankruptcy, the 

consumer may still be required to repay the loan.

iv. Cost estimates, based on an example of the total cost of the loan, 

calculated using:

a. The highest interest rate and including all applicable finance 

charges;

b. An amount financed of $10,000, or $5,000, if the creditor 

offers loans less than $10,000; and

c. Calculated for each payment option. 

v. Eligibility (e.g. any age or school enrollment requirements);

vi. Alternatives to private education loans, including:

a. A statement that the consumer may qualify for Federal student 

loans;

b. The interest rates available for each program available under 

Title IV of the Higher Education Act of 1965, and whether the 

rate is variable or fixed; 

c. A statement that the consumer may obtain additional 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 7

information regarding student federal financial assistance from 

his school or U.S. Department of Education, including an 

appropriate website; and

d. A statement that a covered educational institution may have 

school specific educational loan benefits and terms not detailed 

in the loan disclosure forms. 

vii. A statement that if the loan is approved, that the loan will be 

available for 30 days and the terms will not change, except for 

changes to the interest rate in the case of a variable rate and other 

changes permitted by law.

viii. A statement that before consummation, the borrower must 

complete a self-certification form obtained from the student’s 

institution of higher education. 

2. For approval disclosures the following information is required under 

Section 226.18:

i. Interest rate, information, including:

a. Interest rate applicable to the loan;

b. Whether the interest rate is variable or fixed; and

c. If the interest rate may increase after consummation, any 

limitations on the rate adjustments, or lack thereof.

ii. Fees and default or late payment costs, including: 

a. An itemization of the fees or range of fees required to obtain 

the loan; and

b. Any fees, changes to the interest rate, and adjustments to 

principal based on the consumer’s defaults or late payments.

iii. Repayment terms, including:

a. Principal amount;

b. Term of the loan;

c. A description of the payment deferral option chosen by the 

consumer, if applicable, and any other payment deferral 

options that the consumer may elect at a later time; 

d. Any payments required while the student is enrolled at the 

educational institution, based on the deferral option chosen by 

the consumer; 

e. Amount of any unpaid interest that will accrue while the 

student is enrolled in school, based upon the deferral option 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 8

chosen by the consumer;

f. A statement that if the consumer files for bankruptcy, that the 

consumer may still be required to pay back the loan;

g. An estimate of the total amount of payments calculated based 

upon:

1. The interest rate applicable to the loan (compliance with 

§ 226.18(h) constitutes compliance with this 

requirement).

2. The maximum possible rate of interest for the loan, or, if 

a maximum rate cannot be determined, a rate of 25

percent.

3. If a maximum rate cannot be determined, the estimate of 

the total amount for repayment must include a statement 

that there is no maximum rate and that the total amount 

for repayment disclosed is an estimate.

h. The maximum monthly payment based on the maximum rate 

of interest for the loan, or, if a maximum rate of interest 

cannot be determined, a rate of 25 percent. If a maximum 

cannot be determined, a statement that there is no maximum 

rate and that the monthly payment amount disclosed is an 

estimate and will be higher if the applicable interest rate 

increases.

iv. Alternatives to private education loans, including:

a. A statement that the consumer may qualify for Federal 

student loans;

b. The interest rates available for each program available under 

Title IV of the Higher Education Act of 1965, and whether 

the rate is variable or fixed; and

c. A statement that the consumer may obtain additional 

information regarding student federal financial assistance 

from his school or U.S. Department of Education, including 

an appropriate website.

v. A statement that the consumer may accept the terms of the loan until 

the acceptance period under Section 226.48(c)(1) has expired. The 

statement must include:

a. The specific date on which the acceptance period expires, based 

on the date upon which the consumer receives the disclosures 

required under this subsection for the loan;

b. The method or methods by which the consumer may 

communicate the acceptance (written, oral, or by electronic 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 9

means; and

c. A statement that except for changes to the interest rate and other 

changes permitted by law, the rates and the terms of the loan 

may not be changed by the creditor during the 30 day 

acceptance period.

3. After the consumer has accepted the loan in accordance with Section

226.48(a), final disclosures must disclose the information required 

under Section 226.18 and the following:

i. Interest rate, including:

a. Interest rate applicable to the loan;

b. Whether the interest rate is variable or fixed; and

c. If the interest rate may increase after consummation, any 

limitations on the rate adjustments, or lack thereof.

ii. Fees and default or late payment costs, including: 

a. An itemization of the fees or range of fees required to obtain 

the loan; and

b. Any fees, changes to the interest rate, and adjustments to 

principal based on the consumer’s defaults or late payments.

iii. Repayment terms, including:

a. Principal amount;

b. Term of the loan;

c. A description of the payment deferral option chosen by the 

consumer, if applicable, and any other payment deferral 

options that the consumer may elect at a later time; 

d. Any payments required while the student is enrolled at the 

educational institution, based on the deferral option chosen 

by the consumer; 

e. Amount of any unpaid interest that will accrue while the 

student is enrolled in school, based upon the deferral option 

chosen by the consumer;

f. A statement that if the consumer files for bankruptcy, that the 

consumer may still be required to pay back the loan;

g. An estimate of the total amount of payments calculated based 

upon:

1. The interest rate applicable to the loan (compliance with 

§ 226.18(h) constitutes compliance with this 

requirement); 

2. The maximum possible rate of interest for the loan, or, if 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 10

a maximum rate cannot be determined, a rate of 25

percent;

3. If a maximum rate cannot be determined, the estimate of 

the total amount for repayment must include a statement 

that there is no maximum rate and that the total amount 

for repayment disclosed is an estimate.

h. The maximum monthly payment based on the maximum rate 

of interest for the loan, or, if a maximum rate of interest 

cannot be determined, a rate of 25 percent. If a maximum 

cannot be determined, a statement that there is no maximum 

rate and that the monthly payment amount disclosed is an 

estimate and will be higher if the applicable interest rate 

increases.

iv. In a text more conspicuous than any other required disclosure, 

except for the finance charge, the interest rate, and the creditor’s 

identity, the following disclosures: 

a. A statement that the consumer has the right to cancel the 

loan, without penalty, at any time before midnight of the 

third business day following the date on which the consumer 

receives the final loan disclosures. The statement must 

include the specific date on which the cancellation period 

expires and that the consumer may cancel by that date.

b. A statement that the loan proceeds will not be disbursed until 

the cancellation period expires. 

c. The method or methods by which the consumer may cancel.

d. If the creditor permits cancellation by mail, the statement 

specifying that the consumer’s mailed request will be 

deemed timely if placed in the mail not later than the 

cancellation date specified on the disclosures. 

[Click&type]

Open-End Credit Forms Review Procedures

a. Determine that the creditor made the disclosures clearly and 

conspicuously (§ 226.5(a)).

[Click&type]

b. Determine that the creditor made the applicable disclosures in writing, in a 

form that the consumer may keep, except (§ 226.5(a)(1)(ii)):

1. The following disclosures need not be written: Disclosures under 

Section 226.6(b)(3) of charges that are imposed as part of an open-
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 11

end (not home-secured) plan that are not required to be disclosed 

under Section 226.6(b)(2) and related disclosures of charges under 

Section 226.9(c)(2)(iii)(B); disclosures under Section 226.9(c)(2)(vi); 

disclosures under Section 226.9(d) when a finance charge is imposed 

at the time of the transaction; and disclosures under 

Section 226.56(b)(1)(i).

2. The following disclosures need not be in a retainable form: 

Disclosures that need not be written under paragraph (a)(1)(ii)(A) of 

this section; disclosures for credit and charge card applications and 

solicitations under Section 226.5a; home-equity disclosures under 

Section 226.5b(d); the alternative summary billing-rights statement 

under Section 226.9(a)(2); the credit and charge card renewal 

disclosures required under Section 226.9(e); and the payment 

requirements under Section 226.10(b), except as provided in 

Section 226.7(b)(13).

3. The disclosures required by this subpart may be provided to the 

consumer in electronic form, subject to compliance with the 

consumer consent and other applicable provisions of the Electronic 

Signatures in Global and National Commerce Act (E-Sign Act) (15 

USC 7001 et seq. ). The disclosures required by Sections 226.5a, 

226.5b, and 226.16 may be provided to the consumer in electronic 

form without regard to the consumer consent or other provisions of 

the E-Sign Act in the circumstances set forth in those sections.

[Click&type]

c. Determine that the terminology used in providing the disclosures required 

by Section 226.5 is consistent (§ 226.5(a)(2)(i)).

[Click&type]

d. Determine that, for home-equity plans subject to Section 226.5b, the terms 

finance charge and annual percentage rate, when required to be disclosed 

with a corresponding amount or percentage rate, shall be more 

conspicuous than any other required disclosure. The terms need not be 

more conspicuous when used for periodic statement disclosures under 

Section 226.7(a)(4) and for advertisements under Section 226.16 

(§ 226.5(a)(2)(ii)).

[Click&type]

e. Determine that, if disclosures are required to be presented in a tabular 

format pursuant to Section 226.5(a)(3), that the term penalty APR shall be 

used, as applicable (§ 226.5(a)(2)(iii)).

NOTE: The term penalty APR need not be used in reference to the annual 

percentage rate that applies with the loss of a promotional rate, assuming 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 12

the annual percentage rate that applies is not greater than the annual 

percentage rate that would have applied at the end of the promotional 

period; or if the annual percentage rate that applies with the loss of a 

promotional rate is a variable rate, the annual percentage rate is calculated 

using the same index and margin as would have been used to calculate the 

annual percentage rate that would have applied at the end of the 

promotional period. If credit insurance or debt cancellation or debt 

suspension coverage is required as part of the plan, the term required shall 

be used and the program shall be identified by its name. If an annual 

percentage rate is required to be presented in a tabular format pursuant to 

paragraph (a)(3)(i) or (a)(3)(iii) of this section, the term fixed, or a similar 

term, may not be used to describe such rate unless the creditor also 

specifies a time period that the rate will be fixed and the rate will not 

increase during that period, or if no such time period is provided, the rate 

will not increase while the plan is open.

[Click&type]

Section 226.5s - Credit and Charge Card 

Application and Solicitation Disclosures 

a. Determine that the credit card solicitation or application disclosures were 

made clearly and conspicuously on or with a solicitation or an application.

[Click&type]

b. For the disclosures in Sections 226.5a(b)(1) through (5) (except for 

(b)(1)(iv)(B)) and (b)(7) through (15), determine that the creditor made 

the disclosures required for Sections 226.5a(c), (d)(2), (e)(1) and (f) in the 

form of a table with headings, content, and format substantially similar to 

the applicable tables found in G-10 in Appendix G (§ 226.5a(a)(2)(i)).

[Click&type]

c. Determine that the table required by Section 226.5a(a)(2)(i) contains only 

the information required or permitted by that section. If the creditor 

provides other information, determine that such information appears 

outside the table (§ 226.5a(a)(2)(ii)).

[Click&type]

d. Determine that the disclosures required by Section 226.5a(b)(1)(iv)(B) 

and (b)(6) are placed directly beneath the table required by 

Section 226.5a(a)(2)(i) (§ 225.5a(a)(2)(iii)).

e. When a tabular format is required, determine that the following 

disclosures are disclosed in bold text (§ 226.5a(a)(2)(iv)):
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 13

1. Annual percentage rate required to be disclosed pursuant to 

paragraph (b)(1) of this section,

2. Introductory rate required to be disclosed pursuant to paragraph 

(b)(1)(ii) of this section,

3. Rate that will apply after a premium initial rate expires required to 

be disclosed under paragraph (b)(1)(iii) of this section, and

4. Fee or percentage amounts or maximum limits on fee amounts 

required to be disclosed pursuant to paragraphs (b)(2), (b)(4), (b)(8) 

through (b)(13).

NOTE: Bold text shall not be used for the amount of any periodic 

fee disclosed pursuant to paragraph (b)(2) of this section that is not 

an annualized amount; and other APRs or fee amounts disclosed in 

the table (§ 226.5a(a)(2)(iv)).

[Click&type]

f. Determine that the card issuer discloses, on or with an solicitation or 

application Section 226.5a(b):

1. Annual percentage rate. Each periodic rate that may be used to 

compute the finance charge on an outstanding balance for purchases, 

a cash advance, or a balance transfer, expressed as an annual 

percentage rate. When more than one rate applies for a category of 

transactions, determine that the range of balances to which each rate 

is applicable is also disclosed (§ 226.5a(b)(1)).

NOTE: The annual percentage rate for purchases disclosed pursuant 

to Section 226.5a(b)(1) shall be in at least 16-point type, except for 

the following: Oral disclosures of the annual percentage rate for 

purchases; or a penalty rate that may apply upon the occurrence of 

one or more specific events.

i. Variable rate information. If a rate is a variable rate, determine 

that the card issuer discloses the fact that the rate may vary and 

how the rate is determined. Determine that the card issuer 

identifies the type of index or formula that is used in setting the 

rate. Determine that the value of the index and the amount of the 

margin that are used to calculate the variable rate are not 

disclosed in the table. Determine further that a disclosure of any 

applicable limitations on rate increases or decreases is not 

included in the table (§ 226.5a(b)(1)(i)).

ii. Discounted initial rate. If the initial rate is an introductory rate, 

determine that the card issuer discloses in the table the 

introductory rate, the time period during which the introductory 

rate will remain in effect, and the term “introductory” or “intro”
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 14

in immediate proximity to the introductory rate. Determine 

further that the card issuer discloses, as applicable, either the 

variable or fixed rate that would otherwise apply to the account 

(§ 226.5a(b)(1)(ii)).

iii. Premium initial rate. If the initial rate is temporary and is higher 

than the rate that will apply after the temporary rate expires, 

determine that the card issuer discloses the premium initial rate 

and the time period during which the premium initial rate will 

remain in effect. Determine that the premium initial rate for 

purchases is in at least 16-point type. Determine that the issuer 

discloses in the table the rate that will apply after the premium 

initial rate expires, in at least 16-point type (§ 226.5a(b)(1)(iii)).

iv. Penalty rates. If a rate may increase as a penalty for one or more 

events specified in the account agreement, such as a late 

payment or an extension of credit that exceeds the credit limit, 

determine that the card issuer discloses the increased rate that 

may apply, a brief description of the event or events that may 

result in the increased rate, and a brief description of how long 

the increased rate will remain in effect (§ 226.5a(b)(1)(iv)).

v. Introductory rate. If the issuer discloses an introductory rate in 

the table or in any written or electronic promotional materials 

accompanying applications or solicitations (and subject to 

paragraph (c) or (e) of § 226.5a), determine that the issuer briefly 

discloses, directly beneath the table, the circumstances, if any, 

under which the introductory rate may be revoked, and the type 

of rate that will apply after the introductory rate is revoked 

(§ 226.5a(b)(1)(iv)).

vi. Rates that depend on consumer’s creditworthiness. If a rate 

cannot be determined at the time disclosures are given because 

the rate depends, at least in part, on a later determination of the 

consumer’s creditworthiness, determine that the card issuer 

discloses the specific rates or the range of rates that could apply 

and a statement that the rate for which the consumer may qualify 

at account opening will depend on the consumer’s 

creditworthiness, and other factors if applicable 

(§ 226.5a(b)(1)(v)).

NOTE: If the rate that depends, at least in part, on a later 

determination of the consumer’s creditworthiness is a penalty 

rate, as described in (b)(1)(iv), the card issuer at its option may 

disclose the highest rate that could apply, instead of disclosing 

the specific rates or the range of rates that could apply (§

226.5a(b)(1)(v)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 15

vii. APRs that vary by state. Determine that the card issuer does not 

list annual percentage rates for multiple states in the table. Note, 

however, that issuers imposing annual percentage rates that vary 

by state may, at the issuer’s option, disclose in the table: the 

specific annual percentage rate applicable to the consumer’s 

account; or the range of the annual percentage rates, if the 

disclosure includes a statement that the annual percentage rate 

varies by state and refers the consumer to a disclosure provided 

with the table where the annual percentage rate applicable to the 

consumer’s account is disclosed (§ 226.5a(b)(1)(vi)).

2. Fees for issuance or availability. Determine that the card issuer 

discloses any annual or other periodic fee, expressed as an annualized 

amount, or any other fee that may be imposed for the issuance or 

availability of a credit or charge card, including any fee based on 

account activity or inactivity (§ 226.5a(b)(2)).

3. Fixed finance charge; minimum interest charge. Determine that 

the creditor discloses any fixed finance charge that could be imposed 

during a billing cycle, as well as a brief description of that charge. 

Determine that the creditor discloses any minimum interest charge if 

it exceeds $1.00 that could be imposed during a billing cycle, and a 

brief description of the charge (§ 226.5a(b)(3)).

4. Transaction charge. Determine that the creditor discloses any 

transaction charge imposed for the use of the card for purchases (§

226.5a(b)(4)).

5. Grace period. Determine that the issuer discloses the date by which 

or the period within which any credit extended for purchases may be 

repaid without incurring a finance charge due to a periodic interest 

rate and any conditions on the availability of the grace period. If no 

grace period is provided, determine that this fact is disclosed. In 

disclosing in the tabular format a grace period that applies to all types 

of purchases, determine that the issuer uses the phrase “How to 

Avoid Paying Interest on Purchases” as the heading for the row 

describing the grace period. If a grace period is not offered on all 

types of purchases, in disclosing this fact in the tabular format, 

determine that the issuer uses the phrase “Paying Interest” as the 

heading for the row describing this fact. NOTE: if the length of the 

grace period varies, the card issuer may disclose the range of days, 

the minimum number of days, or the average number of days in the 

grace period, if the disclosure is identified as a range, minimum, or 

average (§ 226.5a(b)(5)).

6. Balance computation method. Determine that the creditor disclosed 

the name of the balance computation method that is used to determine 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 16

the balance on which the finance charge is computed, or an 

explanation of the method used if it is not listed. In determining 

which balance computation method to disclose, the creditor should 

have assumed that the credit extended will not be repaid within any 

grace period (§ 226.5a(b)(6)).

NOTE: Disclosures required by § 226.5a(b)(6) must be placed 

directly beneath the table.

7. Statement on charge card payments. Determine that the creditor 

discloses a statement that charges incurred by use of the charge card 

are due when the periodic statement is received (§ 226.5a(b)(7)).

8. Cash advance fee. Determine that the creditor disclosed any fee 

imposed for an extension of credit in the form of cash or its 

equivalent (§ 226.5a(b)(8)).

9. Late payment fee. Determine that the creditor disclosed any fee 

imposed for a late payment (§ 226.5a(b)(9)).

10. Over-the-limit fee. Determine that the creditor disclosed any fee 

imposed for exceeding the credit limit (§ 226.5a(b)(10)).

11. Balance transfer fee. Determine that the creditor disclosed any fee 

imposed to transfer a balance (§ 226.5a(b)(11)).

12. Returned payment fee. Determine that the creditor disclosed any fee 

imposed for a returned payment (§ 226.5a(b)(12)).

13. Required insurance, debt cancellation, or debt suspension 

coverage. Determine that the fee imposed required insurance, debt 

cancellation or suspension coverage is disclosed if the insurance, debt 

cancellation or coverage is required as part of the plan (§

226.5a(b)(13)).

14. Available credit. Determine whether the total of required fees for the 

issuance or availability of credit and/or security deposit debited to the 

account at account opening equals or exceeds 15 percent of minimum 

credit limit for the account. If so, determine that the creditor 

disclosed, as applicable, the available credit remaining after the fees 

and/or security deposit are debited to the account (§ 226.5a(b)(14)).

15. Website reference. For issuers of credit cards that are not charge 

cards, determine that the creditor disclosed a reference to the website 

established by the Board and a statement that the consumers may 

obtain on the website information about shopping for and using credit 

cards (§ 226.5a(b)(15)).1

 1 These procedures will be modified in the future to reflect, as appropriate, the transfer of certain authorities from the Federal 

Reserve Board to the CFPB on July 21, 2011, effected by the Dodd-Frank Act.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 17

[Click&type]

Section 226.5b — Requirements for 

Home Equity Plans 

a. Determine that the following home equity disclosures were made clearly 

and conspicuously, at the time of application (§ 226.5b):

1. Home equity brochure.

2. Statement that the consumer should retain a copy of the disclosure.

3. Statement of the time the specific terms are available.

4. Statement that terms are subject to change before the plan opens.

5. Statement that the consumer may receive a full refund of all fees.

6. Statement that the consumer’s dwelling secures the credit.

7. Statement that the consumer could lose the dwelling.

8. Creditors right to change, freeze, or terminate the account.

9. Statement that information about conditions for adverse action are 

available upon request.

10. Payment terms including the length of the draw and repayment 

periods, how the minimum payment is determined, the timing of 

payments, and an example based on $10,000 and a recent APR.

11. A recent APR imposed under the plan and a statement that the rate 

does not include costs other than interest (fixed-rate plans only).

12. Itemization of all fees paid to creditor.

13. Estimate of any fees payable to third parties to open the account and a 

statement that the consumer may receive a good faith itemization of 

third- party fees.

14. Statement regarding negative amortization, as applicable.

15. Transaction requirements.

16. Statement that the consumer should consult a tax advisor regarding 

the deductibility of interest and charges under the plan.

17. For variable rate home equity plans, disclose the following:

i. That the APR, payment, or term may change.

ii. The APR excludes costs other than interest.

 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 18

iii. Identify the index and its source.

iv. How the rate will be determined.

v. Statement that the consumer should request information on the 

current index value, margin, discount, premium, or APR.

vi. Statement that the initial rate is discounted and the duration of the 

discount, if applicable.

vii. Frequency of APR changes. 

viii. Rules relating to changes in the index, APR, and payment 

amount.

ix. Lifetime rate cap and any annual caps, or a statement that there is 

no annual limitation.

x. The minimum payment requirement, using the maximum APR, 

and when the maximum APR may be imposed.

xi. A table, based on a $10,000 balance, reflecting all significant plan 

terms.

xii. Statement that rate information will be provided on or with each 

periodic statement. 

[Click&type]

b. For home-equity plans subject to Section 226.5b, determine that the terms 

finance charge and annual percentage rate, when required to be disclosed 

with a corresponding amount or percentage rate, are more conspicuous 

than any other required disclosure. 

NOTE: The terms need not be more conspicuous when used for periodic 

statement disclosures under §226.7(a)(4) and for advertisements under 

§ 226.16 (§ 226.5(a)(2)(ii)).

[Click&type]

Section 226.6 - Account Opening Initial 

Disclosures 

a. The following requirements apply only to home-equity plans subject to the 

requirements of Section 226.5b. Determine that the creditor discloses, as 

applicable (§ 226.6(a)):

1. Finance charge. The circumstances under which a finance charge 

will be imposed and an explanation of how it will be determined, 

including: a statement of when finance charges begin to accrue, and 

an explanation of whether or not any time period exists within which 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 19

any credit extended may be repaid without incurring a finance 

charge; a disclosure of each periodic rate that may be used to 

compute the finance charge, the range of balances to which it is 

applicable, and the corresponding annual percentage rate; an 

explanation of the method used to determine the balance on which the 

finance charge may be computed; and, an explanation of how the 

amount of any finance charge will be determined, including a 

description of how any finance charge other than the periodic rate 

will be determined (§ 226.6(a)(1)).

If a creditor offers a variable-rate plan, determine that the creditor 

discloses: the circumstances under which the rate(s) may increase;

any limitations on the increase; and the effect(s) of an increase. When 

different periodic rates apply to different types of transactions, 

determine that the types of transactions to which the periodic rates 

shall apply shall also be disclosed (§ 226.6(a)(1)).

2. Other charges. The amount of any charge other than a finance 

charge that may be imposed as part of the plan, or an explanation of 

how the charge will be determined (§ 226.6(a)(2)).

3. Home-equity plan information. The following disclosures, as 

applicable (§ 226.6(a)(3)):

i. A statement of the conditions under which the creditor may take 

certain action, as described in Section 226.5b(d)(4)(i), such as 

terminating the plan or changing the terms.

ii. The payment information described in Section 226.5b(d)(5)(i) and 

(ii) for both the draw period and any repayment period.

iii. A statement that negative amortization may occur as described in 

Section 226.5b(d)(9).

iv. A statement of any transaction requirements as described in 

Section 226.5b(d)(10).

v. A statement regarding the tax implications as described in 

Section 226.5b(d)(11).

vi. A statement that the annual percentage rate imposed under the plan 

does not include costs other than interest as described in 

Section 226.5b(d)(6) and (d)(12)(ii).

vii. The variable-rate disclosures described in Section

226.5b(d)(12)(viii), (d)(12)(x), (d)(12)(xi), and (d)(12)(xii), as well 

as the disclosure described in Section 226.5b(d)(5)(iii), unless the 

disclosures provided with the application were in a form the 

consumer could keep and included a representative payment 

example for the category of payment option chosen by the 

consumer.

4. Security interests. The fact that the creditor has or will acquire a 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 20

security interest in the property purchased under the plan, or in other 

property identified by item or type (§ 226.6(a)(4)).

5. Statement of billing rights. A statement that outlines the consumer’s 

rights and the creditor’s responsibilities under Sections 226.12(c) and 

226.13 and that is substantially similar to the statement found in 

Model Form G–3 or, at the creditor’s option, G–3(A), in Appendix G 

to this part (§ 226.6(a)(5)).

[Click&type]

b. For open-end (not home-secured) plans determine that the creditor 

provided the account-opening disclosures specified in Section 226.6 

(b)(2)(i) through (b)(2)(v) (except for § 226.6 (b)(2)(i)(D)(2)) and § 226.6 

(b)(2)(vii) through (b)(2)(xiv) in the form of a table with the headings, 

content, and format substantially similar to any of the applicable tables in 

G–17 in Appendix G (§ 226.6(b)(1)).

[Click&type]

c. For open-end (not home-secured) plans, determine that the following 

disclosures are disclosed in bold text (§ 226.6(b)(1)(i)):

1. Any APR required to be disclosed pursuant to Section 226.6 (b)(2)(i);

2. Any introductory rate permitted to be disclosed pursuant to paragraph 

(b)(2)(i)(B) or required to be disclosed under paragraph (b)(2)(i)(F) 

of this section;

3. Any rate that will apply after a premium initial rate expires permitted 

to be disclosed pursuant to paragraph (b)(2)(i)(C) or required to be 

disclosed pursuant to paragraph (b)(2)(i)(F); and

4. Any fee or percentage amounts or maximum limits on fee amounts 

disclosed pursuant to paragraphs (b)(2)(ii), (b)(2)(iv), (b)(2)(vii) 

through (b)(2)(xii).

d. Determine that bold text is not used for: The amount of any periodic fee 

disclosed pursuant to paragraph (b)(2) of this section that is not an 

annualized amount; and other annual percentage rates or fee amounts 

disclosed in the table (§ 226.6(b)(1)(i)).

[Click&type]

e. Determine that only the information required or permitted by 

Section 226.6 (b)(2)(i) through (b)(2)(v) (except for (b)(2)(i)(D)(2)) and 

(b)(2)(vii) through (b)(2)(xiv) are provided in the table. Disclosures 

required by paragraphs (b)(2)(i)(D)( 2 ), (b)(2)(vi) and (b)(2)(xv) of this 

section shall be placed directly below the table required by Section

226.6(b)(1) (§ 226.6(b)(1)(ii).

NOTE: Disclosures required by § 226.6( b)(3) through (b)(5) that are not 

otherwise required to be in the table and other information may be 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 21

presented with the account agreement or account-opening disclosure 

statement, provided such information appears outside the required table.

[Click&type]

f. For creditors that impose fees (referred to in § 226.6(b)(2)(vii) through 

(b)(2)(xi)) that vary by state and that provide the disclosures required by 

Section 226.6(b) of this section in person at the time the open-end (not 

home-secured) plan is established in connection with financing the 

purchase of goods or services and, at the creditor’s option, discloses in the 

account-opening table the specific fee applicable to the consumer’s 

account, or the range of the fees, determine that the disclosure includes a 

statement that the amount of the fee varies by state and refers the 

consumer to the account agreement or other disclosure provided with the 

account-opening table where the amount of the fee applicable to the 

consumer’s account is disclosed. Determine that the creditor does not list 

fees for multiple states in the account-opening summary table (§

226.6(b)(1)(iii).

NOTE: If the amount of any fee required to be disclosed under this 

section is determined on the basis of a percentage of another amount, the 

percentage used and the identification of the amount against which the 

percentage is applied may be disclosed instead of the amount of the fee (§

226.6(b)(1)(iv).

[Click&type]

g. The following requirements apply to open-end (not home-secured). 

Determine that the creditor discloses in the appropriate format, as 

applicable § 226.6(b):

1.Annual percentage rate. Each periodic rate that may be used to 

compute the finance charge on an outstanding balance for purchases, 

a cash advance, or a balance transfer, expressed as an annual 

percentage rate. When more than one rate applies for a category of 

transactions, determine that the creditor discloses the range of 

balances to which each rate is applicable. Ensure that the annual 

percentage rate for purchases disclosed pursuant to this paragraph is

in at least 16-point type, except for a penalty rate that may apply 

upon the occurrence of one or more specific events (§ 226.6(b)(2)(i)).

2.Variable rate information. If the rate is a variable rate, determine that 

the creditor also disclosed the fact that the rate may vary and how the 

rate is determined (i.e., identify the type of index or formula used in 

setting the rate) (§ 226.6(b)(2)(i)(A)).

3.Discounted initial rate. If the rate is an introductory rate, determine that 

the creditor disclosed that the rate would otherwise apply to the account. 

Where the rate is not tied to an index or formula, determine that creditor 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 22

disclosed the rate that applies after the introductory rate expires. For a 

variable rate account, determine that the creditor disclosed a rate based 

on the applicable index or formula in accordance with the accuracy 

requirements (§ 226.6(b)(2)(i)(B)).

4.Premium initial rate. If the initial rate is temporary and is higher than 

the rate that will apply after the temporary rate expires, determine that 

the creditor disclosed the premium initial rate. Determine that the 

premium rate for purchases is in at least 16-point type (§

226.6(b)(2)(i)(C)).

5.Penalty rates. If the rate is a penalty rate, determine that the creditor 

disclosed as part of the APR disclosure the rate that may apply and a 

brief description of the event or events that may result in the 

increased rate, and a brief description of how long the increased rate 

will remain in effect (§ 226.6(b)(2)(i)(D)(1)).

6.Introductory rates. If the creditor discloses in the table an 

introductory rate, as that term is defined in Section 226.16(g)(2)(ii), 

determine that the creditor briefly disclosed directly beneath the table 

the circumstances under which the introductory rate may be revoked, 

and the rate that will apply after the introductory rate is revoked (§

226.6(b)(2)(i)(D)(2)).

7.Point of sale where APRs vary by state or based on 

creditworthiness. If the creditor imposes an APR that varies by state 

or based on the consumer’s creditworthiness and provides required 

disclosures in person at the time the open-end (not home-secured) 

plan is established in connection with financing the purchase of 

goods or services, determine that the creditor discloses either (§

226.6(b)(2)(i)(E)):

i. The specific APR applicable to the consumer’s account, or

ii. The range of the APRs, if the disclosure includes a statement 

that the APR varies by state or will be determined based on the 

consumer’s creditworthiness and refers the consumer to the 

account agreement or other disclosure provided with the 

account-opening table where the AP applicable to the 

consumer’s account is disclosed. Determine that the creditor 

does not list APRs for multiple states in the account opening 

table.

8. Credit card accounts under an open-end (not home-secured) 

consumer credit plan. Determine that the issuer discloses in the 

table (§ 226.6(b)(2)(i)(F)):

i. Any introductory rate, and

ii. Any rate that would apply upon expiration of a premium initial 

rate.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 23

9. Fees for issuance or availability. Determine that the credit disclosed 

any annual or periodic fee that may be imposed for the issuance or 

availability of an open-end plan (including any fee based on account 

activity or inactivity); how frequently the fee will be imposed; and 

the annualized amount of the fee (§ 226.6(b)(2)(ii)).

10. Fixed finance charge (minimum interest charge). Determine that 

the creditor disclosed any fixed finance charge, any minimum interest 

charge if it exceeds $1.00 that could be imposed during a billing 

cycle, and a brief description of the charge (§ 226.6(b)(2)(iii)).

11. Transaction charges. Determine that the creditor discloses any 

transaction charge imposed by the creditor for use of the open-end 

plan for purchases (§ 226.6(b)(2)(iv)).

12. Grace period. The date by which or the period within which any 

credit extended may be repaid without incurring a finance charge due 

to a periodic interest rate and any conditions on the availability of the 

grace period. If no grace period is provided, that fact must be 

disclosed. If the length of the grace period varies, the creditor may 

disclose the range of days, the minimum number of days, or the 

average number of the days in the grace period, if the disclosure is 

identified as a range, minimum, or average. In disclosing in the 

tabular format a grace period that applies to all features on the 

account, the phrase “How to Avoid Paying Interest” shall be used as 

the heading for the row describing the grace period. If a grace period 

is not offered on all features of the account, in disclosing this fact in 

the tabular format, the phrase “Paying Interest” shall be used as the 

heading for the row describing this fact (§ 226.6(b)(2)(v)).

13. Balance computation method. Determine that the creditor disclosed 

in the account opening disclosures either:

• The name of the balance computation method that is used to 

determine the balance on which the finance charge is computed 

for each feature; or 

• An explanation of the method used if it is not listed, along with a 

statement that an explanation of the methods required by 

Section 226.6(b)(4)(i)(D) of this section is provided with the 

account-opening disclosures. 

In determining which balance computation method to disclose, the 

creditor should have assumed that the credit extended will not be 

repaid within any grace period (§ 226.6(b)(2)(vi)).

14. Cash advance fee. Determine that the creditor disclosed any fee 

imposed for an extension of credit in the form of cash or its 

equivalent (§ 226.6(b)(2)(vii)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 24

15. Late payment fee. Determine that the creditor disclosed any fee 

imposed for a late payment (§ 226.6(b)(2)(viii)).

16. Over-the-limit fee. Determine that the creditor disclosed any fee 

imposed for exceeding the credit limit (§ 226.6(b)(2)(ix)).

17. Balance transfer fee. Determine that the creditor disclosed any fee 

imposed to transfer a balance (§ 226.6(b)(2)(x)).

18. Returned payment fee. Determine that the creditor disclosed any fee 

imposed for a returned payment (§ 226.6(b)(2)(xi)).

19. Required insurance, debt cancellation, or debt suspension 

coverage. Determine that the fee imposed required insurance, debt 

cancellation or suspension coverage is disclosed if the insurance, debt 

cancellation or coverage is required as part of the plan (§

226.6(b)(2)(xii)).

20. Available credit. Determine whether total of required fees for the 

issuance or availability of credit and/or security deposit debited to the 

account at account opening equal or exceed 15 percent of the credit 

limit for the account. If so, determine that the creditor disclosed, as 

applicable, the available credit remaining after the fees and/or 

security deposit are debited to the account (§ 226.6(b)(2)(xiii)).

21. Website reference. For issuers of credit cards that are not charge 

cards, determine that the creditor disclosed a reference to the website 

established by the Board and a statement that the consumers may 

obtain on the website information about shopping for and using credit 

cards (§ 226.6(b)(2)(xiv)).

22. Billing error rights reference. Determine that the creditor disclosed 

a statement that information about consumers’ right to dispute 

transactions is included in the account-opening disclosures.

23. Charges and finance charges. For charges imposed as part of an 

open-end (not home-secured) plan, the circumstances under which 

the charge may be imposed, including the amount of the charge or 

explanation of how the charge is determined. For finance charges, a 

statement of when finance charges begin to accrue, including an 

explanation of whether or not any time period exists within which 

any credit extended may be repaid without incurring a finance charge. 

If such a time period is provided, a creditor may, at its option and 

without disclosure, impose no finance charge when payment is 

received after the time period’s expiration (§ 226.6(b)(3)(i)).

24. Disclosure of rates for open-end (not home-secured) plans.

Determine that the creditor disclosed, as applicable, for each periodic 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 25

rate that may be used to calculate interest (§ 226.6(b)(4)(i)):

i. The rate (expressed as a periodic rate and a corresponding APR),

ii. The range of balances to which the rate is applicable,

iii. The type of transaction to which the periodic rate applies,

iv. An explanation of the method used to determine the balance to 

which the rate is applied. 

25. Variable-rate accounts. For interest rate changes that are tied to 

increases in an index or formula (variable-rate accounts) determine 

that the following are specifically set forth in the account agreement §

226.6(b)(4)(ii):

i. The fact that the annual percentage rate may increase.

ii. How the rate is determined, including the margin.

iii. The circumstances under which the rate may increase.

iv. The frequency with which the rate may increase.

v. Any limitation on the amount the rate may change.

vi. The effect(s) of an increase.

vii. Except as specified in paragraph (b)(4)(ii)(H) of this section, a 

rate is accurate if it is a rate as of a specified date and this rate 

was in effect within the last 30 days before the disclosures are 

provided.

26. Rate changes not due to index or formula. For interest rate changes 

that are specifically set forth in the account agreement and not tied to 

increases in an index or formula, determine that the creditor discloses 

(§ 226.6(b)(4)(iii)):

i. The initial rate (expressed as a periodic rate and a corresponding 

APR)

ii. How long the initial rate will remain in effect and the specific 

events that cause the initial rate to change.

iii. The rate (expressed as a periodic rate and a corresponding APR) 

that will apply when the initial rate is no longer in effect and any 

limitation on the time period the new rate will remain in effect.

iv. The balances to which the new rate will apply.

v. The balances to which the current rate at the time of the change 

will apply.

27. Voluntary credit insurance, debt cancellation, or debt suspension.

Determine that the creditor disclosed the applicable disclosures if the 

creditor offers optional credit insurance, or debt cancellation or dept 

suspension coverage (§ 226.6(b)(5)(i)).

28. Security interests. Determine that the creditor disclosed the fact that 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 26

the creditor has or will acquire a security interest in the property 

purchased under the plan, or in other property identified by item or 

type (§ 226.6(b)(5)(ii)).

29. Statement of billing rights. Determine that the creditor disclosed a 

statement that outlines the consumer’s rights and the creditor’s 

responsibilities (§ 226.6(b)(5)(iii)).

[Click&type]

Section 226.7 - Periodic Statement Disclosures 

a. Rules affecting home-equity plans. For home-equity plans subject to the 

requirements of Section 226.5b, determine that the creditor disclosed on 

the periodic statement items 1 through 10 below (§ 226.7(a)):

NOTE: The requirements of § 226.7(a) apply only to home-equity plans 

subject to the requirements of § 226.5b. Additionally, a creditor may, at 

its option, comply with any of the requirements of paragraph § 226.7(b); 

however, any creditor that chooses to replace the disclosures required 

under paragraph (a)(7) with paragraph (b)(7) must also disclose the 

information required under paragraph (b)(6). 

1. Previous balance. The account balance outstanding at the beginning 

of the billing cycle (§ 226.7(a)(1)).

2. Identification of transactions. An identification of each credit 

transaction in accordance with Section 226.8 (§ 226.7(a)(2)).

3. Credits. Any credit to the account during the billing cycle, including 

the amount and the date of crediting. The date need not be provided if 

a delay in accounting does not result in any finance or other charge

(§ 226.7(a)(3)).

4. Periodic rates. Each periodic rate that may be used to compute the 

finance charge, the range of balances to which it is applicable, and the 

corresponding annual percentage rate. If different periodic rates apply 

to different types of transactions, the types of transactions to which 

the periodic rates apply shall also be disclosed. For variable-rate 

plans, the fact that the periodic rate(s) may vary (§ 226.7(a)(4)).

i. NOTE: If no finance charge is imposed when the outstanding 

balance is less than a certain amount, the creditor is not required 

to disclose that fact, or the balance below which no finance 

charge will be imposed

ii. NOTE: Further that an annual percentage rate that differs from 

the rate that would otherwise apply and is offered only for a 

promotional period need not be disclosed except in periods in 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 27

which the offered rate is actually applied.

5. Balance on which finance charge computed. The amount of the 

balance to which a periodic rate was applied and an explanation of 

how that balance was determined. When a balance is determined 

without first deducting all credits and payments made during the 

billing cycle, the fact and the amount of the credits and payments 

shall be disclosed (§ 226.7(a)(5)).

6. Amount of finance charge and other charges (§ 226.7(a)(6)).

i. Finance charges. The amount of any finance charge debited or 

added to the account during the billing cycle, using the term 

finance charge. Determine that the components of the finance 

charge are individually itemized and identified to show the 

amount(s) due to the application of any periodic rates and the 

amounts(s) of any other type of finance charge. Note that if there 

is more than one periodic rate, the amount of the finance charge 

attributable to each rate need not be separately itemized and 

identified (§ 226.7(a)(6)(i)).

ii. Other charges. The amounts, itemized and identified by type, of 

any charges other than finance charges debited to the account 

during the billing cycle (§ 226.7(a)(6)(ii)).

NOTE: Creditors may comply with paragraphs (a)(6) of § 226.7, or 

with paragraph (b)(6) of § 226.7, at their option. 

7. Annual percentage rate. At a creditor’s option, when a finance charge 

is imposed during the billing cycle, the annual percentage rate(s) 

determined under Section 226.14(c) using the term annual percentage 

rate (§ 226.7(a)(7)).

8. Grace period. The date by which or the time period within which the 

new balance or any portion of the new balance must be paid to avoid 

additional finance charges (§ 226.7(a)(8)).

9. Address for notice of billing errors. The address to be used for notice 

of billing errors. Alternatively, the address may be provided on the 

billing rights statement permitted by Section 226.9(a)(2) (§ 

226.7(a)(9)).

10. Closing date of billing cycle; new balance. The closing date of the 

billing cycle and the account balance outstanding on that date (§

226.7(a)(10)).

[Click&type]

b. Rules affecting open-end (not home-secured) plans. The requirements 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 28

of paragraph (b) of this section (1 through 14 below) apply only to plans 

other than home-equity plans subject to the requirements of Section

226.5b. For applicable plans, determine that the creditor discloses on the 

periodic statement (§ 226.7(b)):

1. Previous balance. The account balance outstanding at the beginning 

of the billing cycle (§ 226.7(b)(1)).

2. Identification of transactions. An identification of each credit 

transaction in accordance with Section 226.8 (§ 226.7(b)(2)).

3. Credits. Any credit to the account during the billing cycle, including 

the amount and the date of crediting. The date need not be provided if 

a delay in crediting does not result in any finance or other charge (§

226.7(b)(3)).

4. Periodic rates. Each periodic rate that may be used to compute the 

interest charge expressed as an annual percentage rate and using the 

term Annual Percentage Rate, along with the range of balances to 

which it is applicable (§ 226.7(b)(4)).

i. NOTE: If no interest charge is imposed when the outstanding 

balance is less than a certain amount, the creditor is not required 

to disclose that fact, or the balance below which no interest 

charge will be imposed. The types of transactions to which the 

periodic rates apply shall also be disclosed. For variable-rate 

plans, the fact that the APR may vary; and, 

ii. A promotional rate, as that term is defined in Section

226.16(g)(2)(i), is required to be disclosed only in periods in 

which the offered rate is actually applied.

5. Balance on which finance charge computed. The amount of the 

balance to which a periodic rate was applied and an explanation of 

how that balance was determined, using the term Balance Subject to 

Interest Rate (§ 226.7(b)(5)).

6. Charges imposed. The amounts of any charges imposed as part of a 

plan as stated in Section 226.6(b)(3), grouped together, in proximity 

to transactions identified under paragraph (b)(2) of this section, 

substantially similar to Sample G–18(A) in Appendix G to this part (§

226.7(b)(6)).

i. Interest. Finance charges attributable to periodic interest rates, 

using the term Interest Charge, must be grouped together under 

the heading Interest Charged, itemized and totaled by type of 

transaction, and a total of finance charges attributable to periodic 

interest rates, using the term Total Interest, must be disclosed for 

the statement period and calendar year to date, using a format 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 29

substantially similar to Sample G–18(A).

ii. Fees. Charges imposed as part of the plan other than charges

attributable to periodic interest rates must be grouped together 

under the heading Fees, identified consistent with the feature or 

type, and itemized, and a total of charges, using the term Fees, 

must be disclosed for the statement period and calendar year to 

date, using a format substantially similar to Sample G–18(A).

7. Change-in-terms and increased penalty rate summary for open-end 

(not home-secured) plans. Creditors who provide a change-in-terms 

notice required by Section 226.9(c), or a rate increase notice required 

by Section 226.9(g), on or with the periodic statement, must disclose 

the information in Section 226.9(c)(2)(iv)(A) and (c)(2)(iv)(B) (if 

applicable) or Section 226.9(g)(3)(i) on the periodic statement in 

accordance with the format requirements in Section

226.9(c)(2)(iv)(D), and Section 226.9(g)(3)(ii). See Forms G–18(F) 

and G–18(G) (§ 226.7(b)(7)).

8. Grace period. The date by which or the time period within which the 

new balance or any portion of the new balance must be paid to avoid 

additional finance charges. If such a time period is provided, a 

creditor may, at its option and without disclosure, impose no finance 

charge if payment is received after the time period’s expiration (§

226.7(b)(8)).

9. Address for notice of billing errors. The address to be used for notice 

of billing errors. Alternatively, the address may be provided on the 

billing rights statement permitted by Section 226.9(a)(2) (§

226.7(b)(9)).

10. Closing date of billing cycle; new balance. The closing date of the 

billing cycle and the account balance outstanding on that date 

disclosed in accordance with Section 226.7(b)(13) (§ 226.7(b)(10)).

11. Due date; late payment costs. With the exception of periodic 

statements provided solely for charge cards and periodic statements 

provided for a charged-off account where payment of the entire 

account balance is due immediately, determine that the creditor 

disclosed (in accordance with § 226.7(b)(13)) for a credit card 

account under an open-end (not home-secured) consumer credit plan:

i. The due date for a payment (the due date must be the same day of 

the month for each billing cycle) (§ 226.7(b)(11)(i)(A)).

ii. The amount of any late payment fee and any increased periodic 

rate(s) (expressed as an annual percentage rate(s)) that may be 

imposed on the account as a result of a late payment. If a range of 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 30

late payment fees may be assessed, verify that the card issuer 

either states a range of fees or the highest fee and an indication 

that the fee imposed could be lower (§ 226.7(b)(11)(i)(B)).

NOTE: If the rate may be increased for more than one feature or 

balance, the card issuer may state the range of rates or the highest 

rate that could apply and at the issuer’s option an indication that 

the rate imposed could be lower.

NOTE: With the exception of the negative or no amortization 

disclosures required by § 226.7(b)(12)(ii), the repayment 

disclosures in § 226.7(b)(12) (as listed in step 12 below) are not 

required for: 

a. Charge card accounts that require payment of outstanding 

balances in full at the end of each billing cycle;

b. A billing cycle immediately following two consecutive 

billing cycles in which the consumer paid the entire balance 

in full, had a zero outstanding balance or had a credit 

balance; and

c. A billing cycle where paying the minimum payment due for 

that billing cycle will pay the entire outstanding balance on 

the account for that billing cycle. 

12. Given those exceptions above, determine that the card issuer 

disclosed on the periodic statement Section 226.7(b)(12):

i. The following statement with a bold heading: “Minimum 

Payment Warning: If you make only the minimum payment each 

period, you will pay more in interest and it will take you longer to 

pay off your balance” (§ 226.7(b)(12)(i)(A));

ii. The minimum payment repayment estimate, as described in 

Appendix M1 to this part. Note, if the minimum payment 

repayment estimate is less than 2 years, determine that the card 

issuer disclosed the estimate in months. Otherwise, the estimate 

must be disclosed in years and rounded to the nearest whole year 

(§ 226.7(b)(12)(i)(B));

iii. The minimum payment total cost estimate, as described in 

Appendix M1 to this part, rounded to the nearest whole dollar (§

226.7(b)(12)(i)(C);

iv. The minimum payment repayment estimate and the minimum 

payment total cost estimate are based on the current outstanding 

balance shown on the periodic statement. A statement that the 

minimum payment repayment estimate and the minimum payment 

total cost estimate are based on the assumption that only minimum 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 31

payments are made and no other amounts are added to the balance 

(§ 226.7(b)(12)(i)(D);

v. A toll-free telephone number where the consumer may obtain 

from the card issuer information about credit counseling services 

(§ 226.7(b)(12)(i)(E)); and

vi. The disclosures required for Section 226.7(b)(12)(i)(F)(1):

a. The estimated monthly payment for repayment in 36 months, 

as described in Appendix M1 to this part. The estimated 

monthly payment for repayment in 36 months must be 

rounded to the nearest whole dollar (§

226.7(b)(12)(i)(F)(1)(i));

b. A statement that the card issuer estimates that the consumer 

will repay the outstanding balance shown on the periodic 

statement in three years if the consumer pays the estimated 

monthly payment for three years;

c. The total cost estimate for repayment in 36 months, as 

described in Appendix M1 to this part. The total cost 

estimate for repayment in 36 months must be rounded to the 

nearest whole dollar; and

d. The savings estimate for repayment in 36 months, as 

described in Appendix M1 to this part. The savings estimate 

for repayment in 36 months must be rounded to the nearest 

whole dollar.

NOTE: The disclosures (i through iv above) required for 

§ 226.7(b)(12)(i)(F)(1) do not apply to a periodic statement 

in any of the following circumstances:

1. The minimum payment repayment estimate that is disclosed 

on the periodic statement pursuant to paragraph (b)(12)(i)(B) 

of this section after rounding is three years or less;

2. The estimated monthly payment for repayment in 36 months, 

as described in Appendix M1 to this part, rounded to the 

nearest whole dollar that is calculated for a particular billing 

cycle is less than the minimum payment required for the plan 

for that billing cycle; and

3. A billing cycle where an account has both a balance in a 

revolving feature where the required minimum payments for 

this feature will not amortize that balance in a fixed amount of 

time specified in the account agreement and a balance in a 

fixed repayment feature where the required minimum 

payment for this fixed repayment feature will amortize that 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 32

balance in a fixed amount of time specified in the account 

agreement which is less than 36 months.

vii. For non-amortizing or negatively amortizing credit card accounts 

under an open-end (not home-secured) consumer credit plan, 

determine that the card issuer provides the following disclosures 

on each periodic statement (§ 226.7(b)(12)(ii)): 

a. “Minimum Payment Warning: Even if you make no more 

charges using this card, if you make only the minimum 

payment each month we estimate you will never pay off the 

balance shown on this statement because your payment will 

be less than the interest charged each month”

(§ 226.7(b)(12)(ii)(A));

b. “If you make more than the minimum payment each period, 

you will pay less in interest and pay off your balance sooner”

(§ 226.7(b)(12)(ii)(B));

c. The estimated monthly payment for repayment in 36 months 

rounded to the nearest whole dollar (§ 226.7(b)(12)(ii)(C));

d. A statement that the card issuer estimates that the consumer 

will repay the outstanding balance shown on the periodic 

statement in 3 years if the consumer pays the estimated 

monthly payment each month for 3 years 

(§ 226.7(b)(12)(ii)(D)); and

e. A toll-free telephone number where the consumer may 

obtain from the card issuer information about credit 

counseling services (§ 226.7(b)(12)(ii)(E)).

viii. Verify that the items required to be disclosed, as addressed in the 

procedures above in step 12 (and required by § 226.(7)(b)(12)) are 

disclosed in accordance with the format requirements of §

226.7(b)(13) and are similar to the samples provided in Appendix 

G to Regulation Z 

ix. Determine that a card issuer provides (to the extent available from 

the United States Trustee or a bankruptcy administrator) through 

the disclosed toll-free telephone number the name, street address, 

telephone number, and website address for at least three 

organizations that have been approved by the United States 

Trustee or a bankruptcy administrator to provide credit counseling 

services in either the state in which the billing address for the 

account is located or the state specified by the consumer (§ 

226.7(b)(12)(iv)(A)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 33

x. Determine that the card issuer at least annually updates the credit 

counseling information it discloses for consistency with the 

information available from the United States Trustee or a 

bankruptcy administrator (§ 226.7(b)(12)(iv)(B)).

13. Determine that the card issuer provided periodic statement 

disclosures according to the following format requirements (§

226.7(b)(13)):

i. The due date is disclosed on the front of the first page of the 

periodic statement and that the amount of the late payment fee and 

the annual percentage rate(s) are stated in close proximity thereto. 

ii. The ending balance and the repayment disclosures (required by 

paragraph (b)(12) of § 226.7) are disclosed closely proximate to 

the minimum payment due. 

iii. The due date, late payment fee and annual percentage rate, ending 

balance, minimum payment due, and repayment disclosures are 

grouped together. 

Note that sample G-18(D) in Appendix G of Regulation Z sets forth 

an example of how these terms may be grouped.

14. For accounts with an outstanding balance subject to a deferred 

interest or similar program, the date by which that outstanding 

balance must be paid in full in order to avoid the obligation to pay 

finance charges on such balance must be disclosed on the front of 

each periodic statement issued during the deferred interest period 

beginning with the first periodic statement issued during the deferred 

interest period that reflects the deferred interest or similar transaction. 

The disclosure provided pursuant to this paragraph must be 

substantially similar to Sample G–18(H) in Appendix G to this part

(§ 226.7(b)(14)).

Click&type]

Section 226.9 - Subsequent Disclosure 

Requirements 

a. Determine whether the creditor mailed or delivered the billing rights 

statement at least once per calendar year, at intervals of not less than six 

months or more than 18 months, to customers and whether the institution 

used the short form notice with each periodic statement (§ 226.9(a)(1)). 

NOTE: As an alternative to the annual billing rights statement (§

226.9(a)(1)), the creditor may mail or deliver, on or with each periodic 

statement, a statement substantially similar to Model Form G–4 or Model 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 34

Form G–4(A) in Appendix G to this part, as applicable. Creditors offering 

home-equity plans subject to the requirements of § 226.5b may use either 

Model Form, at their option (§ 226.9(a)(2)).

[Click&type]

b. If, 30 days after mailing or delivering the account-opening disclosures 

under Section 226.6(a)(1) or (b)(3)(ii)(A), the creditor adds a credit 

feature or furnishes a credit access device (other than as a renewal, 

resupply, or the original issuance of a credit card, or except with regard to 

checks that access a credit card account) on the same finance charge 

terms, determine that the creditor discloses, before the consumer uses the 

feature or device for the first time, that it is for use in obtaining credit 

under the terms previously disclosed (§ 226.9(b)(1).

[Click&type]

c. Determine that, except with regard to checks that access a credit card 

account, whenever a credit feature is added or a credit access device is 

mailed or delivered to the consumer, and the finance charge terms for the 

feature or device differ from disclosures previously given, the disclosures 

required by Section 226.6(a)(1) or (b)(3)(ii)(A) that are applicable to the 

added feature or device are given before the consumer uses the feature or 

device for the first time (§ 226.9(b)(2)).

[Click&type]

d. Checks that access a credit card account. For open-end plans not subject 

to the requirements of Section 226.5b, if checks that can be used to access 

a credit card account are provided more than 30 days after accountopening disclosures under Section 226.6(b) are mailed or delivered, or are 

provided within 30 days of the account-opening disclosures and the 

finance charge terms for the checks differ from the finance charge terms 

previously disclosed, determine that the creditor discloses on the front of 

the page containing the checks the following terms in the form of a table 

with the headings, content, and form substantially similar to Sample G–19 

in Appendix G to this part (§ 226.9(b)(3)).

1. If a promotional rate applies to the checks, determine that the creditor 

discloses:

i. The promotional rate and the time period during which the 

promotional rate will remain in effect (§ 226.9(b)(3)(i)(A)(1);

ii. The type of rate that will apply (such as whether the purchase or 

cash advance rate applies) after the promotional rate expires, and 

the annual percentage rate that will apply after the promotional 

rate expires. For a variable-rate account, a creditor must disclose 

an annual percentage rate based on the applicable index or formula 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 35

in accordance with the accuracy requirements set forth in 

paragraph (b)(3)(ii) of this section (§ 226.9(b)(3)(i)(A)(2); and

iii. The date, if any, by which the consumer must use the checks in 

order to qualify for the promotional rate. If the creditor will honor 

checks used after such date but will apply an annual percentage 

rate other than the promotional rate, the creditor must disclose this 

fact and the type of annual percentage rate that will apply if the 

consumer uses the checks after such date (§ 226.9(b)(3)(i)(A)(3).

2. If no promotional rate applies to the checks, determine that the 

creditor discloses:

i. The type of rate that will apply to the checks and the applicable 

annual percentage rate. For a variable-rate account, a creditor must 

disclose an annual percentage rate based on the applicable index or 

formula in accordance with the accuracy requirements set forth in 

Section 226.9(b)(3)(ii). (§ 226.9(b)(3)(i)(B)(1)).

3. Determine that the creditor discloses:

i. Any transaction fees applicable to the checks disclosed under 

Section 226.6(b)(2)(iv). ((§ 226.9(b)(3)(i)(C)).

ii. Whether or not a grace period is given within which any credit 

extended by use of the checks may be repaid without incurring a 

finance charge due to a periodic interest rate. When disclosing 

whether there is a grace period, the phrase “How to Avoid Paying 

Interest on Check Transactions” shall be used as the row heading 

when a grace period applies to credit extended by the use of the 

checks. When disclosing the fact that no grace period exists for 

credit extended by use of the checks, the phrase “Paying Interest”

shall be used as the row heading (§ 226.9(b)(3)(i)(D)) (§

226.9(b)(3)(i)(D)).

NOTE: The disclosures in § 226.9 (b)(3)(i) must be accurate as of 

the time the disclosures are mailed or delivered. A variable annual 

percentage rate is accurate if it was in effect within 60 days of 

when the disclosures are mailed or delivered.

[Click&type]

e. Determine, for home-equity plans subject to the requirements of Section

226.5(b): 

1. Whenever any term required to be disclosed under Section 226.6(a) is 

changed or the required minimum periodic payment is increased, the 

creditor mailed or delivered written notice of the change at least 15 

days prior to the effective date of the change. If the consumer agreed 

to the change, determine that notice was provided before the change 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 36

went into effect (§ 226.9(c)(1)(i)).

2. If the creditor prohibits additional extensions of credit or reduces the 

credit limit, that the creditor mailed or delivered notice of the action 

not later than three business days after the action is taken. The notice 

must contain the specific reasons for the action

Section 226.9(c)(1)(iii)).

NOTE: Notice is not required when the change involves a reduction 

of any component of a finance charge or other charge or when the 

change results from an agreement involving a court proceeding (§ 

226.9(c)(1)(ii)).

[Click&type]

f. For plans other than home-equity plans subject to the requirements of 

Section 226.5b, except as provided in Sections 226.9(c)(2)(i)(B), 

(c)(2)(iii) and (c)(2)(v), when a significant change in account terms as 

described in Section 226.9(c)(2)(ii) is made to a term required to be 

disclosed under Section 226.6(b)(3), (b)(4) or (b)(5) or the required 

minimum periodic payment is increased, determine that the creditor 

provides a written notice of the change at least 45 days prior to the 

effective date of the change to each consumer who may be affected 

(§ 226.9(c)(2)(i)(A)).

[Click&type]

g. For open-end (not home-secured) plans, determine that increases in the 

rate applicable to a consumer’s account due to delinquency, default or as a 

penalty described in Section 226.9(g) that are not due to a change in the 

contractual terms of the consumer’s account are disclosed pursuant to 

Section 226.9(g) instead of Section 226.9(c)(2) (§ 226.9(c)(2)(i)(A).

[Click&type]

h. When a notice of change in terms is required, determine that it is mailed 

or delivered no later than the effective date of the change, if the consumer 

agrees to the particular change. Section 226.9(c)(2)(i)(B) applies only 

when a consumer substitutes collateral or when the creditor can advance 

additional credit only if a change relatively unique to that consumer is 

made, such as the consumer’s providing additional security or paying an 

increased minimum payment amount Section 226.9(c)(2)(i)(B).

NOTE: The 45-day timing requirements discussed in Step f above does 

not apply in certain narrow circumstances, as described in 

§ 226.9(c)(2)(i)(B). The following are not considered agreements between 

the consumer and the creditor for purposes of § 226.9(c)(2)(i)(B):

1. The consumer’s general acceptance of the creditor’s contract 

reservation of the right to change terms;

2. The consumer’s use of the account (which might imply acceptance of 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 37

its terms under state law);

3. The consumer’s acceptance of a unilateral term change that is not 

particular to that consumer, but rather is of general applicability to 

consumers with that type of account; and,

4. The consumer’s request to reopen a closed account or to upgrade an 

existing account to another account offered by the creditor with 

different credit or other features Section 226.9(c)(2)(i)(B).

[Click&type]

i. The 45-day advance notice requirement applies to changes to the 

following terms (§ 226.9(c)(2)(ii)):

1. APR increase, including each periodic rate that may be used to 

compute the finance charge on outstanding balances for purchases, a 

cash advance, or a balance transfer (such rates may include any 

discounted initial rate, premium initial rate, or penalty rate that may be 

applied to the account);

i. Variable-rate information;

ii. Discounted or premium initial rates; and

iii. Penalty rates.

2. Fees for issuance or availability, including any fee based upon 

account activity or inactivity;

3. Fixed finance charge or minimum interest charge, if it exceeds $1.00;

4. Transaction charge for purchases;

5. Grace period;

6. Balance computation method;

7. Cash advance fee;

8. Late payment fee;

9. Over-the-limit fee;

10. Balance transfer fee;

11. Returned payment fee; 

12. Required insurance, debt cancellation, or debt suspension coverage; 

and

13. Increase in required minimum periodic payment, or the acquisition of 

a security interest.

[Click&type]

j. Except as provided in Section 226.9(c)(2)(vi), if a creditor increases any 

component of a charge, or introduces a new charge, required to be 

disclosed under Section 226.6(b)(3) that is not a significant change in 

account terms as described in paragraph (c)(2)(ii) of this section, 

determine that the creditor either (§ 226.9(c)(2)(iii)): 

1. Complies with the requirements of Section 226.9(c)(2)(i), or
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 38

2. Provides notice of the amount of the charge before the consumer 

agrees to or becomes obligated to pay the charge, at a time or in a 

manner that a consumer would be likely to notice the disclosure of the 

charge, either in writing or orally.

[Click&type]

k. Ensure that the written change-in-terms notice contains the following 

disclosures (§ 226.9(c)(2)(iv)(A)):

1. A summary of the changes made to terms required by Sections 

226.6(b)(1) and (b)(2), a description of any increase in the required 

minimum payment, and a description of any security interests being 

acquired by the creditor. 

2. A statement that changes are being made to the account.

3. For accounts other than credit card accounts under an open-end (not 

home-secured) consumer credit plan subject to Section

226.9(c)(2)(iv)(B), a statement indicating that the consumer has the 

right to opt-out of the changes, if applicable, and a reference to the 

opt-out right provided in the notice, if applicable.

4. The date the changes will become effective.

5. If applicable, a statement that the consumer may find additional 

information about the summarized changes, and other changes, in the 

notice.

6. In the case of a rate change, other than a penalty rate, a statement that 

if a penalty rate currently applies to the consumer’s account, the new 

rate described in the notice will not apply to the consumer’s account 

until the consumer’s account balances are no longer subject to the 

penalty rate.

7. If the change in terms being disclosed is an increase in the APR, the 

balances to which the increased rate will apply. If applicable, creditors 

should disclose a statement identifying the balances to which the 

current rate will apply as of the effective date of the change.

8. If the change in terms being disclosed is an increase in an annual 

percentage rate for a credit card account under an open-end (not 

home-secured) consumer credit plan, a statement of no more than four 

principal reasons for the rate increase, listed in their order of 

importance.

[Click&type]

l. In addition to the disclosures in Section 226.9(c)(2)(iv)(A), if a card issuer 

makes a significant change in account terms on a credit card account 

under an open-end (not home-secured) consumer credit plan, determine 

that the creditor provides the following information on the notice provided 

pursuant to Section 226.9(c)(2)(i) (§ 226.9(c)(2)(iv)(B)):

(NOTE: This information is not required to be provided in the case of an 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 39

increase in the required minimum periodic payment, an increase in a fee 

as a result of a reevaluation of a determination made under §

226.52(b)(1)(i) or an adjustment to the safe harbors in § 226.52(b)(1)(ii) 

to reflect changes in the Consumer Price Index, a change in an annual 

percentage rate applicable to a consumer’s account, a change in the 

balance computation method applicable to consumer’s account necessary 

to comply with § 226.54, or when the change results from the creditor not 

receiving the consumer’s required minimum periodic payment within 60 

days after the due date for that payment).

1. A statement that the consumer has the right to reject the change or 

changes prior to the effective date of the changes, unless the consumer 

fails to make a required minimum periodic payment within 60 days 

after the due date for that payment;

2. Instructions for rejecting the change or changes, and a toll-free 

telephone number that the consumer may use to notify the creditor of 

the rejection; and

3. If applicable, a statement that if the consumer rejects the change or 

changes, the consumer’s ability to use the account for further 

advances will be terminated or suspended.

[Click&type]

m. Changes resulting from failure to make minimum periodic payment within 

60 days from due date for credit card accounts under an open-end (not 

home-secured) consumer credit plan. For a credit card account under an 

open-end (not home-secured) consumer credit plan (§ 226.9(c)(2)(iv)(C)):

1. If the significant change required to be disclosed pursuant to Section

226.9(c)(2)(i) of this section is an increase in an annual percentage 

rate or a fee or charge required to be disclosed under Sections

226.6(b)(2)(ii), (b)(2)(iii), or (b)(2)(xii) based on the consumer’s 

failure to make a minimum periodic payment within 60 days from the 

due date for that payment, determine that the notice provided pursuant 

to paragraph (c)(2)(i) of this section states that the increase will cease 

to apply to transactions that occurred prior to or within 14 days of 

provision of the notice, if the creditor receives six consecutive 

required minimum periodic payments on or before the payment due 

date, beginning with the first payment due following the effective date 

of the increase.

2. If the significant change required to be disclosed pursuant to Section

226.9(c)(2)(i) is an increase in a fee or charge required to be disclosed 

under Sections 226.6(b)(2)(ii), (b)(2)(iii), or (b)(2)(xii) based on the 

consumer’s failure to make a minimum periodic payment within 60 

days from the due date for that payment, determine that the notice 

provided pursuant to Section 226.9(c)(2)(i) also states the reason for 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 40

the increase.

[Click&type]

n. Determine that the summary of changes described in Section

226.9(c)(2)(iv)(A)(1) is in a tabular format (except for a summary of any 

increase in the required minimum periodic payment), with headings and 

format substantially similar to any of the account-opening tables found in 

G–17 in Appendix G. Determine that the table discloses the changed term 

and information relevant to the change, if that relevant information is 

required by Section 226.6(b)(1) and (b)(2). Determine that the new terms 

are described in the same level of detail as required when disclosing the 

terms under Section 226.6(b)(2) (Account opening) (§

226.9(c)(2)(iv)(D)(1)).

[Click&type]

o. If a notice required by Section 226.9 (c)(2)(i) (change in terms) is 

included on or with a periodic statement, determine that the information 

described in Section 226.9(c)(2)(iv)(A)(1) is disclosed on the front of any 

page of the statement. Determine that the summary of changes described 

in Section 226.9(c)(2)(iv)(A)(1) immediately follows the information 

described in paragraph Sections 226.9(c)(2)(iv)(A)(2) through

Section 226.9(c)(2)(iv)(A)(7) and, if applicable, paragraphs 

Section 226.9(c)(2)(iv)(A)(8), Section 226.9(c)(2)(iv)(B) and 

Section 226.9(c)(2)(iv)(C), and is substantially similar to the format 

shown in Sample G–20 or G–21 in Appendix G to this part 

(§ 226.9(c)(2)(iv)(D)(2)). 

[Click&type]

p. If a notice required by Section 226.9(c)(2)(i) (change in terms) is not 

included on or with a periodic statement, determine that the information 

described in Section 226.9(c)(2)(iv)(A)(1) is disclosed on the front of the 

first page of the notice or segregated on a separate page from other 

information given with the notice. 

NOTE: The summary of changes required to be in a table pursuant to 

(c)(2)(iv)(A)(1) of this section may be on more than one page, and may 

use both the front and reverse sides, so long as the table begins on the 

front of the first page of the notice and there is a reference on the first 

page indicating that the table continues on the following page.

[Click&type]

q. Determine that the summary of changes described in 

Section 226.9(c)(2)(iv)(A)(1) immediately follows the information 

described in Section 226.9(c)(2)(iv)(A)(2) through (c)(2)(iv)(A)(7) and, if 

applicable, paragraphs Section 226.9(c)(2)(iv)(A)(8), (c)(2)(iv)(B) and 

(c)(2)(iv)(C) of this section and is substantially similar to the format 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 41

shown in Sample G–20 or G–21 in Appendix G to this part

(§ 226.9(c)(2)(iv)(D)(3)).

[Click&type]

r. For open-end plans (other than home equity plans subject to the 

requirements of Section 226.5b), note that a creditor is not required to 

provide notice under this section if (§ 226.9(c)(2)(v)):

1. The change involves:

i. Charges for documentary evidence;

ii. A reduction of any component of a finance or other charge;

iii. A suspension of future credit privileges (except as provided in 

§ 226.9(c)(2)(vi) of this section) or termination of an account or 

plan;

iv. When the change results from an agreement involving a court 

proceeding;

v. When the change is an extension of the grace period; or

vi. The change is applicable only to checks that access a credit card 

account and the changed terms are disclosed on or with the checks 

in accordance with Section 226.9(b)(3) (§ 226.9(c)(2)(v)(A));

2. The change is an increase in an APR upon the expiration of a 

specified period of time, provided that (§ 226.9(c)(2)(v)(B)):

i. Prior to commencement of that period, the creditor disclosed in 

writing to the consumer, in a clear and conspicuous manner, the 

length of the period and the annual percentage rate that would 

apply after expiration of the period;

ii. The disclosure of the length of the period and the annual 

percentage rate that would apply after expiration of the period are 

set forth in close proximity and in equal prominence to the first 

listing of the disclosure of the rate that applies during the specified 

period of time; and

iii. The annual percentage rate that applies after that period does not 

exceed the rate disclosed pursuant to Section 226.9(c)(2)(v)(B)(1), 

if the rate disclosed pursuant to Section 226.9(c)(2)(v)(B)(1) was a 

variable rate, the rate following any such increase is a variable rate 

determined by the same formula (index and margin) that was used 

to calculate the variable rate disclosed pursuant to Section

226.9(c)(2)(v)(B)(1);

3. The change is an increase in a variable annual percentage rate in 

accordance with a credit card agreement that provides for changes in 

the rate according to operation of an index that is not under the control 

of the creditor and is available to the general public (§ 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 42

226.9(c)(2)(v)(C)); or

4. The change is an increase in an APR, a fee or charge required to be 

disclosed under Sections 226.6(b)(2)(ii), (b)(2)(iii), or (b)(2)(xii), or 

the required minimum periodic payment due to the completion of a 

workout or temporary hardship arrangement by the consumer or the 

consumer’s failure to comply with the terms of such an arrangement, 

provided that (§ 226.9(c)(2)(v)(D)):

i. The APR or fee or charge applicable to a category of transactions 

or the required minimum periodic payment following any such 

increase does not exceed the rate or fee or charge or required 

minimum periodic payment that applied to that category of 

transactions prior to commencement of the arrangement or, if the 

rate that applied to a category of transactions prior to the 

commencement of the workout or temporary hardship 

arrangement was a variable rate, the rate following any such

increase is a variable rate determined by the same formula (index 

and margin) that applied to the category of transactions prior to 

commencement of the workout or temporary hardship 

arrangement; and

ii. The creditor has provided the consumer, prior to the 

commencement of such arrangement, with a clear and conspicuous 

disclosure of the terms of the arrangement (including any 

increases due to such completion or failure). This disclosure must 

generally be provided in writing. However, a creditor may provide 

the disclosure of the terms of the arrangement orally by telephone, 

provided that the creditor mails or delivers a written disclosure of 

the terms of the arrangement to the consumer as soon as 

reasonably practicable after the oral disclosure is provided.

[Click&type]

s. For open-end plans that are not subject to the requirements of Section

226.5b, if a creditor decreases the credit limit on the account, determine 

that advance notice of the decrease is provided before an over-the-limit 

fee or a penalty rate can be imposed solely as a result of the consumer 

exceeding the newly decreased credit limit. Determine that notice is 

provided in writing or orally at least 45 days prior to imposing the overthe-limit fee or penalty rate and that it states that the credit limit on the 

account has been or will be decreased (§ 226.9(c)(2)(vi)).

[Click&type]

t. Determine that the disclosure(s) contained in Section 226.5a(b)(1) 

through (b)(7) are provided if the account is renewed and (1) the card 

issuer imposes an annual or other periodic fee for the renewal or (2) the 

card issuer has changed or amended any term of the account required to 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 43

be disclosed under Section 226.6(b)(1) and (b)(2) that has not previously 

been disclosed to the consumer. Additionally, the disclosure provided 

upon renewal must disclose how and when the cardholder may terminate 

the credit to avoid paying the renewal fee, if any (§ 226.9(e)).

[Click&type]

u. For plans other than home-equity plans subject to the requirements of 

Section 226.5b (except as provided in § 226.9(g)(4)), determine that the 

creditor provides a written notice to each consumer who may be affected 

when (§ 226.9(g)(1)):

1. A rate is increased due to the consumer’s delinquency or default; or

2. A rate is increased as a penalty for one or more events specified in the 

account agreement, such as making a late payment or obtaining an 

extension of credit that exceeds the credit limit.

[Click&type]

v. Whenever any notice is required to be given pursuant to paragraph (g)(1) 

of this section, determine that the creditor provided written notice of the 

increase in rates at least 45 days prior to the effective date of the 

increase. The notice must be provided after the occurrence of the events 

described in Section 226.9(g)(1)(i) and (g)(1)(ii) that trigger the 

imposition of the rate increase (§ 226.9(g)(2)).

[Click&type]

w. If a creditor is increasing the rate due to delinquency or default or as a 

penalty, determine that the creditor provided the following information 

on the notice sent pursuant to Section 226.9(g)(1) (§ 226.9(g)(3)(i)(A)):

1. A statement that the delinquency or default rate or penalty rate, as 

applicable, has been triggered;

2. The date on which the delinquency or default rate or penalty rate will 

apply;

3. The circumstances under which the delinquency or default rate or 

penalty rate, as applicable, will cease to apply to the consumer’s 

account, or that the delinquency or default rate or penalty rate will 

remain in effect for a potentially indefinite time period;

4. A statement indicating to which balances the delinquency or default 

rate or penalty rate will be applied;

5. If applicable, a description of any balances to which the current rate 

will continue to apply as of the effective date of the rate increase, 

unless a consumer fails to make a minimum periodic payment within 

60 days from the due date for that payment; and

6. For a credit card account under an open-end (not home-secured) 

consumer credit plan, a statement of no more than four principal 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 44

reasons for the rate increase, listed in their order of importance.

[Click&type]

x. For a credit card account under an open-end (not home-secured) 

consumer credit plan, if the rate increase required to be disclosed 

pursuant to paragraph (g)(1) of this section is an increase pursuant to 

Section 226.55(b)(4) based on the consumer’s failure to make a 

minimum periodic payment within 60 days from the due date for that 

payment, determine that the notice provided pursuant to paragraph (g)(1) 

of this section also states that the increase will cease to apply to 

transactions that occurred prior to or within 14 days of provision of the 

notice, if the creditor receives six consecutive required minimum 

periodic payments on or before the payment due date, beginning with the 

first payment due following the effective date of the increase (§

226.9(g)(3)(i)(B)).

[Click&type]

y. If a notice required by Section 226.9(g)(1) (Increase in rates due to 

delinquency or default or as a penalty) is included on or with a periodic 

statement, determine that the disclosure described in paragraph (g)(3)(i) is 

in the form of a table and provided on the front of any page of the 

periodic statement, above the notice described in paragraph (c)(2)(iv) of 

this section if that notice is provided on the same statement (§

226.9(g)(3)(ii)(A)).

[Click&type]

z. If a notice required by Section 226.9(g)(1) (increase in rates) is not 

included on or with a periodic statement, determine that the information 

described in Section 226.9(g)(3)(i) is disclosed on the front of the first 

page of the notice. Ensure that only information related to the increase in 

the rate to a penalty rate is included with the notice. 

NOTE: This notice may be combined with a notice described in 

§§ 226.9(c)(2)(iv) or (g)(4) (A statement indicating to which balances the 

delinquency or default rate or penalty rate will be applied) of this section 

(§ 226.9(g)(3)(ii)(B)).

[Click&type]

aa. Exception for Decreases in the Credit Limit – If a creditor does not 

provide the 45 day notice under Section 226.9(g)(1) prior to increasing 

the rate for obtaining an extension of credit that exceeds the credit limit, 

determine that the creditor provides at least 45 days in advance of 

imposing the penalty rate a notice, in writing, that includes (§

226.9(g)(4)):

1. A statement that the credit limit on the account has or will be 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 45

decreased;

2. The date on which the penalty rate will apply, if the outstanding 

balance exceeds the credit limit as of that date;

3. A statement that the penalty rate will not be imposed on that date, if 

the outstanding balance does not exceed the credit limit as of that date;

4. The circumstances under which the penalty rate, if applied, will cease 

to apply to the account, or that the penalty rate, if applied, will remain 

in effect for a potentially indefinite period of time; 

5. A statement indicating to which balances the penalty rate may be 

applied; and

6. If applicable, a description of any balances to which the current rate 

will continue to apply as of the effective date of the rate increase, 

unless the consumer fails to make a minimum periodic payment 

within 60 days from the due date for that payment.

In addition to this notice, determine that the creditor does not increase 

the applicable rate to the penalty rate if the outstanding balance does 

not exceed the credit limit on the date set forth in the notice (§

226.9(g)(4)(ii)).

[Click&type]

bb. If a notice provided pursuant to Section 226.9(g)(4)(i) is included on or 

with a periodic statement, determine that the information described in 

Section 226.9(g)(4)(i) is in the form of a table and provided on the front 

of any page of the periodic statement (§ 226.9(g)(4)(iii)(A)); or,

[Click&type]

cc. If a notice required by Section 226.9(g)(4)(i) is not included on or with a 

periodic statement, determine that the information described in Section

226.9(g)(4)(i) is disclosed on the front of the first page of the notice. 

Determine that only information related to the reduction in credit limit is 

included with the notice, except that this notice may be combined with a 

notice described in Section§ 226.9(c)(2)(iv) or (g)(1) (§

226.9(g)(4)(iii)(B)).

[Click&type]

dd. When the consumer is given the right to reject a significant change to an 

account term prior to the effective date of the change, determine whether 

the consumer was given the option to reject the change by notifying the 

creditor of the rejection before the effective date of the change (§

226.9(h)(1)).

[Click&type]
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 46

ee. If the creditor was notified of the rejection of a significant change to an 

account term, determine that the creditor did not:

1. Apply the charge to the account;

2. Impose a fee or charge or treat the account as in default solely as a 

result of the rejection; or

3. Require repayment of the balance on the account using a method that 

is LESS beneficial to the consumer than one of the following 

methods:

i. The method of repayment for the account on the date on which the 

creditor was notified of the rejection;

ii. An amortization period of not less than five years, beginning no 

earlier than the date on which the creditor was notified of the 

rejection; or

iii. A required minimum periodic payment that includes a percentage 

of the balance that is equal to no more than twice the percentage 

required on the date on which the creditor was notified of the 

rejection (§ 226.9(h)(2)).

NOTE: These requirements do not apply if the creditor has not received 

the consumer’s required minimum periodic payment within 60 days after 

the due date for that payment and the creditor has provided timely change 

in terms disclosures (§ 226.9(h)(3)).

[Click&type]

ff. Determine that a statement of the maximum interest rate that may be 

imposed during the term of the obligation is made for any loan in which 

the APR may increase during the plan (§ 226.30(b)).

[Click&type]

gg. For any open-end mortgage loan (credit transaction that is secured by the 

principal dwelling of a consumer) that was sold or otherwise transferred 

or assigned to the covered person, determine that the covered person 

notifies the borrower in writing of such transfer, including (§ 226.39):

1. An identification of the loan that was acquired or transferred;

2. The identity, address, telephone number of the new covered person 

who owns the mortgage loan;

3. The acquisition date recognized on the books and records of the 

covered person;

4. How to reach an agent or party having authority to act on behalf of the 

covered person; 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 47

5. The location of the place where the transfer of ownership of the debt 

to the covered person is recorded (note, however, that if the transfer of 

ownership has not been recorded in public records at the time the 

disclosure is provided, the covered person complies with this 

paragraph by stating this fact); and

6. At the option of the covered person, any other relevant information 

regarding the transaction.

NOTE: This notice of sale or transfer must be provided for any 

consumer credit transaction that is secured by the principal dwelling 

of a consumer. This notification is required even if the loan servicer 

remains the same.

[Click&type]

Section 226.56 - Disclosure Requirements for 

Over-the-Limit Transactions 

a. Determine that the oral, written or electronic “opt-in” notice includes all 

of the following applicable items (and not any information not specified 

in or otherwise permitted) (§ 226.56(e)(1)):

1. Fees – The dollar amount of any fees or charges assessed by the card 

issuer on a consumer’s account for an over-the-limit transaction.

2. APR(s) – Any increased periodic rate(s) (expressed as an APR(s)) that 

may be imposed on the account as a result of an over-the-limit 

transaction.

3. Disclosure of opt-in right – An explanation of the consumer’s right to 

affirmatively consent to the card issuer’s payment of over-the-limit 

transactions, including the method(s) by which the consumer may 

consent.

[Click&type]

b. Determine that the written notice informing the consumer of the right to 

revoke consent following the assessment of an over-the-limit fee or charge 

describes that right, including the method(s) by which the consumer may 

revoke consent Section 226.56(e)(2)).

[Click&type]

Reverse Mortgage Forms Review Procedures 

(Both Open and Closed-End)

a. Determine that the disclosures required for reverse mortgage transactions 

are substantially similar to the model form in Appendix K and include the 

items below.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 48

1. A statement that the consumer is not obligated to complete the reverse 

mortgage transaction merely because he or she has received the 

disclosures or signed an application.

2. A good faith projection of the total cost of the credit expressed as a 

table of “total annual loan cost rates” including payments to the 

consumer, additional creditor compensation, limitations on consumer 

liability, assumed annual appreciation, and the assumed loan period.

3. An itemization of loan terms, charges, the age of the youngest 

borrower, and the appraised property value.

4. An explanation of the table of total annual loan costs rates. 

NOTE: Forms that include or involve current transactions, such as change 

in terms notices, periodic billing statements, rescission notices, and 

billing error communications, are verified for accuracy when the file 

review worksheets are completed. 

[Click&type]

Timing Requirements

6. Review financial institution policies, procedures, and systems to determine, 

either separately or when completing the actual file review, whether the 

applicable disclosures listed below are furnished when required by Regulation 

Z. Take into account products that have different features, such as closed-end 

loans or credit card accounts that are fixed or variable rate. 

a. Credit card application and solicitation disclosures – On or with the 

application (§ 226.5a(b))

b. HELOC disclosures – At the time the application is provided or within 

three business days under certain circumstances (§ 226.5b(b)).

c. Open-end credit initial disclosures – Before the first transaction is made 

under the plan (§ 226.5(b)(1)).

d. Verify that the card issuer sends to the cardholder or otherwise makes

available to the cardholder a copy of the cardholder’s agreement in 

electronic or paper form no later than 30 days after the issuer receives the 

cardholder’s request § 226.58(e)(1)(ii)(B). Determine that the issuer has 

adequate procedures for ensuring that this requirement is met.

e. Periodic statement disclosures for open-end credit under Section 226.7 –

Required if at the end of a billing cycle the account has a debit or credit 

balance of $1 or more or if a finance charge has been imposed (§ 

226.5(b)(2)(i)). Also, the creditor must adopt reasonable procedures 

designed to ensure that periodic statements for credit card accounts are 

mailed or delivered at least 21 days prior to the payment due date and the 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 49

date on which any grace period expires (§ 226.5(b)(2)(ii)).

f. Statement of billing rights – At least once per year (§ 226.9(a)).

g. Supplemental credit devices – Before the first transaction under the plan 

(§ 226.9(b)).

h. Open-end credit change in significant terms as a result of a change in 

contractual terms – 45 days prior to the effective change date (§ 

226.9(c)(2)).

i. Open-end change in terms or rates due to delinquency or default or as a 

penalty – 45 days prior to the effective change date (§ 226.9(g)).

j. Finance charge imposed at time of transaction – Prior to imposing any fee 

(§ 226.9(d)).

k. Disclosures upon renewal of credit or charge card – 30 days or one billing 

cycle, whichever is less before the delivery of the periodic statement on 

which the renewal fee is charged, or at least 30 days prior to the 

scheduled renewal date if the creditor has changed or amended any term 

required to be disclosed under Section 226.6(b)(1) and (b)(2) that has not 

previously been disclosed to the consumer (§ 226.9(e)).

l. Change in credit account insurance provider – Certain information 30 

days before the change in provider occurs and certain information 30 days 

after the change in provider occurs. The institution may provide a 

combined disclosure 30 days before the change in provider occurs (§ 

226.9(f)).

m. Closed-end credit disclosures – Before consummation (§ 226.17(b)).

n. For disclosures for dwelling-secured transactions subject to RESPA (other 

than open-end), multiple timing requirements apply. Determine whether 

the creditor provides early disclosures within three business days after 

receiving the consumer’s written application. The creditor is required to 

deliver or mail the early disclosures no later than three business days after 

receiving the consumer’s application and at least seven business days 

before consummation (§§ 226.19(a)(1)(i) and 226.19(a)(2)(i)). If the APR 

stated in the early disclosures is not considered accurate under Section

226.22 when compared to the APR at consummation, determine whether 

the creditor provided corrected disclosures of all changed terms, including 

the APR, that the consumer received no later than the third business day 

before consummation (§ 226.19(a)(2)(ii)).

o. Disclosures for transactions subject to Section 226.32 – Three business 

days prior to consummation. If such disclosures became inaccurate due to 

a change by the creditor, ensure that the creditor provided new, accurate 

disclosures no later than three business days prior to consummation (§ 

226.31(c)(1)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 50

p. Disclosures for reverse mortgages – Three days prior to consummation of 

a closed-end credit transaction or prior to the first transaction under an 

open-end credit plan (§ 226.31(c)(2)).

q. Disclosures for adjustable-rate mortgages – At least once each year during 

which an interest rate adjustment is implemented without an 

accompanying payment change, and at least 25, but no more than 120 

calendar days before a new payment amount is due, or in accordance with 

other variable-rate subsequent-disclosure regulations issued by a 

supervisory agency (§ 226.20(c)).

r. Notice of new creditor (§ 226.39) – On or before the 30th calendar day 

following the acquisition. 

s. For private education loans subject to Subpart F, determine that:

1. Application or solicitation disclosures were provided on or with any 

application or solicitation § 226.46(d)(1)(i);

2. Approval disclosures were provided before consummation on or with 

any notice of approval provided to the consumer) § 226.46(d)(2); and

3. Final disclosures (determine that disclosures were provided after the 

consumer accepts the loan and at least three business days prior to 

disbursing the private education loan funds) § 226.48.

t. Determine that the issuer provides a written over-the-limit notice prior to 

the assessment of any over-the-limit fee or charge on a consumer’s 

account (§ 226.56(d)(1)(i)).

u. Determine that, if a consumer consents to the card issuer’s payment of 

any over-the-limit transaction by oral or electronic means, the card issuer 

provides the required written notice immediately prior to obtaining that 

consent (§ 226.56(d)(1)(ii)).

v. Determine that the notice confirming the consumer’s consent is provided 

no later than the first periodic statement sent after the consumer has 

consented to the card issuer’s payment of over-the-limit transactions. In 

no case may the creditor assess an over-the-limit fee on the consumer’s 

account without first providing written confirmation (§ 226.56(d)(2)).

w. Determine that the notice providing the consumer notice in writing of the 

right to revoke consent following the assessment of an over-the-limit fee 

or charge is provided on the front of any page of each periodic statement 

that reflects the assessment of an over-the-limit fee or charge on a 

consumer’s account (§ 226.56(d)(3)).

x. For home-equity plans subject to the requirements of Section 226.5b, 

whenever any term required to be disclosed under Section 226.6(a) is 

changed or the required minimum periodic payment is increased, 

determine that the creditor mails or delivers written notice of the change 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 51

to each consumer who may be affected. Determine that the notice is 

mailed or delivered at least 15 days prior to the effective date of the 

change. If the change has been agreed to by the consumer, determine that 

the notice is given before the effective date of the change

(§ 226.9(c)(1)(i)).

y. Notice to restrict credit. For home-equity plans subject to the 

requirements of Section 226.5b, if the creditor prohibits additional 

extensions of credit or reduces the credit limit pursuant to 

Section 226.5b(f)(3)(i) or (f)(3)(vi), determine that the creditor mails or 

delivers written notice of the action to each consumer who will be 

affected not later than three business days after the action is taken and 

contains specific reasons for the action. If the creditor requires the 

consumer to request reinstatement of credit privileges, determine that the 

notice states that fact (§ 226.9(c)(1)(iii)).

[Click&type]

Electronic Disclosures

7. Assess compliance for an institution’s electronic disclosure requirements.

[Click&type]

E-Sign Act

a. Disclosures may be provided to the consumer in electronic form, subject 

to compliance with the consumer consent and other applicable provisions 

of the Electronic Signatures in Global and National Commerce Act (ESign Act) (15 USC 7001 et seq.). The E-Sign Act does not mandate that 

institutions or consumers use or accept electronic records or signatures. It 

permits institutions to satisfy any statutory or regulatory requirements by 

providing the information electronically after obtaining the consumer’s 

affirmative consent. Before consent can be given, consumers must be 

provided with the following information:

1. Any right or option to have the information provided in paper or nonelectronic form; 

2. The right to withdraw the consent to receive information electronically 

and the consequences, including fees, of doing so;

3. The scope of the consent (for example, whether the consent applies 

only to a particular transaction or to identified categories of records 

that may be provided during the course of the parties’ relationship);

4. The procedures to withdraw consent and to update information needed 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 52

to contact the consumer electronically; and

5. The methods by which a consumer may obtain, upon request, a paper 

copy of an electronic record after consent has been given to receive 

the information electronically and whether any fee will be charged.

[Click&type]

b. The consumer must consent electronically or confirm consent 

electronically in a manner that “reasonably demonstrates that the 

consumer can access information in the electronic form that will be used 

to provide the information that is the subject of the consent.” After the 

consent, if an institution changes the hardware or software requirements 

such that a consumer may be prevented from accessing and retaining 

information electronically, the institution must notify the consumer of the 

new requirements and must allow the consumer to withdraw consent 

without charge. 

[Click&type]

c. If the financial institution makes its disclosures available to consumers in 

electronic form, determine that the forms comply with the appropriate 

sections – § 226.5(a)(1); § 226.5a(a)(2)(v); § 226.5b(a)(3); § 226.15(b); § 

226.16(c); § 226.17(a)(1); § 226.17(g); § 226.19(c); § 226.23(b)(1); § 

226.24(d) and § 226.31(b).

[Click&type]

d. Card issuers may provide credit card agreements in electronic form under 

Section 226.58(d) and (e) without regard to the consumer notice and 

consent requirements of Section 101(c) of the E-Sign Act (§ 226.58(f)).

[Click&type]

Section 226.57 - Annual Report to the Board

a. If the card issuer was a party to one or more college credit card 

agreements in effect at any time during a calendar year, verify that the 

card issuer submits to the Board an annual report regarding those 

agreements in the form and manner prescribed by the Board 

(§ 226.57(d)(1)).

Note that a college credit card agreement is any business, marketing, or 

promotional agreement between a card issuer and an institution of higher 

education (or an affiliated alumni organization or foundation) in 

connection with which credit cards are issued to college students at that 

institution of higher education (§ 226.57(a)(5)).

[Click&type]
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 53

b. The annual report to the Board must include the following (§

226.57(d)(2)): 

1. Identifying information about the card issuer and the agreements 

submitted, including the issuer’s name, address, and identifying 

number (such as an RSSD ID number or tax identification number);

2. A copy of any college credit card agreement to which the card issuer 

was a party that was in effect at any time during the period covered by 

the report;

3. A copy of any memorandum of understanding in effect at any time 

during the period covered by the report between the card issuer and an 

institution of higher education or affiliated organization that directly or 

indirectly relates to the college credit card agreement or that controls 

or directs any obligations or distribution of benefits between any such 

entities;

4. The total dollar amount of any payments pursuant to a college credit 

card agreement from the card issuer to an institution of higher 

education or affiliated organization during the period covered by the 

report, and the method or formula used to determine such amounts;

5. The total number of credit card accounts opened pursuant to any 

college credit card agreement during the period covered by the report; 

and

6. The total number of credit card accounts opened pursuant to any such 

agreement that were open at the end of the period covered by the 

report.

[Click&type]

c. If the card issuer is subject to reporting, determine if the card issuer 

submits its annual report for each calendar year to the Board by the first 

business day on or after March 31 of the following calendar year. 

(However, card issuers must submit the first report following the effective 

date of this section, providing information for the 2009 calendar year, to 

the Board by February 22, 2010.) (§ 226.57(d)(3))

Section 226.58(c) - The Submission of 

Agreements to the Board 

a. For card issuers that issue credit cards under a credit card account under 

an open-end (not home-secured) consumer credit plan, determine that the 

card issuer makes quarterly submissions to the Board in the form and 

manner specified by the Board that contain: 

1. Identifying information about the card issuer and the agreements 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 54

submitted, including the issuer’s name, address, and identifying 

number (such as an RSSD ID number or tax identification number);

2. The credit card agreements that the card issuer offered to the public as 

of the last business day of the preceding calendar quarter that the card 

issuer has not previously submitted to the Board;

3. Any credit card agreement previously submitted to the Board that was 

amended during the preceding calendar quarter, as described in 

Section 226.58(c)(3); and

4. Notification regarding any credit card agreement previously 

submitted to the Board that the issuer is withdrawing, as described in 

Section 226.58(c)(4) and (c)(5). 

[Click&type]

b. Verify that, for the first two submissions on February 22, 2010, and 

August 2, 2010, quarterly submissions were sent to the Board no later 

than the first business day on or after January 31, April 30, July 31, and 

October 31 of each year § 226.58(c.)(1).

[Click&type]

c. Verify that the first submission was sent to the Board no later than 

February 22, 2010. 

[Click&type]

d. Verify that the first submission contains the credit card agreements that 

the card issuer offered to the public as of December 31, 2009 § 

226.58(c)(2).

[Click&type]

e. Verify that the next submission is sent to the Board no later than August 2, 

2010, and contains:

1. Any credit card agreement that the card issuer offered to the public as 

of June 30, 2010, that the card issuer has not previously submitted to 

the Board;

2. Any credit card agreement previously submitted to the Board that was 

amended after December 31, 2009, and on or before June 30, 2010, as 

described in Section 226.58(c)(3); and

3. Notification regarding any credit card agreement previously 

submitted to the Board that the issuer is withdrawing as of June 30, 

2010, as described in Section 226.58(c)(4) and (c)(5).

[Click&type]

f. If a credit card agreement that previously has been submitted to the Board 

is amended, verify that the card issuer submits the entire amended 

agreement to the Board by the first quarterly submission deadline after the 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 55

last day of the calendar quarter in which the change became effective § 

226.58(c.)(3). 

NOTE: If a credit card agreement has been submitted to the Board, the 

agreement has not been amended and the card issuer continues to offer the 

agreement to the public, no additional submission regarding that agreement 

is required.

[Click&type]

g. If a card issuer no longer offers to the public a credit card agreement that 

previously has been submitted to the Board, ensure that the card issuer 

notifies the Board by the first quarterly submission deadline after the last 

day of the calendar quarter in which the issuer ceased to offer the 

agreement (§ 226.58(c)(4)). 

NOTE: A card issuer is not required to submit any credit card agreements 

to the Board if the card issuer had fewer than 10,000 open credit card 

accounts as of the last business day of the calendar quarter (§ 

226.58(c)(5)(i)).

[Click&type]

h. If an issuer that previously qualified for the de minimis exception ceases 

to qualify, determine that the card issuer begins making quarterly 

submissions to the Board no later than the first quarterly submission 

deadline after the date as of which the issuer ceased to qualify (§ 

226.58(c)(5)(ii)).

[Click&type]

i. If a card issuer that did not previously qualify for the de minimis 

exception qualifies for the de minimis exception, determine that the card 

issuer continues to make quarterly submissions to the Board until the 

issuer notifies the Board that the card issuer is withdrawing all agreements 

it previously submitted to the Board (§ 226.58(c)(5)(iii)).

[Click&type]

j. A card issuer is not required to submit to the Board a credit card 

agreement if, as of the last business day of the calendar quarter, the 

agreement is offered for accounts under one or more private label credit 

card plans each of which has fewer than 10,000 open accounts and is not 

offered to the public other than for accounts under such a plan (§ 

226.58(c)(6)(i)).

NOTE: A private label credit card is one that is usable only at a single 

merchant or affiliated group of merchants. A private label credit card plan 

is all private label credit card accounts issued by a particular issuer with 

credit cards usable at the same single merchant or affiliated group of 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 56

merchants (§ 226.58(b)(7)).

[Click&type]

k. If an agreement that previously qualified for the private label credit card 

exception ceases to qualify, determine that the card issuer submits the 

agreement to the Board no later than the first quarterly submission 

deadline after the date as of which the agreement ceased to qualify (§ 

226.58(c)(6)(ii)).

[Click&type]

l. If an agreement that did not previously qualify for the private label credit 

card exception qualifies for the exception, determine that the card issuer 

continues to make quarterly submissions to the Board with respect to that 

agreement until the issuer notifies the Board that the agreement is being 

withdrawn (§ 226.58(c)(6)(iii)).

NOTE: A card issuer is not required to submit to the Board a credit card 

agreement if, as of the last business day of the calendar quarter, the 

agreement is offered as part of a product test offered to only a limited 

group of consumers for a limited period of time, is used for fewer than 

10,000 open accounts, and is not offered to the public other than in 

connection with such a product test (§ 226.58(c)(7)(i)).

[Click&type]

m. If an agreement that previously qualified for the product testing exception 

ceases to qualify, determine that the card issuer submits the agreement to 

the Board no later than the first quarterly submission deadline after the 

date as of which the agreement ceased to qualify (§ 226.58(c)(7)(ii)).

[Click&type]

n. If an agreement that did not previously qualify for the product testing 

exception qualifies for the exception, determine that the card issuer 

continues to make quarterly submissions to the Board with respect to that 

agreement until the issuer notifies the Board that the agreement is being 

withdrawn (§ 226.58(c)(7)(iii)).

[Click&type]

o. Verify that each agreement contains the provisions of the agreement and 

the pricing information in effect as of the last business day of the 

preceding calendar quarter (§ 226.58(c)(8)(i)(A)).

[Click&type]

p. Verify that agreements do not include any personally identifiable 

information relating to any cardholder, such as name, address, telephone 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 57

number, or account number (§ 226.58(c)(8)(i)(B)).

[Click&type]

q. Verify that agreements are presented in a clear and legible font 

(§ 226.58(c)(8)(i)(D)).

[Click&type]

r. Verify that pricing information is set forth in a single addendum to the 

agreement that contains only the pricing information (§ 

226.58(c)(8)(ii)(A)).

NOTE: With respect to information other than the pricing information that 

may vary between cardholders depending on creditworthiness, state of 

residence, or other factors, issuers may, but are not required to, include 

that information in a single addendum (the optional variable terms 

addendum) to the agreement separate from the pricing addendum. 

[Click&type]

s. If pricing information varies from one cardholder to another depending on 

the cardholder’s creditworthiness or state of residence or other factors, 

verify that the pricing information is disclosed either by setting forth all 

the possible variations (such as purchase APRs of 13 percent, 15 percent, 

17 percent, and 19 percent) or by providing a range of possible variations 

(such as purchase APRs ranging from 13 percent to 19 percent) (§ 

226.58(c)(8)(ii)(B)).

[Click&type]

t. If a rate included in the pricing information is a variable rate, verify that 

the issuer identifies the index or formula used in setting the rate and the 

margin (§ 226.58(c)(8)(ii)(C)). 

[Click&type]

u. If rates vary from one cardholder to another, verify that the issuer 

discloses such rates by providing the index and the possible margins (such 

as the prime rate plus 5 percent, 8 percent, 10 percent, or 12 percent) or 

range of margins (such as the prime rate plus from 5 to 12 percent) (§ 

226.58(c)(8)(ii)(C)). (Note that the value of the rate and the value of the 

index are not required to be disclosed (§ 226.58(c)(8)(ii)(C)). 

[Click&type]

v. Determine that issuers do not provide provisions of the agreement or 

pricing information in the form of change-in-terms notices or riders (other 

than the pricing information addendum and the optional variable terms 

addendum) (§ 226.58(c)(8)(iv)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 58

[Click&type]

w. Determine that changes in provisions or pricing information are integrated 

into the text of the agreement, the pricing information addendum or the 

optional variable terms addendum, as appropriate (§ 226.58(c)(8)(iv)).

[Click&type]

Section 226.58(d) - The Posting of Agreements 

Offered to the Public 

a. Determine that the card issuer posts and maintains on its publicly 

available website the credit card agreements that the issuer is required to 

submit to the Board under Section 226.58(c) (§ 226.58(d)(1)).

[Click&type]

b. With respect to an agreement offered solely for accounts under one or 

more private label credit card plans (and the issuer does not post and 

maintain the agreements on its publicly available website), determine that 

the issuer posts and maintains the agreement on the publicly available 

website of at least one of the merchants where cards issued under each 

private label credit card plan with 10,000 or more open accounts may be 

used (§ 226.58(d)(1)).

[Click&type]

c. Verify that agreements posted pursuant to Section 226.58(d) conform to 

the form and content requirements for agreements submitted to the Board 

specified in Section 226.58(c)(8) (§ 226.58(d)(2)).

[Click&type]

d. Determine that agreements are posted in an electronic format that is 

readily usable by the general public (§ 226.58(d)(3)).

[Click&type]

e. Verify that agreements are placed in a location on its website that is 

prominent and readily accessible by the public and accessible without 

submission of personally identifiable information (§ 226.58(d)(3)).

[Click&type]

f. Determine that the card issuer updates the agreements posted on its 

website at least as frequently as the quarterly schedule required for 

submission of agreements to the Board under Section 226.58(c) (§ 

226.58(d)(4)).

NOTE: If the issuer chooses to update the agreements on its website more 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 59

frequently, the agreements posted on the issuer’s website may contain the 

provisions of the agreement and the pricing information in effect as of a 

date other than the last business day of the preceding calendar quarter.

[Click&type]

Section 226.58(e) - The Posting of Agreements for 

“Open” Accounts 

a. With respect to any open (i.e., the cardholder can obtain extensions or there 

is an outstanding balance on the account that has not been charged off) 

credit card account, determine that the card issuer either:

1. Posts and maintains the cardholder’s agreement on its website; or

2. Promptly provides a copy of the cardholder’s agreement to the 

cardholder upon the cardholder’s request.

[Click&type]

b. If the card issuer makes an agreement available upon request, ensure that the 

issuer provides the cardholder with the ability to request a copy of the 

agreement both by:

1. Using the issuer’s website (such as by clicking on a clearly identified 

box to make the request); and § 226.58(e)(1)(ii)(A)

2. Calling a readily available telephone line the number for which is 

displayed on the issuer’s website and clearly identified as to purpose 

(§ 226.58(e)(1)(ii)(B) and (e)(2)).

[Click&type]

c. If an issuer does not maintain a website from which cardholders can access 

specific information about their individual accounts determine that the 

issuer makes agreements available upon request by providing the cardholder 

with the ability to request a copy of the agreement by calling a readily 

available telephone line the number for which is (§ 226.58(e)(2)): 

1. Displayed on the issuer’s website and clearly identified as to purpose; or

2. Included on each periodic statement sent to the cardholder and clearly 

identified as to purpose. 

[Click&type]

d. Verify that the card issuer sends to the cardholder or otherwise makes

available to the cardholder a copy of the cardholder’s agreement in 

electronic or paper form no later than 30 days after the issuer receives the 

cardholder’s request (§ 226.58(e)(1)(ii)(B)).

[Click&type]
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 60

e. Determine that agreements posted on the card issuer’s website or made 

available upon the cardholder’s request conform to the form and content 

requirements for agreements submitted to the Board specified in Section

226.58(c)(8) (§ 226.58(e)(3)(i)).

[Click&type]

f. If the card issuer posts an agreement on its website or otherwise provides an 

agreement to a cardholder electronically, verify that the agreement is posted 

or provided in an electronic format that is readily usable by the general 

public and is placed in a location that is prominent and readily accessible to 

the cardholder (§ 226.58(e)(3)(ii)).

[Click&type]

g. If agreements posted or otherwise provided contain personally identifiable 

information relating to the cardholder, such as name, address, telephone 

number, or account number, ensure that the issuer takes appropriate 

measures to make the agreement accessible only to the cardholder or other 

authorized persons (§ 226.58(e)(3)(iii)).

[Click&type]

h. Determine that agreements posted or otherwise provided set forth the 

specific provisions and pricing information applicable to the particular 

cardholder (§ 226.58(e)(3)(iv)).

[Click&type]

i. Determine that provisions and pricing information are complete and 

accurate as of a date no more than 60 days prior to:

1. The date on which the agreement is posted on the card issuer’s website 

under Section 226.58(e)(1)(i);

2. The date the cardholder’s request is received under Section

226.58(e)(1)(ii) or (e)(2) (§ 226.58(e)(3)(iv)).

Note that card issuers may provide credit card agreements in electronic 

form under Section 226.58(d) and (e) without regard to the consumer 

notice and consent requirements of Section 101(c) of the Electronic 

Signatures in Global and National Commerce Act (E-Sign Act) (15 USC

7001 et seq.) (§ 226.58(f)).

[Click&type]
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 61

Advertising (Open- and Closed-End)

8. For open- and closed-end loans, sample advertising copy, including any 

electronic advertising, since the previous examination and verify that the terms 

of credit are accurate, clear, balanced, and conspicuous. If triggering terms are 

used, determine that the required disclosures are made (§§ 226.16 and 226.24).

a. For advertisements for closed-end credit:

1. If a rate of finance charge was stated, determine that it was stated as an 

APR.

2. If an APR will increase after consummation, verify that a statement to 

that fact is made.

3. Determine whether there are deceptive or misleading statements or 

practices.

b. Determine that the creditor does not offer college students any tangible item 

to induce such students to apply for or open an open-end consumer credit 

plan offered by such creditor, if such offer is made:

1. On the campus of an institution of higher education;

2. Near the campus of an institution of higher education; or

3. At an event sponsored by or related to an institution of higher education

(§ 226.57(c)). 

c. If an open-end credit advertisement refers to an APR as “fixed” (or similar 

term), determine 1) that the advertisement also specifies a time period that 

the rate will be fixed and 2) that the rate will not increase during that period. 

d. If an open-end credit advertisement used the word “fixed” or a similar word 

and no time period is specified in which the rate will be fixed, determine 

that the rate will not increase while the plan is open § 226.16 (f).

e. For any advertisement of an open-end (not home-secured) plan, if any 

annual percentage rate that may be applied to the account is an introductory 

rate, determine that the term introductory or intro is in immediate proximity 

to each listing of the introductory rate (§ 226.16(g)(3)).

f. For any advertisement of an open-end (not home-secured) plan, if any 

annual percentage rate that may be applied to the account is a promotional 

rate, determine that the following information is stated in a clear and 

conspicuous manner in the advertisement (§ 226.16(g)(4)):

1. When the promotional rate will end; and,

2. The annual percentage rate that will apply after the end of the 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 62

promotional period.

NOTE: If such rate is variable, determine that the annual percentage 

rate complies with the accuracy standards in §§ 226.5a(c)(2), 

226.5a(d)(3), 226.5a(e)(4), or 226.16(b)(1)(ii), as applicable. If such 

rate cannot be determined at the time disclosures are given because the 

rate depends at least in part on a later determination of the consumer’s 

creditworthiness, determine that the advertisement discloses the 

specific rates or the range of rates that might apply. Further, if the rate 

is stated in a written or electronic advertisement, determine that the 

information in §§ 226.16 (g)(4)(i) and (g)(4)(ii) is stated in a 

prominent location closely proximate to the first listing of the 

promotional rate.

g. If a deferred interest offer is advertised for an open-end account not subject 

to Section 226.5b, determine that the deferred interest period is stated in a 

clear and conspicuous manner in the advertisement. If the phrase “no 

interest” or similar term regarding the possible avoidance of interest 

obligations under the deferred interest program is stated, determine that the 

term “if paid in full” is also stated in a clear and conspicuous manner 

preceding the disclosure of the deferred interest period in the advertisement. 

If the deferred interest offer is included in a written or electronic 

advertisement, determine that the deferred interest period and, if applicable, 

the term “if paid in full” are stated in immediate proximity to each statement 

of “no interest,” “no payments,” “deferred interest,” “same as cash,” or 

similar term regarding interest or payments during the deferred interest 

period (§ 226.16(h)(3)).

h. If any deferred interest offer is advertised for an open-end account not 

subject to Section 226.5b, determine that the (h)(4)(i) and (h)(4)(ii) language 

(of § 226.16(h)(4)) is stated in the advertisement and is similar to Sample 

G–24 in Appendix G. If the deferred interest offer is included in a written or 

electronic advertisement, determine that this information is stated in a 

prominent location closely proximate to the first statement of “no interest,”

“no payments,” “deferred interest,” “same as cash,” or similar term 

regarding interest or payments during the deferred interest period

(§ 226.16(h)(4)).

[Click&type]

Transactional Testing

NOTE: When verifying APR accuracies, use the OCC’s APR calculation model 

or other calculation tool acceptable to your regulatory agency.

9. Review the financial institution’s closed-end and open-end transactions to 

ensure accuracy and completeness.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 63

[Click&type]

Closed-End Credit Transactional Testing Procedures

a. For each type of closed-end loan being tested, determine the accuracy of the 

disclosures by comparing the disclosures to the contract and other financial 

institution documents (§ 226.17).

[Click&type]

b. Determine whether the required disclosures were made before 

consummation of the transaction and ensure the presence and accuracy of 

the items below, as applicable (§ 226.18).

1. Identity of creditor making disclosure.

2. Amount financed. 

3. Itemization of the amount financed (RESPA GFE may substitute).

4. Finance charge. 

5. Annual Percentage Rate (APR).

6. Variable rate information.

7. Payment schedule including amount, timing and number of 

payments. 

8. Total of payments. 

9. Total sales price (credit sale).

10. Prepayment statement.

11. Late payment statement.

12. Description of security interest.

13. Insurance and debt cancellation.

14. Certain security interest charges.

15. Contract reference statement.

16. Assumption policy.

17. Required deposit.

18. Interest rate and payment summary for mortgage transactions.

[Click&type]

c. Determine for adjustable rate mortgage loans with maturities of more than 

one year that the required early and subsequent disclosures are complete, 

accurate, and timely. Early disclosures required by Section 226.19(a) are 

verified during the closed-end credit forms review. Subsequent 

disclosures should include the items below, as applicable (§ 226.20(c)).

1. Current and prior interest rates.

2. Index values used to determine current and prior interest rates.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 64

3. Extent to which the creditor has foregone an increase in the interest 

rate.

4. Contractual effects of the adjustment (new payment and loan 

balance).

5. Payment required to avoid negative amortization. 

NOTE: The accuracy of the adjusted interest rates and indexes should be 

verified by comparing them with the contract and early disclosures. Refer 

to the Additional Variable Rate Testing section of these examination 

procedures.

[Click&type]

d. Determine, for each type of closed-end rescindable loan being tested, the 

appropriate number of copies of the rescission notice are provided to each 

person whose ownership interest is or will be subject to the security 

interest. The rescission notice must disclose the items below (§ 

226.23(b)(1)).

1. Security interest taken in the consumer’s principal dwelling 

2. Consumer’s right to rescind the transaction 

3. How to exercise the right to rescind, with a form for that purpose, 

designating the address of the creditor’s place of business 

4. Effects of rescission 

5. Date the rescission period expires.

[Click&type]

e. Ensure funding was delayed until the rescission period expired (§ 

226.23(c)).

[Click&type]

f. Determine if the institution has waived the three-day right to rescind since 

the previous examination. If applicable, test rescission waivers (§ 

226.23(e)).

[Click&type]

g. Determine whether the maximum interest rate in the contract is disclosed 

for any adjustable rate consumer credit contract secured by a dwelling (§ 

226.30(a)).

[Click&type]

h. For private student loans with a right to cancel, review cancellation 

requests to determine if they were properly handled (§ 226.47(c)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 65

Certain Home Mortgage Transactions Subject to 

Subpart E

a. Determine whether the financial institution originates consumer credit 

transactions subject to Subpart E of Regulation Z; specifically, certain 

closed-end home mortgages (high-cost mortgages (§ 226.32), reverse 

mortgages (§ 226.33), and “higher-priced mortgage loans” (§ 226.35). 

(Examiners may use the attached worksheet as an aid for identifying and 

reviewing high-cost mortgages.)

[Click&type]

b. In addition to reviewing high-cost mortgages and reverse mortgages for 

compliance with requirements in other subparts of Regulation Z (for 

example, disclosure timing requirements under Section 226.19(a)), review 

such mortgages to ensure the following:

1. Required disclosures are provided to consumers in addition to, not in 

lieu of, the disclosures contained in other subparts of Regulation Z 

(§ 226.31(a)).

2. Disclosures are clear and conspicuous, in writing, and in a form that 

the consumer may keep (§ 226.31(b)).

3. Disclosures are furnished at least three business days prior to 

consummation of a mortgage transaction covered by Section 226.32 

or a closed-end reverse mortgage transaction (or at least three 

business days prior to the first transaction under an open-end reverse 

mortgage) (§ 226.31(c)).

4. Disclosures reflect the terms of the legal obligation between the 

parties (§ 226.31(d)).

5. If the transaction involves more than one creditor, that only one 

creditor provided the disclosures. Where the obligation involves 

multiple consumers, ensure that the disclosures were provided to any 

consumer who is primarily liable on the obligation. Further, for 

rescindable transactions, verify that the disclosures were provided to 

each consumer who has the right to rescind (§ 226.31(e)).

6. The APR is accurately calculated and disclosed in accordance with 

the requirements and within the tolerances allowed in Section 226.22 

(§ 226.31(g)).

[Click&type]

c. For high-cost mortgages (§ 226.32), ensure that, in addition to other 

required disclosures, the creditor discloses the following at least three 

business days prior to consummation: [See model disclosure at App. H-
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 66

16]

1. Notice containing the prescribed language (§ 226.32(c)(1)).

2. APR (§ 226.32(c)(2)).

3. Amount of regular loan payment and the amount of any balloon 

payment. The disclosed regular payment should be treated as accurate 

if it is based on an amount borrowed that is deemed accurate under

Section 226.32(c)(5) (§ 226.32(c)(3)).

4. For variable rate loans, a statement that the interest rate and monthly 

payment may increase, and the amount of the single maximum 

monthly payment allowed under the contract (§ 226.32(c)(4)).

5. For a mortgage refinancing, the total amount the consumer will 

borrow (the face amount) and if this amount includes premiums or 

other charges for optional credit insurance or debt-cancellation 

coverage, that fact is stated. This disclosure should be treated as 

accurate if within $100 of the actual amount borrowed (§ 

226.32(c)(5)).

6. A new disclosure is required if, subsequent to providing the 

additional disclosure but prior to consummation, there are changes in 

any terms that make the disclosures inaccurate. For example, if a 

consumer purchases optional credit insurance and, as a result, the 

monthly payment differs from the payment previously disclosed, redisclosure is required and a new three-day waiting period applies (§ 

226.31(c)(1)(i)).

7. If a creditor provides new disclosures by telephone when the 

consumer initiates a change in terms, then at consummation (§ 

226.31(c)(1)(ii)):

The creditor must provide new written disclosures and both parties 

must sign a statement that these new disclosures were provided by 

telephone at least three days prior to consummation.

8. If a consumer waives the right to a three-day waiting period to meet a 

bona fide personal financial emergency, the consumer’s waiver must 

be a dated written statement (not a pre-printed form) describing the 

emergency and bearing the signature of all entitled to the waiting 

period (a consumer can waive only after receiving the required 

disclosures and prior to consummation) (§ 226.31(c)(1)(iii)).

[Click&type]

d. High-cost mortgage transactions (§ 226.32) do not provide for any of the 

following loan terms:
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 67

1. Balloon payment (if term is less than five years, with exceptions) 

(§ 226.32(d)(1)(i) and (ii)).

2. Negative amortization (§ 226.32(d)(2)).

3. Advance payments from the proceeds of more than two periodic 

payments (§ 226.32(d)(3)).

4. Increased interest rate after default (§ 226.32(d)(4)). 

5. A rebate of interest, arising from a loan acceleration due to default, 

calculated by a method less favorable than the actuarial method 

(§ 226.32(d)(5)).

6. Prepayment penalty, unless:

• It will not apply after the two-year period following 

consummation;

• It will not apply if the source of prepayment funds is a refinancing 

by the creditor or an affiliate of the creditor;

• The consumer’s total monthly debt payments (including amounts 

owed under mortgage), at consummation, is 50 percent or less of 

the consumer’s monthly gross income (as verified in accordance 

with § 226.34(a)(4)(ii)); and

• The amount of the periodic payment of principal or interest or 

both may not change during the four-year period following 

consummation (§§ 226.32(d)(6) and § 226.32(d)(7)).

7. A due-on-demand clause permitting the creditor to terminate the loan 

in advance of maturity and accelerate the balance, with certain 

exceptions (§ 226.32(d)(8)).

[Click&type]

e. The creditor is not engaged in the following acts and practices for highcost mortgages:

1. Home improvement contracts – paying a contractor under a home 

improvement contract from the proceeds of a mortgage unless certain 

conditions are met (§ 226.34(a)(1)).

2. Notice to assignee – selling or otherwise assigning a high-cost 

mortgage without furnishing the required statement to the purchaser 

or assignee (§ 226.34(a)(2)).

3. Refinancing within one year of extending credit – within one year of 

making a high-cost mortgage (§ 226.32), a creditor may not refinance 

any high-cost mortgage to the same borrower into another high-cost 

mortgage that is not in the borrower’s interest. This also applies to 

assignees that hold or service the high-cost mortgage. Commentary to 

34(a)(3) has examples applying the refinancing prohibition and 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 68

addressing “borrower’s interest” (§ 226.34(a)(3)).

[Click&type]

f. For higher-priced mortgage loans (§ 226.35), ensure that the loan terms 

do not provide for a prepayment penalty, unless:

1. The penalty is otherwise permitted by law, including § 226.32(d)(6);

2. The penalty will not apply after the two-year period following 

consummation;

3. The source of prepayment funds is a refinancing by the creditor or an

affiliate of the creditor; and

4. The amount of the periodic payment of principal or interest or both 

may not change during the four-year period following consummation 

(§ 226.35(b)).

[Click&type]

g. For higher-priced mortgage loans secured by a first lien on a principal 

dwelling escrow accounts are established before consummation for 

property taxes and premiums for mortgage-related insurance required by 

the creditor.

[Click&type]

h. For both high-cost (§ 226.32) and higher-priced mortgages (§ 226.35), 

review for the following:

1. Ensure the subject loans are not being extended based on the consumer’s 

collateral without regard to repayment ability, including the consumer’s 

current and expected income, current obligations, mortgage related 

obligations, assets other than collateral, and employment. 

2. Review underwriting standards to ensure the creditor bases its 

determination of repayment ability on current or reasonably expected 

income from employment or other sources, on assets other than the 

collateral, or both.

3. Determine that a creditor verifies amounts of income or assets that it 

relies on to determine repayment ability, including expected income or 

assets, by the consumer’s Internal Revenue Service Form W-2, tax 

returns, payroll receipts, financial institution records, or other third party 

documents that provide reasonably reliable evidence of the consumer’s 

income or assets.

4. To establish whether a presumption of compliance applies, determine 

whether a creditor verifies the consumer’s current obligations by:

i. Verifying repayment ability as described above;
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 69

ii. Determining the consumer’s repayment ability by using the 

largest payment of principal and interest in the first seven years 

following consummation, taking into account current and 

mortgage-related obligations; and

iii. Assessing the consumer’s repayment ability taking into account at 

least one of the following: the ratio of total debt obligations to 

income, or the income the consumer will have after paying debt 

obligations.

5. Evasion of requirements – Ensure that the creditor does not structure 

a high-cost or higher-priced mortgage loan as an open-end plan 

(“spurious open-end credit”) to evade the requirements of Regulation 

Z. See staff commentary to 34(b) for factors to be considered (§ 

226.34(b)).

i. The following are prohibited acts or practices in connection with 

credit secured by a consumer’s principal dwelling. § 226.36:

a. Coercion of Appraiser – For consumer credit secured by a 

consumer’s principal dwelling, review files (and specific 

consumer complaints not reflected in files) to determine if 

there is misrepresentation of the value of a consumer’s 

principal dwelling.

1. Ensure that the creditor or (mortgage broker), affiliate of a 

creditor or mortgage broker has not directly or indirectly 

coerced, influenced, or otherwise encouraged an appraiser 

to misstate or misrepresent the value of a consumer’s 

principal dwelling.

2. Determine if the creditor knew, at or before loan 

consummation, of a violation of the appraiser coercion 

prohibition. If so, verify that the creditor acted with 

reasonable diligence to determine that the appraisal in 

question does not materially misstate or misrepresent the 

value of the consumer’s principal dwelling.

b. Loan Servicing Practices – For a consumer credit transaction 

secured by a consumer’s principal dwelling, determine if loan 

servicer:

1. Failed to credit a conforming payment to the consumer’s 

loan account as of the date of receipt, where the delay in 

crediting resulted in a charge to the consumer or in the 

reporting of negative information to a credit reporting 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 70

agency;

2. Imposed on the consumer any late fee or delinquency 

charge in connection with a payment, when the only 

delinquency was attributable to late fees or delinquency 

charges assessed on an earlier payment, and the payment 

is otherwise a full payment for the applicable period and is 

paid on its due date or within any applicable grace period; 

or

3. Failed to provide, within a reasonable time after receiving 

a request from the consumer or person acting on behalf of 

the consumer, an accurate statement of the total 

outstanding balance that would be required to satisfy the 

consumer’s obligations in full as of a specific date. A 

reasonable time under most circumstances would be to 

provide the statement within 5 business days, unless 

refinance application volume is unusually high.

[Click&type]

Prohibited Payments to Loan Originators2

a. Determine that, in connection with a consumer credit transaction secured 

by a dwelling,3 no loan originator receives and no person pays to a loan 

originator, directly or indirectly, compensation4 that is based on any of the 

transaction’s terms or conditions (§ 226.36(d)(1)(i)). 

Note: This prohibition does not apply if the loan originator receives 

compensation directly from a consumer in a consumer credit transaction 

secured by a dwelling. Additionally, the amount of credit extended is not 

deemed to be a transaction term or condition, provided compensation 

received by or paid to a loan originator, directly or indirectly, is based on 

a fixed percentage of the amount of credit extended. Such compensation 

may be subject to a minimum or maximum dollar amount. 

[Click&type]

 2The term ‘‘loan originator’’ means, with respect to a particular transaction, a person who for compensation or other monetary gain, 

or in expectation of compensation or other monetary gain, arranges, negotiates, or otherwise obtains an extension of consumer credit 

for another person. The term ‘‘loan originator’’ includes an employee of the creditor if the employee meets this definition. The term 

‘‘loan originator’’ includes the creditor only if the creditor does not provide the funds for the transaction at consummation out of the 

creditor’s own resources, including drawing on a bona fide warehouse line of credit, or out of deposits held by the creditor. A mortgage 

broker with respect to a particular transaction is any loan originator that is not an employee of the creditor. See 12 CFR § 226.36 

(a)(1)&(2)

3 Secs. 36(d) and (e) do not apply to a home-equity line of credit subject to § 226.5b or to a loan that is secured by a consumer’s interest in a timeshare plan described in 11 USC 101(53D). (§226.36(f))

4 Compensation includes salaries, commissions, and any financial or similar incentive, such as an annual or periodic bonus. (comment 

§ 226 36(d)(1)-1) 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 71

b. If any loan originator receives compensation directly from a consumer in 

a consumer credit transaction secured by a dwelling, determine that 

(§ 226.36(d)(2)):

1. No loan originator receives compensation, directly or indirectly, from 

any person other than the consumer in connection with the transaction 

(§ 226.36(a)(2)(i)); and 

2. No person who knows or has reason to know of the consumer-paid 

compensation to the loan originator (other than the consumer) pays 

any compensation to a loan originator, directly or indirectly, in 

connection with the transaction (§ 226.36(a)(2)(ii)).

[Click&type]

Prohibition on Steering

a. Determine that, in connection with a consumer credit transaction secured 

by a dwelling, a loan originator does not direct or ‘‘steer’’ a consumer to 

consummate a transaction based on the fact that the originator will receive 

greater compensation from the creditor in that transaction than in other 

transactions the originator offered or could have offered to the consumer, 

unless the consummated transaction is in the consumer’s interest (§

226.36(e)(1)).

Note: The rule provides a safe harbor to facilitate compliance with the 

prohibition on steering in Section 226.36(e)(1). The loan originator is 

deemed to comply with the anti-steering prohibition if the consumer is 

presented with loan options that meet all of the following conditions for 

each type of transaction in which the consumer expressed an interest:5

1. The loan originator obtains loan options from a significant number of 

the creditors with which the originator regularly does business and, 

for each type of transaction in which the consumer expressed an 

interest, presents the consumer with loan options that include (§

226.36(e)(3)(i)):

i. The loan with the lowest interest rate; 

ii. The loan with the lowest interest rate without negative 

amortization, a prepayment penalty, interest-only payments, a 

balloon payment in the first 7 years of the life of the loan, a 

demand feature, shared equity, or shared appreciation; or, in the 

case of a reverse mortgage, a loan without a prepayment penalty, 

 5 The term ‘‘type of transaction’’ refers to whether: (i) A loan has an APR that cannot increase after consummation; (ii) A loan has an 

APR that may increase after consummation; or (iii) A loan is a reverse mortgage (§ 226.36(e)(2)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 72

or shared equity or shared appreciation; and 

iii. The loan with the lowest total dollar amount for origination points 

or fees and discount points.

2. The loan originator has a good faith belief that the options (presented 

to the consumer that are set forth, above) are loans for which the 

consumer likely qualifies (§ 226.36(e)(3)(ii)).

3. For each type of transaction, if the originator presents to the consumer 

more than three loans, the originator highlights the loans that satisfy 

options 1.i, 1.ii, and 1.iii above (§ 226.36(e)(3)(iii)).

NOTE: If the requirements set forth in Section 226.36(e) are met, the 

loan originator can, without steering, present fewer than three loans (§

226.36(e)(4)).

[Click&type]

Valuation Independence

a. Determine that the covered person did not attempt to directly or indirectly 

cause the value assigned to the consumer’s principal dwelling to be based 

on any factor other than the independent judgment of a person that 

prepares valuations. Examples of such attempts include (§ 226.42(c)):

1. Seeking to influence a person that prepares a valuation to report a 

minimum or maximum value for the consumer’s principal dwelling;

2. Withholding or threatening to withhold timely payment to a person 

that prepares a valuation or performs valuation management functions 

because the person does not value the consumer’s principal dwelling 

at or above a certain amount;

3. Implying to a person that prepares valuations that current or future 

retention of the person depends on the amount at which the person 

estimates the value of the consumer’s principal dwelling;

4. Excluding a person that prepares a valuation from consideration for 

future engagement because the person reports a value for the 

consumer’s principal dwelling that does not meet or exceed a 

predetermined threshold; and

5. Conditioning the compensation paid to a person that prepares a 

valuation on consummation of the covered transaction.

[Click&type]

b. Determine that the valuation does not materially misrepresent the value 

of the consumer’s principal dwelling (§ 226.42(c)(2)(i)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 73

Note: A misrepresentation is material if it is likely to significantly affect 

the value assigned to the consumer’s principal dwelling. A bona fide 

error shall not be a misrepresentation.

[Click&type]

c. Determine that a valuation was not falsified or materially altered 

(§ 226.42(c)(2)(ii)).

NOTE: An alteration is material if it is likely to significantly affect the 

value assigned to the consumer’s principal dwelling.

[Click&type]

d. Determine that the covered person does not induce a person to materially 

misrepresent or falsify the value of a consumer’s principal dwelling (in 

violation of Section 226.42(c)(2)(i) or (ii)). (§ 226.42(c)(2)(iii))

[Click&type]

e. Prohibition on conflicts of interest. To the extent applicable, determine 

that the person who prepared the valuations or performed the valuation 

management functions for a covered transaction did not have a direct or 

indirect interest, financial or otherwise, in the property or transaction for 

which the valuation is or will be performed (§ 226.42(d)(1)(i)).

NOTE: No person violates this section solely because that person is an 

employee or affiliate of the creditor, or provides a settlement service in 

addition to preparing valuations or performing valuation management 

functions, or based solely on the fact that the person’s affiliate performs 

another settlement service, as long as the conditions discussed below ((f), 

(g), and (h)) are met. If they are not met, whether the conflicts of interest 

provisions are violated by the above persons or entities depends on all of 

the facts and circumstances. In other words, the conditions in (f), (g), and 

(h) are a safe harbor, but not required.

[Click&type]

f. For any consumer credit transaction secured by the consumer’s principal 

dwelling in which the creditor had assets of more than $250 million as of 

December 31st for both of the past two calendar years, determine that a 

person subject to Section 226.42(d)(1)(i) who is employed by or affiliated 

with the creditor does not have a conflict of interest in violation of Section

226.42(d)(1)(i) based solely on the person’s employment or affiliate 

relationship with the creditor if (§ 226.42(d)(2)):

1. The compensation of the person preparing a valuation or performing 

valuation management functions is not based on the value arrived at 

in any valuation;
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 74

2. The person preparing a valuation or performing valuation 

management functions reports to a person who is not part of the 

creditor’s loan production function, as defined in Section

226.42(d)(5)(i), and whose compensation is not based on the closing 

of the transaction to which the valuation relates; and

3. No employee, officer or director in the creditor’s loan production 

function, as defined in Section 226.42 (d)(5)(i), is directly or 

indirectly involved in selecting, retaining, recommending or 

influencing the selection of the person to prepare a valuation or 

perform valuation management functions, or to be included in or 

excluded from a list of approved persons who prepare valuations or 

perform valuation management functions.

[Click&type]

g. For any covered transaction in which the creditor had assets of $250 

million or less as of December 31st for either of the past two calendar 

years, determine that a person subject to Section 226.42(d)(1)(i) who is 

employed by or affiliated with the creditor does not have a conflict of 

interest in violation of Section 226.42(d)(1)(i) based solely on the 

person’s employment or affiliate relationship with the creditor if (§

226.42(d)(3)):

1. The compensation of the person preparing a valuation or performing 

valuation management functions is not based on the value arrived at 

in any valuation; and

2. The creditor requires that any employee, officer or director of the 

creditor who orders, performs, or reviews a valuation for a covered 

transaction abstain from participating in any decision to approve, not 

approve, or set the terms of that transaction.

[Click&type]

h. For any covered transaction, determine that a person who prepares a 

valuation or performs valuation management functions in addition to 

performing another settlement service for the transaction, or whose 

affiliate performs another settlement service for the transaction, does not 

have a conflict of interest in violation of Section 226.42(d)(1)(i) as a 

result of the person or the person’s affiliate performing another settlement 

service for the transaction if (§ 226.42(d)(4)):

1. The creditor had assets of more than $250 million as of December 31st 

for both of the past two calendar years and the conditions in paragraph 

(d)(2)(i)-(iii) are met; or 

2. The creditor had assets of $250 million or less as of December 31st for 

either of the past two calendar years and the conditions in paragraph 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 75

(d)(3)(i)-(ii) are met. 

NOTE: A valuation materially misstates or misrepresents the value of the 

consumer’s principal dwelling if the valuation contains a misstatement 

or misrepresentation that affects the credit decision or the terms on 

which credit is offered.

[Click&type]

i. If the creditor did know at or before consummation of a violation of 

Sections 226.42(c) or (d) in connection with a valuation, determine that 

the creditor did not extend credit based on the valuation, unless the 

creditor documented that it acted with reasonable diligence to determine 

that the valuation did not materially misstate or misrepresent the value of 

the consumer’s principal dwelling (§ 226.42(e)).

NOTE: For purposes of § 226.42(e), a valuation materially misstates or 

misrepresents the value of the consumer’s principal dwelling if the 

valuation contains a misstatement or misrepresentation that affects the 

credit decision or the terms on which credit is extended.

[Click&type]

j. Customary and reasonable compensation. For any covered transaction, 

determine that the creditor and its agents compensated a fee appraiser for 

performing appraisal services at a rate that is customary and reasonable 

for comparable appraisal services performed in the geographic market of 

the property being appraised (§ 226.42(f)(1)).

NOTE: For purposes of § 226.42(f) “agents” of the creditor do not 

include any fee appraiser as defined in § 226.42(f)(4)(i). In most cases the 

“agent” will be an appraisal management company to which the creditor 

has outsourced the valuation function.

[Click&type]

k. If the creditor reasonably believes an appraiser has not complied with the 

Uniform Standards of Professional Appraisal Practice or ethical or 

professional requirements for appraisers under applicable state or federal 

statutes or regulations, determine that the creditor referred the matter 

within a reasonable period of time to the appropriate state agency if the 

failure to comply is material (§ 226.42(g)(1)).

NOTE: For purposes of § 226.42(g), a failure to comply is material if it is 

likely to significantly affect the value assigned to the consumer’s principal 

dwelling.

[Click&type]
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 76

Open-End Credit Transactional Testing Procedures

a. For each open-end credit product tested, determine the accuracy of the 

disclosures by comparing the disclosure with the contract and other 

financial institution documents (§ 226.5(c)).

[Click&type]

b. Review the financial institution’s policies, procedures, and practices to 

determine whether it provides appropriate disclosures for creditorinitiated direct mail applications and solicitations to open charge card 

accounts, telephone applications and solicitations to open charge card 

accounts, and applications and solicitations made available to the general 

public to open charge card accounts (§ 226.5a(b), (c), and (d)).

[Click&type]

c. Determine for all home equity plans with a variable rate that the APR is 

based on an independent index. Further, ensure home equity plans are 

terminated or terms changed only if certain conditions exist (§ 226.5b(f)).

[Click&type]

d. Determine that, if any consumer rejected a home equity plan because a 

disclosed term changed before the plan was opened, all fees were refunded. 

Verify that non-refundable fees were not imposed until three business days 

after the consumer received the required disclosures and brochure (§ 

226.5b(g) and (h)).

[Click&type]

e. Review consecutive periodic billing statements for each major type of 

open-end credit activity offered (overdraft and home-equity lines of 

credit, credit card programs, etc.). Determine whether disclosures were 

calculated accurately and are consistent with the initial disclosure 

statement furnished in connection with the accounts (or any subsequent 

change in terms notice) and the underlying contractual terms governing 

the plan(s).

[Click&type]

f. Determine whether the consumer was given notice of the right to reject 

the significant change, with the exception of:

1. An increase in the required minimum periodic payment,

2. A change in the APR, 

3. A change in the balance computation method necessary to comply 

with Section 226.54, which sets forth certain limitations on the 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 77

imposition of finance charges as a result of a loss of a grace period, 

or

4. When the change results from the creditor not receiving the required 

minimum periodic payment within 60 days after the due date for that 

payment (§ 226.9(c)(2)(iv)(B)).

[Click&type]

g. Determine that the creditor did not increase the rate applicable to the 

consumer’s account to the penalty rate if the outstanding balance did not 

exceed the credit limit on the date set forth in the notice (§ 226.9(g)).

[Click&type]

h. Determine, for each type of open-end rescindable loan being tested, the 

appropriate number of copies of the rescission notice are provided to each 

person whose ownership interest is or will be subject to the security 

interest and perform the procedures 12, 13, and 14 under Closed-End 

Credit Section (§ 226.15(b), (c) and (e)).

[Click&type]

i. Additional variable rate testing - Verify that when accounts were opened 

or loans were consummated that loan contract terms were recorded 

correctly in the financial institution’s calculation systems (e.g., its 

computer). Determine the accuracy of the following recorded information: 

1. Index value, 

2. Margin and method of calculating rate changes, 

3. Rounding method, and 

4. Adjustment caps (periodic and lifetime).

j. Using a sample of periodic disclosures for open-end variable rate accounts 

(e.g., home equity accounts) and closed-end rate change notices for

adjustable rate mortgage loans: 

1. Compare the rate-change date and rate on the credit obligation to the 

actual rate-change date and rate imposed. 

2. Determine that the index disclosed and imposed is based on the 

terms of the contract (example: the weekly average of one-year 

Treasury constant maturities, taken as of 45 days before the change 

date) (§§ 226.7(g) and 226.20(c)(2)).

3. Determine that the new interest rate is correctly disclosed by adding 

the correct index value with the margin stated in the note, plus or 

minus any contractual fractional adjustment (§§ 226.7(g) and 226.20 

(c)(1)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 78

4. Determine that the new payment disclosed (§ 226.20(c)(4)) was 

based on an interest rate and loan balance in effect at least 25 days 

before the payment change date (consistent with the contract) (§

226.20(c)).

[Click&type]

Section 226.10 - Crediting a Consumer’s Account 

a. Ensure that the creditor credits payment to a consumer’s account as of the 

date of receipt, except when a delay in crediting does not result in a 

finance charge or other charge (§ 226.10(a)).

[Click&type]

b. If a creditor specifies requirements for payments, determine that they are 

reasonable and allow most consumers to make conforming payments (§ 

226.10(b)).

[Click&type]

c. If a creditor specifies, on or with the periodic statement, requirements for 

the consumer to follow in making payments, but accepts a payment that 

does not conform to the requirements, determine that the payment is 

credited within five days of receipt (§ 226.10(b)(4)).

[Click&type]

d. If the creditor sets a cut-off time for payments to be received by mail, by 

electronic means, by telephone, or in person, verify that the cut-off time is 

5 p.m. or later on the payment due date at the location specified by the 

creditor for the receipt of such payments (§ 226.10(b)(2)(ii)).

[Click&type]

e. For in-person payments on a credit card account under an open-end (not 

home-secured) consumer credit plan at a financial institution branch or 

office that accepts such payments, a card issuer shall not impose a cut-off 

time earlier than the close of business for any such payments made in 

person at any branch or office of the card issuer at which such payments 

are accepted. However, a card issuer may impose a cut-off time earlier 

than 5 p.m. for such payments, if the close of business of the branch or 

office is earlier than 5 p.m. (§ 226.10(b)(3)(i)).

[Click&type]

f. If a creditor fails to credit a payment as required and imposes a finance or 

other charge, ensure that the creditor credits the charge(s) to the 

consumer’s account during the next billing cycle (§ 226.10(c)). 

[Click&type]

g. If (due to a weekend or holiday, for example) a creditor does not receive 

or accept payments by mail on the due date for payments, determine that 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 79

the creditor treats as timely a payment received on the next business day 

(§ 226.10(d)(1)).

[Click&type]

NOTE: If a creditor accepts or receives payments made on the due date by 

a method other than mail, such as electronic or telephone payments, the 

creditor is not required to treat a payment made by that method on the 

next business day as timely.

h. For credit card accounts under an open-end (not home-secured) consumer 

credit plan, determine that the creditor does not impose a separate fee to 

allow consumers to make a payment by any method, such as mail, 

electronic, or telephone payments, unless such payment method involves 

an expedited service by a customer service representative of the creditor 

(§ 226.10(e)).

[Click&type]

i. If a card issuer makes a material change in the address for receiving 

payments or procedures for handling payments, and such change causes a 

material delay in the crediting of a payment to a consumer’s account 

during the 60-day period following the date on which such change took 

effect, ensure that the card issuer does not impose any late fee or finance 

charge for a late payment on the credit card account during the 60-day 

period following the date on which the change took effect (§ 226.10(f)).

[Click&type]

Section 226.11 - Treatment of Credit Balances, 

Account Termination 

a. Determine the institution’s treatment of credit balances. Specifically, if 

the account’s credit balance is in excess of $1, the institution must take 

the actions below (§ 226.11):

1. Credit the amount to the consumer’s account; and

2. Either: 

i. Refund any part of the remaining credit balance within seven 

business days from receiving a written request from the 

consumer; or 

ii. If no written request is received and the credit remains for 

more than six months, make a good faith effort to refund the 

amount of the credit to the consumer by cash, check, money 

order, or credit to a deposit account of the consumer if the 

credit remains for more than six months. No further action is 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 80

required if the consumer’s current location is not known to the 

creditor and cannot be traced through the consumer’s last 

known address or telephone number.

[Click&type]

b. Determine that institution has not terminated an account prior to its 

expiration date solely because the consumer did not incur a finance 

charge. However, a creditor is not prohibited from closing an account 

that, for three consecutive months, no credit has been extended (such as 

by purchase, cash advance, or balance transfer) and the account has had 

no outstanding balance (§ 226.11(b)).

[Click&type]

c. Determine that, for credit card accounts under an open-end (not homesecured) consumer credit plan, the card issuer has adopted reasonable 

written policies and procedures designed to ensure that an administrator 

of an estate of a deceased account holder can determine the amount of 

and pay any balance on the account in a timely manner (§

226.11(c)(1)(i)).

NOTE: This does not apply to the account of a deceased consumer if a 

joint account holder remains on the account.

[Click&type]

d. Ensure that, upon request by the administrator of an estate, the card 

issuer provides the administrator with the amount of the balance on a 

deceased consumer’s account in a timely manner (§ 226.11(c)(2)(i)).

NOTE: Providing the amount of the balance on the account within 30 

days of receiving the request is deemed to be timely.

[Click&type]

e. Verify that, after receiving a request from the administrator of an estate 

for the amount of the balance on a deceased consumer’s account, the card 

issuer does not impose any fees on the account (such as a late fee, annual 

fee, or over the-limit fee) or increase any annual percentage rate, except 

as provided by Section 226.55(b)(2) (e.g., due to the operation of an 

index) (§ 226.11(c)(3)(i)).

[Click&type]

f. Determine that, if payment in full of the disclosed balance, pursuant to 

paragraph 226.11(c)(2), is received within 30 days after disclosure, the 

card issuer waives or rebates any additional finance charge due to a 

periodic interest rate (§ 226.11(c)(3)(ii)).
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 81

[Click&type]

Sections 226.12 and 13 - Special Credit Card 

Provisions and Billing Error Resolution 

a. Repayment disclosures. Review a sample of billing error resolution files 

and a sample of consumers who have asserted a claim or defense against 

the financial institution for a credit card dispute regarding property or 

services. Verify the following (§§ 226.12 and 226.13)).

1. Credit cards are issued only upon request;

2. Liability for unauthorized credit card use is limited to $50; 

3. Disputed amounts are not reported delinquent unless remaining 

unpaid after the dispute has been settled; 

4. Offsetting credit card indebtedness is prohibited; and 

5. Errors are resolved within two complete billing cycles.

Section 226.51 - Ability to Make the Required 

Minimum Payments 

a. Determine that the card issuer does not open a credit card account for a 

consumer under an open-end (not home-secured) consumer credit plan, 

or increase any credit limit applicable to such account, unless the card 

issuer considers the ability of the consumer to make the required 

minimum periodic payments under the terms of the account based on the 

consumer’s income or assets and current obligations (§ 226.51(a)(1)(i)).

[Click&type]

b. Verify that the card issuer establishes and maintains reasonable written 

policies and procedures to consider a consumer’s income or assets and 

current obligations. Reasonable policies and procedures to consider a 

consumer’s ability to make the required payments include a consideration 

of at least one of the following: 

1. The ratio of debt obligations to income; 

2. The ratio of debt obligations to assets; or

3. The income the consumer will have after paying debt obligations.

[Click&type]

c. Confirm that the card issuer does not issue a credit card to a consumer 

who does not have any income or assets, and that the creditor does not 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 82

issue a credit card without reviewing any information about a consumer’s 

income, assets, or current obligations (§ 226.51(a)(1)(ii)). 

(Note that a card issuer may consider the consumer’s income or assets 

based on information provided by the consumer, in connection with the 

credit card account or any other financial relationship the card issuer or 

its affiliates has with the consumer, subject to any applicable 

information-sharing rules, and information obtained through third parties, 

subject to any applicable information-sharing rules. A card issuer may 

also consider information obtained through any empirically derived, 

demonstrably and statistically sound model that reasonably estimates a 

consumer’s income or assets. See Regulation Z Commentary, 

§ 226.51(a)(1-4)).

[Click&type]

d. Determine that the card issuer uses a reasonable method for estimating 

the minimum periodic payments the consumer would be required to pay 

under the terms of the account (§ 226.51(a)(2)(i)).

[Click&type]

e. A card issuer’s estimate of the minimum periodic payment is compliant 

(i.e., receives the benefit of a safe harbor) if it uses the following method 

§ 226.51(a)(2)(ii)):

1. The card issuer assumes utilization, from the first day of the billing 

cycle, of the full credit line that the issuer is considering offering to 

the consumer; and

2. The card issuer uses a minimum payment formula employed by the 

issuer for the product the issuer is considering offering to the 

consumer or, in the case of an existing account, the minimum 

payment formula that currently applies to that account, provided that:

i. If the applicable minimum payment formula includes interest 

charges, the card issuer estimates those charges using an interest 

rate that the issuer is considering offering to the consumer for 

purchases or, in the case of an existing account, the interest rate 

that currently applies to purchases; and

ii. If the applicable minimum payment formula includes mandatory 

fees, the card issuer must assume that such fees have been 

charged to the account.

[Click&type]

f. Rules affecting young consumers - if the card issuer opens a credit card 

account under an open-end (not home-secured) consumer credit plan for 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 83

a consumer less than 21 years old, verify that the issuer requires that such 

consumers:

1. Submit a written application; and

2. Possess an independent ability to make the required minimum 

periodic payments on the proposed extension of credit in connection 

with the account under Section 226.51(b)(1)(i) or provide a signed 

agreement of a cosigner, guarantor, or joint applicant who is at least 

21 years old and who has the ability to make the required minimum 

periodic payments on such debts, to be either jointly or secondarily 

liable for any debt on the account incurred by the consumer before 

the consumer has attained the age of 21 pursuant to 

Section 226.51(b)(1)(ii)(A) and (B).

[Click&type]

g. If a credit card account has been opened for a consumer less than 21 

years old with a cosigner, guarantor, or joint applicant pursuant to 

Section 226.51(b)(1)(ii), determine that the issuer does not increase the 

credit limit on such account before the consumer attains the age of 21 

unless the cosigner, guarantor, or joint accountholder who assumed 

liability at account opening agrees in writing to assume liability on the 

increase (§ 226.51(b)(2)).

Section 226.52 - Fees Charged During the First 

Year of a Credit Card Account and Limitations on 

Fees

a. During the first year after the opening of a credit card account under an 

open-end (not home-secured) consumer credit plan, determine whether 

the card issuer required the consumer to pay covered fees in excess of the 

25 percent of the credit limit at the time of the account opening (§ 

226.52(a)).

Covered fees include fees: 

1. For the issuance or availability of credit, including any fees based on 

account activity or inactivity;

2. For insurance, debt cancellation or debt suspension, if the insurance 

or debt cancellation or suspension is required by the terms of the 

account;

3. The consumer is required to pay to engage in transactions using the 

account, such as:
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 84

i. Cash advance fees;

ii. Balance transfer fees;

iii. Foreign transaction fees;

iv. Fees for using the account for purchases; and

v. Fees the consumer is required to pay for violating the terms of the 

account, except to the extent they are specifically excluded (see 

below).

[Click&type]

b. Fees not covered by this limitation include: 

1. Late payment fees, over-the-limit fees, and returned-payment fees; 

or

2. Fees that the consumer is not required to pay with respect to the 

account, such as:

i. An expedited payment fee; 

ii. Fees for optional services like travel insurance; 

iii. Fees for reissuing a lost or stolen card; or 

iv. Statement reproduction fees.

[Click&type]

c. Review penetration rates of various optional services to determine if they 

are truly optional and therefore not covered by the 25 percent limitation.

[Click&type]

d. Ensure that the card issuer does not impose a fee for violating the terms 

or other requirements of a credit card account under an open-end (not 

home-secured) consumer credit plan unless the dollar amount of the fee 

is consistent with §§ 226.52(b)(1) and (b)(2) (§ 226.52(b)).

[Click&type]

e. Determine that a card issuer imposes a fee for violating the terms or other 

requirements of a credit card account under an open-end (not homesecured) consumer credit plan only if the dollar amount of the fee is 

consistent with either Sections 226.52(b)(1)(i) or 226.52(b)(1)(ii) (§

226.52(b)(1)).

[Click&type]

f. Cost determination. A card issuer may impose a fee for a particular 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 85

violation (e.g., late payment) if the card issuer has determined that the fee 

represents a reasonable proportion of the total costs incurred by the issuer 

as a result of that type of violation. If a card issuer is relying on a cost 

determination instead of the safe harbors (see below), review (§

226.52(b)(1)(i)):

1. The number of violations of a particular type experienced by the card 

issuer during a prior period of reasonable length (e.g., a 12-month 

period).

2. The costs incurred by the card issuer during that period as a result of 

those violations. Losses and associated costs (including the cost of 

holding reserves against potential losses and the cost of funding 

delinquent accounts) must be excluded from this analysis.

3. If used by the card issuer when making its determination:

i. The number of fees imposed by the card issuer as a result of the 

type of violation during the period that the issuer reasonably 

estimates it will be unable to collect.

ii. Reasonable estimates for an upcoming period of changes in the 

number of violations of the relevant type, the resulting costs, and 

the number of fees that the card issuer will be unable to collect.

4. If applicable, whether the items in paragraph 1-3 have been 

reevaluated by the card issuer at least once during the prior 

12 months. If as a result of the reevaluation the card issuer determines 

that a lower fee represents a reasonable proportion of the total costs 

incurred by the card issuer as a result of that type of violation, 

determine that the card issuer begins imposing the lower fee within 

45 days after completing the reevaluation. 

NOTE: If as a result of the reevaluation the card issuer determines 

that a higher fee represents a reasonable proportion of the total costs 

incurred by the card issuer as a result of that type of violation, the 

card issuer may begin imposing the higher fee after complying with 

the notice requirements in § 226.9 (§ 226.52(b)(1)(i)).

[Click&type]

g. Safe harbors. A card issuer may impose a fee for violating the terms or 

other requirements of the account if the dollar amount of the fee does not 

exceed (§ 226.52(b)(1)(ii) (A) - (C)): 

1. For the first violation of a particular type, $25.00;

2. For an additional violation of the same type during the next six 

billing cycles, $35.00; or
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 86

3. When a card issuer has not received the required payment for two or 

more consecutive billing cycles for a charge card account that 

requires payment of outstanding balances in full at the end of each 

billing cycle, three percent of the delinquent balance.

NOTE: The dollar amounts in paragraphs 1 and 2 above will be 

adjusted annually by the Board to the extent that changes in the 

Consumer Price Index warrant an increase or decrease of a whole 

dollar.

[Click&type]

h. Determine that the card issuer does not impose a fee for violating the 

terms or other requirements of a credit card account under an open-end 

(not home-secured) consumer credit plan that exceeds the dollar amount 

associated with the violation Section 226.52(b)(2)(i)(A).

[Click&type]

i. Determine that a card issuer does not impose a fee for violating the terms 

or other requirements of a credit card account under an open end (not 

home-secured) consumer credit plan when there is no dollar amount 

associated with the violation. For purposes of Section 226.52(b)(2)(i), 

there is no dollar amount associated with the following violations (§

226.52(b)(2)(i)(B)):

1. Transactions that the card issuer declines to authorize;

2. Account inactivity; and

3. The closure or termination of an account.

[Click&type]

j. Determine that the card issuer does not impose more than one fee for 

violating the terms or other requirements of a credit card account under 

an open-end (not home-secured) consumer credit plan based on a single 

event or transaction (§ 226.52(b)(2)(ii)).

[Click&type]

Section 226.53 - Allocation of Credit Card 

Payments in Excess of the Minimum 

a. Determine whether, when a consumer makes a payment in excess of the 

required minimum periodic payment, the card issuer allocates the excess 

amount:

1. First to the balance with the highest annual percentage rate; then
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 87

2. Any remaining portion to the other balances in descending order 

based on the applicable annual percentage rate.

[Click&type]

b. For balances on a credit card account subject to a deferred interest or 

similar program, determine whether the card issuer allocated any amount 

paid by the consumer in excess of the required minimum periodic 

payment: 

1. Consistent with the general requirement discussed in (a) above, 

except that, during the two billing cycles immediately preceding 

expiration of the deferred interest period, the excess amount must 

have been allocated first to the balance subject to the deferred 

interest or similar program and any remaining portion allocated to 

any other balances; or

2. In the manner requested by the consumer.

[Click&type]

Section 226.54 - Loss of a Grace Period 

a. Determine whether the card issuer imposed finance charges as a result of 

the loss of a grace period on a credit card account under an open-end (not 

home-secured) consumer credit plan based on:

1. Balances for days in billing cycles that precede the most recent 

billing cycle, a prohibited practice; or

2. Any portion of a balance subject to a grace period that was repaid 

prior to the expiration of the grace period (§ 226.54).

[Click&type]

b. With respect to the prohibition in a.2 above, issuers are not required to 

follow any specific methodology, but an issuer is in compliance if it 

applies the consumer’s payment to the balance subject to the grace period 

and calculates interest charges on the amount of the balance that remains 

unpaid. 

Exceptions: This rule does not apply to adjustments to the finance charge 

as a result of:

1. The resolution of a dispute under Section 226.12, unauthorized use, 

or Section 226.13, billing error; or

2. The return of a payment.

[Click&type]
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 88

Section 226.55 - Limitations on Increasing Annual 

Percentage Rates, Fees, and Charges 

a. With respect to a credit card account under an open-end (not homesecured) consumer credit plan, determine that the card issuer did not 

increase an APR or fee or charge required to be disclosed under Section

226.6(b)(2)(ii) (fee for issuance or availability (e.g., an annual fee)), 

(b)(2)(iii) (fixed finance charge or minimum interest charge), or 

(b)(2)(xii) (fee for required insurance, debt cancellation, or debt 

suspension coverage), unless as permitted by one of the six exceptions:

1. Temporary rate exception;

2. Variable rate exception;

3. Advance notice exception;

4. Delinquency exception;

5. Workout and temporary hardship arrangement; and

6. Servicemembers Civil Relief Act exception (§ 226.55(a)-(b)).

[Click&type]

b. To assess whether the temporary rate exception applies (§ 226.55(b)(1)), 

determine whether:

1. The card issuer increased the APR upon the expiration of a specified 

period of six months or longer; and

2. Prior to the commencement of that period, the card issuer disclosed 

in writing to the consumer, in a clear and conspicuous manner, the 

length of the period and the annual percentage rate that would apply 

after expiration of the period.

[Click&type]

c. If the temporary rate exception applies, determine that the card issuer:

1. Did not apply an APR to transactions that occurred prior to the 

period that exceeds the APR that applied to those transactions prior 

to the period;

2. Provided the required notice, but did not apply an APR (to 

transactions that occurred within 14 days after provision of the 

notice) that exceeds the APR that applied to that category of 

transactions prior to provision of the notice; and

3. Did not apply an annual percentage rate to transactions that 

occurred during the period that exceeds the increased annual 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 89

percentage rate.

[Click&type]

d. If the variable rate exception applies (§ 226.55(b)(2)), determine that the 

card issuer did not increase an annual percentage rate unless:

1. The increase in the annual percentage rate is due to an increase in 

the index; and

2. The annual percentage rate varies according to an index that is not 

under the card issuer’s control and is available to the general public. 

NOTE: For purposes of qualifying under this exception, an index is 

under the card issuer’s control if the card issuer applies a minimum 

rate or floor below which the rate cannot decrease. A maximum rate 

or ceiling set by the issuer would qualify for this exception.

[Click&type]

e. If the advance notice exception applies (§ 226.55(b)(3), determine that 

the card issuer:

1. Did not apply that increased APR, fee, or charge to transactions that 

occurred prior to provision of the notice;

2. Did not apply that increased APR, fee, or charge to transactions that 

occurred prior to or within 14 days after provision of the notice; and

3. Did not increase the APR, fee, or charge during the first year after 

the account is opened.

[Click&type]

f. If the delinquency exception applies (§ 226.55(b)(4)), determine that the 

card issuer:

1. Disclosed in a clear and conspicuous manner in the required notice 

a statement of the reason for the increase, and

2. Will cease the increase if the card issuer receives six consecutive 

required minimum periodic payments on or before the payment due 

date, beginning with the first payment due following the effective 

date of the increase.

[Click&type]

g. If the delinquency exception applies and the card issuer received six 

consecutive required minimum periodic payments on or before the 

payment due date beginning with the first payment due following the 

effective date of the increase, determine that the card issuer reduces any 

APR, fee, or charge (increased pursuant to the delinquency exception) to 

the original APR, fee, or charge that applied prior to the increase with 

respect to transactions that occurred prior to or within 14 days after 

provision of the required notice.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 90

[Click&type]

h. If the workout and temporary hardship arrangement exception applies 

(§ 226.55(b)(5), determine that:

1. Prior to commencement of the arrangement (except as provided in 

§ 226.9(c)(2)(v)(D)) the card issuer provided the consumer with a 

clear and conspicuous written disclosure of the terms of the 

arrangement (including any increases due to the completion or 

failure of the arrangement); and

2. Upon the completion or failure of the arrangement, the card issuer 

did not apply to any transactions that occurred prior to 

commencement of the arrangement an APR, fee, or charge that 

exceeds the APR, fee, or charge that applied to those transactions 

prior to commencement of the arrangement.

[Click&type]

i. If the Servicemembers Civil Relief Act exception applies (§ 

226.55(b)(6)), determine that the card issuer increased the APR only 

after 50 USC app. 527 no longer applied. Further, determine that the 

issuer did not apply to any transactions that occurred prior to the 

decrease an APR that exceeded the APR that applied to those 

transactions prior to the decrease.

[Click&type]

j. For protected balances (§ 226.55(c)), determine that the card issuer did 

not require repayment using a method that is less beneficial to the 

consumer than one of the following methods:

1. The method of repayment for the account before the effective date 

of the increase;

2. An amortization period of not less than five years, beginning no 

earlier than the effective date of the increase; or

3. A required minimum periodic payment that includes a percentage of 

the balance that is equal to no more than twice the percentage 

required before the effective date of the increase.

[Click&type]

Section 226.56 - Requirements for Over-the-Limit 

Transactions 

a. Determine that, if two or more consumers are jointly liable on a credit 

card account under an open-end (not home-secured) consumer credit 

plan, the card issuer treats the affirmative consent of any of the joint 

consumers as affirmative consent for that account. Similarly, determine 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 91

that the card issuer treats a revocation of consent by any of the joint 

consumers as revocation of consent for that account (§ 226.56(f)).

[Click&type]

b. Notwithstanding a consumer’s affirmative consent to a card issuer’s 

payment of over-the-limit transactions, determine that the card issuer 

does not (§ 226.56(j)):

1. Impose more than one over-the-limit fee or charge on a consumer’s 

credit card account per billing cycle, and, in any event, only if the 

credit limit was exceeded during the billing cycle. In addition, the 

card issuer may not impose an over-the-limit fee or charge on the 

consumer’s credit card account for more than three billing cycles for 

the same over-the-limit transaction where the consumer has not 

reduced the account balance below the credit limit by the payment 

due date for either of the last two billing cycles.

2. Impose an over-the-limit fee or charge solely because of the card 

issuer’s failure to promptly replenish the consumer’s available credit 

following the crediting of the consumer’s payment.

3. Condition the amount of a consumer’s credit limit on the consumer 

affirmatively consenting to the card issuer’s payment of over-thelimit transactions if the card issuer assesses a fee or charge for such 

service.

4. Impose an over-the-limit fee or charge for a billing cycle if a 

consumer exceeds a credit limit solely because of fees or interest 

charged by the card issuer to the consumer's account during that 

billing cycle. For purposes of this paragraph, the relevant fees or 

interest charges are charges imposed as part of the plan under 

Section 226.6(b)(3).

[Click&type]

Section 226.59 - Re-evaluation of Rate Increases 

a. If a card issuer increases an APR that applies to a credit card account 

under an open-end (not home-secured) consumer credit plan, based on 

the credit risk of the consumer, market conditions, or other factors, or 

increased such a rate on or after January 1, 2009, and 45 days’ advance 

notice of the rate increase is required pursuant to Section 226.9(c)(2) or 

(g), determine that the card issuer (§ 226.59(a)(1)):

1. Evaluates the factors described in Section 226.59(d); and

2. Based on its review of such factors, reduces the APR applicable to 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 92

the consumer’s account, as appropriate.

[Click&type]

b. If a card issuer is required to reduce the rate applicable to an account 

pursuant to Section 226.59(a)(1), determine that the card issuer reduces 

the rate not later than 45 days after completion of the evaluation 

described in Section 226.59(a)(1) (§ 226.59(a)(2)(i)).

NOTE: Any reduction in an APR required pursuant to Section

226.59(a)(1) of this section shall apply to (§ 226.59(a)(2)(ii)):

1. Any outstanding balances to which the increased rate described in 

Section 226.59(a)(1) has been applied; and

2. New transactions that occur after the effective date of the rate 

reduction that would otherwise have been subject to the increased 

rate.

[Click&type]

c. Determine that the card issuer has reasonable written policies and 

procedures in place to conduct the review described in Section 226.59(a) 

(§ 226.59(b)).

[Click&type]

d. Determine that a card issuer that is subject to Section 226.59(a) conducts 

the review described in Section 226.59(a)(1) not less frequently than 

once every six months after the rate increase (§ 226.59(c)).

[Click&type]

e. Except as provided in Section 226.59(d)(2), determine that the card 

issuer reviews either (§ 226.59(d)(1)):

1. The factors on which the increase in an APR was originally based; or

2. The factors that the card issuer currently considers when determining 

the APRs applicable to similar new credit card accounts under an 

open-end (not home-secured) consumer credit plan.

[Click&type]

f. For rate increases imposed between January 1, 2009, and February 21, 

2010, determine that an issuer considers the factors described in Section

226.59(d)(1)(ii) when conducting the first two reviews required under 

Section 226.59(a), unless the rate increase subject to Section 226.59(a) 

was based solely upon factors specific to the consumer, such as a decline 

in the consumer’s credit risk, the consumer’s delinquency or default, or a 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 93

violation of the terms of the account (§ 226.59(d)(2)).

[Click&type]

g. If an issuer increases a rate applicable to a consumer’s account pursuant 

to Section 226.55(b)(4) based on the card issuer not receiving the 

consumer’s required minimum periodic payment within 60 days after the 

due date, note that the issuer is not required to perform the review 

described in Section 226.59(a) prior to the sixth payment due date after 

the effective date of the increase. However, if the APR applicable to the 

consumer’s account is not reduced pursuant to Section 226.55(b)(4)(ii), 

determine that the card issuer performs the review described in 

Section 226.59(a). Determine that the first such review occurs no later 

than six months after the sixth payment due following the effective date 

of the rate increase (§ 226.59(e)).

[Click&type]

h. The obligation to review factors described in Sections 226.59(a) and (d) 

ceases to apply (§ 226.59(f)):

1. If the issuer reduces the APR applicable to a credit card account 

under an open-end (not home-secured) consumer credit plan to the 

rate applicable immediately prior to the increase, or, if the rate 

applicable immediately prior to the increase was a variable rate, to a 

variable rate determined by the same formula (index and margin) that 

was used to calculate the rate applicable immediately prior to the 

increase; or

2. If the issuer reduces the APR to a rate that is lower than the rate 

described in Section 226.59(f)(1) of this section.

[Click&type]

i. Except as provided in Section 226.59(g)(2), Section 226.59 applies to 

credit card accounts that have been acquired by the card issuer from 

another card issuer (§ 226.59(g)).

[Click&type]

j. Determine that a card issuer that complies with this section by reviewing 

the factors described in Section 226.59(d)(1)(i) reviews the factors 

considered by the card issuer from which it acquired the accounts in 

connection with the rate increase (§ 226.59(g)(1)).

[Click&type]

k. If, not later than six months after the acquisition of such accounts, a card 

issuer reviews all of the credit card accounts it acquires in accordance 
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 94

with the factors that it currently considers in determining the rates 

applicable to its similar new credit card accounts (§ 226.59(g)(2)):

1. Except as provided in Section 226.59(g)(2)(iii), determine that the 

card issuer conducts reviews described in Section 226.59(a) of this 

section for rate increases that are imposed as a result of its review 

under this paragraph. 

2. Except as provided in Section 226.59(g)(2)(iii), note that the card 

issuer is not required to conduct reviews in accordance with Section

226.59(a) of this section for any rate increases made prior to the card 

issuer’s acquisition of such accounts. 

3. NOTE: If as a result of the card issuer’s review, an account is subject 

to, or continues to be subject to, an increased rate as a penalty, or due 

to the consumer’s delinquency or default, the requirements of § 

226.59(a) of this section apply.

l. Servicemembers Civil Relief Act exception: Note that the requirements 

of Section 226.59 do not apply to increases in an APR that was 

previously decreased pursuant to the Servicemembers Civil Relief Act 

(50 USC app. 527), provided that such a rate increase is made in 

accordance with Section 226.55(b)(6) (§ 226.59(h)(1)).

[Click&type]

m. Charged off accounts exception: Note that the requirements of Section

226.59 do not apply to accounts that the card issuer has charged off in 

accordance with loan-loss provisions (§ 226.59(h)(2)).

[Click&type]

NOTE: Appendix G to part 226 is amended by revising Forms G-10(B), 

G-10(C), G- 10(E), G-17(B), G-17(C), G-18(B), G-18(D), G-18(F), G18(G), G-20, G-21, G-22, G- 25(A), and G-25(B).

Administrative Enforcement

a. If there is noncompliance involving understated finance charges or 

understated APRs subject to reimbursement under the FFIEC Policy Guide 

on Reimbursement (policy guide):

1. Document the date on which the administrative enforcement of the TILA 

policy statement would apply for reimbursement purposes by 

determining the date of the preceding examination.

2. If the noncompliance involves indirect (third-party paper) disclosure 

errors and affected consumers have not been reimbursed.

3. Prepare comments, discussing the need for improved internal controls to 

be included in the report of examination.

4. Notify your supervisory office for follow up with the regulator that has 

primary responsibility for the original creditor.
CFPB

Examination Procedures TILA

CFPB Examination Procedures FFIEC Rev. 5/2011 TILA 95

If the noncompliance involves direct credit:

a. Make an initial determination whether the violation is a pattern or 

practice.

b. Calculate the reimbursement for the loans or accounts in an expanded 

sample of the identified population.

c. Estimate the total impact on the population based on the expanded 

sample.

d. Inform management that reimbursement may be necessary under the law 

and the policy guide, and discuss all substantive facts including the 

sample loans and calculations.

e. Inform management of the financial institution’s options under Section

130 of the TILA for avoiding civil liability and of its option under the 

policy guide and Section 108 (e)(6) of the TILA for avoiding a regulatory 

agency’s order to reimburse affected borrowers.

[Click&type]

Program Conclusions

1. Summarize the findings, supervisory concerns and regulatory violations. 

[Click&type]

2. For the violations noted, determine the root cause by identifying weaknesses 

in internal controls, audit and compliance reviews, training, management 

oversight, or other factors. Determine whether the violation(s) are repetitive 

or systemic. 

[Click&type]

3. Identify action needed to correct violations and weaknesses in the 

institution’s compliance system. 

[Click&type]

4. Discuss findings with the institution’s management and, if necessary, obtain 

a commitment for corrective action. 

[Click&type]

5. Record violations according to agency policy in the EDS/ROE system to 

facilitate analysis and reporting. 

[Click&type]

Examiner’s Summary, Recommendations, and 

Comments 

[Click&type]
CFPB Appendix A

Consumer Laws and Regulations TILA

CFPB FFIEC 5/2011 TILA – Appendix A 1

Truth in Lending Act

HIGH-COST MORTGAGE (§226.32) WORKSHEET

Borrower’s 

Name

Loan Number

COVERAGE

Yes No

Is the loan secured by the consumer’s principal dwelling?

[§226.2(a)(19), §226.32(a)(1)]

If the answer is No, STOP HERE 

Is the loan for the following purpose?

 1. Residential Mortgage Transaction – [§226.2(a)(24)]

 2. Reverse Mortgage Transaction – [§226.33]

 3. Open-End Credit Plan – Subpart B 

 [note prohibition against structuring loans as open-end

 plans to evade §226.32 – [§226.34(b)]

If the answer is Yes to Box 1, 2, or 3, STOP HERE. If No, continue to Test 1.

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB Appendix A

Consumer Laws and Regulations TILA

CFPB FFIEC 5/2011 TILA – Appendix A 2

TEST 1 – CALCULATION OF APR

A. Disclosed APR

B. Treasury Security Yield of Comparable Maturity

Obtain the Treasury Constant Maturities Yield from the FRB’s Statistical 

Release, H-15 – Selected Interest Rates (the “Business” links will display daily 

yields). Use the yield that has the most comparable maturity to the loan term 

and is from the 15th day of the month that immediately precedes the month of 

the application. If the 15th is not a business day, use the yield for the business 

day immediately preceding the 15th. If the loan term is exactly halfway 

between two published security maturities, use the lower of the two yields.) 

Note: Creditors may use the FRB’s Selected Interest Rates or the actual 

auction results. See Staff Commentary to Regulation Z for further details. 

[§226.32(a)(1)(i)]

http://www.federalreserve.gov/releases/H15/data.htm

C. Treasury Security Yield of Comparable Maturity (Box B)

Plus: 8 percentage points for first-lien loan; or 

 10 percentage points for subordinate-lien loan

Yes No

D. Is Box A greater than Box C?

If Yes, the transaction is a High-Cost Mortgage. If No, continue to Test 2, Points and Fees.
CFPB Appendix A

Consumer Laws and Regulations TILA

CFPB FFIEC 5/2011 TILA – Appendix A 3

HIGH-COST MORTGAGE (§226.32) WORKSHEET

TEST 2 – CALCULATION OF POINTS AND FEES

STEP 1: Identify all Charges Paid by the Consumer at or before Loan Closing

A. Finance Charges – §226.4(a) and (b) (Interest, including per-diem interest, and time price differential 

are excluded from these amounts.)

Fee Subtotals

 Loan Points

 Mortgage Broker Fee

 Loan Service Fees

 Required Closing Agent/Third-Party Fees

 Required Credit Insurance

 Private Mortgage Insurance

 Life of Loan Charges (flood, taxes, etc.)

 Any Other Fees Considered Finance Charges

 Subtotal

B. Certain Non-Finance Charges Under §226.4(c)(7) – Include fees paid by consumers only if the amount 

of the fee is unreasonable or if the creditor receives direct or indirect compensation from the charge or the 

charge is paid to an affiliate of the bank. (See the example in §226.32(b)(1)(ii) of the commentary for further 

explanation.)

 Title Examination

 Title Insurance

 Property Survey

 Document Preparation Charge

 Credit Report

 Appraisal

 Fee for “Initial” Flood Hazard Determination 

 Pest Inspection

 Any Other Fees Not Considered Finance Charges

 Subtotal

C. Premiums or Other Charges for Optional Credit Life, Accident, 

Health, or Loss-of-Income Insurance, or Debt-Cancellation Coverage

D. Total Points & Fees: Add Subtotals for A, B, C 

HIGH-COST MORTGAGE (§226.32) WORKSHEET

TEST 2 – CALCULATION OF POINTS AND FEES (continued)
CFPB Appendix A

Consumer Laws and Regulations TILA

CFPB FFIEC 5/2011 TILA – Appendix A 4

STEP 2: Determine the Total Loan Amount for Cost Calculation [226.32(a)(1)(ii)]

A. Determine the Amount Financed [§226.18(b)]

 Principal Loan Amount

 Plus: Other Amounts Financed by the Lender (not

 already included in the principal and not part of the

 finance charge)

 Less: Prepaid Finance Charges [§226.2(a)(23)]

 Equals: Amount Financed

B. Deduct costs included in the points and fees under 

§226.32(b)(1)(iii) and (iv) (Step 1, Box B and Box C) that are 

financed by the creditor

C. Total Loan Amount (Step 2, Box A minus Box B)

TEST 2 – CALCULATION OF POINTS AND FEES (continued)

STEP 3: Perform High-Fee Cost Calculation

A. Eight Percent of the Total Loan Amount (Step 2, Box C)

B. Annual Adjustment Amount – [§226.32(a)(1)(ii)]

2010: $579

(use the dollar amount corresponding to the year of the loan’s 

origination)

C. Total Points & Fees (Step 1, Box D)

Yes No

In Step 3, does Box C exceed the greater of Box A or Box B?

If Yes, the transaction is a High-Cost Mortgage. If No, the transaction is not a High-Cost 

Mortgage under Test 2, Points and Fees.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 1

Real Estate Settlement Procedures Act

The Real Estate Settlement Procedures Act of 1974 (RESPA) (12 USC § 2601 et seq.) (the 

“Act”) became effective on June 20, 1975. The Act requires lenders, mortgage brokers, or 

servicers of home loans to provide borrowers with pertinent and timely disclosures regarding 

the nature and costs of the real estate settlement process. The Act also protects borrowers against 

certain abusive practices, such as kickbacks, and places limitations upon the use of escrow 

accounts. The Department of Housing and Urban Development (HUD) promulgated 

Regulation X (24 CFR Part 3500), which implements RESPA. The National Affordable 

Housing Act of 1990 amended RESPA to require detailed disclosures concerning the 

transfer, sale, or assignment of mortgage servicing. It also requires disclosures for mortgage 

escrow accounts at closing and annually thereafter, itemizing the charges to be paid by the 

borrower and what is paid out of the account by the servicer.

In October 1992, Congress amended RESPA to cover subordinate lien loans. HUD, however, 

decided not to enforce these provisions until Regulation X was amended to cover these loans. 

On February 10, 1994, Regulation X was amended to extend coverage to subordinate lien 

loans. The amendments were effective August 9, 1994. Exemptions from coverage of RESPA 

and Regulation X, set forth in Section 3500.5(b), were effective March 14, 1994. Technical 

corrections and amendments to the rule were issued on March 30, 1994, and July 22, 1994.

On June 7, 1996, HUD amended Regulation X to clarify certain exemption provisions of 

RESPA, amend the controlled business disclosure requirements, and address specific 

comments raised in the 1994 rule. These amendments became effective on October 7, 1996. 

Congress, when it enacted the Economic Growth and Regulatory Paperwork Reduction Act of 

1996,1 further amended RESPA to clarify certain definitions including “controlled business 

arrangement,” which was changed to “affiliated business arrangement.” The changes also 

reduced the disclosures under the mortgage servicing provisions of RESPA.

In 2008, HUD issued a RESPA Reform Rule (73 FR 68204, Nov. 17, 2008) that included 

substantive and technical changes to the existing RESPA regulations and different implementation 

dates for various provisions. Substantive changes included a standard Good Faith Estimate form 

and a revised HUD-1 Settlement Statement that are required as of January 1, 2010. Technical 

changes, including streamlined mortgage servicing disclosure language, elimination of 

outdated escrow account provisions, and a provision permitting an “average charge” to be 

listed on the Good Faith Estimate and HUD-1 Settlement Statement, took effect on January 

16, 2009. In addition, HUD clarified that all disclosures required by RESPA are permitted to be 

provided electronically, in accordance with the Electronic Signatures in Global and National 

Commerce Act (ESIGN).

 1

Pub. L. 104-208, Div. A., Title II § 2103 (c), Sept. 30, 1996.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 2

The Dodd-Frank Act granted rule-making authority under RESPA to the Consumer Financial 

Protection Bureau (CFPB) and, with respect to entities under its jurisdiction, granted authority to 

the CFPB to supervise for and enforce compliance with RESPA and its implementing 

regulations.

2

Coverage (§ 3500.5(a))

RESPA is applicable to all “federally related mortgage loans,” which are defined as:

Loans (other than temporary loans), including refinancings secured by a first or subordinate lien 

on residential real property upon which either:

• A one-to-four family structure is located or is to be constructed using proceeds of the loan 

(including individual units of condominiums and cooperatives) or

• A manufactured home is located or is to be constructed using proceeds of the loan and to 

which one of the following applies:

 Loans made by a lender,

3 creditor,4 dealer;5

 Loans made or insured by an agency of the federal government;

 Loans made in connection with a housing or urban development program administered by 

an agency of the federal government; 

 Loans made and intended to be sold by the originating lender or creditor to FNMA, 

GNMA, or FHLMC (or its successor);6

 Loans that are the subject of a home equity conversion mortgage or reverse mortgage 

issued by a lender or creditor subject to the regulation; or

 Installment sales contracts, land contracts, or contracts for deeds on otherwise 

qualifying residential property if the contract is funded in whole or in part by proceeds 

of a loan made by a lender, dealer or creditor subject to the regulation.

 

2 Dodd-Frank Act §§ 1002(12)(M), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12)(M), 5514(b)-(c), and 5515(b)-(c) . These 

procedures will be further modified in the future to reflect, as appropriate, the transfer of certain authorities from HUD to the 

CFPB on July 21, 2011, effected by the Dodd-Frank Act.

3 A lender includes financial institutions either regulated by, or whose deposits or accounts are insured by any agency of the 

federal government.

4 A creditor is defined in Sec.103(f) of the Consumer Credit Protection Act (15 USC § 1602(f)). RESPA covers any creditor that 

makes or invests in residential real estate loans aggregating more than $1,000,000 per year.

5 Dealer is defined in Regulation X to mean a seller, contractor, or supplier of goods or services. Dealer loans are covered by 

RESPA if the obligations are to be assigned before the first payment is due to any lender or creditor otherwise subject to the 

regulation.

6 FNMA - Federal National Mortgage Association; GNMA - Government National Mortgage Association; FHLMC - Federal 

Home Loan Mortgage Corporation.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 3

Exemptions (§ 3500.5(b))

The following transactions are exempt from coverage:

• A loan on property of 25 acres or more (whether or not a dwelling is located on the property).

• A loan primarily for business, commercial or agricultural purposes (definition identical to 

Regulation Z, 12 CFR § 226.3(a)(1)).

• A temporary loan, such as a construction loan. (The exemption does not apply if the loan is used 

as, or may be converted to, permanent financing by the same financial institution or is used to 

finance transfer of title to the first user of the property.) If the lender issues a commitment for 

permanent financing, it is covered by the regulation.

• Any construction loan with a term of two years or more is covered by the regulation, unless it 

is made to a bona fide contractor. “Bridge” or “swing” loans are not covered by the 

regulation.

• A loan secured by vacant or unimproved property where no proceeds of the loan will be used to 

construct a one-to-four family residential structure. If the proceeds will be used to locate a 

manufactured home or construct a structure within two years from the date of settlement, the loan 

is covered.

• An assumption, unless the mortgage instruments require lender approval for the assumption and 

the lender approves the assumption.

• A renewal or modification where the original obligation (note) is still in effect but modified.

• A bona fide transfer of a loan obligation in the secondary market. (However, the mortgage 

servicing transfer disclosure requirements of 24 CFR 3500.21 still apply.) Mortgage broker 

transactions that are table funded (the loan is funded by a contemporaneous advance of loan 

funds and an assignment of the loan to the person advancing the funds) are not secondary market 

transactions and therefore are covered by RESPA.

Requirements

Special Information Booklet (§ 3500.6)

A loan originator7 is required to provide the borrower with a copy of the Special Information 

Booklet at the time a written application is submitted, or no later than three business days after 

the application is received. If the application is denied before the end of the three-business-day 

period, the loan originator is not required to provide the booklet. If the borrower uses a 

mortgage broker, the broker rather than the lender, must provide the booklet.

 7

The RESPA Reform Rule added the definition of “loan originator” to the list of defined terms in the RESPA regulations. A 

“loan originator” is defined as a lender or mortgage broker.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 4

The booklet does not need to be provided for refinancing transactions, closed-end subordinate 

lien mortgage loans and reverse mortgage transactions, or for any other federally related 

mortgage loan not intended for the purchase of a one-to-four family residential property

A loan originator that complies with Regulation Z (12 CFR § 226.5b) for open-end home equity 

plans is deemed to have complied with this section.

Good Faith Estimate (GFE) of Settlement Costs (§ 3500.7) 

Standard GFE Required

As of January 1, 2010, a loan originator is required to provide a consumer with the standard 

GFE form that is designed to allow borrowers to shop for a mortgage loan by comparing 

settlement costs and loan terms. (See GFE form at Appendix C to 24 CFR Part 3500.)

Overview of the Standard GFE

The first page of the GFE includes a summary of loan terms and a summary of estimated 

settlement charges. It also includes information about key dates such as when the interest rate for 

the loan quoted in the GFE expires and when the estimate for the settlement charges expires. The 

second page discloses settlement charges as subtotals for 11 categories of costs. The third page 

provides a table explaining which charges can change at settlement, a trade-off table showing the 

relationship between the interest rate and settlement charges, and a shopping chart to compare 

the costs and terms of loans offered by different originators.

GFE Application Requirements

• The loan originator must provide the standard GFE to the borrower within three business 

days of receipt of an application for a mortgage loan. A loan originator is not required to 

provide a GFE if before the end of the three-business-day period, the application is denied or 

the borrower withdraws the application.

• An application can be in writing or electronically submitted, including a written record of an 

oral application.

• A loan originator determines what information it needs to collect from a borrower and which 

of the collected information it will use in order to issue a GFE. Under the regulations, an 

“application” includes at least the following six pieces of information: 1) the borrower’s 

name, 2) the borrower’s gross monthly income; 3) the borrower’s Social Security number 

(e.g., to enable the loan originator to obtain a credit report); 4) the property address; 5) an 

estimate of the value of the property; and 6) the mortgage loan amount sought. In addition, a 

loan originator may require the submission of any other information it deems necessary. A 

loan originator will be presumed to have relied on such information prior to issuing a GFE 

and cannot base a revision of a GFE on that information unless it changes or is later found to 

be inaccurate.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 5

• While the loan originator may require the borrower to submit additional information beyond 

the six pieces of information listed above in order to issue a GFE, it cannot require, as a 

condition of providing the GFE, the submission of supplemental documentation to verify the 

information provided by the borrower on the application. However, a loan originator is not 

prohibited from using its own sources to verify the information provided by the borrower 

prior to issuing the GFE. The loan originator can require borrowers to provide verification 

information after the GFE has been issued in order to complete final underwriting.

• For dealer loans, the loan originator is responsible for providing the GFE directly or ensuring 

that the dealer provides the GFE.

• For mortgage brokered loans, either the lender or the mortgage broker must provide a GFE 

within three business days after a mortgage broker receives either an application or 

information sufficient to complete an application. The lender is responsible for ascertaining 

whether the GFE has been provided. If the mortgage broker has provided the GFE to the 

applicant, the lender is not required to provide an additional GFE.

• A loan originator is prohibited from charging a borrower any fee in order to obtain a GFE 

unless the fee is limited to the cost of a credit report.

GFE Not Required for Open End Lines of Credit 

(§ 3500.7(h))

A loan originator that complies with Regulation Z (12 CFR § 226.5b) for open-end home 

equity plans is deemed to have complied with Section 3500.7.

Availability of GFE Terms (§ 3500.7(c))

Regulation X does not establish a minimum period of availability for which the interest rate 

must be honored. The loan originator must determine the expiration date for the interest rate of 

the loan stated on the GFE. In contrast, Regulation X requires that the estimated settlement 

charges and loan terms listed on the GFE be honored by the loan originator for at least ten 

business days from the date the GFE is provided. The period of availability for the 

estimated settlement charges and loan terms as well as the period of availability for the interest 

rate of the loan stated on the GFE must be listed on the GFE in the “important dates” 

section of the form.

After the expiration date for the interest rate of the loan stated on the GFE, the interest rate 

and the other rate related charges, including the charge or credit for the interest rate chosen, 

the adjusted origination charges and the per diem interest can change until the interest rate is 

locked.

Key GFE Form Contents (§ 3500.7(d))

The loan originator must ensure that the required GFE form is completed in accordance with the 

Instructions set forth in Appendix C of 24 CFR Part 3500.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 6

First Page of GFE

• The first page of the GFE discloses identifying information such as the name and address of 

the “loan originator” which includes the lender or the mortgage broker originating the loan. 

The “purpose” section indicates what the GFE is about and directs the borrower to the Truth 

in Lending disclosures and HUD’s website for more information. The borrower is informed 

that only the borrower can shop for the best loan and that the borrower should compare loan 

offers using the shopping chart on the third page of the GFE.

• The “important dates” section requires the loan originator to state the expiration date for the 

interest rate for the loan provided in the GFE as well as the expiration date for the estimate of 

other settlement charges and the loan terms not dependent upon the interest rate.

• While the interest rate stated on the GFE is not required to be honored for any specific period 

of time, the estimate for the other settlement charges and other loan terms must be honored 

for at least 10 business days from when the GFE is provided.

• In addition, the form must state how many calendar days within which the borrower must go 

to settlement once the interest rate is locked (rate lock period). The form also requires 

disclosure of how many days prior to settlement the interest rate would have to be locked, if 

applicable.

• The “summary of your loan” section requires disclosure of the loan amount; loan term; initial 

interest rate; initial monthly payment for principal, interest and any mortgage insurance; 

whether the interest rate can rise, and if so, the maximum rate to which it can rise over the 

life of the loan, and the period of time after which the interest rate can first change; whether 

the loan balance can rise if the payments are made on time and if so, the maximum amount to 

which it can rise over the life of the loan; whether the monthly amount owed for principal, 

interest and any mortgage insurance can rise even if payments are made on time, and if so, 

the maximum amount to which the monthly amount owed can ever rise over the life of the 

loan; whether the loan has a prepayment penalty, and if so, the maximum amount it could be; 

and whether the loan has a balloon payment, and if so, the amount of such payment and in 

how many years it will be due.

• The “escrow account information” section requires the loan originator to indicate whether the 

loan does or does not have an escrow account to pay property taxes or other property related 

charges. In addition, this section also requires the disclosure of the monthly amount owed for 

principal, interest and any mortgage insurance.

• The bottom of the first page includes subtotals for the adjusted origination charges and 

charges for all other settlement charges listed on page two, along with the total estimated 

settlement charges.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 7

Second Page of GFE

The second page of the GFE requires disclosure of all settlement charges. It provides for the 

estimate of total settlement costs in eleven categories discussed below. The adjusted 

origination charges are disclosed in “Block A” and all other settlement charges are disclosed in 

“Block B.” The amounts in the blocks are to be added to arrive at the “total estimated 

settlement charges” which is required to be listed at the bottom of the page.

Disclosure of Adjusted Origination Charge (Block A)

Block A addresses disclosure of origination charges, which include all lender and mortgage 

broker charges. The “adjusted origination charge” results from the subtraction of a “credit” 

from the “origination charge” or the addition of a “charge” to the origination charge.

• Block 1 – the origination charges, which includes lender processing and underwriting fees 

and any fees paid to a mortgage broker.

Origination Charge Note: This block requires the disclosure of all charges that all loan 

originators involved in the transaction will receive for originating the loan (excluding any 

charges for points). A loan originator may not separately charge any additional fees for getting 

the loan such as application, processing or underwriting fees. The amount in Block 1 is subject 

to zero tolerance, i.e., the amount cannot change at settlement.

• Block 2 – a “credit” or “charge” for the interest rate chosen.

Credit or Charge for the Interest Rate Chosen Note:

Transaction Involving a Mortgage Broker: For a transaction involving a mortgage broker,8 Block 2 

requires disclosure of a “credit” or charge (points) for the specific interest rate chosen. The credit 

or charge for the specific interest rate chosen is the net payment to the mortgage broker (i.e., the 

sum of all payments to the mortgage broker from the lender, including payments based on the 

loan amount, a flat rate or any other compensation, and in a table funded transaction, the loan 

amount less the price paid for the loan by the lender.)

When the net payment to the mortgage broker from the lender is positive, there is a “credit” to the 

borrower and it is entered as a negative amount. For example, if the lender pays a yield spread 

premium to a mortgage broker for the loan set forth in the GFE, the payment must be 

disclosed as a “credit” to the borrower for the particular interest rate listed on the GFE 

(reflected on the GFE at Block 2, checkbox 2). The term “yield spread premium” is not 

featured on the GFE or the HUD-1 Settlement Statement.

 8

The RESPA Reform Rule changed the definition of “mortgage broker” to mean a person or entity (not an employee of a lender) 

that renders origination services and serves as an intermediary between a lender and a borrower in a transaction involving a federally 

related mortgage loan, including such person or entity that closes the loan in its own name and table funds the transaction. The 

definition will also apply to a loan correspondent approved under 24 CFR 202.8 for Federal Housing Administration (FHA 

programs.) The definition would also include an “exclusive agent” who is not an employee of the lender.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 8

Points paid by the borrower for the interest rate chosen must be disclosed as a “charge” 

(reflected on the GFE at Block 2, third checkbox). A loan cannot include both a charge (points) 

and a credit (yield spread premium).

Transaction Not Involving a Mortgage Broker. For a transaction without a mortgage 

broker, a lender may choose not to separately disclose any credit or charge for the interest rate 

chosen for the loan in the GFE. If the lender does not include any credit or charge in Block 2, 

it must check the first checkbox in Block 2 indicating that “The credit or charge for the interest 

rate you have chosen is included in ‘our origination charge’ above.” Only one of the boxes in 

Block 2 may be checked, as a credit and charge cannot occur together in the same transaction.

Disclosure of Charges for All Other Settlement Services 

(Block B) 

Block B is the sum of charges for all settlement services other than the origination charges.

• Block 3 – required services by providers selected by the lender such as appraisal and flood 

certification fees;

• Block 4 – title service fees and the cost of lender’s title insurance;

• Block 5 – owner’s title insurance;

• Block 6 – other required services for which the consumer may shop;

• Block 7 – government recording charges;

• Block 8 – transfer tax charges;

• Block 9 – initial deposit for escrow account;

• Block 10 – daily interest charges;

• Block 11 – homeowner’s insurance charges. 

Third Page of GFE

The third page of the GFE includes the following information:

• A tolerance chart identifying the charges that can change at settlement (see discussion on 

tolerances below);

• A trade-off table that requires the loan originator to provide information on the loan 

described in the GFE and at the loan originator’s option, information about alternative 

loans (one with lower settlement charges but a higher interest rate and one with a lower 

interest rate but higher settlement charges);

• A shopping chart that allows the consumer to fill in loan terms and settlement charges 

from other lenders or brokers to use to compare loans; and

• Language indicating that some lenders may sell the loan after settlement but that any fees the 

lender receives in the future cannot change the borrower’s loan or the settlement charges.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 9

Tolerances on Settlement Costs (§ 3500.7(e) and (i))

The RESPA Reform Rule established “tolerances” or limits on the amount actual settlement 

charges can vary at closing from the amounts stated on the GFE. The rule established three 

categories of settlement charges and each category has different tolerances. If, at settlement, the 

charges exceed the charges listed on the GFE by more than the permitted tolerances, the loan 

originator may cure the tolerance violation by reimbursing to the borrower the amount by 

which the tolerance was exceeded, at settlement or within 30 calendar days after settlement.

Tolerance Categories

• Zero tolerance category. This category of fees is subject to a zero tolerance standard. The 

fees estimated on the GFE may not be exceeded at closing. These fees include:

 The loan originator’s own origination charge, including processing and underwriting 

fees;

 The credit or charge for the interest rate chosen (i.e., yield spread premium or 

discount points) while the interest rate is locked;

 The adjusted origination charge while the interest rate is locked; and

 State/local property transfer taxes.

• Ten percent tolerance category. For this category of fees, while each individual 

fee may increase or decrease, the sum of the charges at settlement may not be greater than 

ten percent above the sum of the amounts included on the GFE. This category includes fees 

for:

 Loan originator required settlement services, where the loan originator selects the thirdparty settlement service provider;

 Loan originator required services, title services, required title insurance and owner’s title 

insurance when the borrower selects a third-party provider identified by the loan 

originator; and

 Government recording charges.

• No tolerance category. The final category of fees is not subject to any tolerance restriction. 

The amounts charged for the following settlement services included on the GFE can change at 

settlement and the amount of the change is not limited:

 Loan originator required services where the borrower selects his or her own third-party 

provider;

 Title services, lender’s title insurance, and owner’s title insurance when the borrower 

selects his or her own provider;

 Initial escrow deposit;

 Daily interest charges; and homeowner’s insurance.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 10

Identification of Third-Party Settlement Service Providers

When the loan originator permits a borrower to shop for one or more required third-party 

settlement services and select the settlement service provider for such required services, the 

loan originator must list in the relevant block on page two of the GFE the settlement service and 

the estimated charge to be paid to the provider of each required service. In addition, the loan 

originator must provide the borrower with a written list of settlement service providers for 

those required services on a separate sheet of paper at the time the GFE is provided.

Binding GFE (§ 3500.7(f))

The loan originator is bound, within the tolerances provided, to the settlement charges and 

terms listed on the GFE provided to the borrower, unless a new GFE is provided prior to 

settlement (see discussion below on changed circumstances). This also means that if a lender 

accepts a GFE issued by a mortgage broker, the lender is subject to the loan terms and 

settlement charges listed in the GFE, unless a new GFE is issued prior to settlement.

Changed Circumstances 

(§ 3500. 2(b); § 3500.7(f)(1) and (f)(2))

Changed circumstances are defined as:

• Acts of God, war, disaster, or other emergency;

• Information particular to the borrower or transaction that was relied on in providing the GFE 

that changes or is found to be inaccurate after the GFE has been provided;

• New information particular to the borrower or transaction that was not relied on in 

providing the GFE; or

• Other circumstances that are particular to the borrower or transaction, including boundary 

disputes, the need for flood insurance, or environmental problems.

Changed circumstances do not include the borrower’s name, the borrower’s monthly income, the 

property address, an estimate of the value of the property, the mortgage loan amount sought, and 

any information contained in any credit report obtained by the loan originator prior to providing 

the GFE, unless the information changes or is found to be inaccurate after the GFE has been 

provided. In addition, market price fluctuations by themselves do not constitute changed 

circumstances.

Changed circumstances affecting settlement costs are those circumstances that result in increased 

costs for settlement services such that the charges at settlement would exceed the tolerances or 

limits on those charges established by the regulations.

Changed circumstances affecting the loan are those circumstances that affect the borrower’s 

eligibility for the loan. For example, if underwriting and verification indicate that the borrower is 

ineligible for the loan provided in the GFE, the loan originator would no longer be bound by the 

original GFE. In such cases, if a new GFE is to be provided, the loan originator must do so 

within three business days of receiving information sufficient to establish changed 
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 11

circumstances. The loan originator must document the reason that a new GFE was provided and 

must retain documentation of any reasons for providing a new GFE for no less than three years 

after settlement.

None of the information collected by the loan originator prior to issuing the GFE may later become 

the basis for a “changed circumstance” upon which it may offer a revised GFE, unless: 1) it can 

demonstrate that there was a change in the particular information; or 2) that the information was 

inaccurate; or 3) that it did not rely on that particular information in issuing the GFE. A loan 

originator has the burden of demonstrating nonreliance on the collected information, but may do so 

through various means including through a documented record in the underwriting file or an 

established policy of relying on a more limited set of information in providing GFEs.

If a loan originator issues a revised GFE based on information previously collected in issuing the 

original GFE and “changed circumstances,” it must document the reasons for issuing the revised 

GFE, such as its nonreliance on such information or the inaccuracy of such information.

Borrower Requested Changes (§ 3500.7(f)(3))

If a borrower requests changes to the mortgage loan identified in the GFE that change the 

settlement charges or the terms of the loan, the loan originator may provide a revised GFE to the 

borrower. If a revised GFE is provided, the loan originator must do so within three business 

days of the borrower’s request.

Expiration of Original GFE (§ 3500.7(f)(4))

If a borrower does not express an intent to continue with an application within 10 business 

days after the GFE is provided, or such longer time provided by the loan originator, the loan 

originator is no longer bound by the GFE.

Interest Rate Dependent Charges and Terms 

(§ 3500.7(f)(5))

If the interest rate has not been locked by the borrower, or a locked interest rate has expired, all 

interest rate-dependent charges on the GFE are subject to change. The charges that may change 

include the charge or credit for the interest rate chosen, the adjusted origination charges, per 

diem interest, and loan terms related to the interest rate. However, the loan originator’s 

origination charge (listed in Block 1 of page 2 of the GFE) is not subject to change, even if the 

interest rate floats, unless there is another changed circumstance or borrower-requested change.

If the borrower later locks the interest rate, a new GFE must be provided showing the revised 

interest rate dependent charges and terms. All other charges and terms must remain the same as 

on the original GFE, unless changed circumstances or borrower-requested changes result in 

increased costs for settlement services or affect the borrower’s eligibility for the specific 

loan terms identified in the original GFE.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 12

New Home Purchases (§ 3500.7(f)(6))

In transactions involving new home purchases, where settlement is expected to occur more than 

60 calendar days from the time a GFE is provided, the loan originator may provide the GFE 

to the borrower with a clear and conspicuous disclosure stating that at any time up until 60 

calendar days prior to closing, the loan originator may issue a revised GFE. If the loan originator 

does not provide such a disclosure, it cannot issue a revised GFE except as otherwise provided in 

Regulation X.

Volume-Based Discounts

The RESPA Reform Rule did not formally address the legality of volume-based discounts. 

However, HUD indicated in the preamble to the rule that discounts negotiated between loan 

originators and other settlement service providers, where the discount is ultimately passed on to 

the borrower in full, is not, depending on the circumstances of a particular transaction, a 

violation of Section 8 of RESPA.

9

Uniform Settlement Statement 

(HUD-1 OR HUD-1A) (§ 3500.8)

Section 4 of RESPA requires the person conducting the settlement (settlement agent) to provide 

the borrower with a HUD-1 Settlement Statement at or before settlement that clearly itemizes all 

charges imposed on the buyer and the seller in connection with the settlement. The RESPA 

Reform rule included a revised HUD-1/1A Settlement Statement form that is required as of 

January 1, 2010. The HUD-1 is used for transactions in which there is a borrower and seller. 

For transactions in which there is a borrower and no seller (refinancings and subordinate lien 

loans), the HUD-1 may be completed by using the borrower’s side of the settlement 

statement. Alternatively, the HUD-1A may be used.

However, no settlement statement is required for home equity plans subject to the Truth in 

Lending Act and Regulation Z. Appendix A to Part 3500 contains the instructions for 

completing the forms.

Key RESPA Reform Enhancements to the HUD-1/1A 

Settlement Statement

While the RESPA Reform Rule did not include any substantive changes to the first page of the 

HUD-1/1A form, there were changes to the second page of the form to facilitate comparison 

between the HUD-1/1A and the GFE. Each designated line on the second page of the revised 

HUD-1/1A includes a reference to the relevant line from the GFE.

 9

73 Fed. Reg. 68204, 68232 (November 17, 2008).
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 13

With respect to disclosure of “no cost” loans where “no cost” refers only to the loan 

originator’s fees (see Section L, subsection 800 of the HUD-1 form), the amounts shown for 

the “origination charge” and the “credit or charge for the interest rate chosen” should offset, so 

that the “adjusted origination charge” is zero.

In the case of a “no cost” loan where “no cost” encompasses loan originator and third-party 

fees, all third-party fees must be itemized and listed in the borrower’s column on the HUD1/1A. These itemized charges must be offset with a negative adjusted origination charge (Line 

803) and recorded in the columns.

To further facilitate comparability between the forms, the revised HUD-1 includes a new third 

page (second page of the HUD-1A) that allows borrowers to compare the loan terms and 

settlement charges listed on the GFE with the terms and charges listed on the closing statement. 

The first half of the third page includes a comparison chart that sets forth the settlement 

charges from the GFE and the settlement charges from the HUD-1 to allow the borrower to 

easily determine whether the settlement charges exceed the charges stated on the GFE. If any 

charges at settlement exceed the charges listed on the GFE by more than the permitted 

tolerances, the loan originator may cure the tolerance violation by reimbursing to the borrower 

the amount by which the tolerance was exceeded. A borrower will be deemed to have 

received timely reimbursement if the financial institution delivers or places the payment in the 

mail within 30 calendar days after settlement.

Inadvertent or technical errors on the settlement statement are not deemed to be a violation of 

Section 4 of RESPA if a revised HUD-1/1A is provided to the borrower within 30 calendar 

days after settlement.

The second half of the third page sets forth the loan terms for the loan received at settlement 

in a format that reflects the summary of loan terms on the first page of the GFE, but with 

additional loan related information that would be available at closing. The note at the bottom of 

the page indicates that the borrower should contact the lender if the borrower has questions 

about the settlement charges or loan terms listed on the form.

Section 3500.8(b) and the instructions for completing the HUD-1/1A Settlement Statement 

provide that the loan originator shall transmit sufficient information to the settlement 

agent to allow the settlement agent to complete the “loan terms” section. The loan 

originator must provide the information in a format that permits the settlement agent to enter 

the information in the appropriate spaces on the HUD-1/1A, without having to refer to the loan 

documents.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 14

Average Charge Permitted

As of January 16, 2009, an average charge may be stated on the HUD-1/1A if such average 

charge is computed in accordance with Section 3500.8(b)(2). All settlement service providers, 

including loan originators, are permitted to list the average charge for a settlement service 

on the HUD-1/1A Settlement Statement (and on the GFE) rather than the exact cost for that 

service.

The method of determining the average charge is left up to the settlement service provider. 

The average charge may be used as the charge for any third-party vendor charge, not for the 

provider’s own internal charges. The average charge also cannot be used where the charge is 

based on the loan amount or the value of the property.

The average charge may be used for any third-party settlement service, provided that the total 

amounts received from borrowers for that service for a particular class of transactions do not 

exceed the total amounts paid to providers of that service for that class of transactions. A class 

of transactions may be defined based on the period of time, type of loan and geographic area. 

If an average charge is used in any class of transactions defined by the loan originator, then 

the loan originator must use the same average charge for every transaction within that class. 

The average charge must be recalculated at least every six months.

A settlement service provider that uses an average charge for a particular service must maintain 

all documents that were used to calculate the average charge for at least three years after any 

settlement in which the average charge was used.

Printing and Duplication of the Settlement Statement 

(§ 3500.9)

Financial institutions have numerous options for layout and format in reproducing the HUD-1 

and HUD-1A that do not require prior HUD approval such as size of pages; tint or color of 

pages; size and style of type or print; spacing; printing on separate pages, front and back of a 

single page or on one continuous page; use of multi-copy tear-out sets; printing on rolls for 

computer purposes; addition of signature lines; and translation into any language. Other 

changes may be made only with the approval of the Secretary of Housing and Urban 

Development.

One-Day Advance Inspection of the Settlement Statement 

(§ 3500.10)

Upon request by the borrower, the HUD-1 or HUD-1A must be completed and made available 

for inspection during the business day immediately preceding the day of settlement, setting 

forth those items known at that time by the person conducting the closing.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 15

Delivery (§ 3500.10(a) and (b))

The completed HUD-1 or HUD-1A must be mailed or delivered to the borrower, the seller (if 

there is one), the lender (if the lender is not the settlement agent), and/or their agents at or before 

settlement. However, the borrower may waive the right of delivery by executing a written 

waiver at or before settlement. The HUD-1 or HUD-1A shall be mailed or delivered as soon as 

practicable after settlement if the borrower or borrower’s agent does not attend the settlement.

Retention (§ 3500.10(e))

A lender must retain each completed HUD-1 or HUD-1A and related documents for five years 

after settlement, unless the lender disposes of its interest in the mortgage and does not 

service the mortgage. If the loan is transferred, the lender shall provide a copy of the HUD-1 or 

HUD-1A to the owner or servicer of the mortgage as part of the transfer. The owner or 

servicer shall retain the HUD-1 or HUD-1A for the remainder of the five-year period.

Prohibition of Fees for Preparing Federal Disclosures 

(§ 3500.12)

For loans subject to RESPA, no fee may be charged for preparing the Settlement Statement 

or the Escrow Account statement or any disclosures required by the Truth in Lending Act.

Prohibition Against Kickbacks and Unearned Fees (§ 

3500.14)

Any person who gives or receives a fee or a thing of value (payments, commissions, fees, gifts or 

special privileges) for the referral of settlement business is in violation of Section 8 of RESPA. 

Payments in excess of the reasonable value of goods provided or services rendered are 

considered unearned fees. Appendix B of Regulation X provides guidance on the meaning and 

coverage of the prohibition against kickbacks and unearned fees.

Penalties and Liabilities

Civil and criminal liability is provided for violating the prohibition against kickbacks and 

unearned fees including:

• Civil liability to the parties affected, equal to three times the amount of any charge paid for 

such settlement service.

• The possibility that the costs associated with any court proceeding together with reasonable 

attorney’s fees could be recovered.

• A fine of not more than $10,000 or imprisonment for not more than one year or both.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 16

Affiliated Business Arrangements (§ 3500.15)

If a loan originator has either an affiliate relationship or a direct or beneficial ownership 

interest of more than one percent in a provider of settlement services and the loan originator 

directly or indirectly refers business to the provider it is an affiliated business arrangement. 

An affiliated business arrangement is not a violation of Section 8 of RESPA and of Section

3500.14 of Regulation X if the following conditions are satisfied.

Prior to the referral, the person making each referral has provided to each person whose 

business is referred an Affiliated Business Arrangement Disclosure Statement (Appendix D of 

Regulation X). This disclosure shall specify the following:

• The nature of the relationship (explaining the ownership and financial interest) between the 

provider and the loan originator; and

• The estimated charge or range of charges generally made by such provider.

This disclosure must be provided on a separate piece of paper either at the time of loan 

application, or with the GFE, or at the time of the referral.

The loan originator may not require the use of such a provider, with the following exceptions: 

the institution may require a buyer, borrower, or seller to pay for the services of an attorney, credit 

reporting agency, or real estate appraiser chosen by the institution to represent its interest. The 

loan originator may only receive a return on ownership or franchise interest or payment 

otherwise permitted by RESPA.

Title Companies (§ 3500.16)

Sellers that hold legal title to the property being sold are prohibited from requiring borrowers, 

either directly or indirectly, as a condition to selling the property, to use a particular title 

company.

Civil liability for violating the provision that a financial institution (seller) cannot require a 

borrower to use a particular title company is an amount equal to three times all charges 

made for such title insurance.

Escrow Accounts (§ 3500.17)

On October 26, 1994, HUD issued its final rule changing the accounting method for escrow 

accounts, which was originally effective April 24, 1995. The rule establishes a national 

standard accounting method, known as aggregate accounting. Existing escrow accounts were 

allowed a three-year phase-in period to convert to the aggregate accounting method. The final 

rule also established formats and procedures for initial and annual escrow account 

statements. (The 2008 RESPA Reform Rule eliminated provisions in Section 3500.17 that 

related to the phase-in period for aggregate accounting, effective January 16, 2009.)
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 17

The amount of escrow funds that can be collected at settlement or upon creation of an escrow 

account is restricted to an amount sufficient to pay charges, such as taxes and insurance, that 

are attributable to the period from the date such payments were last paid until the initial 

payment date. Throughout the life of an escrow account, the servicer may charge the 

borrower a monthly sum equal to 1/12 of the total annual escrow payments that the 

servicer reasonably anticipates paying from the account. In addition, the servicer may 

add an amount to maintain a cushion no greater than 1/6 of the estimated total annual

payments from the account.

Escrow Account Analysis 

(§ 3500.17(c)(2) and (3) and 3500.17(k))

Before establishing an escrow account, a servicer must conduct an analysis to determine the 

periodic payments and the amount to be deposited. The servicer shall use an escrow 

disbursement date that is on or before the deadline to avoid a penalty and may make annual 

lump sum payments to take advantage of a discount.

Transfer of Servicing (§ 3500.17(e))

If the new servicer changes either the monthly payment amount or the accounting method used 

by the old servicer, then it must provide the borrower with an initial escrow account statement 

within 60 days of the date of transfer. When the new servicer provides an initial escrow 

account statement, it shall use the effective date of the transfer of servicing to establish the new 

escrow account computation year. In addition, if the new servicer retains the monthly payments 

and accounting method used by the old servicer, then the new servicer may continue to use the 

same computation year established by the old servicer or it may choose a different one, using a 

short year statement.

Shortages, Surpluses, and Deficiency Requirements 

(§ 3500.17(f))

The servicer shall conduct an annual escrow account analysis to determine whether a surplus, 

shortage, or deficiency exists as defined under Section 3500.17(b).

If the escrow account analysis discloses a surplus, the servicer shall, within 30 days from the date 

of the analysis, refund the surplus to the borrower if the surplus is greater than or equal to $50. 

If the surplus is less than $50, the servicer may refund such amount to the borrower, or credit 

such amount against the next year’s escrow payments. These provisions apply as long as the 

borrower’s mortgage payment is current at the time of the escrow account analysis.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 18

If the escrow account analysis discloses a shortage of less than one month’s escrow payments, 

then the servicer has three possible courses of action:

• The servicer may allow the shortage to exist and do nothing to change it;

• The servicer may require the borrower to repay the shortage amount within 30 days; or

• The servicer may require the borrower to repay the shortage amount in equal monthly 

payments over at least a 12-month period.

If the shortage is more than or equal to one month’s escrow payment, then the servicer has 

two possible courses of action:

• The servicer may allow the shortage to exist and do nothing to change it; or

• The servicer may require the borrower to repay the shortage in equal monthly payments over 

at least a 12-month period.

If the escrow account analysis discloses a deficiency, then the servicer may require the borrower 

to pay additional monthly deposits to the account to eliminate the deficiency.

If the deficiency is less than one month’s escrow account payment, then the servicer;

• May allow the deficiency to exist and do nothing to change it;

• May require the borrower to repay the deficiency within 30 days; or

• May require the borrower to repay the deficiency in two or more equal monthly payments.

If the deficiency is greater than or equal to one month’s escrow payment, the servicer may allow 

the deficiency to exist and do nothing to change it, or require the borrower to repay the 

deficiency in two or more equal monthly payments.

These provisions apply as long as the borrower’s mortgage payment is current at the time of the 

escrow account analysis.

A servicer must notify the borrower at least once during the escrow account computation year 

if a shortage or deficiency exists in the account.

Initial Escrow Account Statement (§ 3500.17(g))

After analyzing each escrow account, the servicer must submit an initial escrow account 

statement to the borrower at settlement or within 45 calendar days of settlement for escrow 

accounts that are established as a condition of the loan.

The initial escrow account statement must include the monthly mortgage payment; the portion 

going to escrow; itemize estimated taxes, insurance premiums, and other charges; the 

anticipated disbursement dates of those charges; the amount of the cushion; and a trial running 

balance.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 19

Annual Escrow Account Statement (§ 3500.17(i))

A servicer shall submit to the borrower an annual statement for each escrow account within 30 

days of the completion of the computation year. The servicer must conduct an escrow account 

analysis before submitting an annual escrow account statement to the borrower.

The annual escrow account statements must contain the account history; projections for the next 

year; current mortgage payment and portion going to escrow; amount of past year’s monthly 

mortgage payment and portion that went into the escrow account; total amount paid into the 

escrow account during the past year; amount paid from the account for taxes, insurance 

premiums, and other charges; balance at the end of the period; explanation of how the 

surplus, shortage, or deficiency is being handled; and, if applicable, the reasons why the 

estimated low monthly balance was not reached.

Short-Year Statements (§ 3500.17(i)(4))

Short-year statements can be issued to end the escrow account computation year and establish 

the beginning date of the new computation year. Short-year statements may be provided upon 

the transfer of servicing and are required upon loan payoff. The statement is due to the 

borrower within 60 days after receiving the pay-off funds.

Timely Payments (§ 3500.17(k))

The servicer shall pay escrow disbursements by the disbursement date. In calculating the 

disbursement date, the servicer must use a date on or before the deadline to avoid a penalty 

and may make annual lump sum payments to take advantage of a discount.

Recordkeeping (§ 3500.17(l))

Each servicer shall keep records that are easily retrievable, reflecting the servicer’s handling of 

each borrower’s escrow account. The servicer shall maintain the records for each escrow 

account for at least five years after the servicer last serviced the account.

Penalties (§ 3500.17(m))

Failure to provide an initial or annual escrow account statement to a borrower can result in the 

financial institution or the servicer being assessed a civil penalty of $75 for each such failure, 

with the total for any 12 month period not to exceed $130,000. If the violation is due to 

intentional disregard, the penalty is $110 for each failure without any annual cap on liability.

Mortgage Servicing Transfer Disclosures

(§ 3500.21)

The disclosures related to the transfer of mortgage servicing are required for first mortgage 

liens, including all refinancing transactions. Subordinate lien loans and open-end lines of credit 

(home equity plans), that are covered under the TILA and Regulation Z are exempt from this 

section.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 20

A financial institution that receives an application for a federally related mortgage loan is 

required to provide the servicing disclosure statement to the borrower within three business days 

after receipt of the application. The 2008 RESPA Reform Rule included a technical revision to 

the mortgage servicing disclosure statement in Appendix MS-1 to Regulation X, effective 

January 16, 2009. The rule streamlined the initial servicing disclosure statement language to be 

consistent with statutory changes.

When a federally related mortgage loan is assigned, sold or transferred, the transferor (present 

servicer) must provide a disclosure at least 15 days before the effective date of the transfer. A 

transfer of servicing notice from the transferee (new servicer) must be provided not more than 

15 days after the effective date of the transfer. Both notices may be combined into one notice if 

delivered to the borrower at least 15 days before the effective date of the transfer. The disclosure 

must include:

• The effective date of the transfer.

• The name, address for consumer inquiries, and toll-free or collect-call telephone number of the 

transferee servicer.

• A toll-free or collect-call telephone number for an employee by the transferor servicer that can be 

contacted by the borrower to answer servicing questions.

• The date on which the transferor servicer will cease accepting payments relating to the loan and 

the date on which the transferee servicer will begin to accept such payments. The dates must 

either be the same or consecutive dates.

• Any information concerning the effect of the transfer on the availability of optional insurance and 

any action the borrower must take to maintain coverage.

• A statement that the transfer does not affect the terms or conditions of the mortgage (except as 

related to servicing).

• A statement of the borrower’s rights in connection with complaint resolution.

During the 60-day period beginning on the date of transfer, no late fee can be imposed on a 

borrower who has made the payment to the wrong servicer.

The following transfers are not considered an assignment, sale, or transfer of mortgage loan 

servicing for purposes of this requirement if there is no change in the payee, address to which 

payment must be delivered, account number, or amount of payment due:

• Transfers between affiliates;

• Transfers resulting from mergers or acquisitions of service or subservicers; and

• Transfers between master servicers, when the subservicer remains the same.
CFPB Consumer

Laws and Regulations RESPA

CFPB FFIEC Rev. 12/2009 RESPA 21

Servicers Must Respond to Borrower’s Inquiries 

(§ 3500.21(e))

A financial institution servicer must respond to a borrower’s qualified written request for 

information relating to the servicing of the loan and take appropriate action within established 

time frames after receipt of the inquiry. Generally, the financial institution must provide 

written acknowledgment within 20 business days, and take certain specified actions within 60 

business days of receipt of such inquiry. The written inquiry must include the name and 

account number of the borrower and the reasons the borrower believes the account is in error.

During the 60 business day period following receipt of a qualified written request from a 

borrower relating to a payment, a financial institution may not provide adverse information 

regarding any payment that is the subject of the qualified written request to any consumer 

reporting agency.

Relationship to State Law (§ 3500.21(h) and 12 USC 2616)

Financial institutions complying with the mortgage servicing transfer disclosure 

requirements of RESPA are considered to have complied with any state law or regulation 

requiring notice to a borrower at the time of application or transfer of a mortgage.

Other state laws shall not be affected by the act, except to the extent that they are inconsistent 

and then only to the extent of the inconsistency. The Secretary of Housing and Urban 

Development is authorized, after consulting with the appropriate federal agencies, to 

determine whether such inconsistencies exist.

Penalties and Liabilities (§ 3500.21(f))

Failure to comply with any provision of Section 3500.21 will result in actual damages, and 

where there is a pattern or practice of noncompliance, any additional damages in an amount not 

to exceed $1,000. In class action cases, each borrower may receive actual damages and 

additional damages, as the court allows, up to $1,000 for each member of the class, except that 

the total amount of damages in any class action may not exceed the lesser of $500,000 or one 

percent of the net worth of the servicer. In addition, costs of the action and attorney fees may 

be awarded in any successful action.

REFERENCES 

Laws

12 USC 2601 et seq. Real Estate Settlement Procedures Act

Department of Housing and Urban Development Regulations 

(24 CFR)

Part 3500 Real Estate Settlement Procedures Act (Regulation X)
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 1

Real Estate Settlement 

Procedures Act

Examination Objectives

• To determine if the financial institution has established procedures to ensure compliance with the Real Estate Settlement Procedures Act 

(RESPA).

• To determine that the financial institution does not engage in any practices prohibited by 

RESPA, such as kickbacks, payment or receipt of referral fees or unearned fees, or excessive 

escrow assessments.

• To determine if the Special Information Booklet, Good Faith Estimate, Uniform Settlement 

Statement (Form HUD-1 or HUD 1A), mortgage servicing transfer disclosures, and other 

required disclosures are in a form that complies with Regulation X, are properly completed, 

and provided to borrowers within prescribed time periods.

• To determine if the institution is submitting the required initial and annual escrow account 

statements to borrowers as applicable, and complying with established limitations on escrow 

account arrangements.

• To determine whether the institution is responding to borrower inquiries for information relating to the servicing of their loans in compliance with the provisions of RESPA.

Examination Procedures

If the financial institution has loans covered by the act, determine whether the institution’s policies, 

practices, and procedures are in compliance.

1. Review the types of loans covered by RESPA and applicable exemptions.

[Click&type]

2. Review the Special Information Booklet, good faith estimate (GFE) form, 

Uniform Settlement Statement form (HUD-1 or HUD-1A), mortgage servicing 

transfer disclosure forms, and affiliated business arrangement disclosure form for 

compliance with the requirements of Regulation X. Review standardized and 

model forms in the appendices to the regulation.

[Click&type]

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 2

3. If electronic disclosures are provided, determine whether the institution has 

policies and procedures to provide electronic delivery in accordance with the 

Electronic Signatures in Global and National Commerce Act (ESIGN).

[Click&type]

4.

Review written loan policies and operating procedures in connection with 

federally related mortgage loans and discuss them with institution personnel.

Determine whether the financial institution has policies and procedures that 

address the following:

• The information that will be collected from applicants in connection with 

issuing a GFE, and what information will be relied on to issue a GFE. 

• Provision of a revised GFE in the event of changed circumstances. 

• Provision of a revised GFE for transactions involving new home purchases. 

• To cure a tolerance violation by reimbursing the borrower the amount by 

which the tolerance was exceeded within 30 calendar days from date of 

settlement. 

• To cure a technical or inadvertent error on the HUD-1/1A by providing a 

revised settlement statement to the borrower within 30 calendar days of 

settlement. 

[Click&type]

5. Interview mortgage lending personnel to determine:

• Identity of persons or entities referring federally related mortgage loan 

business;

• The nature of services provided by referral sources, if any;

• Settlement service providers used by the institution;

• When the Special Information Booklet is given;

• The timing of the good faith estimate and how fee information is 

determined;

• Any providers whose services are required by the institution;

• How borrower inquiries regarding loan servicing are handled and within 

what time frames; and

• Whether escrow arrangements exist on mortgage loans.

[Click&type]

6. Assess the overall level of knowledge and understanding of mortgage lending 

personnel.

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 3

Special Information Booklet

7. Determine through discussion with management and review of credit files 

whether the Special Information Booklet, if required, is provided within 3 

business days after the financial institution or broker receives a written 

application for a loan (§ 3500.6(a)(1)).

[Click&type]

Good Faith Estimate

8. Determine whether the financial institution provides a good faith estimate of 

charges for settlement services, if required, within three business days after 

receipt of a written application (§ 3500.7(a)).

[Click&type]

9. Review the Good Faith Estimate to determine if it appears exactly as set forth in 

Appendix C to Part 3500. 

[Click&type]

10. Review a sample of loan files that include GFEs to determine the following: 

• Whether the financial institution followed GFE application requirements. 

• If the institution provided a revised GFE to the applicant due to changed 

circumstances, determine whether institution followed regulatory 

requirements for issuing a revised GFE due to changed circumstances. 

• Whether the GFE was completed as required in the regulations and 

instructions (§ 3500.7 and Appendix C to Part 3500) and whether it included 

the following information: 

 Interest rate expiration date,

 Settlement charges expiration date,

 Rate lock period, 

 Number of days before settlement the interest rate must be locked, if 

applicable, 

 Summary of loan information, 

 Escrow account information, 

 Estimates for settlement charges, and 
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 4

 Left hand column on trade-off table completed for loan in the GFE.

• Whether, for no cost loans, all third-party fees paid by the financial 

institution are itemized and listed in the appropriate blocks on the second 

page of the GFE. 

• Whether a separate sheet was provided with the GFE that identifies the 

settlement service providers for the services listed on the GFE. 

[Click&type]

Uniform Settlement Statement Form (HUD-1 and HUD-1A)

11. Using the same sample of loan files as used for the review of the GFE, review the 

Uniform Settlement Statement (HUD-1 or HUD-1A, as appropriate) (§ 3500.8 

and Appendix A to Part 3500) to determine whether:

• Charges are properly itemized in accordance with the instructions for 

completion of the HUD-1 or HUD-1A (Appendix A to Part 3500).

• All charges paid by the borrower and the seller are itemized and include the 

name of the recipient (§ 3500.8(b), Appendix A).

• Average charges for settlement services are calculated in accordance with 

§ 3500.8(b)(2).

• Charges required by the financial institution but paid outside of closing are

itemized on the settlement statement, marked as “paid outside of closing” or

“P.O.C.,” but not included in cost totals (§ 3500.8(b); Appendix A).

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 5

12. If the financial institution conducts the settlement, determine whether:

• The borrower, upon request, is allowed to inspect the HUD-1 or HUD-1A at 

least one business day prior to settlement (§ 3500.10(a)).

• The HUD-1 or HUD-1A is provided to the borrower and seller at or before

settlement (except where the borrower has waived the right to delivery and 

in the case of exempt transactions) (§ 3500.10(b)).

• In cases where the right to delivery is waived or the transaction is exempt, 

the HUD-1/1A is mailed as soon as practicable after settlement (§

3500.10(b),(c), and (d)).

[Click&type]

13. Determine whether, in the case of an inadvertent or technical error on the HUD1/1A, the financial institution provides a revised HUD-1/1A to the borrower 

within 30 calendar days after settlement (§ 3500.8(c)).

[Click&type]

14. Review the HUD-1 or HUD-1A form prepared in connection with each GFE 

reviewed to determine if the amount stated for any itemized service exceeds the 

amount shown on the GFE for that service. If the amount stated on the HUD-1 

exceeds the amount shown on the GFE and such overcharge violates the 

tolerance for that category of settlement services, determine whether the financial 

institution cured the tolerance violation by reimbursing to the borrower the 

amount by which the tolerance was exceeded, at settlement or within 30 calendar 

days from date of settlement (§ 3500.7(i)).

[Click&type]

15. Determine whether HUD-1 and HUD-1A forms are retained for five years. If the 

financial institution disposes of its interest in the mortgage and does not service 

the loan, determine whether the HUD-1 or HUD-1A form is transferred to the 

new asset owner with the loan file (§ 3500.10(e)).

[Click&type]

Mortgage Servicing Transfer Disclosure

16. Determine whether the disclosure form is substantially in conformity with the 

model disclosure in Appendix MS-1 to Part 3500.

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 6

17. Determine that the mortgage servicing transfer disclosure was provided to the 

applicant within three business days after receipt of the application (§

3500.21(c)).

[Click&type]

18. Determine that the disclosure states whether the loan may be assigned, sold, or 

transferred while the loan is outstanding (§ 3500.21(b)(2)).

[Click&type]

Notice to Borrower of Transfer of Mortgage Servicing

19. Determine whether the institution has transferred or received mortgage servicing 

rights.

[Click&type]

20. If it has transferred servicing rights, determine whether notice to the borrower 

was given at least 15 days prior to the transfer (§ 3500.21(d)(2)).

[Click&type]

21. If it has received servicing rights, determine whether notice was given to the 

borrower within 15 days after the transfer (§ 3500.21(d)(2)).

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 7

22. Determine whether the notice by transferor and transferee includes the following

information (§ 3500.21(d)(3)). Sample language for the notice of transfer is 

contained in Appendix MS-2 to Part 3500.

• The effective date of the transfer;

• A statement that the transfer does not affect the terms or conditions of the

mortgage, other than terms directly related to its servicing; 

• The name, consumer inquiry addresses (including, at the option of the 

servicer, a separate address where qualified written requests must be sent), 

and a toll-free or collect call telephone number for an employee or 

department of the transferee servicer;

• A toll-free or collect call telephone number for an employee or department 

of the transferor servicer that can be contacted by the borrower for answers 

to servicing transfer inquiries;

• The date on which the present servicer will cease accepting payments and 

the date the new servicer will begin accepting payments relating to the 

transferred loan;

• Any information concerning the effect of the transfer on the availability or 

terms of optional insurance and any action the borrower must take to 

maintain coverage; and

• A statement of the borrower’s rights in connection with complaint resolution

(Appendix MS-2 to Part 3500.)

[Click&type]

Responsibilities of Servicer

23. Through a review of late notices or otherwise if the transferor servicer received 

payment, determine that no late fees have been imposed and that no payments 

have been treated as late within 60 days following a transfer of servicing (§

3500.21(d)(5)).

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 8

24. Determine that the institution, as loan servicer for mortgage loans and 

refinancings subject to RESPA, responds to borrower inquiries relating to these 

loans as prescribed in the regulation, including:

• Provides the notice of receipt of inquiry for qualified written requests from 

borrowers within 20 business days (unless the action requested is taken 

within that period and the borrower is notified in writing of that action)

(§ 3500.21(e)(1)).

• Provides written notification of the corrections taken on the account, or 

statement of the reasons the account is correct or explanation why the 

information requested is unavailable not later than 60 business days after 

receipt of the qualified written request from the borrower (§ 3500.21(e)(3)).

• Determine that the institution does not provide information to any consumer

reporting agency regarding overdue payment when investigating a qualified 

written request from borrower regarding disputed payments during this 60-

business-day period (§ 3500.21(e)(4)(I)).

[Click&type]

No Fees for RESPA Disclosures

25. Determine whether the financial institution charges a fee specifically for 

preparing and distributing the HUD-1 forms, escrow statements or documents 

required under the Truth in Lending Act (§ 3500.12).

• If any fee is charged before providing a GFE, determine whether such fee is 

limited to the cost of a credit report (§ 3500.7(a)(4)). 

[Click&type] ]

Purchase of Title Insurance

26. When the financial institution owns the property being sold, determine whether it 

requires that title insurance be purchased from a particular company (§ 3500.16).

[Click&type]

Payment or Receipt of Referral or Unearned Fees

27. Determine if management is aware of the prohibitions against payment or receipt 

of kickbacks and unearned fees (RESPA § 8; § 3500.14).

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 9

28. Through interviews with institution management and personnel, file reviews, 

review of good faith estimates, and HUD-1 and HUD-1A, determine if federally 

related mortgage loan transactions are referred by brokers, affiliates, or other 

parties. Identify those parties. Also, identify persons or entities to which the 

institution refers services in connection with a federally related mortgage 

transaction.

• Identify the types of services rendered by the broker, affiliate, or service 

provider.

• By a review of the institution’s general ledger or otherwise, determine if fees 

were paid to the institution or any parties identified.

• Confirm that any fees paid to the broker, affiliate, service provider, or other 

party meet the requirements of Section 3500.14(g) and are for goods or 

facilities actually furnished or services actually performed. This includes 

payments to an affiliate or the affiliate’s employees.

[Click&type]

Affiliated Business Arrangements

29. Determine from the HUD-1 or HUD-1A and from interviews with institution 

management if the institution referred a borrower to a settlement service 

provider. 

[Click&type]

30. If the financial institution referred a borrower to an affiliated settlement service 

provider, determine whether the Affiliated Business Arrangement disclosure 

statement (Appendix D to Part 3500) was provided as required by Section 

3500.15(b)(1).

[Click&type]

31. Other than an attorney, credit reporting agency, or appraiser representing the 

lender, if the financial institution referred a borrower to a settlement service 

provider, determine whether the institution required the use of the provider (§

3500.15(b)(2)).

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 10

Escrow Accounts

If the institution maintains escrow accounts in connection with a federally related mortgage loan, complete the following procedures.

32. Determine whether the institution performed an initial escrow analysis 

(§ 3500.17(c)(2)) and provided the initial escrow statement required by Section 

3500.17(g). The statement must contain the following:

• Amount of monthly payment

• Portion of the monthly payment being placed in escrow

• Charges to be paid from the escrow account during the first 12 months

• Disbursement dates

• Amount of cushion

[Click&type]

33. Determine if the statement was given to the borrower at settlement or within 45 

days after the escrow account was established. This statement may be 

incorporated into the HUD-1 statement (§ 3500.17(g)(1) and (2)).

[Click&type]

34. Determine whether the institution performs an annual analysis of the escrow 

account (§ 3500.17(c)(3) and (7), and 3500.17(i)).

[Click&type]

35. Determine whether the annual escrow account statement is provided to the 

borrower within 30 days of the end of the computation year (§ 3500.17(i)).

[Click&type]

36. Determine if the annual escrow statement contains the following:

• Amount of monthly mortgage payment and portion that were placed in

escrow;

• Amount of past year’s monthly mortgage payment and portion that went into 

escrow;

• Total amount paid into escrow during the past computation year;

• Total amount paid out of escrow account during same period for taxes,
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 11

insurance, and other charges;

• Balance in the escrow account at the end of the period;

• How a surplus, shortage, or deficiency is to be paid/handled; and

• If applicable, the reason why estimated low monthly balance was not

reached (§ 3500.17(i)(1)).

[Click&type]

37. Determine whether monthly escrow payments following settlement are within the 

limits of § 3500.17(c).

[Click&type]
CFPB 

Examination Procedures RESPA

CFPB FFIEC 12/2009 RESPA 12

Examiner Conclusions

1. Summarize the findings, supervisory concerns and regulatory violations. 

[Click&type]

2. For the violations noted, determine the root cause by identifying weaknesses in 

internal controls, audit and compliance reviews, training, management oversight, 

or other factors. Determine whether the violation(s) are repetitive or systemic. 

[Click&type]

3. Identify action needed to correct violations and weaknesses in the institution’s 

compliance system. 

[Click&type]

4. Discuss findings with the institution’s management and, if necessary, obtain a 

commitment for corrective action. 

[Click&type]

5. Record violations according to agency policy in the EDS/ROE system to 

facilitate analysis and reporting. 

[Click&type]

Examiner’s Summary, Recommendations, and Comments 

[Click&type]
CFPB 

Examination Checklist RESPA

Yes No

CFPB FFIEC Rev. 12/2009 RESPA 1

Real Estate Settlement 

Procedures Act

1. Are written loan policies in connection with federally related mortgage loans in compliance with Regulation X? 

2. Does the institution have established operating procedures that address the requirements 

of Regulation X? 

3. Are mortgage lending personnel knowledgeable of the requirements of RESPA and 

Regulation X? 

Special Information Booklet

4. For applicable transactions, is the Special Information Booklet provided within three 

business days after the financial institution or broker receives or prepares a written application for a loan? 

Good Faith Estimate

5. Does the financial institution use the standard/required Good Faith Estimate form 

(GFE)? 

6. Is a GFE of charges for settlement services, if required, provided within three business 

days after an application is received or prepared? 

7. Does the GFE appear in the exact form as in Appendix C to Regulation X?

8. a. Does the GFE contain the following required elements:

i. Interest rate expiration date? 

ii. Settlement charges expiration date? 

iii. Rate lock period? 

iv. Number of days before settlement the interest rate must be locked,

if applicable? 

v. Summary of loan information? 

vi. Escrow account information? 

vii. Estimates for settlement charges? 

viii. Left hand column on trade-off table completed for loan in the GFE? 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Checklist RESPA

Yes No

CFPB FFIEC Rev. 12/2009 RESPA 2

b. For all loans, are all third-party fees, including those paid by the financial institution in the case of no cost loans, itemized and listed in the appropriate blocks on 

the second page of the GFE? 

c. Did the financial institution provide a separate sheet that identifies the settlement 

service providers for the services listed?

Affiliated Business Arrangements 

9. Does the financial institution refer borrowers to settlement service providers? 

10. If the institution refers borrowers to affiliated settlement service providers, is the Affiliated Business Disclosure statement provided to each borrower as set forth in Appendix 

D to Part 3500? 

11. Other than an attorney, credit reporting agency, or appraiser representing the lender, 

does the financial institution require the use of an affiliate? 

Uniform Settlement Statement Form (HUD-1 and HUD-1A)

12. Does the financial institution use the current Uniform Settlement Statement (HUD-1 

or HUD-1A) as appropriate? 

13. Does the HUD-1 or HUD-1A contain the following:

a. Charges properly itemized for both borrower and seller in accordance with the 

instructions for completion of the HUD-1 or HUD-1A? 

b. All charges paid to one other than the lender itemized and the recipient named?

c. Charges required by the financial institution but paid outside of closing, itemized 

on the settlement statement, marked as “paid outside of closing” or “P.O.C.,” but 

not included in totals? 

d. Where an average charge was listed for a settlement service, was the charge 

calculated in accordance with requirements set forth in § 3500.8(b)(2)?

14. From a review of the HUD-1 or HUD-1/A prepared in connection with each GFE 

reviewed, are amounts shown on the GFE the same as the fees actually paid by the

borrower? 

15. If a charge stated on the HUD-1/1A exceeds the charges stated on the GFE by more than 

the permitted tolerance, does the financial institution cure the tolerance violation by 

reimbursing the borrower the amount by which the tolerance was exceeded at settlement, or by delivering or placing the payment in the mail within 30 calendar days after 

settlement? 

16. If the financial institution conducts settlement: 
CFPB 

Examination Checklist RESPA

Yes No

CFPB FFIEC Rev. 12/2009 RESPA 3

a. Is the borrower, upon request, allowed to inspect the HUD-1 or HUD-1A at least 

one day prior to settlement? 

b. Is the HUD-1 or HUD-1A provided to the borrower and seller at settlement?

c. In cases where the right to delivery is waived or the transaction is exempt, is the 

statement mailed as soon as possible after settlement? 

17. In the case of an inadvertent or technical error on the HUD-1/1A, does the institution 

provide a revised HUD-1/1A to the borrower within 30 calendar days after settlement? 

18. If the financial institution retains its interest in the mortgage and/or services, is the 

HUD-1 or HUD-1A form retained for five years? 

19. If the financial institution disposes of its interest in the mortgage and does not service 

the loan, is the HUD-1/1A transferred to the new asset owner with the loan file? 

Mortgage Servicing Transfer Disclosure

20. Does the mortgage servicing transfer disclosure form language substantially conform to 

the model disclosure in Appendix MS-1 to Part 3500? 

21. Does the lender provide the mortgage servicing transfer disclosure within three business 

days after receipt of the application? 

22. Does the disclosure state whether the loan may be assigned or transferred while outstanding? 

Notice to Borrower of Transfer of Mortgage Servicing

23. If the institution has transferred servicing rights, was notice to the borrower given at 

least 15 days prior to the transfer? 

24. If the institution has received servicing rights, was notice given the borrower within 15

days after the transfer? 

25. Does the notice by transferor and transferee include the following information as 

contained in Appendix MS-2 to Part 3500:

a. The effective date of the transfer? 

b. The new servicer's name, address, and toll-free or collect call telephone number of 

the transferor servicer? 

c. A toll-free or collect call telephone number of the present servicer to answer 

inquiries relating to the transfer?

d. The date on which the present servicer will cease accepting payments and the date 

the new servicer will begin accepting payments relating to the transferred loan? 
CFPB 

Examination Checklist RESPA

Yes No

CFPB FFIEC Rev. 12/2009 RESPA 4

e. Any information concerning the effect of the transfer on the availability of 

terms of optional insurance and any action the borrower must take to maintain 

coverage?

f. A statement that the transfer does not affect the terms or conditions of the mortgage, other than terms directly related to its servicing? 

g. A statement of the borrower’s rights in connection with complaint resolution?

Responding to Borrower Inquiries

26. Have late fees been imposed within 60 days following a transfer of servicing or were 

payments treated as late when received by transferor rather than transferee? 

27. Does the institution respond to borrower inquiries relating to servicing of RESPA 

covered mortgage loans and refinancings as prescribed in the regulation? 

Specifically, does the institution:

a. Provide a written response acknowledging receipt of a qualified written request 

from a borrower for information relating to the servicing of the loan within 20

business days? 

b. If not, has the action requested by the borrower been taken within the 20-business 

day period?

c. Within 60 business days after the receipt of a qualified written request, does 

the institution make appropriate corrections in the account of the borrower and 

provide a written notification of the correction (including in the notice the name 

and the telephone number of a representative of the institution who can provide 

assistance)? 

or

Provide the borrower with a written explanation:

i. Stating the reasons the account is correct (including the name and telephone 

number of a representative of the institution who can provide assistance)? 

or

ii. Explaining why the information requested is unavailable or cannot be obtained by the institution (including the name and telephone number of a representative of the institution who can provide assistance)? 

28. Does the institution provide information regarding an overdue payment to any consumer 

reporting agency during the 60-day period beginning on the date the institution 

received any qualified written request relating to a dispute regarding the borrower's 

payments? 
CFPB 

Examination Checklist RESPA

Yes No

CFPB FFIEC Rev. 12/2009 RESPA 5

Escrow Accounts

29. Does the institution perform an escrow analysis at the creation of the escrow account? 

30. Is the initial escrow statement given to the borrower at settlement or within 45 days 

after the escrow account is established? 

31. For continuing escrow arrangements, is an annual escrow statement provided to the 

borrower at least once every 12 months? 

32. Does the initial escrow statement itemize:

a. Amount of monthly mortgage payment?

b. Portion of the monthly payment being placed in escrow?

c. Charges to be paid from the escrow account during the first 12 months?

d. Disbursement date?

e. Amount of cushion? 

33. Is the annual escrow statement provided within 30 days of the completion of the escrow 

account computation year? 

34. Does the annual escrow statement itemize:

a. Current mortgage payment and portion going to escrow?

b. Amount of last year’s mortgage payment and portion that went to escrow?

c. Total amount paid into the escrow account during the past computation year?

d. Total amount paid from the escrow account during the year for taxes, insurance 

premiums, and other charges?

e. Balance in the escrow account at the end of the period?

f. Explanation of how any surplus is being handled?

g. Explanation of how any shortage or deficiency is to be paid by the borrower?

h. If applicable, the reason(s) why the estimated low monthly balance was not 

reached?

35. Are monthly escrow payments following settlement no larger than 1/12 of the amount 

expected to be paid for taxes, insurance premiums, and other charges in the following 12

months, plus 1/6 of that amount? 
CFPB 

Examination Checklist RESPA

Yes No

CFPB FFIEC Rev. 12/2009 RESPA 6

36. Does the servicer notify the borrower at least annually of any shortage or deficiency in 

the escrow account? 

37. Does the institution make payments from the escrow account for taxes, insurance premiums and other charges in a timely manner as they become due? 

No Fees for RESPA Disclosures

38. Does the financial institution charge a fee specifically for preparing and distributing the 

HUD-1 forms, escrow statements or documents required under the Truth in Lending 

Act? 

a. If a fee is charged for a GFE, is the fee limited to the cost of a credit report? 

Purchase of Title Insurance

39. When the financial institution owns the property being sold, does it require that title insurance is required from a particular company? 

Payment or Receipt of Referral or Unearned Fees

40. Is institution management aware of the prohibitions against payment or receipt of kickbacks and unearned fees? 

41. Are federally related mortgage loan transactions referred by brokers, affiliates, or other 

parties?

or

Does the institution refer services to brokers, affiliates, or other parties?

42. If fees were paid to the institution or any parties identified, were all fees paid to the broker, affiliate, service provider, or other party consistent with all the requirements of Section 3500.14 (g) and for goods or facilities actually furnished or services actually 

performed? 

Comments

[Click&type]
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 1

Homeowners Protection Act (PMI Cancellation Act)

I. BACKGROUND

The Homeowners Protection Act of 1998 (HPA or PMI Cancellation Act, or Act) was signed into law

on July 29, 1998, became effective on July 29, 1999, and was later amended on December 27, 2000,

to provide technical corrections and clarification. The “PMI Cancellation Act” addresses homeowners’

difficulties in canceling private mortgage insurance (PMI)

1 coverage. It establishes provisions for

canceling and terminating PMI, sets disclosure and notification requirements, and requires the return 

of unearned premiums.

The Dodd-Frank Act granted authority to the CFPB to supervise for and enforce compliance with the 

Homeowners Protection Act with respect to entities within its jurisdiction.

2

PMI is insurance that protects lenders from the risk of default and foreclosure. PMI allows

prospective buyers who cannot, or choose not to, provide significant down payments to obtain

mortgage financing at affordable rates. It is used extensively to facilitate “high-ratio” loans

(generally, loans in which the loan to value (LTV) ratio exceeds 80 percent). With PMI, the lender

can recover costs associated with the resale of foreclosed property, and accrued interest payments or

fixed costs, such as taxes or insurance policies, paid prior to resale.

Excessive PMI coverage provides little extra protection for a lender and does not benefit the borrower. 

In some instances, homeowners have experienced problems in canceling PMI. At other times, lenders 

may have agreed to terminate coverage when the borrower’s equity reached 20 percent, but the

policies and procedures used for canceling or terminating PMI coverage varied widely among lenders. 

Prior to the Act, homeowners had limited recourse when lenders refused to cancel their PMI

coverage. Even homeowners in the few states that had laws pertaining to PMI cancellation or

termination noted difficulties in canceling or terminating their PMI policies. The Act now protects 

homeowners by prohibiting life of loan PMI coverage for borrower-paid PMI products and

establishing uniform procedures for the cancellation and termination of PMI policies.

II. SCOPE AND EFFECTIVE DATE

The Act applies primarily to “residential mortgage transactions,” defined as mortgage loan transactions 

consummated on or after July 29, 1999, to finance the acquisition, initial construction or refinancing3 of 

a single-family dwelling that serves as a borrower’s principal residence.4 The Act also includes 

 

1 The Act does not apply to mortgage insurance made available under the National Housing Act, title 38 of the United States Code, or

title V of the Housing Act of 1949. This includes mortgage insurance on loans made by the Federal Housing Administration and

guarantees on mortgage loans made by the Veterans Administration.

2 Dodd-Frank Act, §§ 1002(12)(G), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12)(G), 5514(c), and 5515(c).

3 For purposes of these procedures, “refinancing” means the refinancing of loans any portion of which was to provide financing for the

acquisition or initial construction of a single-family dwelling that serves as a borrower’s principal residence. See 15 USCC 1601 et. seq.

and 12 CFR 226.20.

4 For purposes of these procedures, junior mortgages that provide financing for the acquisition, initial construction or refinancing of a 

single-family dwelling that serves as a borrower’s primary residence are covered.
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 2

provisions for annual written disclosures for “residential mortgages,” defined as mortgages, loans or 

other evidences of a security interest created for a single-family dwelling that is the principal residence 

of the borrower (12 USC 4901(14) and (15)). A condominium, townhouse, cooperative or mobile home 

is considered to be a single-family dwelling covered by the Act.

The Act’s requirements vary depending on whether a mortgage is:

• A “residential mortgage” or a “residential mortgage transaction;”

• Defined as high risk (either by the lender in the case of nonconforming loans, or Fannie Mae and 

Freddie Mac in the case of conforming loans);

• Financed under a fixed rate or an adjustable rate; or

• Covered by borrower-paid private mortgage insurance (BPMI) or lender-paid private mortgage 

insurance (LPMI).5

III. CANCELLATION AND TERMINATION OF PMI FOR NONHIGH RISK RESIDENTIAL MORTGAGE TRANSACTIONS

A. Borrower Requested Cancellation

A borrower may initiate cancellation of PMI coverage by submitting a written request to the servicer. 

The servicer must take action to cancel PMI when the cancellation date occurs, which is when the 

principal balance of the loan reaches (based on actual payments) or is first scheduled to reach 80 

percent of the “original value,”6 irrespective of the outstanding balance, based upon the initial

amortization schedule (in the case of a fixed rate loan) or amortization schedule then in effect (in the 

case of an adjustable rate loan),7 or any date thereafter that:

• The borrower submits a written cancellation request;

• The borrower has a good payment history;

8

• The borrower is current;

9 and

• The borrower satisfies any requirement of the mortgage holder for: (i) evidence of a type 

established in advance that the value of the property has not declined below the original value; and

(ii) certification that the borrower’s equity in the property is not subject to a subordinate lien (12 

USC 4902(a)(4)).

 

5 All sections of these procedures and manual apply to BPMI. For LPMI, relevant sections begin under the heading that follows thereafter.

6 “Original value” is defined as the lesser of the sales price of the secured property as reflected in the purchase contract or, the appraised 

value at the time of loan consummation. In the case of a refinancing, the term means the appraised value relied upon by the lender to 

approve the refinance transaction.

7 The Act includes as an adjustable rate mortgage, a balloon loan that “contains a conditional right to refinance or modify the unamortized 

principal at the maturity date.” Therefore, if a balloon loan contains a conditional right to refinance, the initial disclosure for an adjustable 

rate mortgage would be used even if the interest rate is fixed.

8 A borrower has a good payment history if the borrower: (1) has not made a payment that was 60 days or more past due within the first 

12 months of the last 2 years prior to the later of the cancellation date, or the date that the borrower request cancellation; or (2) has not 

made a payment that was 30 days or more past due within the 12 months prior to the later of the cancellation date or the date that the 

borrower requests cancellation.

9 The Act does not define current.
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 3

Once PMI is canceled, the servicer may not require further PMI payments or premiums more than 30 

days after the later of: (i) the date on which the written request was received or (ii) the date on which 

the borrower satisfied the evidence and certification requirements of the mortgage holder described 

previously (12 USC 4902(e)(1)).

B. Automatic Termination

The Act requires a servicer to automatically terminate PMI for residential mortgage transactions on

the date that:

• The principal balance of the mortgage is first scheduled to reach 78 percent of the original value of

the secured property (based solely on the initial amortization schedule in the case of a fixed rate

loan or on the amortization schedule then in effect in the case of an adjustable rate loan, 

irrespective of the outstanding balance) if the borrower is current; or

• If the borrower is not current on that date, on the first day of the first month following the date that 

the borrower becomes current (12 USC 4902(b)).

If PMI is terminated, the servicer may not require further payments or premiums of PMI more than 30 

days after the termination date or the date following the termination date on which the borrower 

becomes current on the payments, whichever is sooner (12 USC 4902(e)(2)).

There is no provision in the automatic termination section of the Act, as there is with the borrowerrequested PMI cancellation section that protects the lender against declines in property value or 

subordinate liens. The automatic termination provisions make no reference to good payment history (as 

prescribed in the borrower-requested provisions), but state only that the borrower must be current

on mortgage payments (12 USC 4902(b)).

C. Final Termination

If PMI coverage on a residential mortgage transaction was not canceled at the borrower’s request or

by the automatic termination provision, the servicer must terminate PMI coverage by the first day of

the month immediately following the date that is the midpoint of the loan’s amortization period if, on

that date, the borrower is current on the payments required by the terms of the mortgage. (If the

borrower is not current on that date, PMI should be terminated when the borrower does become 

current.)

The midpoint of the amortization period is halfway through the period between the first day of the 

amortization period established at consummation and ending when the mortgage is scheduled to be 

amortized. The servicer may not require further payments or premiums of PMI more than 30 days 

after PMI is terminated (12 USC 4902(e)(3)).

D. Loan Modifications

If a borrower and mortgage holder agree to modify the terms and conditions of a loan pursuant to a 

residential mortgage transaction, the cancellation, termination or final termination dates shall be 

recalculated to reflect the modification (12 USC 4902(d)).
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 4

E. Exclusions

The Act’s cancellation and termination provisions do not apply to residential mortgage transactions

for which Lender Paid Mortgage Insurance (LPMI) is required (12 USC 4905(b).

F. Return of Unearned Premiums

The servicer must return all unearned PMI premiums to the borrower within 45 days after cancellation 

or termination of PMI coverage. Within 30 days after notification by the servicer of cancellation or 

termination of PMI coverage, a mortgage insurer must return to the servicer any amount of unearned 

premiums it is holding to permit the servicer to return such premiums to the borrower (12 USC

4902(f)).

G. Accrued Obligations for Premium Payments

The cancellation or termination of PMI does not affect the rights of any lender, servicer or mortgage 

insurer to enforce any obligation of a borrower for payments of premiums that accrued before the 

cancellation or termination occurred (12 USC 4902 (h)).

IV. EXCEPTIONS TO CANCELLATION AND TERMINATION 

PROVISIONS FOR HIGH RISK RESIDENTIAL MORTGAGE 

TRANSACTIONS

The borrower-requested cancellation at 80 percent LTV and the automatic termination at 78 percent 

LTV requirements of the Act do not apply to “high risk” loans. However, high risk loans are subject to 

final termination and are divided into two categories – conforming (Fannie Mae/Freddie Macdefined high-risk loans) and nonconforming (lender-defined high-risk loans) (12 USC 4902(g)(1)).

A. Conforming Loans (Fannie Mae/Freddie Mac-Defined High 

Risk Loans)

Conforming loans are those loans with an original principal balance not exceeding Freddie Mac’s

and Fannie Mae’s conforming loan limits.10 Fannie Mae and Freddie Mac are authorized under the

Act to establish a category of residential mortgage transactions that are not subject to the Act’s

requirements for borrower-requested cancellation or automatic termination, because of the high risk

associated with them.11 They are, however, subject to the final termination provision of the Act. As

such, PMI on a conforming high risk loan must be terminated by the first day of the month

following the date that is the midpoint of the loan’s initial amortization schedule (in the case of a

fixed rate loan) or amortization schedule then in effect (in the case of an adjustable rate loan) if, on

that date, the borrower is current on the loan. (If the borrower is not current on that date, PMI should

be terminated when the borrower does become current.)

 

10 The limit was $322,700 in 2003.

11 Fannie Mae and Freddie Mac have not defined high-risk loans as of the date of this publication.
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 5

B. Nonconforming Loans (Lender-Defined High Risk Loans)

Nonconforming loans are those residential mortgage transactions that have an original principal 

balance exceeding Freddie Mac’s and Fannie Mae’s conforming loan limits. Lender-defined high risk

loans are not subject to the Act’srequirements for borrower-requested cancellation or automatic

termination. However, if a residential mortgage transaction is a lender-defined high risk loan, PMI

must be terminated on the date on which the principal balance of the mortgage, based solely on the

initial amortization schedule (in the case of a fixed rate loan) or the amortization schedule then in

effect (in the case of an adjustable rate loan) for that mortgage and irrespective of the outstanding

balance for that mortgage on that date, is first scheduled to reach 77 percent of the original value of

the property securing the loan.

Like conforming loans that are determined to be high risk by Freddie Mac and Fannie Mae, a 

residential mortgage transaction that is a lender-defined high risk loan is subject to the final

termination provision of the Act.

C. Notices

The lender must provide written initial disclosures at consummation for all high-risk residential 

mortgage transactions (as defined by the lender or Fannie Mae or Freddie Mac), that in no case

will PMI be required beyond the midpoint of the amortization period of the loan, if the loan is

current. The Act does not require a more specific notice as to the 77 percent LTV termination

standards for lender defined high-risk loans.

V. BASIC DISCLOSURE AND NOTICE REQUIREMENTS 

APPLICABLE TO RESIDENTIAL MORTGAGE

TRANSACTIONS AND RESIDENTIAL MORTGAGES

The Act requires the lender in a residential mortgage transaction to provide to the borrower, at the time 

of consummation, certain disclosures that describe the borrower’s rights for PMI cancellation and 

termination. A borrower may not be charged for any disclosure required by the Act. Initial disclosures 

vary, based upon whether the transaction is a fixed rate mortgage, adjustable rate mortgage or highrisk loan. The Act also requires that the borrower be provided with certain annual and other

notices concerning PMI cancellation and termination. Residential mortgages are subject to certain

annual disclosure requirements.

A. Initial Disclosures for Fixed Rate Residential Mortgage 

Transactions

When PMI is required for non-high risk fixed rate mortgages, the lender must provide to the borrower 

at the time the transaction is consummated: (i) a written initial amortization schedule, and (ii) a written 

notice that discloses:

• The borrower’s right to request cancellation of PMI, and, based on the initial amortization 

schedule, the date the loan balance is scheduled to reach 80 percent of the original value of the 

property;
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 6

• The borrower’s right to request cancellation on an earlier date, if actual payments bring the loan 

balance to 80 percent of the original value of the property sooner than the date based on the initial 

amortization schedule;

• That PMI will automatically terminate when the LTV ratio reaches 78 percent of the original 

value of the property and the specific date that is projected to occur (based on the initial 

amortization schedule); and

• The Act provides for exemptions to the cancellation and automatic termination provisions for highrisk mortgages and whether these exemptions apply to the borrower’s loan (12 USC

4903(a)(1)(A)).

B. Initial Disclosures for Adjustable Rate Residential Mortgage

Transactions

When PMI is required for non-high risk adjustable rate mortgages, the lender must provide to the 

borrower, at the time the transaction is consummated, a written notice that discloses:

• The borrower’s right to request cancellation of PMI on (i) the date the loan balance is first 

scheduled to reach 80 percent of the original value of the property based on the amortization 

schedule then in effect or (ii) the date the balance actually reaches 80 percent of the original 

value of the property based on actual payments. The notice must also state that the servicer will notify 

the borrower when either (i) or (ii) occurs;

• That PMI will automatically terminate when the loan balance is first scheduled to reach 78 

percent of the original value of the property based on the amortization schedule then in effect. The

notice must also state that the borrower will be notified when PMI is terminated (or that 

termination will occur when the borrower becomes current on payments); and

• That there are exemptions to the cancellation and automatic termination provisions for high risk

mortgages and whether such exemptions apply to the borrower’s loan (12 USC 4903(a)(1)(B)).

C. Initial Disclosures for High Risk Residential Mortgage 

Transactions

When PMI is required for high risk residential mortgage transactions, the lender must provide to the 

borrower a written notice stating that PMI will not be required beyond the date that is the midpoint of 

the loan’s amortization period if, on that date, the borrower is current on the payments as required by 

the terms of the loan. The lender must provide this notice at consummation. The lender need not 

provide disclosure of the termination at 77 percent LTV for lender defined high risk mortgages (12

USC 4903(a)(2)).

D. Annual Disclosures for Residential Mortgage Transactions

For all residential mortgage transactions, including high risk mortgages for which PMI is required,

the servicer must provide the borrower with an annual written statement that sets forth the rights of

the borrower to PMI cancellation and termination and the address and telephone number that the 

borrower may use to contact the servicer to determine whether the borrower may cancel PMI (12 USC

4903(a)(3)).
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 7

E. Disclosures for Existing Residential Mortgages

When PMI was required for a residential mortgage consummated before July 29, 1999, the servicer 

must provide to the borrower an annual written statement that:

• States that PMI may be canceled with the consent of the lender or in accordance with state law; and

• Provides the servicer’s address and telephone number, so that the borrower may contact the 

servicer to determine whether the borrower may cancel PMI (12 USC 4903(b)).

VI. NOTIFICATION UPON CANCELLATION OR TERMINATION 

OF PMI RELATING TO RESIDENTIAL MORTGAGE 

TRANSACTIONS

A. General

The servicer must, not later than 30 days after PMI relating to a residential mortgage transaction is 

cancelled or terminated, notify the borrower in writing that:

12

• PMI has terminated and the borrower no longer has PMI and

• No further premiums, payments, or other fees are due or payable by the borrower in connection with 

PMI (12 USC 4904(a)).

B. Notice of Grounds/Timing

If a servicer determines that a borrower in a residential mortgage transaction does not qualify for PMI 

cancellation or automatic termination, the servicer must provide the borrower with a written notice of 

the grounds relied on for that determination. If an appraisal was used in making the determination, the 

servicer must give the appraisal results to the borrower. If a borrower does not qualify for cancellation, 

the notice must be provided not later than 30 days following the later of: (i) the date the borrower’s 

request for cancellation is received; or (ii) the date on which the borrower satisfies any evidence

and certification requirements of the mortgage holder. If the borrower does not meet the requirements

for automatic termination, the notice must be provided not later than 30 days following the

scheduled termination date (12 USC 4904(b)).

 

12 For adjustable rate mortgages, the initial notice to borrowers must state that the servicer will notify the borrower when the 

cancellation and automatic termination dates are reached (12 USC 4903(a)(1)(B)). Servicers should take care that the appropriate

notices are made to borrowers when those dates are reached.
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 8

VII. DISCLOSURE REQUIREMENTS FOR LENDER PAID 

MORTGAGE INSURANCE

A. Definitions

Borrower paid mortgage insurance (BPMI) means PMI that is required for a residential mortgage

transaction, the payments for which are made by the borrower.

Lender paid mortgage insurance (LPMI) means PMI that is required for a residential mortgage

transaction, the payments for which are made by a person other than the borrower.

Loan commitment means a prospective lender’s written confirmation of its approval, including any 

applicable closing conditions, of the application of a prospective borrower for a residential

mortgage loan (12 USC 4905(a)).

B. Initial Notice

In the case of LPMI required for a residential mortgage transaction, the Act requires that the lender 

provide a written notice to the borrower not later than the date on which a loan commitment is made. 

The written notice must advise the borrower of the differences between LPMI and BPMI by notifying 

the borrower that LPMI:

• Differs from BPMI because it cannot be cancelled by the borrower or automatically terminated as 

provided under the Act;

• Usually results in a mortgage having a higher interest rate than it would in the case of BPMI; and

• Terminates only when the mortgage is refinanced, (as that term is defined in the Truth in 

Lending Act, 15 USC 1601 et seq., and Regulation Z, 12 CFR 226.20), paid off, or otherwise 

terminated.

The notice must also provide:

• That LPMI and BPMI have both benefits and disadvantages;

• A generic analysis of the costs and benefits of a mortgage in the case of LPMI versus BPMI over

a ten-year period, assuming prevailing interest and property appreciation rates; and

• That LPMI may be tax-deductible for federal income taxes, if the borrower itemizes expenses for 

that purpose (12 USC 4905(c)(1)).

C. Notice at Termination Date

Not later than 30 days after the termination date that would apply in the case of BPMI, the servicer 

shall provide to the borrower a written notice indicating that the borrower may wish to review 

financing options that could eliminate the requirement for LPMI in connection with the mortgage (12

USC 4905(c)(2)).

VIII. FEES FOR DISCLOSURES

As stated previously, no fee or other cost may be imposed on a borrower for the disclosures or 

notifications required to be given to a borrower by lenders or servicers under the Act (12 USC 4906).
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 9

IX. CIVIL LIABILITY

A. Liability Dependent upon Type of Action

Servicers, lenders, and mortgage insurers that violate the Act are liable to borrowers as follows:

• Individual Action

In the case of individual borrowers:

⎯ Actual damages (including interest accruing on such damages);

⎯ Statutory damages not to exceed $2,000;

⎯ Costs of the action; and

⎯ Reasonable attorney fees.

• Class Action

In the case of a class action suit against a defendant that is subject to Section 10 of the Act,

(i.e., regulated by the federal banking agencies, NCUA or the Farm Credit Administration):

⎯ Such statutory damages as the court may allow up to the lesser of $500,000 or 1 percent

of the liable party’s net worth;

⎯ Costs of the action; and

⎯ Reasonable attorney fees.

In the case of a class action suit against a defendant that is not subject to Section 10 of the Act,

(i.e., not regulated by the federal banking agencies, NCUA, or the Farm Credit Administration):

⎯ Actual damages (including interest accruing on such damages);

⎯ Statutory damages up to $1,000 per class member but not to exceed the lesser of (i)

$500,000 or (ii) 1 percent of the liable party’s gross revenues;

⎯ Costs of the action; and

⎯ Reasonable attorney fees (12 USC 4907(a))

B. Statute of Limitation

A borrower must bring an action under the Act within two years after the borrower discovers the 

violation (12 USC 4907(b))

C. Mortgage Servicer Liability Limitation

A servicer shall not be liable for its failure to comply with the requirements of the Act if the

servicer’s failure to comply is due to the mortgage insurer’s or lender’s failure to comply with the

Act (12 USC 4907(c)).
CFPB Consumer

Laws and Regulations HPA

CFPB FFIEC Rev. 1/2004 HPA 10

X. ENFORCEMENT

The Dodd-Frank Act directs the CFPB to enforce Federal consumer financial laws and specifically

enumerates HPA as one of those laws.

13

HPA also directs the federal banking agencies to enforce the Act under 12 USC 1818 or any other 

authority conferred upon the agencies by law. Under HOPA the agencies shall:

• Notify applicable lenders or servicers of any failure to comply with the Act;

• Require the lender or servicer, as applicable, to correct the borrower’s account to reflect the date on 

which PMI should have been canceled or terminated under the Act; and

• Require the lender or servicer, as applicable, to return unearned PMI premiums to a borrower who 

paid premiums after the date on which the borrower’s obligation to pay PMI premiums ceased under 

the Act (12 USC 4909).

References

Laws

12 USC 4901 et seq. Homeowners Protection Act

 

13 CFPA, §§ 1002(12)(G), 1024(c), and 1025(c); 12 USC §§ 5481(12)(G), 5514(c), and 5515(c).
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 1

EXAMINATION OBJECTIVES 

• To determine the financial institution’s compliance with the Homeowners Protection Act of 

1998 (HPA), as amended.

• To assess the quality of the financial institution’s policies and procedures for implementing 

the HPA.

• To determine the reliance that can be placed on the financial institution’s internal controls 

and procedures for monitoring the institution’s compliance with the HPA. 

• To initiate corrective action when violations of HPA are identified, or when policies or internal controls are deficient.

EXAMINATION PROCEDURES

1. Through discussions with management and review of available information, 

determine if the institution’s internal controls are adequate to ensure compliance 

with the HPA. Consider the following:

Organization charts

Process flowcharts

Policies and procedures

Loan documentation

Checklists

Training

Computer program documentation

[Click&type]

2. Review any compliance audit material, including work papers and reports, to 

determine whether:

The institution's procedures address all applicable provisions of HPA;

Steps are taken to followup on previously identified deficiencies;

The procedures used include samples covering all product types and decision 

centers;

The compliance audit work performed is accurate; 

Significant deficiencies and their causes are included in reports to management 

and/or to the Board of Directors;

Corrective action is taken in a timely and appropriate manner; and

The frequency of compliance review is appropriate.

[Click&type]

3. Review sample transactions, disclosure and notification forms, and the financial 

institution’s policies and procedures to ensure the institution provides:

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 2

Initial Disclosures for (i) fixed rate mortgages, (ii) adjustable rate mortgages, (iii) 

high risk loans, and (iv) lender paid mortgage insurance; 

Annual Notices for (i) fixed and adjustable rate mortgages and high risk loans, 

and (ii) existing residential mortgages; and

Notices of (i) cancellation, (ii) termination, (iii) grounds for not canceling PMI, 

(iv) grounds for not terminating PMI, (v) cancellation date for adjustable rate 

mortgages, and (vi) termination date for lender paid mortgage insurance.

(Refer to Appendix A for required content of the disclosure and notices.)

[Click&type]

4. Using the above sample and bank policies and procedures, determine that 

borrowers are not charged for any required disclosures or notifications (12 USC 

4906).

[Click&type]

5. Obtain and review a sample of recent written requests from borrowers to 

cancel their private mortgage insurance (PMI) on “non-high risk” residential 

mortgage transactions. Verify that the insurance was cancelled on either (a) 

the date on which the principal balance of the loan was first scheduled to reach 

80 percent of the original value of the property based on the initial 

amortization schedule (in the case of a fixed rate loan) or amortization 

schedule then in effect (in the case of an adjustable rate loan) or (b) the date 

on which the principal balance of the loan actually reached 80 percent of the 

original value of the property based on actual payments, in accordance with

the applicable provisions in 12 USC 4902(a)of HPA (i.e., good payment 

history, current payments and, if required by the lender, evidence that the 

value of the mortgaged property did not decline, and certification that the 

borrower’s equity was unencumbered by a subordinate lien) (12 USC 

4902(a)).

[Click&type]
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 3

6. Obtain and review a sample of “non-high risk” PMI residential mortgage 

transactions where the borrower did not request cancellation. Select loans 

from the sample that have reached a 78 percent or lower LTV ratio based on 

the original value of the property and that are not current. Verify that PMI was 

terminated, based on the initial amortization schedule (in the case of a fixed 

rate loan) or the amortization schedule then in effect (in the case of an 

adjustable rate loan) on the date that the principal balance of the loan was first 

scheduled to reach 78 percent of the original value of the mortgaged property 

(if the borrower was current) or on the first day of the first month after the 

date that the borrower became current (12 USC 4902(b)).

[Click&type]

7. Obtain a sample of PMI-covered residential mortgage transactions (including 

high-risk loans, if any) that are at or beyond the midpoint of their amortization 

period. Determine whether PMI was terminated by the first day of the 

following month if the loan was current. If the loan was not current at the 

midpoint, determine that PMI was terminated by the first day of the month 

following the day the loan became current. If, at the time of the examination, a 

loan at the midpoint is not current, determine whether the financial institution 

is monitoring the loan and has systems in place to ensure that PMI is 

terminated when the borrower becomes current (12 USC 4902(c) and 12 USC 

4902(g)(2)).

[Click&type]

8. Obtain a sample of any lender defined “high risk” PMI residential mortgage 

transactions that have a 77 percent or lower LTV based on the original value 

of the property. Verify that PMI was cancelled, based on the initial 

amortization schedule (in the case of a fixed rate loan) or the amortization 

schedule then in effect (in the case of an adjustable rate loan), on the date that 

the principal balance of the loan was scheduled to reach 77 percent of the 

original value of the mortgaged property (12 USC 4902(g)(1)(B)). 

[Click&type]
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 4

9. Obtain a sample of loans that have had PMI cancelled or terminated (the samples 

obtained above can be used). For PMI loans cancelled upon the borrowers’ 

requests, determine that the financial institution did not require any PMI 

payment(s) beyond 30 days of the borrower satisfying the evidence and 

certification requirements to cancel PMI (12 USC 4902(e)(1). For the PMI loans 

that received automatic termination or final termination, determine that the 

financial institution did not require any PMI payment(s) beyond 30 days of 

termination (12 USC 4902(e)(2) and 12 USC 4902(e)(3)).

[Click&type]

10. Using the samples in steps 5, 6, and 7, determine if the financial institution 

returned unearned premiums, if any, to the borrower within 45 days after 

cancellation or termination (12 USC 4902(f)(1)).

[Click&type]

CONCLUSIONS

1. Summarize all violations and internal deficiencies.

[Click&type]

2. If the violation(s) and internal deficiencies noted above represent(s) a pattern or 

practice, determine the root cause by identifying weaknesses in internal controls, 

compliance review, training, management oversight, or other factors.

[Click&type]

3. Identify action needed to correct violations and weaknesses in the institution’s 

compliance system, as appropriate.

[Click&type]

4. Discuss findings with the institution’s management and obtain a commitment for 

corrective action.

[Click&type]

5. Determine if enforcement action is appropriate. If so, contact appropriate agency 

personnel for guidance. Section 10(c) of the Act contains a provision requiring 

restitution of unearned PMI premiums. 

[Click&type]
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 5

EXAMINER’S SUMMARY, RECOMMENDATIONS, AND COMMENTS 

[Click&type]
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 6

APPENDIX A

HOMEOWNERS PROTECTION ACT

This appendix provides guidance about the timing and required content of disclosures and notices 

to be made in connection with the Act.

1. Initial disclosures at consummation for fixed rate residential mortgage transactions must include:

a. A written amortization schedule (12 USC 4903(a)(1)(A)(i)).

b. A notice that the borrower may submit a written request to cancel PMI as of the date that,

based on the initial amortization schedule, the principal balance is first scheduled to reach 

80% of the original value of the mortgaged property, irrespective of the outstanding balance of the mortgage, or such earlier date that, based on actual payments, the principal 

balance actually reaches 80% of the original value of the mortgaged property and the borrower has a good payment history and has satisfied the lender’s requirements that the 

value of the mortgaged property has not declined and is unencumbered by subordinate 

liens (12 USC 4903(a)(1)(A)(ii)(I) and (II)).

c. The specific date, based on the initial amortization schedule, the loan balance is scheduled to reach 80% of the original value of the mortgaged property (12 USC 

4903(a)(1)(A)(ii)(I)).

d. A notice that PMI will automatically terminate on the date that, based on the amortization 

schedule and irrespective of the outstanding balance of the mortgage, the principal balance is first scheduled to reach 78% of the original value of the mortgaged property if the 

loan is current (12 USC 4903(a)(1)(A)(ii)(III)).

e. The specific date the loan balance is scheduled to reach 78% LTV (12 USC 

4903(a)(1)(A)(ii)(III)).

f. Notice that exemptions to the right to cancel and automatic termination exist for high-risk 

loans and whether such exemptions apply (12 USC 4903(a)(1)(A)(ii)(IV)).
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 7

2. Initial disclosures at consummation for adjustable rate residential mortgage transactions 

must include a notice that:

a. The borrower may submit a written request to cancel PMI as of the date that, based on the 

amortization schedule(s) and irrespective of the outstanding balance of the mortgage, the 

principal balance is first scheduled to reach 80% of the original value of the mortgaged 

property or such earlier date that, based on actual payments, the principal balance actually 

reaches 80% of the original value of the mortgaged property and the borrower has a good 

payment history and has satisfied the lender requirements that the value of the mortgaged

property has not declined and is unencumbered by subordinate liens (12 USC 

4903(a)(1)(B)(i)).

b. The servicer will notify the borrower when the cancellation date is reached, i.e., when the 

loan balance represents 80% of the original value of the mortgaged property (12 USC

4903(a)(1)(B)(i)).

c. PMI will automatically terminate when the loan balance is first scheduled to reach 78% 

of the original value of the mortgaged property irrespective of the outstanding balance of 

the mortgage and the loan is current (12 USC 4903(a)(1)(B)(ii)).

d. On the termination date, the borrower will be notified of the termination or the fact that 

PMI will be terminated when the loan is brought current (12 USC 4903(a)(1)(B)(ii)).

e. Exemptions to the right to cancel and automatic termination exist for high-risk loans and 

whether such exemptions apply (12 USC 4903(a)(1)(B)(iii)).

3. Lender has established standards regarding the type of evidence it requires borrowers to provide to demonstrate that the value of the mortgage property has not declined and they are 

provided when a request for cancellation occurs (12 USC 4902(a)(3)(A)).

4. Lender provides written initial disclosures at consummation for high-risk residential mortgage transactions (as defined by the lender or Fannie Mae or Freddie Mac), that PMI will not 

be required beyond the midpoint of the amortization period of the loan, if the loan is current 

(12 USC 4903(a)(2)).

5. When the financial institution acts as servicer for residential mortgage transactions, it provides an annual written statement to the borrowers explaining their rights to cancel or 

terminate PMI and an address and telephone number to contact the servicer to determine 

whether they may cancel PMI (12 USC 4903(a)(3)). 

NOTE: This disclosure may be included on RESPA’s annual escrow account disclosure or 

IRS interest payment disclosures.
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 8

6. When the financial institution acts as servicer, it provides an annual written statement to each 

borrower who entered into a residential mortgage prior to July 29, 1999, that includes:

a. A statement that PMI may, under certain circumstances, be canceled by the borrower with 

the consent of the lender or in accordance with applicable state law (12 USC 4903(b)(1)).

b. An address and telephone number that the borrower may use to contact the servicer to determine whether the borrower may cancel the PMI (12 USC 4903(b)(2)). 

NOTE: This disclosure may be included on RESPA’s annual escrow account disclosure 

or IRS interest payment disclosure.

7. When the financial institution acts as servicer for residential mortgage transactions, it provides borrowers written notices within 30 days after the date of cancellation or termination of 

PMI that the borrower no longer has PMI and that no further PMI payments or related fees 

are due (12 USC 4904(a)).

8. When the financial institution services residential mortgage transactions, it returns all unearned PMI premiums to the borrower within 45 days of either termination upon the 

borrower’s request or automatic termination under the HPA (12 USC 4902(e)).

9. When the financial institution acts as servicer for residential mortgage transactions, it provides borrowers written notices of the grounds it relied on (including the results of any 

appraisal) to deny a borrower’s request for PMI cancellation, no later than 30 days after the 

date the request is received, or the date on which the borrower satisfies any evidence and certification requirements established by the lender, whichever is later (12 USC 4904(b)(1) and 

12 USC 4904(b)(2)(A)).

10. When the financial institution acts as servicer for residential mortgage transactions, it provides borrowers written notices of the grounds it relied on (including the results of any 

appraisal) for refusing to automatically terminate PMI not later than 30 days after the scheduled termination date (12 USC 4904(b)(2)(B)).

NOTE: The scheduled termination date is reached when, based on the initial amortization 

schedule (in the case of a fixed rate loan) or the amortization schedule(s) (in the case of an 

adjustable rate loan), the principal balance of the loan is first scheduled to reach 78% of the 

original value of mortgaged property, assuming the borrower is current on that date or the 

earliest date thereafter on which the borrower becomes current.

11. When the financial institution acts as a servicer for adjustable rate residential mortgage transactions, the financial institution notifies borrowers that the cancellation date has been reached 

(12 USC 4903(a)(1)(B)(i)).

12. When the financial institution acts as a servicer for adjustable rate residential mortgage transactions, the financial institution notifies the borrowers on the termination date that PMI has 

been cancelled or will be cancelled as soon as the borrower is current on loan payments (12 

USC 4903(a)(1)(B)(ii)).

13. When the financial institution requires “Lender Paid Mortgage Insurance” (LPMI) for residential mortgage transactions, it provides a written notice to a prospective borrower on or 

before the loan commitment date that includes:
CFPB

Examination Procedures HPA

CFPB FFIEC Rev. 1/2004 HPA 9

a. A statement that LPMI differs from borrower paid mortgage insurance (BPMI) in that the 

borrower may not cancel LPMI, while BPMI is subject to cancellation and automatic 

termination under the HPA (12 USC 4905(c)(1)(A)).

b. A statement that LPMI usually results in a mortgage with a higher interest rate than 

BPMI (12 USC 4905(c)(1)(B)(i)).

c. A statement that LPMI only terminates when the transaction is refinanced, paid off, or 

otherwise terminated (12 USC 4905(c)(1)(B)(ii)).

d. A statement that LPMI and BPMI both have benefits and disadvantages and a generic 

analysis reflecting the differing costs and benefits of each over a 10-year period, assuming prevailing interest and property appreciation rates (12 USC 4905(c)(1)(C)).

e. A statement that LPMI may be tax-deductible for federal income taxes if the borrower 

itemizes expenses for that purpose (12 USC 4905(c)(1)(D)).

14. When the lender requires LPMI for residential mortgage transactions and the financial institution acts as servicer, it notifies the borrower in writing within 30 days of the termination 

date that would have applied if it were a BPMI transaction that the borrower may wish to review financing options that could eliminate the requirement for PMI (12 USC 4905(c)(2)).

15. The financial institution prohibits borrower-paid fees for the disclosures and notifications required under the HPA (12 USC 4906).
CFPB Consumer

Laws and Regulations CLA

CFPB FFIEC Rev. 12/2009 CLA 1

Consumer Leasing Act

Overview 

For consumers, leasing is an alternative to buying property either with cash or on credit. A lease is a 

contract between a lessor (the property owner) and a lessee (the property user) for the use of 

property subject to stated terms and limitations for a specified period and at a specified payment. 

The Consumer Leasing Act (15 USC 1667 et. seq.) (CLA) was passed in 1976 to assure that 

meaningful and accurate disclosure of lease terms is provided to consumers before entering into a 

contract. It applies to consumer leases of personal property. With this information, consumers can 

more easily compare one lease with another, as well as compare the cost of leasing with the cost of 

buying on credit or the opportunity cost of paying cash. In addition, the CLA puts limits on balloon 

payments sometimes due at the end of a lease and regulates advertising. 

Originally, the CLA was part of the Truth in Lending Act and was implemented by Regulation Z. 

When Regulation Z was revised in 1981, Regulation M was issued and contained those provisions 

that govern consumer leases. 

The Electronic Signatures in Global and National Commerce Act (the E-Sign Act), 15 USC 7001 et 

seq., was enacted in 2000 and did not require implementing regulations. On November 9, 2007, 

amendments to Regulation M and the official staff commentary were issued to simply the 

regulation and provide guidance on the electronic delivery of disclosures consistent with the E-Sign 

Act.1

The Dodd-Frank Act granted rulemaking authority under the CLA to the Consumer Financial 

Protection Bureau (CFPB) and, with respect to entities under its jurisdiction, granted authority to 

the CFPB to supervise for and enforce compliance with the CLA and its implementing regulations.2

Today, a relatively small number of banks engage in consumer leasing. The trend seems to be for 

leasing to be carried out through specialized bank subsidiaries, vehicle finance companies, other 

finance companies, or directly by retailers. 

 1

72 FR 63456, November 9, 2007. These amendments took effect December 10, 2007, with a mandatory compliance date of October 

1, 2008.

2

Dodd-Frank Act §§ 1002(12)(B), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12)(B), 5514(c), and 5515(c). These exam 

procedures do not include final amendments to Regulation M implementing Dodd Frank Act amendment to CLA that increased the 

threshold for exempt consumer leases from $25,000 to $50,000. This Regulation M amendment became effective on July 21, 2011. 

CFPB is working with prudential regulators to update exam procedures in a uniform manner as appropriate. 76 FR 18349 (April 4, 

2011 These procedures will be further modified in the future to reflect, as appropriate, the transfer of certain authorities from the 

Federal Reserve Board to the CFPB on July 21, 2011effected by the Dodd-Frank Act.
CFPB Consumer

Laws and Regulations CLA

CFPB FFIEC Rev. 12/2009 CLA 2

Key Definitions 

The definition of certain terms is necessary to understand the requirements imposed by the CLA. 

These terms include lease, lessor, lessee, consumer lease, open-end lease, closed-end lease, realized 

value, residual value, gross capitalized cost, capitalized cost reduction, and adjusted capitalized 

cost. 

Lessee 

A lessee is a natural person who enters into or is offered a consumer lease. 

Lessor 

A lessor is a natural person or organization who regularly leases, offers to lease, or arranges for the 

lease of personal property under a consumer lease. A person who leases or offers to lease more than 

five times in the preceding or current calendar year meets this definition. 

Consumer Lease 

A consumer lease is a contract between a lessor and a lessee:

• For the use of personal property by an individual (natural person);

• To be used primarily for personal, family, or household purposes;

• For a period of more than 4 months (week-to-week and month-to-month leases do not meet 

this criterion, even though they may be extended beyond 4 months); and 

• With a total contractual cost of no more than $25,000. 

Specifically excluded from coverage are leases that are:

• For business, agricultural or made to an organization or government;

• For real property;

• For personal property which are incidental to the lease of real property, subject to certain 

conditions; and

• For credit sales, as defined in Regulation Z Section 226.2(a)(16). 

A lease meeting all of these criteria is covered by the CLA and the Federal Reserve Board’s 

Regulation M. If any one of these criteria is not met, for example, if the leased property is used 

primarily for business purposes or if the total contractual cost exceeds $25,000, the CLA and 

Regulation M do not apply. 

Consumer leases fall into one of two categories: closed end and open end. Since the information 

required to be disclosed to the consumer will vary with the kind of lease, it is important to note the 

difference between them. However, to properly understand the difference, realized value and 

residual value must first be defined. 
CFPB Consumer

Laws and Regulations CLA

CFPB FFIEC Rev. 12/2009 CLA 3

Realized Value 

The realized value is the price received by the lessor of the leased property at disposition, the 

highest offer for disposition of the leased property, or the fair market value of the leased property at 

the end of the lease term. 

Residual Value 

The residual value is the value of the leased property at the end of the lease, as estimated or 

assigned at consummation of the lease by the lessor. 

Open-End Lease 

An open-end lease is a lease in which the amount owed at the end of the lease term is based on the 

difference between the residual value of the leased property and its realized value. The consumer 

may pay all or part of the difference if the realized value is less than the residual value or he may 

get a refund if the realized value is greater than the residual value at scheduled termination. 

Closed-End Lease 

A closed-end lease is a lease other than an open-end lease. This type of lease allows the consumer 

to “walk away” at the end of the contract period, with no further payment obligation – unless the 

property has been damaged or has sustained abnormal wear and tear. 

Gross Capitalized Cost 

The gross capitalized cost is the amount agreed upon by the lessor and lessee as the value of the 

leased property, plus any items that are capitalized or amortized during the lease term. These items 

may include taxes, insurance, service agreements, and any outstanding prior credit or lease balance. 

Capitalized Cost Reduction 

This term means the total amount of any rebate, cash payment, net trade-in allowance, and noncash 

credit that reduces the gross capitalized cost. 

Adjusted Capitalized Cost 

This is the gross capitalized cost less the capitalized cost reduction and the amount used by the 

lessor in calculating the base periodic payment. 

General Disclosure Requirements 

Lessors are required by federal law to provide the consumer with leasing cost information and other 

disclosures in a format similar to the model disclosure forms found in Appendix A to the regulation. 

Certain pieces of this information must be kept together and must be segregated from other lease 

information. All of the information stated must be accurate, clear and conspicuous, and provided in 

writing in a form that the consumer may keep. 
CFPB Consumer

Laws and Regulations CLA

CFPB FFIEC Rev. 12/2009 CLA 4

The institution may provide the general disclosures required by Part 213 to the lessee in electronic 

form, subject to compliance with the consumer consent and other applicable provisions of the ESign Act. The E-Sign Act does not mandate that institutions or consumers use or accept electronic 

records or signatures. It permits institutions to satisfy any statutory or regulatory requirements by 

providing the information electronically after obtaining the consumer’s affirmative consent. The 

institution must provide consumers with the following information before consumers can give 

consent: 

• Any right or option to have the information provided in paper or non-electronic form;

• The right to withdraw the consent to receive information electronically and the 

consequences, including fees, of doing so;

• The scope of the consent (for example, whether the consent applies only to a particular 

transaction or to identified categories of records that may be provided during the course of 

the parties’ relationship);

• The procedures to withdraw consent and to update information needed to contact the 

consumer electronically; and

• The methods by which a consumer may obtain, after consent and upon request, a paper copy 

of an electronic record after consent has been given to receive the information electronically 

and whether any fee will be charged.

The consumer must consent electronically or confirm consent electronically in a manner that 

“reasonably demonstrates that the consumer can access information in the electronic form that will 

be used to provide the information that is the subject of the consent.” 

After the consent, if an institution changes the hardware or software requirements such that a 

consumer may be prevented from accessing and retaining information electronically, the institution 

must notify the consumer of the new requirements and must allow the consumer to withdraw 

consent without charge. 

Institutions must provide disclosures in the following circumstances. (Advertisement requirements 

are discussed in the advertising section.)

Prior to or Due at Lease Signing 

A dated disclosure must be given to the consumer before signing the lease and must contain all of 

the information detailed in Section 4 of the regulation. 
CFPB Consumer

Laws and Regulations CLA

CFPB FFIEC Rev. 12/2009 CLA 5

Renegotiations and Extensions 

New disclosures also must be provided when a consumer renegotiates, or extends a lease, subject to 

certain exceptions. 

Multiple Lessors/Lessees 

In the event of multiple lessors, one lessor on behalf of all the lessors may make the required 

disclosures. If the lease involves more than one lessee, the required disclosures should be given to 

any lessee who is primarily liable. 

Advertising 

Advertisements concerning consumer leases must also comply with certain disclosure requirements. 

All advertisements must be accurate. If an advertisement includes any reference to certain “trigger 

terms” – the amount of any payment, statement of a capitalized cost reduction (e.g., down 

payment), or other payment required prior to or at lease signing or delivery, or that no such 

payment is required – then the ad must also state the following: 

• That the transaction is for a lease;

• The total amount due prior to or at lease signing or delivery;

• The number, amounts and due dates or periods of the scheduled payments;

• A statement of whether or not a security deposit is required; and

• A statement that an extra charge may be imposed at the end of the lease term where the 

lessee’s liability (if any) is based on the difference between the residual value of the leased 

property and its realized value at the end of the lease term (§ 213.7(d)(2)). 

An advertisement for an open-end lease also must include a statement that extra charges may be 

imposed at the end of the lease based on the difference between the residual value and the realized 

value at the end of the lease term. 

If lessors give a percentage rate in an advertisement, the rate cannot be more prominent than any of 

the other required disclosures. They must also include a statement that “this percentage may not 

measure the overall cost of financing this lease.” The lessor cannot use the term “annual percentage 

rate,” “annual lease rate,” or any equivalent term. 

Some fees (license, registration, taxes, and inspection fees) may vary by state or locality. An 

advertisement may exclude these third-party fees from the disclosure of a periodic payment or total 

amount due at lease signing or delivery, provided the ad states that these have been excluded. 

Otherwise, an ad may include these fees in the periodic payment or total amount due, provided it 

states that the fees are based on a particular state or locality and indicates that the fees may vary. 

For an advertisement accessed by the consumer in electronic form, the required disclosures may be 

provided to the consumer in electronic form in the advertisement, without regard to the consumer 
CFPB Consumer

Laws and Regulations CLA

CFPB FFIEC Rev. 12/2009 CLA 6

consent or other provisions of the E-Sign Act. An electronic advertisement (such as an 

advertisement on an Internet website) that provides a table or schedule of the required disclosures is 

considered a single advertisement if the advertisement clearly refers the consumer to the location 

where the additional required information begins. For example, in an electronic advertisement, a 

term triggering additional disclosures may be accompanied by a link that directly connects the 

consumer to the additional disclosures. 

Limits on Balloon Payments 

In order to limit balloon payments that may be required of the consumer, certain sections of the 

regulation call for reasonable calculations and estimates. These provisions protect the consumer at 

early termination of a lease, at the end of the lease term, or in delinquency, default, or late payment 

status. The provisions limit the lessee’s liability at the end of the lease term and set reasonableness 

standards for wear and use charges, early termination charges, and penalties or fees for delinquency. 

Penalties and Liability 

Criminal and civil liability provisions of the Truth in Lending Act also apply to the CLA. Actions 

alleging failure to disclose the required information, or otherwise comply with the CLA, must be 

brought within one year of the termination of the lease agreement. 

Record Retention 

Lessors are required to maintain evidence of compliance with the requirements imposed by 

Regulation M, other than the advertising requirements under Section 7 of the regulation, for a 

period of not less than two years after the date of disclosures are required to be made or an action is 

required to be taken. 

REFERENCES

Laws 

15 USC 1667 et seq. Consumer Leasing Act

15 USC 7001 et seq. Electronic Signatures in Global and National Commerce Act 

Regulations 

Federal Reserve Board Regulation (12 CFR) 

Part 213 Consumer Leasing (Regulation M)
CFPB

Examination Procedures CLA

CFPB FFIEC Rev. 4/2009 CLA 1

Consumer Leasing Act

Examination Objectives

• To assess the quality of the institution’s 

compliance management system for the 

Consumer Leasing Act. 

• To determine that lessees of personal property are given meaningful and accurate 

disclosures of lease terms.

• To determine if the limits of liability are clearly indicated to the lessees and correctly 

enforced by the institution.

• To ensure that the financial institution provides accurate disclosures of its leasing terms 

in all advertising. 

Examination Procedures

General Disclosure Requirements

A. Review the institution’s procedures for providing disclosures to ensure that there 

are adequate controls and procedures to effect compliance. 

[Click&type]

B. Review the disclosures provided by the institution.

1. Are the disclosures clear and conspicuous and provided in writing in a form 

the consumer may keep? For disclosures provided electronically (other than 

for advertising requirements), are the disclosures in electronic form provided 

in compliance with the consumer consent and other applicable provisions of 

the Electronic Signatures in Global and National Commerce Act (E-Sign 

Act)?1 For an advertisement accessed by the consumer in electronic form, are 

the disclosures required by 12 CFR 213.7 provided to the consumer in 

electronic form in the advertisement? (§ 213.3(a)) 

2. Are the disclosures given in a dated statement and in the prescribed format?

(§ 213.3(a)(1))

3. Is the information required by sections 213.4(b) through (f), (g)(2), (h)(3), 

(i)(1), (j), and (m)(1) segregated and in a form substantially similar to the 

model in Appendix A? (§ 213.3(a)(2))

4. Are the disclosures timely? (§ 213.3(a)(3))

5. If the lease involves more than one lessee, are the disclosures provided to any

lessee who is primarily liable? (§ 213.3(c))

6. If additional information is provided, is it provided in a manner such that it 1 The final amendment to Regulation M on the electronic delivery of disclosures, consistent with the requirements of the E-Sign Act, 

became effective December 10, 2007, and required mandatory compliance by October 1, 2008.

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB

Examination Procedures CLA

CFPB FFIEC Rev. 4/2009 CLA 2

does not mislead or confuse the lessee? (§ 213.3(b))

7. Are all estimates clearly identified and reasonable? (§ 213.3(d))

8. Are the disclosures accurate and do the disclosures contain the information 

required by section 213.4(a) through (t)? (§ 213.4)

9. Are disclosures given to lessees when they “renegotiate” or “extend” their 

leases? (§213.5)

[Click&type]

Lessee Liability

A. Review the lease estimates and calculations to ensure that there is not any 

unreasonable balloon payment expected of the lessee in the following 

circumstances:

1. At early termination: 

• Does the lessor disclose the conditions under which the lease may be 

terminated early and the amount and method of determining the 

amount of any early termination charges? (§ 213.4(g)(1))

• Are any early termination charges reasonable? (§ 213.4(g)(1), (q))

2. At end of lease term, for wear and use:

• If the lessor sets standards for wear and use of the leased vehicle are 

the amounts or method of determining any charge for excess mileage 

disclosed? (§ 213.4(h)(3))

• Are standards for wear and use reasonable? (§ 213.4(h)(2))

3. At end of lease term (for open-end leases):

• Does the lessor disclose the limitations on the lessee’s liabilities at the 

end of the lease term? (§ 213.4(m)(2))

• Are the lessee and lessor permitted to make a mutually agreeable final 

adjustment regarding excess liability? (§ 213.4(m)(3))

4. In delinquency, default or late payment:

• Does the lessor disclose penalties or other charges for delinquency, 

default or late payments? (§ 213.4(q))

• Are the penalties or other charges reasonable? (§ 213.4(q))

[Click&type]
CFPB

Examination Procedures CLA

CFPB FFIEC Rev. 4/2009 CLA 3

Advertising

A. Review advertising policies and procedures used by the institution to ensure that 

there are adequate controls and procedures to effect compliance. 

[Click&type]

B. Review a sample of the institution’s advertisements. Determine the following:

1. Do the advertisements advertise terms that are usually and customarily 

available? (§ 213.7(a))

2. Are the disclosures contained in the advertisements clear and 

conspicuous? (§ 213.7(b))

3. Do catalogs, multiple page advertisements and electronic advertisements 

comply with the page reference requirements? (§ 213.7(c))

4. When triggering terms are used, do the advertisements contain the 

additional required information? (§ 213.7(d))

5. Do merchandise tags that use triggering terms refer to a sign or display 

that contains the additional required disclosures? (§ 213.7(e))

6. If television or radio advertisements use triggering terms, if they do not 

contain the additional terms required by § 213.7(d)(2), do they use 

alternative disclosure methods (direct consumers to a toll-free number or 

written advertisement)? (§ 213.7(f))

[Click&type]

Miscellaneous

A. Are records and other evidence of compliance (other than for advertising 

requirements under § 213.7) retained for a period of no less than two (2) years? 

(§ 213.8)

[Click&type]
CFPB

Examination Procedures CLA

CFPB FFIEC Rev. 4/2009 CLA 4

Examiner’s Summary, Recommendations, and 

Comments 

[Click&type]
CFPB

Examination Checklist CLA

Yes No

CFPB FFIEC Rev. 4/2009 CLA 1

CONSUMER LEASING ACT

This checklist is an aid to analysis of an institution’s 

compliance program for consumer leasing operations. 

It is not a mandatory work paper. Apply it to the extent warranted by your risk-based scoping judgment. 

1. Does the institution engage in consumer leasing or purchase consumer leases 

from lessors? (§213.2(h)) 

(If no, there is no need to do further work on Consumer Leasing. If yes, complete the 

following checklist, answering yes (Y) or no (N) for each item.)

2. Are the disclosures made prior to consummation of the lease, that is, at the time a 

binding order is made or the lease is signed? (§213.3(a)(3)) 

3. Are the disclosures clear and conspicuous and provided in writing in a form the consumer may keep? (§213.3(a))

4. Are disclosures in electronic form provided in compliance with the consumer 

consent and other applicable provisions of the Electronic Signature in Global 

and National Commerce Act (E-Sign Act)? (§213.3(a))

5. For an advertisement accessed by the consumer in electronic form, are the disclosures required by 12 CFR § 213.7 provided to the consumer in electronic 

form in the advertisement? (§213.3(a))

6. Are the disclosures given in a dated statement and (i) made either in a separate 

statement that identifies the consumer lease transaction, (ii) in the contract or 

(iii) other document evidencing the lease? (§213.3(a)(1))

7. Is the information required by §§ 213.4(b) through (f), (g)(2), (h)(3), (i)(1), (j), 

and (m)(1) segregated and in a form substantially similar to the model in Appendix A? (§213.3(a)(2))

8. If the lease involves more than one lessee, are the disclosures provided to any 

lessee who is primarily liable? (§213.3(c))

9. If additional information is provided, is it provided in a manner such that it does 

not mislead or confuse the lessee? (§213.3(b))

10. Are disclosures provided to at least one lessee where there are multiple lessees 

and by at least one lessor when there are multiple lessors? (§213.3(c))

11. Are all estimates clearly identified and reasonable? (§213.3(d))

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB

Examination Checklist CLA

Yes No

CFPB FFIEC Rev. 4/2009 CLA 2

12. Are the following disclosures made in the lease?

A. Description of property (§213.4(a))

B. Amount due at lease signing or delivery (§213.4(b))

C. Payment schedule and total amount of periodic payments (§213.4(c))

D. Other charges (§213.4(d))

E. Total of payments (§213.4(e))

F. Regarding payment calculations:

i. Gross capitalized cost (§213.4(f)(1))

ii. Capitalized cost reduction (§213.4(f)(2))

iii. Adjusted capitalized cost (§213.4(f)(3))

iv. Residual value (§213.4(f)(4))

v. Depreciation and any amortized amounts (§213.4(f)(5))

vi. Rent charge (§213.4(f)(6))

vii. Total of base periodic payments (§213.4(f)(7))

viii. Lease payments (§213.4(f)(8))

ix. Basic periodic payment (§213.4(f)(9))

x. Itemization of other charges (§213.4(f)(10))

xi. Total periodic payment (§213.4(f)(11))

G. Regarding early termination: 

i. Conditions under which the lessee or lessor may terminate the lease 

prior to the end of the lease term (§213.4(g)(1))

ii. The amount or description of the method for determining the amount of 

any penalty or other charges for early termination (§213.4(g)(1))

iii. In a form substantially similar to the sample (§213.4(g)(2))
CFPB

Examination Checklist CLA

Yes No

CFPB FFIEC Rev. 4/2009 CLA 3

H. Regarding notice of wear and use:

i. A statement specifying whether the lessor or the lessee is responsible 

for maintaining or servicing the leased property, with a description of 

the responsibility (§213.4(h)(1))

ii. A statement of the lessor’s standards for wear and use, which must be 

reasonable (§213.4(h)(2))

iii. In a form substantially similar to the sample (§213.4(h)(3))

I. Purchase option (§213.4(i))

J. Statement referencing other non-segregated disclosures (§213.4(j))

K. Liability between residual and realized values (§213.4(k))

L. Right of appraisal (§213.4(l))

M. For open-end leases:

i. The rent and other charges paid by lessee (§213.4(m)(1))

ii. Liability at end of lease term based on residual value and any excess 

liability (§213.4 (m) and (m)(2))

iii. Mutually agreeable final adjustment (§213.4(m)(3))

N. Fees and taxes (§213.4(n))

O. Regarding insurance:

i. Are the types and amounts of insurance that the lessee is required to 

have disclosed? (§213.4(o)) 

ii. If the lessor provides insurance, are the types, amounts, and cost also 

disclosed? (§213.4(o)(1)) 

P. Warranties or guarantees (§213.4 (p))

Q. Penalties and other charges for late payments, delinquency, or default 

(§213.4(q))

R. Security interest other than a security deposit (§213.4(r))

S. Regarding any information on rate:

i. Does the lessor use the term “annual percentage rate,” “annual lease 

rate,” or any equivalent term in the lease disclosure? (§213.4(s)) 

ii. If so, does a statement that “this percentage may not measure the overall cost of financing this lease” accompany the rate? (§213.4(s))
CFPB

Examination Checklist CLA

Yes No

CFPB FFIEC Rev. 4/2009 CLA 4

13. Are disclosures given to lessees when they “renegotiate” or “extend” their leases? (§213.5) 

14. Does the institution advertise its leasing program? If so: 

A. Do the advertisements advertise terms that are usually and customarily available? (§213.7(a))

B. Are the advertisements clear and conspicuous? (§213.7(b))

i. Are any affirmative or negative references to a charge that is part of the 

disclosure required under paragraph (d)(2)(ii) less prominent than the 

disclosure (except for the statement of a periodic payment? 

(§213.7(b)(1))

ii. Are the advertisements of lease rates less prominent than any disclosure 

required by § 213.4 (except the notice of the limitations on rate)? 

(§213.7(b)(2))

C. Do catalogs and multiple page advertisements and electronic advertisements 

comply with the page reference requirements? (§213.7(c))

D. If any triggering terms are used, are all the following disclosures made 

(§213.7(d)(2))

i. That the transaction advertised is a lease

ii. The total amount due prior to or at consummation or by delivery, if delivery occurs after consummation

iii. The number, amounts, and due dates or periods of scheduled payments 

under the lease

iv. A statement of whether or not a security deposit is required

v. A statement that an extra charge may be imposed at the end of the lease 

term where the lessee’s liability (if any) is based on the difference between the residual value of the leased property and its realized value at 

the end of the lease term.

15. Do merchandise tags that use triggering terms refer to a sign or display that contains the additional required disclosures? (§213.7(e))
CFPB

Examination Checklist CLA

Yes No

CFPB FFIEC Rev. 4/2009 CLA 5

16. Do television or radio advertisements that do not contain the additional information required by § 213.4(d) direct consumers to a toll-free number or written 

advertisement for additional information when triggering terms are used? 

(§213.7)

A. Is the toll-free number listed along with a reference that the number may be 

used by the consumer to obtain the information? (§213.7(f)(1)(i))

B. Does the written advertisement that is in general circulation in the community 

served by the station include the name and date of the publication, and is it published beginning at least three days before and ending at least 10 days after 

broadcast? (§213.7(f)(1)(ii))

C. Has the toll-free telephone number been available for no fewer than ten days, 

beginning on the date of broadcast? (§213.7(f)(2)(i))

D. Does the lessor provide the information required by paragraph (d)(2) over the 

toll-free number, orally or in writing upon request? (§213.7(f)(2)(ii))

17. Are records and other evidence of compliance retained for a period of no less 

than two (2) years as required by the CLA? (§213.8)

COMMENTS

[Click&type]
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 1

Fair Credit Reporting Act

Background and Summary

The Fair Credit Reporting Act (FCRA)1 became effective on April 25, 1971. The FCRA is a part of 

a group of acts contained in the Federal Consumer Credit Protection Act2 such as the Truth in 

Lending Act and the Fair Debt Collection Practices Act. 

Congress substantively amended FCRA upon the passage of the Fair and Accurate Credit 

Transactions Act of 2003 (FACT Act).3 The FACT Act created many new responsibilities for 

consumer reporting agencies and users of consumer reports. It contained many new consumer 

disclosure requirements as well as provisions to address identity theft. In addition, it provided free 

annual consumer report rights for consumers and improved access to consumer report information 

to help increase the accuracy of data in the consumer reporting system.

The FCRA contains significant responsibilities for business entities that are consumer reporting 

agencies and lesser responsibilities for those that are not. Generally, financial institutions are not 

consumer reporting agencies.

In addition to the requirements related to financial institutions acting as consumer reporting 

agencies, FCRA requirements also apply to financial institutions that operate in any of the following 

capacities:

• Procurers and users of information (for example, as credit grantors, purchasers of dealer 

paper, or when opening deposit accounts).

• Furnishers and transmitters of information (by reporting information to consumer reporting 

agencies, other third parties, or to affiliates).

• Marketers of credit or insurance products.

• Employers.

Structure and Overview of Examination Modules

We structured the examination procedures as a series of modules, grouping similar requirements 

together. The modules contain general information about each of the requirements:

• Module 1 Obtaining Consumer Reports.

• Module 2 Obtaining Information and Sharing Among Affiliates.

• Module 3 Disclosures to Consumers and Miscellaneous Requirements.

• Module 4 Financial Institutions as Furnishers of Information.

• Module 5 Consumer Alerts and Identity Theft Protections

 

1

15 USC §§ 1681-1681u. 2 15 USC § 1601 et seq. 3

Pub. L. No. 108-159, 117 Stat. 1952.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 2

Financial institutions are subject to a number of different requirements under the FCRA. The statute 

contains some of the requirements, while others are in regulations issued jointly by the FFIEC 

agencies or in regulations issued by the Federal Reserve Board and/or the Federal Trade 

Commission.4

The Dodd-Frank Act granted rulemaking authority under the FCRA (except for §615(e) (identity 

theft) and §628 (disposal)) to the Consumer Financial Protection Bureau (CFPB) and, with respect 

to entities under its jurisdiction, granted authority to the CFPB to supervise for and enforce 

compliance with the provisions of the FCRA and the implementing regulations.56

Important Definitions

The FCRA uses a number of definitions. Key definitions include the following:

Consumer

A consumer is defined as an individual.

Consumer Report

A consumer report is any written, oral, or other communication of any information by a consumer 

reporting agency that bears on a consumer’s creditworthiness, credit standing, credit capacity, 

character, general reputation, personal characteristics, or mode of living that is used or expected to 

be used or collected, in whole or in part, for the purpose of serving as a factor in establishing the 

consumer’s eligibility for any of the following:

• Credit or insurance to be used primarily for personal, family, or household purposes.

• Employment purposes.

• Any other purpose authorized under Section 604 (15 USC 1681b). 

The term “consumer report” does not include any of the following:

• Any report containing information solely about transactions or experiences between the 

consumer and the institution making the report.

• Any communication of that transaction or experience information among entities related by 

common ownership or affiliated by corporate control (for example, different institutions 

that are members of the same holding company, or subsidiary companies of an insured 

institution).

 

4 For ease of reference, only the Federal Reserve’s implementing regulation is cited in this narrative. However, examiners should 

review an entity’s compliance with the applicable regulation in effect with respect to that entity.

5 Dodd-Frank Act, §§ 1002(12)(F), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12), 5514(c), and 5515(c). These exam 

procedures do not include final amendments to Regulation V implementing Dodd Frank Act amendments to risk-based pricing rules 

that require disclosure of credit scores and information relating to credit scores in risk-based pricing notices. CFPB is working with 

prudential regulators to update exam procedures to reflect these rules, which have taken effect, in a uniform manner as appropriate. 

These procedures will be further modified in the future to reflect, as appropriate, the transfer of certain authorities from the Federal 

Reserve Board to the CFPB on July 21, 2011 effected by the Dodd-Frank Act. 6 Appendix A of the interagency procedures contained a matrix of different statutory and regulatory cites applicable to financial 

institutions. The appendix has been deleted from the CFPB procedures because the interagency appendix does not contain the current 

regulatory citations.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 3

• Communication of other information among persons related by common ownership or 

affiliated by corporate control if:

 It is clearly and conspicuously disclosed to the consumer that the information may be 

communicated among such persons; and

 The consumer is given the opportunity, before the time that the information is 

communicated, to direct that the information not be communicated among such 

persons.

• Any authorization or approval of a specific extension of credit directly or indirectly by the 

issuer of a credit card or similar device. 

• Any report in which a person who has been requested by a third party to make a specific 

extension of credit directly or indirectly to a consumer, such as a lender who has received a 

request from a broker, conveys his or her decision with respect to such request, if the third 

party advises the consumer of the name and address of the person to whom the request was 

made, and such person makes the disclosures to the consumer required under Section 615 

(15 USC § 1681m), Requirements on Users of Consumer Reports.

• A communication described in subsection (o) or (x) of Section 603 (15 USC § 1681a (o)) 

(which relates to certain investigative reports and certain reports to prospective employers). 

Person

A person means any individual, partnership, corporation, trust, estate, cooperative, association, 

government or governmental subdivision or agency, or other entity.

Investigative Consumer Report

An investigative consumer report means a consumer report or portion thereof in which information 

on a consumer’s character, general reputation, personal characteristics, or mode of living is obtained 

through personal interviews with neighbors, friends, or associates of the consumer reported on or 

with others with whom he is acquainted or who may have knowledge concerning any such items of 

information. However, such information does not include specific factual information on a 

consumer’s credit record obtained directly from a creditor of the consumer or from a consumer 

reporting agency when such information was obtained directly from a creditor of the consumer or 

from the consumer.

Adverse Action

The term adverse action has the same meaning as used in Section 701(d) (6) (15 USC1691 (d) (6)) 

of the Equal Credit Opportunity Act (ECOA). Under the ECOA, it means a denial or revocation of 

credit, a change in the terms of an existing credit arrangement, or a refusal to grant credit in 

substantially the same amount or on terms substantially similar to those requested. Under the 

ECOA, the term does not include a refusal to extend additional credit under an existing credit 

arrangement where the applicant is delinquent or otherwise in default, or where such additional 

credit would exceed a previously established credit limit. 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 4

The term has the following additional meanings for purposes of the FCRA:

• A denial or cancellation of, an increase in any charge for, or a reduction or other adverse or 

unfavorable change in the terms of coverage or amount of, any insurance, existing or 

applied for, in connection with the underwriting of insurance.

• A denial of employment or any other decision for employment purposes that adversely 

affects any current or prospective employee.

• A denial or cancellation of, an increase in any charge for, or any other adverse or 

unfavorable change in the terms of, any license or benefit described in Section 604(a)(3)(D) 

(15 USC § 1681b(a)(3)(D)). 

• An action taken or determination that is:

 Made in connection with an application made by, or transaction initiated by, any 

consumer or in connection with a review of an account to determine whether the 

consumer continues to meet the terms of the account.

 Adverse to the interests of the consumer.

Employment Purposes

The term employment purposes when used in connection with a consumer report means a report 

used for the purpose of evaluating a consumer for employment, promotion, reassignment or 

retention as an employee.

Consumer Reporting Agency

The term consumer reporting agency means any person who, for monetary fees, dues, or on a 

cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or 

evaluating consumer credit information or other information on consumers for the purpose of 

furnishing consumer reports to third parties, and who uses any means or facility of interstate 

commerce for the purpose of preparing or furnishing consumer reports.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 5

MODULE 1: OBTAINING CONSUMER REPORTS

Overview

Consumer reporting agencies have a significant amount of personal information about consumers. 

This information is invaluable in assessing a consumer’s creditworthiness for a variety of products 

and services, including loan and deposit accounts, insurance, and utility services, among others. The 

FCRA governs access to this information to ensure that a prospective user of the information 

obtains it for permissible purposes and does not exploit it for illegitimate purposes.

The FCRA requires any prospective user of a consumer report, for example, a lender, insurer, 

landlord, or employer, among others, to have a legally permissible purpose to obtain a report.

Permissible Purposes of Consumer Reports 

(Section 604) (15 USC 1681b) and 

Investigative Consumer Reports 

(Section 606) (15 USC 1681d)

Legally Permissible Purposes

The FCRA allows a consumer reporting agency to furnish a consumer report for the following 

circumstances and no other:

• In response to a court order or Federal Grand Jury subpoena.

• In accordance with the written instructions of the consumer.

• To a person, including a financial institution, that the agency has reason to believe intends 

to use the report as information for any of the following reasons:

 In connection with a credit transaction involving the consumer (includes extending, 

reviewing, and collecting credit).

 For employment purposes.7

 In connection with the underwriting of insurance involving the consumer.

 In connection with a determination of the consumer’s eligibility for a license or other 

benefit granted by a governmental instrumentality that is required by law to consider an 

applicant’s financial responsibility.

 As a potential investor or servicer, or current insurer, in connection with a valuation of, 

or an assessment of the credit or prepayment risks associated with, an existing credit 

obligation.

 Otherwise has a legitimate business need for the information:

 

7 Use of consumer reports for employment purposes requires specific advanced authorization, disclosure, and adverse action notices. 

Module 3 of the examination procedures contains these issues.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 6

 In connection with a business transaction that the consumer initiates; or

 To review an account to determine whether the consumer continues to meet the 

terms of the account.

• In response to a request by the head of a State or local child support enforcement agency 

(or authorized appointee) if the person certifies various information to the consumer 

reporting agency regarding the need to obtain the report. (Generally, this particular purpose 

does not impact a financial institution that is not a consumer reporting agency.)

Prescreened Consumer Reports

Users of consumer reports, such as financial institutions, may obtain prescreened consumer reports 

to make firm offers of credit or insurance to consumers, unless the consumers elected to opt out of 

being included on prescreened lists. The FCRA contains many requirements, including an opt-out 

notice requirement when prescreened consumer reports are used. In addition to defining prescreened 

consumer reports, Module 3 covers these requirements.

Investigative Consumer Reports (Section 606)

This section on Investigative Consumer Reports contains specific requirements for use of an 

investigative consumer report. This type of consumer report contains information about a 

consumer’s character, general reputation, personal characteristics, or mode of living obtained in 

whole or in part through personal interviews with neighbors, friends, or associates of the consumer. 

If a financial institution procures an investigative consumer report, or causes the preparation of one, 

the institution must meet the following requirements:

• The institution clearly and accurately discloses to the consumer that it may obtain an 

investigative consumer report.

• The disclosure contains a statement of the consumer’s right to request other information 

about the report and a summary of the consumer’s rights under the FCRA.

• The disclosure is in writing and is mailed or otherwise delivered to the consumer not later

than three business days after the date on which the report was first requested.

• The financial institution procuring the report certifies to the consumer reporting agency that 

it has complied with the disclosure requirements and will comply in the event that the 

consumer requests additional disclosures about the report.

Institution Procedures

Given the preponderance of electronically available information and the growth of identity theft, 

financial institutions should manage the risks associated with obtaining and using consumer reports. 

Financial institutions should employ procedures, controls, or other safeguards to ensure that they 

obtain and use consumer reports only in situations for which there are permissible purposes.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 7

Module 2: Obtaining Information and Sharing Among 

Affiliates

Overview

The FCRA contains many substantive compliance requirements for consumer reporting agencies 

designed to help ensure the accuracy and integrity of the consumer reporting system. As noted in 

the definitions section, a consumer reporting agency is a person that generally furnishes consumer 

reports to third parties. By their very nature, banks, credit unions, and other financial institutions 

have a significant amount of consumer information that could constitute a consumer report, and thus 

communication of this information could cause the institution to become a consumer reporting 

agency. The FCRA contains several exceptions that enable a financial institution to communicate 

this type of information, within strict guidelines, without becoming a consumer reporting agency. 

Rather than containing strict information-sharing prohibitions, the FCRA creates a business 

disincentive such that if a financial institution shares consumer report information outside of the 

exceptions, then the institution is a consumer reporting agency and will be subject to the significant, 

substantive requirements of the FCRA applicable to those entities. Typically, a financial institution 

will structure its information sharing practices within the exceptions to avoid becoming a consumer 

reporting agency. This examination module generally covers the various information-sharing 

practices within these exceptions.

Consumer Report and Information Sharing (Section 603(d))

This section on Consumer Report and Information Sharing defines a consumer report to include 

information about a consumer such as that which bears on a consumer’s creditworthiness, character, 

and capacity among other factors. Communication of this information may cause a person, 

including a financial institution, to become a consumer reporting agency. The statutory definition 

contains key exemptions to this definition that enable financial institutions to share this type of 

information under certain circumstances, without becoming consumer reporting agencies. 

Specifically, the term "consumer report” does not include:

• A report containing information solely as to transactions or experiences between the 

consumer and the financial institution making the report. A person, including a financial

institution, may share information strictly related to its own transactions or experiences 

with a consumer (such as the consumer’s payment history, or an account with the 

institution) with any third party, without regard to affiliation, without becoming a consumer 

reporting agency. The Privacy of Consumer Financial Information regulations that 

implement the Gramm-Leach-Bliley Act (GLBA) may restrict this type of information 

sharing because it meets the definition of nonpublic personal information under the Privacy 

regulations. Therefore, sharing it with nonaffiliated third parties may be subject to an optout notice under the privacy regulations. In turn, the FCRA may also restrict activities that 

the GLBA permits. For example, the GLBA permits a financial institution to share a list of 

its customers and information such as their credit scores with another financial institution to 

jointly market or sponsor other financial products or services. This communication may be 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 8

a consumer report under the FCRA and could potentially cause the sharing financial 

institution to become a consumer reporting agency.

• Communication of such transaction or experience information among persons, including 

financial institutions related by common ownership or affiliated by corporate control.

• Communication of other information (for example, other than transaction or experience 

information) among persons and financial institutions related by common ownership or 

affiliated by corporate control, if it is clearly and conspicuously disclosed to the consumer 

that the information will be communicated among such entities, and before the information 

is initially communicated, the consumer is given the opportunity to opt out of the 

communication. This allows a financial institution to share other information (that is, 

information other than its own transaction and experience information) that could otherwise 

be a consumer report, without becoming a consumer reporting agency under both of the 

following circumstances: 

 The sharing of the “other” information is done with affiliates. 

 Consumers are provided with the notice and an opportunity to opt out of this sharing 

before the information is first communicated among affiliates. 

For example, “other” information can include information a consumer provides on an 

application form concerning accounts with other financial institutions. It can also include 

information a financial institution obtains from a consumer reporting agency, such as the 

consumer’s credit score. If a financial institution shares other information with affiliates without 

providing a notice and an opportunity to opt out, the financial institution may become a 

consumer reporting agency subject to all of the other requirements of the FCRA.

GLBA and its implementing regulations require that a financial institution’s Privacy Notice 

contain the Consumer Report (Section 603(d)) opt-out right.

Other Exceptions

Specific extensions of credit

In addition, the term consumer report does not include the communication of a specific extension of 

credit directly or indirectly by the issuer of a credit card or similar device. For example, this 

exception allows a lender to communicate an authorization through the credit card network to a 

retailer, to enable a consumer to complete a purchase using a credit card.

Credit Decision to Third Party (for example, auto dealer)

The term consumer report also does not include any report in which a person, including a financial 

institution, who has been requested by a third party to make a specific extension of credit directly or 

indirectly to a consumer, conveys the decision with respect to the request. The third party must 

advise the consumer of the name and address of the financial institution to which the request was 

made, and such financial institution makes the adverse action disclosures required by Section 615 of 

the FCRA. For example, this exception allows a lender to communicate a credit decision to an 

automobile dealer who is arranging financing for a consumer purchasing an automobile and who 

requires a loan to finance the transaction.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 9

“Joint User” Rule

The Federal Trade Commission staff commentary discusses another exception known as the “Joint 

User Rule.” Under this exception, users of consumer reports, including financial institutions, may 

share information if they are jointly involved in the decision to approve a consumer’s request for a 

product or service, provided that each has a permissible purpose to obtain a consumer report on the 

individual. For example, a consumer applies for a mortgage loan that will have a high loan-to-value 

ratio, and thus the lender will require private mortgage insurance (PMI) in order to approve the 

application. An outside company provides the PMI. The lender and the PMI company can share 

consumer report information about the consumer because both entities have permissible purposes to 

obtain the information and both are jointly involved in the decision to grant the products to the 

consumer. This exception applies to entities that are affiliated or nonaffiliated third parties. It is 

important to note that the GLBA will still apply to the sharing of nonpublic, personal information 

with nonaffiliated third parties; therefore, financial institutions should be aware the GLBA may still 

limit or prohibit sharing under the FCRA joint user rule. 

Protection of Medical Information 

(Section 604(g) (12 CFR 222, Subpart D)

Section 604(g) generally prohibits creditors from obtaining and using medical information in 

connection with any determination of the consumer’s eligibility, or continued eligibility, for credit. 

The statute contains no prohibition on creditors obtaining or using medical information for other 

purposes that are not in connection with a determination of the consumer’s eligibility, or continued 

eligibility for credit.

Section 604(g)(5)(A) requires the federal banking agencies and NCUA to prescribe regulations that 

permit transactions that are determined to be necessary and appropriate to protect legitimate 

operational, transactional, risk, consumer, and other needs (including administrative verification 

purposes), consistent with the Congressional intent to restrict the use of medical information for 

inappropriate purposes. On November 22, 2005, the FFIEC Agencies published final rules in the 

Federal Register (70 FR 70664). The rules contain the general prohibition on obtaining or using 

medical information, and provide exceptions for the limited circumstances when medical 

information may be used. The rules define “credit” and “creditor” as having the same meanings as 

in Section 702 of the Equal Credit Opportunity Act (15 USC 1691a).

Obtaining and Using Unsolicited Medical Information (12 CFR 222.30(c)). A creditor does not 

violate the prohibition on obtaining medical information if it receives the medical information 

pertaining to a consumer in connection with any determination of the consumer’s eligibility, or 

continued eligibility, for credit without specifically requesting medical information. However, the 

creditor may only use this medical information in connection with a determination of the 

consumer’s eligibility, or continued eligibility, for credit in accordance with either the financial 

information exception or one of the specific other exceptions provided in the rules. We discuss 

these exceptions below.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 10

Financial Information Exception (12 CFR 222.30(d)). The rules allow a creditor to obtain and use 

medical information pertaining to a consumer in connection with any determination of the 

consumer’s eligibility or continued eligibility for credit, so long as:

• The information is the type of information routinely used in making credit eligibility 

determinations, such as information relating to debts, expenses, income, benefits, assets, 

collateral, or the purpose of the loan, including the use of the loan proceeds.

• The creditor uses the medical information in a manner and to an extent that is no less 

favorable than it would use comparable information that is not medical information in a 

credit transaction.

• The creditor does not take the consumer’s physical, mental, or behavioral health, condition 

or history, type of treatment, or prognosis into account as part of any such determination.

The financial information exception is designed in part to allow creditors to consider a consumer’s 

medical debts and expenses in the assessment of that consumer’s ability to repay the loan according 

to the loan terms. In addition, the financial information exception also allows a creditor to consider 

the dollar amount and continued eligibility for disability income, worker’s compensation income, or 

other benefits related to health or a medical condition that is relied on as a source of repayment. 

The creditor may use the medical information in a manner and to an extent that is no less favorable

than it would use comparable, nonmedical information. For example, a consumer includes on an 

application for credit information about two $20,000 debts. One debt is to a hospital; the other is to 

a retailer. The creditor may use and consider the debt to the hospital in the same manner in which it 

considers the debt to the retailer, such as including the debts in the calculation of the consumer’s 

proposed debt-to-income ratio. In addition, the consumer’s payment history of the debt to the 

hospital may be considered in the same manner as the debt to the retailer. For example, if the 

creditor does not grant loans to applicants who have debts that are 90-days past due, the creditor 

could consider the past-due status of a debt to the hospital, in the same manner as the past-due status 

of a debt to the retailer. 

A creditor may use medical information in a manner that is more favorable to the consumer, 

according to its regular policies and procedures. For example, if a creditor has a routine policy of 

declining consumers who have a 90-day past due installment loan to a retailer, but does not decline 

consumers who have a 90-day past due debt to a hospital, the financial information exception would 

allow a creditor to continue this policy without violating the rules because in these cases, the 

creditor’s treatment of the debt to the hospital is more favorable to the consumer.

A creditor may not take the consumer’s physical, mental, or behavioral health, condition or history, 

type of treatment, or prognosis into account as part of any determination regarding the consumer’s 

eligibility, or continued eligibility for credit. The creditor may only consider the financial 

implications as discussed above, such as the status of a debt to a hospital, continued eligibility for 

disability income, etc.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 11

Specific Exceptions for Obtaining and Using Medical Information (12 CFR 222.30(e)). In addition 

to the financial information exception, the rules also provide for the following nine specific 

exceptions under which a creditor can obtain and use medical information in its determination of the 

consumer’s eligibility, or continued eligibility for credit: 

• To determine whether the use of a power of attorney or legal representative that is triggered 

by a medical condition or event is necessary and appropriate, or whether the consumer has 

the legal capacity to contract when a person seeks to exercise a power of attorney or act as a 

legal representative for a consumer based on an asserted medical condition or event. For 

example, if Person A is attempting to act on behalf of Person B under a Power of Attorney 

that is invoked based on a medical event, a creditor is allowed to obtain and use medical 

information to verify that Person B has experienced a medical condition or event such that 

Person A is allowed to act under the Power of Attorney.

• To comply with applicable requirements of local, state, or Federal laws.

• To determine, at the consumer’s request, whether the consumer qualifies for a legally 

permissible special credit program or credit-related assistance program that is:

 Designed to meet the special needs of consumers with medical conditions and

 Established and administered pursuant to a written plan that:

 Identifies the class of persons that the program is designed to benefit; and

 Sets forth the procedures and standards for extending credit or providing other 

credit-related assistance under the program.

• To the extent necessary for purposes of fraud prevention or detection.

• In the case of credit for the purpose of financing medical products or services, to determine 

and verify the medical purpose of the loan and the use of the proceeds. 

• Consistent with safe and sound banking practices, if the consumer or the consumer’s legal 

representative requests that the creditor use medical information in determining the 

consumer’s eligibility, or continued eligibility, for credit, to accommodate the consumer’s 

particular circumstances, and such request is documented by the creditor. For example, at 

the consumer’s request, a creditor may grant an exception to its ordinary policy to 

accommodate a medical condition that the consumer has experienced. This exception 

allows a creditor to consider medical information in this context, but it does not require a 

creditor to make such an accommodation nor does it require a creditor to grant a loan that is 

unsafe or unsound.

• Consistent with safe and sound practices, to determine whether the provisions of a 

forbearance practice or program that is triggered by a medical condition or event apply to a 

consumer. For example, if a creditor has a policy of delaying foreclosure in cases where a 

consumer is experiencing a medical hardship, this exception allows the creditor to use 

medical information to determine if the policy would apply to the consumer. Like the 

exception listed in the bullet above, this exception does not require a creditor to grant 

forbearance, it merely provides an exception so that a creditor may consider medical 

information in these instances.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 12

• To determine the consumer’s eligibility for the triggering of, or the reactivation of a debt 

cancellation contract or debt suspension agreement, if a medical condition or event is a 

triggering event for the provision of benefits under the contract or agreement.

• To determine the consumer’s eligibility for the triggering of, or the reactivation of a credit 

insurance product, if a medical condition or event is a triggering event for the provision of 

benefits under the product.

Limits on redisclosure of information (12 CFR 222.31(b)). If a creditor subject to the medical 

information rules receives medical information about a consumer from a consumer reporting agency 

or its affiliate, the creditor must not disclose that information to any other person, except as 

necessary to carry out the purpose for which the information was initially disclosed, or as otherwise 

permitted by statute, regulation, or order.

Sharing medical information with affiliates (12 CFR 222.32(b)). In general, the exclusions from the 

definition of “consumer report” in Section 603(d) (2) of the FCRA allow the sharing of non-medical 

information among affiliates. With regard to medical information, Section 603(d) (3) of the FCRA 

provides that the exclusions in Section 603(d) (2) do not apply when a person subject to the medical 

information rules shares any of the following information with an affiliate:

• Medical information.

• An individualized list or description based on the payment transactions of the consumer for 

medical products or services.

• An aggregate list of identified consumers based on payment transactions for medical 

products or services.

If a person who is subject to the medical rules shares with an affiliate the type of information 

discussed above, the exclusions from the definition of “consumer report” do not apply. Effectively, 

this means that if a person shares medical information, that person becomes a consumer reporting 

agency, subject to all of the other substantive requirements of the FCRA. 

The rules provide exceptions to these limitations on sharing medical information with affiliates. A 

person, such as a bank, thrift, or credit union, may share medical information with its affiliates 

without becoming a consumer reporting agency under any of the following circumstances:

• In connection with the business of insurance or annuities (including the activities described 

in Section 18B of the model Privacy of Consumer Financial and Health Information 

Regulation issued by the National Association of Insurance Commissioners, as in effect on 

January 1, 2003).

• For any purpose permitted without authorization under the regulations promulgated by the 

Department of Health and Human Services pursuant to the Health Insurance Portability and 

Accountability Act of 1996 (HIPAA).

• For any purpose referred to in Section 1179 of HIPAA.

• For any purpose described in Section 502(e) of the Gramm-Leach-Bliley Act.

• In connection with a determination of the consumer’s eligibility, or continued eligibility, 

for credit consistent with the financial information exceptions or specific exceptions.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 13

• As otherwise permitted by order of the appropriate federal agency or NCUA, as applicable.

Affiliate Marketing Opt-Out Requirement 

(Section 624) (12 CFR 222, Subpart C)

Section 624 gives a consumer the right to restrict an entity, with which it does not have a preexisting business relationship, from using certain information obtained from an affiliate to make 

solicitations to that consumer. This provision is distinct from Section 603(d) (2) (A) (iii) that gives a 

consumer the right to restrict the sharing of certain consumer information among affiliates.8

Under Section 624, an entity may not use information received from an affiliate to market its 

products or services to a consumer, unless the consumer is given notice and a reasonable 

opportunity and a reasonable and simple method to opt out of the making of such solicitations. The 

affiliate marketing opt-out requirement applies to both transaction or experience information and 

“other” information, such as information from credit reports and credit applications. On November 

7, 2007, the federal financial institution regulators published final regulations in the Federal 

Register to implement this Section (72 FR 62910).9

Exceptions to the notice and opt-out requirements apply when an entity uses eligibility information 

in certain ways, as described later in these procedures.

Key Definitions (12 CFR 222.20)10

• Eligibility information (12 CFR 222.20(b) (3)) includes not only transaction and experience 

information, but also the type of information found in consumer reports, such as 

information from third-party sources and credit scores. Eligibility information does not 

include aggregate or blind data that does not contain personal identifiers such as account 

numbers, names, or addresses.11

 

8 See Module 2, Section 603(d) Consumer Report and Information Sharing, for provisions pertaining to the sharing of consumer 

information. Under Section 603(d)(2)(A)(iii) of the FCRA, entities are responsible for complying with the affiliate sharing notice and optout requirement, where applicable. Thus, under the FCRA, certain consumer information will be subject to two opt-out notices, a sharing 

opt-out notice (Section 603(d)) and a marketing use opt-out notice(Section 624). These two opt-out notices may be consolidated.

9See 12 CFR 222.20(a) for the scope of entities covered by Subpart C of 12 CFR 222.

10 See 12 CFR 222.20 for other definitions.

11 Specifically, “eligibility information” is defined in the affiliate marketing regulation as “any information the communication of which 

would be a consumer report if the exclusions from the definition of “consumer report” in Section 603(d)(2)(A) of the [Fair Credit 

Reporting] Act did not apply.”
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 14

• Pre-existing business relationship (12 CFR 222.20(b)(4))12 means a relationship between a 

person, such as a financial institution (or a person’s licensed agent), and a consumer based 

on:

 A financial contract between the person and the consumer that is in force on the date on 

which the consumer is sent a solicitation covered by the affiliate marketing regulation; 

 The purchase, rental, or lease by the consumer of the person’s goods or services, or a 

financial transaction (including holding an active account or a policy in force, or having 

another continuing relationship) between the consumer and the person, during the 18-

month period immediately preceding the date on which the consumer is sent a 

solicitation covered by the affiliate marketing regulation; or

 An inquiry or application by the consumer regarding a product or service offered by 

that person during the three-month period immediately preceding the date on which the 

consumer is sent a solicitation covered by the affiliate marketing regulation.

• Solicitation (12 CFR 222.20(b)(5)) means the marketing of a product or service initiated by 

a person, such as a financial institution, to a particular consumer that is:

 Based on eligibility information communicated to that person by its affiliate; and 

 Intended to encourage the consumer to purchase or obtain such product or service.

Examples of a solicitation include a telemarketing call, direct mail, email, or other form of 

marketing communication directed to a particular consumer that is based on eligibility information 

received from an affiliate. A solicitation does not include marketing communications that are 

directed at the general public (e.g., television, general circulation magazine, and billboard 

advertisements). 

 

12 See 12 CFR 222.20(b)(4)(ii) and (iii) for examples of pre-existing business relationships and situations where no pre-existing business 

relationship exists.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 15

Initial Notice and Opt-Out Requirement 

(12 CFR 222.21(a), 222.24, and 222.25)

A financial institution and its subsidiaries (financial institution) generally may not use eligibility 

information about a consumer that it receives from an affiliate to make a solicitation for marketing 

purposes to the consumer, unless:

• It is clearly and conspicuously disclosed to the consumer in writing or, if the consumer 

agrees, electronically, in a concise notice that the financial institution may use eligibility 

information about that consumer that it received from an affiliate to make solicitations for 

marketing purposes to the consumer;

• The consumer is provided a reasonable opportunity and a reasonable and simple method to 

“opt out” (that is, the consumer prohibits the financial institution from using eligibility 

information to make solicitations for marketing purposes to the consumer);13 and

• The consumer has not opted out.

For example, a consumer has a homeowner’s insurance policy with an insurance company. The 

insurance company shares eligibility information about the consumer with its affiliated depository 

institution. Based on that eligibility information, the depository institution wants to make a 

solicitation to the consumer about its home equity loan products. The depository institution does not 

have a pre-existing business relationship with the consumer and none of the other exceptions apply. 

The depository institution may not use eligibility information it received from its insurance affiliate 

to make solicitations to the consumer about its home equity loan products unless the insurance 

company gave the consumer a notice and opportunity to opt out and the consumer does not opt out.

Making Solicitations (12 CFR 222.21(b))14

A financial institution (or a service provider acting on behalf of the financial institution) makes a 

solicitation for marketing purposes if:

• The financial institution receives eligibility information from an affiliate, including when 

the affiliate places that information into a common database that the financial institution 

may access;

• The financial institution uses that eligibility information to do one or more of the following:

 Identify the consumer or type of consumer to receive a solicitation;

 Establish criteria used to select the consumer to receive a solicitation; or

 Decide which of the financial institution’s products or services to market to the 

consumer or tailor the financial institution’s solicitation to that consumer; and

• As a result of the financial institution’s use of the eligibility information, the consumer is 

provided a solicitation.

 

13 See 12 CFR 222.24 and 222.25 for examples of “a reasonable opportunity to opt out” and “reasonable and simple methods for opting 

out.”

14 See 12 CFR 222.21(b)(6) for examples of making solicitations.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 16

A financial institution does not make a solicitation for marketing purposes (and therefore the 

affiliate marketing regulation, with its notice and opt-out requirements, does not apply) in the 

situations listed below, commonly referred to as “constructive sharing.” Constructive sharing 

occurs when a financial institution provides criteria to an affiliate to use in marketing the 

financial institution’s product and the affiliate uses the criteria to send marketing materials to 

the affiliate’s own customers that meet the criteria. In this situation, the financial institution is 

not using shared eligibility information to make solicitations.

• The financial institution provides criteria for consumers to whom it would like its affiliate 

to market the financial institution’s products. Then, based on this criteria, the affiliate uses 

eligibility information that the affiliate obtained in connection with its own pre-existing 

business relationship with the consumer to market the financial institution’s products or 

services (or directs its service provider to use the eligibility information in the same manner 

and the financial institution does not communicate with the service provider regarding that 

use).

• A service provider, applying the financial institution’s criteria, uses information from an 

affiliate, such as that in a shared database, to market the financial institution’s products or 

services to the consumer, so long as it meets certain requirements, including all of the 

following.

 The affiliate controls access to and use of its eligibility information by the service 

provider under a written agreement between the affiliate and the service provider.

 The affiliate establishes, in writing, specific terms and conditions under which the 

service provider may access and use the affiliate’s eligibility information to market the 

financial institution’s products and services (or those of affiliates generally) to the 

consumer.

 The affiliate requires the service provider, under a written agreement, to implement 

reasonable policies and procedures designed to ensure that the service provider uses the 

affiliate’s eligibility information in accordance with the terms and conditions 

established by the affiliate relating to the marketing of the financial institution’s 

products or services.

 The affiliate is identified on or with the marketing materials provided to the consumer.

 The financial institution does not directly use its affiliate’s eligibility information in the 

manner described above under “Making Solicitations (12 CFR 222.21(b)),” item 2. 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 17

Exceptions to Initial Notice and Opt-Out Requirements 

(12 CFR 222.21(c))15

The initial notice and opt-out requirements do not apply to a financial institution if it uses eligibility 

information that it receives from an affiliate:

• To make a solicitation for marketing purposes to a consumer with whom the financial 

institution has a pre-existing business relationship;

• To facilitate communications to an individual for whose benefit the financial institution 

provides employee benefit or other services pursuant to a contract with an employer;

• To perform services on behalf of an affiliate (but this would not allow solicitation where 

the consumer has opted out);

• In response to a communication about the financial institution’s products or services 

initiated by the consumer;

• In response to a consumer’s authorization or request to receive solicitations; or

• If the financial institution’s compliance with the affiliate marketing regulation would 

prevent it from complying with State insurance laws pertaining to unfair discrimination in 

any state in which the financial institution is lawfully doing business.

Contents of Opt-Out Notice (12 CFR 222.23)

A financial institution must provide to the consumer a reasonable and simple method for the 

consumer to opt out. The opt-out notice must be clear, conspicuous, and concise, and must 

accurately disclose specific information outlined in 12 CFR 222.23(a), including that the consumer 

may elect to limit the use of eligibility information to make solicitations to the consumer. See 

Appendix C to the regulation for the model notices contained in the affiliate marketing regulation.

Alternative contents. An affiliate that provides a consumer a broader right to opt out than that 

required by the affiliate marketing regulation may satisfy the regulatory requirements by 

providing the consumer with a clear, conspicuous, and concise notice that accurately discloses 

the consumer’s opt-out rights.

Coordinated, consolidated, and equivalent notices. Opt-out and renewal notices may be 

coordinated and consolidated with any other notice or disclosure required under any other 

provision of law, such as the Gramm-Leach-Bliley Act (GLBA), 15 USC 6801 et seq. Renewal 

notices, which have additional required content (12 CFR 222.27), may be consolidated with the 

annual GLBA privacy notices.

 

15See 12 CFR 222.21(d) for examples of exceptions to the initial notice and opt-out requirement.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 18

Delivery of the Opt-Out Notice 

(12 CFR 222.21(a) (3) and 222.26)16

An affiliate that has or previously had a pre-existing business relationship with the consumer must 

provide the notice either individually or as part of a joint notice from two or more members of an 

affiliated group of companies. The opt-out notice must be provided so that each consumer can 

reasonably be expected to receive actual notice. A consumer may not reasonably be expected to 

receive actual notice if, for example, the affiliate providing the notice sends the notice via email to a 

consumer who has not agreed to receive electronic disclosures by email from the affiliate providing 

the notice.17

Scope of Opt-Out (12 CFR 222.22(a) and 222.23(a) (2))18

As a general rule, the consumer’s election to opt out prohibits any affiliate covered by the opt-out 

notice from using eligibility information received from another affiliate, described in the notice, to 

make solicitations to the consumer. If two or more consumers jointly obtain a product or service, 

any of the joint consumers may exercise the right to opt out. It is impermissible to require all joint 

consumers to opt out before implementing any opt-out direction.

Menu of alternatives. A consumer may be given the opportunity to choose from a menu of 

alternatives when electing to prohibit solicitations, such as by:

• Electing to prohibit solicitations from certain types of affiliates covered by the opt-out 

notice but not other types of affiliates covered by the notice.

• Electing to prohibit solicitations based on certain types of eligibility information but not 

other types of eligibility information. 

• Electing to prohibit solicitations by certain methods of delivery but not other methods of 

delivery.

One of the alternatives, however, must allow the consumer to prohibit all solicitations from all of 

the affiliates that are covered by the notice.

Continuing relationship. If the consumer establishes a continuing relationship with a financial 

institution or its affiliate, an opt-out notice may apply to eligibility information obtained from 

one or more continuing relationships (such as a deposit account, a mortgage loan, or a credit 

card), if the notice adequately describes the continuing relationships covered. The opt-out notice 

can also apply to future continuing relationships if the notice adequately describes the continuing 

future relationships that would be covered.

 

16See 12 CFR 222.26(b) and (c) for examples of “reasonable expectation of actual notice” and “no reasonable expectation of actual 

notice.”

17 For opt-out notices provided electronically, the notice may be provided in compliance with either the electronic disclosure provisions of 

12 CFR 222.24(b)(2) and 222.24(b)(3) or the provisions in section 101 of the Electronic Signatures in Global and National Commerce 

Act, 15 USC 7001 et seq.

18See 12 CFR 222.22(a) for examples of the scope of the opt-out notice, including examples of continuing relationships.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 19

Special rule for a notice following termination of all continuing relationships. After all 

continuing relationships with a financial institution or its affiliate(s) are terminated, a consumer 

must be given a new opt-out notice if the consumer later establishes another continuing 

relationship with the financial institution or its affiliate(s) and the consumer’s eligibility 

information is to be used to make a solicitation. The consumer’s decision not to opt out after 

receiving the new opt-out notice would not override a prior opt-out election that applies to 

eligibility information obtained in connection with a terminated relationship, regardless of 

whether the new opt-out notice applies to eligibility information obtained in connection with a 

terminated relationship.

No continuing relationship (isolated transaction). If the consumer does not establish a 

continuing relationship with a financial institution or its affiliate, but the financial institution or 

its affiliate obtains eligibility information about the consumer in connection with a transaction 

with the consumer (such as an ATM cash withdrawal, purchase of traveler’s checks, or a credit 

application that is denied), an opt-out notice provided to the consumer only applies to eligibility 

information obtained in connection with that transaction.

Time, Duration, and Renewal of Opt-Out 

(12 CFR 222.22(b) and (c) and 222.27)

A consumer may opt out at any time. The opt-out must be effective for a period of at least five years 

beginning when the consumer’s opt-out election is received and implemented, unless the consumer 

later revokes the opt-out in writing or, if the consumer agrees, electronically. An opt-out period may 

be set at more than five years, including an opt-out that does not expire unless the consumer revokes 

it.

Renewal after opt-out period expires. After the opt-out period expires, a financial institution may 

not make solicitations based on eligibility information it receives from an affiliate to a consumer 

who previously opted out, unless:

• The consumer receives a renewal notice and opportunity to opt out, and the consumer does 

not renew the opt-out; or 

• An exception to the notice and opt-out requirements applies.19

Contents of renewal notice. The renewal notice must be clear, conspicuous, and concise, and must 

accurately disclose most of the elements of the original opt-out notice, as well as the following 

information as applicable: 

• The consumer previously elected to limit the use of certain information to make 

solicitations to the consumer.

• The consumer’s election has expired or is about to expire.

• The consumer may elect to renew the consumer’s previous election.

• If applicable, that the consumer’s election to renew will apply for the specified period of 

time stated in the notice and that the consumer will be allowed to renew the election once 

that period expires.

See 12 CFR 222.27(b) for all the content requirements of a renewal notice.

 

19See 12 CFR 222.21(c) for exceptions.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 20

Renewal period. Each opt-out renewal must be effective for a period of at least five years.

Affiliate who may provide the notice. The renewal notice must be provided by the affiliate that 

provided the previous opt-out notice, or its successor; or as part of a joint renewal notice from 

two or more members of an affiliated group of companies, or their successors, that jointly 

provided the previous opt-out notice.

Timing of the renewal notice. A renewal notice may be provided to the consumer either a 

reasonable period of time before the expiration of the opt-out period20 or any time after the 

expiration of the opt-out period but before solicitations are made to the consumer that would 

have been prohibited by the expired opt-out.

Prospective application (12 CFR 222.28(c))

A financial institution may use eligibility information received from an affiliate to make 

solicitations to a consumer if it received such information prior to October 1, 2008, the mandatory 

compliance date of the affiliate marketing regulation. An institution is deemed to have received 

eligibility information when such information is placed into a common database and is accessible 

by the institution prior to that date.

Model forms for opt-out notices 

(12 CFR Part 222, Appendix C)

Appendix C of the affiliate marketing regulation contains model forms that may be used to comply 

with the requirement for clear, conspicuous, and concise notices. The five model forms are:

C-1 Model Form for Initial Opt-Out Notice (Single-Affiliate Notice)

C-2 Model Form for Initial Opt-Out Notice (Joint Notice)

C-3 Model Form for Renewal Notice (Single-Affiliate Notice)

C-4 Model Form for Renewal Notice (Joint Notice)

C-5 Model Form for Voluntary “No Marketing” Notice 

Use of the model forms is not required and a financial institution may make certain changes to the 

language or format of the model forms without losing the protection from liability afforded by use 

of the model forms. These changes may not be so extensive as to affect the substance, clarity, or 

meaningful sequence of the language in the model forms. Institutions making such extensive 

revisions will lose the safe harbor that Appendix C provides. Examples of acceptable changes are 

provided in Appendix C to the regulation. 

 

20 An opt-out period may not be shortened by sending a renewal notice to the consumer before expiration of the opt-out period, even 

if the consumer does not renew the opt-out. If a financial institution provides an annual privacy notice under the Gramm-LeachBliley Act, providing a renewal notice with the last annual privacy notice provided to the consumer before expiration of the opt-out 

period is a reasonable period of time before expiration of the opt-out in all cases (12 CFR 222.27(d)).
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 21

Module 3: Disclosures to Consumers and 

Miscellaneous Requirements

Overview

The FCRA requires financial institutions to provide consumers with various notices and information 

under a variety of circumstances. This module contains examination responsibilities for these 

various areas. 

Use of Consumer Reports for Employment Purposes

(Section 604(b))(15 USC 1681b (b))

This section on the Use of Consumer Reports for Employment Purposes has specific requirements 

for financial institutions that obtain consumer reports of its employees or prospective employees 

prior to, and/or during, the term of employment. The FCRA generally requires the written 

permission of the consumer to procure a consumer report for “employment purposes.” Moreover, 

the financial institution must provide to the consumer in writing a clear and conspicuous disclosure 

that it may obtain a consumer report for employment purposes prior to procuring a report.

Prior to taking any adverse action involving employment that is based in whole or in part on the 

consumer report, the user generally must provide to the consumer:

• A copy of the report.

• A description in writing of the rights of the consumer under this title, as FTC prescribes 

under Section 609(c) (3).

At the time a financial institution takes adverse action in an employment situation, Section 615 

requires that it must provide the consumer with an adverse action notice described later in this 

module. 

Prescreened Consumer Reports and Opt-Out Notice 

(Sections 604(c) and 615(d))(15 USC 1681b(c) and 15 USC 

1681m (d)) and

(Parts 642 and 698 of Federal Trade Commission 

Regulations)

The sections on Prescreened Consumer Reports and Opt-Out Notice allows persons, including 

financial institutions, to obtain and use consumer reports on any consumer in connection with any 

credit or insurance transaction that the consumer does not initiate, to make firm offers of credit or 

insurance. This process, known as prescreening, occurs when a financial institution obtains a list 

from a consumer reporting agency of consumers who meet certain predetermined creditworthiness 

criteria and who have not elected to be excluded from such lists. 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 22

These lists may only contain the following information:

• The name and address of a consumer.

• An identifier that is not unique to the consumer and that the person uses solely for the 

purpose of verifying the identity of the consumer. 

• Other information pertaining to a consumer that does not identify the relationship or 

experience of the consumer with respect to a particular creditor or other entity.

Each name appearing on the list is considered an individual consumer report. In order to obtain and 

use these lists, financial institutions must make a “firm offer of credit or insurance” as defined in 

Section 603(l) to each person on the list. An institution is not required to grant credit or insurance if 

the consumer is not creditworthy or insurable, or cannot furnish required collateral, provided that 

the financial institution determines the underwriting criteria in advance, and applies it consistently.

Example 1: Assume a home mortgage lender obtains a list from a consumer reporting agency of 

everyone in County X, with a current home mortgage loan and a credit score of 700. The lender 

will use this list to market a second lien home equity loan product. The lender’s other 

nonconsumer report criteria, in addition to those used in the prescreened list for this product, 

include a maximum total debt-to-income ratio (DTI) of 50 percent or less. The consumer 

reporting agency can screen some of the criteria but must determine other criteria individually, 

such as the DTI, when consumers respond to the offer. If a consumer responds to the offer, but 

already has a DTI of 60 percent, the lender does not have to grant the loan.

In addition, the financial institution is allowed to obtain a full consumer report on anyone 

responding to the offer to verify that the consumer continues to meet the creditworthiness criteria. If 

the consumer no longer meets those criteria, the financial institution does not have to grant the loan.

Example 2: On January 1, a credit card lender obtains a list from a consumer reporting agency 

of consumers in County Y who have credit scores of 720, and no previous bankruptcy records. 

The lender mails solicitations offering a pre-approved credit card to everyone on the list on 

January 2. On January 31, a consumer responds to the offer and the lender obtains and reviews a 

full consumer report that shows a bankruptcy record was added on January 15. Since this 

consumer no longer meets the lender’s predetermined criteria, the lender is not required to issue 

the credit card.

These basic requirements help prevent financial institutions from obtaining prescreened lists 

without following through with an offer of credit or insurance. The financial institution must 

maintain the criteria used for the product (including the criteria used to generate the prescreened 

report and any other criteria such as collateral requirements) on file for a period of three years, 

beginning on the date that the financial institution made the offer to the consumer. 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 23

Technical Notice and Opt-Out Requirements 

(Section 615(d))

This section contains consumer protections and technical notice requirements concerning 

prescreened offers of credit or insurance. The FCRA requires nationwide consumer reporting 

agencies to jointly operate an “opt-out” system, whereby consumers can elect to be excluded from 

prescreened lists by calling a toll-free number.

When a financial institution obtains and uses these lists, it must provide consumers with a 

Prescreened Opt-Out Notice with the offer of credit or insurance. This notice alerts consumers that 

they are receiving the offer because they meet certain creditworthiness criteria. The notice must also 

provide the toll-free telephone number operated by the nationwide consumer reporting agencies for 

consumers to call to opt out of prescreened lists.

The FCRA contains the basic requirement to provide notices to consumers at the time the 

prescreened offers are made. The Federal Trade Commission (FTC) published an implementing 

regulation containing the technical requirements of the notice at 16 CFR Parts 642 and 698. This 

regulation is applicable to anyone, including banks, credit unions, and saving associations, that 

obtains and uses prescreened consumer reports. These requirements became effective on August 1, 

2005; however, the requirement to provide a notice containing the toll-free opt-out telephone 

number has existed under the FCRA for many years.

Short and Long Notice

FTC regulations—16 CFR 642 and 698—require that the financial institution give a “short” notice 

and a “long” notice of the prescreened opt-out information with each written solicitation made to 

consumers using prescreened consumer reports. These regulations also contain specific 

requirements concerning the content and appearance of these notices. The requirements are listed 

within the following paragraphs of these procedures. The regulations were published on January 31, 

2005, in 70 Federal Register 5022, and took effect August 1, 2005.

The short notice must be a clear and conspicuous, simple, and easy-to-understand statement as 

follows:

• Content. The short notice must state that the consumer has the right to opt out of receiving 

prescreened solicitations. It must provide the toll-free number and direct consumers to the 

existence and location of the long notice. It should also state the title of the long notice. The 

short notice may not contain any other information.

• Form. The short notice must be in a type size larger than the principal text on the same 

page, but it may not be smaller than 12-point type. If the financial institution provides the 

notice by electronic means, it must be larger than the type size of the principal text on the 

same page.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 24

• Location. The short form must be on the front side of the first page of the principal 

promotional document in the solicitation. If provided electronically, it must be on the same 

page and in close proximity to the principal marketing message. The statement must be 

located so that it is distinct from other information, such as inside a border, and must be in 

a distinct type style, such as bolded, italicized, underlined, and/or in a color that contrasts 

with the principal text on the page, if the solicitation is provided in more than one color.

The long notice must also be a clear and conspicuous, simple, and easy-to-understand statement as 

follows:

• Content. The long notice must state the information required by Section 615(d) of the 

FCRA and may not include any other information that interferes with, detracts from, 

contradicts, or otherwise undermines the purpose of the notice.

• Form. The notice must appear in the solicitation, be in a type size that is no smaller than the 

type size of the principal text on the same page, and, for solicitations provided other than by 

electronic means, the type size may not be smaller than 8-point type. The notice must begin 

with a heading in capital letters, underlined, and identifying the long notice as the 

“PRESCREEN & OPT-OUT NOTICE.” It must be in a type style that is distinct from the 

principal type style used on the same page, such as bolded, italicized, underlined, and/or in 

a color that contrasts from the principal text, if the solicitation is in more than one color. 

The notice must be set apart from other text on the page, such as by including a blank line 

above and below the statement, and by indenting both the left and right margins from other 

text on the page.

The FTC developed model Prescreened Opt-Out Notices, which are contained in Appendix A to 16 

CFR 698 of the FTC’s regulations. Appendix A contains complete sample solicitations for context. 

The prescreen notice text is contained below:

Sample Short Notice:

You can choose to stop receiving “prescreened” offers of (credit or insurance) from this and 

other companies by calling toll-free (toll-free number). See PRESCREEN & OPT-OUT 

NOTICE on other side (or other location) for more information about prescreened offers.

Sample Long Notice:

PRESCREEN & OPT-OUT NOTICE: This “prescreened” offer of (credit or insurance) is 

based on information in your credit report indicating that you meet certain criteria. This offer 

is not guaranteed if you do not meet our criteria (including providing acceptable property as 

collateral). If you do not want to receive prescreened offers of (credit or insurance) from this 

and other companies, call the consumer reporting agencies (or name of consumer reporting 

agency) toll-free, (toll-free number); or write: (consumer reporting agency name and mailing 

address).
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 25

Truncation of Credit and Debit Card Account Numbers 

(Section 605(g))(15 USC 1681c(g))

This section on Truncation of Credit and Debit Card Account Numbers provides that persons, 

including financial institutions that accept debit and credit cards for the transaction of business will 

be prohibited from issuing electronic receipts that contain more than the last five digits of the card 

number, or the card expiration date, at the point of sale or transaction. This requirement applies only 

to electronically developed receipts and does not apply to hand-written receipts or those developed 

with an imprint of the card.

For Automatic Teller Machines (ATMs) and Point-of-Sale (POS) terminals or other machines that 

were put into operation before January 1, 2005, this requirement took effect on December 4, 2006. 

For ATMs and POS terminals or other machines that were put into operation on or after January 1, 

2005, the effective date was the date of installation.

Disclosure of Credit Scores by Certain Mortgage Lenders 

(Section 609(g))(15 USC 1681g(g))

This section on Disclosure of Credit scores by Certain Mortgage Lenders requires financial 

institutions that make or arrange mortgage loans using credit scores to provide the score with 

accompanying information to the applicants. 

Credit score

For purposes of this section, the term “credit score” is defined as a numerical value or a 

categorization derived from a statistical tool or modeling system used by a person who makes or 

arranges a loan to predict the likelihood of certain credit behaviors, including default (and the 

numerical value or the categorization derived from such analysis may also be referred to as a “risk 

predictor” or “risk score”). The credit score does not include either of the following: 

• Any mortgage score or rating by an automated underwriting system that considers one or 

more factors in addition to credit information, such as the loan-to-value ratio, the amount of 

down payment, or the financial assets of a consumer. 

• Any other elements of the underwriting process or underwriting decision.

Covered transactions

The disclosure requirement applies to both closed-end and open-end loans that are for consumer 

purposes and are secured by one- to four-family residential real properties, including purchase and 

refinance transactions. This requirement will not apply in circumstances that do not involve a 

consumer purpose, such as when a borrower obtains a loan secured by his or her residence to 

finance his or her small business.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 26

Specific required notice

Financial institutions in covered transactions that use credit scores must provide a disclosure 

containing the following specific language, which is contained in 609(g)(1)(D): 

Notice to The Home Loan Applicant

In connection with your application for a home loan, the lender must disclose to you the 

score that a consumer reporting agency distributed to users and the lender used in connection with 

your home loan, and the key factors affecting your credit scores.

The credit score is a computer generated summary calculated at the time of the request and 

based on information that a consumer reporting agency or lender has on file. The scores are based 

on data about your credit history and payment patterns. Credit scores are important because they are 

used to assist the lender in determining whether you will obtain a loan. They may also be used to 

determine what interest rate you may be offered on the mortgage. Credit scores can change over 

time, depending on your conduct, how your credit history and payment patterns change, and how 

credit scoring technologies change. 

Because the score is based on information in your credit history, it is very important that 

you review the credit-related information that is being furnished to make sure it is accurate. Credit 

records may vary from one company to another.

If you have questions about your credit score or the credit information that is furnished to 

you, contact the consumer reporting agency at the address and telephone number provided with this 

notice, or contact the lender, if the lender developed or generated the credit score. The consumer 

reporting agency plays no part in the decision to take any action on the loan application and is 

unable to provide you with specific reasons for the decision on a loan application.

If you have questions concerning the terms of the loan, contact the lender.

The notice must include the name, address, and telephone number of each consumer reporting 

agency that provided a credit score that was used. 

Credit score and key factors disclosed

In addition to the notice, financial institutions must also disclose the credit score, the range of 

possible scores, the date that the score was created, and the “key factors” used in the score 

calculation. “Key factors” are all relevant elements or reasons adversely affecting the credit score 

for the particular individual, listed in the order of their importance, and based on their effect on the 

credit score. The total number of factors the financial institution should disclose must not exceed 

four. However, if one of the key factors is the number of inquiries into a consumer’s credit 

information, then the total number of factors must not exceed five. These key factors come from 

information the consumer reporting agencies supplied with any consumer report that was furnished 

containing a credit score (Section 605(d)(2)).
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 27

This disclosure requirement applies in any application for a covered transaction, regardless of the 

final action the lender takes on the application. The FCRA requires a financial institution to disclose 

all of the credit scores used in these transactions. For example, if two joint applicants apply for a 

mortgage loan to purchase a single-family residence and the lender uses both credit scores, then the 

financial institution needs to disclose both. The statute specifically does not require more than one 

disclosure per loan. Therefore, if the financial institution uses multiple scores, it can include all of 

them in one disclosure containing the Notice to the Home Loan Applicant. 

If a financial institution uses a credit score that it did not obtain directly from a consumer reporting 

agency, but may contain some information from a consumer reporting agency, the financial 

institution may satisfy this disclosure requirement by providing a score and associated key factor 

information that a consumer reporting agency supplied. For example, certain automated 

underwriting systems generate a score used in a credit decision. These systems are often populated 

by data obtained from a consumer reporting agency. If a financial institution uses this automated 

system, it may satisfy the disclosure requirement by providing the applicants with a score and key 

factors a consumer reporting agency supplied based on the data, including credit score(s) imported 

into the automated underwriting system. This will provide applicants with information about their 

credit history and its role in the credit decision, in the spirit of this section of the statute.

Timing

With regard to the timing of the disclosure, the statute requires that the financial institution provide 

it as soon as is reasonably practicable after using a credit score. 

Adverse Action Disclosures 

(Section 615(a) and (b))(15 USC 1681m(a) and (b))

This section requires users of consumer reports to make certain disclosures when they take adverse 

actions with respect to consumers, based on information received from third parties. Specific 

disclosures are required depending upon whether the source of the information is: a consumer 

reporting agency, a third party other than a consumer reporting agency, or an affiliate. The 

disclosure requirements are discussed separately below.

Information Obtained From a Consumer Reporting Agency

Section 615(a), Duties of Users Taking Adverse Actions on the Basis of Information Contained in 

Consumer Reports, provides that when adverse action is taken with respect to any consumer based 

in whole or in part on any information contained in a consumer report, the financial institution must:

• Provide oral, written, or electronic notice of the adverse action to the consumer.

• Provide to the consumer orally, in writing, or electronically:

 The name, address, and telephone number of the consumer reporting agency from 

which it received the information (including a toll-free telephone number established 

by the agency, if the consumer reporting agency maintains files on a nationwide basis). 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 28

 A statement that the consumer reporting agency did not make the decision to take the 

adverse action and is unable to provide the consumer the specific reasons why the 

adverse action was taken.

• Provide the consumer an oral, written, or electronic notice of the consumer’s right to obtain 

a free copy of the consumer report from the consumer reporting agency within 60 days of 

receiving notice of the adverse action, and the consumer’s right to dispute the accuracy or 

completeness of any information in the consumer report with the consumer reporting 

agency.

Information Obtained from a Source Other Than a Consumer 

Reporting Agency

Section 615(b)(1) provides that if a financial institution (a) denies credit for personal, family, or 

household purposes involving a consumer, or (b) increases the charge for such credit, that is 

partially or wholly on the basis of information obtained from a person other than a consumer 

reporting agency and bearing upon the consumer’s creditworthiness, credit standing, credit capacity, 

character, general reputation, personal characteristics, or mode of living, the financial institution:

• At the time it communicates an adverse action to a consumer, must clearly and accurately 

disclose the consumer’s right to file a written request for the reasons for the adverse action.

• If it receives such a request within 60 days after the consumer learns of the adverse action, 

must disclose, within a reasonable period of time, the nature of the adverse information. 

The financial institution should sufficiently detail the information to enable the consumer to 

evaluate its accuracy. The financial institution may, but need not, disclose the source of the 

information. In some instances, it may be impossible to identify the nature of certain 

information without also revealing the source.

Information Obtained from an Affiliate

Section 615(b)(2), Duties of Taking Certain Actions Based on Information Provided by Affiliate, 

provides that if a person, including a financial institution, takes an adverse action involving credit 

(taken in connection with a transaction initiated by a consumer), insurance or employment, based in 

whole or in part on information provided by an affiliate, the financial institution must notify the 

consumer that the information:

• Was furnished by a person related to the financial institution by common ownership or 

affiliated by common corporate control.

• Bears upon the consumer’s creditworthiness, credit standing, credit capacity, character, 

general reputation, personal characteristics, or mode of living.

• Does not pertain solely to transactions or experiences between the consumer and the person 

furnishing the information.

• Does not include information in a consumer report.

The notification must inform the consumer of the action and that the consumer may obtain a 

disclosure of the nature of the information relied upon by making a written request within 60 days 

of transmittal of the adverse action notice. If the consumer makes such a request, the user must 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 29

disclose the nature of the information received from the affiliate not later than 30 days after 

receiving the request.

Debt Collector Communications Concerning Identity Theft 

(Section 615(g))(15 USC 1681m(g))

This section, Debt Collector Communications Concerning Identity Thefts, has specific requirements 

for financial institutions that act as debt collectors, whereby they collect debts on behalf of a third 

party that is a creditor or other user of a consumer report. The requirements do not apply when a 

financial institution is collecting its own loans. When a financial institution is notified that any 

information relating to a debt that it is attempting to collect may be fraudulent or may be the result 

of identity theft, the financial institution must notify the third party of this fact. In addition, if the 

consumer, to whom the debt purportedly relates, requests information about the transaction, the 

financial institution must provide all of the information the consumer would otherwise be entitled to 

if the consumer wished to dispute the debt under other provisions of law applicable to the financial 

institution.

Risk-Based Pricing Notice (Section 615(h))

Section 615(h) of the Fair Credit Reporting Act (FCRA) generally requires a user of consumer 

reports, such as a financial institution, to provide a risk-based pricing notice to a consumer when the 

financial institution, based on a consumer report, extends credit to the consumer on terms that are 

“materially less favorable” than the terms the financial institution has extended to other consumers. 

On January 15, 2010, the Federal Reserve and the Federal Trade Commission published final rules 

in the Federal Register (75 FR 2724) implementing this section of the FCRA. 

The risk-based pricing notice requirement is designed primarily to improve the accuracy of 

consumer reports by alerting consumers to the existence of negative information in their consumer 

reports so that the consumers can, if they choose, check their consumer reports for accuracy and 

correct any inaccurate information. This notice provision is meant to complement an existing 

provision of the FCRA, Section 615(a), whereby a creditor that denies a consumer’s application for 

credit, based in whole or in part on information in a consumer’s report, must provide an adverse 

action notice. The new provision, Section 615(h), covers the situation where credit is offered at 

“materially less favorable terms,” rather than being denied.

Definitions (12 CFR 222.71)

The following definitions pertain to the rules governing the risk-based pricing regulation:

• “Material terms” means in general: 

 For open-end credit, the annual percentage rate (APR) required to be disclosed in the 

account opening disclosures required under Regulation Z. This does not include a 

temporary initial rate that is lower than the rate that will apply when the temporary rate 

expires, any penalty rate that applies upon the occurrence of specific events (such as a 

late payment), or any fixed APR option for a home equity line of credit;
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 30

 For credit cards (other than a credit card used to access a home equity line of credit or a 

charge card), the APR that applies for purchases. For credit cards without a purchase 

APR, “material terms” means the APR that varies based on consumer report information 

and that has the most significant financial impact on consumers;

 For closed-end credit, the APR required to be disclosed prior to consummation under the 

closed-end provisions of Regulation Z; and

 For credit that does not have an APR, the financial term that varies based on consumer 

report information and that has the most significant financial impact on consumers, such 

as an annual membership fee for a charge card. 

• “Materially less favorable” means, generally, that the cost of credit to a consumer would be 

significantly greater than the cost of credit to another consumer from or through the same 

creditor. Relevant factors in determining the significance of a difference in cost include the 

type of credit product, the term of the credit extension, and the extent of the difference.

General requirements (12 CFR 222.72-73)

A financial institution must provide to a consumer a notice (“risk-based pricing notice”) in the form 

and manner prescribed by the regulation if: 

• The institution uses a consumer report in connection with an application for, or a grant, 

extension, or other provision of, credit to a consumer for personal, family, or household 

purposes; and

• Based in whole or in part on the consumer report, the institution grants, extends, or 

otherwise provides credit to that consumer on material terms that are materially less 

favorable than the most favorable material terms available to a substantial proportion of 

consumers from that institution.

The obligation to provide the notice applies to the creditor to whom the obligation is initially 

payable, i.e., the original creditor. This interpretation excludes brokers and other intermediaries who 

do not themselves grant, extend, or provide credit to consumers. See preamble to the final 

regulation (75 FR at 2730 - 2731).

Determination of which consumers must receive notice (12 CFR 222.72(b)). A financial institution 

may determine, on a case-by-case basis, whether a consumer has received material terms that are 

materially less favorable by comparing the material terms offered to the consumer to the material 

terms offered to other consumers for a specific type of credit product. A “specific type of credit 

product” means one or more credit products with similar features that are designed for similar 

purposes. Examples include student loans, unsecured credit cards, secured credit cards, new 

automobile loans, used automobile loans, fixed-rate mortgage loans, and variable-rate mortgage 

loans.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 31

Because making such a direct comparison between consumers may not be operationally feasible, 

the rules provide the two alternative methods, a credit score proxy method and a tiered pricing 

method, both of which are described as follows: 

Credit score proxy method (12 CFR 222.72(b)(1)). If a creditor uses credit scores to set the material 

terms of credit, the creditor may determine a cutoff score that represents the point at which 

approximately 40 percent of its consumers have higher credit scores and 60 percent of its consumers 

have lower credit scores. The creditor may then provide a risk-based pricing notice to each 

consumer who has a credit score lower than the cutoff score. 

Credit Score Proxy Example

The number of all, or a representative sample of, consumers to whom the institution 

granted credit for a specific type of credit product

10,000

40 percent of consumers 4,000

Credit scores of the 4,000 consumers with the highest credit scores 700 or higher

Cutoff score 700

Credit scores of those consumers to whom the creditor must provide a risk-based 

pricing notice, because the consumers’ scores are lower than cutoff score

699 or lower

Alternative to 40/60 cutoff. The regulation provides an alternative to the 40/60 cutoff discussed 

above for situations where more than 40 percent of consumers (e.g., 80 percent) receive the most 

favorable material terms. In such situations, the creditor may set a different cutoff score based on its 

historical experience. The cutoff score would be set at a point at which the approximate percentage 

of consumers who historically have received the most favorable material terms based on their credit 

score would not receive a notice in the future. Under this alternative, the risk-based pricing notices 

would be provided to the approximate percentage of consumers who historically have been granted 

credit on material terms other than the most favorable terms. 

For example, based on a sample of credit extended in the past six months, a creditor may determine 

that approximately 80 percent of its consumers received credit at its lowest APR (i.e., the most 

favorable material terms), and 20 percent of its consumers received credit at a higher APR (i.e., 

material terms other than the most favorable). Approximately 80 percent of the sampled consumers 

had a credit score at or above 750, and 20 percent had a credit score below 750. As a result, the card 

issuer could select 750 as its cutoff score. Consumers who have credit scores lower than 750 would 

receive the risk-based pricing notice. See preamble to the final regulation (75 FR at 2733).

Recalculation. An institution must recalculate the score no less than every two years.

Specific type of product. A financial institution must calculate the cutoff score by considering the 

credit scores of all, or a representative sample of, the consumers who have received credit for a 

specific type of credit product. 

New entrants or new products. For new entrants into the credit business or for new products subject 

to risk-based pricing, a financial institution may determine the cutoff score based on information 

from market research or other third-party sources. For a newly acquired credit portfolio, a financial 

institution may determine the cutoff score from information obtained from the party from which it 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 32

acquired the portfolio. The institution must recalculate the cutoff score using the scores of its own 

consumers within one year after it begins using a score derived from market research, a third-party, 

or the party from which it acquired the portfolio. If, within that one year, it has not granted credit to 

a sufficient number of new consumers, thus preventing it from having sufficient data with which to 

recalculate a cut-off score based on the credit scores of its own consumers, it may continue to use 

the original cutoff score. However, within two years, it must calculate its own cutoff score if it has 

granted credit to some new consumers within those two years.

Use of multiple credit scores. For a financial institution that generally uses two or more credit 

scores to set material credit terms, the institution must determine the cutoff score using the same 

method used to evaluate multiple scores when making credit decisions (for example, using an 

average credit score). If the institution does not consistently use the same method for evaluating 

multiple scores, the institution must use a reasonable means. For example, the institution may use 

any one of the methods that the institution ordinarily uses or the average credit score of each 

consumer to calculate the credit score by a reasonable means.

No credit score available for a consumer. If no credit score is available for a consumer, a financial 

institution must assume that it is granting credit on materially less favorable terms and thus must 

provide a risk-based pricing notice to the consumer.

Tiered pricing method (12 CFR 222.72(b)(2)). If a financial institution sets the material terms of 

credit by assigning each consumer to one of a discrete number of pricing tiers for a specific type of 

credit product, based in whole or in part on a consumer report, the institution may provide a riskbased pricing notice to each consumer who is not assigned to the top pricing tier or tiers.

If the financial institution uses four or fewer pricing tiers, it complies by providing risk-based 

pricing notices to all consumers who do not qualify for the top, best-priced tier. If the institution 

uses five or more pricing tiers, it complies by providing the notices to all consumers who do not 

qualify for the two top, best-priced tiers and any other tier that, combined with the top two tiers, 

equals no less than the top 30 percent and no more than the top 40 percent of the total number of 

tiers.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 33

Tiered Pricing Example

Four or fewer tiers

Top tier = best rate APR Notice requirements.

Tier 1 (top) 8% No risk-based pricing notice required.

Tier 2 10% Risk-based pricing notice required for Tiers 2, 3 and 4.

Tier 3 12%

Tier 4 14%

Five or more tiers (5 tiers)

Top tier = best rate APR

Tier 1 (top) 8% No risk-based pricing notice required for top 30% to 40% of 

tiers. 

Top two tiers comprise 2 out of 5 (40%) of the number of 

tiers.

Tier 2 10%

Tier 3 12% Risk-based notices required for Tiers 3-5.

Tier 4 14%

Tier 5 16%

Five or more tiers (9 tiers)

Top tier = best rate APR

Tier 1 (top) 8% No risk-based pricing notice required for top 30% to 40% of 

tiers. 

Top three tiers comprise 3 out of 9 (33%) of the number of 

tiers.

Tier 2 10%

Tier 3 12%

Tier 4 14% Risk-based notices required for Tiers 4-9.

Tier 5 16%

Tier 6 18%

Tier 7 20%

Tier 8 22%

Tier 9 24%
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 34

• Application to credit card issuers (12 CFR 222.72(c)). A credit card issuer may use any of 

the methods in 12 CFR 222.72(b) to identify consumers to whom it must provide a riskbased pricing notice. Alternatively, the card issuer may provide the notice when: 

 A consumer applies for a credit card in connection with an application program or in 

response to a solicitation, and more than one purchase APR may apply under the 

program or solicitation, and 

 Based in whole or in part on a consumer report, the credit card is issued to a consumer 

with an APR that is higher than the lowest APR available in connection with the 

application or solicitation. 

The risk-based pricing requirements do not apply to a card issuer if the credit card program offers 

only a single annual APR (other than temporary initial rates or penalty rates) or if the issuer offers 

the consumer the lowest possible APR under the credit card program. 

Content of the notice (12 CFR 222.73(a)(1)). The risk-based pricing notice must include:

• A statement that a consumer report (or credit report) includes information about the 

consumer’s credit history and the type of information included in that history;

• A statement that the consumer is encouraged to verify the accuracy of the information 

contained in the consumer report and has the right to dispute any inaccurate information in 

the report;

• The identity of each consumer reporting agency that furnished a consumer report used in 

the credit decision;

• A statement that federal law gives the consumer the right to obtain a copy of a consumer 

report from the consumer reporting agency or agencies identified in the notice without 

charge for 60 days after receipt of the notice;

• A statement informing the consumer how to obtain a consumer report from the consumer 

reporting agency or agencies identified in the notice and providing contact information 

(including a toll-free telephone number, where applicable) specified by the consumer 

reporting agency or agencies; 

• A statement directing consumers to the websites of the Federal Reserve Board and Federal 

Trade Commission to obtain more information about consumer reports; 

• A statement that the terms offered, such as the APR, have been set based on information 

from a consumer report; and

• A statement that the terms offered may be less favorable than the terms offered to 

consumers with better credit histories.

See Appendix H-1 of the regulation for a model form for the risk-based pricing notice.

Account Review (12 CFR 222.72(d)). Generally, creditors must provide an account review riskbased pricing notice to the consumer if the creditor, based in whole or in part on a consumer report, 

increases the consumer’s APR after a review of the consumer’s account, unless one of the 

exceptions in 12 CFR 222.74(a), (b), or (c) applies (for example, the creditor provides an adverse 

action notice). 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 35

Content of account review risk-based pricing notice (12 CFR 222.73(a)(2)). The account review 

risk-based pricing notice must include: 

• A statement that a consumer report (or credit report) includes information about the 

consumer’s credit history and the type of information included in that history;

• A statement that the consumer is encouraged to verify the accuracy of the information 

contained in the consumer report and has the right to dispute any inaccurate information in 

the report;

• The identity of each consumer reporting agency that furnished a consumer report used in 

the account review;

• A statement that federal law gives the consumer the right to obtain a copy of a consumer 

report from the consumer reporting agency or agencies identified in the notice without 

charge for 60 days after receipt of the notice;

• A statement informing the consumer how to obtain a consumer report from the consumer 

reporting agency or agencies identified in the notice and providing contact information 

(including a toll-free telephone number, where applicable) specified by the consumer 

reporting agency or agencies; 

• A statement directing consumers to the websites of the Federal Reserve Board and Federal 

Trade Commission to obtain more information about consumer reports; 

• A statement that the financial institution has conducted a review of the account using 

information from a consumer report; and

• A statement that as a result of the review, the APR on the account has been increased based 

on information from a consumer report. 

NOTE: Items 1 through 6 for account review risk-based pricing notice are substantially the same as 

items 1 through 6 for the risk-based pricing notice. Only the last two items in each list are different.

See Appendix H-2 of the regulation for a model form for the account review risk-based pricing 

notice.

Form of the notice (12 CFR 222.73(b)).The risk-based pricing notices and the account review riskbased pricing notices must be clear and conspicuous and provided to the consumer in oral, written, 

or electronic form. Creditors are deemed to be in compliance with the disclosure requirements 

through use of the optional, applicable model forms, found in Appendix H of the regulation. 

Timing (12 CFR 222.73(c)). The timing requirement depends on the specific type of credit 

transaction as specified below:

• For closed-end credit, a risk-based pricing notice must be provided to the consumer after

the decision to approve a credit request is communicated to the consumer, but before 

consummation of the transaction. 

• For open-end credit, the notice must be provided after the decision to grant credit is 

communicated to the consumer, but before the first transaction under the plan has been 

made.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 36

• For account reviews, the notice must be provided at the time that the decision to increase 

the APR is communicated to the consumer. If no notice of the increase in the APR is 

provided to the consumer prior to the effective date of the APR change, the notice must be 

provided no later than five days after the effective date of the APR change. 

• For automobile lending transactions made through an auto dealer that is unaffiliated with 

the institution, the institution may provide a risk-based pricing notice in the time periods 

described above for closed-end credit. Alternatively, the institution may arrange to have the 

auto dealer provide a risk-based pricing notice to the consumer on its behalf within these 

time periods and maintain reasonable policies and procedures to verify that the auto dealer 

provides the notices to consumers within the applicable time periods.

• For instant credit that is granted under an open-end credit plan to a consumer in person or 

by telephone, the risk-based pricing notice may be provided at the earlier of:

 The time of the first mailing to the consumer after the decision is made to approve the 

credit, such as in a mailing containing the account agreement or a credit card; or

 Within 30 days after the decision to approve the credit.

Exceptions (12 CFR 222.74)

The rules contain a number of exceptions to the risk-based pricing notice requirement, as follows:

• when a consumer applies for specific terms of credit, and receives them, unless those terms 

were specified by the creditor using a consumer report after the consumer applied for the 

credit and after the creditor obtained the consumer report (12 CFR 222.74(a)); 

• when a creditor provides a notice of adverse action (12 CFR 222.74(b)); 

• when a creditor makes a firm offer of credit in a prescreened solicitation (12 CFR 

222.74(c));

• when an institution generally provides a credit score disclosure to each consumer that 

requests a loan that is or will be secured by residential real property (12 CFR 222.74(d));

• when an institution generally provides a credit score disclosure to each consumer that 

requests a loan that is not or will not be secured by residential real property (12 CFR 

222.74(e));

• When an institution, which otherwise provides credit score disclosures to consumers that 

request loans, provides a disclosure about credit scores when no credit score is available 

(12 CFR 222.74(f)).

The regulation contains specific disclosure requirements for Sections 222.74(d)-(f) exceptions, as 

discussed below.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 37

Section 222.74(d) exception - credit score disclosure for loans secured by residential real property 

(12 CFR 222.74(d)). An institution is not required to provide a risk-based pricing notice to a 

consumer under Sections 222.72(a) or (c) if: 

• The consumer requests from an institution an extension of credit that is or will be secured 

by one to four units of residential real property; and 

• The institution generally provides to each consumer that requests such an extension of 

credit a notice that contains the following:

 A statement that a consumer report (or credit report) is a record of the consumer’s 

credit history and includes information about whether the consumer pays his or her 

obligations on time and how much the consumer owes to creditors; 

 A statement that a credit score is a number that takes into account information in a 

consumer report and that a credit score can change over time to reflect changes in the 

consumer’s credit history;

 A statement that the consumer’s credit score can affect whether the consumer can 

obtain credit and what the cost of that credit will be;

 A statement that the consumer is encouraged to verify the accuracy of the information 

contained in the consumer report and has the right to dispute any inaccurate 

information in the report;

 A statement that federal law gives the consumer the right to obtain copies of his or her 

consumer reports directly from the consumer reporting agencies, including a free 

report from each of the nationwide consumer reporting agencies once during any 12-

month period;

 Contact information for the centralized source from which consumers may obtain their 

free annual consumer reports; 

 A statement directing consumers to the websites of the Federal Reserve Board and 

Federal Trade Commission to obtain more information about consumer reports; 

 The information required to be disclosed to the consumer in Section 609(g) of the 

FCRA, and as described in Module 3 of these examination procedures, under 

“Disclosure of Credit Scores by Certain Mortgage Lenders (FCRA), Section 609(g);” 

and
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 38

 The distribution of credit scores among consumers who are scored under the same 

scoring model that is used to generate the consumer’s credit score. The distribution 

must:

 Use the same scale as that of the credit score provided to the consumer, and 

 Be presented:

 In the form of a bar graph containing a minimum of six bars that illustrates the 

percentage of consumers with credit scores within the range of scores reflected in 

each bar, 

 By other clear and readily understandable graphical means, or 

 In a clear and readily understandable statement informing the consumer how his 

or her credit score compares to the scores of other consumers. 

The presentation may use a graph or statement obtained from the entity providing the 

credit score if it meets these requirements.

Form of the notice. The Section 222.74(d) notice must be:

 Clear and conspicuous;

 Provided on or with the notice required by Section 609(g) of the FCRA;

 Segregated from other information provided to the consumer, except for the notice 

required by Section 609(g) of the FCRA; and

 Provided to the consumer in writing and in a form that the consumer may keep.

Timing. The Section 222.74(d) notice must be provided to the consumer at the same time as the 

disclosure required by Section 609(g) of the FCRA is provided to the consumer, which must be 

provided as soon as reasonably practicable after the credit score has been obtained. In any event, 

the Section 222.74(d) notice must be provided at or before consummation in the case of closedend credit or before the first transaction is made under an open-end credit plan.

Content of the notice when using multiple credit scores. When an institution obtains two or 

more credit scores from consumer reporting agencies in setting material terms of credit, the 

content of the Section 222.74(d) notice varies depending upon whether the institution only relies 

upon one of the credit scores or relies upon multiple credit scores. 

 If an institution only relies upon one of those credit scores in setting the material terms 

of credit granted, extended, or otherwise provided to a consumer (for example, by 

using the low, middle, high, or most recent score), the notice must include that credit 

score and the other information required by Section 222.74(d). 

 If an institution relies upon multiple credit scores in setting the material terms of credit 

granted, extended, or otherwise provided to a consumer (for example, by computing 

the average of all the credit scores obtained), the notice must include one of those 

credit scores and the other information required by Section 222.74(d). 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 39

At the institution’s option, the notice may include more than one credit score, along with the 

additional information required by Section 222.74(d) for each credit score disclosed.

Examples:

 An institution uses consumer reports to set the material terms of mortgage credit 

granted, extended, or provided to consumers and regularly requests credit scores from 

several consumer reporting agencies. It relies upon the low score when determining the 

material terms it will offer to the consumer. The institution must disclose the low score 

in the Section 222.74(d) notice.

 An institution uses consumer reports to set the material terms of mortgage credit 

granted, extended, or provided to consumers and regularly requests credit scores from 

several consumer reporting agencies. The institution takes an average of all of the 

credit scores obtained in order to determine the material terms it will offer to the 

consumer, and thus relies upon all of the credit scores that it receives. The institution 

may choose one of these scores to include in the Section 222.74(d) notice.

Model form. Appendix H-3 of the regulation contains a model form of the Section 222.74(d) 

notice that is consolidated with the notice required by Section 609(g) of the FCRA. While use of 

the model form is optional, appropriate use of Model Form H-3 is deemed to comply with the 

requirements of Section 222.74(d). 

Section 222.74(e) exception - credit score disclosure for loans not secured by residential real 

property (12 CFR 222.74(e)). An institution is not required to provide a risk-based pricing notice to 

a consumer under Section 222.72(a) or (c) if:

• The consumer requests from an institution an extension of credit that is not or will not be 

secured by one to four units of residential real property; and 

• The institution provides to each consumer that requests such an extension of credit a notice 

that contains the following:

 A statement that a consumer report (or credit report) is a record of the consumer’s 

credit history and includes information about whether the consumer pays his or her 

obligations on time and how much the consumer owes to creditors;

 A statement that a credit score is a number that takes into account information in a 

consumer report and that a credit score can change over time to reflect changes in the 

consumer’s credit history;

 A statement that the consumer’s credit score can affect whether the consumer can 

obtain credit and what the cost of that credit will be;

 A statement that the consumer is encouraged to verify the accuracy of the information 

contained in the consumer report and has the right to dispute any inaccurate 

information in the report;
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 40

 A statement that federal law gives the consumer the right to obtain copies of his or her 

consumer reports directly from the consumer reporting agencies, including a free 

report from each of the nationwide consumer reporting agencies once during any 12-

month period;

 Contact information for the centralized source from which consumers may obtain their 

free annual consumer reports; 

 A statement directing consumers to the websites of the Federal Reserve Board and 

Federal Trade Commission to obtain more information about consumer reports;

 The current credit score of the consumer or the most recent credit score of the 

consumer that was previously calculated by the consumer reporting agency for a 

purpose related to the extension of credit;

 The distribution of credit scores among consumers who are scored under the same 

scoring model that is used to generate the consumer’s credit score. The distribution 

must:

 Use the same scale as that of the credit score provided to the consumer, and 

 Be presented:

 in the form of a bar graph containing a minimum of six bars that illustrates the 

percentage of consumers with credit scores within the range of scores reflected in 

each bar, 

 by other clear and readily understandable graphical means, or 

 In a clear and readily understandable statement informing the consumer how his 

or her credit score compares to the scores of other consumers. 

The presentation may use a graph or statement obtained from the entity providing the 

credit score if it meets these requirements.

 The range of possible credit scores under the model used to generate the credit score;

 The date on which the credit score was created; and

 The name of the consumer reporting agency or other person that provided the credit 

score.

NOTE: Items a, b, c, d, e, f, g, and i for the Section 222.74(e) notice are the same as 

items a, b, c, d, e, f, g, and i for the Section 222.74(d) notice. 

Form of the notice. The Section 222.74(e) notice must be:

 Clear and conspicuous;

 Segregated from other information provided to the consumer; and

 Provided to the consumer in writing and in a form that the consumer may keep.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 41

Timing. The Section 222.74(e) notice generally must be provided to the consumer as soon as 

reasonably practicable after the credit score has been obtained, but in any event at or before 

consummation in the case of closed-end credit or before the first transaction is made under an 

open-end credit plan. The notice may alternatively be provided in the following manner:

 For automobile lending transactions made through an auto dealer that is unaffiliated 

with the institution, the institution may provide a Section 222.74(e) notice in the time 

periods described above. Alternatively, the institution may arrange to have the auto 

dealer provide a Section 222.74(e) notice to the consumer on its behalf within these 

time periods and maintain reasonable policies and procedures to verify that the auto 

dealer provides the notice to the consumer within the applicable time periods. If the 

institution arranges to have the auto dealer provide a Section 222.74(e) notice, the 

institution complies if the consumer receives a notice containing a credit score 

obtained by the dealer, even if a different credit score is obtained and used by the 

institution (12 CFR 222.73(c)(2)).

 For instant credit that is granted under an open-end credit plan to a consumer in person 

or by telephone, the Section 222.74(e) notice may be provided at the earlier of:

 The time of the first mailing to the consumer after the decision is made to approve 

the credit, such as in a mailing containing the account agreement or a credit card; or

 Within 30 days after the decision to approve the credit (12 CFR 222.73(c)(3)).

Multiple credit scores. When an institution obtains two or more credit scores from consumer 

reporting agencies in setting material terms of credit, the content of the Section 222.74(e) notice 

varies depending if the institution relies upon only one of the credit scores or relies upon 

multiple credit scores. These disclosures requirements are the same as those for the Section 

222.74(d) notices, as described previously.

Model form. Appendix H-4 of the regulation contains a model form of the Section 222.74(e) 

notice. While use of the model form is optional, appropriate use of Model Form H-4 is deemed 

to comply with the requirements of Section 222.74(e).
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 42

Section 222.74(f) exception - credit score not available (12 CFR 222.74(f)). An institution is not 

required to provide a risk-based pricing notice to a consumer under Section 222.72(a) or (c) if the 

institution:

• Regularly obtains credit scores from a consumer reporting agency and provides credit score 

disclosures to consumers in accordance with Sections 222.74(d) or (e), but a credit score is 

not available from the consumer reporting agency from which the institution regularly 

obtains credit scores for a consumer to whom the institution grants, extends, or provides 

credit;

• Does not obtain a credit score from another consumer reporting agency in connection with 

granting, extending, or providing credit to the consumer; and

• Provides to the consumer a notice that contains the following:

 A statement that a consumer report (or credit report) includes information about the 

consumer’s credit history and the type of information included in that history;

 A statement that a credit score is a number that takes into account information in a 

consumer report and that a credit score can change over time in response to changes in 

the consumer’s credit history;

 A statement that credit scores are important because consumers with higher credit 

scores generally obtain more favorable credit terms;

 A statement that not having a credit score can affect whether the consumer can obtain 

credit and what the cost of that credit will be;

 A statement that a credit score about the consumer was not available from a consumer 

reporting agency, which must be identified by name, generally due to insufficient 

information regarding the consumer’s credit history;

 A statement that the consumer is encouraged to verify the accuracy of the information 

contained in the consumer report and has the right to dispute any inaccurate 

information in the consumer report;

 A statement that federal law gives the consumer the right to obtain copies of his or her 

consumer reports directly from the consumer reporting agencies, including a free 

consumer report from each of the nationwide consumer reporting agencies once during 

any 12-month period;

 The contact information for the centralized source from which consumers may obtain 

their free annual consumer reports; and 

 A statement directing consumers to the websites of the Federal Reserve Board and 

Federal Trade Commission to obtain more information about consumer reports.

NOTE: Items b, f, g, h, and i for the Section 222.74(f) notice are the same as items b, f, g, h, and i 

for the Sections 222.74(d) and (e) notices.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 43

Example. An institution uses consumer reports to set the material terms of non-mortgage credit 

granted, extended, or provided to consumers and regularly requests credit scores from a particular 

consumer reporting agency. As required by Section 222.74(e), the institution provides those credit 

scores and additional information to consumers. The consumer reporting agency provides to the 

institution a consumer report on a particular consumer that contains one trade line, but does not

provide the institution with a credit score on that consumer. If the institution does not obtain a credit 

score from another consumer reporting agency and, based in whole or in part on information in a 

consumer report, grants, extends, or provides credit to the consumer, the institution may provide the 

Section 222.74(f) notice. If, however, the institution obtains a credit score from another consumer 

reporting agency, the institution may not rely upon the Section 222.74(f) exception, but must satisfy 

the requirements of Section 222.74(e).

Form of the notice. The Section 222.74(f) notice must be:

 Clear and conspicuous;

 Segregated from other information provided to the consumer; and

 Provided to the consumer in writing and in a form that the consumer may keep.

Timing. The Section 222.74(f) notice generally must be provided to the consumer as soon as 

reasonably practicable after the institution has requested the credit score, but in any event not later 

than consummation of a transaction in the case of closed-end credit or when the first transaction is 

made under an open-end credit plan. The notice may alternatively be provided in the following 

manner:

 For automobile lending transactions made through an auto dealer that is unaffiliated 

with the institution, the institution may provide a Section 222.74(f) notice in the time 

periods described above. Alternatively, the institution may arrange to have the auto 

dealer provide a Section 222.74(f) notice to the consumer on its behalf within these 

time periods and maintain reasonable policies and procedures to verify that the auto 

dealer provides the notice to the consumer within the applicable time periods (12 CFR 

222.73(c)(2)).

 For instant credit that is granted under an open-end credit plan to a consumer in person 

or by telephone, the Section 222.74(f) notice may be provided at the earlier of:

 The time of the first mailing to the consumer after the decision is made to approve 

the credit, such as in a mailing containing the account agreement or a credit card; or

 Within 30 days after the decision to approve the credit (12 CFR 222.73(c)(3)).

Model form. Appendix H-5 of the regulation contains a model form of the Section 222.74(f) 

notice. While use of the model form is optional, appropriate use of Model Form H-5 is deemed 

to comply with the requirements of Section 222.74(f).
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 44

Rules of Construction (12 CFR 222.75) 

The rules clarify that, in general, only one risk-based pricing notice or one credit score exception 

notice is required to be provided per credit extension (however, an account review would still be 

required, if applicable). In a transaction involving two or more consumers, a financial institution 

must provide a risk-based pricing notice to each consumer. If the consumers have the same address, 

a financial institution may satisfy the requirements by providing a single risk-based pricing notice 

addressed to both consumers. For credit score disclosure exception notices, whether the consumers 

have the same address or not, the financial institution must provide a separate notice to each 

consumer. 

Appendix H

Appendix H contains five optional model forms that may be used to comply with the regulatory 

requirements. The five model forms are:

• H-1 Model form for risk-based pricing notice

• H-2 Model form for account review risk-based pricing notice

• H-3 Model form for credit score disclosure exception for credit secured by one to four units 

of residential real property

• H-4 Model form for credit score disclosure exception for loans not secured by residential 

real property

• H-5 Model form for credit score disclosure exception for loans where credit score is not 

available

Use of the model forms is not required. A financial institution may change the forms by rearranging 

the format or by making technical modifications to the language of the forms. However, any change 

may not be so extensive as to materially affect the substance, clarity, comprehensibility, or 

meaningful sequence of the forms. Institutions making such extensive revisions would lose the 

“safe harbor” that Appendix H provides. Examples of acceptable changes are provided in Appendix 

H to the regulation. 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 45

Module 4: Duties of Users of Consumer Reports and 

Furnishers of Consumer Report Information

Duties of Users of Credit Reports Regarding Address 

Discrepancies (12 CFR 222.82) (Section 605(h))

Section 605(h)(1) requires that, when providing a consumer report to a person that requests the 

report (a user), a nationwide consumer reporting agency (NCRA) must provide a notice of address 

discrepancy to the user if the address provided by the user in its request “substantially differs” from 

the address the NCRA has in the consumer’s file. Section 605(h)(2) requires the federal banking 

agencies and the NCUA (the Agencies), and the FTC to prescribe regulations providing guidance 

regarding reasonable policies and procedures that a user of a consumer report should employ when 

such user has received a notice of address discrepancy. On November 9, 2007, the Agencies and the 

FTC published final rules in the Federal Register implementing this section (72 FR 63718). 

Definitions

• Nationwide consumer reporting agency (NCRA) Section 603(p) defines an NCRA as 

one that compiles and maintains files on consumers on a nationwide basis and regularly 

engages in the practice of assembling or evaluating and maintaining the following two 

pieces of information about consumers residing nationwide for the purpose of furnishing 

consumer reports to third parties bearing on a consumer’s credit worthiness, credit standing, 

or credit capacity:

 Public record information.

 Credit account information from persons who furnish that information regularly and in 

the ordinary course of business.

• Notice of address discrepancy (12 CFR 222.82(b)) A “notice of address discrepancy” is a 

notice sent to a user by an NCRA (Section 603(p)) that informs the user of a substantial 

difference between the address for the consumer that the user provided to request the 

consumer report and the address(es) in the NCRA’s file for the consumer.

Requirement to form a reasonable belief (12 CFR 222.82(c))

A user must develop and implement reasonable policies and procedures designed to enable the user 

to form a reasonable belief that the consumer report relates to the consumer whose report was 

requested, when the user receives a notice of address discrepancy in connection with a new or 

existing account.

The rules provide the following examples of reasonable policies and procedures for forming a 

reasonable belief that a consumer report relates to the consumer whose report was requested:

• Comparing information in the consumer report with information the user 

 has obtained and used to verify the consumer’s identity as required by the Customer 

Identification Program rules (31 CFR 103.121); 

 maintains in its records; or 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 46

 obtains from a third party; or 

• Verifying the information in the consumer report with the consumer.

Requirement to furnish a consumer’s address to an NCRA 

(12 CFR 222.82(d))

A user must develop and implement reasonable policies and procedures for furnishing to the NCRA 

an address for the consumer that the user has reasonably confirmed is accurate when the user does 

the following:

• Forms a reasonable belief that the report relates to the consumer whose report was 

requested. 

• Establishes a continuing relationship with the consumer (i.e., in connection with a new 

account). 

• Regularly, and in the ordinary course of business, furnishes information to the NCRA that 

provided the notice of address discrepancy. 

A user’s policies and procedures for furnishing a consumer’s address to an NCRA must require the 

user to furnish the confirmed address as part of the information it regularly furnishes to the NCRA 

during the reporting period when it establishes a continuing relationship with the consumer.

The rules also provide the following examples of how a user may reasonably confirm an address is 

accurate:

• Verifying the address with the consumer whose report was requested. 

• Reviewing its own records. 

• Verifying the address through third-party sources.

• Using other reasonable means.

Financial Institutions as Furnishers of Information 

Overview

The FCRA contains many responsibilities for financial institutions that furnish information to 

consumer reporting agencies. These requirements generally involve ensuring the accuracy of the 

data that is placed in the consumer reporting system. This examination module includes reviews of 

the various areas associated with furnishers of information. This module will not apply to financial 

institutions that do not furnish any information to consumer reporting agencies.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 47

Furnishers of Information – General 

(Section 623)(15 USC 1681s)

Section 623 of the FCRA requires the Agencies and the Federal Trade Commission (FTC) to:

• Issue guidelines for use by furnishers regarding the accuracy and integrity of the 

information about consumers that they furnish to consumer reporting agencies;

• Prescribe regulations requiring furnishers to establish reasonable policies and procedures 

for implementing the guidelines; and

• Issue regulations identifying the circumstances under which a furnisher must reinvestigate 

disputes concerning the accuracy of information contained in a consumer report based on a 

direct request from a consumer.

The Agencies and the FTC published final rules in the Federal Register (74 FR 31484) 

implementing this section of FCRA. These rules took effect July 1, 2010.

Definitions (12 CFR 222.41)

The following definitions pertain to the rules governing the furnishers of information to a consumer 

reporting agency:

• “Accuracy” means that the information a furnisher provides to a consumer reporting 

agency about an account or other relationship with the consumer correctly:

 Reflects the terms of and liability for the account or other relationship;

 Reflects the consumer’s performance and other conduct with respect to the account or 

other relationship; and

 Identifies the appropriate consumer.

• “Direct dispute” means a dispute submitted by a consumer directly to a furnisher (including 

a furnisher that is a debt collector) concerning the accuracy of any information contained in 

a consumer report and pertaining to an account or other relationship that the furnisher has 

or had with the consumer.

• “Furnisher” means an entity that furnishes information relating to consumers to one or 

more consumer reporting agencies for inclusion in a consumer report. An entity is not a 

furnisher when it:

 Provides information to a consumer reporting agency solely to obtain a consumer 

report in accordance with the permissible purposes outlined in Sections 604(a) and (f) 

of the FCRA;

 Is acting as a “consumer reporting agency” as defined in Section 603(f) of the FCRA;

 Is a consumer to whom the furnished information pertains; or

 Is a neighbor, friend, or associate of the consumer, or another individual with whom 

the consumer is acquainted or who may have knowledge about the consumer, and who 

provides information about the consumer’s character, general reputation, personal 

characteristics, or mode of living in response to a specific request from a consumer 

reporting agency.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 48

• “Identity theft” means a fraud committed or attempted using the identifying information of 

another person without authority. “Identifying information” means any name or number 

that may be used alone or in conjunction with any other information to identify a specific 

person (16 CFR 603.2).

• “Integrity” means that the information a furnisher provides to a consumer reporting agency 

about an account or other relationship with the consumer:

 Is substantiated by the furnisher’s records at the time it is furnished;

 Is furnished in a form and manner that is designed to minimize the likelihood that the 

information may be incorrectly reflected in a consumer report; and

 Includes the information in the furnisher’s possession about the account or other 

relationship that:

 the relevant Agency has determined that the absence of which would likely be 

materially misleading in evaluating a consumer’s creditworthiness, credit standing, 

credit capacity, character, general reputation, personal characteristics, or mode of 

living; and 

 Is specified in the Interagency Guidelines Concerning the Accuracy and Integrity of 

Information Furnished to Consumer Reporting Agencies (FCRA rule, Appendix E). 

Currently, the Guidelines specify the credit limit, if applicable and in the furnisher’s 

possession.

Duties of furnishers to provide accurate information 

(Section 623(a))(15 USC 1681s-2(a))

This section states that a person, including a financial institution, may, but need not, specify an 

address for receipt of notices from consumers concerning inaccurate information. If the financial 

institution specifies such an address, then it may not furnish information relating to a consumer to 

any consumer reporting agency, if (a) the consumer notified the financial institution, at the specified 

address, that the information is inaccurate, and (b) the information is inaccurate. If the financial 

institution does not specify an address, then it may not furnish any information relating to a 

consumer to any consumer reporting agency if the financial institution knows or has reasonable 

cause to believe that the information is inaccurate. 

When a financial institution that (regularly and in the ordinary course of business) furnishes 

information to one or more consumer reporting agencies about its transactions or experiences with 

any consumer determines that any such information is not complete or accurate, the financial 

institution must promptly notify the consumer reporting agency of that determination. The financial 

institution must provide corrections to that information or any additional information necessary to 

make the information complete and accurate to the consumer reporting agency. Further, the 

financial institution thereafter must not furnish any information that remains incomplete or 

inaccurate to the consumer reporting agency.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 49

If a consumer disputes the completeness or accuracy of any information a financial institution 

furnishes to a consumer reporting agency, that financial institution may not furnish the information 

to any consumer reporting agency without notice that the consumer disputes the information.

Reasonable policies and procedures concerning the accuracy 

and integrity of furnished information (12 CFR 222.42) and 

Interagency Guidelines (FCRA rule, Appendix E)

Each furnisher must establish and implement reasonable written policies and procedures regarding 

the accuracy and integrity of consumer information that it furnishes to a consumer reporting agency. 

The policies and procedures must be appropriate to the nature, size, complexity, and scope of each 

furnisher’s activities. In developing its policies and procedures, a furnisher must consider the 

Interagency Guidelines and may include its existing policies and procedures that are relevant and 

appropriate. Each furnisher must also review its policies and procedures periodically and update 

them as necessary to ensure their continued effectiveness. The guideline’s recommendations include 

the following:

• Using standard data reporting formats and standard procedures for compiling and 

furnishing data, where feasible, such as electronic transmission of information about 

consumers to consumer reporting agencies; 

• Maintaining records for a reasonable period of time, not less than any applicable 

recordkeeping requirement, in order to substantiate the accuracy of any information 

furnished about consumers to consumer reporting agencies that is subject to a direct 

disputer; and 

• Training staff that participates in activities related to the furnishing of information about 

consumers to consumer reporting agencies.

Voluntary closures of accounts(Section 623(a)(4))(15 USC 

1681s-2(a)(4))

This section requires a person, including a financial institution, who regularly and in the ordinary 

course of business furnishes information to a consumer reporting agency regarding one of its 

consumer credit accountholders, to notify the consumer reporting agency of the consumer’s 

voluntary account closure. This notice is to be furnished to the consumer reporting agency as part of 

the regularly furnished information for the period in which the account is closed.

Notice involving delinquent accounts (Section 623(a)(5)) 

(15 USC 1681s-2(a)(5))

This section requires that a person, including a financial institution, that furnishes information to a 

consumer reporting agency about a delinquent account placed for collection, charged off, or 

subjected to any similar action, must, not later than 90 days after furnishing the information to the 

consumer reporting agency, notify the consumer reporting agency of the month and year of the 

commencement of the delinquency that immediately preceded the action.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 50

Duties upon notice of dispute from a consumer reporting 

agency(Section 623(b)) (15 USC 1681s-2(b))

This section requires that whenever a financial institution receives a notice of dispute from a

consumer reporting agency regarding the accuracy or completeness of any information the financial 

institution provided to a consumer reporting agency pursuant to Section 611 (Procedure in Case of 

Disputed Accuracy), that financial institution must, pursuant to Section 623(b):

• Conduct an investigation regarding the disputed information.

• Review all relevant information the consumer reporting agency provided along with the 

notice.

• Report the results of the investigation to the consumer reporting agency.

• If the investigation finds the information is incomplete or inaccurate, report those results to 

all nationwide consumer reporting agencies to which the financial institution previously 

provided the information.

• If the disputed information is incomplete, inaccurate, or not verifiable by the financial 

institution, it must promptly, for purposes of reporting to the consumer reporting agency do 

one of the following:

 Modify the item of information.

 Delete the item of information. 

 Permanently block the reporting of that item of information.

The financial institution must complete the required investigations, reviews, and reports within 30 

days. The financial institution may extend the time period for 15 days if a consumer reporting 

agency receives additional relevant information from the consumer. 

Duties upon notice of dispute from a consumer (direct 

disputes) (12 CFR 222.43)

General rule. A furnisher must conduct a reasonable investigation of a direct dispute (unless 

exceptions, described later, apply) if the dispute relates to:

• The consumer’s liability for a credit account or other debt with the furnisher, such as direct 

disputes relating to whether there is or has been identity theft or fraud against the consumer, 

whether there is individual or joint liability on an account, or whether the consumer is an 

authorized user of a credit account;

• The terms of a credit account or other debt with the furnisher, such as, direct disputes 

relating to the type of account, principal balance, scheduled payment amount on an account, 

or the amount of the credit limit on an open-end account;
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 51

• The consumer’s performance or other conduct concerning an account or other relationship 

with the furnisher such as, direct disputes relating to the current payment status, high 

balance, payment date, the payment amount, or the date an account was opened or closed; 

or

• Any other information contained in a consumer report regarding an account or other 

relationship with the furnisher that bears on the consumer’s creditworthiness, credit

standing, credit capacity, character, general reputation, personal characteristics, or mode of 

living.

Exceptions. The direct dispute requirements do not apply to a furnisher if the direct dispute relates 

to:

• The consumer’s identifying information such as name(s), date of birth, Social Security 

number, telephone number(s), or address(es);

• The identity of past or present employers;

• Inquiries or requests for a consumer report;

• Information derived from public records, such as judgments, bankruptcies, liens, and other 

legal matters (unless the information was provided by a furnisher with an account or other 

relationship with the consumer);

• Information related to fraud alerts or active duty alerts; or

• Information provided to a consumer reporting agency by another furnisher.

The direct dispute requirements also do not apply if the furnisher has a reasonable belief that the 

direct dispute is:

• Submitted by a credit repair organization;

• Is prepared on behalf of the consumer by a credit repair organization; or

• Is submitted on a form supplied to the consumer by a credit repair organization.

• NOTE: The direct dispute requirements also do not apply if any of the above is done by an 

entity that would be a credit repair organization but for the fact that it is a 501(c)(3) 

nonprofit organization.

Direct Dispute Address. A furnisher is required to investigate a direct dispute only if a consumer 

submits a dispute notice to the furnisher at:

• The address provided by a furnisher and listed on a consumer report relating to the 

consumer;

• An address clearly and conspicuously specified by the furnisher that is provided to the 

consumer in writing or electronically (if the consumer has agreed to the electronic delivery 

of information from the furnisher); or

• Any business address of the furnisher if the furnisher has not provided a specific address 

for submitting direct disputes.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 52

Direct Dispute Notice Contents. A dispute notice from a consumer must include:

• Sufficient information to identify the account or other relationship that is in dispute, such as 

an account number and the name, address, and telephone number of the consumer;

• The specific information that the consumer is disputing and an explanation of the basis for 

the dispute; and

• All supporting documentation or other information reasonably required by the furnisher to 

substantiate the basis of the dispute. This documentation may include, for example, a copy 

of the relevant portion of the consumer report that contains the allegedly inaccurate 

information; a police report; a fraud or identity theft affidavit; a court order; or account 

statements.

Duties of a Furnisher after Receiving a Direct Dispute Notice from a Consumer. After receiving a 

dispute notice from a consumer, the furnisher must:

• Conduct a reasonable investigation with respect to the disputed information;

• Review all relevant information provided by the consumer with the dispute notice;

• Complete its investigation of the dispute and report the results of the investigation to the 

consumer before the expiration of the period under Section 611(a)(1) of the FCRA (15 

U.S.C. 1681i(a)(1)) within which a consumer reporting agency would be required to 

complete its action if the consumer had elected to dispute the information under that 

section; and

• If the investigation finds that the information reported was inaccurate, promptly notify each 

consumer reporting agency to which the furnisher provided inaccurate information of 

investigation findings and provide to the consumer reporting agency any correction to that 

information that is necessary to make the information provided by the furnisher accurate.

Frivolous or Irrelevant Disputes. A furnisher is not required to investigate a direct dispute if the 

furnisher has reasonably determined that the dispute is frivolous or irrelevant. A dispute qualifies as 

frivolous or irrelevant if:

• The consumer did not provide sufficient information to investigate the disputed 

information;

• The direct dispute is substantially the same as a dispute previously submitted by or on 

behalf of the consumer and the dispute is one with respect to which the furnisher has 

already complied with the statutory or regulatory requirements. However, a direct dispute 

would not be “substantially the same” as the one previously submitted if the dispute 

includes new information required by the regulation to be provided to the furnisher, but that 

had not previously been provided to the furnisher; or

• The furnisher is not required to investigate the direct dispute because one or more of the 

exceptions listed in 12 CFR 222.43(b) applies.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 53

Upon making a determination that a dispute is frivolous or irrelevant, the furnisher must notify the 

consumer of the determination not later than five business days after making the determination, by 

mail or, if authorized by the consumer for that purpose, by any other means available to the 

furnisher. The furnisher’s notice that a dispute is frivolous or irrelevant must include the reasons for 

such determination and identify any information required to investigate the disputed information. 

The notice may consist of a standardized form describing the general nature of such information.

Prevention of Re-Pollution of Consumer Reports 

(Section 623(a)(6))(15 USC 1681s-2(a)(6))

This section, Prevention of Re-Pollution of Consumer Reports, has specific requirements for 

furnishers of information, including financial institutions, to a consumer reporting agency that 

received notice from a consumer reporting agency that furnished information may be fraudulent as a 

result of identity theft. Section 605B, Block of Information Resulting From Identity Theft, requires 

consumer reporting agencies to notify furnishers of information, including financial institutions, that 

the information may be the result of identity theft, an identity theft report has been filed, and that a 

block has been requested. Upon receiving such notice, Section 623(a)(6) requires financial 

institutions to establish and follow reasonable procedures to ensure that it does not re-report this 

information to the consumer reporting agency, thus “re-polluting” the victim’s consumer report. 

Section 615(f), Prohibition on Sale or Transfer of Debt Caused by Identity Theft, also prohibits a 

financial institution from selling or transferring debt caused by an alleged identity theft.

Negative Information Notice 

(Section 623(a)(7))(15 USC 1681s-2(a)(7))

This section, Negative Information Notice, requires a financial institution to provide consumers 

with a notice either before it provides negative information to a nationwide consumer reporting 

agency, or within 30 days after reporting the negative information. 

Negative information

For these purposes, negative information means any information concerning a customer’s 

delinquencies, late payments, insolvency, or any form of default. 

Nationwide consumer reporting agency

Section 603(p) of the FCRA defines a nationwide consumer reporting agency as a “consumer 

reporting agency that compiles and maintains files on consumers on a nationwide basis.” It defines 

this type of consumer reporting agency as one that regularly assembles or evaluates, and maintains, 

each of the following regarding consumers residing nationwide for the purpose of furnishing 

consumer reports to third parties bearing on a consumer’s creditworthiness, credit standing, or credit 

capacity:

• Public Record Information.

• Credit account information from persons who furnish that information regularly and in the 

ordinary course of business.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 54

Institutions may provide this disclosure on or with any notice of default, any billing statement, or 

any other materials provided to the customer, as long as the notice is clear and conspicuous. 

Institutions may also choose to provide this notice to all customers as an abundance of caution. 

However, financial institutions may not include this notice in the initial disclosures provided under 

§ 127(a) of the Truth in Lending Act. 

Model text

As required by the FCRA, the Federal Reserve Board developed the following model text that 

institutions can use to comply with these requirements. The first model contains text an institution 

can use when it provides a notice before furnishing negative information. The second model form 

contains text to use when an institution provides notice within 30 days after reporting negative 

information:

Notice prior to communicating negative information (Model B-1): 

“We may report information about your account to credit bureaus. Late payments, missed 

payments, or other defaults on your account may be reflected in your credit report.”

Notice within 30 days after communicating negative information (Model B-2):

“We have told a credit bureau about a late payment, missed payment, or other default on your 

account. This information may be reflected in your credit report.”

Use of the model form(s) is not required; however, proper use of the model forms provides a 

financial institution with a safe harbor from liability. A financial institution may make certain 

changes to the language or format of the model notices without losing the safe harbor from liability 

provided by the model notices. The changes to the model notices may not be so extensive as to 

affect the substance, clarity, or meaningful sequence of the language in the model notices. A 

financial institution making extensive revisions will lose the safe harbor from liability that the 

model notices provide. Acceptable changes include:

• Rearranging the order of the references to “late payment(s),” or “missed payment(s).”

• Pluralizing the terms “credit bureau,” “credit report,” and “account.”

• Specifying the particular type of account on which it may furnish information, such as 

“credit card account.” 

• Rearranging in Model Notice B-1 the phrases “information about your account” and “to 

credit bureaus” such that it would read, “We may report to credit bureaus information about 

your account.”
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 55

Module 5: Consumer Alerts and Identity Theft 

Protections

Overview

The FCRA contains several provisions for both consumer reporting agencies and users of consumer 

reports, including financial institutions, that are designed to help combat identity theft. This module 

applies to financial institutions that are not consumer reporting agencies, but are users of consumer 

reports.

Two primary requirements exist: first, a user of a consumer report that contains a fraud or active 

duty alert must take steps to verify the identity of an individual to whom the consumer report 

relates, and second, a financial institution must disclose certain information when consumers allege 

that they are the victims of identity theft.

Fraud and Active Duty Alerts 

(Section 605A(h)) (15 USC 1681c-1(h))

Initial fraud and active duty alerts

Consumers who suspect that they may be the victims of fraud including identity theft may request 

nationwide consumer reporting agencies to place initial fraud alerts in their consumer reports. These 

alerts must remain in a consumer’s report for no less than 90 days. In addition, members of the 

armed services who are called to active duty may also request that active duty alerts be placed in 

their consumer reports. Active duty alerts must remain in these service members’ files for no less 

than 12 months.

Section 605A(h)(1)(B), Limitations on Use of Information for Credit Extensions, requires users of 

consumer reports, including financial institutions, to verify a consumer’s identity if a consumer 

report includes a fraud or active duty alert. Unless the financial institution uses reasonable policies 

and procedures to form a reasonable belief that it knows the identity of the person making the 

request, the financial institution may not: 

• Establish a new credit plan or extension credit (other than under an open-end credit plan) in 

the name of the consumer. 

• Issue an additional card on an existing account. 

• Increase a credit limit. 

Extended Alerts

Consumers who allege that they are the victim of an identity theft may also place an extended alert, 

which lasts seven years, on their consumer report. Extended alerts require consumers to submit 

identity theft reports and appropriate proof of identity to the nationwide consumer reporting 

agencies.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 56

Section 605A(h)(2)(B), Limitation on Users, requires a financial institution that obtains a consumer 

report that contains an extended alert to contact the consumer in person or by the method the 

consumer lists in the alert prior to performing any of the three actions listed above. 

Information Available to Victims 

(Section 609(e)) (15 USC 1681g(e))

This section, Information Available to Victims, requires a financial institution to provide records of 

fraudulent transactions to victims of identity theft within 30 days after the receipt of a request for 

the records. These records include the application and business transaction records under the control 

of the financial institution whether maintained by the financial institution or another person on 

behalf of the institution (such as a service provider). 

The financial institution should provide this information to any of the following:

• The victim.

• Any federal, state, or local government law enforcement agency or officer specified by the 

victim in the request. 

• Any law enforcement agency investigating the identity theft that was authorized by the 

victim to take receipt of these records. 

The victim must make the request for the records in writing and send it to the financial institution at 

the address specified by the financial institution for this purpose. The financial institution may ask 

the victim to provide information, if known, regarding the date of the transaction or application, and 

any other identifying information such as an account or transaction number. 

Unless the financial institution has a high degree of confidence that it knows the identity of the 

victim making the request for information, the financial institution must take prudent steps to 

positively identify the person before disclosing any information. Proof of identity can include any of 

the following:

• A government-issued identification card.

• Personally identifying information of the same type that was provided to the financial 

institution by the unauthorized person. 

• Personally identifiable information that the financial institution typically requests from new 

applicants or for new transactions.

At the election of the financial institution, the victim must also provide the financial institution with 

proof of an identity theft complaint, which may consist of a copy of a police report evidencing the 

claim of identity theft and a properly completed affidavit. The affidavit can be either the 

standardized affidavit form prepared by the Federal Trade Commission (published in April 2005 in 

70 Federal Register 21792), or an “affidavit of fact” that is acceptable to the financial institution for 

this purpose.
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 57

When these conditions are met, the financial institution must provide the information at no charge 

to the victim. However, the financial institution is not required to provide any information if, acting 

in good faith, the financial institution determines any of the following:

• Section 609(e) does not require disclosure of the information.

• The financial institution does not have a high degree of confidence in knowing the true 

identity of the requestor, based on the identification and/or proof provided.

• The request for information is based on a misrepresentation of fact by the requestor.

• The information requested is Internet navigational data or similar information about a 

person’s visit to a website or online service. 

Duties Regarding the Detection, Prevention, and Mitigation 

of Identity Theft (Section 615(e))

Section 615(e) requires the federal banking agencies and the NCUA (the Agencies) as well as the 

FTC to prescribe regulations and guidelines for entities under their enforcement authority regarding 

the detection, prevention, and mitigation of identity theft. On November 9, 2007, the Agencies 

published final rules and guidelines in the Federal Register implementing this section (72 FR 

63718). The Agencies also have issued examination procedures for the implementing regulations. 

CFPB examiners are not expected to examine for compliance with Section 615(e)). If CFPB 

examiners become aware of potential issues in this area, the appropriate federal regulator should be 

notified. 

Duties of Card Issuers Regarding Changes of Address 

(Section 615(e))

Section 615(e)(1)(C) requires the Agencies and the FTC to prescribe regulations for debit and credit 

card issuers regarding the assessment of the validity of address changes for existing accounts. On 

November 9, 2007, the Agencies and the FTC published final rules in the Federal Register 

implementing this section (72 FR 63718). The regulations require card issuers to have procedures 

to assess the validity of an address change if the card issuer receives a notice of change of address 

for an existing account, and within a short period of time (during at least the first 30 days), receives 

a request for an additional or replacement card for the same account. The Agencies also have 

issued examination procedures for the implementing regulations. CFPB examiners are not expected 

to examine for compliance with Section 615(e)). If CFPB examiners become aware of potential 

issues in this area, the appropriate federal regulator should be notified. 

Disposal of Consumer Information (Section 628)

Section 628 requires the federal banking agencies to prescribe regulations for entities under their 

enforcement authority regarding the proper disposal of consumer information. On December 28, 

2004, the federal banking agencies published final rules and guidelines in the Federal Register 

implementing this section (69 FR 77610). The agencies also have issued examination procedures 

for the implementing regulations. CFPB examiners are not expected to examine for compliance 

with Section 628. If CFPB examiners become aware of potential issues in this area, the appropriate

federal regulator should be notified. 
CFPB Consumer 

Laws and Regulations FCRA

CFPB FFIEC Rev. 1/2011 FCRA 58

References

Law

15 USC 1681 et seq. Fair Credit Reporting Act

Regulations

Federal Reserve Board Regulations (12 CFR)

Part 222 Fair Credit Reporting (Regulation V)
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 1

Fair Credit Reporting Act

Examination Objectives 

• To determine the financial institution’s compliance with the Fair Credit Reporting Act 

(FCRA).

• To assess the quality of the financial institution’s compliance risk management system to 

ensure compliance with the FCRA, as amended by the Fair and Accurate Credit Transaction 

Act of 2003 (FACT Act). 

• To determine the reliance you can place on the financial institution’s internal controls and 

procedures for monitoring the institution’s compliance with the FCRA.

• To direct corrective action when you identify violations of law, or when the institution’s policies or internal controls are deficient.

Initial Examination Procedures

The initial examination procedures are designed to acquaint examiners with the operations and 

processes of the institution being examined. They focus on the institution’s systems, controls, policies, and procedures, including audits and previous examination findings.

The applicability of the various sections of the FCRA and the implementing regulations1 depends 

on an institution’s unique operations. The functional examination requirements for an institution’s 

FCRA responsibilities are presented topically in modules 1 through 5.

Initially, examiners should:

1. Through discussions with management and review of available information, 

determine if the institution’s internal controls are adequate to ensure compliance 

in the FCRA area under review. Consider the following:

a. Organization charts

b. Process flowcharts

c. Policies and procedures

d. Loan documentation

e. Checklists

f. Computer program documentation (for example, records illustrating the 

fields and types of data reported to consumer reporting agencies; automated 

records tracking customer opt-outs for FCRA affiliate information sharing; 

etc.).

[Click&type]

 

1 The Federal Reserve’s implementing regulation is cited in these procedures. However, if examiners cite violations by an entity, 

examiners should cite violations of the applicable regulation in effect with respect to that entity.

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 2

2. Review any compliance audit material, including workpapers and reports, to 

determine whether:

a. The scope of the audit addresses all provisions as applicable

b. Corrective actions were taken to follow up on previously identified 

deficiencies

c. The testing includes samples covering all product types and decision centers

d. The work performed is accurate

e. Significant deficiencies and their causes are included in reports to 

management and/or to the board of directors, and

f. The frequency of review is appropriate.

[Click&type]

3. Review the financial institution’s training materials to determine whether:

a. Appropriate training is provided to individuals responsible for FCRA 

compliance and operational procedures.

b. The training is comprehensive and covers the various aspects of the FCRA 

that apply to the individual financial institution’s operations.

[Click&type]

4. Through discussions with management, determine which portions of the 

examination modules will apply.

[Click&type]

5. Complete appropriate examination modules; document and form conclusions 

regarding the quality of the financial institution’s compliance management 

systems and compliance with FCRA.

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 3

Module 1: Obtaining Consumer Reports

Permissible Purposes of Consumer Reports (15 USC 1681b) and

Investigative Consumer Reports (15 USC 1681d)

1. Determine whether the financial institution obtains consumer reports.

[Click&type]

2. Determine whether the institution obtains prescreened consumer reports 

and/or reports for employment purposes. If so, complete the appropriate 

sections of Module 3.

[Click&type]

3. Determine whether the financial institution procures or causes an 

investigative consumer report to be prepared. If so, ensure that the 

appropriate disclosure is given to the consumer within the required time 

period. In addition, ensure that the financial institution certified compliance 

with the disclosure requirements to the consumer reporting agency.

[Click&type]

4. Ensure that the institution obtains consumer reports only for permissible 

purposes. Confirm that the institution certifies to the consumer reporting 

agency the purposes for which it will obtain reports. (The certification is 

usually contained in a financial institution’s contract with the consumer 

reporting agency.)

[Click&type]

5. If procedural weaknesses are noted or other risks requiring further 

investigation are noted, such as the receipt of several consumer complaints 

were received, review a sample of consumer reports obtained from a 

consumer reporting agency and determine whether the financial institution 

had permissible purposes to obtain the reports. For example, 

• Obtain a copy of a billing statement or other list of consumer reports obtained by the financial institution from the consumer reporting agency for 

a period of time. 

• Compare this list, or a sample from this list to the institution’s records to 

ensure that there is a permissible purpose for the report(s) obtained. This 

could include any permissible purpose, such as the consumer applied for 

credit, insurance, or employment, etc. The financial institution may also 

obtain a report in connection with the review of an existing account.

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 4

Module 2: Obtaining Information and Sharing 

Among Affiliates

Consumer Report and Information Sharing (15 USC 1681a(d))

1. Review the financial institution’s policies, procedures, and practices 

concerning the sharing of consumer information with third parties, including 

both affiliated and nonaffiliated third parties. Determine the type of 

information shared and with whom the information is shared. (This portion of 

the examination process may overlap with a review of the institution’s 

compliance with the Privacy of Consumer Financial Information Regulations 

that implement the Gramm-Leach-Bliley Act.)

[Click&type]

2. Determine whether the financial institution’s information sharing practices 

fall within the exceptions to the definition of a consumer report. If they do 

not, the institution could be considered a consumer reporting agency and 

subject to the FCRA requirements for consumer reporting agencies.

[Click&type]

3. If the financial institution shares information other than transaction and 

experience information with affiliates subject to opt-out provisions, determine 

whether the institution’s GLBA privacy notice contains tinformation 

regarding how to opt out, as required by the Privacy of Consumer Financial 

Information regulations.

[Click&type]

4. If procedural weaknesses or other risks requiring further investigation are 

noted, obtain a sample of opt-out rights exercised by consumers and 

determine if the financial institution honored the opt-out requests by not 

sharing “other information” about the consumers with the institution’s 

affiliates subsequent to receiving a consumer’s opt-out direction.

[Click&type]

Protection of Medical Information (12 CFR 222.30, Subpart D)

1. Review the financial institution’s policies, procedures, and practices concerning 

the collection and use of consumer medical information in connection with any 

determination of the consumer’s eligibility, or continued eligibility for credit.

[Click&type]

2. If the financial institution’s policies, procedures, and practices allow for 

obtaining and using consumer medical information in the context of a credit 

transaction, determine whether there are adequate controls in place to ensure 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 5

that the information is only used subject to the financial information 

exception in the rules, or under a specific exception within the rules.

[Click&type]

3. If procedural weaknesses or other risks requiring further investigation are 

noted, obtain samples of credit transactions to determine whether the use of 

medical information pertaining to a consumer was done strictly under the 

financial information exception or the specific exceptions under the 

regulation.

[Click&type]

4. Determine whether the financial institutionhas adequate policies and 

procedures in place to limit the redisclosure of consumer medical information 

that was received from a consumer reporting agency or an affiliate.

[Click&type]

5. Determine whether the financial institution shares medical information about a 

consumer with affiliates. If it does, determine whether the sharing occurred in 

accordance with an exception in the rules that enables the financial institution 

to share the information without becoming a consumer reporting agency.

[Click&type]

Affiliate Marketing Opt Out (12 CFR 222.20)

1. Determine whether the financial institution receives consumer eligibility information from 

an affiliate. Stop here if it does not because Subpart C of 12 CFR 222 does not apply.

[Click&type]

2. Determine whether the financial institution uses consumer eligibility information 

received from an affiliate to make a solicitation for marketing purposes that is subject to 

the notice and opt-out requirements. If it does not, stop here.

[Click&type]

3. Evaluate the institution’s policies, procedures, practices and internal controls to ensure 

that, where applicable, the consumer is provided with an appropriate notice, a 

reasonable opportunity, and a reasonable and simple method to opt out of the 

institution’s using eligibility information to make solicitations for marketing purposes to 

the consumer, and that the institution is honoring the consumer’s opt-outs.

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 6

4. If compliance risk management weaknesses or other risks requiring further 

investigation are noted, obtain and review a sample of notices to ensure technical 

compliance and a sample of opt-out requests from consumers to determine if the 

institution is honoring the opt-out requests.

a. Determine whether the opt-out notices are clear, conspicuous, and 

concise and contain the required information, including the name of the 

affiliate(s) providing the notice, a general description of the types of 

eligibility information that may be used to make solicitations to the 

consumer, and the duration of the opt out (12 CFR 222.23(a)).

b. Review opt-out notices that are coordinated and consolidated with any 

other notice or disclosure that is required under other provisions of law 

for compliance with the affiliate marketing regulation (12 CFR 

222.23(b)).

c. Determine whether the opt-out notices and renewal notices provide the 

consumer a reasonable opportunity to opt out and a reasonable and 

simple method to opt out (12 CFR 222.24 and .25).

d. Determine whether the opt-out notice and renewal notice are provided 

(by mail, delivery or electronically) so that a consumer can reasonably 

be expected to receive that actual notice (12 CFR 222.26).

e. Determine whether, after an opt-out period expires, a financial 

institution provides a consumer a renewal notice prior to making 

solicitations based on eligibility information received from an affiliate 

(12 CFR 222.27).

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 7

Module 3: Disclosures to Consumers and 

Miscellaneous Requirements

Use of Consumer Reports for Employment Purposes (15 USC 1681b(b)(2))

1. Determine if the financial institution obtains consumer reports on current or 

prospective employees.

[Click&type]

2. Assess the financial institution’s policies and procedures to determine if 

appropriate disclosures are provided to current and prospective employees 

when a financial institution obtains consumer reports for employment 

purposes, including situations where the financial institution takes adverse 

actions based on consumer report information.

[Click&type]

3. If procedural weaknesses or other risks requiring further investigation are 

noted, review a sample of the disclosures to determine if they are accurate 

and in compliance with the technical FCRA requirements.

[Click&type]

Prescreened Consumer Reports and Opt-Out Notice (15 USC 1681b(c) and 

15 USC 1681m(d))(and Parts 642 and 698 of Federal Trade Commission 

Regulations)

1. Determine whether the financial institution obtained and used prescreened 

consumer reports in connection with offers of credit and/or insurance.

[Click&type]

2. Evaluate the institution’s policies and procedures to determine if a list of the 

criteria used for prescreened offers, including all post-application criteria, is 

maintained in the institution’s files and the criteria are applied consistently 

when consumers respond to the offers.

[Click&type]

3. Determine if written solicitations contain the required disclosures of the 

consumers’ right to opt-out of prescreened solicitations and comply with all 

requirements applicable at the time of the offer.

[Click&type]

4. If procedural weaknesses or other risks requiring further investigation are 

noted, obtain and review a sample of approved and denied responses to the 

offers to ensure that criteria were appropriately followed. 

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 8

Truncation of Credit and Debit Card Account Numbers (15 USC 1681c(g))

1. Determine whether the financial institution’s policies and procedures ensure 

that electronically generated receipts from automated teller machines (ATM) 

and point-of-sale (POS) terminals or other machines do not contain more than 

the last five digits of the card number and do not contain the expiration dates.

[Click&type]

2. For ATMs and POS terminals or other machines put into operation before 

January 1, 2005, determine if the institution brought the terminals into 

compliance or started a plan to ensure that these terminals comply by the 

mandatory compliance date of December 4, 2006.

[Click&type]

3. If procedural weaknesses or other risks requiring further investigation are 

noted, review samples of actual receipts to ensure compliance.

[Click&type]

Disclosure of Credit Scores by Certain Mortgage Lenders (15 USC 

1681g(g))

1. Determine if the financial institution uses credit scores in connection with 

applications for closed-end or open-end loans secured by one- to four-family 

residential real property.

[Click&type]

2. Evaluate the institution’s policies and procedures to determine whether 

accurate disclosures are provided to applicants as soon as is reasonably 

practicable after using credit scores.

[Click&type]

3. If procedural weaknesses or other risks requiring further investigation are 

noted, review a sample of disclosures given to home loan applicants to 

determine technical compliance with the requirements.

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 9

Adverse Action Disclosures (15 USC 1681m(a) and (b))

1. Determine whether the institution’s policies and procedures adequately 

ensure that the financial institution provides the appropriate disclosures when 

it takes adverse action against consumers based on information received from 

consumer reporting agencies, other third parties, and/or affiliates.

[Click&type]

2. Review the financial institution’s policies and procedures for responding to 

requests for information in response to these adverse action notices.

[Click&type]

3. If procedural weaknesses or other risks requiring further investigation are 

noted, review a sample of adverse action notices to determine if they are 

accurate and in technical compliance.

[Click&type]

Debt Collector Communications Concerning Identity Theft 

(15 USC 1681m(g))

1. Determine whether the financial institution collects debts for third parties.

[Click&type]

2. Determine whether the financial institution has policies and procedures to 

ensure that the third parties are notified if the financial institution obtains 

any information that may indicate that the debt in question is the result of 

fraud or identity theft.

[Click&type]

3. Determine if the institution has effective policies and procedures for 

providing information to consumers to whom the fraudulent debts relate.

[Click&type]

4. If procedural weaknesses or other risks requiring further investigation are 

noted, review a sample of instances where consumers have alleged identity 

theft and requested information related to transactions to determine if all of 

the appropriate information was provided to the consumer.

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 10

Risk-Based Pricing Notice2 (12 CFR 222.70)

1. Determine whether the financial institution uses consumer report information 

in consumer credit decisions. 

If yes, determine whether the institution uses such information to provide 

credit on terms that are “materially less favorable” than the most favorable 

material terms available to a substantial proportion of its consumers. Relevant factors in determining the significance of differences in the cost of credit 

include the type of credit product, the term of the credit extension, and the 

extent of the difference. 

If “yes,” the financial institution is subject to the risk-based pricing regulations. 

[Click&type]

2. Determine whether the financial institution provides a risk-based pricing 

notice to a consumer (12 CFR 222.72(a)). If it does, proceed to step 3. If the 

institution does not provide a risk-based pricing notice, proceed to step 22 to 

determine whether an exception applies (12 CFR 222.74). 

[Click&type]

3. Determine the method the financial institution uses to identify consumers 

who must receive a risk-based pricing notice and whether the method 

complies with the regulation (12 CFR 222.72(b)).

a. For institutions that use the direct comparison method (12 CFR 

222.72(b)), determine whether the institution directly compares the material terms offered to each consumer and the material terms offer to the 

other consumers for a specific type of credit product.

b. For institutions that use the credit score proxy method (12 CFR 

222.72(b)(1)):

i. determine whether the institution calculates the cutoff score by 

considering the credit scores of all, or a representative sample, of 

consumers who have received credit for a specific type of credit 

product;

ii. determine whether the institution recalculates the cutoff score no 

less than every two years;

iii. for new entrants into the credit business, for new products subject 

 

2 These exam procedures do not include final amendments to Regulation V implementing Dodd Frank Act amendments to risk-based 

pricing rules that require disclosure of credit scores and information relating to credit scores in risk-based pricing notices. CFPB is 

working with prudential regulators to update exam procedures to reflect these rules, which have taken effect, in a uniform manner as 

appropriate, 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 11

to risk-based pricing, or for acquired credit portfolios, determine 

whether the institution recalculates the cutoff scores within time 

periods specified in the regulation;

iv. for institutions using more than one credit score to set material 

terms, determine whether the institution establishes a cutoff score 

according to the methods specified in the regulation; and

v. if no credit score is available for a consumer, determine whether 

the institution provides the consumer a risk-based pricing notice.

c. For institutions that use the tiered pricing method (12 CFR 222.72(b)(2)):

i. when four or fewer pricing tiers are used, determine if the institution 

sends risk-based pricing notices to consumers who do not qualify for 

the top, best-priced tier; or 

ii. when five or more pricing tiers are used, determine if the institution 

provides risk-based pricing notices to consumers who do not qualify 

for the two top, best-priced tiers and any other tier that, combined 

with the top two tiers, equal no less than the top 30 percent and no 

more than the top 40 percent of the total number of tiers.

d. For credit card issuers:

i. Determine whether the card issuer uses the credit score proxy method or the tiered pricing method to identify consumers to whom it 

must provide a risk-based pricing notice. 

ii. If the institution does not use the credit score proxy method or the 

tiered pricing method, determine whether the card issuer uses the 

following method as permitted by 12 CFR 222.72(c) to identify 

consumers to whom it must provide a risk-based pricing notice:

a) A consumer applies for a credit card either in connection with 

an application program, such as a direct-mail offer or a takeone application, or in response to a solicitation under 12 CFR 

226.5a, and more than a single possible purchase annual percentage rate may apply under the program or solicitation; and 

b) Based in whole or in part on a consumer report, the credit card 

issuer provides a credit card to the consumer with a purchase 

APR that is greater than the lowest purchase APR available in 

connection with the application or solicitation.

iii. Determine whether the card issuer provides a risk-based pricing 

notice to each consumer that is provided a credit card with a purchase APR greater than the lowest purchase APR available under 

the program or solicitation.

[Click&type]

4. Determine whether the risk based pricing notice contains (12 CFR 

222.73(a)(1)):
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 12

a. a statement that a consumer report (or credit report) includes information 

about the consumer’s credit history and the type of information included 

in that history;

b. a statement that the terms offered, such as the APR, have been set based 

on information from a consumer report;

c. statement that the terms offered may be less favorable than the terms offered to consumers with better credit histories;

d. a statement that the consumer is encouraged to verify the accuracy of the 

information contained in the consumer report and has the right to dispute 

any inaccurate information in the report;

e. the identity of each consumer reporting agency that furnished a consumer 

report used in the credit decision;

f. a statement that federal law gives the consumer the right to obtain a copy 

of a consumer report from the consumer reporting agency or agencies 

identified in the notice without charge for 60 days after receipt of the notice;

g. a statement informing the consumer how to obtain a consumer report 

from the consumer reporting agency or agencies identified in the notice 

and providing contact information (including a toll-free telephone number, where applicable) specified by the consumer reporting agency or 

agencies; and

h. a statement directing consumers to the websites of the Federal Reserve 

Board and Federal Trade Commission to obtain more information about 

consumer reports.3

[Click&type]

Proceed to step #10.

 

3 These procedures will be further modified in the future to reflect, as appropriate, the transfer of certain authorities from the Federal 

Reserve Board to the CFPB on July 21, 2011 effected by the Dodd-Frank Act.
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 13

5. If the institution does not provide a risk-based pricing notice, determine if 

one of the following situations that qualify for a regulatory exception applies 

(12 CFR 222.74(a)-(f)):

a. when a consumer applies for specific terms of credit, and receives them, 

unless those terms were specified by the creditor using a consumer report 

after the consumer applied for the credit and after the creditor obtained 

the consumer report; 

b. when a creditor provides a notice of adverse action;

c. when a creditor makes a firm offer of credit in a prescreened solicitation;

d. when an institution generally provides a credit score disclosure to each 

consumer that requests a loan that is or will be secured by residential real 

property;

e. when an institution generally provides a credit score disclosure to each 

consumer that requests a loan that is not or will not be secured by residential real property;

f. when an institution, which otherwise provides credit score disclosures to 

consumers that request loans, provides a disclosure for when no credit 

score is available.

[Click&type]

6. For institutions that choose to provide a credit score disclosure to consumers 

that request a loan that is or will be secured by residential real property, 

determine whether the Section 222.74(d) notice generally is provided to each 

consumer that requests such an extension of credit and that each notice 

contains:

a. A statement that a consumer report (or credit report) is a record of the 

consumer’s credit history and includes information about whether the 

consumer pays his or her obligations on time and how much the consumer owes to creditors; 

b. A statement that a credit score is a number that takes into account information in a consumer report and that a credit score can change over time 

to reflect changes in the consumer’s credit history;

c. A statement that the consumer’s credit score can affect whether the consumer can obtain credit and what the cost of that credit will be;

d. A statement that the consumer is encouraged to verify the accuracy of the 

information contained in the consumer report and has the right to dispute 

any inaccurate information in the report;

e. A statement that federal law gives the consumer the right to obtain copies 

of his or her consumer reports directly from the consumer reporting 

agencies, including a free report from each of the nationwide consumer 

reporting agencies once during any 12-month period;

f. Contact information for the centralized source from which consumers 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 14

may obtain their free annual consumer reports; 

g. A statement directing consumers to the websites of the Federal Reserve 

Board and Federal Trade Commission to obtain more information about 

consumer reports; 

h. The information required to be disclosed to the consumer in Section 

609(g) of the FCRA, and as described in Module 3 of these examination 

procedures, under “Disclosure of Credit Scores by Certain Mortgage 

Lenders (FCRA), Section 609(g)”; and

i. The distribution of credit scores among consumers who are scored under 

the same scoring model that is used to generate the consumer’s credit 

score. The distribution should:

i. Use the same scale as that of the credit score provided to the consumer, and 

ii. Be presented:

a) in the form of a bar graph containing a minimum of six bars that 

illustrates the percentage of consumers with credit scores within 

the range of scores reflected in each bar, 

b) by other clear and readily understandable graphical means, or 

c) in a clear and readily understandable statement informing the 

consumer how his or her credit score compares to the scores of 

other consumers. 

The presentation may use a graph or statement obtained from the entity 

providing the credit score if it meets these requirements.

[Click&type]

7. For institutions that choose to provide a credit score disclosure to consumers 

that request a loan that is not or will not be secured by residential real 

property, determine whether the Section 222.74(e) notice generally is 

provided to each consumer that requests such an extension of credit and that 

each notice contains:

a. A statement that a consumer report (or credit report) is a record of the 

consumer’s credit history and includes information about whether the 

consumer pays his or her obligations on time and how much the consumer owes to creditors;

b. A statement that a credit score is a number that takes into account information in a consumer report and that a credit score can change over time 

to reflect changes in the consumer’s credit history;

c. A statement that the consumer’s credit score can affect whether the consumer can obtain credit and what the cost of that credit will be;

d. A statement that the consumer is encouraged to verify the accuracy of the 

information contained in the consumer report and has the right to dispute 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 15

any inaccurate information in the report;

e. A statement that federal law gives the consumer the right to obtain copies 

of his or her consumer reports directly from the consumer reporting 

agencies, including a free report from each of the nationwide consumer 

reporting agencies once during any 12-month period;

f. Contact information for the centralized source from which consumers 

may obtain their free annual consumer reports; 

g. A statement directing consumers to the websites of the Federal Reserve 

Board and Federal Trade Commission to obtain more information about 

consumer reports;

h. The current credit score of the consumer or the most recent credit score 

of the consumer that was previously calculated by the consumer reporting 

agency for a purpose related to the extension of credit;

i. The distribution of credit scores among consumers who are scored under 

the same scoring model that is used to generate the consumer’s credit 

score. The distribution should:

i. Use the same scale as that of the credit score provided to the consumer, 

and 

ii. Be presented:

a) in the form of a bar graph containing a minimum of six bars that 

illustrates the percentage of consumers with credit scores within 

the range of scores reflected in each bar, 

b) by other clear and readily understandable graphical means, or 

c) in a clear and readily understandable statement informing the consumer how his or her credit score compares to the scores of other 

consumers. The presentation may use a graph or statement obtained from the entity providing the credit score if it meets these 

requirements;

j. The range of possible credit scores under the model used to generate the credit score;

k. The date on which the credit score was created; and

l. The name of the consumer reporting agency or other person that provided

the credit score.

[Click&type]

8. For institutions that otherwise provide credit score disclosures to consumers 

that request loans, determine whether the Section 222.74(f) notice is provided 

to the applicable consumers in situations where no credit score is available 

for the consumer, as required by 222.74(f). Determine whether each notice 

contains:

a. A statement that a consumer report (or credit report) includes information 

about the consumer’s credit history and the type of information included 

in that history;
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 16

b. A statement that a credit score is a number that takes into account information in a consumer report and that a credit score can change over time 

in response to changes in the consumer’s credit history;

c. A statement that credit scores are important because consumers with 

higher credit scores generally obtain more favorable credit terms;

d. A statement that not having a credit score can affect whether the consumer can obtain credit and what the cost of that credit will be;

e. A statement that a credit score about the consumer was not available from 

a consumer reporting agency, which must be identified by name, generally due to insufficient information regarding the consumer’s credit history;

f. A statement that the consumer is encouraged to verify the accuracy of the 

information contained in the consumer report and has the right to dispute 

any inaccurate information in the consumer report;

g. A statement that federal law gives the consumer the right to obtain copies 

of his or her consumer reports directly from the consumer reporting 

agencies, including a free consumer report from each of the nationwide 

consumer reporting agencies once during any 12-month period;

h. The contact information for the centralized source from which consumers 

may obtain their free annual consumer reports; and 

i. A statement directing consumers to the websites of the Federal Reserve 

Board and Federal Trade Commission to obtain more information about 

consumer reports.

[Click&type]

9. For institutions that provide credit score exception notices and that obtain 

multiple credit scores in setting material terms of credit, determine whether 

the score(s) is disclosed in a manner consistent with the regulation (12 CFR 

222.74(d)(4) and .74 (e)(4)):

a. If an institution only relies upon one of those credit scores in setting the 

material terms of credit granted, extended, or otherwise provided to a 

consumer (for example, by using the low, middle, high, or most recent 

score), determine whether the notice includes that credit score and the 

other information required by Section 222.74(d). 

b. If an institution relies upon multiple credit scores in setting the material 

terms of credit granted, extended, or otherwise provided to a consumer 

(for example, by computing the average of all the credit scores obtained), 

determine whether the notice includes one of those credit scores and the 

other information required by Section 222.74(d). 

[Click&type]

10. Regardless of whether the institution provides risk-based pricing notices or 

credit score exception notices, if the institution increases the consumer’s 

APR as the result of a review of a consumer’s account, determine whether 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 17

the financial institution provided the consumer with an account review riskbased pricing notice (12 CFR 222.72(d)) if an adverse action notice was not 

already provided.

[Click&type]

11. Determine whether the account review risk-based pricing notice contains 

(12 CFR 222.73(a)(2)):

a. a statement that a consumer report (or credit report) includes information 

about the consumer’s credit history and the type of information included 

in that history;

b. a statement that the consumer is encouraged to verify the accuracy of the 

information contained in the consumer report and has the right to dispute 

any inaccurate information in the report;

c. the identity of each consumer reporting agency that furnished a consumer 

report used in the credit decision;

d. a statement that federal law gives the consumer the right to obtain a copy 

of a consumer report from the consumer reporting agency or agencies 

identified in the notice without charge for 60 days after receipt of the notice;

e. a statement that informs the consumer how to obtain a consumer report from 

the consumer reporting agency or agencies identified in the notice and provides contact information (including a toll-free telephone number, where 

applicable) specified by the consumer reporting agency or agencies; 

f. a statement that directs consumers to the websites of the Federal Reserve 

Board and Federal Trade Commission to obtain more information about 

consumer reports;

g. a statement that the financial institution has conducted a review of the account using information from a consumer report; and

h. a statement that, as a result of the review, the APR on the account has 

been increased based on information from a consumer report.

[Click&type]

12. For all notices, determine whether the notices are clear and conspicuous and 

comply with the specific format requirements for the notices (12 CFR 

222.73(b), .74(d)(2), .74(e)(2), and .74(f)(3)).

[Click&type]

13. For all notices, determine whether the notices are provided within the 

required time frames (12 CFR 222.73(c), .74(d)(3), .74(e)(3), and .74(f)(4)):

Risk-based pricing notices and account review risk-based pricing notices

• For closed-end credit, the notice generally must be provided to the consumer after the decision to approve a credit request is communicated to 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 18

the consumer, but before consummation of the transaction. 

• For open-end credit, the notice generally must be provided after the decision to grant credit is communicated to the consumer, but before the first 

transaction under the plan has been made.

• For account reviews, the notice generally must be provided at the time 

that the decision to increase the APR is communicated to the consumer or 

no later than five days after the effective date of the change in the APR. 

Credit score disclosures for loans secured by residential real property

• The credit score disclosure for loans secured by residential real property 

must be provided to the consumer at the same time as the disclosure required by Section 609(g) of the FCRA is provided to the consumer. The 

609(g) notice must be provided as soon as reasonably practicable after 

the credit score has been obtained. In any event, the credit score disclosure for loans secured by residential real property must be provided at or 

before consummation in the case of closed-end credit or before the first 

transaction is made under an open-end credit plan.

Credit score disclosures for loans not secured by residential real property 

• The notice generally must be provided to the consumer as soon as reasonably practicable after the credit score has been obtained, but in any 

event at or before consummation in the case of closed-end credit or before the first transaction is made under an open-end credit plan. 

Credit score exception notices when no credit score is available

• The notice generally must be provided to the consumer as soon as reasonably practicable after the institution has requested the credit score, but 

in any event not later than consummation of a transaction in the case of 

closed-end credit or when the first transaction is made under an open-end 

credit plan.

All notices, except credit score disclosures for loans secured by residential 

real property

• For automobile lending transactions made through an auto dealer that is 

unaffiliated with the institution, the institution may provide a notice in the 

time periods described above. Alternatively, the institution may arrange 

to have the auto dealer provide a notice to the consumer on its behalf 

within these time periods and maintain reasonable policies and procedures to verify that the auto dealer provides the notice to the consumer 

within the applicable time periods. If the institution arranges to have the 

auto dealer provide a credit score disclosure for loans not secured by residential real property, the institution complies if the consumer receives a 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 19

notice containing a credit score obtained by the dealer with these time periods, even if a different credit score is obtained and used by the 

institution. 

• For instant credit that is granted under an open-end credit plan to a consumer in person or by telephone, the notice may be provided at the earlier 

of:

 The time of the first mailing to the consumer after the decision is 

made to approve the credit, such as in a mailing containing the account agreement or a credit card; or

 Within 30 days after the decision to approve the credit.

[Click&type]

14. For all notices, determine whether the financial institution follows the rules 

of construction pertaining to the number of notices provided to the 

consumer(s) (12 CFR 222.75). In a transaction involving two or more 

consumers, a financial institution must provide a risk-based notice to each 

consumer. If the consumers have the same address, a financial institution 

may satisfy the requirements by providing a single risk-based pricing notice 

addressed to both consumers. For credit score disclosure exception notices, 

whether the consumers have the same address or not, the financial institution 

must provide a separate notice to each consumer.

[Click&type]

15. For all notices, determine whether the financial institution uses the model 

forms in Appendix H of the regulation. If yes, determine that it does not 

modify the model form so extensively as to affect the substance, clarity, 

comprehensibility, or meaningful sequence of the forms (Appendix H).

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 20

Module 4: Duties of Users of Consumer Reports 

and Furnishers of Consumer Report Information

Duties of Users of Credit Reports Regarding Address Discrepancies 

(12 CFR 222.82)

1. Determine whether a user of consumer reports has policies and procedures to 

recognize notices of address discrepancy that it receives from a nationwide 

consumer reporting agency (NCRA)4 in connection with consumer reports.

[Click&type]

2. Determine whether a user that receives notices of address discrepancy has 

policies and procedures to form a reasonable belief that the consumer report 

relates to the consumer whose report was requested (12 CFR 222.82(c)). 

See examples of reasonable policies and procedures “to form a reasonable 

belief” in 12 CFR 222.82(c)(2).

[Click&type]

3. Determine whether a user that receives notices of address discrepancy has 

policies and procedures to furnish to the NCRA an address for the consumer 

that the user has reasonably confirmed is accurate, if the user does the 

following:

a. Forms a reasonable belief that the report relates to the consumer;

b. Establishes a continuing relationship with the consumer; and

c. Regularly, and in the ordinary course of business, furnishes information 

to the NCRA (12 CFR 222.82(d)(1)).

See examples of reasonable confirmation methods in 12 CFR 222.82(d)(2).

[Click&type]

4. Determine whether the user’s policies and procedures require it to furnish 

the confirmed address as part of the information it regularly furnishes to an 

NCRA during the reporting period when it establishes a relationship with the 

consumer (12 CFR 222.82(d)(3)).

[Click&type]

5. If procedural weaknesses or other risks requiring further information are 

noted, obtain a sample of consumer reports requested by the user from an 

 

4 A NCRA compiles and maintains files on consumers on a nationwide basis. As of the effective date of the rule (January 1, 2008) there 

were three such consumer reporting agencies: Experian, Equifax, and TransUnion. Section 603(p) of FCRA (15 USC 1681a).
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 21

NCRA that included notices of address discrepancy and determine:

a. How the user established a reasonable belief that the consumer 

reports related to the consumers whose reports were requested; and 

b. If a consumer relationship was established:

i. Whether the institution furnished a consumer’s address that it 

reasonably confirmed to the NCRA from which it received 

the notice of address discrepancy; and

ii. Whether it furnished the address in the reporting period 

during which it established the relationship.

[Click&type]

6. On the basis of examination procedures completed, form a conclusion about 

the ability of user’s policies and procedures to meet regulatory requirements 

for the proper handling of address discrepancies reported by an NCRA. 

[Click&type]

Furnishers of Information – General (12 CFR 222.40)

1. Determine whether the financial institution furnishes consumer information 

to a consumer reporting agency about an account or other relationship with 

a consumer. If so, the institution is subject to 12 CFR 222.40 

[Click&type]

2. Determine whether the financial institution has established and 

implemented reasonable policies and procedures regarding the accuracy 

and integrity of information furnished to a consumer reporting agency (12 

CFR 222.42(a)). 

[Click&type]

3. Determine whether the institution considered the Interagency Guidelines 

in Appendix E of the regulation when developing its policies and 

procedures, and incorporated the guidelines as appropriate (12 CFR 

222.42(b)). 

[Click&type]

4. Determine whether the institution reviews its policies and procedures 

periodically and updates them as necessary to ensure their effectiveness 

(12 CFR 222.42(c)).

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 22

5. If procedural weaknesses are noted or other risks requiring further 

investigation are noted, such as a high number of consumer complaints 

regarding the accuracy of their consumer report information from the 

financial institution, select a sample of reported items and the corresponding 

loan or collection file to determine that the financial institution:

a. Did not report information that it knew, or had reasonable cause to believe, was inaccurate. Section 623(a)(1)(A) [15 USC 1681s-2(a)(1)(A)];

b. Did not report information to a consumer reporting agency if it was notified by the consumer that the information was inaccurate and the 

information was, in fact, inaccurate. Section 623(a)(1)(B) [15 USC 

1681s-2(a)(1)(B)];

c. Provided the consumer reporting agency with corrections or additional 

information to make the information complete and accurate, and thereafter did not send the consumer reporting agency the inaccurate or 

incomplete information in situations where the incomplete or inaccurate 

information was provided. Section 623(a)(2) [15 USC 1681s-2(a)(2)];

d. Furnished a notice to a consumer reporting agency of a dispute in situations where a consumer disputed the completeness or accuracy of any 

information the institution furnished, and the institution continued furnishing the information to a consumer reporting agency. Section 

623(a)(3) [15 USC 1681s-2(a)(3)];

e. Notified the consumer reporting agency of a voluntary account-closing 

by the consumer, and did so as part of the information regularly furnished for the period in which the account was closed. Section 623(a)(4) 

[15 USC 1681s-2(a)(4)]; and

f. Notified the consumer reporting agency of the month and year of commencement of a delinquency that immediately preceded the action. The 

notification to the consumer reporting agency must be made within 90 

days of furnishing information about a delinquent account that was being 

placed for collection, charged-off, or subjected to any similar action. 

Section 623(a)(5) [15 USC 1681s-2(a)(5)].

[Click&type]

6. If weakness within the financial institution’s procedurs for investigating 

errors are revealed, review a sample of notices of discputes received from a 

consumer reporting agency and determine whether the institution did the 

following:

a. Conducted an investigation with respect to the disputed information 

(Section 623(b)(1)(A) [15 USC 1681s-2(b)(1)(A)].

b. Reviewed all relevant information provided by the consumer reporting 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 23

agency (Section 623(b)(1)(B) [15 USC 1681s-2(b)(1)(B)].

c. Reported the results of the investigation to the consumer reporting 

agency (Section 623(b)(1)(C)) [15 USC 1681s-2(b)(1)(C)].

d. Reported the results of the investigation to all other nationwide 

consumer reporting agencies to which the information was furnished if 

the investigation found that the reported information was inaccurate or 

incomplete (Section 623(b)(1)(D) [15 USC 1681s-2(b)(1)(D)].

e. Modified, deleted, or blocked the reporting of information that could 

not be verified.

[Click&type]

7. Determine whether the institution conducts reasonable investigations of 

direct disputes from consumers, including a review of all relevant 

information provided by the consumer (12 CFR 222.43(e)(1) and (2)).

a. Determine whether the institution completes the investigation and 

reports the results to the consumer within the required time frame (12 

CFR 22243(e)(3)).

b. Determine whether the institution notifies and provides corrected 

information to the consumer reporting agencies when the results of its 

investigation finds that inaccurate information was furnished to the 

consumer reporting agencies (12 CFR 222.43(e)(4)).

c. When the institution finds that a dispute is frivolous or irrelevant,

determine whether the institution:

i. notifies the consumer within five days after finding the dispute frivolous or irrelevant (12 CFR 222.43(f)(2)), and

ii. includes in the consumer notification the reasons for the findings and 

the information necessary to investigate the disputed information 

(12 CFR 222.43(f)(3)).

[Click&type]

Prevention of Re-Pollution of Consumer Reports (15 USC 1681s-2(a)(6))

1. If the financial institution provides information to a consumer reporting 

agency, review the institutin’s policies and procedures for ensuring that 

items of information blocked because of an alleged identity theft are not rereported to the consumer reporting agency.

[Click&type]

2. If weaknesses are noted within the financial institutoin’s policies and 

procedures, review a sample of notices from a consumer reporting agency of 
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 24

allegedly fraudulent ifnormation due to identity theft furnished by the 

financial institution, to determine whether the institution does not re-report 

the item to a consumer reporting agency.

[Click&type]

3. If procedural weaknesses or other risks requiring further investigation are 

noted, verify that the financial institution has not sold or transferred a debt 

that resulted from an alleged identity theft.

[Click&type]

Negative Information Notice (15 USC 1681s-2(a)(7))

1. If the financial institution provides negative information to a nationwide 

consumer reporting agency, verify that the institution’s policies and 

procedures ensure tht the approriate notices are provided to consumers.

[Click&type]

2. If procedural weaknesses or other risks requiring further investigation are 

noted, review a sample of notices provided to consumers to determine 

compliance with the technical content and timing requirements.

[Click&type]
CFPB 

Examination Procedures FCRA

CFPB FFIEC Rev. 2011 FCRA 25

Module 5: Consumer Alerts and Identity Theft 

Protections

Fraud and Active Duty Alerts (15 USC 1681c-1(h))

1. Determine whether the financial institution has effective policies and 

procedures in place to verify the identity of consumers in situations in which 

consumer reports include fraud and/or active duty military alerts.

[Click&type]

2. Determine if the financial institution has effective policies and procedures in 

place to contact consumers in situations where consumer reports include 

extended alerts.

[Click&type]

3. If procedural weaknesses or other risks requiring further investigation are 

noted, review a sample of transactions in which consumer reports including 

these types of alerts were obtained. Verify that the financial institution 

complied with the identity verification and/or consumer contact requirements.

[Click&type]

Information Available to Victims (15 USC 1681g(e))

1. Review the financial institution’s policies, procedures, and/or practices to 

determine whether identities and claims of fruadulent transactions are 

verified and whether information is properly disclosed to victims of identity 

theft and/or appropriately authorized law enforcement agents.

[Click&type]

2. If procedural weaknesses or other risks requiring further investigation are 

noted, review a sample of these types of requests to endetermine whether the 

financial institution properly verified the requestor’s identity prior to 

disclosing the information.

[Click&type]
CFPB Consumer

Laws and Regulations FDCPA

CFPB FFIEC Rev. 12/1999 FDCPA 1

Fair Debt Collection Practices Act

The Fair Debt Collection Practices Act (FDCPA)(15 USC 1692, et seq.), which became effective 

March 20, 1978, was designed to eliminate abusive, deceptive, and unfair debt collection practices. 

In addition, the federal law (15 USC 1692 et seq.) protects reputable debt collectors from unfair 

competition and encourages consistent state action to protect consumers from abuses in debt 

collection.

The Dodd-Frank Act granted rulemaking authority under the FDCPA to the Consumer Financial 

Protection Bureau (CFPB) and, with respect to entities under its jurisdiction, granted authority to 

the CFPB to supervise for and enforce compliance with the FDCPA.

1

 

Debt That Is Covered

The FDCPA applies only to the collection of debt incurred by a consumer primarily for personal, 

family, or household purposes. It does not apply to the collection of corporate debt or to debt owed 

for business or agricultural purposes.

Debt Collectors That Are Covered

Under FDCPA, a “debt collector” is defined as any person who regularly collects, or attempts to 

collect, consumer debts for another person or institution or uses some name other than its own when 

collecting its own consumer debts. That definition would include, for example, an institution that 

regularly collects debts for an unrelated institution. This includes reciprocal service arrangements 

where one institution solicits the help of another in collecting a defaulted debt from a customer who 

has moved.

Debt Collectors That Are Not Covered

An institution is not a debt collector under the FDCPA when it collects:

• Another’s debts in isolated instances.

• Its own debts under its own name.

• Debts it originated and then sold, but continues to service (for example, mortgage and 

student loans).

• Debts that were not in default when they were obtained.

• Debts that were obtained as security for a commercial credit transaction (for example, 

accounts receivable financing).

• Debts incidental to a bona fide fiduciary relationship or escrow arrangement (for example, a 

debt held in the institution’s trust department or mortgage loan escrow for taxes and 

insurance).

• Debts regularly for other institutions to which it is related by common ownership or 

corporate control.

 1 Dodd-Frank Act §§ 1002(12)(H), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12)(H), 5514(c), and 5515(c).
CFPB Consumer

Laws and Regulations FDCPA

CFPB FFIEC Rev. 12/1999 FDCPA 2

Debt collectors that are not covered also include:

• Officers or employees of an institution who collect debts owed to the institution in 

the institution’s name.

• Legal process servers.

COMMUNICATIONS CONNECTED WITH DEBT COLLECTION

(15 USC 1692b and c)

For communications with a consumer or third party with the collection of a debt, the term 

“consumer” is defined to include the borrower’s spouse, parent (if the borrower is a minor), 

guardian, executor, or administrator.

When, Where, and With Whom Communication is Permitted

Communicating with the Consumer

A debt collector may not communicate with a consumer at any unusual time (generally before 8 

a.m. or after 9 p.m. in the consumer’s time zone) or at any place that is inconvenient to the 

consumer, unless the consumer or a court of competent jurisdiction has already given permission for 

such contacts. A debt collector may not contact the consumer at his or her place of employment if 

the collector has reason to believe the employer prohibits such communications.

If the debt collector knows the consumer has retained an attorney to handle the debt, and can easily 

ascertain the attorney’s name and address, all contacts must be with that attorney, unless the 

attorney is unresponsive or agrees to allow direct communication with the consumer.

Ceasing Communication with the Consumer

When a consumer refuses, in writing, to pay a debt or requests that the debt collector cease further 

communication, the collector must cease all further communication, except to advise the consumer that:

• The collection effort is being stopped.

• Certain specified remedies ordinarily invoked may be pursued or, if appropriate, that a 

specific remedy will be pursued.

Mailed notices from the consumer are official when they are received by the debt collector.

Communicating with Third Parties

The only third parties that a debt collector may contact when trying to collect a debt

are:

• The consumer.

• The consumer’s attorney.

• A consumer reporting agency (if permitted by local law).

• The creditor.
CFPB Consumer

Laws and Regulations FDCPA

CFPB FFIEC Rev. 12/1999 FDCPA 3

• The creditor’s attorney.

• The debt collector’s attorney.

The consumer or a court of competent jurisdiction may, however, give the debt collector specific 

permission to contact other third parties. In addition, a debt collector who is unable to locate a 

consumer may ask a third party for the consumer’s home address, telephone number and place of 

employment (location information). The debt collector must give his or her name and state that he 

or she is confirming or correcting location information about the consumer. Unless specifically 

asked, the debt collector may not name the collection firm or agency or reveal that the consumer 

owes any debt.

No third party may be contacted more than once unless the collector believes that the information 

from the first contact was wrong or incomplete and that the third party has since received better 

information, or unless the third party specifically requests additional contact.

Contact with any third party by postcard, letter or telegram is allowed only if the envelope or 

content of the communication does not indicate the nature of the collector’s business.

VALIDATION OF DEBTS (15 USC 1692g)

The debt collector must provide the consumer with certain basic information. If that information

was not in the initial communication and if the consumer has not paid the debt five days after

the initial communication, the following information must be sent to the consumer in written form:

• The amount of the debt;

• The name of the creditor to whom the debt is owed;

• Notice that the consumer has 30 days to dispute the debt before it is assumed to be valid;

• Notice that upon such written dispute, the debt collector will send the consumer a 

verification of the debt or a copy of any judgment; and

• Notice that if, within the 30-day period, the consumer makes a written request for the name 

and address of the original creditor, if it is different from the current creditor, the debt 

collector will provide that information.

If, within the 30-day period, the consumer disputes in writing any portion of the debt or requests the 

name and address of the original creditor, the collector must stop all collection efforts until he or 

she mails the consumer a copy of a judgment or verification of the debt, or the name and address of 

the original creditor, as applicable.
CFPB Consumer

Laws and Regulations FDCPA

CFPB FFIEC Rev. 12/1999 FDCPA 4

PROHIBITED PRACTICES

HARASSING OR ABUSIVE PRACTICES (15 USC 1692d)

A debt collector in collecting a debt, may not harass, oppress, or abuse any person. Specifically, a 

debt collector may not:

• Use or threaten to use violence or other criminal means to harm the physical person, 

reputation, or property of any person.

• Use obscene, profane, or other language that abuses the hearer or reader.

• Publish a list of consumers who allegedly refuse to pay debts, except to a consumer 

reporting agency or to persons meeting the requirements of Section 603(f) or 604(3) of the 

Act.

• Advertise a debt for sale to coerce payment.

• Annoy, abuse, or harass persons by calling repeatedly their telephone number or allowing 

their telephones to ring continually.

• Make telephone calls without properly identifying oneself, except as allowed to obtain 

location information.

FALSE OR MISLEADING REPRESENTATIONS (15 USC 1692e)

A debt collector, in collecting a debt, may not use any false, deceptive, or misleading 

representation. Specifically, a debt collector may not:

• Falsely represent or imply that he or she is vouched for, bonded by, or affiliated with the 

United States or any state, including the use of any badge, uniform, or similar identification.

• Falsely represent the character, amount, or legal status of the debt, or of any services 

rendered, or compensation he or she may receive for collecting the debt.

• Falsely represent or imply that he or she is an attorney or that communications are from an 

attorney.

• Threaten to take any action which is not legal or intended.

• Falsely represent or imply that nonpayment of any debt will result in the arrest or 

imprisonment of any person or the seizure, garnishment, attachment, or sale of any property 

or wages of any person, unless such action is lawful and intended by the debt collector or 

creditor.

• Falsely represent or imply that the sale, referral, or other transfer of the debt will cause the 

consumer to lose a claim or a defense to payment, or become subject to any practice 

prohibited by the FDCPA.

• Falsely represent or imply that the consumer committed a crime or other conduct to disgrace 

the consumer.
CFPB Consumer

Laws and Regulations FDCPA

CFPB FFIEC Rev. 12/1999 FDCPA 5

• Communicate, or threaten to communicate, false credit information or information 

which should be known to be false, including not identifying disputed debts as such.

• Use or distribute written communications made to look like or falsely represented to 

be documents authorized, issued, or approved by any court, official, or agency of the United 

States or any state if it would give a false impression of its source, authorization, or 

approval.

• Use any false representation or deceptive means to collect or attempt to collect a debt or to 

obtain information about a consumer.

• Fail to disclose in the initial written communication with the consumer, and the initial oral 

communication if it precedes the initial written communication, that the debt collector is 

attempting to collect a debt and that any information obtained will be used for that purpose. 

In addition, the debt collector must disclose in subsequent communications that the 

communication is from a debt collector. (These disclosures do not apply to a formal 

pleading made in connection with a legal action.)

• Falsely represent or imply that accounts have been sold to innocent purchasers.

• Falsely represent or imply that documents are legal process.

• Use any name other than the true name of the debt collector’s business, company, 

or organization.

• Falsely represent or imply that documents are not legal process or do not require action by 

the consumer.

• Falsely represent or imply that he or she operates or is employed by a consumer reporting 

agency.

Unfair Practices (15 USC 1692f)

A debt collector may not use unfair or unconscionable means to collect or attempt to collect a debt. 

Specifically, a debt collector may not:

• Collect any interest, fee, charge, or expense incidental to the principal obligation unless it 

was authorized by the original debt agreement or is otherwise permitted by law.

• Accept a check or other instrument post-dated by more than five days, unless he or she 

notifies the consumer, in writing, of any intention to deposit the check or instrument. That 

notice must be made not more than ten or less than three business days before the date of 

deposit.

• Solicit a post-dated check or other post-dated payment instrument to use as a threat or to 

institute criminal prosecution.

• Deposit or threaten to deposit a post-dated check or other post-dated payment instrument 

before the date on the check or instrument.

• Cause communication charges, such as those for collect telephone calls and telegrams, to be 

made to any person by concealing the true purpose of the communication.
CFPB Consumer

Laws and Regulations FDCPA

CFPB FFIEC Rev. 12/1999 FDCPA 6

• Take or threaten to repossess or disable property when the creditor has no enforceable right 

to the property or does not intend to do so, or if, under law, the property cannot be taken, 

repossessed, or disabled.

• Use a postcard to contact a consumer about a debt.

MULTIPLE DEBTS (15 USC 1692h)

If a consumer owes several debts that are being collected by the same debt collector, payments must

be applied according to the consumer’s instructions. No payment may be applied to a disputed debt.

LEGAL ACTIONS BY DEBT COLLECTORS (15 USC 1692i)

A debt collector may file a lawsuit to enforce a security interest in real property only in the judicial 

district in which the real property is located. Other legal actions may be brought only in the judicial 

district in which the consumer lives or in which the original contract creating the debt was signed.

FURNISHING CERTAIN DECEPTIVE FORMS (15 USC 1692j)

No one may design, compile and/or furnish any form that creates the false impression that someone 

other than the creditor (for example, a debt collector) is participating in the collection of a debt.

CIVIL LIABILITY

A debt collector who fails to comply with any provision of the FDCPA is liable for:

• Any actual damages sustained as a result of that failure;

• Punitive damages as allowed by the court-

 in an individual action, up to $1,000; or

 in a class action, up to $1,000 for each named plaintiff and an award to be divided 

among all members of the class of an amount up to $500,000 or 1 percent of the debt 

collector’s net worth, whichever is less;

• Costs and a reasonable attorney’s fee in any such action.

In determining punitive damages, the court must consider the nature, frequency and persistency of 

the violations and the extent to which they were intentional. In a class action, the court must also 

consider the resources of the debt collector and the number of persons adversely affected.

Defenses

A debt collector is not liable for a violation if a preponderance of the evidence shows it was not 

intentional and was the result of a bona fide error that arose despite procedures reasonably designed 

to avoid any such error. The collector is also not liable if he or she, in good faith, relied on an 

advisory opinion of the CFPB or on prior advisory opinions of the Federal Trade Commission, even 

if the ruling is later amended, rescinded, or determined to be invalid for any reason.
CFPB Consumer

Laws and Regulations FDCPA

CFPB FFIEC Rev. 12/1999 FDCPA 7

Jurisdiction and Statute of Limitations

Action against debt collectors for violations of the FDCPA may be brought in any appropriate U.S. 

district court or other court of competent jurisdiction. The consumer has one year from the date on 

which the violation occurred to start such as action.

Relation to State Law

The FDCPA preempts state law only to the extent that a state law is inconsistent with the FDCPA. 

A state law that is more protective of the consumer is not considered inconsistent with the FDCPA.

Exemption for State Regulation

The CFPB may exempt certain classes of debt collection practices from the requirements of the 

FDCPA if it has determined that state laws impose substantially similar requirements and that there 

is adequate provision for enforcement.

References

Laws

15 USC 1692 et seq. Fair Debt Collection Practices Act
CFPB 

Examination Procedures FDCPA

CFPB FFIEC Rev. 1999 FDCPA 1

Fair Debt Collection 

Practices Act

EXAMINATION OBJECTIVES

 To determine the adequacy of the institution's internal procedures and controls to assure 

consistent compliance with FDCPA.

 To determine if the institution complies with the requirements of the FDCPA in collecting or 

attempting to collect third-party consumer debts.

EXAMINATION PROCEDURES

The following procedures are to be completed through interviews with personnel knowledgeable 

about and directly engaged in the institution's collection activities and through reviews of any written collection procedures, reciprocal collection agreements, collection letters, dunning notices, 

envelopes, scripts used by collection personnel, validation notices, individual collection files, complaint files, and other relevant records.

1. Determine if the institution is a debt collector under FDCPA.

[Click&type]

2. Determine if the institution has established internal procedures and controls to 

ensure compliance with the FDCPA.

[Click&type]

3. If the institution has acted or is acting as a debt collector under the FDCPA, 

determine if the institution has:

a. Communicated with the consumer or third parties in any prohibited manner 

(15 USC 1692b and c);

b. Furnished the written validation notice within the required time period and 

otherwise complied with applicable validation requirements (15 SC 1692g);

c. Used any harassing, abusive, unfair, or deceptive collection practice 

prohibited by FDCPA (15 USC 1692d, e, f, and j);

d. Collected any amount not expressly authorized by the debt instrument 

creating the debt or by state law (15 USC 1692f(1));

e. Applied all payments received as instructed and, where no instruction was 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Procedures FDCPA

CFPB FFIEC Rev. 1999 FDCPA 2

given, applied payments only to undisputed debts (15 USC 1692h);

f. Filed suit in an authorized forum if the institution sued to collect the debt (15 

USC 1692i).

[Click&type]

EXAMINER’S SUMMARY, RECOMMENDATIONS, AND COMMENTS 

[Click&type]
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 1

Electronic Fund Transfer Act

The Electronic Fund Transfer Act (EFTA) (15 USC 1693 et seq.) of 1978 is intended to protect 

individual consumers engaging in electronic fund transfers (EFTs). EFT services include transfers 

through automated teller machines, point-of-sale terminals, automated clearinghouse systems, 

telephone bill-payment plans in which periodic or recurring transfers are contemplated, and remote 

banking programs. The Federal Reserve Board (Board) implements EFTA through Regulation E, 

which includes an official staff commentary. 

The Board amended Regulation E to add section 205.17, prohibiting institutions from charging 

overdraft fees for ATM and point of sale (POS) transactions unless the consumer affirmatively 

consents (74 Fed. Reg. 59033 (Nov. 17, 2009) and 75 Fed. Reg. 31665 June 4, 2010). The Board 

also added section 205.20 to restrict fees and expiration dates on gift cards, and to require that gift 

card terms be clearly stated. (75 Fed. Reg. 16580 (April 1, 2010)).1

The Dodd-Frank Act granted rule-making authority under the EFTA to the Consumer Financial 

Protection Bureau (CFPB) and, with respect to entities under its jurisdiction, granted authority to 

the CFPB to supervise and enforce compliance with EFTA and its implementing regulations.2

To help clarify the requirements of Regulation E, the following background information does not 

strictly follow the order of the regulatory text, but rather it is presented in the following order: 

I. Scope and Key Definitions (Sections 205.2, 205.3, 205.17, 205.20)

II. Disclosures (Sections 205.4, 205.7, 205.8, 205.16, 205.17, 205.20)

III. Electronic transaction overdraft service opt in (Section 205.17)

IV. Issuance of access devices (Sections 205.5, 205.18)

V. Consumer liability and error resolution (Sections 205.6, 205.11)

VI. Receipts and periodic statements (Sections 205.9, 205.18)

VII. Gift cards (Section 205.20)

VIII. Other requirements ( Sections 205.10, 205.14, 205.15)

IX. Relation to other laws (Section 205.12)

X. Administrative enforcement and record retention (Section 205.13)

XI. Miscellaneous (EFTA provisions not reflected in Regulation E)

For ease of use by the examiner, however, the examination procedures and checklist follow the 

order of the regulation. 

 

1 The Board also implemented a legislative extension of time for complying with the gift card disclosure requirements until January 

31, 2011. 75 Fed. Reg. 50683 (August 17, 2010).

2

Dodd-Frank Act §§ 1002(12)(C), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12)(C), 5514(c), and 5515(c). The transfer of 

authority did not include section 920 of EFTA, which concerns debit card interchange fees charged to merchants. These procedures 

will be further modified in the future to reflect, as appropriate, the transfer of certain authorities from the Federal Reserve Board to 

the CFPB on July 21, 2011 effected by the Dodd-Frank Act.
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 2

I. Scope

Key Definitions

Access device is a card, code, or other means of access to a consumer’s account or a combination of 

these used by the consumer to initiate EFTs. Access devices include debit cards, personal 

identification numbers (PINs), telephone transfer and telephone bill payment codes, and other 

means to initiate an EFT to or from a consumer account (Section 205.2(a)(1) and Staff Commentary 

205.2(a)-1).

Access devices do not include either of the following:

• Magnetic tape or other devices used internally by a financial institution to initiate electronic 

transfers.

• A check or draft used to capture the MICR (Magnetic Ink Character Recognition) encoding 

or routing, account, and serial numbers to initiate a one-time ACH debit (Staff Commentary 

205.2(a)-1 and -2).

Accepted access device is an access device that a consumer:

• Requests and receives, signs, or uses (or authorizes another to use) to transfer money 

between accounts or to obtain money, property, or services.

• Requests to be validated even if it was issued on an unsolicited basis.

• Receives as a renewal or substitute for an accepted access device from either the financial 

institution that initially issued the device or a successor (Section 205.2(a)(2)).

Account includes the following:

• Checking, savings, or other consumer asset account held by a financial institution (directly 

or indirectly), including certain club accounts, established primarily for personal, family, or 

household purposes.

• Payroll card account, established through an employer (directly or indirectly), to which 

EFTs of the consumer’s wages, salary, or other employee compensation (such as 

commissions), are made on a recurring basis. The payroll card account can be operated or 

managed by the employer, a third-party processor, a depository institution, or any other 

person. All transactions involving the transfer of funds to or from a payroll card account are 

covered by the regulation (Section 205.2(b)(2) and Staff Commentary 205.2(b)-2).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 3

An account does not include:

• An account held by a financial institution under a bona fide trust agreement.

• An occasional or incidental credit balance in a credit plan. 

• Profit-sharing and pension accounts established under a bona fide trust agreement. 

• Escrow accounts such as for payments of real estate taxes, insurance premiums, or 

completion of repairs.

• Accounts for purchasing U.S. savings bonds (Section 205.2(b)(3) and Staff Commentary 

205.2(b)-3). 

A payroll card account does not include a card used:

• Solely to disburse incentive-based payments (other than commissions when they represent 

the primary means through which a consumer is paid) that are unlikely to be a consumer’s 

primary source of salary or other compensation;

• Solely to make disbursements unrelated to compensation, such as petty cash reimbursements 

or travel per diem payments; or

• In isolated instances to which an employer typically does not make recurring payments 

(Staff Commentary 205.2(b)-2).

Activity means any action that results in an increase or decrease of the funds underlying a certificate 

or card, other than the imposition of a fee, or an adjustment due to an error or a reversal of a prior 

transaction. (Section 205.20(a)(7)).

ATM operator is any person that operates an ATM at which a consumer initiates an EFT or a 

balance inquiry and that does not hold the account to or from which the transfer is made or about 

which the inquiry is made (Section 205.16(a)).

Dormancy fee and inactivity fee mean a fee for non-use of or inactivity on a gift certificate, store 

gift card, or general-use prepaid card. (Section 205.20(a)(5)).

Electronic check conversion (ECK) transactions are transactions where a check, draft, or similar 

paper instrument is used as a source of information to initiate a one-time electronic fund transfer 

from a consumer’s account. The consumer must authorize the transfer. (Section 205.3(b)(2))

Electronic fund transfer (EFT) is a transfer of funds initiated through an electronic terminal, 

telephone, computer (including on-line banking) or magnetic tape for the purpose of ordering, 

instructing, or authorizing a financial institution to debit or credit a consumer’s account. EFTs 

include, but are not limited to, point-of-sale (POS) transfers; automated teller machine (ATM) 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 4

transfers; direct deposits or withdrawals of funds; transfers initiated by telephone; and transfers 

resulting from debit card transactions, whether or not initiated through an electronic terminal 

(Section 205.3(b)).

Electronic terminal is an electronic device, other than a telephone call by a consumer, through 

which a consumer may initiate an EFT. The term includes, but is not limited to, point-of-sale 

terminals, automated teller machines, and cash-dispensing machines (Section 205.2(h)).

Exclusions from gift card definition. The following cards, codes, or other devices are excluded and 

not subject to the substantive restrictions on imposing dormancy, inactivity, or service fees, or on 

expiration dates if they are: (Section 205.20(b))

• Useable solely for telephone services;

• Reloadable and not marketed or labeled as a gift card or gift certificate. For purposes of 

this exception, the term “reloadable” includes a temporary non-reloadable card issued 

solely in connection with a reloadable card, code, or other device;

• A loyalty, award, or promotional gift card (except that these must disclose on the card or 

device itself, information such as the date the funds expire, fee information and a toll 

free number) (Sections 205.20(a)(4) and (c)(4));

• Not marketed to the general public;

• Issued in paper form only; or

• Redeemable solely for admission to events or venues at a particular location or group of 

affiliated locations, or to obtain goods or services in conjunction with admission to such 

events or venues, at the event or venue or at specific locations affiliated with and in 

geographic proximity to the event or venue.

General-use prepaid card is a card, code, or other device: 

• Issued on a prepaid basis primarily for personal, family, or household purposes to a 

consumer in a specified amount, whether or not that amount may be increased or reloaded, 

in exchange for payment; and 

• That is redeemable upon presentation at multiple, unaffiliated merchants for goods or 

services, or that may be usable at automated teller machines. (Section 205.20(a)(3)). 

See “Exclusions from gift card definition.”

Gift certificate is a card, code, or other device issued on a prepaid basis primarily for personal, 

family, or household purposes to a consumer in a specified amount that may not be increased or 

reloaded in exchange for payment and redeemable upon presentation at a single merchant or an 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 5

affiliated group of merchants for goods or services. (Section 205.20(a)(1)). See “Exclusions from 

gift card definition.”

Loyalty, award, or promotional gift card is a card, code, or other device (1) issued on a prepaid 

basis primarily for personal, family, or household purposes to a consumer in connection with a 

loyalty, award, or promotional program; (2) that is redeemable upon presentation at one or more 

merchants for goods or services, or usable at automated teller machines; and (3) that sets forth 

certain disclosures, including a statement indicating that the card, code, or other device is issued for 

loyalty, award, or promotional purposes. (Section 205.20(a)(4)) See “Exclusions from gift card 

definition.”

Overdraft Services. A financial institution provides an overdraft service if it assesses a fee or charge 

for paying a transaction (including a check or other item) when the consumer has insufficient or 

unavailable funds in the account to pay the transaction. However, an overdraft service does not 

include payments made from the following:

• A line of credit subject to Regulation Z, such as a credit card account, a home equity line 

of credit, or an overdraft line of credit;

• Funds transferred from another account held individually or jointly by the consumer; or

• A line of credit or other transaction from a securities or commodities account held by a 

broker-dealer registered with the SEC or the CFTC. (Section 205.17(a))

Preauthorized electronic fund transfer is an EFT authorized in advance to recur at substantially 

regular intervals (Section 205.2(k)).

Service fee means a periodic fee for holding or use of a gift certificate, store gift card, or generaluse prepaid card. A periodic fee includes any fee that may be imposed on a gift certificate, store 

gift card, or general-use prepaid card from time to time for holding or using the certificate or card. 

(Section 205.20(a)(6)). For example, a service fee may include a monthly maintenance fee, a 

transaction fee, an ATM fee, a reload fee, a foreign currency transaction fee, or a balance inquiry 

fee, whether or not the fee is waived for a certain period of time or is only imposed after a certain 

period of time. However, a service fee does not include a one-time fee or a fee that is unlikely to be 

imposed more than once while the underlying funds are still valid, such as an initial issuance fee, a 

cash-out fee, a supplemental card fee, or a lost or stolen certificate or card replacement fee. 

(Commentary 20(a)(6)-1)

Store gift card is a card, code, or other device issued on a prepaid basis primarily for personal, 

family, or household purposes to a consumer in a specified amount, whether or not that amount may 

be increased or reloaded, in exchange for payment, and redeemable upon presentation at a single 

merchant or an affiliated group of merchants for goods or services. (Section 205.20(a)(2)). See 

“Exclusions from gift card definition.”
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 6

Unauthorized electronic fund transfer is an EFT from a consumer’s account initiated by a person 

other than the consumer without authority to initiate the transfer and from which the consumer 

receives no benefit. This does not include an EFT initiated in any of the following ways:

• By a person who was furnished the access device to the consumer’s account by the 

consumer, unless the consumer has notified the financial institution that transfers by that 

person are no longer authorized;

• With fraudulent intent by the consumer or any person acting in concert with the consumer; 

or

• By the financial institution or its employee (Section 205.2(m)).

Coverage – Section 205.3

The requirements of Regulation E apply only to accounts for which there is an agreement for EFT 

services to or from the account between (i) the consumer and the financial institution or (ii) the 

consumer and a third party, when the account-holding financial institution has received notice of the 

agreement and the fund transfers have begun (Staff Commentary 205.3(a)-1). 

Regulation E applies to all persons, including offices of foreign financial institutions in the United 

States, that offer EFT services to residents of any state3 and it covers any account located in the 

United States through which EFTs are offered to a resident of a state, no matter where a particular 

transfer occurs or where the financial institution is chartered (Staff Commentary 205.3(a)-3). 

Regulation E does not apply to a foreign branch of a U.S. financial institution unless the EFT 

services are offered in connection with an account in a state, as defined in Section 205.2(l) (Staff 

Commentary 205.3(a)-3). 

Exclusions from Coverage - Section 205.3(c) describes transfers that are not EFTs and are 

therefore not covered by the EFTA and Regulation E:

• Transfers of funds originated by check, draft, or similar paper instrument;

• Check guarantee or authorization services that do not directly result in a debit or credit to a 

consumer’s account;

• Any transfer of funds for a consumer within a system that is used primarily to transfer funds 

between financial institutions or businesses, e.g., Fedwire or other similar network;

• Any transfer of funds which has as its primary purpose the purchase or sale of securities or 

commodities regulated by the Securities and Exchange Commission (SEC) or the 

Commodity Futures Trading Commission (CFTC), purchased or sold through a broker-

 3

State means any state, territory, or possession of the United States; the District of Columbia; the Commonwealth of Puerto Rico; or 

any of their political subdivisions. 12 CFR 205.2(l).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 7

dealer regulated by the SEC or through a futures commission merchant regulated by the 

CFTC, or held in book-entry form by a Federal Reserve Bank or federal agency;

• Intra-institutional automatic transfers under an agreement between a consumer and a 

financial institution;

• Transfers initiated by telephone between a consumer and a financial institution provided the 

transfer is not a function of a written plan contemplating periodic or recurring transfers. A 

written statement available to the public, such as a brochure, that describes a service 

allowing a consumer to initiate transfers by telephone constitutes a written plan; or

• Preauthorized transfers to or from accounts at financial institutions with assets of less than 

$100 million on the preceding December 31. Such preauthorized transfers, however, remain 

subject to the compulsory use prohibition under Section 913 of the EFTA and 12 CFR 

205.10(e), as well as the civil and criminal liability provisions of Sections 915 and 916 of 

the EFTA. A small financial institution that provides EFT services besides preauthorized 

transfers must comply with the Regulation E requirements for those other services (Staff 

Commentary 205.3(c)(7)-1). For example, a small financial institution that offers ATM 

services must comply with Regulation E in regard to the issuance of debit cards, terminal 

receipts, periodic statements, and other requirements. 

Electronic Check Conversion (ECK) and Collection of 

Returned-Item Fees 

Regulation E covers electronic check conversion (ECK) transactions. In an ECK transaction, a 

consumer provides a check to a payee and information from the check is used to initiate a one-time 

EFT from the consumer’s account. Although transfers originated by checks are not covered by 

Regulation E, an ECK is treated as an EFT and not a payment originated by check. Payees must 

obtain the consumer’s authorization for each ECK transaction. A consumer authorizes a one-time 

EFT for an ECK transaction when the consumer receives notice that the transaction will or may be 

processed as an EFT and goes forward with the underlying transaction4 (Sections 205.3(b)(2)(i) and 

(ii) and Staff Commentary 205.3(b)(2)-3). 

Prior to December 31, 2009, a person using the check to initiate the EFT had to include a notice that 

funds may be withdrawn from the consumer’s account as soon as the same day payment is received, 

and, as applicable, that the consumer’s check will not be returned by the financial institution 

(Section 205.3(b)(2)(iii) and Appendix A-6). This requirement is no longer in effect.

If a payee re-presents electronically a check that has been returned unpaid, the transaction is not an 

EFT, and Regulation E does not apply because the transaction originated by check (Staff 

Commentary 205.3(c)(1)-1)). 

 4 For POS transactions, the notice must be posted in a prominent and conspicuous location and a copy of the notice must be provided 

to the consumer at the time of the transaction (Secs. 205.3(b)(2)(i) and (ii) and Staff Commentary 205.3(b)(2)-3). 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 8

However, Regulation E applies to a fee collected electronically from a consumer’s account for a 

check or EFT returned unpaid. A consumer authorizes a one-time EFT from the consumer’s account 

to pay the fee for the returned item or transfer if the person collecting the fee provides notice to the 

consumer stating the amount of the fee and that the person may electronically collect the fee, and 

the consumer goes forward with the underlying transaction5 (Section 205.3(b)(3))). These 

authorization requirements do not apply to fees imposed by the account-holding financial institution 

for returning the check or EFT or paying the amount of an overdraft (Staff Commentary 

205.3(b)(3)-1)).

II. Disclosures

Disclosures Generally - Section 205.4 

Required disclosures must be clear and readily understandable, in writing, and in a form the 

consumer may keep. The required disclosures may be provided to the consumer in electronic form, 

if the consumer affirmatively consents after receiving a notice that complies with the E-Sign Act 

(Section 205.4(a)(1)).

Disclosures may be made in a language other than English, if the disclosures are made available in 

English upon the consumer’s request (Section 205.4(a)(2)).

A financial institution has the option of disclosing additional information and combining disclosures 

required by other laws (for example, Truth in Lending disclosures) with Regulation E disclosures 

(Section 205.4(b)).

A financial institution may combine required disclosures into a single statement if a consumer holds 

two or more accounts at the financial institution. Thus, a single periodic statement or error 

resolution notice is sufficient for multiple accounts. In addition, it is only necessary for a financial 

institution to provide one set of disclosures for a joint account (Section 205.4(c)(l) and (2)).

Two or more financial institutions that jointly provide EFT services may contract among themselves 

to meet the requirements that the regulation imposes on any or all of them. When making initial 

disclosures (see Section 205.7) and disclosures of a change in terms or an error resolution notice 

(see Section 205.8), a financial institution in a shared system only needs to make disclosures that 

are within its knowledge and apply to its relationship with the consumer for whom it holds an 

account (Section 205.4(d)).

Initial Disclosure of Terms and Conditions - Section 205.7

Financial institutions must provide initial disclosures of the terms and conditions of EFT services 

before the first EFT is made or at the time the consumer contracts for an EFT service. They must 

give a summary of various consumer rights under the regulation, including the consumer’s liability 

for unauthorized EFTs, the types of EFTs the consumer may make, limits on the frequency or dollar 

 5 For POS transactions, the notice must be posted in a prominent and conspicuous location and a copy of the notice must either be 

provided to the consumer at the time of the transaction or mailed to the consumer’s address as soon as reasonably practicable after the 

person initiates the EFT to collect the fee (Sec. 205.3(b)(3)).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 9

amount, fees charged by the financial institution, and the error-resolution procedures. Appendix A 

to Part 205 provides model clauses that financial institutions may use to provide the disclosures.

Timing of Disclosures. Financial institutions must make the required disclosures at the time a 

consumer contracts for an electronic fund transfer service or before the first electronic fund transfer 

is made involving the consumer’s account (Section 205.7(a)).

Disclosures given by a financial institution earlier than the regulation requires (for example, when 

the consumer opens a checking account) need not be repeated when the consumer later authorizes 

an electronic check conversion or agrees with a third party to initiate preauthorized transfers to or 

from the consumer’s account, unless the terms and conditions differ from the previously disclosed 

term. This interpretation also applies to any notice provided about one-time EFTs from a 

consumer’s account initiated using information from the consumer’s check. On the other hand, if an 

agreement for EFT services to be provided by an account-holding financial institution is directly 

between the consumer and the account-holding financial institution, disclosures must be given in 

close proximity to the event requiring disclosure, for example, when the consumer contracts for a 

new service (Staff Commentary 205.7(a)-1).

Where a consumer authorizes a third party to debit or credit the consumer’s account, an accountholding financial institution that has not received advance notice of the transfer or transfers must 

provide the required disclosures as soon as reasonably possible after the first debit or credit is made, 

unless the financial institution has previously given the disclosures (Staff Commentary 205.7(a)-2).

If a consumer opens a new account permitting EFTs at a financial institution, and the consumer has 

already received Regulation E disclosures for another account at that financial institution, the 

financial institution need only disclose terms and conditions that differ from those previously given 

(Staff Commentary 205.7(a)-3).

If a financial institution joins an interchange or shared network system (which provides access to 

terminals operated by other financial institutions), disclosures are required for additional EFT 

services not previously available to consumers if the terms and conditions differ from those 

previously disclosed (Staff Commentary 205.7(a)-4).

A financial institution may provide disclosures covering all EFT services that it offers, even if some 

consumers have not arranged to use all services (Staff Commentary 205.7(a)-5).

Addition of EFT Services. A financial institution must make disclosures for any new EFT service 

added to a consumer’s account if the terms and conditions are different from those described in the 

initial disclosures. ECK transactions may be a new type of transfer requiring new disclosures (See 

Appendix A-2 and Staff Commentary 205.7(c)-1).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 10

Content of Disclosures. Section 205.7(b) requires a financial institution to provide the following 

disclosures as they apply: 

• Liability of consumers for unauthorized electronic fund transfers. The financial 

institution must include a summary of the consumer’s liability (under Section 205.6, state 

law, or other applicable law or agreement) for unauthorized transfers (Section 205.7(b)(1)). 

A financial institution does not need to provide the liability disclosures if it imposes no 

liability. If it later decides to impose liability, it must first provide the disclosures (Staff 

Commentary 205.7(b)(1)-1). The financial institution can choose to include advice on 

promptly reporting unauthorized transfers or the loss or theft of the access device (Staff 

Commentary 205.7(b)(1)-3).

• Telephone number and address. A financial institution must provide a specific telephone 

number and address, on or with the disclosure statement, for reporting a lost or stolen access 

device or a possible unauthorized transfer (Staff Commentary 205.7(b)(2)-2). Except for the 

telephone number and address for reporting a lost or stolen access device or a possible 

unauthorized transfer, the disclosure may insert a reference to a telephone number that is 

readily available to the consumer, such as “Call your branch office. The number is shown on 

your periodic statement.” (Staff Commentary 205.7(b)(2)-2). 

• Business days. The financial institution’s business days (Section 205.7(b)(3)).

• Types of transfers; limitations on frequency or dollar amount. Limitations on the 

frequency and dollar amount of transfers generally must be disclosed in detail (Section 

205.7(b)(4)). If the confidentiality of certain details is essential to the security of an account 

or system, these details may be withheld (but the fact that limitations exist must still be 

disclosed)6

A limitation on account activity that restricts the consumer’s ability to make 

EFTs must be disclosed even if the restriction also applies to transfers made by nonelectronic means.7

Financial institutions are not required to list preauthorized transfers

among the types of transfers that a consumer can make (Staff Commentary 205.7(b)(4)-3). 

Financial institutions must disclose the fact that one-time EFTs initiated using information 

from a consumer’s check are among the types of transfers that a consumer can make (See 

Appendix A-2 and Staff Commentary 205.7(b)(4)-4).

• Fees. A financial institution must disclose all fees for EFTs or for the right to make EFTs 

(Section 205.7(b)(5)). Other fees, for example, minimum-balance fees, stop-payment fees, 

account overdrafts, or ATM inquiry fees, may, but need not, be disclosed under Regulation 

E (see Regulation DD, 12 CFR Part 230) (Staff Commentary 205.7(b)(5)-1). A per-item fee 

for EFTs must be disclosed even if the same fee is imposed on non-electronic transfers. If a 

 6

For example, if a financial institution limits cash ATM withdrawals to $100 per day, the financial institution may disclose that daily 

withdrawal limitations apply and need not disclose that the limitations may not always be in force (such as during periods when its 

ATMs are off-line) (Staff Commentary 205.7(b)(4)-1).

7

For example, Regulation D (12 CFR 204) restricts the number of payments to third parties that may be made from a money market

deposit account; a financial institution that does not execute fund transfers in excess of those limits must disclose the restriction as a 

limitation on the frequency of EFTs (Staff Commentary 205.7(b)(4)-2). 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 11

per-item fee is imposed only under certain conditions, such as when the transactions in the 

cycle exceed a certain number, those conditions must be disclosed. Itemization of the 

various fees may be on the disclosure statement or on an accompanying document 

referenced in the statement (Staff Commentary 205.7(b)(5)-2). 

A financial institution must disclose that networks used to complete the EFT as well as an ATM 

operator, may charge a fee for an EFT or for balance inquiries (Section 205.7(b)(11)).

• Documentation. A summary of the consumer’s right to receipts and periodic statements, as 

provided in Section 205.9, and notices regarding preauthorized transfers as provided in 

Sections 205.10(a) and 205.10(d) (Section 205.7(b)(6)).

• Stop payment. A summary of the consumer’s right to stop payment of a preauthorized 

electronic fund transfer and the procedure for placing a stop-payment order, as provided in 

Section 205.10(c) (Section 205.7(b)(7)).

• Liability of institution. A summary of the financial institution’s liability to the consumer 

under Section 910 of the EFTA for failure to make or to stop certain transfers (Section 

205.7(b)(8)).

• Confidentiality. The circumstances under which, in the ordinary course of business, the 

financial institution may provide information concerning the consumer’s account to third 

parties (Section 205.7(b)(9)). A financial institution must describe the circumstances under 

which any information relating to an account to or from which EFTs are permitted will be 

made available to third parties, not just information concerning those EFTs. Third parties 

include other subsidiaries of the same holding company (Staff Commentary 205.7(b)(9)-1).

• Error Resolution. The error-resolution notice must be substantially similar to Model Form 

A-3 in Appendix A of Part 205. A financial institution may use different wording so long as 

the substance of the notice remains the same, may delete inapplicable provisions (for 

example, the requirement for written confirmation of an oral notification), and may 

substitute substantive state law requirements affording greater consumer protection than 

Regulation E (Staff Commentary 205.7(b)(10)-1). To take advantage of the longer time 

periods for resolving errors under Section 205.11(c)(3) (for new accounts as defined in 

Regulation CC, transfers initiated outside the United States, or transfers resulting from POS 

debit card transactions), a financial institution must have disclosed these longer time 

periods. Similarly, a financial institution relying on the exception from provisional crediting 

in Section 205.11(c)(2) for accounts relating to extensions of credit by securities brokers and 

dealers (Regulation T, 12 CFR Part 220) must disclose accordingly (Staff Commentary 

205.7(b)(10)-2).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 12

Change in Terms; Error Resolution Notice - Section 205.8 

If a financial institution contemplates a change in terms, it must mail or deliver a written or 

electronic notice to the consumer at least 21 days before the effective date of any change in a term 

or condition required to be disclosed under Section 205.7(b) if the change would result in any of the 

following: 

• Increased fees or charges;

• Increased liability for the consumer; 

• Fewer types of available EFTs; or

• Stricter limitations on the frequency or dollar amounts of transfers. (Section 205.8(a)(1)).

If an immediate change in terms or conditions is necessary to maintain or restore the security of an 

EFT system or account, the financial institution does not need to give prior notice. However, if the 

change is to be permanent, the financial institution must provide notice in writing of the change to 

the consumer on or with the next regularly scheduled periodic statement or within 30 days, unless 

disclosures would jeopardize the security of the system or account. (Section 205.8(a)(2)).

For accounts to or from which EFTs can be made, the financial institution must mail, deliver, or 

provide electronically to the consumer at least once each calendar year, the error resolution notice in 

12 CFR 205 Appendix A - Model Form A-3, or one substantially similar. Alternatively, the 

financial institution may include an abbreviated error resolution notice substantially similar to the 

notice set out in Appendix A (Model Form A-3) with each periodic statement (Section 205.8(b)).

Disclosures at Automated Teller Machines - Section 205.16

An ATM operator that charges a fee is required to post notice that a fee will be imposed and 

disclose the amount of the fee. (Section 205.16(b)). Notices must be posted both (1) in a prominent 

and conspicuous location on or at the machine, and (2) on the screen or on a paper notice before the 

consumer is committed to paying a fee (Section 205.16(c)(1) and (2)). The fee may be imposed by 

the ATM operator only if: (1) the consumer is provided the required notices, and (2) the consumer 

elects to continue the transaction (Section 205.16(e)).

The “prominent and conspicuous notice” standard applies to notice posted on or at the ATM. The 

“clear and readily understandable standard” applies to the content of the notice. The requirement 

that the notice be in a retainable format only applies to printed notices (not those on the ATM 

screen) (Section 205.16(c)).

These fee disclosures are not required where a network owner is not charging a fee directly to the 

consumer i.e., some network owners charge an interchange fee to financial institutions whose 

customers use the network) (Staff Commentary 205.7(b)(5)-3). If the network practices change 

such that the network charges the consumer directly, these fee disclosure requirements would apply 

to the network. (Section 205.7(c)).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 13

Overdraft Service Disclosures – Section 205.17

Disclosure requirements for overdraft services are addressed in Section III of this document. 

Gift Card Disclosures – Section 205.20(c)

Disclosures must be clear and conspicuous and generally in a written or electronic form (except for 

certain pre-purchase disclosures, which may be given orally) that the consumer may retain. The fees 

and terms and conditions of expiration that are required to be disclosed prior to purchase may not be 

changed after purchase.

A number of disclosures must be made on the actual card. Making such disclosures in an 

accompanying terms and conditions document, on packaging surrounding a certificate or card, or on 

a sticker or other label affixed to the certificate or card does not constitute a disclosure on the 

certificate or card. Those disclosures include the following:

• The existence, amount, and frequency of any dormancy, inactivity, or service fee;

• The expiration date for the underlying funds (or the fact that the funds do not expire);

• A toll-free telephone number and (if any) a website that the consumer may use to obtain a 

replacement certificate or card if the certificate or card expires while underlying funds are 

still available;

• A statement that the certificate or card expires, but the underlying funds do not expire or 

expire later than the certificate or card, as well as a statement that the consumer may 

contact the issuer for a replacement card;8 and

• A toll-free telephone number and (if any) a website that the consumer may use to obtain 

information about fees.

Additional Disclosure Requirements Regarding Fees. In addition to the disclosure requirements 

related to dormancy, inactivity, or service fees, all other fees must be disclosed as well. These 

disclosures must be provided on or with the certificate or card and disclosed prior to purchase. The 

certificate or card must also disclose a toll-free telephone number and website, if one is maintained, 

that a consumer may use to obtain fee information or replacement certificates or cards. (Section 

205.20(f))

 8 This requirement does not apply to non-reloadable certificates or cards that expire seven years or more after the date of 

manufacture.
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 14

Disclosure Requirements for Loyalty, Award, or Promotional Gift Cards (Section 205.20(a)(4))

To qualify for the exclusion for loyalty, award, or promotional gift cards, the following must be 

disclosed: 

• A statement indicating that the card, code, or other device is issued for loyalty, award, or 

promotional purposes, which must be included on the front of the card, code, or other 

device;

• The expiration date for the underlying funds, which must be included on the front of the 

card, code, or other device;

• The amount of any fees that may be imposed in connection with the card, code, or other 

device, and the conditions under which they may be imposed, which must be provided on or 

with the card, code, or other device; and

• A toll-free telephone number and, if one is maintained, a website, that a consumer may use 

to obtain fee information, which must be included on the card, code, or other device. 

Amendments to Regulation E were issued on August 11, 2010. The amendments implemented 

legislation that modified the effective date of certain disclosure and card expiration requirements in 

the gift card provisions of the Credit Card Accountability Responsibility and Disclosure Act of 

2009 for cards produced prior to April 1, 2010. 

The disclosures and card expiration requirements that may be delayed, until January 31, 2011, are:

1) Disclosures required to be made prior to purchase (see 205.20(c)(3));

2) Disclosures that must be stated on the certificate or card regarding the fees and expiration dates 

(see 205.20(d)(2), (e)(1) & (e)(3)); and 

3) Disclosures that may be provided on or with the certificate or card (see 205.20(f)).

Gift cards must comply with all other provisions of the gift card rule.

Issuers must make the following disclosures on in-store signs, messages during customer service 

calls, websites, and general advertising:

• The funds underlying the gift card do not expire;

• Consumers have the right to receive a free replacement card, along with the packaging and 

materials that typically accompany the gift card; and

• The issuer will charge dormancy, inactivity, or service fees only if the fee is permitted by 

the gift card rule.

The issuer must make the disclosures on in-store signs and via general advertising until January 31, 

2011, and via customer service call center and website disclosures until January 31, 2013.

See 205.20(h).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 15

III. Electronic Transaction Overdraft Services Opt In 

– Section 205.17

Background. In recent years overdraft protection services have been extended to cover overdrafts 

resulting from non-check transactions, including ATM withdrawals, debit card transactions at point 

of sale, on-line transactions, preauthorized transfers, and ACH transactions. Generally, institutions 

charge a flat fee each time an overdraft is paid, although some institutions have a tiered fee structure 

and charge higher fees based on the amount of the negative balance at the end of the day or as the 

number of overdrafts increases. Institutions commonly charge the same amount for paying check 

and ACH overdrafts as they would if they returned the item unpaid. Some institutions also impose a 

fee for each day the account remains overdrawn. For debit card overdrafts, the dollar amount of the 

fee and multiple assessments can exceed the dollar amount of the overdrafts.

In 2005, the agencies issued guidance concerning the marketing, disclosure, and implementation of 

overdraft programs. The guidance also covers safety and soundness considerations, and establishes 

a number of best practices financial institutions should incorporate into their overdraft programs. 

The 2009 revisions to Regulation E supersede portions of the guidance related to ATM and one 

time debit card overdraft transactions. However, in addition to the revised Regulation E 

requirements, institutions are again advised to incorporate their agency’s overdraft guidance into 

their overdraft protection programs.

Section 205.17 was added in the 2009 revision to Regulation E.9 It provides consumers with a 

choice to opt into their institution’s overdraft protection program and be charged a fee for overdrafts 

for ATM and one-time debit card transactions. It also requires disclosure of the fees and terms 

associated with the institution’s overdraft service. Before an institution may assess overdraft fees, 

the consumer must opt in, or affirmatively consent, to the overdraft service for ATM and one-time 

debit card transactions, and the consumer has an ongoing right to revoke consent. Institutions may 

not require an opt in for ATM and one-time debit transactions as a condition to the payment of 

overdrafts for checks and other transactions. The account terms, conditions and features must be the 

same for consumers who opt in and for those who do not. 

Opt-In Requirement for Overdraft Services. The financial institution may assess a fee for 

paying an ATM or one-time debit card transaction pursuant to an overdraft service only if it has met 

the following requirements:

• The financial institution has provided the consumer with a written (or, if the consumer 

agrees, electronic) notice, segregated from all other information, describing the overdraft 

service;

 9 74 FR 59033, Nov. 17, 2009; 75 FR 31665, June 4, 2010.
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 16

• The financial institution has provided a reasonable opportunity for the consumer to

affirmatively consent (opt in) to the overdraft service for ATM and one-time debit card 

transactions;

• The financial institution has obtained the consumer’s affirmative consent (opt in) for 

ATM and one-time debit card transactions; and

• The financial institution has mailed or delivered written (or, if the consumer agrees, 

electronic) confirmation of the consent, including a statement informing the consumer of 

the right to revoke consent. An institution complies if it adopts reasonable procedures to 

ensure that it assesses overdraft fees only for transactions paid after mailing or delivering 

the confirmation to the consumer. (Section 205.17(b)(1); Commentary 205.17(b)-7))

Fee Prohibitions. As a general rule, an institution may not charge overdraft fees for paying an 

ATM or one-time debit card transaction unless the consumer has opted in. The fee prohibition also 

applies to an institution that has a policy and practice of not paying an ATM or one-time debit card 

overdraft when it reasonably believes at the time of the authorization request that the consumer does 

not have sufficient funds available to pay the transaction, although the institution does not have to 

comply with the notice and opt-in requirements. (Commentary 205.17(b)-1(iv)) 

Lack of consent does not prohibit the financial institution from paying ATM or one-time debit card 

overdrafts. However, the financial institution may charge a fee only if the consumer has consented 

to the institution’s overdraft service for ATM and one-time debit card transactions. (Commentary 

205.17(b)-2) Conversely, the financial institution is not required to pay an ATM or one-time debit 

card overdraft even if the consumer has consented to pay a fee. (Commentary 205.17(b)-3)

For a consumer who has not opted in, if a fee or charge is based on the amount of the outstanding 

negative balance, an institution may not charge a fee for a negative balance that is solely attributable 

to an ATM or one-time debit card transaction. However, an institution may assess a fee if the

negative balance is attributable in whole or in part to a check, ACH transaction or other type of 

transaction not subject to the prohibition on assessing overdraft fees. (Commentary 205.17(b)-8) 

For a consumer who has not opted in, the institution may not assess daily or sustained negative 

balance, overdraft, or similar fees for a negative balance, based solely on ATM or one-time debit 

card transactions. However, if the negative balance is attributable in part to a check, ACH 

transaction or other type of transaction not subject to the prohibition on assessing overdraft fees, the 

institution may charge a daily or sustained overdraft or similar fee, even if the consumer has not 

opted in. The date the fee may be charged is based on the date on which the check, ACH, or other 

type of transaction is paid into overdraft. (Commentary 205.17(b)-9)
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 17

Contents and Format of Notice. The notice describing the overdraft service must be substantially 

similar to Model Form A-9. The notice must include all of the following items, and may not 

contain any other information not expressly specified or otherwise permitted:

• A brief description of the overdraft service and the types of transactions for which the 

financial institution may charge a fee;

• The dollar amount of any fee that may be charged for an ATM or one-time debit card 

transaction, including any daily or other overdraft fees;10

• The maximum number of fees that may be charged per day, or, if applicable, that there is 

no limit;

• An explanation of the right to affirmatively consent to the overdraft service, including the 

methods by which the consumer may consent;11 and

• The availability of a line of credit or a service that transfers funds from another account 

to cover overdrafts, if the financial institution offers those alternatives.12 (Section 

205.17(d)(1) through (d)(5))

The financial institution also may (but is not required to) include the following information, to the 

extent applicable:

• Disclosure of the right to opt into, or out of, the payment of overdrafts for other types of 

transactions (e.g., checks, ACH transactions, or automatic bill payments) and a means for 

the consumer to exercise such choices;

• Disclosure of the financial institution’s returned item fee, as well as the fact that 

merchants may charge additional fees; and

• Disclosure of the right to revoke consent. (Section 205.17(d)(6))

Reasonable opportunity to consent. The financial institution must provide a reasonable 

opportunity to consent. Reasonable methods of consent include mail - if the financial institution 

provides a form for the consumer to fill out and mail, telephone - if the financial institution 

 10 If the amount of the fee may vary based on the number of times the consumer has overdrawn the account, the amount of the 

overdraft, or other factors, the financial institution must disclose the maximum fee.

11 Institutions may tailor the response portion of Model Form A-9 to the methods offered. For example, a tear-off portion of Model 

Form A-9 is not necessary if consumers may only opt-in by telephone or electronically. (Commentary 205.17(d)-3).

12If the institution offers both a line of credit subject to the Board’s Regulation Z (12 CFR part 226) and a service that transfers funds from another 

account of the consumer held at the institution to cover overdrafts, the institution must state in its opt-in notice that both alternative plans are offered. 

If the institution offers one, but not the other, it must state in its opt-in notice the alternative plan that it offers. If the institution does not offer either 

plan, it should omit the reference to the alternative plans. (Commentary 205.17(d)-5). If the financial institution offers additional alternatives for 

paying overdrafts, it may (but is not required to) disclose those alternatives. § 205.17(d)(5).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 18

provides a readily-available telephone line that the consumer may call, electronic means - if the 

financial institution provides a form that can be accessed and processed at its website, where the 

consumer may click on a box to consent and click on a button to affirm consent, or in person - if the 

financial institution provides a form for the consumer to complete and present at a branch or office. 

(Commentary 205.17(b)-4) The financial institution may provide the opportunity to consent and 

require the consumer to make a choice as a step to opening an account. (Commentary 205.17(b)-5)

Affirmative consent is necessary. An important feature of the opt in is that the consumer’s 

affirmative consent is necessary before the institution may charge overdraft fees for paying an ATM 

or one-time debit card transaction. (205.17(b)(iii)) The consent must be separate from other 

consents or acknowledgments (including a consent to receive disclosures electronically). Check 

boxes are allowed, but the check box and the consumer’s signature may only apply to the 

consumer’s consent to opt in. Preprinted disclosures about the overdraft service provided with a 

signature card or contract do not constitute affirmative consent. (Commentary 205.17(b)-6) 

Confirmation and consumer’s right to revoke. Not only must the consumer affirmatively 

consent, but the institution must mail or deliver to the consumer a written confirmation (or 

electronic, if the consumer agrees) that the consumer has consented, along with a statement 

informing the consumer of the right to revoke the consent at any time. (205.17(b)(iv) and 

Commentary 205.17(b)-7) An institution complies with the confirmation requirement if it has 

adopted reasonable procedures to ensure that overdraft fees are assessed only on transactions paid 

after the confirmation is mailed or delivered to the consumer. (Commentary 205.17(b)-7))

Assessing fees. For consumers who have not opted in, institutions are prohibited from charging 

overdraft fees for paying those transactions. This prohibition applies to daily or sustained overdraft, 

negative balance, or similar fees. However, the rule does not prohibit an institution from assessing 

these fees if the negative balance is attributable, in whole or part, to a check, ACH or other 

transaction not subject to the fee prohibition. However, if the negative balance is attributable in part 

to an ATM transaction, for example, and in part to a check, a fee may be assessed based on the date 

when the check is paid into overdraft, not the date of the ATM or one-time debit transaction.

Conditioning payment of other overdrafts. The financial institution may not condition the 

payment of other types of overdraft transactions on the consumer’s affirmative consent, and the 

financial institution may not decline to pay other types of overdraft transactions because the 

consumer has not affirmatively consented to the payment of ATM and one-time debit card 

overdrafts. (Section 205.17(b)(2)) In other words, the financial institution may not use different 

criteria for paying other types of overdraft transactions for consumers who have consented and for 

consumers who have not consented. (Commentary 205.17(b)(2)-1)
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 19

Same account terms, conditions, and features. In addition, the financial institution must provide 

to consumers who do not affirmatively consent the same account terms, conditions, and features 

(except the payment of ATM and one-time debit overdrafts) that are available to consumers who do 

affirmatively consent. (Section 205.17(b)(3)) That requirement includes, but is not limited to:

• Interest rates paid;

• Fees assessed;

• The type of ATM or debit card provided to the depositor;13

• Minimum balance requirements; and

• On-line bill payment services. (Commentary 205.17(b)(3)-1)

Joint Accounts. Any consumer may consent, or revoke consent, for payment of ATM or one-time 

debit card transactions from a joint account. (Section 205.17(e))

Continuing Right to Consent or Revoke. A consumer may consent to the payment of ATM and 

one-time debit card overdrafts at any time. A consumer may also revoke consent at any time. The 

financial institution must implement a revocation as soon as reasonably practicable. (Section 

205.17(f)) The financial institution need not waive overdraft fees assessed before it implements the 

consumer’s revocation. (Commentary 205.17(f)-1)

Duration of Consent. Consent remains effective until the consumer revokes it, unless the financial 

institution terminates the overdraft service. (Section 205.17(g)) The financial institution may 

terminate the overdraft service, for example, if the consumer makes excessive use of the service. 

(Commentary 205.17(g)-1)

Effective Date. The overdraft services rule became effective on January 19, 2010, and compliance 

is mandatory on July 1, 2010. For accounts opened on or after July 1, 2010, the financial institution 

must obtain consent before charging a fee for payment of any ATM or one-time debit overdraft. 

However, for accounts opened before July 1, 2010, the financial institution may not charge a fee for 

paying any ATM or one-time debit overdraft on or after August 15, 2010, unless it has obtained 

consent. (See Section 205.17(c))

 13For example, the financial institution may not provide a PIN-only debit card to consumers who do not opt in, and a debit card with 

both PIN and signature-debit features to consumers who do opt in.
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 20

IV. Issuance of Access Devices - Sections 205.5 and 

205.18 

In general, a financial institution may issue an access device to a consumer only in the following 

cases:

• The consumer requested it in writing or orally.14

• It is a renewal of, or a substitute for, an accepted access device (as defined in Section 

205.2(a)). (Section 205.5(a)).

Only one renewal or substitute device may replace a previously issued device. A financial 

institution may provide additional devices at the time it issues the renewal or substitute access 

device provided the institution complies with the requirements for issuing unsolicited access 

devices for the additional devices (Staff Commentaries 205.5(a)(2)-1 and 205.5(b)-5).

A financial institution may issue an unsolicited access device only if the access device meets all of 

the following criteria. The access device is:

• Not validated - that is, it cannot be used to initiate an EFT. 

• Accompanied by the explanation that it is not validated and how the consumer may dispose 

of it if the consumer does not wish to validate it.

• Accompanied by a complete disclosure, in accordance with Section 205.7, of the consumer’s 

rights and liabilities that will apply if the access device is validated.

• Validated only upon oral or written request from the consumer and after a verification of the 

consumer’s identity by some reasonable means (Section 205.5(b)).

The financial institution may use any reasonable means of verifying the consumer’s identity, but 

the consumer is not liable for any unauthorized transfers if an imposter succeeds in validating the 

access device (Staff Commentary 205.5(b)-4).

Payroll Card Access Devices. Consistent with Section 205.5(a), a financial institution may issue a 

payroll card access device only in response to an oral or written request for the device or as a 

renewal or substitute for an accepted access device. A consumer is deemed to request an access 

device for a payroll account when the consumer chooses to receive salary or other compensation 

through a payroll card account (Staff Commentary 205.18(a)-1).

EFT added to credit card. The EFTA and Regulation E apply when the capability to initiate EFTs 

is added to an accepted credit card (as defined under Regulation Z). The EFTA and Regulation E 

also apply to the issuance of an access device that permits credit extensions under a preexisting 

 14For a joint account, a financial institution may issue an access device to each account holder for whom the requesting holder 

specifically requests an access device (Staff Commentary 205.5(a)(1)-1). 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 21

agreement between the consumer and a financial institution to extend credit only to cover overdrafts 

(or to maintain a specified minimum balance). The Truth in Lending Act and Regulation Z govern 

the addition of a credit feature to an accepted access device, and except as discussed above, the 

issuance of a credit card that is also an access device. For information on Regulation E’s 

relationship to other laws, including Truth in Lending, see Section 205.12. 

V. Consumer Liability and Error Resolution

Liability of Consumers for Unauthorized Transfers - Section 

205.6 

A consumer may be liable for an unauthorized EFT (defined in Section 205.2(m)) depending on 

when the consumer notifies the financial institution and whether an access device was used to 

conduct the transaction. Under the EFTA, there is no bright-line time limit within which consumers 

must report unauthorized EFTs (71 Fed. Reg. 1638, 1653 (Jan. 10, 2006)).

The extent of the consumer’s liability is determined solely by the consumer’s promptness in 

notifying the financial institution (Staff Commentary 205.6(b)-3). Other factors may not be used as 

a basis to hold consumers liable. Regulation E expressly prohibits the following factors as the basis 

for imposing greater liability than is permissible under Regulation E: the consumer was negligent 

(e.g., wrote a PIN on an ATM card); an agreement between the consumer and the financial 

institution provides for greater liability; or the consumer is liable for a greater amount under state 

law (Staff Commentaries 205.6(b)-2 and 205.6(b)-3). 

A consumer may only be held liable for an unauthorized transaction, within the limitations set forth 

in Section 205.6(b), if:

• The financial institution has provided all of the following written disclosures to the 

consumer: 

 A summary of the consumer’s liability for unauthorized EFTs. 

 The telephone number and address for reporting that an unauthorized EFT has been or 

may be made. 

 The financial institution’s business days.

• Any access device used to affect the EFT was an accepted access device (as defined in 

Section 205.2(a)). 

• The financial institution has provided a means to identify the consumer to whom the access 

device was issued (Section 205.6(a)).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 22

Regulation E allows, but does not require, the financial institution to provide a separate means to 

identify each consumer of a multiple-user account (Staff Commentary 205.6(a)-2).

The limitations on the amount of consumer liability for unauthorized EFTs, the time limits within 

which consumers must report unauthorized EFTs, and the liability for failing to adhere to those time 

limits, are listed in the chart below. The financial institution may impose less consumer liability 

than is provided by Section 205.6 based on state law or the deposit agreement (Section 205.6(b)(6)).

Consumer Liability for Unauthorized Transfers: 

Electronic Fund Transfer Act - Regulation E (12 CFR 205.6)

Event Timing of Consumer 

Notice to Financial Institution

Maximum liability

Loss or theft of access 

device15 Within two business days after learning 

of loss or theft

Lesser of $50, OR total amount of 

unauthorized transfers.

Loss or theft of access 

device

More than two business days after 

learning of loss or theft up to 60 calendar 

days after transmittal of statement 

showing first unauthorized transfer made 

with access device.

Lesser of $500, OR the sum of:

(a) $50 or the total amount of unauthorized 

transfers occurring in the first two 

business days, whichever is less, AND 

(b) The amount of unauthorized transfers 

occurring after two business days and 

before notice to the financial institution.16

Loss or theft of access 

device

More than 60 calendar days after 

transmittal of statement showing first 

unauthorized transfer made with access 

device.

For transfers occurring within the 60-day 

period, the lesser of $500, OR the sum of 

(a) Lesser of $50 or the amount of 

unauthorized transfers in first two 

business days, AND

(b) The amount of unauthorized transfers 

occurring after two business days.

For transfers occurring after the 60-day period, 

unlimited liability (until the financial institution 

is notified)17

Unauthorized transfer(s) 

not involving loss or theft 

of an access device

Within 60 calendar days after transmittal 

of the periodic statement on which the 

unauthorized transfer first appears.

No liability.

Unauthorized transfer(s) 

not involving loss or theft 

of an access device

More than 60 calendar days after 

transmittal of the periodic statement on 

which the unauthorized transfer first 

appears.

Unlimited liability for unauthorized transfers 

occurring 60 calendar days after the periodic 

statement and before notice to the financial 

institution.

 15Includes a personal identification number (PIN) if used without a card in a telephone transaction, for example.

16 Provided the financial institution demonstrates that these transfers would not have occurred had notice been given within the twobusiness-day period.

17 Provided the financial institution demonstrates that these transfers would not have occurred had notice been given within the 60-

day period.
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 23

Knowledge of Loss or Theft. The fact that a consumer has received a periodic statement reflecting 

an unauthorized transaction is a factor, but not conclusive evidence, in determining whether the 

consumer had knowledge of a loss or theft of the access device (Staff Commentary 205.6(b)(1)-2).

Timing of Notice. If a consumer’s delay in notifying a financial institution was due to extenuating 

circumstances, such as extended travel or hospitalization, the time periods for notification specified 

above must be extended to a reasonable time (Section 205.6(b)(4); Staff Commentary 205.6(b)(4)-

1).

Notice to the Financial Institution. A consumer gives notice to a financial institution about 

unauthorized use when the consumer takes reasonable steps to provide the financial institution with 

the pertinent information, whether or not a particular employee actually receives the information 

(Section 205.6(b)(5)(i)). Even if the consumer is unable to provide the account number or the card 

number, the notice effectively limits the consumer’s liability if the consumer sufficiently identifies 

the account in question, for example, by giving the name on the account and the type of account 

(Staff Commentary 205.6(b)(5)-3). At the consumer’s option, notice may be given in person, by 

telephone, or in writing (Section 205.6(b)(5)(ii)). Notice in writing is considered given at the time 

the consumer mails the notice or delivers the notice for transmission by any other usual means to 

the financial institution. Notice may also be considered given when the financial institution 

becomes aware of circumstances leading to the reasonable belief that an unauthorized transfer has 

been or may be made (Section 205.6(b)(5)(iii)).

Relation of Error Resolution to Truth in Lending. Regulation E’s liability and error resolution 

provisions apply to an extension of credit that occurs under an agreement between the consumer and 

a financial institution to extend credit when the consumer’s account is overdrawn, to maintain a 

specified minimum balance in the consumer’s account, or under an overdraft service (Section 

205.12(a)(1)(ii)). As provided in Section 205.12 and related commentary, for transactions involving 

access devices that also function as credit cards, the liability and error resolution provisions of 

Regulation E or Regulation Z will apply depending on the nature of the transaction: 

• If the unauthorized use of a combined access device-credit card solely involves an extension 

of credit, other than an extension of credit described under Section 205.12(a)(1)(iii), and 

does not involve an EFT, for example, when the card is used to draw cash advances directly 

from a credit line, only the error resolution provisions of Regulation Z will apply. 

• If the unauthorized use of a combined access device-credit card involves only an EFT, for 

example, debit card purchases or cash withdrawals at an ATM from a checking account, 

only the error resolution provisions of Regulation E will apply. 

• If a combined access device-credit card is stolen and unauthorized transactions are made by 

using the card as both a debit card and a credit card, Regulation E will apply to the 

unauthorized transactions in which the card was used as a debit card, and Regulation Z will 

apply to the unauthorized transactions in which the card was used as a credit card. 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 24

Procedures for Resolving Errors - Section 205.11 

This section defines the term error and describes the steps the consumer must take when asserting 

an error in order to receive the protection of the EFTA and Regulation E, and the procedures that a 

financial institution must follow to resolve an alleged error. 

An error includes any of the following: 

• An unauthorized EFT. 

• An incorrect EFT to or from the consumer’s account.

• The omission from a periodic statement of an EFT to or from the consumer’s account that 

should have been included. 

• A computational or bookkeeping error made by the financial institution relating to an EFT. 

• The consumer’s receipt of an incorrect amount of money from an electronic terminal; 

• An EFT not identified in accordance with the requirements of Sections 205.9 or 205.10(a). 

• A consumer’s request for any documentation required by Sections 205.9 or 205.10(a) or for 

additional information or clarification concerning an EFT (Section 205.11(a)(1)).

The term error does not include:

• A routine inquiry about the balance in the consumer’s account or a request for duplicate 

copies of documentation or other information that is made only for tax or other recordkeeping purposes (Sections 205.11(a)(2)(i), (ii), and (iii)).

• The fact that a financial institution does not make a terminal receipt available for a transfer 

of $15 or less in accordance with 205.9(e) (Staff Commentary 205.11(a)-6).

A financial institution must comply with the error resolution procedures in Section 205.11 with 

respect to any oral or written notice of error from the consumer that:

• The financial institution receives not later than 60 days after sending a periodic statement or 

other documentation first reflecting the alleged error (see 205.14 and 205.18).

• Enables the financial institution to identify the consumer’s name and account number.

• Indicates why the consumer believes the error exists and, to the extent possible, the type, 

date, and amount of the error (Section 205.11(b)(1)).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 25

A financial institution may require a consumer to give written confirmation of an error within 10 

business days of giving oral notice. The financial institution must provide the address where 

confirmation must be sent (Section 205.11(b)(2)). 

Error Resolution Procedures. After receiving a notice of error, the financial institution must do all 

of the following:

• Promptly investigate the oral or written allegation of error.

• Complete its investigation within 10 business days (Section 205.11(c)(1)). 

• Report the results of its investigation within three business days after completing its 

investigation. 

• Correct the error within one business day after determining that an error has occurred. 

The financial institution may take up to 45 calendar days (Section 205.11(c)(2)) to complete its 

investigation provided it: 

• Provisionally credits the funds (including interest, where applicable) to the consumer’s 

account within the 10 business-day period. 

• Advises the consumer within 2 business days of the provisional crediting. 

• Gives the consumer full use of the funds during the investigation. 

A financial institution need not provisionally credit the account to take up to 45 calendar days to 

complete its investigation if the consumer fails to provide the required written confirmation of an 

oral notice of error, or if the notice of error involves an account subject to the margin requirements 

or other aspects of Regulation T (Securities Credit by Brokers and Dealers, 12 CFR part 220) 

(Section 205.11(c)(2)(i)(B)).

However, where an error involves an unauthorized EFT, the financial institution must comply with 

the requirements of the provisions relating to unauthorized EFTs before holding the consumer 

liable, even if the consumer does not provide a notice of error within the time limits in Section 

205.11(b) (Staff Commentary 205.11(b)(1)-7).

When investigating a claim of error, the financial institution need only review its own records if the 

alleged error concerns a transfer to or from a third party, and there is no agreement between the 

financial institution and the third party for the type of EFT involved (Section 205.11(c)(4)). 

However, the financial institution may not limit its investigation solely to the payment instructions 

where other information within the financial institution’s records pertaining to a particular account 

may help to resolve a consumer’s claim (Staff Commentary 205.11(c)(4)-5).

If, after investigating the alleged error, the financial institution determines that an error has 

occurred, it must promptly (within one business day after such determination) correct the error, 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 26

including the crediting of interest if applicable. The financial institution must provide within three 

business days of the completed investigation an oral or written report of the correction to the 

consumer and, as applicable, notify the consumer that the provisional credit has been made final 

(Section 205.11(c)(2)(iii) and (iv)).

If the financial institution determines that no error occurred or that an error occurred in a different 

manner or amount from that described by the consumer, the financial institution must mail or 

deliver a written explanation of its findings within three business days after concluding its 

investigation. The explanation must include a notice of the consumer’s rights to request the 

documents upon which the financial institution relied in making its determination (Section 

205.11(d)).

Upon debiting a provisionally credited amount, the financial institution must notify the consumer of 

the date and amount of the debit and of the fact that the financial institution will honor (without 

charge) checks, drafts, or similar paper instruments payable to third parties and preauthorized debits 

for five business days after transmittal of the notice. The financial institution need honor only items 

that it would have paid if the provisionally credited funds had not been debited. Upon request from 

the consumer, the financial institution must promptly mail or deliver to the consumer copies of 

documents upon which it relied in making its determination (Section 205.11(d)(2)).

If a notice involves an error that occurred within 30 days after the first deposit to the account was 

made, the time periods are extended from 10 and 45 days, to 20 and 90 days, respectively. If the 

notice of error involves a transaction that was not initiated in a state or resulted from a point-of-sale 

debit card transaction, the 45-day period is extended to 90 days (Section 205.11(c)(3)).

If a financial institution has fully complied with the investigation requirements, it generally does not 

need to reinvestigate if a consumer later reasserts the same error. However, it must investigate a 

claim of error asserted by a consumer following receipt of information provided pursuant to Section 

205.11(a)(1)(vii) (Section 205.11(e)).

VI. Receipts and Periodic Statements 

Documentation of Transfers – Section 205.9

Electronic terminal receipts. Receipts must be made available at the time a consumer initiates an 

EFT at an electronic terminal. (Section 205.9(a)). Financial institutions may provide receipts only 

to consumers who request one (Staff Commentary 205.9(a)-1). The receipt must include, as 

applicable:

• Amount of the transfer – a charge for making the transfer may be included in the amount, 

provided the charge is disclosed on the receipt and on a sign posted on or at the terminal. 

• Date – the date the consumer initiates the transfer.

• Type of transfer and type of account – descriptions such as “withdrawal from checking” or 

“transfer from savings to checking” are appropriate. This is true even if the accounts are 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 27

only similar in function to a checking account (such as a share draft or NOW account) or a 

savings account (such as a share account). If the access device used can only access one 

account, the type of account may be omitted (Staff Commentaries 205.9(a)(3)-1; 205.9(3)-2; 

205.9(3)-4; and 205.9(3)-5). 

• Number or code identifying the consumer’s account(s) or the access device used to initiate 

the transfer – the number and code need not exceed four digits or letters.

• Location of the terminal – The location of the terminal where the transfer is initiated or an 

identification, such as a code or terminal number. If the location is disclosed, except in 

limited circumstances where all terminals are located in the same city or state, the receipt 

must include the city and state or foreign country and one of the following: 

 Street address of the terminal; 

 Generally accepted name for the location of the terminal (such as an airport, shopping 

center, or branch of a financial institution); or

 Name of the entity (if other than the financial institution providing the statement) at 

whose place of business the terminal is located, such as a store, and the city, state, or 

foreign country (Section 205.9(a)(5)).

Third party - Name of any third party to or from whom funds are transferred – a code may be used 

to identify the party if the code is explained on the receipt. This requirement does not apply if the 

name of the party is provided by the consumer in a manner the terminal cannot duplicate on the 

receipt, such as on a payment stub (Section 205.9(a)(6) and Staff Commentary 205.9(a)(6)-1).

Receipts are not required for electronic EFTs of $15 or less (Section 205.9(e)).

Periodic statements. Periodic statements must be sent for each monthly cycle in which an EFT has 

occurred, and at least quarterly if no EFT has occurred (Section 205.9(b)). For each EFT made 

during the cycle, the statement must include, as applicable: 

• Amount of the transfer - if a charge was imposed at an electronic terminal by the owner or 

operator of the terminal, that charge may be included in the amount.

• Date the transfer was posted to the account.

• Type of transfer(s) and type of account(s) to or from which funds were transferred.

• For each transfer (except deposits of cash, or a check , draft or similar paper instrument to 

the consumer’s account) initiated at an electronic terminal, the terminal location as required 

for the receipt under Section 205.9(a)(5). 

• Name of any third party payee or payor.
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 28

• Account number(s). 

• Total amount of any fees and charges, other than a finance charge as defined by Regulation 

Z, assessed during the period for making EFTs, the right to make EFTs, or for account 

maintenance. 

• Balance in the account at the beginning and close of the statement period. 

• Address and telephone number to be used by the consumer for inquiries or notice of errors. 

If the financial institution has elected to send the abbreviated error notice with every 

periodic statement, the address and telephone number may appear on that document.

• If the financial institution has provided a telephone number which the consumer can use to 

find out whether or not a preauthorized transfer has taken place, that telephone number. 

Exceptions to the Periodic Statement Requirement for Certain Accounts. 

Passbook accounts. Where a consumer’s passbook may not be accessed by an EFT other than 

preauthorized transfers to the account, a periodic statement need not be sent, provided that the 

financial institution updates the consumer’s passbook or provides the required information on a 

separate document at the consumer’s request. To update the passbook, the amount and date of each 

EFT made since the passbook was last presented must be listed (Section 205.9(c)(1)(i)). For other 

accounts that may be accessed only by preauthorized transfers to the account, the financial 

institution must send a periodic statement at least quarterly (Section 205.9(c)(1)(ii)). 

Transfers between accounts. If a transfer occurs between two accounts of the consumer at the 

same financial institution, the transfer need only be documented for one of the two accounts 

(Section 205.9(c)(2)). A preauthorized transfer between two accounts of the consumer at the same 

financial institution is subject to the Section 205.9(c)(1) rule on preauthorized transfers and not the 

Section 205.9(c)(2) rule on intra-institutional transfers (Section 205.9(c)(3)).

Documentation for Foreign-initiated transfers. If an EFT is initiated outside the United States, 

the financial institution need not provide a receipt or a periodic statement reflecting the transfer if it 

treats an inquiry for clarification or documentation as a notice of error (Section 205.9(d)). 

Alternatives to Periodic Statements for Financial Institutions Offering Payroll 

Card Accounts - Section 205.18

This section provides an alternative to providing periodic statements for payroll card accounts if 

financial institutions make the account information available to consumers by specific means. In 

addition, this section clarifies how financial institutions that do not provide periodic statements for 

payroll card accounts can comply with the Regulation E requirements relating to initial disclosures, 

the annual error resolution notice, liability limits, and the error resolution procedures.

Typically, employers and third-party service providers do not meet the definition of a “financial 

institution” subject to the regulation because they neither (i) hold payroll card accounts nor (ii) issue 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 29

payroll cards and agree with consumers to provide EFT services in connection with payroll card 

accounts. However, to the extent an employer or a service provider undertakes either of these 

functions, it would be deemed a financial institution under the regulation (Staff Commentary 

205.18(a)-2).

Alternative to Periodic Statements. A financial institution does not need to furnish periodic 

statements required by Section 205.9(b) if the financial institution makes available to the consumer 

the following:

• The account balance, through a readily available telephone line.

• An electronic history of account transactions covering at least 60 days preceding the date the 

consumer electronically accesses the account.

• A written history of the account transactions provided promptly in response to an oral or 

written request and covering at least 60 days preceding the date the financial institution 

receives the consumer’s request (Section 205.18(b)(1)).

The history of account transactions must include the same type of information required on periodic 

statements under Section 205.9(b) (Section 205.18(b)(2)).

Requirements to Comply with Regulation E. If a financial institution provides an alternative to 

periodic statements under Section 205.18(b), it must comply with the following:

• Modify the initial disclosures under 205.7(b) by disclosing:

 A telephone number that the consumer may call to obtain the account balance; the means 

by which the consumer can obtain an electronic account history, such as the address of 

an Internet website; and a summary of the consumer’s right to receive a written account 

history upon request (in place of the summary of the right to receive a periodic statement 

required by Section 205.7(b)(6)), including a telephone number to call to request a 

history. The disclosure required by Section 205.18(c)(1)(i) may be made by providing a

notice substantially similar to the notice contained in paragraph A-7(a) in Appendix A of 

Part 205.

 A notice concerning error resolution that is substantially similar to the notice contained 

in paragraph A-7(b) in Appendix A, in place of the notice required by Section 

205.7(b)(10).

• Provide an annual error resolution notice that is substantially similar to the notice contained 

in paragraph (b) to A-7 - Model Clauses for Financial Institutions Offering Payroll Card 

Accounts in Appendix A of Part 205, in place of the notice required by Section 205.8(b). 

Alternatively, a financial institution may include on or with each electronic and written 

history provided in accordance with Section 205.18(b)(1), a notice substantially similar to 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 30

the abbreviated notice for periodic statements contained in paragraph A-3(b) in Appendix A, 

modified as necessary to reflect the error-resolution provisions set forth in this section.

• Limits on consumer liability.

 For purposes of Section 205.6(b)(3), the 60-day period for reporting any unauthorized 

transfer begins on the earlier of: 

⇒ The date the consumer electronically accesses the consumer’s account under Section 

205.18(b)(1)(ii), provided that the electronic history made available to the consumer 

reflects the transfer; or

⇒ The date the financial institution sends a written history of the consumer’s account 

transactions requested by the consumer under Section 205.18(b)(1)(iii) in which the 

unauthorized transfer is first reflected.

 A financial institution may limit the consumer’s liability for an unauthorized transfer as 

provided under Section 205.6(b)(3) for transfers reported by the consumer within 120 

days after the transfer was credited or debited to the consumer’s account.

• Comply with error resolution requirements.

 An error notice is considered timely, and the financial institution must comply with the 

requirements of Section 205.11, if the financial institution receives notice from the 

consumer no later than the earlier of:

⇒ 60 days after the date the consumer electronically accesses the consumer’s account 

under Section 205.18(b)(1)(ii), provided that the electronic history made available to 

the consumer reflects the alleged error; or

⇒ 60 days after the date the financial institution sends a written history of the 

consumer’s account transactions requested by the consumer under Section 

205.18(b)(1)(iii) in which the alleged error is first reflected.

 Alternatively, a financial institution complies with the error resolution requirements in 

Section 205.11 if it investigates any oral or written notice of an error from the consumer 

that is received by the financial institution within 120 days after the transfer allegedly in 

error was credited or debited to the consumer’s account.

VII. Gift Cards – Section 205.20

Background

A gift card is a type of prepaid card that is designed to be purchased by one consumer and given to 

another consumer as a present or expression of appreciation or recognition. When provided in the 

form of a plastic card, a user of a gift card is able to access and spend the value associated with the 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 31

device by swiping the card at a POS terminal, much as a person would use a debit card. There are 

two distinct types of gift cards: closed-loop cards and open-loop cards. Closed-loop gift cards 

constitute the majority of the gift card market, are typically issued by a merchant, not by a financial 

institution, and generally can only be used to make purchases at the merchant or group of 

merchants. Open-loop gift cards are generally issued by financial institutions, typically carry a card 

network brand logo, can be used at a wide variety of merchants and are more likely to carry fees 

compared to closed-loop gift cards, including card issuance and transaction-based fees. Openloop gift cards are more likely to offer the capability of being reloaded with additional value 

(reloadable) than are closed-loop gift cards.

Concerns have been raised regarding the amount of fees associated with gift cards, the expiration 

dates of gift cards, and the adequacy of disclosures. Consumers who do not use the value of the card 

within a short period of time may be surprised to find that the card has expired or that dormancy or 

service fees have reduced the value of the card. Even where fees or terms are disclosed on or with 

the card, the disclosures may not be clear and conspicuous. This rule contains restrictions on 

dormancy, inactivity and service fees and expiration dates.

Scope of the gift card rule The rule is generally limited to gift certificates, store gift cards, or 

general-use prepaid cards sold or issued to consumers primarily for personal, family, or household 

purposes. It generally does not apply to cards, codes, or other devices that are reloadable and not 

marketed or labeled as a gift card or gift certificate and loyalty, award, and promotional gift cards. 

See also the exclusions from the gift card definitions, described above. 

Restrictions on Dormancy, Inactivity, or Service Fees (Section 205.20(d))

No person may impose a dormancy, inactivity, or service fee with respect to a gift certificate, store 

gift card, or general-use prepaid card, unless three conditions are satisfied:

• There has been no activity with respect to the certificate or card within the one-year 

period prior to the imposition of the fee; 

• Only one such fee is assessed in a given calendar month; and

• Disclosures regarding dormancy, inactivity, or service fees are clearly and conspicuously 

stated on the certificate or card, and the person issuing or selling the certificate or card 

has provided these disclosures to the purchaser before the certificate or card is 

purchased. See the disclosure section, above, for additional information.

Expiration Date Restrictions (Section 205.20(e)) A gift certificate, store gift card, or general-use 

prepaid card may not be sold or issued unless the expiration date of the funds underlying the 

certificate or card is no less than five years after the date of issuance (in the case of a gift certificate) 

or five years after the date of last load of funds (in the case of a store gift card or general-use 

prepaid card). In addition, information regarding whether funds underlying a certificate or card may 

expire must be clearly and conspicuously stated on the certificate or card and disclosed prior to 

purchase.
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 32

No person may sell or issue a certificate or card with an expiration date unless the person has 

established policies and procedures to provide consumers with a reasonable opportunity to purchase 

a certificate or card that has an expiration date that is at least five years from the date of purchase. A 

person who has established policies and procedures to prevent the sale of a certificate or card with 

less than five years from the date of purchase satisfies this requirement.

A certificate or card generally must include a disclosure alerting consumers to the difference 

between the certificate or card expiration date and the funds expiration date, if any, and that the 

consumer may contact the issuer for a replacement card. This disclosure must be stated with equal 

prominence and in close proximity to the certificate or card expiration date. Non-reloadable 

certificates or cards that bear an expiration date on the certificate or card that is at least seven years 

from the date of manufacture need not include this disclosure. See the disclosure section, above, for 

additional information.

To ensure that consumers are able to access the underlying funds for the full five-year period, fees 

may not be imposed for replacing an expired certificate or card if the underlying funds remain valid 

(unless the card has been lost or stolen). In lieu of sending a replacement certificate or card, issuers 

may remit, without charge, the remaining balance of funds to the consumer.

Effective Date. The requirements of this section apply to any gift certificate, store gift card, or 

general-use prepaid card sold to a consumer on or after August 22, 2010, or provided to the 

consumer as a replacement for such certificate or card.18

VIII. Other Requirements

Preauthorized Transfers - Section 205.10 

A preauthorized transfer may be either a credit to, or a debit from, an account. 

Preauthorized transfers to a consumer’s account. When an account is scheduled to be credited 

by a preauthorized EFT from the same payor at least once every 60 days, the financial institution 

must provide some form of notice to the consumer so that the consumer can find out whether or not 

the transfer occurred (Section 205.10(a)). The notice requirement will be satisfied if the payor 

provides notice to the consumer that the transfer has been initiated. If the payor does not provide 

notice, the financial institution must adopt one of three alternative procedures for giving notice. 

• The financial institution may give the consumer oral or written notice within two business 

days after a preauthorized transfer occurs.

• The financial institution may give the consumer oral or written notice, within two business 

days after the preauthorized transfer was scheduled to occur, that the transfer did not occur.

 

18 For gift cards produced before April 1, 2010, the mandatory compliance date is extended to January 31, 2011, for several 

disclosures on the card. 12 CFR § 205.20(h).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 33

• The financial institution may establish a readily available telephone line19 that the consumer 

may call to find out whether a preauthorized transfer has occurred. If the financial institution 

selects this option, the telephone number must be disclosed on the initial disclosures and on 

each periodic statement.

The financial institution need not use any specific language to give notice but may not simply 

provide the current account balance (Staff Commentary 205.10(a)(1)-1). The financial institution 

may use different methods of notice for different types of preauthorized transfers and need not offer 

consumers a choice of notice methods (Staff Commentary 205.10(a)(1)-2).

The financial institution that receives a preauthorized transfer must credit the consumer’s account as 

of the day the funds are received (Section 205.10(a)(3)).

Preauthorized transfers from a customer’s account. Preauthorized transfers from a consumer’s 

account may only be authorized by the consumer in writing and signed or similarly authenticated by 

the consumer (Section 205.10(b)). Signed, written authorizations may be provided electronically, 

subject to the E-Sign Act (Staff Commentary 205.10(b)-5). In all cases, the party that obtains the 

authorization from the consumer must provide a copy to the consumer. If a third party payee fails to 

obtain an authorization in writing or fails to provide a copy to the consumer, the third party payee 

and not the financial institution has violated Regulation E (Staff Commentary 205.10(b)-2).

Stop payments. Consumers have the right to stop payment of preauthorized transfers from 

accounts. The consumer must notify the financial institution orally or in writing at any time up to 

three business days before the scheduled date of the transfer (Section 205.10(c)(1)).If the debit item 

is resubmitted, the institution must continue to honor the stop-payment order. (Staff commentary 

205.10(c)(1)) The financial institution may require written confirmation of an oral stop payment 

order to be made within 14 days of the consumer’s oral notification. If the financial institution 

requires a written confirmation, it must inform the consumer at the time of the oral stop payment 

order that written confirmation is required and provide the address to which the confirmation should 

be sent. If the consumer fails to provide written confirmation, the oral stop payment order ceases to 

be binding after 14 days (Section 205.10(c)(2)).

Notice of transfers varying in amount. If a preauthorized transfer from a consumer’s account 

varies in amount from the previous transfer under the same authorization or the preauthorized 

amount, either the financial institution or the designated payee must send to the consumer a written 

notice, at least 10 days before the scheduled transfer date, of the amount and scheduled date of the 

transfer (Section 205.10(d)(1)). The consumer may elect to receive notice only when the amount 

varies by more than an agreed amount or falls outside a specified range (Section 205.10(d)(2)). The 

range must be an acceptable range that the consumer could reasonably anticipate (Staff 

 

19The telephone line must be “readily available” so that consumers calling to inquire about transfers are able to have their calls 

answered reasonably promptly during normal business hours. During the initial call in most cases and within two business days after 

the initial call in all cases, the financial institution should be able to verify whether the transfer was received (Staff Commentary 

205.10(a)(1)-5).Within its primary service area, a financial institution must provide a local or toll-free telephone number (Staff 

Commentary 205.10(a)(1)-7).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 34

Commentary 205.10(d)(2)-1). The financial institution does not violate Regulation E if the payee 

fails to provide sufficient notice (Staff Commentary 205.10(d)-1).

Compulsory use. The financial institution may not make it a condition for an extension of credit 

that repayment will be by means of preauthorized EFT, except for credit extended under an 

overdraft credit plan or extended to maintain a specified minimum balance in the consumer’s 

account (Section 205.10(e)(1)). The financial institution may offer a reduced APR or other costrelated incentive for an automatic payment feature as long as the creditor offers other loan programs 

for the type of credit involved (Staff Commentary 205.10(e)(1)-1).20

Services Offered by Provider Not Holding Consumer’s Account - Section 

205.14

A person who provides EFT services to a consumer but does not hold the consumer’s account is a 

service provider subject to Section 205.14 if the person issues an access device that the consumer 

can use to access the account and no agreement exists between the person and the account-holding 

financial institution. Transfers initiated by a service provider are often cleared through an automated 

clearinghouse (ACH). 

The responsibilities of the service provider are set forth in Sections 205.14(b)(l) and (2). The duties 

of the account-holding financial institution with respect to the service provider are found in Sections 

205.14(c)(l) and (2). 

Electronic Fund Transfer of Government Benefits - Section 205.15 

Section 205.15 contains the rules that apply to electronic benefit transfer (EBT) programs. It 

provides that government agencies must comply with modified rules on the issuance of access 

devices, periodic statements, initial disclosures, liability for unauthorized use, and error resolution 

notices. 

IX. Relation to Other Laws - Section 205.12 

This section describes the relationship between the EFTA and the Truth in Lending Act (TILA). 

The section also provides procedures for states to apply for exemptions from the requirements of the 

EFTA or Regulation E for any class of EFTs within the state. 

The EFTA governs the following: 

• The issuance of debit cards and other access devices with EFT capabilities.

• The addition of EFT features to credit cards. 

 20This section also prohibits anyone from requiring the establishment of an account for receipt of EFTs with a particular financial 

institution either as a condition of employment or the receipt of a government benefit (Sec. 205.10(e)(2)). However, the employer 

may require direct deposit of salary, as long as the employee may choose the financial institution that will accept the direct deposit, or 

limit direct deposits to one financial institution as long as the employee may choose to receive salary by other means (e.g., check or 

cash). (Staff Commentary 205.10(e)(2)-1).
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 35

• The issuance of access devices whose only credit feature is a pre-existing agreement to 

extend credit to cover account overdrafts or to maintain a minimum account balance, or is an 

overdraft service. 

The TILA governs all of the following: 

• The issuance of credit cards as defined in Regulation Z.

• The addition of a credit feature to a debit card or other access device, other than an overdraft 

service. 

• The issuance of dual debit/credit cards, except for access devices whose only credit feature 

is a pre-existing agreement to cover account overdrafts or to maintain a minimum account 

balance, or is an overdraft service. 

The EFTA and Regulation E preempt inconsistent state laws, but only to the extent of the 

inconsistency. The Board is given the authority to determine whether or not a state law is 

inconsistent. A financial institution, state, or other interested party may request the Board to make 

such a determination. A state law will not be deemed inconsistent if it is more protective of the 

consumer than the EFTA or Regulation E. Upon application, the Board has the authority to exempt 

any state from the requirements of the Act or the regulation for any class of EFTs within a state, 

with the exception of the civil liability provision. 

X. Administrative Enforcement, Record Retention -

Section 205.13

Section 917 of the EFTA sets forth the federal agencies responsible for enforcing compliance with 

the provisions of the Act. 

Record retention. Financial institutions must maintain evidence of compliance with the EFTA and 

Regulation E for at least two years. The agency supervising the financial institution may extend this 

period. The period may also be extended if the financial institution is subject to an action filed 

under Sections 910, 915 or 916(a) of the EFTA, which generally apply to the financial institution’s 

liability under the EFTA and Regulation E. Persons subject to the EFTA who have actual notice that 

they are being investigated or subject to an enforcement proceeding must retain records until 

disposition of the proceeding. 

Records may be stored on microfiche, microfilm, magnetic tape, or in any other manner capable of 

accurately retaining and reproducing the information. 

XI. Miscellaneous 

EFTA contains several additional provisions that are not directly reflected in the language of 

Regulation E. Most significantly, 15 USC 1693l provides that the consumer may not waive by 

agreement any right conferred, or cause of action created, by the EFTA. However, the consumer 
CFPB Consumer

Laws and Regulations EFTA

CFPB FFIEC Rev. 12/2010 EFTA 36

and another person may provide by agreement greater consumer protections or additional rights or 

remedies than those provided by EFTA. In addition, the consumer may sign a waiver in settlement 

of a dispute.

If a third party payee has agreed to accept payment by EFT, the consumer’s obligation to pay is 

suspended during any period in which a system malfunction prevents an EFT from occurring (15 

USC 1693j). However, the payee may avoid that suspension by making a written request for 

payment by means other than EFT.

Failure to comply with the requirements of EFTA can result in civil and criminal liability, as 

outlined in 15 USC 1693m and 15 USC 1693n. Financial institutions may also be liable for 

damages under 15 USC 1693h due to failure to complete an EFT or failure to stop a preauthorized 

transfer when instructed to do so.

Model disclosure clauses and forms (12 CFR 205, Appendix A) Appendix A of Regulation E 

contains model clauses and forms that financial institutions may use to comply with the requirement 

disclosure requirements of Regulation E. Use of the model forms is optional and a financial 

institution may make certain changes to the language or format of the model forms without losing 

the protection from civil and criminal liability under Sections 915 and 916 of the EFTA. The model 

forms are:

A-1 Model Clauses for Unsolicited Issuance (Section 205.5(b)(2))

A-2 Model Clauses for Initial Disclosures (Section 205.5(b)(2))

A-3 Model Forms for Error Resolution Notice (Section 205.7(b)(10) and 205.8(b))

A-4 Model Form for Service-Providing Institutions (Section 205.14(b)(1)(ii))

A-5 Model Forms for Government Agencies (Section 205.15(d)(1) and(2))

A-6 Model Clauses for Authorizing One-Time Electronic Fund Transfers Using 

Information from a Check (Section 205.3(b)(2))

A-7 Model Clauses for Financial Institutions Offering Payroll Card Accounts 

(Section 205.18(c))

A-8 Model Clause for Electronic Collection of Returned Item Fees (Section 205.3(b)(3))

A-9 Model Consent Form for Overdraft Services (Section 205.17)

References

Laws

15 USC 1693 et seq. Electronic Fund Transfer Act

15 USC 7001 et seq. Electronic Signatures in Global and National Commerce 

Regulations

Federal Reserve Board Regulations (12 CFR)

Part 205 Electronic Fund Transfers (Regulation E)
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 1

Electronic Fund Transfer Act

Examination Objectives

• To determine the financial institution’s 

compliance with Regulation E. 

• To assess the quality of the financial institution’s compliance risk management systems and 

its policies and procedures for implementing Regulation E.

• To determine the reliance that can be placed on the financial institution’s internal controls 

and procedures for monitoring the financial institution’s compliance with Regulation E.

• To direct corrective action when violations of law are identified or when the financial 

institution’s policies or internal controls are deficient.

Examination Procedures 

Management and Policy-Related Examination Procedures

1. Through a review of all written policies and procedures, management’s selfassessments, customer complaints, prior examination reports, and any 

compliance audit material, including work papers and reports, determine 

whether:

a. The scope of the audit addresses all provisions as applicable.

b. Management has taken corrective actions to follow-up on previously 

identified deficiencies.

c. The testing includes samples covering all product types and decision 

centers.

d. The work performed is accurate.

e. Significant deficiencies and their causes are included in reports to 

management and/or to the Board of Directors.

f. The frequency of review is appropriate.

[Click&type]

2. Through discussions with management and review of available information, 

determine whether the financial institution’s internal controls are adequate 

to ensure compliance in Regulation E area under review. Consider the 

following:

a. Organization charts

b. Process flowcharts

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 2

c. Policies and procedures

d. Account documentation

e. Checklists

f. Computer program documentation

[Click&type]

3. Through a review of the financial institution’s training materials, determine 

whether:

a. The financial institution provides appropriate training to individuals 

responsible for Regulation E compliance and operational procedures.

b. The training is comprehensive and covers the various aspects of 

Regulation E that apply to the individual financial institution’s product 

offerings and operations. 

[Click&type]

4. Through discussions with management and review of available information, 

determine whether the financial institution’s Overdraft Protection Program 

has incorporated the agency’s applicable guidance. In addition to ATM 

and one time debit card transactions, consider other types of transactions as 

well. Consider the institution’s contravention of the guidance when 

assessing the institution’s compliance management system and in 

determining the overall compliance rating.

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 3

Transaction-Related Examination Procedures

If upon conclusion of the management and policy-related examination procedures, you note 

procedural weaknesses or other risks requiring further investigation, conduct transaction testing, as 

necessary, using the following examination procedures. Use your judgment in deciding the size of 

each sample of deposit account disclosures, notices, and advertisements. Increase the sample size 

until you are confident you have sufficiently reviewed all aspects of the financial institution’s 

activities and policies subject to the regulation.

1. Obtain and review copies of the following: 

a. Disclosure forms

b. Advertising and scripts for overdraft opt-ins

c. Account agreements

d. Procedural manuals and written policies

e. Merchant agreements

f. Automated teller machine receipts and periodic statements

g. Error resolution statements/files

h. Form letters used in case of errors or questions concerning an account

i. Any agreements with third parties allocating compliance 

responsibilities

j. Consumer complaint files

[Click&type]

2. Determine the extent and adequacy of the financial institution’s policies, 

procedures, and practices for ensuring compliance with the regulation. In 

particular, verify that: 

a. Access devices are issued in compliance with the regulation (12 CFR 

205.5(b)). 

b. Required disclosures are given at time the account is opened or prior to 

the first EFT (12 CFR 205.4 and 205.7(c)). 

c. Unauthorized transfer claims are processed in compliance with the 

regulation (12 CFR 205.6 and 205.11).

d. Liability for unauthorized transfer claims is assessed in compliance 

with the regulation (12 CFR 205.6).

e. Negligence is not a factor in determining customer liability. The 

deposit agreement may not impose greater liability than Regulation E 
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 4

provides but may provide for less consumer liability (12 CFR 205.6).

f. Preauthorized debits and credits comply with the regulation (12 CFR 

205.10).

[Click&type]

3. If the financial institution has changed the terms or conditions since the last 

examination that required a written notice to the customer, determine that the 

institution provided the proper notice in a timely manner (12 CFR 205.8(a)).

[Click&type]

4. Review a sample of periodic statements to determine that they contain 

sufficient information for the consumer to identify transactions adequately 

and that they otherwise comply with regulatory requirements (12 

CFR 205.9).

[Click&type]

5. Verify that the financial institution does not require compulsory use of 

EFTs, except as authorized (12 CFR 205.10(e)).

[Click&type]

6. Review documents relating to a sample of unauthorized transfers, lost or 

stolen ATM cards, and EFT consumer complaints, and their respective 

periodic statements. During this review: 

a. Evaluate the financial institution’s compliance with its error resolution

procedures to isolate any apparent deficiencies in the financial 

institution’s operations and to ensure that the institution follows its 

policies for unauthorized transfers (12 CFR 205.6 and 205.11). 

b. Determine whether the financial institution investigates alleged errors 

and notifies consumers of the results within allotted time frames and, 

when appropriate, provisionally re-credits the account (12 CFR 

205.11(c)). 

c. Verify that the financial institution follows regulatory procedures after 

it completes its investigation and determines either that an error 

occurred (12 CFR 205.11(c)(1)) or that no error occurred (12 CFR 

205.11(d)).

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 5

7. Review a periodic statement for each type of account in which electronic 

fund transfers occur to make sure that the statements comply with the 

requirements of the regulation (12 CFR 205.9(b)).

[Click&type]

8. Review ATM and point-of-sale transfer receipts to determine whether they 

provide a clear description of the transaction (12 CFR 205.9(a)).

[Click&type]

9. Determine that the financial institution is maintaining records of compliance 

for a period of not less than two years from the date disclosures are required 

to be made or action is required to be taken (12 CFR 205.13(b)).

[Click&type]

10. If the financial institution maintains payroll card accounts, review a sample 

of the payroll card accounts. If the financial institution does not provide 

periodic statements under 12 CFR 205.9(b) for these accounts, verify that 

the institution makes available the account balance by telephone, an 

electronic history of account transactions, and (upon request) a written 

history of account transactions (12 CFR 205.18(b)).

[Click&type]

11. If the financial institution maintains payroll card accounts,verify that the 

financial institution complies with the modified requirements with respect 

to the required initial disclosures, error resolution notices, limitations on 

liability, and error resolution procedures (12 CFR 205.18(c)).

[Click&type]

12. If the financial institution operates one or more ATMs for which it charges 

a fee for use, determine that the financial institution provides notice of the 

fee and the amount of the fee both on the machine and on the screen or 

paper before the consumer is committed to paying the fee (12 CFR 205.16).

[Click&type]

13. Determine that the financial institution holding a consumer’s account does 

not assess a fee or charge on a consumer’s account for paying an ATM or 
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 6

one-time debit card transaction pursuant to the institution’s overdraft 

service,1 unless the institution: §205.17(b)(1) 

• Provides the consumer with a notice in writing (or if the consumer 

agrees, electronically), that is segregated from all other information and 

describes the institution’s overdraft service;

• Provides a reasonable opportunity for the consumer to affirmatively 

consent, or opt in, to the service for ATM and one-time debit card 

transactions;

• Obtains the consumer’s affirmative consent, or opt-in, to the 

institution’s payment of ATM or one-time debit card transactions; and

• Provides the consumer with confirmation of the consumer's consent in 

writing (or if the consumer agrees, electronically), which includes a 

statement informing the consumer of the right to revoke such consent.

An institution does not have to meet the notice requirements described 

above if it has a policy and practice of declining to authorize and pay any 

ATM or one-time debit card transactions when it has a reasonable belief at 

the time of the authorization request that the consumer does not have 

sufficient funds available to cover the transaction. However, it is still 

prohibited from charging fees for paying an ATM or one-time debit 

transaction overdraft. Commentary 205.17(b)-1(iv)) 

NOTE: this section is mandatory on July 1, 2010. However, for accounts 

opened before July 1, the section is mandatory on August 15, 2010. 

§205.17(c).

[Click&type]

13A Determine that in assessing overdraft fees for consumers who have not 

opted in, the institution charges fees only for negative balances, daily, or 

sustained overdraft, or similar fees, when the negative balance is 

attributable in whole or in part to checks, ACH or other transactions not 

subject to the fee prohibition, and the fee is assessed based on the date when 

the check is paid into overdraft, not the date of the ATM or one-time debit 

transaction. Commentary 205.17(b)-9

[Click&type]

 

1

The term “overdraft service” means a service under which a financial institution assesses a fee or charge on a consumer's account 

held by the institution for paying a transaction (including a check or other item) when the consumer has insufficient or unavailable 

funds in the account. §205.17(a). “Overdraft service” does not include a service that transfers funds from another account held by a 

consumer or a line of credit.
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 7

14. Determine that the financial institution does not: §205.17(b)(2)

• Condition the payment of any overdrafts for checks, ACH transactions, 

and other types of transactions on the consumer affirmatively 

consenting to the institution’s payment of ATM and one-time debit 

card transactions pursuant to the institution's overdraft service; or

• Decline to pay checks, ACH transactions, and other types of 

transactions that overdraw the consumer’s account because the 

consumer has not affirmatively consented to the institution's overdraft 

service for ATM and one-time debit card transactions.

[Click&type]

15. Determine that the financial institution provides to consumers who do not 

affirmatively consent to the institution’s overdraft service for ATM and 

one-time debit card transactions the same account terms, conditions, and 

features that it provides to consumers who affirmatively consent, except for 

the overdraft service for ATM and one-time debit card transactions. 

§205.17(b)(3)

[Click&type]

16. Ensure that the notice required by §205.17(b)(1)(i) is substantially similar to 

Model Form A–9, includes all applicable items in the following list, and 

does not contain any additional information: §205.17(d) and Commentary 

205.17(d)-1 through -5.

Overdraft service. A brief description of the financial institution’s overdraft 

service and the types of transactions for which a fee or charge for paying an 

overdraft may be imposed, including ATM and one-time debit card 

transactions.

Fees imposed. The dollar amount of any fees or charges assessed by the 

financial institution for paying an ATM or one-time debit card transaction 

pursuant to the institution’s overdraft service, including any daily or other 

overdraft fees. If the amount of the fee is determined on the basis of the 

number of times the consumer has overdrawn the account, the amount of 

the overdraft, or other factors, the institution must disclose the maximum 

fee that may be imposed.

Limits on fees charged. The maximum number of overdraft fees or charges 

that may be assessed per day, or, if applicable, that there is no limit.

Disclosure of opt-in right. An explanation of the consumer’s right to 
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 8

affirmatively consent to the financial institution's payment of overdrafts for 

ATM and one-time debit card transactions pursuant to the institution’s 

overdraft service, including the methods by which the consumer may 

consent to the service; and

Alternative plans for covering overdrafts. If the institution offers both a line 

of credit subject to Regulation Z (12 CFR part 226) and a service that 

transfers funds from another account of the consumer held at the institution 

to cover overdrafts, the institution must state in its opt-in notice that both 

alternative plans are offered. If the institution offers one, but not the other, 

it must state in its opt-in notice the alternative plan that it offers. If the 

institution does not offer either plan, it should omit the reference to the 

alternative plans. If the financial institution offers additional alternatives 

for paying overdrafts, it may (but is not required to) disclose those 

alternatives. 

Permitted modifications and additional content. If applicable, the institution 

may modify the content required by §205.17(d) to indicate that the 

consumer has the right to opt into, or opt out of, the payment of overdrafts 

under the institution’s overdraft service for other types of transactions, such 

as checks, ACH transactions, or automatic bill payments; to provide a 

means for the consumer to exercise this choice; and to disclose the 

associated returned item fee and that additional merchant fees may apply. 

The institution may also disclose the consumer’s right to revoke consent. 

The response portion of Model Form A-9 may be tailored to the methods 

offered for opting in, and may include reasonable methods to identify the 

account, such as a bar code. For notices provided to consumers who have 

opened accounts prior to July 1, 2010, the financial institution may describe 

the institution’s overdraft service with respect to ATM and one-time debit 

card transactions with a statement such as “After August 15, 2010, we will 

not authorize and pay overdrafts for the following types of transactions 

unless you ask us to (see below).”

[Click&type]

17. Determine that, when two or more consumers jointly hold an account, the 

financial institution treats the affirmative consent of any of the joint 

consumers as affirmative consent for that account, and treats a revocation of 

affirmative consent by any of the joint consumers as revocation of consent 

for that account. §205.17(e)

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 9

18. Ensure thata consumer may affirmatively consent to the financial 

institution's overdraft service at any time in the manner described in the 

institution’s (Section 205.17(b)(1)(i)) notice, and that a consumer may also 

revoke consent at any time in the manner made available to the consumer 

for providing consent. §205.17(f)

[Click&type]

19. Determine that the financial institution implements a consumer's revocation 

of consent as soon as reasonably practicable. §205(17)(f)

[Click&type]

20. Determine that a consumer’s affirmative consent to the institution's 

overdraft service is effective until revoked by the consumer, or until the 

financial institution terminates the service.§205.17(g)

[Click&type]

21. Determine that gift card disclosures (made under Section 205.20 of 

Regulation E) are clear and conspicuous. §205.20(c)(1) Further determine 

that the disclosures are provided to the consumer in a retainable written or 

electronic form. Only disclosures provided under §205.20(c)(3) (prior to 

purchase of a gift certificate, store gift card or general-use prepaid card) [or 

(h)(2), if applicable2] may be given orally.§205.20(c)(2) 

NOTE: as explained by the rulemaking’s prefatory material, permitting oral 

disclosures is necessary in limited circumstances where disclosures cannot 

be made prior to purchase unless made orally, such as when a certificate or 

card is purchased by telephone. Though disclosures required to be made 

prior to purchase can be made orally, the rule still requires written or 

electronic disclosures to be provided on or with the certificate or card.

[Click&type]

 

2 Section 205.20(h)(2) allows a delayed effective date – until January 31, 2011 - for disclosures on the card for gift cards that were 

produced before April 1, 2010. Throughout the remainder of the examination procedures, such sections are denoted by a triple 

asterisk ***.
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 10

22. Determine that the disclosures required by §§205.20(a)(4)(iii) (loyalty, 

award, or promotional gift card), (d)(2) (dormancy/inactivity/service fees), 

(e)(3)(expiration date, phone and web, regarding replacement), and (f)(2) 

(phone and web, regarding fees), are made on the certificate or card, or in 

the case of a loyalty, award, or promotional gift card, on the card, code, or 

other device*** 

NOTE: A disclosure made in an accompanying terms and conditions 

document, on packaging surrounding a certificate or card, or on a sticker or 

other label affixed to the certificate or card does not constitute a disclosure 

on the certificate or card. 

• If the certificate or card is electronic, determine that disclosures are 

provided electronically on the certificate or card provided to the 

consumer. 

• If an issuer provides a code or confirmation to a consumer orally, 

determine that the issuer provides to the consumer a written or 

electronic copy of the code or confirmation promptly, and the 

applicable disclosures are provided on the written copy of the code or 

confirmation.§205.20(c)(4)

[Click&type]

23. Determine that the following are stated, as applicable, clearly and 

conspicuously on the gift certificate, store gift card, or general-use prepaid 

card: §205.20(d)(2) ***

• The amount of any dormancy, inactivity, or service fee that may be 

charged;

• How often such fee may be assessed; and

• That such fee may be assessed for inactivity.

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 11

24. Determine that the following disclosures are provided in connection with a 

gift certificate, store gift card, or general-use prepaid card as applicable: 

§205.20(f) ***

• For each type of fee that may be imposed in connection with the 

certificate or card (other than a dormancy, inactivity, or service fee, 

which are discussed above) the following information must be 

provided on or with the certificate or card: §205.20(f)(1)

o The type of fee;

o The amount of the fee (or an explanation of how the fee will be 

determined); and

o The conditions under which the fee may be imposed.

• A toll-free telephone number and, if one is maintained, a website, that a 

consumer may use to obtain information about fees described in 

paragraphs (d)(2) and (f)(1) (described immediately above) of this 

section must be disclosed on the certificate or card.§205.20(f)(2)

[Click&type]

25. If an expiration date applies to a certificate or card, determine that the 

following disclosures are provided on the certificate or card, as 

applicable:§205.20(e)(3) ***

• The expiration date for the underlying funds or, if the underlying funds 

do not expire, that fact;

• A toll-free telephone number and, if one is maintained, a website that a 

consumer may use to obtain a replacement certificate or card after the 

certificate or card expires if the underlying funds may be available; and

• Except where a non-reloadable certificate or card bears an expiration 

date that is at least seven years from the date of manufacture, a 

statement, disclosed with equal prominence and in close proximity to 

the certificate or card expiration date, that:

o The certificate or card expires, but the underlying funds either do 

not expire or expire later than the certificate or card, and

• The consumer may contact the issuer for a replacement card.

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 12

26. Determine that a loyalty, award, or promotional gift card sold or issued by 

the examined institution sets forth the following disclosures, as applicable: 

§205.20(a)(4)(iii)

• A statement on the front of the card, code, or other device, indicating 

that the card, code, or other device is issued for loyalty, award, or 

promotional purposes;

• The expiration date for the underlying funds on the front of the card, 

code, or other device;

• The amount of any fees that may be imposed in connection with the 

card, code, or other device, and the conditions under which they may 

be imposed. This disclosure must be provided on or with the card, 

code, or other device; and

• A toll-free telephone number and, if one is maintained, a website that a 

consumer may use to obtain fee information on the card, code, or other 

device

[Click&type]

27. Determine that a person (examined institution) that issues or sells a gift 

certificate, store gift card, or general-use prepaid card discloses to the 

consumer, prior to purchase, the information required by §§205.20(d)(2) 

(dormancy/inactivity/service fees), (e)(3) (expiration date, phone and web, 

regarding replacement), and (f)(1) (other fees). §205.20(c)(3). ***

[Click&type]

28. Determine that the fees and terms and conditions of expiration that are 

required to be disclosed prior to purchase are not changed after 

purchase.§205.20(c)(3) ***

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 13

29. Determine that no person(examined institution) imposes a dormancy, 

inactivity, or service fee with respect to a gift certificate, store gift card, or 

general-use prepaid card, unless: §205.20(d)

• There has been no activity with respect to the certificate or card, in the 

one year period ending on the date on which the fee is imposed;

• Required disclosures are provided;

• Not more than one dormancy, inactivity, or service fee is imposed in 

any given calendar month.

[Click&type]

30. Determine that the person (examined institution) does not sell or issue a gift 

certificate, store gift card, or general-use prepaid card with an expiration 

date unless: §205.20(e) ***

• Required expiration date disclosures are provided on the certificate or 

card, as applicable;

• It has established policies and procedures to provide consumers with a 

reasonable opportunity to purchase a certificate or card with at least 

five years remaining until the certificate or card expiration date ;

• The expiration date for the underlying funds is at least the later of:

o Five years after the date the gift certificate was initially issued, or 

the date on which funds were last loaded to a store gift card or 

general-use prepaid card; or

o The certificate or card expiration date, if any; and

• No fee or charge is imposed on the cardholder for replacing the gift 

certificate, store gift card, or general-use prepaid card or for providing 

the certificate or card holder with the remaining balance in some other

manner prior to the funds expiration date, unless such certificate or 

card has been lost or stolen.

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 14

31. For cards produced prior to April 1, 2010, sections 205.20 (c)(3), (d)(2), 

(e)(1), (e)(3), and (f) do not apply until January 31, 2011 if certain 

conditions are met. If applicable, determine that the issuer: 

• Complies with all other non-suspended provisions of the gift card rules; 

• Does not impose an expiration date with respect to the funds underlying 

such certificate or card and, at the consumer’s request, replaces such 

certificate or card if it has funds remaining, at no cost to the consumer; 

• Discloses through in-store signage, messages during customer service 

calls, websites, and general advertising, that:

o The underlying funds of such certificate or card do not expire; 

o Consumers holding such certificate or card have a right to a free 

replacement certificate or card, accompanied by the packaging and 

materials typically associated with such certificate or card; and

o Any dormancy, inactivity, or service fee for such certificate or 

card that might otherwise be charged will not be charged if such 

fees do not comply with Section 915 of the Electronic Fund 

Transfer Act.

Determine that the above disclosures (i) are provided until January 31, 

2011, with respect to in-store signage and general advertising, (ii) and are 

provided until January 31, 2013, with respect to messages during customer 

service calls and websites.

[Click&type]
CFPB

Examination Procedures EFTA

CFPB FFIEC Rev. 12/2010 EFTA 15

Examiner’s Summary, Recommendations and Comments

[Click&type]
CFPB 

Examination Checklist EFTA

CFPB FFIEC rev. 12/2010 EFTA 1

Electronic Fund Transfer Act 

(Regulation E)

This questionnaire can be used to review audit work 

papers, to evaluate financial institution policies, to 

perform transaction testing, and to train as appropriate. Complete only those aspects of the checklist 

that specifically relate to the issue being reviewed, evaluated, or tested, and retain those completed 

sections in the work papers.

When reviewing audit, evaluating financial institution policies, or performing transaction testing, a 

“No” answer indicates a possible exception/deficiency and you should explain it in the work papers. 

If a line item is not applicable within the area you are reviewing, indicate by using “NA.”

Underline the applicable use: Audit Financial Institution Policies Transaction Testing

Yes No NA

12 CFR 205.5 - Issuance of Access Devices

1. Do the financial institution’s policies, practices, and procedures allow 

that validated access devices are issued only:

• In response to oral or written requests (12 CFR 205.5(a)(1)) or

• As a renewal or substitution for an accepted access device? 

(12 CFR 205.5(a)(2))

2. Do the financial institution’s policies, practices, and procedures allow 

that unsolicited access devices are issued only when the devices are:

• Not validated? (12 CFR 205.5(b)(1))

• Accompanied by a clear explanation that they are not validated and 

how they may be disposed of if validation is not desired? (12 CFR 

205.5(b)(2))

• Accompanied by the initial disclosures required by 12 CFR 205.7? 

(12 CFR 205.5(b)(3)) 

• Validated only in response to a consumer’s request and after the 

financial institution has verified the consumer’s identity by 

reasonable means (e.g., photograph, fingerprint, personal visit, 

signature)? (12 CFR 205.5(b)(4) and Staff Commentary)

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 2

12 CFR 205.6 - Consumer Liability for 

Unauthorized Electronic Fund Transfers

3. Does the financial institution impose liability on the consumer for 

unauthorized transfers only if: (12 CFR 205.6(a))

• Any access device that was used was an accepted access device?

• The institution has provided a means to identify the consumer to 

whom it was issued?

• The institution has provided the disclosures required by 

Section 205.7(b)(l), (2), and (3)?

4. Does the financial institution not rely on consumer negligence or the 

deposit agreement to impose greater consumer liability for unauthorized 

EFTs than is permitted under Regulation E? (Staff Commentaries 

205.6(b)-1 and -2)

5. If a consumer notifies the financial institution within two business days 

after learning of the loss or theft of an access device, does the financial 

institution limit the consumer’s liability for unauthorized EFTs to the 

lesser of $50 or actual loss? (12 CFR 205.6(b)(1))

6. If a consumer does not notify the financial institution within two 

business days after learning of the loss or theft of an access device, does 

the institution limit the consumer’s liability for unauthorized EFTs to the 

lesser of $500 or the sum of (12 CFR 205.6(b)(2)):

• $50 or the amount of unauthorized EFTs that occurred within the 

two business days, whichever is less;

plus

• The amount of unauthorized EFTs that occurred after the close of 

two business days and before notice to the financial institution 

(provided the financial institution establishes that these transfers 

would not have occurred had the consumer notified the financial 

institution within that two-day period)?

7. If a consumer notifies the financial institution of an unauthorized EFT 

within 60 calendar days of transmittal of the periodic statement upon 

which the unauthorized EFT appears, does the financial institution not 

hold the consumer liable for the unauthorized transfers that occur after 

the 60-day period? (12 CFR 205.6(b)(3))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 3

8. If a consumer does not notify the financial institution of an unauthorized 

EFT within 60 calendar days of transmittal of the periodic statement 

upon which the unauthorized EFT appears, does the financial institution 

ensure that the consumer’s liability does not exceed the amount of the 

unauthorized transfers that occur after the close of the 60 days and before 

notice to the financial institution, if the financial institution establishes 

that the transfers would not have occurred had timely notice been given? 

(12 CFR 205.6(b)(3)) 

9. If a consumer notifies the financial institution of an unauthorized EFT 

within the timeframes discussed in questions 7 or 8 and the consumer’s 

access device is involved in the unauthorized transfer, does the financial 

institution hold the consumer liable for amounts as set forth in 12 CFR 

205.6(b)(1) or (2) (discussed in questions 5 and 6)? (12 CFR 205.6(b)(3))

NOTE: The first two tiers of liability (as set forth in 12 CFR 205.6(b)(1) 

and (2) and discussed in questions 5 and 6) do not apply to unauthorized 

transfers from a consumer’s account made without an access device. 

(Staff Commentary 205.6(b)(3)-2)

10. Does the financial institution extend the 60-day time period by a 

reasonable amount, if the consumer’s delay in notification was due to an 

extenuating circumstance? (12 CFR 205.6(b)(4))

11. Does the financial institution consider notice to be made when the 

consumer takes steps reasonably necessary to provide the institution with 

pertinent information, whether or not a particular employee or agent of 

the institution actually received the information? (12 CFR 205.6(b)(5)(i))

12. Does the financial institution allow the consumer to provide notice in 

person, by telephone, or in writing? (12 CFR 205.6(b)(5)(ii))

13. Does the financial institution consider written notice to be given at the 

time the consumer mails or delivers the notice for transmission to the 

institution by any other usual means? (12 CFR 205.6(b)(5)(iii))

14. Does the financial institution consider notice given when it becomes 

aware of circumstances leading to the reasonable belief that an 

unauthorized transfer to or from the consumer’s account has been or may 

be made? 

(12 CFR 205.6(b)(5)(iii))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 4

15. Does the financial institution limit the consumer’s liability to a lesser 

amount than provided by 12 CFR 205.6, when state law or an agreement 

between the consumer and the financial institution provide for such an 

amount? (12 CFR 205.6(b)(6))

12 CFR 205.7 - Initial Disclosures 

16. Does the financial institution provide the initial disclosures at the time a 

consumer contracts for an EFT service or before the first EFT is made 

involving the consumer’s account? (12 CFR 205.7(a))

17. Do the financial institution’s initial disclosures provide the following 

information, as applicable:

• A summary of the consumer’s liability for unauthorized transfers 

under 12 CFR 205.6 or under state or other applicable law or 

agreement? (12 CFR 205.7(b)(1))

• The telephone number and address of the person or office to be 

notified when the consumer believes that an unauthorized EFT has 

been or may be made? (12 CFR 205.7(b)(2))

• The financial institution’s business days? (12 CFR 205.7(b)(3))

• The type of EFTs the consumer may make and any limits on the 

frequency and dollar amount of transfers? (If details on the limits 

on frequency and dollar amount are essential to maintain the 

security of the system, they need not be disclosed.) (12 CFR 

205.7(b)(4))

• Any fees imposed by the financial institution for EFTs or for the 

right to make transfers? (12 CFR 205.7(b)(5))

• A summary of the consumer’s right to receive receipts and periodic 

statements, as provided in 12 CFR 205.9, and notices regarding 

preauthorized transfers as provided in 12 CFR 205.10(a) and 

205.10(d)? (12 CFR 205.7(b)(6))

• A summary of the consumer’s right to stop payment of a 

preauthorized EFT and the procedure for placing a stop payment 

order, as provided in 12 CFR 205.10(c)? (12 CFR 205.7(b)(7))

• A summary of the financial institution’s liability to the consumer 

for its failure to make or to stop certain transfers under the EFTA? 

(12 CFR 205.7(b)(8))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 5

• The circumstances under which the financial institution, in the 

ordinary course of business, may disclose information to third 

parties concerning the consumer’s account? (12 CFR 205.7(b)(9))

• An error resolution notice that is substantially similar to the Model 

Form A-3 in appendix A? (12 CFR 205.7(b)(10))

• A notice that a fee may be imposed by an ATM operator (as 

defined in section 205.16(a)) when the consumer initiates an EFT 

or makes a balance inquiry and by any network used to complete 

the transaction? (12 CFR 205.7(b)(11))

18. Does the financial institution provide disclosures at the time a new EFT 

service is added, if the terms and conditions of the service are different 

than those initially disclosed? (12 CFR 205.7(c))

12 CFR 205.8 - Change-in-Terms Notice; 

Error Resolution Notice 

19. If the financial institution made any changes in terms or conditions 

required to be disclosed under section 205.7(b) that would result in 

increased fees, increased liability, fewer types of available EFTs, or 

stricter limits on the frequency or dollar amount of transfers, did the 

financial institution provide a written notice to consumers at least 21 

days prior to the effective date of such change? (12 CFR 205.8(a)) 

20. Does the financial institution provide either the long form error 

resolution notice at least once every calendar year or the short form error 

resolution notice on each periodic statement? (12 CFR 205.8(b)) 

12 CFR 205.9 - Receipts at Electronic Terminals; 

Periodic Statements 

21. Does the financial institution make receipts available to the consumer at 

the time the consumer initiates an EFT at an electronic terminal? The 

financial institution is exempt from this requirement for EFTs of $15 or 

less. (12 CFR 205.9(a) and (e))

22. Do the receipts contain the following information, as applicable:

• The amount of the transfer? (12 CFR 205.9(a)(1))

• The date the transfer was initiated? (12 CFR 205.9(a)(2))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 6

• The type of transfer and the type of account to or from which funds 

were transferred? (12 CFR 205.9(a)(3))

• A number or code that identifies the consumer’s account or the 

access device used to initiate the transfer? (12 CFR 205.9(a)(4))

• The terminal location where the transfer is initiated? (12 CFR 

205.9(a)(5))

• The name or other identifying information of any third party to or 

from whom funds are transferred? (12 CFR 205.9(a)(6))

23. Does the financial institution send a periodic statement for each monthly 

cycle in which an EFT has occurred? If no EFT occurred, does the 

financial institution send a periodic statement at least quarterly? (12 CFR 

205.9(b))

24. Does the periodic statement contain the following information, as 

applicable:

• Transaction information for each EFT occurring during the cycle, 

including the amount of transfer, date of transfer, type of transfer, 

terminal location, and name of any third-party transferor or 

transferee? (12 CFR 205.9(b)(1))

• Account number? (12 CFR 205.9(b)(2))

• Fees? (12 CFR 205.9(b)(3))

• Account balances? (12 CFR 205.9(b)(4))

• Address and telephone number for inquiries? (12 CFR 205.9(b)(5))

• Telephone number to ascertain preauthorized transfers, if the 

financial institution provides telephone notice under 12 CFR 

205.10(a)(1)(iii)? 

(12 CFR 205.9(b)(6))

12 CFR 205.10 - Preauthorized Transfers

25. If a consumer’s account is to be credited by a preauthorized EFT from 

the same payor at least once every 60 days (and the payor does not 

already provide notice to the consumer that the transfer has been 

initiated) (12 CFR 205.10(a)(2)), does the financial institution do one of 

the following:

• Provide oral or written notice, within two business days, after the 

transfer occurs? (12 CFR 205.10(a)(1)(i))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 7

• Provide oral or written notice, within two business days after the 

transfer was scheduled to occur, that the transfer did or did not 

occur? (12 CFR 205.10(a)(1)(ii))

• Provide a readily available telephone line that the consumer can 

call to determine if the transfer occurred and that telephone number 

is disclosed on the initial disclosure of account terms and on each 

periodic statement? 

(12 CFR 205.10(a)(1)(iii))

26. Does the financial institution credit the amount of a preauthorized 

transfer as of the date the funds for the transfer are received? 

(12 CFR 205.10(a)(3))

27. Does the financial institution ensure that an authorization is obtained for 

preauthorized transfers from a consumer’s account by a written, signed 

or similarly authenticated authorization, and is a copy of the 

authorization provided to the consumer? (12 CFR 205.10(b))

28. Does the financial institution allow the consumer to stop payment on a 

preauthorized EFT by oral or written notice at least three business days 

before the scheduled date of the transfer? (12 CFR 205.10(c)(1))

29. If the financial institution requires that the consumer give written 

confirmation of an oral stop-payment order within 14 days, does the 

financial institution inform the consumer, at the time they give oral 

notification, of the requirement and provide the address where they must 

send the written confirmation?

NOTE: An oral stop-payment order ceases to be binding after 14 days if 

the consumer fails to provide the required written confirmation. (12 CFR 

205.10(c)(2))

30. Does the financial institution inform, or ensure that third-party payees 

inform, the consumer of the right to receive notice of all varying 

transfers?

or

Does the financial institution give the consumer the option of receiving 

notice only when a transfer falls outside a specified range of amounts or 

differs from the most recent transfer by an agreed-upon amount? (12 

CFR 205.10(d)(2)) 

31. If the financial institution or third-party payee is obligated to send the 

consumer written notice of the EFT of a varying amount, does the 

financial institution ensure that:

• The notice contains the amount and date of transfer?
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 8

• The notice is sent at least 10 days before the scheduled date of 

transfer? (12 CFR 205.10(d)(1)) 

32. Does the financial institution not condition an extension of credit to a 

consumer on the repayment of loans by preauthorized EFT, except for 

credit extended under an overdraft credit plan or extended to maintain a 

specified minimum balance in the consumer’s account? (12 CFR 

205.10(e)(1))

33. Does the financial institution not require a consumer to establish an 

account for EFTs with a particular institution as a condition of 

employment or receipt of government benefits? (12 CFR 205.10(e)(2))

12 CFR 205.11 - Procedures for Resolving Errors 

34. Does the financial institution have procedures to investigate and resolve 

all oral or written notices of error received no later than 60 days after the 

institution sends the periodic statement or provides passbook 

documentation? (12 CFR 205.11(b)(2))

35. If the financial institution requires written confirmation of an error within 

10 business days of an oral notice, does the financial institution inform 

the consumer of this requirement and provide the address where the 

written confirmation must be sent? (12 CFR 205.11(b)(2))

36. Does the financial institution have procedures to investigate and resolve 

alleged errors within 10 business days, except as otherwise provided in 

12 CFR 205.11(c)? (12 CFR 205.11(c)(1))

NOTE: The time period is extended in certain circumstances. (12 CFR 

205.11(c)(3))

37. Does the financial institution report investigation results to the consumer 

within three business days after completing its investigation and correct 

any error within one business day after determining that an error 

occurred? (12 CFR 205.11(c)(1))

38. If the financial institution is unable to complete its investigation within 

10 business days, does the financial institution have procedures to 

investigate and resolve alleged errors within 45 calendar days of receipt 

of a notice of error; and:
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 9

• Does the financial institution provisionally credit the consumer’s 

account in the amount of the alleged error (including interest, if 

applicable) within 10 business days of receiving the error notice 

(however, if the financial institution requires, but does not receive, 

written confirmation within 10 business days, the financial 

institution is not required to provisionally credit the consumer’s 

account)? 

• Within two business days after granting any provisional credit, does 

the financial institution inform the consumer of the amount and 

date of the provisional credit and gives the consumer full use of the 

funds during the investigation? 

• Within one business day after determining that an error occurred, 

does the financial institution correct the error? and

• Does the financial institution report the results to the consumer 

within three business days after completing its investigation 

including, if applicable, notice that a provisional credit has been 

made final? (12 CFR 205.11(c))

NOTE: The time period is extended in certain circumstances. 

(12 CFR 205.11(c)(3))

39. If a billing error occurred, does the financial institution not impose a 

charge related to any aspect of the error-resolution process? 

(Staff Commentary 205.11(c)-3)

40. If the financial institution determines that no error occurred (or that an 

error occurred in a manner or amount different from that described by the 

consumer), does the financial institution send a written explanation of its 

findings to the consumer and note the consumer’s right to request the 

documents the financial institution used in making its determination? (12 

CFR 205.11(d)(1)) 

41. When the financial institution determines that no error (or a different 

error) occurred, does the financial institution notify the consumer of the 

date and amount of the debiting of the provisionally credited amount and 

the fact that the financial institution will continue to honor checks and 

drafts to third parties and preauthorized transfers for five business days 

(to the extent that they would have been paid if the provisionally credited 

funds had not been debited)? (12 CFR 205.11(d)(2))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 10

12 CFR 205.13 - Record Retention

42. Does the financial institution maintain evidence of compliance with the 

requirements of the EFTA and Regulation E for a period of two years? 

(12 CFR 205.13(b))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 11

12 CFR 205.16 - Disclosures at Automated Teller 

Machines (ATM)

43. If the financial institution operates an ATM and imposes a fee on a 

consumer for initiating an EFT or balance inquiry, does the financial 

institution provide notice that a fee will be imposed and disclose the 

amount of the fee? 

(12 CFR 205.16(b))

44. Does the financial institution post the notice required by section 

205.16(b) in a prominent and conspicuous location on or at the ATM? 

(12 CFR 205.16(c)(1)) 

45. Does the financial institution provide the notice required by section 

205.16(b) either by showing it on the ATM screen or by providing it on 

paper before the consumer is committed to paying a fee? (12 CFR 

205.16(c)(2))

12 CFR 205.17 Requirements for Overdraft Services

46. Does the financial institution’s Overdraft Protection Program incorporate 

the agency’s guidance as applicable?

47. Does the financial institution’s Overdraft Protection Program provide 

“overdraft services,” i.e., charge fees for paying ATM and one-time debit 

overdrafts? (12 CFR 205.17(a)) If no, do not complete this section

48. If the financial institution assesses a fee or charge (NOTE: fees or 

charges may generally be assessed only on transactions paid after the 

confirmation has been mailed or delivered) on the consumer’s account 

for paying an ATM or one-time debit card transaction pursuant to the 

financial institutions overdraft service, does the financial institution first 

(12 CFR 205.17(b)(1)): 

• Provide the consumer with a notice in writing, or if the consumer 

agrees, electronically, that is segregated from all other information 

and describes the institution’s overdraft service 

(12 CFR 205.17(b)(1)(i)); 

• Provide a reasonable opportunity for the consumer to affirmatively 

consent, or opt-in, to the institution’s payment of ATM and onetime debit card transactions (12 CFR 205.17(b)(1)(ii)); 

• Obtain the consumer’s affirmative consent, or opt-in, to the 

institution’s payment of ATM or one-time debit card transactions 

(12 CFR 205.17(b)(1)(iii)); and
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 12

• Provide the consumer with confirmation of the consumer’s consent 

in writing, or if the consumer agrees, electronically, which includes 

a statement informing the consumer of the right to revoke such 

consent? (12 CFR 205.17(b)(1)(iv)) 

49. Does the financial institution ensure that it does not condition the 

payment of any overdrafts for checks, ACH transactions, and other types 

of transactions on the consumer affirmatively consenting to the 

institution’s payment of ATM and one-time debit card transactions 

pursuant to the institution’s “overdraft services”? 

(12 CFR 205.17(b)(2)(i))

50. Does the financial institution pay checks, ACH transactions, and other 

types of transactions that overdraw the consumer’s account regardless of 

whether the consumer has affirmatively consented to the institution’s 

overdraft protection service for ATM and one-time debit card 

transactions? (12 CFR 205.17(b)(2)(ii)) 

51. For consumers who have not opted in, and if an overdraft fee or charge is 

based on the amount of the outstanding negative balance, does the 

institution only assess fees where the negative balance is attributable in 

whole or in part to a check, ACH, or other type of transaction not subject 

to the prohibition on assessment of overdraft fees? 

For consumers who have not opted in, does the financial institution only 

assess daily or sustained overdraft, negative balance, or similar fees or 

charges where the negative balance is attributable in whole or in part to a 

check, ACH, or other type of transaction not subject to the prohibition on 

assessment of overdraft fees?

Does the institution base the date on which such a daily or sustained 

overdraft, negative balance, or similar fee or charge is assessed on the 

date on which the check, ACH, or other type of transaction was paid into 

overdraft? Commentary 205.17(b)-9

52. Does the financial institution provide consumers who do not 

affirmatively consent to the institution’s overdraft service for ATM and 

one-time debit card transactions the same account terms, conditions, and 

features that it provides to consumers who affirmatively consent, except 

for the overdraft service for ATM and one-time debit card transactions? 

(12 CFR 205.17(b)(3))

53. Is the notice required by (12 CFR 205.17(b)(1)(i)) substantially similar to 

Model Form A-9 set forth in Appendix A of (12 CFR 205.17), including 

applicable items from the list below, and does it not contain any 

additional information? (12 CFR 205.17(d)) 
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 13

• Overdraft Service – Does the notice provide a brief description of 

the overdraft service and the types of transactions for which a fee or 

charge off paying an overdraft may be imposed, including ATM 

and one-time debit card transactions? (12 CFR 205.17(d)(1)) 

• Fees imposed – Does the notice contain the dollar amount of any 

fees or charges assessed by the financial institution for paying an 

ATM or one-time debit card transaction pursuant to the financial 

institution’s overdraft service, including any daily or other 

overdraft fees? 

NOTE: If the amount of the fee is determined on the basis of the 

number of times the consumer has overdrawn the account, the 

amount of the overdraft, or other factors, the institution must 

disclose the maximum fee that may be imposed. 

(12 CFR 205.17(d)(2))

• Limits on Fees Charged – Does the notice disclose the maximum 

number of overdraft fees or charges that may be assessed per day, 

or, if applicable, that there is no limit? (12 CFR 205.17(d)(3))

• Disclosure of opt-in right – Does the notice explain the consumer’s 

right to affirmatively consent to the financial institution’s payment 

of overdrafts for ATM and one-time debit card transactions 

pursuant to the institution’s overdraft service, including the 

methods by which the consumer may consent to the service? 

(12 CFR 205.17(d)(4)) 

• Alternative Plans for Covering Overdrafts – As applicable, does the 

institution’s opt-in notice appropriately address the alternative 

methods for covering overdrafts? 

• If the institution offers both a line of credit subject to Regulation Z 

(12 CFR part 226) and a service that transfers funds from another 

account of the consumer held at the institution to cover overdrafts, 

does the notice state that both alternative plans are offered? 

• If the institution offers one, but not the other, does the notice state 

which of the alternative plan it offers. If the institution does not 

offer either a line of credit subject to Regulation Z (12 CFR part 

226) or a service that transfers funds from another account of the 

consumer held at the institution to cover overdrafts plan, does the 

notice exclude information regarding either of these plans.
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 14

• If the financial institution offers additional alternatives for paying 

overdrafts, at its option the institution may (but is not required to) 

disclose those alternatives. Does its notice describe those 

alternatives? 

• Permitted Modifications and Additional Content – If the institution 

modifies the notice, are the modifications permitted: to indicate 

that the consumer has the right to opt into, or out of, the payment of 

overdrafts under the institution’s overdraft service for other types 

of transactions, such as checks, ACH transactions, or automatic bill 

payments; to provide a means for the consumer to exercise this 

choice; and to disclose the associated returned item fee and that 

additional merchant fees may apply? The institution may also 

disclose the consumer’s right to revoke consent. The response 

portion of Model Form A-9 may be tailored to the methods offered 

for opting in, and may include reasonable methods to identify the 

account, such as a bar code. For notices provided to consumers who 

have opened accounts prior to July 1, 2010, the financial institution 

may describe the institution’s overdraft service with respect to 

ATM and one-time debit card transactions with a statement such as 

“After August 15, 2010, we will not authorize and pay overdrafts 

for the following types of transactions unless you ask us to (see 

below).” (12 CFR 205.17(d)(6) and Commentary 20517(d)-1 

through -5))

54. Joint Accounts – When two or more consumers jointly hold an account, 

does the financial institution treat the affirmative consent of any of the 

joint consumers as affirmative consent for that account, and treat the 

revocation of affirmative consent by any of the joint consumers as 

revocation of consent for that account? (12 CFR 205.17(e)) 

55. Continuing Right to Opt-In or to Revoke Opt-In - Does the financial 

institution allow the consumer to affirmatively consent to the financial 

institution’s overdraft service at any time in the manner described in the 

notice required (12 CFR 205.17(b)(1)(i)) and allow a consumer to revoke 

consent at any time in the manner made available to the consumer for 

providing consent? (12 CFR 205.17(f)) 

56. Does the financial institution implement a consumer’s revocation of 

consent as soon as reasonably practicable? (12 CFR 205.17(f)) 

57. Is the consumer’s affirmative consent to the overdraft service effective 

until revoked by the consumer, or unless the financial institution 

terminates the service? (12 CFR 205.17(g)) 
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 15

12 CFR 205.18 - Payroll Card Accounts 

58. If the financial institution offers payroll card accounts, does the financial 

institution either provide periodic statements as required by 12 CFR 

205.9(b) or make available to the consumer:

• The account balance, through a readily available telephone line, 

and

• An electronic history of the consumer’s account transactions, such 

as through an Internet Website, that covers at least 60 days 

preceding the date the consumer electronically accesses the 

account, and

• A written history of the consumer’s account transactions that is 

provided promptly in response to an oral or written request and that 

covers at least 60 days preceding the date the financial institution 

receives the consumer’s request? (12 CFR 205.18(b))

NOTE: The history of account transactions must include the 

information set forth in section 205.9(b).

59. Does the financial institution provide initial disclosures that include, at a 

minimum:

• A telephone number that the consumer may call to obtain the 

account balance, the means by which the consumer can obtain an 

electronic account history, such as the address of a website, and a 

summary of the consumer's right to receive a written account 

history upon request, including a telephone number to call to 

request a history, and

• A notice concerning error resolution? (12 CFR 205.18(c)(1))

60. Does the financial institution provide an annual notice concerning error 

resolution or, alternatively, an abbreviated notice with each electronic 

and written history? (12 CFR 205.18(c)(2))
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 16

61. Does the financial institution begin the 60-day period for reporting any 

unauthorized transfer under 12 CFR 205.6(b)(3) on the earlier of the date 

the consumer electronically accesses the consumer's account after the 

electronic history made available to the consumer reflects the transfer; or 

the date the financial institution sends a written history of the consumer's 

account transactions requested by the consumer in which the 

unauthorized transfer is first reflected? 

(12 CFR 205.18(c)(3))

NOTE: A financial institution may comply with the provision above by 

limiting the consumer's liability for an unauthorized transfer as provided 

under 12 CFR 205.6(b)(3) for any transfer reported by the consumer 

within 120 days after the transfer was credited or debited to the 

consumer's account.

62. Does the financial institution comply with the error resolution 

requirements in response to an oral or written notice of an error from the 

consumer that is received by the earlier of 60 days after the date the 

consumer electronically accesses the consumer's account after the 

electronic history made available to the consumer reflects the alleged 

error; or 60 days after the date the financial institution sends a written 

history of the consumer's account transactions requested by the consumer 

in which the alleged error is first reflected? (12 CFR 205.18(c)(4))

NOTE: The financial institution may comply with the requirements for 

resolving errors by investigating any oral or written notice of an error

from the consumer that is received by the institution within 120 days 

after the transfer allegedly in error was credited or debited to the 

consumer's account.
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 17

12 CFR 205.20 Requirements for Gift Cards and Gift 

Certificates

63. Does the institution offer gift certificates, store gift cards, general-use 

prepaid cards, loyalty, award, or promotional gift cards? If no, do not 

complete this section.

64. Determine if the institution offers consumers, primarily for personal, 

family, or household purposes, in a specified amount, a card, code, or 

other device on a prepaid basis, the following:

• Gift certificates – which may not be increased or reloaded in 

exchange for payment; and are redeemable upon presentation at a 

single merchant or an affiliated group of merchants for goods and 

services? [12 CFR 205.20(a)(1)]

• Store gift cards – which may be increased or reloaded, in exchange 

for payment; and are redeemable upon presentation at a single 

merchant or an affiliated group of merchants for goods and 

services? [12 CFR 205.20(a)(2)]

• General-use prepaid cards – which may be increased or reloaded, in 

exchange for payment; and are redeemable upon presentation at 

multiple, unaffiliated merchants for goods or services, or useable at 

automated teller machines? [12 CFR 205.20(a)(3)]

65. Do loyalty, award, or promotional gift cards as defined by 

[12 CFR 205.20(a)(4)] contain the following disclosures as applicable?

• A statement indicating that the card, code, or other device is issued 

for loyalty, award, or promotional purposes, which must be 

included on the front of the card, code, or other device 

[12 CFR 205.20(a)(4)(iii)(A)];

• The expiration date for the underlying funds, which must be 

included on the front of the card, code, or other device 

[12 CFR 205.20(a)(4)(iii)(B)];
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 18

• The amount of fees that may be imposed in connection with the 

card, code, or other device, and the conditions under which they 

may be imposed, which must be provided with the card, code, or 

other device [12 CFR 205.20(a)(4)(iii)(C)]; and

• A toll-free telephone number and, if one is maintained, a website, 

that a consumer may use to obtain fee information, which must be 

included on or with the card, code, or other device 

[12 CFR 205.20(a)(4)(iii)(D)]?

66. If the terms of the gift certificate, store gift card, or general-use prepaid 

card impose a dormancy, inactivity, or service fee as defined under 

[12 CFR 205.20(a)], please answer the following:

• Has there been activity with respect to the certificate or card, in the 

one- year period ending on the date on which the fee was imposed 

[12 CFR 205.20(d)(1)]; 

• As applicable, are the following, clearly and conspicuously stated 

on the gift certificate, store gift card, or general-use prepaid 

card***: 

o The amount of any dormancy, inactivity, or service fee that may 

be charged [12 CFR 205.20(d)(2)(i)];

o How often such a fee may be assessed 

[12 CFR 205.20(d)(2)(ii)]; and

o That such fee may be assessed for inactivity 

[12 CFR 205.20(d)(2)(iii)]?

• Is the dormancy, inactivity, or service fee imposed limited to one in 

any given calendar month [12 CFR 205.20(d)(3)]?

67. If the financial institution sells or issues a gift certificate, store gift card, 

or general-use prepaid card with an expiration date, please answer the 

following:

• Has the financial institution established policies and procedures to 

provide consumers with a reasonable opportunity to purchase a 

certificate or card with at least five years remaining until the 

certificate or card expiration date [12 CFR 205.20(e)(1)]? ***
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 19

• The expiration date for the underlying funds is at least the later of 

five years after the date the gift certificate was initially issued, or the 

date on which funds were last loaded to a store gift card or generaluse prepaid card; or the certificate or card expiration date, if any 

[12 CFR 205.20(e)(2)]?

68. If the financial institution sells or issues a gift certificate, store gift card, 

or general-use prepaid card with an expiration date, then are the 

following disclosures provided on the certificate or card, as applicable: 

***

• The expiration date for the underlying funds, or if the underlying 

funds do not expire, the fact that the funds do not expire 

[12 CFR 205.20(e)(3)(i)]

• A toll-free number and, if one is maintained, a website that a 

consumer may use to obtain a replacement certificate or card after the 

certificate or card expires if the underlying funds may be available 

[12 CFR 205.20(e)(3)(ii)]; and 

• Except where a non-reloadable certificate or card bears an expiration 

date that is at least seven years from the date of manufacture, a 

statement, disclosed with equal prominence and in close proximity to 

the certificate or card expiration date, that:

o The certificate or card expires, but the underlying funds either do 

not expire or expire later than the certificate or card 

[12 CFR 205.20(e)(3)(iii)(A)]; 

o The consumer may contact the issuer for a replacement card 

[12 CFR 205.20(e)(3)(iii)(B)]; and

o No fee or charge is imposed on the cardholder for replacing the 

gift certificate, store gift card, or general-use prepaid card or for 

providing the certificate or card holder with the remaining 

balance in some manner prior to the funds expiration date unless 

such certificate or card has been lost or stolen. 

[12 CFR 205.20(e)(4)]. 
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 20

69. Are the following disclosures provided in connection with a gift 

certificate, store gift card, or general-use prepaid card, as applicable: *** 

• For each type of fee that may be imposed in connection with the gift 

certificate or card (other than a dormancy, inactivity, or service fee 

subject to the disclosure requirements under [12 CFR 205.20(d)(2)]), 

the following information must be provided on or with the certificate 

or card:

o The type of fee [12 CFR 205.20(f)(1)(i)];

o The amount of the fee (or an explanation of how the fee will be 

determined) [12 CFR 205.20(f)(1)(ii)]; and

o The conditions under which the fee may be imposed 

[12 CFR 205.20(f)(1)(iii)].

• A toll-free telephone number and, if one is maintained, a website, 

that a consumer may use to obtain information about dormancy, 

inactivity, service, or each type of fee that may be imposed in 

connection with the certificate or card [12 CFR 205.20(f)(2)].

70. For cards issued prior to April 1, 2010, §§205.20 (c)(3), (d)(2), (e)(1), 

(e)(3), and (f) do not apply until January 31, 2011, if certain conditions 

are met. If applicable, determine that the issuer: 

• Complies with all other non-suspended provisions of the gift card 

rules; 

• Does not impose an expiration date with respect to the funds 

underlying such certificate or card and, at the consumer’s request, 

replaces such certificate or card if it has funds remaining, at no cost 

to the consumer; 

• Discloses through in-store signage, messages during customer service 

calls, websites, and general advertising, that:

o The underlying funds of such certificate or card do not expire; 

o Consumers holding such certificate or card have a right to a free 

replacement certificate or card, accompanied by the packaging and 

materials typically associated with such certificate or card; and

o Any dormancy, inactivity, or service fee for such certificate or 

card that might otherwise be charged will not be charged if such 

fees do not comply with Section 915 of the Electronic Fund 

Transfer Act.

• Determine that the above disclosures (i) are provided until January 

31, 2011, with respect to in-store signage and general advertising and 

(ii) are provided until January 31, 2013, with respect to messages 

during customer service calls and websites.
CFPB 

Examination Checklist EFTA

Yes No NA

CFPB FFIEC rev. 12/2010 EFTA 21

COMMENTS

[Click&type]
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 1

Truth in Savings Act

Regulation DD (12 CFR part 230), which implements the Truth in Savings Act (TISA), became 

effective in June 1993. An official staff commentary interprets the requirements of Regulation DD 

(12 CFR 230 (Supplement I)).

1 Since then, several amendments have been made to Regulation DD 

and the Staff Commentary, including changes effective January 1, 2010, concerning disclosures of 

aggregate overdraft and returned item fees on periodic statements and balance disclosures provided 

to consumers through automated systems. In addition, effective July 6, 2010, clarifications were 

made to the provisions related to overdraft services (NOTE: The effective date for the clarification 

to Section 230.11(a)(1)(i), requiring the term “Total Overdraft Fees” to be used, is October 1, 2010) 

(75 FR 31673).

The Dodd-Frank Act granted rulemaking authority under the Truth in Savings Act to the Consumer 

Financial Protection Bureau (CFPB) and, with respect to entities under its jurisdiction, granted 

authority to the CFPB to supervise for and enforce compliance with the Truth in Savings Act and its 

implementing regulations.2

 

The purpose of Regulation DD is to enable consumers to make informed decisions about their 

accounts at depository institutions through the use of uniform disclosures. The disclosures aid 

comparison shopping by informing consumers about the fees, annual percentage yield, interest rate, 

and other terms for deposit accounts. A consumer is entitled to receive disclosures under all of the 

following circumstances:

• When an account is opened.

• Upon request.

• When the terms of the account are changed.

• When a periodic statement is sent.

• For most time accounts, before the account matures. 

The regulation also includes requirements on the payment of interest, the methods of calculating the 

balance on which interest is paid, the calculation of the annual-percentage yield, and advertising.

 

1 For ease of reference, only the Federal Reserve’s implementing regulation is cited in this narrative. However, examiners should 

review an entity’s compliance with the applicable regulations in effect with respect to that entity.

2 Dodd-Frank Act §§ 1002(12)(P), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12)(P), 5514(b)-(c), and 5515(b)-(c).
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 2

Coverage (§ 230.1)

Regulation DD applies to all depository institutions, except credit unions, that offer deposit 

accounts to residents of any state. Branches of foreign institutions located in the United States are 

subject to Regulation DD if they offer deposit accounts to consumers. Edge Act and agreement 

corporations, and agencies of foreign institutions, are not depository institutions for purposes of 

Regulation DD.

In addition, persons who advertise accounts are subject to the advertising rules. For example, if a 

deposit broker places an advertisement offering consumers an account at a depository institution, 

the advertising rules apply to the advertisement, whether the account is to be held by the broker or 

directly by the consumer.

Definitions (§ 230.2)

Section 230.2 defines key terms used in Regulation DD. Among those definitions are the following:

Account (§ 230.2(a))

An account is a deposit account at a depository institution that is held by or offered to a consumer. 

It includes time, demand, savings, and negotiable order of withdrawal accounts. Regulation DD 

covers interest-bearing as well as noninterest-bearing accounts.

Advertisement (§ 230.2(b))

An advertisement is a commercial message, appearing in any medium, that promotes directly or 

indirectly (a) the availability or terms of, or a deposit in, a new account, and (b) for purposes of 

Sections 230.8(a) (misleading or inaccurate advertisements) and 230.11 (additional disclosure 

requirements for institutions advertising the payment of overdrafts), the terms of, or a deposit in, a 

new or existing account. An advertisement includes a commercial message in visual, oral, or print 

media that invites, offers, or otherwise announces generally to prospective customers the 

availability or terms of, or a deposit in, a consumer account. Examples of advertisements include 

telephone solicitations and messages on automated teller machine screens.

Annual Percentage Yield (§ 230.2(c))

An annual percentage yield is a percentage rate reflecting the total amount of interest paid on an 

account, based on the interest rate and the frequency of compounding for a 365-day period, or 366-

day period during leap years, and calculated according to the rules in Appendix A of Regulation 

DD. Interest or other earnings are not to be included in the annual percentage yield if the 

circumstances for determining the interest and other earnings may or may not occur in the future 

(see Appendix A, footnote 1).
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 3

Average Daily Balance Method (§ 230.2(d))

The average daily balance method is the application of a periodic rate to the average daily balance 

in the account for the period. The average daily balance is determined by adding the full amount of 

principal in the account for each day of the period and dividing that figure by the number of days in 

the period.

Board (§ 230.2(e))

The Board means the Board of Governors of the Federal Reserve System.

Bonus (§ 230.2(f))

A bonus is a premium, gift, award, or other consideration worth more than $10 (whether in the 

form of cash, credit, merchandise, or any equivalent) given or offered to a consumer during a year 

in exchange for opening, maintaining, renewing, or increasing an account balance. The term does 

not include interest, other consideration worth $10 or less given during a year, the waiver or 

reduction of a fee, or the absorption of expenses.

Business Day (§ 230.2(g))

A business day is a calendar day other than a Saturday, a Sunday, or any of the legal public 

holidays specified in 5 USC § 6103(a).

Consumer (§ 230.2(h))

A consumer is a natural person who holds an account primarily for personal, family, or household 

purposes, or to whom such an account is offered. The term does not include accounts held by a 

natural person on behalf of another in a professional capacity or accounts held by individuals as sole 

proprietors.

Daily Balance Method (§ 230.2(i))

The daily balance method is the application of a daily periodic rate to the full amount of principal 

in the account each day.

Depository Institution (§ 230.2(j))

The terms depository institution and institution are defined in Section 19(b)(1)(A)(i)-(vi) of the 

Federal Reserve Act (12 USC 461). Credit unions are defined in Section 19(b)(1)(A)(iv). Branches 

of foreign institutions located in the United States are subject to the regulation if they offer deposit 

accounts to consumers. Edge Act and agreement corporations, and agencies of foreign institutions, 

are not depository institutions for purposes of this regulation.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 4

Deposit Broker (§ 230.2(k))

A deposit broker is a person who is in the business of placing or facilitating the placement of 

deposits in an institution, as defined by Section 29(g) of the Federal Deposit Insurance Act (12 USC 

§ 1831f(g)).

Fixed-Rate Account (§ 230.2(l))

A fixed-rate account is an account for which the institution contracts to give at least 30 calendar 

days’ advance written notice of decreases in the interest rate.

Grace Period (§ 230.2(m))

A grace period is a period following the maturity of an automatically renewing time account during 

which the consumer may withdraw funds without being assessed a penalty.

Interest (§ 230.2(n))

Interest is any payment to a consumer or to an account for the use of funds in an account, 

calculated by applying a periodic rate to the balance. Interest does not include the payment of a 

bonus or other consideration worth $10 or less during a year, the waiver or reduction of a fee, or the 

absorption of expenses. 

Interest Rate (§ 230.2(o))

An interest rate is the annual rate of interest paid on an account and does not reflect compounding. 

For purposes of the account disclosures in Section 230.4(b)(1)(i), the interest rate may, but need not, 

be referred to as the “annual percentage rate” in addition to being referred to as the “interest rate.”

Passbook Savings Account (§ 230.2(p))

A passbook savings account is a savings account in which the consumer retains a book or other 

document in which the institution records transactions on the account. Passbook savings accounts 

include accounts accessed by preauthorized electronic fund transfers to the account. As defined in 

Regulation E, a preauthorized electronic fund transfer is an electronic fund transfer authorized in 

advance to recur at substantially regular intervals. Examples include an account that receives direct 

deposit of Social Security payments. Accounts permitting access by other electronic means are not 

passbook savings accounts and must comply with the requirements of Section 230.6 if statements 

are sent four or more times a year.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 5

Periodic Statement (§ 230.2(q))

A periodic statement is a statement setting forth information about an account (other than a time 

account or passbook savings account) that is provided to a consumer on a regular basis four or more 

times a year.

State (§ 230.2(r))

A state is a state, the District of Columbia, the commonwealth of Puerto Rico, and any territory or 

possession of the United States.

Stepped-Rate Account (§ 230.2(s))

A stepped-rate account is an account that has two or more interest rates that take effect in 

succeeding periods and are known when the account is opened.

Tiered-Rate Account (§ 230.2(t))

A tiered-rate account is an account that has two or more interest rates that are applicable to 

specified balance levels. A requirement to maintain a minimum balance to earn interest does not 

make an account a tiered-rate account.

Time Account (§ 230.2(u))

A time account is an account with a maturity of at least seven days in which the consumer 

generally does not have a right to make withdrawals for six days after the account is opened, unless 

the deposit is subject to an early withdrawal penalty of at least seven days’ interest on the amount 

withdrawn.

Variable-Rate Account (§ 230.2(v))

A variable-rate account is an account in which the interest rate may change after the account is 

opened, unless the institution contracts to give at least 30 calendar days’ advance written notice of 

rate decreases.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 6

General Disclosure Requirements (§ 230.3)

General Requirements (§ 230.3(a) and (b))

Section 230.3 outlines the general requirements for account disclosures and periodic-statement 

disclosures. Such disclosures are required to be:

• Clear and conspicuous;

• In writing;

• In a form the consumer may keep;

• Clearly identifiable for different accounts, if disclosures for different accounts are 

combined;

• Reflective of the terms of the legal obligation of the account agreement between the 

consumer and the depository institution;

• Available in English upon request if the disclosures are made in languages other than 

English; and

• Consistent in terminology when describing terms or features that are required to be 

disclosed.

Electronic Disclosures

Regulation DD disclosures may be provided to the consumer in electronic form, subject to 

compliance with the consumer consent and other applicable provisions of the Electronic Signatures 

in Global and National Commerce Act (E-Sign Act) (15 USC 7001 et seq.). 

The E-Sign Act does not mandate that institutions or consumers use or accept electronic records or 

signatures. It does, however, permit institutions to satisfy any statutory or regulatory requirements 

that information, such as Regulation DD disclosures, be provided in writing to a consumer by 

providing the information electronically after obtaining the consumer’s affirmative consent. 
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 7

But before the consumer can give consent, the institution must provide the consumer with a clear 

and conspicuous statement, informing the consumer of:

• Any right or option to have the information provided in paper or nonelectronic form.

• The right to withdraw the consent to receive information electronically and the 

consequences, including fees, of doing so.

• The scope of the consent (whether the consent applies only to a particular transaction or to 

identified categories of records that may be provided during the course of the parties’ 

relationship).

• The procedures to withdraw consent and to update information needed to contact the 

consumer electronically.

• The methods by which a consumer may obtain, upon request, a paper copy of an electronic 

record after having given consent to receive the information electronically and whether any 

fee will be charged.

Prior to consenting, the institution must provide the consumer with a statement of the hardware and 

software requirements for access to and retention of the electronic information. The consumer must 

consent electronically or confirm consent electronically in a manner that “reasonably demonstrates 

that the consumer can access information in the electronic form that will be used to provide the 

information that is the subject of the consent.”

After the consent, if an institution changes the hardware or software requirements such that a 

consumer may be prevented from accessing and retaining information electronically, the institution 

must notify the consumer of the new requirements and must allow the consumer to withdraw 

consent without charge.

Under Section 230.10(c), the disclosures required by Sections 230.4(a)(2) (Disclosures Upon 

Request) and 230.8 (Advertising) may be provided to the consumer in electronic form without 

regard to the consumer consent or other provisions of the E-Sign Act, as set forth in those sections 

of Regulation DD. For example, under Section 230.4(a)(2) (Disclosures Upon Request), if a 

consumer who is not present at the institution makes a request for disclosures, the institution may 

provide the disclosures electronically if the consumer agrees without regard to the consumer 

consent or other provisions of the E-Sign Act.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 8

Relation to Regulation E (§ 230.3(c))

Disclosures required by and provided in accordance with the Electronic Fund Transfer Act (15 USC 

§ 1693 et seq.) and its implementing Regulation E (12 CFR part 205), that are also required by 

Regulation DD, may be substituted for the disclosures required by this regulation. Compliance with 

Regulation E is deemed to satisfy the disclosure requirements of Regulation DD, such as when:

• An institution changes a term that triggers a notice under Regulation E, and uses the timing 

and disclosure rules of Regulation E for sending change-in-term notices.

• Consumers add an ATM access feature to an account, and the institution provides 

disclosures pursuant to Regulation E, including disclosure of fees (see 12 CFR 205.7).

• An institution, complying with the timing rules of Regulation E, discloses at the same time 

fees for electronic services (such as for balance inquiry fees at ATMs) required to be 

disclosed by this regulation but not by Regulation E.

• An institution relies on Regulation E’s rules regarding disclosure of limitations on the 

frequency and amount of electronic fund transfers, including security-related exceptions. 

But any limitations on intra-institutional transfers to or from the consumer’s other accounts 

during a given time period must be disclosed, even though intra-institutional transfers are 

exempt from Regulation E.

Other general disclosure requirements include the following:

Multiple Consumers (§ 230.3(d))

If an account is held by more than one consumer, the institution may make disclosures to any one of 

the consumers.

Oral Response to Inquiries (§ 230.3(e)) 

If an institution chooses to provide rate information orally, it must state the annual percentage yield 

and may state the interest rate. However, the institution may not state any other rate. The advertising 

rules do not cover an oral response to a rate inquiry.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 9

Rounding and Accuracy Rules for Rates and Yields 

(§ 230.3(f)) 

The rounding and accuracy requirements are as follows:

• Rounding – The annual percentage yield, the annual percentage yield earned, and the 

interest rate must be rounded to the nearest one-hundredth of one percentage point (.01%) 

and expressed to two decimal places. (For account disclosures, the interest rate may be 

expressed to more than two decimal places.) For example, if an annual percentage yield is 

calculated at 5.644 percent, it must be rounded down and disclosed as 5.64 percent, or if 

annual percentage yield is calculated at 5.645 percent, it must be rounded up and disclosed 

as 5.65 percent.

• Accuracy – The annual percentage yield (and the annual percentage yield earned) will be 

considered accurate if it is not more that one-twentieth of one percentage point (.05 percent) 

above or below the annual percentage yield (and the annual percentage yield earned) that are 

calculated in accordance with Appendix A of Regulation DD.

Account Disclosures (§ 230.4)

Section 230.4 covers the delivery and content of account disclosures both at the time an account is 

open and when requested by a consumer.

Delivery of Account Disclosures (§ 230.4(a))

Disclosures at Account Opening (§ 230.4(a)(1)) 

A depository institution must provide account disclosures to a consumer before an account is 

opened or a service is provided, whichever is earlier. (An institution is deemed to have provided a 

service when a fee, required to be disclosed, is assessed.) An institution must mail or deliver the 

account opening disclosures no later than ten business days after the account is opened or the 

service is provided, whichever is earlier, if the consumer: 

• Is not present when the account is opened or the service is provided, and

• Has not received the disclosures. 

If a consumer who is not present at the institution uses electronic means (for example, an Internet 

website) to apply to open an account or to request a service, the institutions must provide the 

disclosures before opening the account or providing the service.

Disclosures Upon Request (§ 230.4(a)(2)) 

A depository institution must provide full account disclosures, including complete fee schedules, to 

a consumer upon request. Institutions must comply with all requests for this information, whether or 

not the requester is an existing customer or a prospective customer. A response to an oral inquiry 
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 10

(by telephone or in person) about rates and yields or fees does not trigger the duty to provide 

account disclosures. However, when consumers ask for written information about an account 

(whether by telephone, in person, or by other means), the institution must provide disclosures, 

unless the account is no longer offered to the public. 

If the consumer makes the request in person, the institution must provide the disclosures at that 

time. If a consumer is not present when the request is made, the institution must mail or deliver the 

disclosures within a reasonable time after it receives the request. Ten business days is considered a 

reasonable time for responding to requests for account information that a consumer does not make 

in person, including requests made by electronic means (such as by electronic mail). 

If a consumer who is not present at the institution makes a request for account disclosures, including 

a request made by telephone, email, or via the institution’s website, the institution may send the 

disclosures in paper form or, if the consumer agrees, may provide the disclosures electronically, 

such as to an email address that the consumer provides for that purpose, or on the institution’s 

website, without regard to the consumer consent or other provisions of the E-Sign Act. The 

institution is not required to provide, nor is the consumer required to agree to receive, the 

disclosures required by Section 230.4(a)(2) in electronic form. 

When providing disclosures upon the request of a consumer, the institution has several choices of 

how to specify the interest rate and annual percentage yield. The institution may disclose the rate 

and yield offered:

• Within the most recent seven calendar days,

• As of an identified date, or

• Currently by providing a telephone number for consumers to call.

Further, when providing disclosures upon the request of a consumer, the institution may state the 

maturity of a time account as a term rather than a date. Describing the maturity of a time account as 

“1 year” or “6 months,” for example, illustrates a statement of the maturity as a term rather than a 

date (“January 10, 2010”).

Content of Account Disclosures (§ 230.4(b))

Account disclosures must include, as applicable, information on the following (see Appendix A and 

B of Regulation DD for information on the annual percentage yield calculation and for model 

clauses for account disclosures and sample forms):

Rate Information (§ 230.4(b)(1)) 

An institution must disclose both the “annual percentage yield” and the “interest rate,” using those 

terms. 

For fixed-rate accounts, an institution must disclose the period of time that the interest rate will be 

in effect. 
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 11

For variable-rate accounts, an institution must disclose all of the following:

• The fact that the interest rate and annual percentage yield may change.

• How the interest rate is determined.

• The frequency with which the interest rate may change.

• Any limitation on the amount the interest rate may change.

Compounding and Crediting (§ 230.4(b)(2)) 

An institution must disclose the frequency with which interest is compounded and credited. In cases 

where consumers will forfeit interest if they close an account before accrued interest is credited, an 

institution must state that interest will not be paid.

Balance Information (§ 230.4(b)(3)) 

An institution must disclose the following information about account balances: 

• Minimum balance requirements – An institution must disclose any minimum balance 

requirement to: 

 Open the account, 

 Avoid the imposition of a fee, or 

 Obtain the annual percentage yield disclosed. 

In addition, the institution must disclose how the balance is determined to avoid the imposition 

of a fee or to obtain the annual percentage yield.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 12

• Balance computation method – An explanation of the balance-computation method, 

specified in Section 230.7 of Regulation DD, that is used to calculate interest on the account. 

An institution may use different methods or periods to calculate minimum balances for 

purposes of imposing a fee and accruing interest. The institution must disclose each method 

and corresponding period.

• When interest begins to accrue – An institution must state when interest begins to accrue 

on noncash deposits. 

Fees (§ 230.4(b)(4)) 

An institution must disclose the amount of any fee that may be imposed in connection with the 

account (or an explanation of how the fee will be determined) and the conditions under which the 

fee may be imposed. Examples of fees that must be disclosed are:

• Maintenance fees, such as monthly service fees.

• Fees to open or to close an account.

• Fees related to deposits or withdrawals, such as fees for use of the institution’s ATMs.

• Fees for special services, such as stop-payment fees.

Institutions must state if fees that may be assessed against an account are tied to other accounts at 

the institution. For example, if an institution ties the fees payable on a NOW account to balances 

held in the NOW account and a savings account, the NOW account disclosures must state that fact 

and explain how the fee is determined.

An institution must specify the categories of transactions for which an overdraft fee may be 

imposed. For example, it is sufficient to state that the fee applies to overdrafts “created by check, inperson withdrawal, ATM withdrawal, or other electronic means.” However, it is insufficient to state 

that a fee applies “for overdraft items.”

Transaction Limitations (§ 230.4(b)(5)) 

An institution must disclose any limitations on the number or dollar amount of withdrawals or 

deposits. Examples of such limitations include:

• Limits on the number of checks that may be written on an account within a given time 

period.

• Limits on withdrawals or deposits during the term of a time account.

• Limits under Regulation D (Reserve Requirements on Depository Institutions) on the 

number of withdrawals permitted from money market deposit accounts by check to third 

parties each month.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 13

Features of Time Accounts (§ 230.4(b)(6)) 

For time accounts, an institution must disclose information about the following features:

• Time requirements – An institution must state the maturity date and, for “callable” time 

accounts, the date or circumstances under which an institution may redeem a time account at 

the institution’s option.

• Early withdrawal penalties – An institution must state the following: 

 If a penalty will or may be imposed for early withdrawal.

 How it is calculated.

 The conditions for its assessment. 

An institution may, but does not need to, use the term “penalty” to describe the loss of interest 

that consumers may incur for early withdrawal of funds from an account. 

Examples of early withdrawal penalties include:

 Monetary penalties, such as “$10.00” or “seven days’ interest plus accrued but 

uncredited interest.”

 Adverse changes to terms such as a lowering of the interest rate, annual percentage 

yield, or compounding frequency for funds remaining on deposit.

 Reclamation of bonuses.

• Withdrawal of interest prior to maturity – An institution must disclose the following, as 

applicable:

 A statement that the annual percentage yield assumes interest remains on deposit until 

maturity and that a withdrawal will reduce earnings for accounts where

⇒ Compounding occurs during the term, and 

⇒ Interest may be withdrawn prior to maturity, or
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 14

 A statement that interest cannot remain on deposit and that payout of interest is 

mandatory for accounts where:

⇒ The stated maturity is greater than one year,

⇒ Interest is not compounded on an annual or more frequent basis, 

⇒ Interest is required to be paid out at least annually, and 

⇒ The annual percentage yield is determined in accordance with Section E of Appendix 

A of Regulation DD.

• Renewal policies – An institution must state whether an account will, or will not, renew 

automatically at maturity. If it will, the statement must indicate whether a grace period will 

be provided and, if so, must indicate the length of that period. For accounts that do not 

renew automatically, the statement must indicate whether interest will be paid after maturity 

if the consumer does not renew the account.

Bonuses (§ 230.4(b)(7)) 

For bonuses, an institution must disclose: 

• The amount or type of any bonus.

• When the bonus will be provided.

• Any minimum balance and time requirements to obtain the bonus.

Subsequent Disclosures (§ 230.5)

Section 230.5 covers the required disclosures when the terms of an account change, resulting in a 

negative effect on the consumer. In addition, this section covers the required disclosures for both 

time accounts that automatically renew and have a maturity longer than one month and time 

accounts that do not renew automatically and have a maturity of longer than one year.

Change in Terms (§ 230.5(a))

Advance Notice Required (§ 230.5(a)(1)) 

An institution must give advance notice to affected consumers of any change in a term that is 

required to be disclosed if the change may reduce the annual percentage yield or adversely affect 

the consumer. The notice must include the effective date of the change and must be mailed or 

delivered at least 30 calendar days before the effective date of the change.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 15

No Notice Required (§ 230.5(a)(2)) 

An institution is not required to provide a notice for any of the following changes:

• For variable-rate accounts, any change in the interest rate and corresponding changes in the 

annual percentage yield.

• Any changes in fees assessed for check printing.

• For short-term time accounts, any changes in any term for accounts with maturities of one 

month or less.

• The imposition of account maintenance or activity fees that previously had been waived for 

a consumer when the consumer was employed by the depository institution, but who is no 

longer employed there.

• The expiration of a one-year period that was part of a promotion, described in the account 

opening disclosures, for example, to “waive $4.00 monthly service charges for one year.”

Notice for Time Accounts Longer Than One Month That 

Renew Automatically (§ 230.5(b))

For automatically renewing time accounts with maturities longer than one month, an institution 

must provide different disclosures depending on whether the maturity is longer than one year or 

whether the maturity is one year or less. The institution must provide all disclosures before 

maturity. We summarize the requirements in Table 1.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 16

TABLE 1

SUBSEQUENT NOTICE REQUIREMENTS FOR TIME ACCOUNTS

Maturity Automatically Renewable (Rollover) Non-automatically Renewable 

(Non-rollover)

> One Year Timing

(a) 30 calendar days before maturity, 

or

(b) 20 calendar days before end of grace period, if a 

grace period is at least 5 calendar days

Content

(a) Date existing account matures

(b) Disclosures for a new account (§ 230.4(b))

If terms have not been determined, indicate this 

fact, state the date when they will be determined, 

and provide a telephone number to obtain the terms 

(§ 230.5(b)(1)).

Timing

10 calendar days before maturity

Content

Maturity date, and whether or not interest will be 

paid after maturity (§ 230.5(c))

> One Month

and

< One Year

Timing

(a) 30 calendar days before maturity, 

or

(b) 20 calendar days before end of grace period, if 

a grace period is at least 5 calendar days

Content

(a) Disclosures required under § 230.5(b)(1),

or 

(b) Date of maturities of existing and new 

account, any change in terms, and a difference 

in terms between new account and ones of 

existing account.

If terms have not been determined, indicate 

this fact, state the date when they will be 

determined, and provide a telephone number 

to obtain the terms (§ 230.5(b)(2)).

No subsequent notice required
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 17

Maturities Longer Than One Year (§ 230.5(b)(1)) 

If the maturity is longer than one year, the institution must provide the date the existing account 

matures and the required account disclosures for a new account, as described in Section 230.4(b). If 

the interest rate and annual percentage yield that will be paid for the new account are unknown 

when disclosures are provided, the institution must state the following: 

• That those rates have not yet been determined.

• The date when they will be determined.

• A telephone number for consumers to call to obtain the interest rate and the annual 

percentage yield for the new account.

Maturities Longer Than One Month but No More Than One Year

(§ 230.5(b)(2))

If the maturity is longer than one month but less than or equal to one year, the institution must 

either:

• Provide the disclosures required in Section 230.5(b)(1) for accounts longer than one year; or

• Disclose to the consumer:

 The date the existing account matures and the new maturity date if the account is 

renewed;

 The interest rate and the annual percentage yield for the new account if they are known. 

If the rates have not yet been determined, the institution must disclose:

⇒ The date when they will be determined, and 

⇒ A telephone number the consumer may call to obtain the interest rate and the annual 

percentage yield for the new account; and 

 Any difference in the terms of the new account as compared to the terms required to be 

disclosed for the existing account.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 18

Delivery (§ 230.5(b))

The institution must mail or deliver all disclosures at least 30 calendar days before maturity of the 

existing account. Alternatively, the institution may mail or deliver the disclosures at least 20 

calendar days before the end of the grace period on the existing account, provided a grace period of 

at least five calendar days is allowed.

Notice for Time Accounts Longer Than One Year That Do Not 

Renew Automatically (§ 230.5(c))

For time accounts with maturity longer than one year that do not renew automatically at maturity, 

an institution must disclose to consumers the maturity date and whether interest will be paid after 

maturity. The institution must mail or deliver the disclosures at least 10 calendar days before 

maturity of the existing account. The requirements are summarized in Table 1.

Periodic Statement Disclosures (§ 230.6)

Regulation DD does not require institutions to provide periodic statements. However, for 

institutions that mail or deliver periodic statements, Section 230.6 sets forth specific information 

that must be included in a periodic statement. 

General Requirements (§ 230.6(a))

The statement must include the following disclosures:

Annual Percentage Yield Earned (§ 230.6(a)(1))

An institution must state the annual percentage yield earned during the statement period, using that 

term, and calculated according to Appendix A of Regulation DD.

Amount of Interest (§ 230.6(a)(2))

An institution must state the dollar amount of interest earned during the statement period, whether 

or not it was credited. In disclosing interest earned for the period, an institution must use the term 

“interest” or terminology such as:

• “Interest paid,” to describe interest that has been credited; or

• “Interest accrued” or “interest earned,” to indicate that interest is not yet credited.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 19

Fees Imposed (§ 230.6(a)(3)) 

An institution must report any fees that are required to be disclosed and that were debited to the 

account during the statement period, even if assessed for an earlier period. The fees must be 

itemized by type and dollar amounts. When fees of the same type are imposed more than once in a 

statement period, an institution may itemize each fee separately or group the fees together and 

disclose a total dollar amount for all fees of that type. When fees of the same type are grouped 

together, the description must make clear that the dollar figure represents more than a single fee, for 

example, “total fees for checks written this period.” The Staff Commentary provides examples of 

fees that may not be grouped together. For example, an institution must separately identify whether 

a fee was for the payment of an overdraft or for returning the item unpaid.

Total overdraft and returned item fees, if any, must also be disclosed on the periodic statement. An 

institution must provide totals for fees for the payment of overdrafts and totals for items returned 

unpaid, both for the statement period and for the calendar year to date. See Section 230.11(a)(1) and 

(2). (The institution may, however, continue to itemize overdraft and returned item fees.)

Length of Period (§ 230.6(a)(4))

An institution must indicate the total number of days in the statement period, or the beginning and 

ending dates of the period. Institutions providing the beginning and ending dates of the period must 

make clear whether both dates are included in the period.

Combined Statements (Staff Commentary § 230.6(a)-3) 

Institutions may provide information about an account (for example, a Money Market Deposit 

Account) on the periodic statement for another account (such as a Negotiable Order of Withdrawal 

account) without triggering the disclosures required by this section, as long as:

• The information is limited to the account number, the type of account, or balance 

information, and

• The institution also provides a periodic statement complying with this section for each 

account. 

Aggregate Fee Disclosure (§ 230.6(a)(5))

• If an institution charges a consumer overdraft and returned item fees, it must disclose them 

on the consumer’s periodic statement as required by Section 230.11(a).
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 20

Special Rule for Average Daily Balance Method (§ 230.6(b))

Section 230.6 has special periodic statement requirements for an institution using the average daily 

balance method and calculating interest for a period other than the statement period. In these 

situations, an institution must calculate and disclose the annual percentage yield earned and amount 

of interest earned based on the time period used rather than the statement period. In addition, when 

disclosing the length of period requirement on the periodic statement, an institution must state this 

information for the statement period as well as the interest-calculation period. See Staff 

Commentary for examples.

Payment of Interest (§ 230.7)

Section 230.7 covers the payment of interest, including how to determine the balance on which to 

pay interest, the daily periodic rate to use, and the date interest begins to accrue.

Permissible Methods to Determine Balance to Calculate Interest

(§ 230.7(a)(1))

An institution must calculate interest on the full amount of principal in an account for each day by 

using one of the following methods:

• Daily balance method, where the daily periodic rate is applied to the full amount of 

principal in the account each day.

• Average daily balance method, where a periodic rate is applied to the average daily 

balance in the account for the period. The average daily balance is determined by adding the 

full amount of principal in the account for each day of the period and dividing that figure by 

the number of days in the period.

The following are prohibited calculation methods:

• Ending-balance method, where interest is paid on the balance in the account at the end of 

the period.

• Low-balance method, where interest is paid based on the lowest balance in the account for 

any day in that period.

• Investable-balance method, where interest is paid on a percentage of the balance, 

excluding the amount set aside for reserve requirements.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 21

Use of 365-day basis (Staff Commentary § 230.7(a)(1)-2)

Institutions may apply a daily periodic rate greater than 1/365 of the interest rate – such as 1/360 of 

the interest rate – as long as it is applied 365 days a year.

LEAP YEAR (STAFF COMMENTARY § 230.7(A)(1)-4)

Institutions may apply a daily rate of 1/366 or 1/365 of the interest rate for 366 days in a leap year, 

if the account will earn interest for February 29. 

MATURITY OF TIME ACCOUNTS (STAFF COMMENTARY § 230.7(A)(1)-5)

Institutions are not required to pay interest after time accounts mature.

DORMANT ACCOUNTS (STAFF COMMENTARY § 230.7(A)(1)-6)

Institutions must pay interest on funds in an account, even if inactivity or the infrequency of 

transactions would permit the institution to consider the account to be “inactive” or “dormant” (or 

similar status) as defined by state, other laws, or the account contract.

Permissible Methods to Determine Minimum Balance to Earn Interest 

(§ 230.7(a)(2))

If an institution requires a minimum balance to earn interest, it must use the same method to 

determine the required minimum balance as it uses to determine the balance on which interest is 

calculated. For example, if an institution requires a $300 minimum balance that would be 

determined by using the average daily balance method, then it must calculate interest based on the 

average daily balance method. Further, an institution may use an additional method that is 

unequivocally beneficial to the consumer.

BALANCES BELOW THE MINIMUM (STAFF COMMENTARY § 230.7(A)(2)-1 AND 2)

An institution that requires a minimum balance may choose not to pay interest for days or period 

when the balance drops below the required minimum, whether they use the daily-balance method or 

the average daily balance method to calculate interest.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 22

PAYING ON FULL BALANCE (STAFF COMMENTARY § 230.7(A)(2)-4)

Institutions must pay interest on the full balance in the account that meets the required minimum 

balance. For example, if $300 is the minimum daily balance required to earn interest, and a 

consumer deposits $500, the institution must pay the stated interest rate on the full $500 and not just 

on $200.

MINIMUM BALANCE NOT AFFECTING INTEREST (STAFF COMMENTARY §

230.7(A)(2)-7)

Institutions may use the daily balance, average daily balance, or any other computation method to 

calculate minimum-balance requirements that do not involve the payment of interest. For example, 

an institution may use any computation method to compute minimum balances for assessing fees.

Compounding and Crediting Policies (§ 230.7(b))

This section does not require institutions to compound or credit interest at any particular frequency. 

Institutions choosing to compound interest may compound or credit interest annually, semiannually, quarterly, monthly, daily, continuously, or on any other basis.

An institution may choose not to pay accrued interest if consumers close an account prior to the date 

accrued interest is credited, as long as the institution has disclosed this practice in the initial account 

disclosures.

Date Interest Begins to Accrue (§ 230.7(c))

Interest shall begin to accrue not later than the business day specified for interest-bearing accounts 

in Section 606 of the Expedited Funds Availability Act, which states:

“... interest shall accrue on funds deposited in an interest-bearing account at a depository 

institution beginning not later than the business day on which the depository institution receives 

provisional credit for such funds.”

Interest shall accrue until the day funds are withdrawn.

Advertising (§ 230.8)

Section 230.8 contains account advertising requirements, including overall general rules and rules 

for special account features. In addition, the section describes advertising involving certain types of 

media and in-house posters that are exempt from Regulation DD’s advertising requirements.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 23

General Advertising Rules (§ 230.8(a) and (b))

Misleading or Inaccurate Advertising (§ 230.8(a))

An institution may not advertise in a way that is misleading or inaccurate or misrepresents its 

deposit contract. In addition, an advertisement may not use the word “profit” in referring to interest 

paid on an account. 

An institution’s advertisement may not refer to or describe an account as “free” or “no cost” (or 

contain a similar term such as “fees waived”) if a maintenance or activity fee may be imposed on 

the account. Examples of such maintenance or activity fees include:

• Any fee imposed when a minimum-balance requirement is not met, or when consumers 

exceed a specified number of transactions.

• Transaction and service fees that consumers reasonably expect to be imposed on a regular 

basis.

• A flat fee, such as a monthly service fee.

• Fees imposed to deposit, withdraw, or transfer funds, including per-check or per-transaction 

charges (for example, 25 cents for each withdrawal, whether by check or in person). 

Examples of fees that are not maintenance or activity fees include:

• Fees not required to be disclosed under Section 230.4(b)(4).

• Check-printing fees.

• Balance-inquiry fees.

• Stop-payment fees and fees associated with checks returned unpaid.

• Fees assessed against a dormant account.

• Fees for ATM or electronic transfer services (such as preauthorized transfers or home 

banking services) not required to obtain an account.

If an account (or a specific account service) is free only for a limited period of time (for example, 

for one year following the account opening) the account (or service) may be advertised as free if the 

time period is also stated.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 24

If an electronic advertisement (such as an advertisement appearing on a website) displays a 

triggering term (such as a bonus or annual percentage yield), described elsewhere in section 230.8, 

the advertisement must clearly refer the consumer to the location where the additional required 

information begins. For example, an advertisement that includes a bonus or annual percentage yield 

may be accompanied by a link that directly takes the consumer to the additional information. As 

discussed in Section 230.3(a), electronic advertising disclosures may be provided to the consumer in 

electronic form without regard to the consumer consent or other provisions of the E-Sign Act.

The Staff Commentary provides the following examples of advertisements that would ordinarily be 

misleading, inaccurate, or misrepresent the deposit contract:

• Representing an overdraft service as a “line of credit,” unless the service is subject to the 

Board’s Regulation Z, 12 part CFR 226.

• Representing that the institution will honor all checks or authorize payment of all 

transactions that overdraw an account, with or without a specified dollar limit, when the 

institution retains discretion at any time not to honor checks or authorize transactions.

• Representing that consumers with an overdrawn account are allowed to maintain a negative 

balance when the terms of the account’s overdraft service require consumers promptly to 

return the deposit account to a positive balance.

• Describing an institution’s overdraft service solely as protection against bounced checks 

when the institution also permits overdrafts for a fee for overdrawing accounts by other 

means, such as ATM withdrawals, debit card transactions, or other electronic fund transfers.

• Advertising an account-related service for which the institution charges a fee in an 

advertisement that also uses the word “free” or “no cost” (or a similar term) to describe the 

account, unless the advertisement clearly and conspicuously indicates that there is a cost 

associated with the service. If the fee is a maintenance or activity fee under section 

230.8(a)(2), however, an advertisement may not describe the account as “free” or “no cost” 

(or contain a similar term) even if the fee is disclosed in the advertisement.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 25

Advertising Rate Information (§ 230.8(b))

When an institution states a rate of return in an advertisement, it must do the following:

• State the rate as an “annual percentage yield,” using that term.

• If the advertisement uses the abbreviation “APY,” state the term “annual percentage yield” 

at least once in the advertisement.

• If the advertisement uses the term “interest rate,” use the term in conjunction with, but not 

more conspicuously than, the related annual percentage yield.

• It may not state any other rate except “annual percentage yield” or “interest rate”.

• Round the annual percentage yield, the annual percentage yield earned, and the interest rate 

to the nearest one-hundredth of one percentage point (.01%) and express them to two 

decimal places. 

An advertisement for a tiered-rate account that states an annual percentage yield must also state the 

annual percentage yield for each tier, along with corresponding minimum-balance requirements.

An advertisement for a stepped-rate account that states an interest rate must state all the interest 

rates and the time period that each rate is in effect.

Required Advertising for Special Account Features 

(§ 230.8(c))

If an institution advertises an annual percentage yield for a product and the product includes one of 

the features listed in Sections 230.8(c)(1)-(6), then the institution must clearly and conspicuously 

disclose the information outlined in Sections 230.8(c)(1)-(6) as noted below. However, these 

requirements do not necessarily apply if the situation falls under the exemptions of Section 

230.8(e).

Variable Rates (§ 230.8(c)(1)) 

For variable-rate accounts, the advertisement must state that the rate may change after the account is 

opened.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 26

Time Annual Percentage Yield (APY) is Offered (§ 230.8(c)(2))

The advertisement must include the period of time during which the annual percentage yield will be 

offered. Alternatively, the advertisement may state that the annual percentage yield is accurate as of 

a specified date. The date must be recent in relation to the publication or media broadcast used for 

the advertisement, taking into account the particular circumstances or production deadlines 

involved. An advertisement may refer to the annual percentage yield as being accurate as of the date 

of publication, if the date is on the publication itself.

Minimum Balance (§ 230.8(c)(3))

For accounts that have a required minimum balance, the advertisement must state the minimum 

balance required to obtain the advertised annual percentage yield. For tiered-rate accounts, the 

advertisement must state the minimum balance required for each tier in close proximity and with 

equal prominence to the applicable annual percentage yield.

Minimum Opening Deposit (§ 230.8(c)(4)) 

For an account that requires a minimum deposit to open the account, the advertisement must state 

the minimum deposit required to open the account, if it is greater than the minimum balance 

necessary to obtain the advertised annual percentage yield.

Effect of Fees (§ 230.8(c)(5))

An advertisement must state that fees could reduce the earnings on the account. This requirement 

only applies to maintenance or activity fees.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 27

Features of Time Accounts (§ 230.8(c)(6))

For time accounts, the advertisement must include:

• Term of the account.

• Early withdrawal penalties – a statement that a penalty will or may be imposed for early 

withdrawal.

• Required interest payouts – a statement that interest cannot remain on deposit and that 

payout of interest is mandatory for noncompounding time accounts with the following 

features: 

 The stated maturity is greater than one year.

 Interest is not compounded on an annual or more frequent basis.

 Interest is required to be paid out at least annually.

 The annual percentage yield is determined in accordance with Section E of Appendix A 

of Regulation DD.

Bonuses (§ 230.8(d))

If an institution states a bonus in an advertisement, the advertisement must state clearly and 

conspicuously the following information, if applicable to the advertised product: 

• “Annual percentage yield,” using that term.

• Time requirement to obtain the bonus.

• Minimum balance required to obtain the bonus.

• Minimum balance required to open the account, if it is greater than the minimum balance 

necessary to obtain the bonus.

• Time when the bonus will be provided.

However, these requirements do not necessarily apply if the situation falls under the exemptions of 

Section 230.8(e). In addition, general statements such as “bonus checking” or “get a bonus when 

you open a checking account” do not trigger the bonus disclosures.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 28

Exemption for Certain Advertisements (§ 230.8(e))

Section 230.8(e) exempts certain types of media and certain indoor signs from some of the section’s 

advertising rules.

Media Exemptions (§ 230.8(e)(1)) 

If an institution advertises through one of the following media, the advertisement does not need to 

include information required under certain Section 230.8 rules, as outlined below:

• Exempted media 

 Broadcast or electronic media, such as television or radio. However, the exemption does 

not extend to Internet and email advertisements.

 Outdoor media, such as billboards.

 Telephone response machines. However, solicitations for a tiered-rate account made 

through telephone-response machines must provide the annual percentage yields and the 

balance requirements applicable to each tier.

• Exempted advertising requirements 

 Information required for special account features involving variable rates, time an annual 

percentage yield is offered, minimum opening deposit, effect of fees, and early 

withdrawal penalties for time accounts.

 When bonuses are advertised, information required related to a minimum balance to 

open an account (if it is greater than the minimum balance necessary to obtain the bonus) 

and related to when a time the bonus will be provided.

Indoor Signs (§ 230.8(e)(2)) 

If an institution posts account information on signs inside its premises (or the premises of a deposit 

broker), the postings are exempt from the advertising requirements for: 

• Permissible rates

• When additional disclosures are required

• Bonuses

• Certain media exemption
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 29

If a sign, falling under this exemption, states a rate of return, it must:

• State the rate as an “annual percentage yield,” using that term or the term “APY.” The sign 

must not state any other rate, although the related interest rate may be stated.

• Contain a statement advising consumers to contact an employee for further information 

about applicable fees and terms.

Indoor signs include advertisements displayed on computer screens, banners, preprinted posters, 

and chalk or peg boards. Any advertisement inside the premises that can be retained by a consumer 

(such as a brochure or a printout from a computer) is not an indoor sign.

Additional Disclosures in Connection With the Payment of Overdrafts

(§ 230.8(f))

In addition to the general requirement that advertisements not be misleading, an institution that 

promotes the payment of overdrafts in an advertisement must also include in the advertisement the 

disclosures required under Section 230.11(b).

Record Retention (§ 230.9(c))

Section 230.9(c) covers the record retention requirements in order for an institution to demonstrate 

compliance with Regulation DD, including rate information, advertising, and providing disclosures 

to consumers at the appropriate time (including upon a consumer’s request).

Timing

Under Regulation DD, an institution must retain records that evidence compliance for a minimum 

of two years after the date that disclosures are required to be made or an action is required to be 

taken. In addition, if required by its supervising agency, an institution may need to retain records for 

a longer time period.

An institution may demonstrate its compliance by:

• Establishing and maintaining procedures for paying interest and providing timely 

disclosures.

• Retaining sample disclosures for each type of account offered to consumers such as accountopening disclosures, copies of advertisements, and change-in-term notices; and information 

regarding the interest rates and annual percentage yields offered.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 30

Methods of Retaining Evidence

An institution must be able to reconstruct the required disclosures and other required actions, but 

does not need to maintain hard copies of disclosures and other records. It may keep records 

evidencing compliance in microfilm, microfiche, or other methods that reproduce records accurately 

(including computer files).

Payment of Interest

An institution must retain sufficient rate and balance information to permit the verification of 

interest paid on an account, including the payment of interest on the full principal balance.

Section 230.10 – [Reserved] 

Additional Disclosure Requirements for Overdraft 

Services (§ 230.11)

Section 230.11 contains periodic statement and advertising requirements for certain discretionary

overdraft services. The requirements address concerns about the uniformity and adequacy of 

information provided to consumers when they overdraw their deposit accounts. Specifically, they 

address certain types of services – sometimes referred to as “bounced-check protection” or 

“courtesy overdraft protection” – which institutions offer to pay consumers’ checks and other items

when there are insufficient funds in the account. The requirements apply to all depository 

institutions, regardless of whether they promote their overdraft services. 

Periodic Statement Disclosures (§ 230.11(a))

Disclosure of Total Fees (§ 230.11(a)(1)) 

The institution must disclose on its periodic statements (if it provides periodic statements) separate 

totals for the statement period and for the calendar year to date for: 

• The total dollar amount for all fees or charges imposed on the account for paying checks or 

other items when there are insufficient or unavailable funds and the account becomes 

overdrawn, using the term “Total Overdraft Fees” (the requirement to use the term “Total 

Overdraft Fees” is effective October 1, 2010), and

• The total dollar amount for all fees or charges imposed on the account for returning items 

unpaid.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 31

The aggregate fee disclosures must be placed in close proximity to the disclosure of any fee(s) that 

may be imposed in connection with the account and must use a substantially similar format as 

shown below: (see Appendix B of the regulation). The table must contain lines (or similar markings 

such as asterisks) inside the table to divide the columns and rows.

Total for this period Total year-to-date

Total Overdraft Fees $60.00 $150.00

Total Returned Item Fees 0.00 30.00

The total dollar amount for paying overdrafts includes per-item fees as well as interest charges, 

daily or other periodic fees, or fees charged for maintaining an account in overdraft status, whether 

the overdraft is by check, debit card transaction, or by other transaction type. It also includes fees 

charged when there are insufficient funds because previously deposited funds are subject to a hold 

or are uncollected. It does not include fees for transferring funds from another account of the 

consumer to avoid an overdraft, or fees charged under a service subject to Regulation Z, 12 CFR

226.

The total dollar amount for all fees for returning items unpaid must include all fees charged to the 

account for dishonoring or returning checks or other items drawn on the account. The institution 

must disclose separate totals for the statement period and for the calendar year-to-date. Fees 

imposed when deposited items are returned are not included. Institutions may use terminology such 

as ‘‘returned item fee’’ or ‘‘NSF fee’’ to describe fees for returning items unpaid.

In the case of waived fees, an institution may provide a statement for the current period reflecting 

that fees imposed during a previous period were waived and credited to the account. Institutions 

may, but are not required to, reflect the adjustment in the total for the calendar year-to-date and in 

the applicable statement period. For example, if an institution assesses a fee in January and refunds 

the fee in February, the institution could disclose a year-to-date total reflecting the amount credited, 

but it should not affect the total disclosed for the February statement period, because the fee was not 

assessed in the February statement period. If an institution assesses and then waives and credits a 

fee within the same cycle, the institution may, at its option, reflect the adjustment in the total 

disclosed for fees imposed during the current statement period and for the total for the calendar 

year-to-date. Thus, if the institution assesses and waives the fee in the February statement period, 

the February fee total could reflect a total net of the waived fee. 

The disclosures under this section must be included on periodic statements provided by an 

institution starting the first statement period that began after January 1, 2010. For example, if a 

consumer’s statement period typically closes on the 15th of each month, an institution must provide 

the disclosures required by this section on subsequent periodic statements for that consumer 

beginning with the statement reflecting the period from January 16, 2010, to February 15, 2010.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 32

Advertising Disclosures for Overdraft Services (§ 230.11(b))

Disclosures (§ 230.11(b)(1)) 

Unless an exception in Section 230.11(b)(2)-(4) applies, any advertisement promoting the payment 

of overdrafts must disclose in a clear and conspicuous manner all of the following:

• The fee(s) for the payment of each overdraft.

• The categories of transactions for which a fee may be imposed for paying an overdraft.

• The time period by which the consumer must repay or cover any overdraft.

• The circumstances under which the institution will not pay an overdraft. It is sufficient to 

state, as applicable, “Whether your overdrafts will be paid is discretionary, and we reserve 

the right not to pay. For example, we typically do not pay overdrafts if your account is not in 

good standing, or you are not making regular deposits, or you have too many overdrafts.”

Communications Not Subject to Additional Advertising Disclosures 

(§ 230.11(b)(2)) 

The advertising disclosure rules for overdraft services do not apply in the following circumstances:

• An advertisement promoting a service where the institution’s payment of overdrafts would 

be agreed upon in writing and subject to Regulation Z (12 CFR part 226).

• A communication by an institution about the payment of overdrafts in response to a 

consumer-initiated inquiry about deposit accounts or overdrafts. However, providing 

information about the payment of overdrafts in response to a balance inquiry made through 

an automated system, such as a telephone response machine, ATM, or an institution’s 

Internet site, is not a response to a consumer-initiated inquiry that is exempt from the 

advertising disclosures.

• An advertisement made through broadcast or electronic media, such as television or radio. 

However, this exception does not apply to advertisements posted on an institution’s Internet 

site, on an ATM screen, provided on telephone-response machines, or sent by electronic 

mail.

• An advertisement made on outdoor media, such as billboards.

• An ATM receipt.

• An in-person discussion with a consumer.

• Disclosures required by federal or other applicable law.

• Information included on a periodic statement or on a notice informing a consumer about a 

specific overdrawn item or the amount the account is overdrawn.

• A term in a deposit account agreement discussing the institution’s right to pay overdrafts.
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 33

• A notice provided to a consumer, such as at an ATM, that completing a requested 

transaction may trigger a fee for overdrawing an account, or a general notice that items 

overdrawing an account may trigger a fee.

• Informational or educational materials concerning the payment of overdrafts if the materials 

do not specifically describe the institution’s overdraft service.

• An opt-out or opt-in notice regarding the institution’s payment of overdrafts or provision of 

discretionary overdraft services.

Exception for ATM Screens and Telephone Response Machines (§ 

230.11(b)(3)) 

Any advertisement made on an ATM screen or using a telephone response machine is not required 

to include the following:

• The categories of transactions for which a fee may be imposed for paying an overdraft.

• The circumstances under which the institution will not pay an overdraft.

Exception for Indoor Signs (§ 230.11(b)(4)) 

The advertising requirement to disclose fees for the payment of each overdraft does not apply to 

advertisements for the payment of overdrafts on indoor signs, if the indoor sign contains a clear and 

conspicuous statement that:

• Fees may apply, and 

• Consumers should contact an employee for further information about applicable fees and 

terms. 

An indoor sign covered under this exception is one described in Section 230.8(e)(2) and the 

accompanying Staff Commentary. In addition to the Staff Commentary’s examples of 

advertisements that are not considered indoor signs, an ATM screen is not considered an indoor 

sign for purposes of the overdraft disclosure requirements.

Account Balance Disclosures (§ 230.11(c))

In general, Section 230.11(c) covers how an institution displays a consumer’s account balance 

information on automated systems, such as an ATM, when the institution will advance additional 

funds to cover insufficient or unavailable funds in a consumer’s account. Specifically, if an 

institution discloses balance information to a consumer through an automated system, the disclosed 

balance may not include additional amounts that the institution may provide to cover an item when 

there are insufficient or unavailable funds in the consumer’s account. This requirement covers 

additional funds that an institution may provide under a service provided at the institution’s own 

discretion, a service subject to Regulation Z (12 CFR 226), or a service to transfer funds from 

another account of the consumer. However, the institution may, at its option, disclose an additional, 

second account balance that would include funds provided by the institution, if the institution 

prominently states that any such second balance includes funds that the institution may provide to 
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 34

cover insufficient or unavailable funds in the consumer’s account and, if applicable, that additional

funds are not available for all transactions.

Additional amounts that may be included in balance. The balance may, but need not, include 

funds that are deposited in the consumer’s account, such as from a check, that are not yet made 

available for withdrawal in accordance with the funds availability rules under Regulation CC (12 

CFR 229). In addition, the balance may, but need not, include funds that are held by the institution 

to satisfy a prior obligation of the consumer (for example, to cover a hold for an ATM or debit card 

transaction that has been authorized but for which the bank has not settled).

Retail sweep programs. When disclosing a transaction account balance, an institution is not 

required to exclude funds from the consumer’s balance that may be transferred from another 

account pursuant to a retail sweep account. In a retail sweep program, an institution establishes two 

legally distinct subaccounts, a transaction subaccount and a savings subaccount. These two accounts 

together make up the consumer’s account. Retail sweep account programs typically:

• Comply with Regulation D,

• Prevent direct access by the consumer to the nontransaction subaccount that is part of the 

retail sweep program, and

• Document on the consumer’s periodic statements the account balance as the combined 

balance in the subaccounts.

Disclosure of second balance. If an institution discloses additional balances that include funds that 

may be provided to cover an overdraft, the institution must prominently state that the additional 

balance(s) includes additional overdraft funds. The institution may not simply state, for instance, 

that the second balance is the consumer’s ‘‘available balance,’’ or contains ‘‘available funds.’’ 

Rather, the institution should provide enough information to convey that the second balance 

includes funds that the institution may provide to cover insufficient or unavailable funds. For 

example, the institution may state that the balance includes ‘‘overdraft funds.’’ Where a consumer 

has not opted into (or as applicable, has opted out of) the institution’s discretionary overdraft 

service, any additional balance disclosed should not include funds that otherwise might be available 

under that service. Where a consumer has not opted into (or as applicable, has opted out of) the 

institution’s discretionary overdraft service for some, but not all transactions (e.g., the consumer has 

not opted into overdraft services for ATM and one-time debit card transactions), an institution that 

includes funds from its discretionary overdraft service in the balance should convey that the 

overdraft funds are not available for all transactions. For example, the institution could state that 

overdraft funds are not available for ATM and one-time debit card transactions. Similarly, if funds

are not available for all transactions pursuant to a service subject to the Board’s Regulation Z (12 

CFR 226) or a service that transfers funds from another account, a second balance that includes 

such funds should also indicate this fact.

Automated systems. The balance disclosure requirement applies to any automated system through 

which the consumer requests a balance, including, but not limited to, a telephone response system, 

the institution’s Internet site, or an ATM. The requirement applies whether the institution discloses 
CFPB Consumer 

Laws and Regulations TISA

CFPB FFIEC Rev. 9/2010 TISA 35

a balance through an ATM owned or operated by the institution or through an ATM not owned or 

operated by the institution (including an ATM operated by a non-depository institution). If the 

balance is obtained at an ATM, the requirement also applies whether the balance is disclosed on the 

ATM screen or on a paper receipt.

Effect on State Laws (Regulation DD - Appendix C)

Regulation DD preempts state law requirements that are inconsistent with the requirements of the 

Truth in Savings Act (TISA) or Regulation DD. A state law is inconsistent if it contradicts the 

definitions, disclosure requirements, or interest-calculation methods outlined in the act or the 

regulation. The regulation also provides that interested parties may request the Board to determine 

whether a state law is inconsistent with the TISA.

References

Laws

12 USC 4301 et seq. Truth in Savings Act

12 USC 4005 et seq. Expedited Funds Availability Act

15 USC 7001 et seq. Electronic Signatures in Global and National Commerce Act (E-Sign Act)

Regulations

Federal Reserve Board Regulations (12 CFR)

Part 205 Electronic Fund Transfer (Regulation E)

Part 229 Availability of Funds and Collection of Checks (Regulation CC)

Part 230 Truth in Savings (Regulation DD)
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 1

TRUTH IN SAVINGS ACT

EXAMINATION OBJECTIVES

 To determine the institution’s compliance with 

Regulation DD,1 including the requirements to 

provide full account disclosures (for example, fee schedules) to consumers to open an account and upon request and including the requirements covering overdraft payment 

disclosures and advertising.

 To assess the quality of the institution’s compliance risk management systems and its policies and procedures for implementing Regulation DD.

 To determine the reliance that can be placed on the institution’s internal controls and procedures for monitoring the institution’s compliance with Regulation DD.

 To direct corrective action when violations of law are identified or when the institution’s 

policies or internal controls are deficient.

MANAGEMENT AND POLICY-RELATED 

EXAMINATION PROCEDURES 

1. Determine the types of deposit accounts offered by the institution to consumers 

(including accounts usually offered to commercial customers that may 

occasionally be offered to consumers) as well as the characteristics of each type 

of deposit account (for example, bonuses offered, minimum balances, balancecomputation method, frequency of interest crediting, fixed or variable rates, fees 

imposed, and frequency of periodic statements).

[Click&type]

2. Review relevant written policies and procedures, management’s self-assessments, 

consumer complaints, and any compliance audit material including work papers 

and reports to determine whether:

• The scope of the audit addresses all provisions as applicable.

• Management has taken corrective actions to followup on previously 

identified deficiencies.

• The testing includes samples covering all product types and decision centers.

• The work performed is accurate.

• Significant deficiencies and their causes are included in reports to 

management and to the Board of Directors, as appropriate.

 1

The Federal Reserve’s implementing regulation is cited in these procedures. However, if examiners cite violations by an entity, 

examiners should cite violations of the applicable regulation in effect with respect to that entity.

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 2

• The frequency of review is appropriate.

[Click&type]

3. Through discussions with management and review of available information, 

determine whether the institution’s internal controls are adequate to ensure 

compliance in Regulation DD area under review. Consider the following:

• Organization charts

• Process flowcharts

• Policies and procedures

• Account documentation

• Checklists

• Computer program documentation.

[Click&type]

4. Through a review of the institution’s training materials, determine whether:

• The institution provides appropriate training to individuals responsible for 

Regulation DD compliance and operational procedures.

• The training is comprehensive and covers the various aspects of Regulation 

DD that apply to the individual institution’s product offerings and operations. 

• The training includes the timing requirements of Section 230.4(a)(2) to 

provide disclosure information (e.g., terms, conditions, and fees) to a 

consumer upon a request, whether or not the consumer is an existing or a 

prospective customer. Review whether the training instructs all employees, 

including branch employees, to provide such disclosures at the time of the 

request if the consumer makes the request in person or within ten business 

days if the consumer is not present when making the request. 

[Click&type]

5. Determine the extent and adequacy of the institution’s policies, procedures, and 

practices for ensuring compliance with the regulation. In particular, verify that: 

• Account disclosure information is available to be provided to all consumers 

within the appropriate time frames. This requirement pertains to all consumer 

requesters whether or not the consumer is an existing customer or a 

prospective customer.

• Advance notice is given for any changes in terms required to be disclosed 

under Section 230.4 and that exceptions to the advance notice requirements 

are limited to those set forth in Section 230.5(a)(2).

• If periodic statements are given, the statements disclose the required 

information, including the annual percentage yield earned, the amount of 
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 3

interest, fees imposed, and the statement’s covered time period.

• The institution’s methods of paying interest are permissible. Review the dates 

on which interest begins to accrue on deposits to accounts, and determine 

whether hold times comply with the Expedited Funds Availability Act.

• The institution’s advertising policies are consistent with the requirements of 

the regulation, including advertising requirements for overdraft services.

• Evidence of compliance is retained for a minimum of two years after the date 

disclosures are required to be made or action is required to be taken.

• The periodic statements separately disclose the total fees and charges for 

payment of items that overdraw the account and for returning items 

unpaid.These disclosures must be provided for the statement period and the 

calendar year-to-date.

[Click&type]

TRANSACTION-RELATED EXAMINATION PROCEDURES

If upon conclusion of the management and policy-related examination procedures, procedural 

weaknesses or other risks requiring further investigation are noted, conduct the transaction testing, 

as necessary, using the following examination procedures. Use examiner judgment in deciding the 

size of each sample of deposit account disclosures, notices, and advertisements. Increase the sample 

size until you are confident that all aspects of the institution’s activities and policies that are subject 

to the regulation are reviewed.
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 4

GENERAL DISCLOSURE REQUIREMENTS (12 CFR 230.3)

1. Determine whether the institution makes disclosures clearly and conspicuously in 

writing and in a form the consumer may keep (§ 230.3(a)). 

[Click&type]

2. If the disclosures are combined with other account disclosures, determine 

whether it is clear which disclosures are applicable to the consumer’s account (§ 

230.3(a)).

[Click&type]

3. If the institution provides a consumer disclosure in electronic form, determine 

whether the institution has obtained the consumer’s consent, where required, and 

complies with the other applicable provisions of the Electronic Signatures in 

Global and National Commerce Act (E-Sign Act)(15 USC 7001 et seq.) (§ 

230.3(a)). 

[Click&type]

4. Determine whether the disclosures reflect the legal obligation of the account 

agreement between the consumer and the institution (§ 230.3(b)). 

[Click&type]

5. If the institution provides disclosures in a language other than English, verify 

whether the disclosures are available in English upon request (§ 230.3(b)). 

[Click&type]

6. Determine whether disclosures use consistent terminology when describing terms 

or features that are required to be disclosed (Staff Commentary 230.3(a)-2). 

[Click&type]

7. Determine whether the institution substitutes disclosures required by Regulation 

E for disclosures required by Regulation DD (§ 230.3(c)). 

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 5

8. Determine whether the institution provides required disclosures to at least one 

account holder if there are multiple holders (§ 230.3(d)). 

[Click&type]

9. Determine whether the institution’s oral response to a consumer’s inquiry about 

interest rates payable on accounts state the annual percentage yield (APY) by 

reviewing the institution’s policies and procedures. If the institution chooses, it 

may also state the interest rate, but no other rate (§ 230.3(e)). 

[Click&type]

10. Determine whether the APY, the annual percentage earned (APYE) and the 

interest rate are rounded to the nearest one-hundredth of one percentage point 

(.01%). 

NOTE:For account disclosures, the interest rate may be expressed to more than 

two decimal places (§ 230.3(f)(1)). 

[Click&type]

11. Determine whether the APYs and APYEs are not more than one-twentieth of one 

percentage point (.05%) above or below the APY (and APYE) as determined in 

accordance with Appendix A of Regulation DD (§ 230.3(f)(2)). 

[Click&type]

ACCOUNT DISCLOSURES (12 CFR 230.4)

Delivery of Account Disclosures

Account Opening

12. Determine whether the institution provides account disclosures to consumers 

before an account is opened or a service is provided, whichever is earlier (§ 

230.4(a)(1)(i)). 

• If the consumer is not present when the account is opened or a service is 

provided (and has not already received the disclosures), the institution should 

mail or deliver the disclosures no later than 10 business days after the account 

is opened or the service is provided, whichever is earlier (§ 230.4(a)(1)(i)). 

• If the consumer who is not present at the institution uses electronic means to 

open an account or request a service, the institution must provide the 

disclosures before the account is open or the service is provided 

(§ 230.4(a)(1)(ii)). 

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 6

Consumer Request

13. Determine whether the institution has available full account disclosures, 

including complete fee schedules, to provide to a consumer upon request.This 

requirement pertains to all consumer requests, whether or not the consumer is an 

existing customer or a prospective customer. 

• If the request is made in person, determine whether the institution has 

disclosures available to provide upon the consumer’s request. 

• If the consumer is not present, the institution must mail or deliver the 

disclosures within a reasonable period of time after it receives the request 

(generally no more than 10 days) (§ 230.4(a)(2)(i)). 

[Click&type]

14. Determine whether the institution chooses one of the following options when 

providing rate information (§ 230.4(a)(2)(ii)(A)). 

• Specifies an interest rate and APY that were offered within the most recent 

seven calendar days.

• States that the rate and yield are accurate as of an identified date.

• Provides a telephone number that consumers may call to obtain current rate 

information. 

[Click&type]

15. For a time deposit account, the institution may state the maturity as a term rather 

than a date (§ 230.4(a)(2)(ii)(B)). 

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 7

Content of Disclosures

Rate information

16. Determine whether account disclosures include, as applicable:

• The “annual percentage yield” and the “interest rate” using those terms. 

• For fixed-rate accounts the period of time the interest rate will be in effect 

(§ 230.4(b)(1)(i)). 

[Click&type]

17. For variable-rate accounts, determine whether account disclosures include all of 

the following information(§ 230.4(b)(1)(ii)):

• The fact that the interest rate and APY may change.

• How the interest rate is determined.

• The frequency with which the interest rate may change.

• Any limitations on the amount the interest rate may change. 

[Click&type]

Compounding and crediting

18. Determine whether account disclosures describe the frequency with which interest is compounded or credited (§ 230.4(b)(2)(i)). 

[Click&type]

19. If the consumer will forfeit interest if the consumer closes an account before accrued interest is credited, determine whether account disclosures include a 

statement that interest will not be paid in such cases (§ 230.4(b)(2)(ii)). 

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 8

Balance information

20. As applicable, determine whether account disclosures:

• Describe the minimum balance required to (§ 230.4(b)(3)(i)):

 Open an account, 

 Avoid the imposition of a fee, or 

 Obtain the APY disclosed. 

• Describe how the minimum balance requirement is determined to avoid the 

imposition of a fee or to obtain the APY disclosed (§ 230.4(b)(3)(i)). 

• Explain the balance computation method (specified in Section 230.7) used to 

calculate interest on the account (§ 230.4(b)(3)(ii)). 

• State when interest begins to accrue on noncash deposits (§ 230.4(b)(3)(iii)). 

[Click&type]

Fees

21. Determine whether account disclosures state the amount of any fee that may be 

imposed in connection with the account (or an explanation of how the fee will be 

determined) and the conditions under which the fee may be imposed (§ 

230.4(b)(4)). 

• Determine whether the institution has specified the categories of transactions 

for which an overdraft fee may be imposed (Staff Commentary § 230.4(b)(4)-

5). 

[Click&type]

Transaction Limitations

22. Determine whether the account disclosures state any limits on the number or 

dollar amount of withdrawals or deposits (§ 230.4(b)(5)). 

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 9

Features of time accounts

23. For time accounts, determine whether account disclosures include, as applicable:

• The maturity date (§ 230.4(b)(6)(i)). 

• A statement that a penalty will or may be imposed for early withdrawal, how 

it is calculated, and the conditions for its assessment (§ 230.4(b)(6)(ii)). 

• If compounding occurs during the term and the interest may be withdrawn 

prior to maturity, a statement that the APY assumes interest remains on 

deposit until maturity and that a withdrawal will reduce earnings (§ 

230.4(b)(6)(iii)). 

• A statement that interest cannot remain on deposit and that payout of interest 

is mandatory for accounts (§ 230.4(b)(6)(iii)):

 With a stated maturity greater than one year, 

 That do not compound interest on an annual or more frequent basis,

 That require interest payouts at least annually, and

 That disclose an APY determined in accordance with Section E of 

Appendix A of Regulation DD. 

• A statement of whether or not the account will renew automatically at 

maturity (§ 230.4(b)(6)(iv)):

 If it will renew automatically at maturity, a statement whether or not a 

grace period will be provided and, if so, the length of the grace period.

 If it will not renew automatically, a statement of whether interest will be 

paid after maturity if the consumer does not renew the account.

[Click&type]

Bonuses

24. Determine whether the account disclosures state the amount or type of any bonus, 

when the bonus will be provided, and any minimum balance and time 

requirements to obtain the bonus (§ 230.4(b)(7)). 

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 10

SUBSEQUENT DISCLOSURES (12 CFR 230.5)

Change in Terms Notice

25. Determine whether the institution sends out advance change in terms notices to 

consumers of any change in a term, required to be disclosed under Section 

230.4(b), that may reduce the annual percentage yield (APY) or that otherwise 

adversely affects consumers. Verify that the notice (§ 230.5(a)(1)):

• Includes the effective date of the change.

• Is mailed or delivered at least 30 days before the effective date of the change.

[Click&type]

26. Determine whether exceptions to the notice requirements are limited to 

(§ 230.5(a)(2)):

• Variable-rate changes

• Check-printing fees

• Short-term time accounts (one month or less).

[Click&type]

Pre-Maturity Notices – Renewable Accounts

27. For time accounts with a maturity longer than one month and that renew 

automatically, determine whether the proper subsequent disclosures (§ 230.5(b)):

• Are mailed or delivered at least 30 days before maturity of the existing 

account. Alternatively, the institution may mail or deliver the disclosures at 

least 20 calendar days before the end of the grace period on the existing 

account, if a grace period of at least five days is allowed (§ 230.5(b)). 

• For accounts with maturities of more than one year, include the following 

information (§ 230.5(b)(1)):

 The account disclosures required in Section 230.4(b) for new accounts

 The date the existing account matures

 If the interest rate and APY are not known, include the following:

⇒ The fact that the rates are unknown

⇒ The date that the rates will be determined

⇒ A telephone number to call to obtain the rates that will be paid on the 

new account.

• For accounts with maturities of one year or less, include the following 

information (§ 230.5(b)(2)):
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 11

 The same account disclosures as required in Section 230.5(b)(1) for 

accounts with maturities of more than one year;

Or disclose to the consumer:

 The date the existing account matures and the new maturity date if the 

account is renewed, and

 The interest and APY, if known. 

 If the rates are not known, include the following:

⇒ The fact that the rates are unknown

⇒ The date they will be determined

⇒ A telephone number to call to obtain the rates that will be paid on the 

new account, and

 The difference in the terms of the new account, as compared to the 

existing account.

[Click&type]

Pre-Maturity Notices – Nonrenewable Accounts

28. For time accounts with a maturity longer than one year and that do not renew 

automatically, determine whether the institution (§ 230.5(c)):

• Discloses the maturity date.

• Discloses whether interest will be paid after maturity.

• Mails or delivers the disclosures at least 10 calendar days before maturity of 

the existing account.

[Click&type]

PERIODIC STATEMENT DISCLOSURES (12 CFR 230.6)

29. If an institution mails or delivers a periodic statement, determine whether the 

statements include the following (§ 230.6(a)):

• The “annual percentage yield earned” during the statement period, using that 

term and calculated in accordance to Appendix A of Regulation DD 

(§ 230.6(a)(1)). 

• The amount of interest earned during the statement period (§ 230.6(a)(2)).

• Any debited fees required to be disclosed under Section 230.4(b)(4) itemized 

by dollar amount and type (§ 230.6(a)(3)). 

NOTE: Except as required in Section 230.11(a)(1) for overdraft payment 

fees, if fees of the same type are imposed more than once in a statement 
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 12

period, an institution may itemize fees separately or group them together and 

disclose a total dollar amount for all fees of the same type. Fees for paying 

overdrafts and for returning items unpaid are not fees of the same type and 

must be separately distinguished (Staff Commentary § 230.6(a)(3)-2(iv)). 

• The total number of days in the statement period or the beginning and ending 

dates of the period (§230.6(a)(4)).

• If applicable, the total overdraft and returned item fees required to be 

disclosed by § 230.11(a) (§ 230.6(a)(5)).

[Click&type]

30. If the institution uses the average daily balance method and calculates interest for 

a period other than the statement period, determine whether the institution 

§ 230.6(b)):

• Calculates and discloses the APY earned and the amount of interest earned 

based on the other period rather than the statement period, and 

• States the information required in Section 230.6(a)(4), specifying the period 

length for the other period as well as for the statement period.

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 13

PAYMENT OF INTEREST (12 CFR 230.7)

31. Determine whether the institution calculates interest based on the full amount of 

principal in an account for each day by use of either the daily balance method or 

the average daily balance method§ 230.7(a)(1)).

[Click&type]

32. For deposit accounts that require a minimum balance to earn interest, determine 

whether the institution is using the same method to determine the minimum 

balance as it uses to determine the balance on which interest is calculated§ 

230.7(a)(2)).

NOTE:An institution may use an additional method that is unequivocally 

beneficial to the consumer§ 230.7(a)(2)).

[Click&type]

33. If an institution chooses not to pay accrued interest if the consumer closes an 

account prior to the date accrued interest is credited, determine whether the 

institution disclosed this practice in the initial account disclosures (Staff 

Commentary § 230.7(b)-3).

NOTE:An institution is not required to compound or credit interest at any 

particular frequency but, if it does, it may compound or credit interest annually, 

semi-annually, quarterly, monthly, daily, continuously, or on any other basis 

(§ 230.7(b) and Staff Commentary § 230.7(b)-1).

[Click&type]

34. Determine whether interest begins to accrue no later than the business day on 

which the depository institution receives provisional credit for the funds, in 

accordance with Section 606 of the Expedited Funds Availability Act and the 

implementing Regulation CC, Section 229.14 (§ 230.7(c)).

[Click&type]

35. Determine whether interest accrues until the day funds are withdrawn (§ 

230.7(c)).

[Click&type]

ADVERTISING (12 CFR 230.8)

General

36. Determine the types of advertising the institution uses, including visual, oral, or 

print, that meet the regulatory definition of an advertisement. 

[Click&type]

37. Determine that all types of advertisements do not contain misleading or 
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 14

inaccurate statements and do not misrepresent deposit contracts(§ 230.8(a)(1)).

[Click&type]

38. Determine that advertisements of accounts do not:

Refer to or describe an account as “free” or “no cost” (or contain a similar term) 

if any maintenance or activity fee is charged

Use the word profit to refer to interest paid on the account

Use the term “fees waived” if a maintenance or activity fee can be imposed 

(§ 230.8(a)(2) and Staff Commentary § 230.8(a)-5).

[Click&type]

39. If an electronic advertisement displays a triggering term, determine whether the 

advertisement clearly refers the consumer to the location where the additional 

required information begins (Staff Commentary § 230.8(a)-9).

[Click&type]

40. For institutions that promote the payment of overdrafts in an advertisement, 

determine whether the advertisement includes the disclosures required by Section 

230.11(b) (§ 230.8(f)).

[Click&type]

Permissible Advertisement Rates

41. For advertisements that state a rate of return, determine whether (§ 230.8(b)):

• The rate is stated as an “annual percentage yield” using that term and that no 

other rate is stated except “interest rate.” 

• If the advertisement uses the abbreviation “APY,” the term “annual 

percentage yield” is stated at least once in the advertisement.

• If the advertisement states the interest rate, it uses the term “interest rate” in 

conjunction with, but not be more conspicuous than, the annual percentage 

yield to which it relates. 

• Rates are rounded to the nearest one-hundredth of one percentage point 

(.01%) and expressed to two decimal places. 

[Click&type]

42. For tiered-rate accounts, determine whether an annual percentage yield is stated 

for each tier, along with corresponding minimum balance requirements (Staff 

Commentary § 230.8(b)-1).

[Click&type]

43. For stepped-rate accounts, determine whether all interest rates and the time 
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 15

period that each rate is in effect are stated (Staff Commentary § 230.8(b)-2).

[Click&type]

Required Additional Disclosures

44. With the exception of broadcast, electronic, or outdoor media, telephone-response 

machines, and indoor signs, if the annual percentage yield is stated in the 

advertisement, determine whether it includes the following information, as 

applicable, clearly and conspicuously:

• For a variable rate account, that the rate may change after account opening 

(§ 230.8(c)(1)).

• The time period that the annual percentage yield will be offered or a 

statement that it is accurate as of a specified date (§ 230.8(c)(2)).

• The minimum balance required to earn the advertised annual percentage yield 

(§ 230.8(c)(3)).

• For tiered accounts, the minimum balance required for each tier stated in 

close proximity and with equal prominence to the applicable APY, if 

applicable (§ 230.8(c)(3)).

• The minimum deposit to open the account, if it is greater than the minimum 

balance necessary to obtain the advertised annual percentage yield 

(§ 230.8(c)(4)).

• A statement that maintenance or activity fees could reduce the earnings on 

the account(§ 230.8(c)(5) and Staff Commentary § 230.8(c)(5)-1).

• For time accounts: 

 Term of the account (§ 230.8(c)(6)(i)).

 A statement that a penalty will or may be imposed for early withdrawal 

(§ 230.8(c)(6)(ii)).

 A statement that interest cannot remain on deposit and that payout of 

interest is mandatory for noncompounding time accounts with the 

following features (§ 230.8(c)(6)(iii)):

⇒ Stated maturity greater than one year.

⇒ Interest is not compounded annually or more frequently.

⇒ Interest is required to be paid out at least annually.

⇒ The APY is determined in accordance with Section E of Appendix A of 

Regulation DD.

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 16
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 17

Bonuses

45. For advertisements that state a bonus (a premium, gift, award or other 

consideration worth more than $10), determine whether they state all of the 

following:

• The “annual percentage yield,” using that term (§ 230.8(d)(1)).

• The time requirement to obtain the bonus (§ 230.8(d)(2)).

• The minimum balance required to obtain the bonus (§ 230.8(d)(3)).

• The minimum balance required to open the account, if it is greater than the 

minimum balance required to obtain the bonus (§ 230.8(d)(4)).

• When the bonus will be provided (§ 230.8(d)(5)).

[Click&type]

Exemptions for certain advertisements

46. Advertisements made through broadcast, electronic, or outdoor media, and 

telephone-response machines are exempted from some of the Regulation DD 

advertising requirements and are only required to contain certain information. 

(This exemption does not apply to Internet or email advertisements.) Determine 

whether advertisements made in these media contain the following information as 

applicable, clearly and conspicuously (§ 230.8(e)(1) and Staff Commentary § 

230.8(e)(1)(i)-1):

• The minimum balance required to earn the advertised annual percentage 

yield. For tiered accounts, the minimum balance required for each tier stated 

in close proximity and with equal prominence to the applicable APY, if 

applicable (§ 230.8(c)(3)).

• For time accounts: 

 Term of the account (§ 230.8(c)(6)(i)).

 A statement that interest cannot remain on deposit and that payout of 

interest is mandatory for noncompounding time accounts with the 

following features(§ 230.8(c)(6)(iii)):

⇒ Stated maturity greater than one year.

⇒ Interest is not compounded annually or more frequently.

⇒ Interest is required to be paid out at least annually.

⇒ The APY is determined in accordance with Section E of Appendix A 

of Regulation DD.

 For advertisements that state a bonus (a premium, gift, award or other 

consideration worth more than $10):
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 18

⇒ The “annual percentage yield,” using that term § 230.8(d)(1)).

⇒ The time requirement to obtain the bonus (§ 230.8(d)(2)).

⇒ The minimum balance required to obtain the bonus (§ 230.8(d)(3)).

[Click&type]

47. Indoor signs are exempted from most of the Regulation DD advertising 

requirements. Determine that indoor signs:

• Do not:

 Contain misleading or inaccurate statements and do not misrepresent 

deposit contracts (§ 230.8(a)(1)).

 Refer to or describe an account as “free” or “no cost” (or contain a 

similar term) if any maintenance or activity fee is charged (§ 230.8(a)).

 Use the word profit to refer to interest paid on the account 

(§ 230.8(a)(2)).

 Use the term “fees waived” if a maintenance or activity fee can be 

imposed (Staff Commentary § 230.8(a)-5).

• If a rate of return is stated, determine whether the indoor sign:

 States the rate as “annual percentage yield” or “APY.”No other rate may 

be stated except for the interest rate in conjunction with the APY to 

which it relates (§ 230.8(b)(2)(i)).

 Contains a statement advising consumers to contact an employee for 

further information about applicable fees and terms (§ 230.8(e)(2)(ii)).

[Click&type]

RECORD RETENTION REQUIREMENTS (12 CFR 230.9)

48 Determine whether the institution has maintained evidence of compliance with 

Regulation DD, including rate information, advertising, and providing consumers 

disclosures at the appropriate time (including upon a consumer’s request), for a 

minimum of two years after disclosures are required to be made or action is 

required to be taken. For example, review samples of advertising and disclosures, 

policies and procedures, and training activities, as appropriate (§ 230.9(c)).

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 19

SECTION 230.10 - [RESERVED]

ADDITIONAL DISCLOSURE REQUIREMENTS FOR OVERDRAFT SERVICES 

(12 CFR 230.11)

Periodic Statement Disclosures

49. Determine whether the institution discloses on each periodic statement (if a 

statement is provided) separate totals, for both the statement period and for the 

calendar year-to-date, for both of the following (§ 230.11(a)(1) and (a)(2)):

• The total amount for all fees or charges imposed on the account for paying 

checks or other items when there are insufficient or unavailable funds and the 

account becomes overdrawn, using the term “Total Overdraft Fees” (the 

requirement to use the term “Total Overdraft Fees” is effective October 1, 

2010) (§ 230.11(a)(1)(i));

• The total amount for all fees or charges imposed on the account for returning 

items unpaid (§ 230.11(a)(1)(ii).

[Click&type]

50. Determine if the aggregate fee disclosures are in a format that is substantially 

similar to the sample form in Appendix B of Regulation DD and that the 

disclosures are in close proximity to any fee identified in Section 230.6(a)(3) (§ 

230.11(a)(3)). NOTE: The table must contain lines (or similar markings such as 

asterisks) inside the table to divide the columns and rows.

[Click&type]

Advertisement Requirements

51. Unless an exception under Section 230.11(b)(2)-(4) applies, when an institution 

advertises the payment of overdrafts, determine whether the institution clearly 

and conspicuously discloses in advertisements all of the following:

• The fee(s) for the payment of each overdraft (§ 230.11(b)(1)(i)).

• The categories of transactions for which a fee may be imposed for paying an 

overdraft (§ 230.11(b)(1)(ii)).

• The time period by which the consumer must repay or cover any 

overdraft(§ 230.11(b)(1)(iii)).

• The circumstances under which the institution will not pay an 

overdraft(§ 230.11(b)(1)(iv)).

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 20

52. Disclosure of Account Balances

• If the institution discloses account balance information through automated 

systems, determine whether: 

 The balance excludes additional amounts that the institution may 

provide to cover items when there are insufficient or unavailable funds 

(§ 230.11(c)).

 The institution, if it discloses at its option additional account balances 

that include additional amounts, prominently states that any such 

balance includes additional amounts and, if applicable, that those 

additional amounts are not available for all transactions (§ 230.11(c)).

• NOTE: Regulation DD does not require an institution to exclude funds 

from the consumer’s balance that may be transferred from another account 

pursuant to a retail sweep program (Staff Commentary § 230.11(c)-2).

[Click&type]
CFPB 

Examination Procedures TISA

CFPB FFIEC Rev. 9/2010 TISA 21

EXAMINER’S SUMMARY, RECOMMENDATIONS, AND COMMENTS 

[Click&type]
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 1

TRUTH IN SAVINGS ACT

SECTION 230.31 - GENERAL 

DISCLOSURE REQUIREMENTS

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]

1. Does the institution make the required disclosures clearly and conspicuously 

in writing and in a form the consumer may keep (§ 230.3(a))?

2. If the disclosures are combined with other account disclosures, is it clear 

which disclosures are applicable to the consumer’s account (§ 230.3(a))?

3. Do the disclosures reflect the terms of the legal obligation of the account 

agreement between the consumer and the institution (§ 230.3(b))?

4. If the disclosures are provided in a language other than English, are 

disclosures also available in English upon request (§ 230.3(b))?

5. Do the disclosures use consistent terminology when describing terms or 

features that are required to be disclosed (Staff Commentary § 230.3(a)-2)?

6. Does the institution substitute disclosures required by Regulation E for 

disclosures required by this regulation (§ 230.3(c))?

7. Does the institution provide disclosures to at least one account holder if 

there are multiple holders (§ 230.3(d))?

8. Do the institution’s oral responses to a consumer’s inquiry about interest rates 

payable on accounts state the annual percentage yield (APY)? If the institution 

chooses, it may state the interest rate, but no other rate (§ 230.3(e)).

9. Are the APY, annual percentage yield earned (APYE), and the interest rate 

rounded to the nearest one-hundredth of one percentage point (.01%) and 

expressed to two decimal places (§ 230.3(f)(1))?

• For account disclosures, is the interest rate expressed to two or more 

decimal places (§ 230.3(f)(1))?

10. Are the APY and APYE not more than one-twentieth of one percentage 

point (.05%) above or below the APY and APYE determined in 

accordance with appendix A of Regulation DD (§ 230.3(f)(2))?

 1 The Federal Reserve’s implementing regulation is cited in these procedures. However, if examiners cite violations by an entity, 

examiners should cite violations of the applicable regulation in effect with respect to that entity.
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 2

SECTION 230.4 - ACCOUNT DISCLOSURES 

DELIVERY OF ACCOUNT DISCLOSURES

ACCOUNT OPENING

1. Does the institution provide initial disclosures before an account is opened 

or a service provided, whichever is earlier (§ 230.4(a)(1))?

• If the consumer is not present when the account is open or a service is 

provided (and has not already received the disclosures), does the 

institution mail or deliver the disclosures no later than ten business 

days after the account is opened or the service is provided, whichever 

is earlier (§ 230.4(a)(1)(i))?

• If the consumer who is not present at the institution uses electronic 

means to open an account or request a service, does the institution 

provide the disclosures before the account is open or the service is 

provided (§ 230.4(a)(1)(ii))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 3

CONSUMER REQUEST

2. Does the institution have full account disclosures, including complete fee 

schedules, available to provide to consumers upon request? This 

requirement pertains to all consumer requests, whether or not the consumer 

is an existing customer or a prospective customer (§ 230.4(a)(2)(i)).

• If the consumer makes the request in person, does the institution have 

disclosures available to provide upon request?

• If the consumer who is not present at the institution makes a request, 

does the institution mail or deliver the account disclosures within a 

reasonable time after it receives the request (generally no more than 10 

days) (§ 230.4(a)(2)(i))?

3. In providing disclosures upon request, does the institution choose one of 

the following options when providing rate information (§ 230.4(a)(2)(ii)):

• Specify an interest rate and APY that were offered within the most 

recent seven calendar days (§ 230.4(a)(2)(ii)(A))?

• State that the rate and yield are accurate as of an identified date 

(§ 230.4(a)(2)(ii)(A))?

• Provide a telephone number that consumers may call to obtain current 

rate information (§ 230.4(a)(2)(ii)(A))?

4. For a time deposit account, does the institution choose to state the maturity 

of the time account as a term rather than a date (§ 230.4(a)(2)(ii)(B))?

CONTENT OF DISCLOSURES

RATE INFORMATION

5. Do account disclosures include, as applicable (§ 230.4(b)):

• The “annual percentage yield” and interest rate, using those terms

(§ 230.4(b)(1(i))?

• For fixed-rate accounts, the period of time the interest rate will be in 

effect (§ 230.4(b)(1)(i))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 4

6. For variable-rate accounts, do account disclosures include all of the 

following information (§ 230.4(b)(1)(ii)):

• The fact that the interest rate and APY may change (§ 

230.4(b)(1)(ii)(A))?

• How the interest rate is determined (§ 230.4(b)(1)(ii)(B))?

• The frequency with which the interest rate may change 

§ 230.4(b)(1)(ii)(C))?

• Any limitation on the amount the interest rate may change 

§ 230.4(b)(1)(ii)(D))?

COMPOUNDING AND CREDITING

7. Do the account disclosures describe the frequency with which interest is 

compounded and credited (§ 230.4(b)(2)(i))?

8. If consumers will forfeit interest if they close the account before accrued 

interest is credited, do the account disclosures include a statement that 

interest will not be paid in such cases (§ 230.4(b)(2)(ii))?

BALANCE INFORMATION

9. As applicable, do the account disclosures (§ 230.4(b)(3)(i)):

• Describe the minimum balance required to: 

 Open an account (§ 230.4(b)(3)(i)(A))?

 Avoid the imposition of a fee (§ 230.4(b)(3)(i)(B))?

 Obtain the APY disclosed (§ 230.4(b)(3)(i)(C))?

• Describe how the minimum balance requirement is determined to avoid 

the imposition of a fee or to obtain the APY disclosed (§ 

230.4(b)(3)(i))?

• Explain the balance computation method used to calculate interest on 

the account (§ 230.4(b)(3)(ii))?

• State when interest begins to accrue on noncash deposits 

(§ 230.4(b)(3)(iii))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 5

FEES

10. Do the account disclosures state the amount of any fee that may be 

imposed in connection with the account (or an explanation of how the fee 

will be determined) and the conditions under which the fee may be 

imposed (§ 230.4(b)(4))?

• Regardless of whether the institution promotes overdraft payment, does 

it disclose specific categories of transactions that may cause an 

overdraft fee to be imposed on the accountholder (Staff Commentary § 

230.4(b)(4)-5)?

TRANSACTION LIMITATIONS

11. Do the account disclosures state any limits on the number or dollar amount 

of withdrawals or deposits (§ 230.4(b)(5))?

FEATURES OF TIME ACCOUNTS

12. For time accounts, do the account disclosures also include the following, as

applicable (§ 230.4(b)(6)):

• The maturity date (§ 230.4(b)(6)(i))?

• A statement that a penalty will or may be imposed for early 

withdrawal, how it is calculated, and the conditions for its assessment 

(§ 230.4(b)(6)(ii))?

• If compounding occurs during the term and the interest may be 

withdrawn prior to maturity, a statement that the APY assumes that 

interest remains on deposit until maturity and that a withdrawal will 

reduce earnings (§ 230.4(b)(6)(iii))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 6

• A statement that interest cannot remain on deposit and that payout of 

interest is mandatory for accounts with the following features (§ 

230.4(b)(6)(iii)):

 With a stated maturity greater than one year,

 That do not compound interest on an annual or more frequent 

basis,

 That require interest payouts at least annually, and

 That disclose an APY determined in accordance with Section E of 

Appendix A of Regulation DD?

• A statement of whether or not the account will renew automatically at 

maturity (§ 230.4(b)(6)(iv))?

 If the account will renew automatically at maturity, a statement of 

whether or not a grace period is provided, and if so, the length of 

the grace period?

 If the account does not renew automatically, a statement of 

whether interest will be paid after maturity if the consumer does 

not renew the account?

BONUSES

13. Do account disclosures state the amount or type of any bonus, when the 

bonus will be provided, and any minimum balance and time requirements 

to obtain the bonus (§ 230.4(b)(7))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 7

SECTION 230.5 – SUBSEQUENT DISCLOSURES 

CHANGE IN TERMS NOTICE

1. Does the institution provide advance change in terms notices to consumers 

of any change to a term, required to be disclosed under Section 230.4(b), 

that may reduce the annual percentage yield or that otherwise adversely 

affects the consumer? (§ 230.5(a)(1))

• Does the notice include the effective date of the change (§ 

230.5(a)(1))?

• Is the notice mailed or delivered at least 30 days before the effective 

date of the change (§ 230.5(a)(1))?

2. Are exceptions to the notice requirements limited to the following 

(§ 230.5(a)(2))?

• Variable-rate changes (§ 230.5(a)(2)(i))?

• Check-printing fees (§ 230.5(a)(2)(ii))?

• Short-term time accounts (one month or less) (§ 230.5(a)(2)(iii))?

PRE-MATURITY NOTICES – RENEWABLE ACCOUNTS

3. For time accounts with maturities longer than one month and that 

automatically renew, does the institution (§ 230.5(b)):

• Mail or deliver subsequent disclosures at least 30 calendar days before 

maturity of existing account (§ 230.5(b))?

(Alternatively, if grace period of at least five calendar days is allowed, 

the institution may mail or deliver disclosures at least 20 calendar days 

before the end of the grace period.) 
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 8

• For accounts with maturities longer than one year, include in the 

disclosures (§ 230.5(b)(1)):

 The account disclosures outlined in Section 230.4(b) for the new 

account? 

 The date the existing account matures? 

 If the interest rate and APY for the new account have not been 

determined: 

⇒ The fact that the rates have not yet been determined?

⇒ The date that the rates will be determined?

⇒ A telephone number to call for the interest rate and APY that 

will be paid on the new account? 

• For accounts with maturities of one year or less, include in the 

disclosures (§ 230.5(b)(2)):

 The same account disclosures as required under Section 

230.5(b)(1) for accounts with maturities of more than one year (§ 

230.5(b)(2)(i)):

Or include:

 The date the existing account matures and the new maturity date if 

the account is renewed (§ 230.5(b)(2)(ii)(A))?

 The interest rate and APY for the new account, if known 

(§ 230.5(b)(2)(ii)(B))?

 If the rates are not known (§ 230.5(b)(2)(ii)(B)):

⇒ The fact that the rates have not yet been determined?

⇒ The date they will be determined?

⇒ A telephone number to call for the interest rate and APY that 

will be paid on the new account? 

 Any difference in the terms of the new account, compared to the 

existing account (§ 230.5(b)(2)(ii)(C))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 9

PRE-MATURITY NOTICES – NONRENEWABLE ACCOUNTS

4. For time accounts with maturities longer than one year and that do not 

automatically renew, does the institution (§ 230.5(c)):

• Disclose the maturity date? 

• Disclose whether interest will be paid after maturity? 

• Mail or deliver the disclosures at least 10 calendar days before the 

maturity of the existing account? 

SECTION 230.6 – PERIODIC STATEMENT DISCLOSURES

1. If an institution mails or delivers a periodic statement, do the statements 

include the following (§ 230.6(a)):

• The “annual percentage yield earned” during the statement period, 

using that term and calculated in accordance to Appendix A of 

Regulation DD (§ 230.6(a)(1))?

• The amount of interest earned during the statement period (§ 

230.6(a)(2))?

• Any debited fees required to be disclosed under Section 230.4(b)(4), 

itemized by dollar amount and type (§ 230.6(a)(3))?

NOTE: Except as required in Section 230.11(a)(1) for overdraft 

payment fees, if fees of the same type are imposed more than once in a 

statement period, an institution may itemize fees separately or group 

them together and disclose a total dollar amount for all fees of the same 

type. Fees for paying overdrafts and for returning items unpaid are not 

fees of the same type and must be separately distinguished.

• The total number of days in the statement period or the beginning and 

ending dates of the period (§ 230.6(a)(4))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 10

2. If the institution uses the average daily balance method and calculates 

interest for a period other than the statement period, does the institution (§ 

230.6(b)):

• Calculate and disclose the APYE and the amount of interest earned 

based on the other period rather than the statement period? 

• State the information required in section 230.6(a)(4), specifying the 

period length for the other period as well as for the statement period?

SECTION 230.7 – PAYMENT OF INTEREST

1. Does the institution calculate interest on the full amount of principal in the 

account each day by use of either the daily balance method or the average 

daily balance method (§ 230.7(a)(1))?

2. For deposit accounts that require a minimum balance to earn interest, does 

the institution use the same method to determine any minimum balance as 

it uses to determine the balance on which interest is calculated? 

NOTE: An institution may use an additional method that is unequivocally 

beneficial to the consumer (§ 230.7(a)(2)).

3. If an institution chooses not to pay accrued interest if the consumer closes 

an account prior to the date accrued interest is credited, does the institution 

disclose this practice in the initial account disclosures (Staff Commentary 

§230.7(b)-3)?

NOTE: An institution is not required to compound or credit interest at any 

particular frequency but, if it does, it may compound or credit interest 

annually, semi-annually, quarterly, monthly, daily, continuously, or on any 

other basis (§ 230.7(b) and Staff Commentary § 230.7(b)-1).

4. Does interest begin to accrue no later than the business day specified for 

interest-bearing accounts in Section 606 of the Expedited Funds 

Availability Act and implementing Regulation CC (§ 230.7(c))?

5. Does interest accrue until the day the funds are withdrawn (§ 230.7(c))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 11

SECTION 230.8 – ADVERTISING REQUIREMENTS

GENERAL

1. Do the types of advertising that the institution uses, including visual, oral, 

or print, meet the regulatory definition of an advertisement?

2. Do the advertisements refrain from misleading or inaccurate statements, 

and from misrepresenting the institution’s deposit contract (§ 230.8(a)(1))?

3. Do the advertisements refrain from using (§ 230.8(a)(2) and Staff 

Commentary § 230.8(a)-5):

• The terms “free” or “no cost” (or similar term) if any maintenance or 

activity fee may be imposed? 

• The word “profit” when referring to interest paid on an account? 

• The term “fees waived” if a maintenance or activity fee can be 

imposed?

4. If an electronic advertisement displays a triggering term, does the 

advertisement clearly refer the consumer to the location where the 

additional required information begins (Staff Commentary § 230.8(a)-9)?

5. For an institution that promotes the payment of overdrafts in an 

advertisement, does the advertisement include the disclosures required by 

section 230.11(b) (§ 230.8(f))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 12

PERMISSIBLE ADVERTISEMENT RATES

6. If the institution advertises a rate of return (§ 230.8(b)):

• Is the rate stated as “annual percentage yield,” using that term, and no 

other rate except “interest rate”? 

• If the advertisement uses the abbreviation “APY,” has the term “annual 

percentage yield” been stated at least once in the advertisement? 

• If the advertisement states the interest rate, using that term, is it stated 

in conjunction with, but not more conspicuous than, the annual 

percentage yield to which it relates? 

• Are the annual percentage yields and interest rates rounded to the 

nearest one-hundredth of one percentage point (.01%) and expressed to 

two decimal places? 

7. If the institution advertises tiered-rate accounts, does the advertisement 

state an annual percentage yield for each tier, along with corresponding 

minimum-balance requirements (Staff Commentary § 230.8(b)-1)?

8. If the institution advertises stepped-rate accounts, does the advertisement 

state all the interest rates and the time period that each rate is in effect 

(Staff Commentary § 230.8(b)-2)?

REQUIRED ADDITIONAL DISCLOSURES

9. With the exception of broadcast, electronic, or outdoor media, telephoneresponse machines, and indoor signs, if the annual percentage yield is 

stated in the advertisement, is the following information, as applicable, 

stated clearly and conspicuously (§ 230.8(c)):

• For a variable rate account, that the rate may change after account 

opening (§ 230.8(c)(1))?

• The time period that the annual percentage yield will be offered or a 

statement that it is accurate as of a specified date (§230.8(c)(2))?

• The minimum balance required to earn the advertised annual 

percentage yield (§ 230.8(c)(3))?

• For tiered-rate accounts, the minimum balance required for each tier 

stated in close proximity and with equal prominence to the applicable 

APY, if applicable (§ 230.8(c)(3))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 13

• The minimum deposit to open the account, if it is greater than the 

minimum balance necessary to obtain the advertised annual percentage 

yield (§ 230.8(c)(4))?

• A statement that maintenance or activity fees could reduce the earnings 

on the account (§ 230.8(c)(5) and Staff Commentary § 230.8(c)(5)-1)?

• For time accounts, the following features (§ 230.8(c)(6)): 

 Term of the account (§ 230.8(c)(6)(i))? 

 A statement that a penalty will or may be imposed for early 

withdrawal (§ 230.8(c)(6)(ii))?

 A statement that interest cannot remain on deposit and that payout 

of interest is mandatory for noncompounding time accounts with 

the following features (§ 230.8(c)(6)(iii))?

⇒ A stated maturity greater than one year.

⇒ Interest is not compounded on an annual or more frequent 

basis.

⇒ Interest is required to be paid out at least annually.

⇒ The APY is determined in accordance with Section E of 

Appendix A.
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 14

BONUSES

10. Unless an exception applies in Section 230.8(e), if a bonus is stated in an 

advertisement, does the advertisement state the following information, as 

applicable, clearly and conspicuously (§ 230.8(d)):

• The “annual percentage yield,” using that term (§ 230.8(d)(1))?

• The time requirement to obtain the bonus (§ 230.8(d)(2))?

• The minimum balance required to obtain the bonus (§ 230.8(d)(3))?

• The minimum balance required to open the account, if it is greater than 

the minimum balance necessary to obtain the bonus) (§ 230.8(d)(4))?

• When the bonus will be provided (§ 230.8(d)(5))?

EXEMPTIONS FOR CERTAIN ADVERTISEMENTS

11. Do advertisements made through broadcast, electronic, or outdoor media, 

and telephone-response machines contain the following information, as 

applicable, clearly and conspicuously (§ 230.8(e)(1) and Staff 

Commentary § 230.8(e)(1)(i)-1):

• The minimum balance required to earn the advertised annual 

percentage yield? For tiered accounts, the minimum balance required 

for each tier stated in close proximity and with equal prominence to the 

applicable APY, if applicable (§ 230.8(c)(3))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 15

• For time accounts: 

 Term of the account (§230.8(c)(6)(i))?

 A statement that interest cannot remain on deposit and that payout 

of interest is mandatory for noncompounding time accounts with 

the following features (§ 230.8(c)(6)(iii)):

⇒ A stated maturity greater than one year.

⇒ Interest is not compounded on an annual or more frequent 

basis.

⇒ Interest is required to be paid out at least annually. 

⇒ The APY is determined in accordance with Section E of 

Appendix A of Regulation DD. 

• If an advertisement states a bonus:

 The “annual percentage yield,” using that term (§ 230.8(d)(1))?

 The time requirement to obtain the bonus (§ 230.8(d)(2))?

 The minimum balance required to obtain the bonus (§ 

230.8(d)(3))?

12. Do indoor signs:

• Refrain from:

 Containing misleading or inaccurate statements, and 

misrepresenting deposit contracts (§ 230.8(a)(1))?

 Referring to or describe an account as “free” or “no cost” (or 

contain a similar term) if any maintenance or activity fee is 

charged?

 Using the word profit to refer to interest paid on the account?

 Using the term “fees waived” if a maintenance or activity fee can 

be imposed (§ 230.8(a)(2) and Staff Commentary § 230.8(a)-5)?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 16

• If a rate of return is stated:

 State the rate as “annual percentage yield” or “APY”? No other 

rate may be stated except for the interest rate in conjunction with 

the APY to which it relates. 

 Contain a statement advising consumers to contact an employee 

for further information about applicable fees and terms (§

230.8(e)(2))?

SECTION 230.9 – RECORD RETENTION REQUIREMENTS

13. Has the institution retained evidence of compliance with Regulation DD, 

including rate information, advertising, and providing consumers 

disclosures at the appropriate time (including upon a consumer’s request), 

for a minimum of two years after disclosures are required to be made or 

action is required to be taken? For example, review samples of advertising 

and disclosures, policies and procedures, and training activities, as 

appropriate (§ 230.9(c)).

SECTION 230.10 – [RESERVED]

SECTION 230.11 - OVERDRAFT PAYMENT DISCLOSURE AND 

ADVERTISING REQUIREMENTS

PERIODIC STATEMENT DISCLOSURES

1. Does the institution disclose on each periodic statement (if it provides a 

statement, and if a consumer is charged such fees) separate totals, for both 

the statement period and the calendar year-to-date, for both of the 

following (§ 230.11(a)(1) and (2)):

• The total amount of fees and charges imposed for paying checks or 

other items when there are insufficient or unavailable funds and the 

account becomes overdrawn, using the term “Total Overdraft Fees” (§ 

230.11(a)(1)(i))? (NOTE: The requirement to use the term “Total 

Overdraft Fees” is effective October 1, 2010) AND

• The total amount of fees imposed on an account for returning items 

unpaid (§ 230.11(a)(1)(ii))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 17

2. Does the institution disclose the fees in close proximity to any fee 

identified in Section 230.6(a)(3) that may be imposed in connection with 

the account and in a substantially similar format as found in Appendix B of 

Regulation DD? NOTE: The table must contain lines (or similar markings 

such as asterisks) inside the table to divide the columns and rows. 

ADVERTISEMENT REQUIREMENTS

3. Unless an exception under Section 230.11(b)(2)-(4) applies, when an 

institution advertises the payment of overdrafts, are all of the following 

disclosed clearly and conspicuously in the advertisement: 

• The fee(s) for the payment of each overdraft (§ 230.11(b)(1)(i))?

• The categories of transactions for which a fee may be imposed for 

paying an overdraft (§ 230.11(b)(1)(ii))?

• The time period by which the consumer must repay or cover any 

overdraft (§ 230.11(b)(1)(iii))?

• The circumstances under which the institution will not pay an overdraft 

(§ 230.11(b)(1)(iv))?

DISCLOSURE OF ACCOUNT BALANCES

4. If the institution discloses account balance information to a consumer 

through an automated system, does:

• the balance exclude additional amounts that the institution may provide 

to cover an item when there are insufficient or unavailable funds in the 

consumer’s account (§ 230.11(c))? NOTE: The regulation does not 

require an institution to exclude funds from the consumer’s balance 

that may be transferred from another account pursuant to a retail sweep 

program (Staff Commentary ((§ 230.11(c)-2)).

• the institution, if it discloses at its option additional account balances 

that include such additional amounts, prominently state that the balance 

includes such additional amounts, and if applicable, that the additional 

amounts are not available for all transactions (§ 230.11(c))?
CFPB

Examination Checklist TISA

YES NO NA

CFPB FFIEC Rev. 9/10 TISA 18

COMMENTS

[Click&type]
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 1

Privacy of Consumer Financial Information

Background and Overview

Title V, Subtitle A of the Gramm-Leach-Bliley Act (“GLBA”) governs the treatment of nonpublic 

personal information about consumers by financial institutions. Section 502 of the Subtitle, subject 

to certain exceptions, prohibits a financial institution from disclosing nonpublic personal 

information about a consumer to nonaffiliated third parties, unless the institution satisfies various 

notice and opt-out requirements, and provided that the consumer has not elected to opt out of the 

disclosure. Section 503 requires the institution to provide notice of its privacy policies and practices 

to its customers. Section 504 authorizes the issuance of regulations to implement these provisions.

In 2000, the four federal banking agencies and the National Credit Union Administration 

(“NCUA”) published regulations implementing provisions of the GLBA governing the treatment of 

nonpublic personal information about consumers by financial institutions.1 The regulations establish 

rules governing duties of a financial institution to provide particular notices and limitations on its 

disclosure of nonpublic personal information, as summarized below.

The Dodd-Frank Act granted rule-making authority under Sections 502 through 509 of the GrammLeach-Bliley Act (15 USC 6802-6809) to the Consumer Financial Protection Bureau (CFPB) and, 

with respect to entities under its jurisdiction, granted authority to the CFPB to supervise for and 

enforce compliance with these statutory provisions and their implementing regulations.

2

The regulations establish rules governing duties of a financial institution to provide particular 

notices and limitations on its disclosure of nonpublic personal information as summarized below.

• A financial institution must provide a notice of its privacy policies and allow the 

consumer to opt out of the disclosure of the consumer’s nonpublic personal information 

to a nonaffiliated third party if the disclosure is outside of the exceptions in Sections 13, 

14 or 15 of the regulations.

• Regardless of whether a financial institution shares nonpublic personal information, the 

institution must provide notices of its privacy policies to its customers.

• A financial institution generally may not disclose customer account numbers to any 

nonaffiliated third party for marketing purposes.

• A financial institution must follow reuse and redisclosure limitations on any nonpublic 

personal information it receives from a nonaffiliated financial institution.

 

1 The NCUA published its final rule in the Federal Register on May 18, 2000 (65 FR 31722). The Board of Governors of the Federal 

Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift 

Supervision jointly published their final rules on June 1, 2000 (65 FR 35162). For ease of reference, only the Federal Reserve’s 

implementing regulation is cited in this narrative. However, examiners should review an entity’s compliance with the applicable 

regulations in effect with respect to that entity.

2 Dodd-Frank Act §§ 1002(12)(J), 1024(b)-(c), and 1025(b)-(c); 12 USC §§ 5481(12)(J), 5514(b)-(c), and 5515(b)-(c). Under Sec. 

1002(12)(J), the Dodd-Frank Act excepted from CFPB authority Sec. 505 as it applies to Sec. 501(b) – related to financial institution 

security safeguards.
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 2

In general, the privacy notice must describe a financial institution’s policies and practices with 

respect to disclosing nonpublic personal information about a consumer to both affiliated and 

nonaffiliated third parties. Also, the notice must provide a consumer a reasonable opportunity to 

direct the institution generally not to share nonpublic personal information about the consumer 

(that is, to ‘‘opt out’’) with nonaffiliated third parties other than as permitted by the statute (for 

example, sharing for everyday business purposes, such as processing transactions and 

maintaining customers’ accounts, and in response to properly executed governmental requests). 

The privacy notice must also provide, where applicable under the Fair Credit Reporting Act 

(“FCRA”), a notice and an opportunity for a consumer to opt out of certain information sharing 

among affiliates.

Section 728 of the Financial Services Regulatory Relief Act of 2006 (“Regulatory Relief Act” 

or “Act”) required the Agencies to develop a model privacy form that financial institutions may 

rely on as a safe harbor to provide disclosures under the privacy rules.

On December 1, 2009, the four federal banking agencies and four additional federal regulatory 

agencies3 jointly released a voluntary model privacy notice form designed to make it easier for 

consumers to understand how financial institutions collect and share nonpublic personal 

information (74 FR 62890). The final rule adopting the model privacy form was effective on 

December 31, 2009, except that notices that were provided on or before December 31, 2010,

using sample clauses contained in Appendix B to the 2000 rule continued to receive the safe 

harbor for compliance with the notice requirements of the regulation for one year. Appendix B 

and the sample clauses are deleted from the agencies’ rules effective January 1, 2012.

Definitions and Key Concepts

In discussing the duties and limitations imposed by the regulations, a number of key concepts are 

used. These concepts include “financial institution”; “nonpublic personal information”; 

“nonaffiliated third party”; the “opt-out” right and the exceptions to that right; and “consumer” and 

“customer.” Each concept is briefly discussed below. A more complete explanation of each appears 

in the regulations.

Financial Institution:

A “financial institution” is any institution the business of which is engaging in activities that are 

financial in nature or incidental to such financial activities, as determined by Section 4(k) of the 

Bank Holding Company Act of 1956. Financial institutions can include banks, securities brokers 

and dealers, insurance underwriters and agents, finance companies, mortgage bankers, and travel 

agents.4

 3 The four additional federal regulators are the NCUA, the Commodity Futures Trading Commission, the Federal Trade Commission, 

and the Securities and Exchange Commission. 

4 Certain functionally regulated subsidiaries, such as brokers, dealers, and investment advisers are subject to privacy regulations 

issued by the Securities and Exchange Commission. Other functionally regulated subsidiaries, such as futures commission merchants, 

commodity trading advisors, commodity pool operators, and introducing brokers in commodities, are subject to privacy regulations 

issued by the Commodity Futures Trading Commission. Insurance entities may be subject to privacy regulations issued by their 

respective state insurance authorities.
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 3

Nonpublic Personal Information:

“Nonpublic personal information” generally is any information that is not publicly available and 

that: 

• A consumer provides to a financial institution to obtain a financial product or service 

from the institution; 

• Results from a transaction between the consumer and the institution involving a financial 

product or service; or 

• A financial institution otherwise obtains about a consumer in connection with providing 

a financial product or service. 

Information is publicly available if an institution has a reasonable basis to believe that the information 

is lawfully made available to the general public from government records, widely distributed media, 

or legally required disclosures to the general public. Examples include information in a telephone 

book or a publicly recorded document, such as a mortgage or securities filing.

Nonpublic personal information may include individual items of information as well as lists of 

information. For example, nonpublic personal information may include names, addresses, phone 

numbers, social security numbers, income, credit score, and information obtained through Internet 

collection devices (i.e., cookies).

There are special rules regarding lists. Publicly available information would be treated as nonpublic 

if it were included on a list of consumers derived from nonpublic personal information. For 

example, a list of the names and addresses of a financial institution’s depositors would be nonpublic 

personal information even though the names and addresses might be published in local telephone 

directories because the list is derived from the fact that a person has a deposit account with an 

institution, which is not publicly available information.

However, if the financial institution has a reasonable basis to believe that certain customer 

relationships are a matter of public record, then any list of these relationships would be considered 

publicly available information. For instance, a list of mortgage customers where the mortgages are 

recorded in public records would be considered publicly available information. The institution could 

provide a list of such customers, and include on that list any other publicly available information it 

has about the customers on that list without having to provide notice or opt out.

Non-affiliated Third Party:

A “nonaffiliated third party” is any person except a financial institution’s affiliate or a person 

employed jointly by a financial institution and a company that is not the institution’s affiliate. An 

“affiliate” of a financial institution is any company that controls, is controlled by, or is under 

common control with the financial institution.
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 4

Opt-out Right and Exceptions:

The Right

Consumers must be given the right to “opt out” of, or prevent, a financial institution from disclosing 

nonpublic personal information about them to a nonaffiliated third party, unless an exception to that 

right applies. The exceptions are detailed in Sections 13, 14, and 15 of the regulations and described 

below.

As part of the opt-out right, consumers must be given a reasonable opportunity and a reasonable 

means to opt out. What constitutes a reasonable opportunity to opt out depends on the 

circumstances surrounding the consumer’s transaction, but a consumer must be provided a 

reasonable amount of time to exercise the opt-out right. For example, it would be reasonable if the 

financial institution allows 30 days from the date of mailing a notice or 30 days after customer 

acknowledgement of an electronic notice for an opt-out direction to be returned. What constitutes a 

reasonable means to opt out may include check-off boxes, a reply form, or a toll-free telephone 

number, again depending on the circumstances surrounding the consumer’s transaction. It is not 

reasonable to require a consumer to write his or her own letter as the only means to opt out.

The Exceptions

Exceptions to the opt-out right are detailed in Sections 13, 14, and 15 of the regulations. Financial 

institutions need not comply with opt-out requirements if they limit disclosure of nonpublic 

personal information:

• To a nonaffiliated third party to perform services for the financial institution or to 

function on its behalf, including marketing the institution’s own products or services or 

those offered jointly by the institution and another financial institution. The exception is 

permitted only if the financial institution provides notice of these arrangements and by 

contract prohibits the third party from disclosing or using the information for other than 

the specified purposes. The contract must provide that the parties to the agreement are 

jointly offering, sponsoring, or endorsing a financial product or service. However, if the 

service or function is covered by the exceptions in Section 14 or 15 (discussed below), 

the financial institution does not have to comply with the additional disclosure and 

confidentiality requirements of Section 13. Disclosure under this exception could include 

the outsourcing of marketing to an advertising company. (Section 13)

• As necessary to effect, administer, or enforce a transaction that a consumer requests or 

authorizes, or under certain other circumstances relating to existing relationships with 

customers. Disclosures under this exception could be in connection with the audit of 

credit information, administration of a rewards program, or to provide an account 

statement. (Section 14)

• For specified other disclosures that a financial institution normally makes, such as to 

protect against or prevent actual or potential fraud; to the financial institution’s 

attorneys, accountants, and auditors; or to comply with applicable legal requirements, 

such as the disclosure of information to regulators. (Section 15)
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 5

Consumer and Customer:

The distinction between consumers and customers is significant because financial institutions have 

additional disclosure duties with respect to customers. All customers covered under the regulation 

are consumers, but not all consumers are customers.

A “consumer” is an individual, or that individual’s legal representative, who obtains or has obtained 

a financial product or service from a financial institution that, is to be used primarily for personal, 

family, or household purposes.

A “financial service” includes, among other things, a financial institution’s evaluation or brokerage 

of information that the institution collects in connection with a request or an application from a 

consumer for a financial product or service. For example, a financial service includes a lender’s 

evaluation of an application for a consumer loan or for opening a deposit account even if the 

application is ultimately rejected or withdrawn.

Consumers who are not customers are entitled to an initial privacy and opt-out notice only if their 

financial institution wants to share their nonpublic personal information with nonaffiliated third 

parties outside of the exceptions.

A “customer” is a consumer who has a “customer relationship” with a financial institution. A 

“customer relationship” is a continuing relationship between a consumer and a financial institution 

under which the institution provides one or more financial products or services to the consumer that 

are to be used primarily for personal, family, or household purposes.

• For example, a customer relationship may be established when a consumer engages in 

one of the following activities with a financial institution:

 Maintains a deposit or investment account;

 Obtains a loan;

 Enters into a lease of personal property; or

 Obtains financial, investment, or economic advisory services for a fee.

Customers are entitled to initial and annual privacy notices regardless of the information disclosure 

practices of their financial institution.

There is a special rule for loans. When a financial institution sells the servicing rights to a loan to 

another financial institution, the customer relationship transfers with the servicing rights. However, 

any information on the borrower retained by the institution that sells the servicing rights must be 

accorded the protections due any consumer.

• Note that isolated transactions alone will not cause a consumer to be treated as a 

customer. For example, if an individual purchases a bank check from a financial 

institution where the person has no account, the individual will be a consumer but not a 

customer of that institution because he or she has not established a customer 

relationship. Likewise, if an individual uses the ATM of a financial institution where the 

individual has no account, even repeatedly, the individual will be a consumer, but not a 

customer of that institution.
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 6

Financial Institution Duties

The regulations establish specific duties and limitations for a financial institution based on its 

activities. Financial institutions that intend to disclose nonpublic personal information outside the 

exceptions will have to provide opt-out rights to their customers and to consumers who are not 

customers. All financial institutions have an obligation to provide an initial and annual notice of 

their privacy policies to their customers. All financial institutions must abide by the regulatory 

limits on the disclosure of account numbers to nonaffiliated third parties and on the redisclosure and 

reuse of nonpublic personal information received from nonaffiliated financial institutions.

A brief summary of financial institution duties and limitations appears below. A more complete 

explanation of each appears in the regulations.

Notice and Opt-out Duties to Consumers:

If a financial institution intends to disclose nonpublic personal information about any of its 

consumers (whether or not they are customers) to a nonaffiliated third party, and an exception does 

not apply, then the financial institution must provide to the consumer:

• An initial notice of its privacy policies; 

• An opt-out notice (including, among other things, a reasonable means to opt out); and

• A reasonable opportunity, before the financial institution discloses the information to the 

nonaffiliated third party, to opt out.

The financial institution may not disclose any nonpublic personal information to nonaffiliated third 

parties except under the enumerated exceptions unless these notices have been provided and the 

consumer has not opted out. Additionally, the institution must provide a revised notice before the 

financial institution begins to share a new category of nonpublic personal information or shares 

information with a new category of nonaffiliated third party in a manner that was not described in 

the previous notice.

Note that a financial institution need not comply with the initial and opt-out notice requirements for 

consumers who are not customers if the institution limits disclosure of nonpublic personal 

information to the exceptions.

Notice Duties to Customers:

In addition to the duties described above, there are several duties unique to customers. In particular, 

regardless of whether the institution discloses or intends to disclose nonpublic personal information, 

a financial institution must provide notice to its customers of its privacy policies and practices at 

various times.

• A financial institution must provide an initial notice of its privacy policies and practices 

to each customer, not later than the time a customer relationship is established. Section 

4(e) of the regulations describes the exceptional cases in which delivery of the notice is 

allowed subsequent to the establishment of the customer relationship. 

• A financial institution must provide an annual notice at least once in any period of 12 

consecutive months during the continuation of the customer relationship.
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 7

• Generally, new privacy notices are not required for each new product or service. 

However, a financial institution must provide a new notice to an existing customer when 

the customer obtains a new financial product or service from the institution, if the initial 

or annual notice most recently provided to the customer was not accurate with respect to 

the new financial product or service. 

• When a financial institution does not disclose nonpublic personal information (other than 

as permitted under Section 14 and Section 15 exceptions) and does not reserve the right 

to do so, the institution has the option of providing a simplified notice.

Requirements for Notices

Clear and Conspicuous. Privacy notices must be clear and conspicuous, meaning they must be 

reasonably understandable and designed to call attention to the nature and significance of the 

information contained in the notice. The regulations do not prescribe specific methods for making a 

notice clear and conspicuous, but do provide examples of ways in which to achieve the standard, 

such as the use of short explanatory sentences or bullet lists, and the use of plain-language headings 

and easily readable typeface and type size. Privacy notices also must accurately reflect the 

institution’s privacy practices.

Delivery Rules. Privacy notices must be provided so that each recipient can reasonably be expected 

to receive actual notice in writing, or if the consumer agrees, electronically. To meet this standard, a 

financial institution could, for example, (1) hand-deliver a printed copy of the notice to its 

consumers, (2) mail a printed copy of the notice to a consumer’s last known address, or (3) for the 

consumer who conducts transactions electronically, post the notice on the institution’s website and 

require the consumer to acknowledge receipt of the notice as a necessary step to completing the 

transaction.

For customers only, a financial institution must provide the initial notice (as well as the annual 

notice and any revised notice) so that a customer may be able to retain or subsequently access the 

notice. A written notice satisfies this requirement. For customers who obtain financial products or 

services electronically, and agree to receive their notices on the institution’s website, the institution 

may provide the current version of its privacy notice on its website.
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 8

Notice Content. A privacy notice must contain specific disclosures. However, a financial institution 

may provide to consumers who are not customers a “short form” initial notice together with an optout notice stating that the institution’s privacy notice is available upon request and explaining a 

reasonable means for the consumer to obtain it. The following is a list of disclosures regarding 

nonpublic personal information that institutions must provide in their privacy notices, as applicable:

1. Categories of information collected;

2. Categories of information disclosed;

3. Categories of affiliates and nonaffiliated third parties to whom the institution may disclose 

information;

4. Policies with respect to the treatment of former customers’ information;

5. Information disclosed to service providers and joint marketers (Section 13);

6. An explanation of the opt-out right and methods for opting out;

7. Any opt-out notices the institution must provide under the Fair Credit Reporting Act with 

respect to affiliate information sharing;

8. Policies for protecting the security and confidentiality of information; and

9. A statement that the institution makes disclosures to other nonaffiliated third parties as 

permitted by law (Sections 14 and 15).

Model Privacy Notice Form. Appendix A to each federal banking agency’s privacy regulation 

contains the model privacy notice form jointly issued in 2009. A financial institution can use the 

model form to obtain a “safe harbor” for compliance with the content requirements for notifying 

consumers of its information-sharing practices and their right to opt out of certain sharing practices. 

To obtain the safe harbor, the institution must provide a model form in accordance with the 

instructions set forth in Appendix A of each agency’s privacy regulation. The final rule adopting the 

model privacy form and accompanying safe harbor became effective on December 31, 2009, except 

that notices that were provided on or before December 31, 2010, using sample clauses contained in 

Appendix B to the 2000 rule continued to receive the safe harbor for one year. Appendix B and the 

sample clauses are deleted from the agencies’ rules effective January 1, 2012.

Limitations on Disclosure of Account Numbers:

A financial institution must not disclose an account number or similar form of access number or 

access code for a credit card, deposit, or transaction account to any nonaffiliated third party (other 

than a consumer reporting agency) for use in telemarketing, direct mail marketing, or other 

marketing through electronic mail to the consumer.

The disclosure of encrypted account numbers without an accompanying means of decryption, 

however, is not subject to this prohibition. The regulation also expressly allows disclosures by a 

financial institution to its agent to market the institution’s own products or services (although the 

financial institution must not authorize the agent to directly initiate charges to the customer’s 

account). Also not barred are disclosures to participants in private-label or affinity card programs, 

where the participants are identified to the customer when the customer enters the program.
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 9

Redisclosure and Reuse Limitations on Nonpublic Personal Information 

Received:

If a financial institution receives nonpublic personal information from a nonaffiliated financial 

institution, its disclosure and use of the information is limited.

• For nonpublic personal information received under a Section 14 or 15 exception, the 

financial institution is limited to: 

 Disclosing the information to the affiliates of the financial institution from which it 

received the information;

 Disclosing the information to its own affiliates, who may, in turn, disclose and use 

the information only to the extent that the financial institution can do so; and

 Disclosing and using the information pursuant to a Section 14 or 15 exception (for 

example, an institution receiving information for account processing could disclose 

the information to its auditors).

• For nonpublic personal information received other than under a Section 14 or 15 

exception, the recipient’s use of the information is unlimited, but its disclosure of the 

information is limited to:

 Disclosing the information to the affiliates of the financial institution from which it 

received the information;

 Disclosing the information to its own affiliates, who may, in turn disclose the 

information only to the extent that the financial institution can do so; and 

 Disclosing the information to any other person, if the disclosure would be lawful if 

made directly to that person by the financial institution from which it received the 

information. For example, an institution that received a customer list from another 

financial institution could disclose the list (1) in accordance with the privacy policy 

of the financial institution that provided the list, (2) subject to any opt-out election or 

revocation by the consumers on the list, and (3) in accordance with appropriate 

exceptions under Sections 14 and 15. 
CFPB

Laws and Regulations PCFI

CFPB FFIEC Rev. 6/2011 PCFI 10

Other Matters

Fair Credit Reporting Act 

The regulations do not modify, limit, or supersede the operation of the Fair Credit Reporting Act.

State Law 

The regulations do not supersede, alter, or affect any state statute, regulation, order, or 

interpretation, except to the extent that it is inconsistent with the regulations. A state statute, 

regulation, order, etc. is consistent with the regulations if the protection it affords any consumer is 

greater than the protection provided under the regulations, as determined by the FTC.

Guidelines Regarding Protecting Customer Information

The regulations require a financial institution to disclose its policies and practices for protecting the 

confidentiality, security, and integrity of nonpublic personal information about consumers (whether 

or not they are customers). The disclosure need not describe these policies and practices in detail, 

but instead may describe in general terms who is authorized to have access to the information and 

whether the institution has security practices and procedures in place to ensure the confidentiality of 

the information in accordance with the institution’s policies.

The four federal banking agencies published guidelines, pursuant to Section 501(b) of the GrammLeach-Bliley Act, that address steps a financial institution should take in order to protect customer 

information. The guidelines relate only to information about customers, rather than all consumers. 

Compliance examiners should consider the findings of a 501(b) inspection during the compliance 

examination of a financial institution for purposes of evaluating the accuracy of the institution’s 

disclosure regarding data security.

References

Laws

15 USC 6802 et seq. Gramm-Leach-Bliley Act

Regulations

Federal Reserve Board Regulations (12 CFR)

Part 216 Privacy of Consumer Financial Information (Regulation P)
CFPB 

Examination Procedures PCFI

Privacy GLB Act FFIEC Rev. 6/2011 PCFI 1

Examination Objectives

• To assess the quality of a financial institution’s 

compliance management policies and procedures 

for implementing the privacy regulation, specifically ensuring consistency between what the financial 

institution tells consumers in its notices about its policies and practices and what it actually 

does. 

• To determine the reliance that can be placed on a financial institution’s internal controls and 

procedures for monitoring the institution’s compliance with the privacy regulation.

• To determine a financial institution’s compliance with the privacy regulation, specifically in 

meeting the following requirements:

o Providing to customers notices of its privacy policies and practices that are timely, accurate, 

clear and conspicuous, and delivered so that each customer can reasonably be expected to 

receive actual notice;

o Disclosing nonpublic personal information to nonaffiliated third parties, other than under an 

exception, after first meeting the applicable requirements for giving consumers notice and 

the right to opt out;

o Appropriately honoring consumer opt-out directions;

o Lawfully using or disclosing nonpublic personal information received from a nonaffiliated 

financial institution; and

o Disclosing account numbers only according to the limits in the regulations.

• To initiate effective corrective actions when violations of law are identified, or when policies or 

internal controls are deficient. 

Initial Procedures

1. Through discussions with management and review of available information, 

identify the institution’s information sharing practices (and changes to those 

practices) with affiliates and nonaffiliated third parties; how it treats nonpublic 

personal information; and how it administers opt outs. Consider the following as 

appropriate:

• Notices (initial, annual, revised, opt-out, short-form, and simplified);

• Institutional privacy policies and procedures, including those to:

 process requests for nonpublic personal information, including requests for 

aggregated data; 

 deliver notices to consumers;

 manage consumer opt-out directions (e.g., designating files, allowing a 

reasonable time to opt out, providing new opt-out and privacy notices when 

necessary, receiving opt-out directions, handling joint account holders);

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Procedures PCFI

Privacy GLB Act FFIEC Rev. 6/2011 PCFI 2

 prevent the unlawful disclosure and use of the information received from 

nonaffiliated financial institutions; and

 prevent the unlawful disclosure of account numbers.

• Information-sharing agreements between the institution and affiliates and service agreements or contracts between the institution and nonaffiliated third 

parties either to obtain or provide information or services;

• Complaint logs, telemarketing scripts, and any other information obtained 

from nonaffiliated third parties (Note: Review telemarketing scripts to determine whether the contractual terms set forth under Section 13 are met and 

whether the institution is disclosing account number information in violation 

of Section 12); 

• Categories of nonpublic personal information collected from or about consumers in obtaining a financial product or service (e.g., in the application 

process for deposit, loan, or investment products; for an over-the-counter purchase of a bank check; from E-banking products or services, including the 

data collected electronically through Internet cookies; or through ATM transactions);

• Categories of nonpublic personal information shared with, or received from, 

each nonaffiliated third party; 

• Consumer complaints regarding the treatment of nonpublic personal information, including those received electronically;

• Records that reflect the bank’s categorization of its information sharing practices under Sections 13, 14, 15, and outside of these exceptions; and

• Results of a 501(b) inspection (used to determine the accuracy of the institution’s privacy disclosures regarding data security).

[Click&type]

2. Use the information gathered from step 1 to work through the “Privacy Notice 

and Opt-Out Decision Tree” (Attachment A). Identify which module(s) of 

procedures is (are) applicable. 

Click&type]

3. Use the information gathered from step 1 to work through the Reuse and 

Redisclosure and Account Number Sharing Decision Trees, as necessary 

(Attachments B & C). Identify which module is applicable. 

[Click&type]

4. Determine the adequacy of the financial institution’s internal controls and 

procedures to ensure compliance with the privacy regulation as applicable. 
CFPB 

Examination Procedures PCFI

Privacy GLB Act FFIEC Rev. 6/2011 PCFI 3

Consider the following: 

• Sufficiency of internal policies and procedures, and controls, including 

review of new products and services and controls over servicing arrangements 

and marketing arrangements;

• Effectiveness of management information systems, including the use of 

technology for monitoring, exception reports, and standardization of forms 

and procedures;

• Frequency and effectiveness of monitoring procedures;

• Adequacy and regularity of the institution’s training program;

• Suitability of the compliance audit program for ensuring that:

o the procedures address all regulatory provisions as applicable;

o the work is accurate and comprehensive with respect to the institution’s 

information sharing practices;

o the frequency is appropriate;

o conclusions are appropriately reached and presented to responsible 

parties; 

o steps are taken to correct deficiencies and to follow-up on previously 

identified deficiencies; and

• Knowledge level of management and personnel.

[Click&type]

5. Ascertain areas of risk associated with the financial institution’s sharing practices 

(especially those within Section 13 and those that fall outside of the exceptions ) 

and any weaknesses found within the compliance management program. Keep in 

mind any outstanding deficiencies identified in the audit for follow-up when 

completing the modules.

[Click&type]

6. Based on the results of the foregoing initial procedures and discussions with 

management, determine which procedures if any should be completed in the 

applicable module, focusing on areas of particular risk. The selection of 

procedures to be employed depends upon the adequacy of the institution’s 

compliance management system and level of risk identified. Each module 

contains a series of general instructions to verify compliance, cross-referenced to 

cites within the regulation. Additionally, there are cross-references to a more 

comprehensive checklist, which the examiner may use if needed to evaluate 

compliance in more detail. 

[Click&type]
CFPB 

Examination Procedures PCFI

Privacy GLB Act FFIEC Rev. 6/2011 PCFI 4

7. Evaluate any additional information or documentation discovered during the 

course of the examination according to these procedures. Note that this may 

reveal new or different sharing practices necessitating reapplication of the 

Decision Trees and completion of additional or different modules.

[Click&type]

8. Formulate conclusions.

• Summarize all findings.

• For violation(s) noted, determine the cause by identifying weaknesses in internal controls, compliance review, training, management oversight, or other 

areas.

• Identify action needed to correct violations and weaknesses in the institution’s 

compliance system, as appropriate. 

• Discuss findings with management and obtain a commitment for corrective 

action. 

[Click&type]
CFPB 

Examination Procedures PCFI

Privacy GLB Act FFIEC Rev. 6/2011 PCFI 5

Examiner’s Summary, Recommendations, and 

Comments 

[Click&type]
CFPB 

Examination Procedures PCFI

Attachment A

CFPB FFIEC Rev. 6/2011 PCFI Attachment 1

DECISION TREE: PRIVACY 

NOTICE AND OPT-OUT 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]

Yes

Yes

Module 1

Privacy notice (presentation, 

content, and delivery)

(with or without Section 

13 notice & contracting)

Short-form notice (optional 

for consumers)

Customer notice delivery rules

Opt-out rules

Module 2

Privacy notice

Customer notice delivery rules

Section 13 notice & contracting

Does the financial institution 

share nonpublic personal 

information with nonaffiliated 

third parties under sections 13, 

and 14 and/or 15 but not 

outside the exceptions?

Yes

No

Does the financial 

institution share 

nonpublic personal 

information with 

nonaffiliated third parties 

only under sections 14 

and /or 15?

Module 3

Privacy notice

Simplified notice (if applicable)

Customer notice delivery rules

No

Does the financial institution 

share nonpublic personal 

information with nonaffiliated 

third parties under Sections 14 

and/or 15 and outside of the 

exceptions (with or without also 

sharing under 13)?
CFPB 

Examination Procedures PCFI

Attachment B

CFPB FFIEC Rev. 6/2011 PCFI Attachment 2

DECISION TREE: REUSE & REDISCLOSURE OF 

NONPUBLIC PERSONAL INFORMATION RECEIVED 

FROM NONAFFILIATED FINANCIAL INSTITUTIONS

(Sections 11(a) and 11(b))

Under 

Sections 

Outside of 

Sections 14 

and 15

Does the financial 

institution receive 

nonpublic personal 

information from 

nonaffiliated financial 

institutions?

Yes

No

Module 4

Receipt of 

information under 

14 and/or 15

Module 5

Receipt of 

information outside 

of 14 and/or 15

No review

necessary

How is that 

information 

received?
CFPB 

Examination Procedures PCFI

Attachment C

CFPB FFIEC Rev. 6/2011 PCFI Attachment 3

DECISION TREE: ACCOUNT NUMBER SHARING 

(Section 12)

* This may include sharing of encrypted account numbers, but not the decryption key. 

Does the financial institution share 

account numbers or similar access 

numbers or codes with nonaffiliated 

third parties (other than a consumer 

reporting agency) for telemarketing, 

direct mail, or electronic mail?

Module 6

Account 

number sharing

No review 

necessary

Yes

No*
CFPB 

Examination Procedures PCFI

Module 1

CFPB FFIEC Rev. 6/2011 PCFI Attachment 4

Module 1: Sharing nonpublic personal information 

with nonaffiliated third parties under Sections 14 

and/or 15 and outside of the exceptions (with or 

without also sharing under Section 13)

Note: Financial institutions whose practices fall within this category engage in the most expansive 

degree of information sharing permissible. Consequently, these institutions are held to the most 

comprehensive compliance standards imposed by the Privacy regulation. 

A. Disclosure of Nonpublic Personal Information 

1. Select a sample of third party relationships with nonaffiliated third parties and obtain a 

sample of data shared between the institution and the third party both inside and outside of 

the exceptions. The sample should include a cross-section of relationships but should 

emphasize those that are higher risk in nature as determined by the initial procedures. 

Perform the following comparisons to evaluate the financial institution’s compliance with 

disclosure limitations. 

a. Compare the categories of data shared and with whom the data were shared to those 

stated in the privacy notice and verify that what the institution tells consumers 

(customers and those who are not customers) in its notices about its policies and 

practices in this regard and what the institution actually does are consistent (§§10, 6).

b. Compare the data shared to a sample of opt-out directions and verify that only nonpublic 

personal information covered under the exceptions or from consumers (customers and 

those who are not customers) who chose not to opt out is shared (§10).

[Click&type]

2. If the financial institution also shares information under Section 13, obtain and review 

contracts with nonaffiliated third parties that perform services for the financial institution 

not covered by the exceptions in Section 14 or 15. Determine whether the contracts prohibit 

the third party from disclosing or using the information other than to carry out the purposes 

for which the information was disclosed. Note that the “grandfather” provisions of Section 

18 apply to certain of these contracts (§13(a)).

[Click&type]

B. Presentation, Content, and Delivery of Privacy Notices 

1. Review the financial institution’s initial, annual and revised notices, as well as any shortform notices that the institution may use for consumers who are not customers. Determine 

whether or not these notices:
CFPB 

Examination Procedures PCFI

Module 1

Privacy – Appendix A FFIEC Rev. 6/2011 PCFI Attachment 5

a. Are clear and conspicuous (§§3(b), 4(a), 5(a)(1), 8(a)(1));

b. Accurately reflect the policies and practices used by the institution (§§4(a), 5(a)(1), 

8(a)(1)). Note, this includes practices disclosed in the notices that exceed regulatory 

requirements; and

c. Include, and adequately describe, all required items of information and contain examples 

as applicable (§6). Note that if the institution shares under Section 13 the notice 

provisions for that section shall also apply.

d. If the model privacy form is used, determine that it reflects the institution’s policies and 

practices. For institutions seeking a safe harbor for compliance with the content 

requirements of the regulation, verify that the notice has the proper content and is in the 

proper format as specified in Appendix A of each agency’s privacy regulation.

[Click&type]

2. Through discussions with management, review of the institution’s policies and procedures, 

and a sample of electronic or written consumer records where available, determine if the 

institution has adequate procedures in place to provide notices to consumers, as appropriate. 

Assess the following:

a. Timeliness of delivery (§§4(a), 7(c), 8(a)); 

b. Reasonableness of the method of delivery (e.g., by hand; by mail; electronically, if the 

consumer agrees; or as a necessary step of a transaction) (§9); and

c. For customers only, review the timeliness of delivery (§§4(d), 4(e), 5(a)), means of 

delivery of annual notice (§9(c)), and accessibility of or ability to retain the notice 

(§9(e)).

[Click&type]

C. Opt-Out Right 

1. Review the financial institution’s opt-out notices. An opt-out notice may be combined with 

the institution’s privacy notices. Regardless, determine whether the opt-out notices:

a. Are clear and conspicuous (§§3(b) and 7(a)(1));

b. Accurately explain the right to opt out (§7(a)(1));

c. Include and adequately describe the three required items of information (the institution’s 

policy regarding disclosure of nonpublic personal information, the consumer’s opt-out 

right, and the means to opt out) (§7(a)(1)); and

d. Describe how the institution treats joint consumers (customers and those who are not 

customers), as applicable (§7(d)). 

[Click&type]
CFPB 

Examination Procedures PCFI

Module 1

Privacy – Appendix A FFIEC Rev. 6/2011 PCFI Attachment 6

2. Through discussions with management, review of the institution’s policies and procedures, 

and a sample of electronic or written records where available, determine if the institution has 

adequate procedures in place to provide the opt-out notice and comply with opt-out 

directions of consumers (customers and those who are not customers), as appropriate. 

Assess the following:

a. Timeliness of delivery (§10(a)(1));

b. Reasonableness of the method of delivery (e.g., by hand; by mail; electronically, if the 

consumer agrees; or as a necessary step of a transaction) (§9);

c. Reasonableness of the opportunity to opt out (the time allowed to and the means by 

which the consumer may opt out) (§§10(a)(1)(iii), 10(a)(3)); and

d. Adequacy of procedures to implement and track the status of a consumer's (customers 

and those who are not customers) opt-out direction, including those of former customers 

(§7(e), (f), (g)).

[Click&type]

D. Checklist Cross References

Regulation Section Subject Checklist Questions

4(a); 6(a, b, c, e); and 

9(a, b, g)

Privacy notices (presentation, content, 

and delivery)

2, 8-11, 14, 18, 35, 36, 

40

4(a, c, d, e); 5; and 9(c, e) Customer notice delivery rules 1, 3-7, 37, 38

13 Section 13 notice and contracting rules 

(as applicable)

12, 47

6(d) Short form notice rules (optional for 

consumers only)

15-17

7; 8; and 10 Opt-out rules 19-34, 41-43

14, 15 Exceptions 48, 49, 50
CFPB 

Examination Procedures PCFI

Module 2

CFPB FFIEC Rev. 6/2011 PCFI Attachment 7

Module 2: Sharing nonpublic personal information 

with nonaffiliated third parties under Sections 13, 

and 14 and/or 15 but not outside of these exceptions

A. Disclosure of Nonpublic Personal Information 

1. Select a sample of third party relationships with nonaffiliated third parties and obtain a 

sample of data shared between the institution and the third party. The sample should include 

a cross-section of relationships but should emphasize those that are higher risk in nature as 

determined by the initial procedures. Perform the following comparisons to evaluate the 

financial institution’s compliance with disclosure limitations. 

a. Compare the data shared and with whom the data were shared to ensure that the 

institution accurately categorized its information sharing practices and is not sharing 

nonpublic personal information outside the exceptions (§§13, 14, 15).

b. Compare the categories of data shared and with whom the data were shared to those 

stated in the privacy notice and verify that what the institution tells consumers in its 

notices about its policies and practices in this regard and what the institution actually 

does are consistent (§§10, 6).

c. If the model privacy form is used, determine that it reflects the institution’s policies and 

practices. For institutions seeking a safe harbor for compliance with the content 

requirements of the regulation, verify that the notice has the proper content and is in the 

proper format as specified in Appendix A of each agency’s privacy regulation.

[Click&type]

2. Review contracts with nonaffiliated third parties that perform services for the financial 

institution not covered by the exceptions in Section 14 or 15. Determine whether the 

contracts adequately prohibit the third party from disclosing or using the information other 

than to carry out the purposes for which the information was disclosed. Note that the 

“grandfather” provisions of Section 18 apply to certain of these contracts. (§13(a))

[Click&type]

B. Presentation, Content, and Delivery of Privacy Notices 

1. Review the financial institution’s initial and annual privacy notices. Determine whether or 

not they:

a. Are clear and conspicuous (§§3(b), 4(a), 5(a)(1));

b. Accurately reflect the policies and practices used by the institution (§§4(a), 5(a)(1)). 

Note, this includes practices disclosed in the notices that exceed regulatory 

requirements; and
CFPB 

Examination Procedures PCFI

Module 2

Privacy – Appendix A FFIEC Rev. 6/2011 PCFI Attachment 8

c. Include, and adequately describe, all required items of information and contain examples 

as applicable (§§6, 13).

[Click&type]

2. Through discussions with management, review of the institution’s policies and procedures, 

and a sample of electronic or written consumer records where available, determine if the 

institution has adequate procedures in place to provide notices to consumers, as appropriate. 

Assess the following:

a. Timeliness of delivery (§4(a)); 

b. Reasonableness of the method of delivery (e.g., by hand; by mail; electronically, if the 

consumer agrees; or as a necessary step of a transaction) (§9); and

c. For customers only, review the timeliness of delivery (§§4(d), 4(e), and 5(a)), means of 

delivery of annual notice §9(c)), and accessibility of or ability to retain the notice 

(§9(e)).

[Click&type]

C. Checklist Cross References 

Regulation Section Subject Checklist Questions

4(a); 6(a, b, c, e); and 

9(a, b, g)

Privacy notices (presentation, content, 

and delivery) 

2, 8-11, 14, 18, 35, 36, 

40

13 Section 13 notice and contracting rules 12, 47

4(a, c, d, e); 5; and 9(c, e) Customer notice delivery rules 1, 3-7, 37, 38

14, 15 Exceptions 48, 49, 50
CFPB 

Examination Procedures PCFI

Module 3

CFPB FFIEC Rev. 6/2011 PCFI Attachment 9

Module 3: Sharing nonpublic personal information 

with nonaffiliated third parties only under

Sections 14 and/or 15

Note: This module applies only to customers.

A. Disclosure of Nonpublic Personal Information

1. Select a sample of third party relationships with nonaffiliated third parties and obtain a 

sample of data shared between the institution and the third party. 

a. Compare the data shared and with whom the data were shared to ensure that the 

institution accurately states its information sharing practices and is not sharing nonpublic 

personal information outside the exceptions.

[Click&type]

B. Presentation, Content, and Delivery of Privacy Notices 

1. Obtain and review the financial institution’s initial and annual notices, as well as any 

simplified notice that the institution may use. Note that the institution may only use the 

simplified notice when it does not also share nonpublic personal information with affiliates 

outside of Section 14 and 15 exceptions. Determine whether or not these notices:

a. Are clear and conspicuous (§§3(b), 4(a), 5(a)(1));

b. Accurately reflect the policies and practices used by the institution (§§4(a), 5(a)(1)). 

Note, this includes practices disclosed in the notices that exceed regulatory 

requirements; and

c. Include, and adequately describe, all required items of information (§6).

d. If the model privacy form is used, determine that it reflects the institution’s policies and 

practices. For institutions seeking a safe harbor for compliance with the content 

requirements of the regulation, verify that the notice has the proper content and is in the 

proper format as specified in Appendix A of each agency’s privacy regulation.

[Click&type]
CFPB 

Examination Procedures PCFI

Module 4

Privacy – Appendix A FFIEC Rev. 6/2011 PCFI Attachment 10

2. Through discussions with management, review of the institution’s policies and procedures, 

and a sample of electronic or written customer records where available, determine if the 

institution has adequate procedures in place to provide notices to customers, as appropriate. 

Assess the following:

a. Timeliness of delivery (§§4(a), 4(d), 4(e), 5(a)); and

b. Reasonableness of the method of delivery (e.g., by hand; by mail; electronically, if the 

customer agrees; or as a necessary step of a transaction) (§9) and accessibility of or 

ability to retain the notice (§9(e)).

[Click&type]

C.

Regulation Section Subject Checklist Questions

6 Customer notice content and 

presentation

8-11, 14, 18

6 (c)(5) Simplified notice content (optional) 13

4 (a, d, e); 5; and 9 Customer notice delivery process 1, 3-7, 35-40

14, 15 Exceptions 48, 49, 50
CFPB 

Examination Procedures PCFI

Module 4

CFPB FFIEC Rev. 6/2011 PCFI Attachment 11

Module 4: Reuse & Redisclosure of nonpublic 

personal information received from a nonaffiliated 

financial institution under Sections 14 and/or 15

A. Through discussions with management and review of the institution’s procedures, determine 

whether the institution has adequate practices to prevent the unlawful redisclosure and reuse of 

the information where the institution is the recipient of nonpublic personal information (§11(a)).

[Click&type]

B. Select a sample of data received from nonaffiliated financial institutions, to evaluate the 

financial institution’s compliance with reuse and redisclosure limitations.

1. Verify that the institution’s redisclosure of the information was only to affiliates of the 

financial institution from which the information was obtained or to the institution’s own 

affiliates, except as otherwise allowed in step 2 below (§11(a)(1)(i) and (ii)).

[Click&type]

2. Verify that the institution only uses and shares the data pursuant to an exception in Sections 

14 and 15 (§11(a)(1)(iii)).

[Click&type]

C. Checklist Cross References

Regulation Section Subject Checklist Question

11(a) Reuse and redisclosure 44
CFPB 

Examination Procedures PCFI

Module 5

CFPB FFIEC Rev. 6/2011 PCFI Attachment 12

Module 5: Redisclosure of nonpublic personal 

information received from a nonaffiliated financial 

institution outside of Sections 14 and 15

A. Through discussions with management and review of the institution’s procedures, determine 

whether the institution has adequate practices to prevent the unlawful redisclosure of the 

information where the institution is the recipient of nonpublic personal information (§11(b)). 

[Click&type]

B. Select a sample of data received from nonaffiliated financial institutions and shared with others 

to evaluate the financial institution’s compliance with redisclosure limitations.

1. Verify that the institution’s redisclosure of the information was only to affiliates of the 

financial institution from which the information was obtained or to the institution’s own 

affiliates, except as otherwise allowed in the step b below (§11(b)(1)(i) and (ii)).

[Click&type]

2. If the institution shares information with entities other than those under step a above, verify 

that the institution’s information sharing practices conform to those in the nonaffiliated 

financial institution’s privacy notice (§11(b)(1)(iii)).

[Click&type]

3. Also, review the procedures used by the institution to ensure that the information sharing 

reflects the opt-out status of the consumers of the nonaffiliated financial institution (§§10, 

11(b)(1)(iii)). 

[Click&type]

C. Checklist Cross References

Regulation Section Subject Checklist Question

11(b) Reuse and redisclosure 45
CFPB 

Examination Procedures PCFI

Module 6

CFPB FFIEC Rev. 6/2011 PCFI Attachment 13

Module 6: Account number sharing

A. If available, review a sample of telemarketer scripts used when making sales calls to determine 

whether the scripts indicate that the telemarketers have the account numbers of the institution’s 

consumers (§12).

[Click&type]

B. Obtain and review a sample of contracts with agents or service providers to whom the financial 

institution discloses account numbers for use in connection with marketing the institution's own 

products or services. Determine whether the institution shares account numbers with 

nonaffiliated third parties only to perform marketing for the institution’s own products and 

services. Ensure that the contracts do not authorize these nonaffiliated third parties to directly 

initiate charges to customer’s accounts (§12(b)(1)). 

[Click&type]

C. Obtain a sample of materials and information provided to the consumer upon entering a private 

label or affinity credit card program. Determine if the participants in each program are 

identified to the customer when the customer enters into the program (§12(b)(2)).

[Click&type]

D. Checklist Cross References

Regulation Section Subject Checklist Question

12 Account number sharing 46
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 1

Privacy of Consumer 

Financial Information

SUBPART A

Initial Privacy Notice

NOTE: No notice is required if nonpublic personal information is disclosed to nonaffiliated third parties only under an exception in Sections 14 and 15, and there is no 

customer relationship. [§4(b)] With respect to credit relationships, an institution establishes a customer relationship when it originates a consumer loan. If the institution 

subsequently sells the servicing rights to the loan to another financial institution, the 

customer relationship transfers with the servicing rights. [§4(c)]

1. Does the institution provide a clear and conspicuous notice that accurately reflects its 

privacy policies and practices to all customers not later than when the customer relationship is established, other than as allowed in paragraph (e) of Section four (4) of the 

regulation [§4(a)(1))]?

2. Does the institution provide a clear and conspicuous notice that accurately reflects its 

privacy policies and practices to all consumers, who are not customers, before any 

nonpublic personal information about the consumer is disclosed to a nonaffiliated third 

party, other than under an exception in Sections 14 or 15 [§4(a)(2)]?

3. Does the institution provide to existing customers, who obtain a new financial product 

or service, an initial privacy notice that covers the customer's new financial product or 

service, if the most recent notice provided to the customer was not accurate with respect 

to the new financial product or service [§4(d)(1)] ?

4. Does the institution provide initial notice after establishing a customer relationship

only if:

 The customer relationship is not established at the customer's election [§4(e)(1)(i)] 

or 

 To do otherwise would substantially delay the customer's transaction (e.g. in the 

case of a telephone application), and the customer agrees to the subsequent delivery 

[§4 (e)(1)(ii)]?

5. When the subsequent delivery of a privacy notice is permitted, does the institution provide notice after establishing a customer relationship within a reasonable time [§4(e)]?

Annual Privacy Notice

6. Does the institution provide a clear and conspicuous notice that accurately reflects its 

privacy policies and practices at least annually (that is, at least once in any period of 12 

consecutive months) to all customers, throughout the customer relationship? 

[§5(a)(1)and (2)] 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 2

NOTE: Annual notices are not required for former customers [§5(b)(1)and (2)].

7. Does the institution provide an annual privacy notice to each customer whose loan the 

institution owns the right to service [§§5(c), 4(c)(2)]?

Content of Privacy Notices

8. Do the initial, annual, and revised privacy notices include each of the following, as applicable:

 The categories of nonpublic personal information that the institution collects 

[§6(a)(1)];

 The categories of nonpublic personal information that the institution discloses 

[§6(a)(2)];

 The categories of affiliates and nonaffiliated third parties to whom the institution 

discloses nonpublic personal information, other than parties to whom information is 

disclosed under an exception in Section14 or 15 [§6(a)(3)];

 The categories of nonpublic personal information disclosed about former customers, 

and the categories of affiliates and nonaffiliated third parties to whom the institution 

discloses that information, other than those parties to whom the institution discloses 

information under an exception in Section 14 or 15 [§6(a)(4)];

 If the institution discloses nonpublic personal information to a nonaffiliated third 

party under §13, and no exception under Section 14 or 15 applies, a separate statement of the categories of information the institution discloses and the categories of 

third parties with whom the institution has contracted [§6(a)(5)];

 An explanation of the opt-out right, including the method(s) of opt out that the consumer can use at the time of the notice [§6(a)(6)];

 Any disclosures that the institution makes under §603(d)(2)(A)(iii) of the Fair Credit Reporting Act (FCRA) [§6(a)(7)];

 The institution’s policies and practices with respect to protecting the confidentiality 

and security of nonpublic personal information [§6(a)(8)]; and

 A general statement—with no specific reference to the third parties—that the institution makes disclosures to other nonaffiliated third parties for everyday business 

purposes, such as (with the institution including all that are applicable) to process 

transactions, maintain accounts, respond to court orders and legal investigations, or 

report to credit bureaus, or as otherwise permitted by law [§6(a)(9),(b)(1) and (2)]?

NOTE: Institutions that provide a model privacy form in accordance with the instructions in Appendix A of each agency’s regulation will receive a safe harbor for 

compliance with the content requirements of the regulation. The final model privacy 

notice form and accompanying safe harbor became effective on December 31, 2009, 
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 3

except that notices that were provided on or before December 31, 2010, using sample 

clauses contained in Appendix B to the 2000 rule continued to receive the safe harbor 

for one year. Appendix B and the sample clauses are deleted from the agencies’ rules 

effective January 1, 2012.

9. Does the institution list the following categories of nonpublic personal information that 

it collects, as applicable:

 Information from the consumer [§6(c)(1)(i)],

 Information about the consumer’s transactions with the institution or its affiliates 

[§6(c)(1)(ii)],

 Information about the consumer’s transactions with nonaffiliated third parties 

[§6(c)(1)(iii)], and

 Information from a consumer reporting agency [§6(c)(1)(iv)]?

10. Does the institution list the following categories of nonpublic personal information that 

it discloses, as applicable, and a few examples of each, or alternatively state that it reserves the right to disclose all the nonpublic personal information that it collects:

 Information from the consumer,

 Information about the consumer’s transactions with the institution or its affiliates,

 Information about the consumer’s transactions with nonaffiliated third parties, and 

 Information from a consumer reporting agency [§6(c)(2)]?

NOTE: Examples are recommended under Section 6(c)(2) although not under Section 

6(c)(1).

11. Does the institution list the following categories of affiliates and nonaffiliated third parties to whom it discloses information, as applicable, and a few examples to illustrate the 

types of the third parties in each category:

 Financial service providers [§6(c)(3)(i)],

 Non-financial companies [§6(c)(3)(ii)], and 

 Others [§6(c)(3)(iii)]?

12. Does the institution make the following disclosures regarding service providers and 

joint marketers to whom it discloses nonpublic personal information under Section 13:

 As applicable, the same categories and examples of nonpublic personal information 

disclosed as described in paragraphs (a)(2) and (c)(2) of Section six (6) (see questions 8b and 10)and [§6(c)(4)(i)];
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 4

 That the third party is a service provider that performs marketing on the institution’s 

behalf or on behalf of the institution and another financial institution[§6(c)(4)(ii)(A)]; or

 That the third party is a financial institution with which the institution has a joint 

marketing agreement [§6(c)(4)(ii)(B)]?

13. If the institution does not disclose nonpublic personal information, and does not reserve 

the right to do so, other than under exceptions in §14 and §15, does the institution provide a simplified privacy notice that contains at a minimum:

 A statement to this effect,

 The categories of nonpublic personal information it collects,

 The policies and practices the institution uses to protect the confidentiality and security of nonpublic personal information, and

 A general statement that the institution makes disclosures to other nonaffiliated 

third parties as permitted by law [§6(c)(5)]?

NOTE: Use of this type of simplified notice is optional; an institution may always use a 

full notice.

14. Does the institution describe the following about its policies and practices with respect 

to protecting the confidentiality and security of nonpublic personal information:

 Who is authorized to have access to the information[§6(c)(6)(i)] and

 Whether security practices and policies are in place to ensure the confidentiality of 

the information in accordance with the institution’s policy [§6(c)(6)(ii)]?

NOTE: The institution is not required to describe technical information about the safeguards used in this respect.

15. If the institution provides a short-form initial privacy notice with the opt-out notice, 

does the institution do so only to consumers with whom the institution does not have a 

customer relationship [§6(d)(1)]?

16. If the institution provides a short-form initial privacy notice according to Section 

6(d)(1), does the short-form initial notice: 

 Conform to the definition of “clear and conspicuous” [§6(d)(2)(i)],

 State that the institution's full privacy notice is available upon request [§6(d)(2)(ii)], 

and 

 Explain a reasonable means by which the consumer may obtain the notice 

[§6(d)(2)(iii)]?
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 5

NOTE: The institution is not required to deliver the full privacy notice with the shortform initial notice. [§6(d)(3)])

17. Does the institution provide consumers who receive the short-form initial notice with a 

reasonable means of obtaining the longer initial notice, such as:

 A toll-free telephone number that the consumer may call to request the notice 

[§6(d)(4)(i)] or

 For the consumer who conducts business in person at the institution's office, having 

copies available to provide immediately by hand-delivery [§6(d)(4)(ii)]?

18. If the institution, in its privacy policies, reserves the right to disclose nonpublic personal 

information to nonaffiliated third parties in the future, does the privacy notice include, 

as applicable, the:

 Categories of nonpublic personal information that the financial institution reserves 

the right to disclose in the future, but does not currently disclose [§6(e)(1)] and

 Categories of affiliates or nonaffiliated third parties to whom the financial institution reserves the right in the future to disclose, but to whom it does not currently 

disclose, nonpublic personal information [§6(e)(2)]?

Opt-Out Notice

19. If the institution discloses nonpublic personal information about a consumer to a nonaffiliated third party, and the exceptions under §§13-15 do not apply, does the institution 

provide the consumer with a clear and conspicuous opt-out notice that accurately explains the right to opt out [§7(a)(1)]?

20. Does the opt-out notice state:

 That the institution discloses or reserves the right to disclose nonpublic personal 

information about the consumer to a nonaffiliated third party [§7(a)(1)(i)],

 That the consumer has the right to opt out of that disclosure [§7(a)(1)(ii)], and 

 A reasonable means by which the consumer may opt out [§7(a)(1)(iii)]?

21. Does the institution provide the consumer with the following information about the 

right to opt out:

 All the categories of nonpublic personal information that the institution discloses or 

reserves the right to disclose [§7(a)(2)(i)(A)],

 All the categories of nonaffiliated third parties to whom the information is disclosed 

[§7(a)(2)(i)(A)],

 That the consumer has the right to opt out of the disclosure of that information 
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 6

[§7(a)(2)(i)(A)], and

 The financial products or services that the consumer obtains to which the 

opt-out direction would apply [§7(a)(2)(i)(B)]?

22. Does the institution provide the consumer with at least one of the following reasonable 

means of opting out, or with another reasonable means:

 Check-off boxes prominently displayed on the relevant forms with the opt-out notice [§7(a)(2)(ii)(A)];

 A reply form included with the opt-out notice [§7(a)(2)(ii)(B)];

 An electronic means to opt out, such as a form that can be sent via electronic mail 

or a process at the institution’s website, if the consumer agrees to the electronic delivery of information [§7(a)(2)(ii)(C)]; or

 A toll-free telephone number [§7(a)(2)(ii)(D)]?

NOTE: The institution may require the consumer to use one specific means, as long as 

that means is reasonable for that consumer [§7(a)(iv)].

23. If the institution delivers the opt-out notice after the initial notice, does the institution 

provide the initial notice once again with the opt-out notice [§7(c)]?

24. Does the institution provide an opt-out notice, explaining how the institution will treat 

opt-out directions by the joint consumers, to at least one party in a joint consumer relationship [§7(d)(1)]?

25. Does the institution permit each of the joint consumers in a joint relationship to opt out 

[§7(d)(2)]?

26. Does the opt-out notice to joint consumers state that either:

 The institution will consider an opt out by a joint consumer as applying to all associated joint consumers [§7(d)(2)(i)] or

 Each joint consumer is permitted to opt out separately [§7(d)(2)(ii)]?

27. If each joint consumer may opt out separately, does the institution permit:

 One joint consumer to opt out on behalf of all of the joint consumers [§7(d)(3)],

 The joint consumers to notify the institution in a single response [§7(d)(5)], and

 Each joint consumer to opt out either for himself or herself and/or for another joint 

consumer [§7(d)(5)]?
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 7

28. Does the institution refrain from requiring all joint consumers to opt out before implementing any opt-out direction with respect to the joint account [§7(d)(4)]?

29. Does the institution comply with a consumer's direction to opt out as soon as is reasonably practicable after receiving it [§7(e)]?

30. Does the institution allow the consumer to opt out at any time [§7(f)]?

31. Does the institution continue to honor the consumer's opt-out direction until revoked by 

the consumer in writing, or, if the consumer agrees, electronically [§7(g)(1)]?

32. When a customer relationship ends, does the institution continue to apply the customer’s opt-out direction to the nonpublic personal information collected during, or related 

to, that specific customer relationship (but not to new relationships, if any, subsequently 

established by that customer) [§7(g)(2)]?

Revised Notices

33. Except as permitted by Sections 13-15, does the institution refrain from disclosing any 

nonpublic personal information about a consumer to a nonaffiliated third party, other 

than as described in the initial privacy notice provided to the consumer, unless:

 The institution has provided the consumer with a clear and conspicuous revised notice that accurately describes the institution's privacy policies and practices, 

[§8(a)(1)],

 The institution has provided the consumer with a new opt-out notice [§8(a)(2)],

 The institution has given the consumer a reasonable opportunity to opt out of the 

disclosure, before disclosing any information [§8(a)(3)], and

 The consumer has not opted out [§8(a)(4)]?

34. Does the institution deliver a revised privacy notice when it:

 Discloses a new category of nonpublic personal information to a nonaffiliated third 

party [§8(b)(1)(i)],

 Discloses nonpublic personal information to a new category of nonaffiliated third 

party [§8(b)(1)(ii)], or 

 Discloses nonpublic personal information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an 

opt-out right regarding that disclosure [§8(b)(1)(iii)]?

NOTE: A revised notice is not required if the institution adequately described the nonaffiliated third party or information to be disclosed in the prior privacy notice [§8(b)(2).
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 8

Delivery Methods

35. Does the institution deliver the privacy and opt-out notices, including the short-form 

notice, so that the consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically [§9(a)]?

36. Does the institution use a reasonable means for delivering the notices, such as: 

 Hand-delivery of a printed copy [§9(b)(1)(i)];

 Mailing a printed copy to the last known address of the consumer [§9(b)(1)(ii)];

 For the consumer who conducts transactions electronically, clearly and conspicuously posting the notice on the institution’s electronic site and requiring the 

consumer to acknowledge receipt as a necessary step to obtaining a financial product or service [§9(b)(1)(iii)]; or

 For isolated transactions, such as ATM transactions, posting the notice on the 

screen and requiring the consumer to acknowledge receipt as a necessary step to obtaining the financial product or service [§9(b)(1)(iv)]?

NOTE: Insufficient or unreasonable means of delivery include: exclusively oral notice, 

in person or by telephone; branch or office signs or generally published advertisements; 

and electronic mail to a customer who does not obtain products or services electronically [§9 (b)(2)(i) and (ii), and (d)].

37. For annual notices only, if the institution does not employ one of the methods described 

in question 36, does the institution employ one of the following reasonable means of 

delivering the notice such as: 

 For the customer who uses the institution’s website to access products and services 

electronically and who agrees to receive notices at the website, continuously posting 

the current privacy notice on the website in a clear and conspicuous manner[§9(c)(1)] or

 For the customer who has requested the institution refrain from sending any information about the customer relationship, making copies of the current privacy notice 

available upon customer request [§9(c)(2)]?

38. For customers only, does the institution ensure that the initial, annual, and revised notices may be retained or obtained later by the customer in writing, or if the customer 

agrees, electronically [§9(e)(1)]?

39. Does the institution use an appropriate means to ensure that notices may be retained or 

obtained later, such as:

 Hand-delivery of a printed copy of the notice [§9(e)(2)(i)],

 Mailing a printed copy to the last known address of the customer [§9(e)(2)(ii)], or
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 9

 Making the current privacy notice available on the institution’s website (or via a 

link to the notice at another site) for the customer who agrees to receive the notice 

at the website [§9(e)(2)(iii)]?

40. Does the institution provide at least one initial, annual, and revised notice, as applicable, 

to joint consumers [§9(g)]?

SUBPART B

Limits on Disclosure to Nonaffiliated Third Parties

41. Does the institution refrain from disclosing any nonpublic personal information about a 

consumer to a nonaffiliated third party, other than as permitted under §§13-15, unless:

 It has provided the consumer with an initial notice [§10(a)(1)(i)],

 It has provided the consumer with an opt-out notice [§10(a)(1)(ii)],

 It has given the consumer a reasonable opportunity to opt out before the disclosure 

[§10(a)(1)(iii)], and

 The consumer has not opted out [§10(a)(1)(iv)]?

NOTE: This disclosure limitation applies to consumers as well as to customers 

[§10(b)(1)], and to all nonpublic personal information regardless of whether collected 

before or after receiving an opt-out direction [§10(b)(2)].

42. Does the institution provide the consumer with a reasonable opportunity to opt out such 

as by:

 Mailing the notices required by Section 10 and allowing the consumer to respond 

by toll-free telephone number, return mail, or other reasonable means (see question 

22) within 30 days from the date mailed [§10(a)(3)(i)];

 Where the consumer opens an on-line account with the institution and agrees to receive the notices required by Section 10 electronically, allowing the consumer to 

opt out by any reasonable means (see question 22) within 30 days from consumer 

acknowledgement of receipt of the notice in conjunction with opening the account 

[§10(a)(3)(ii)]; or

 For isolated transactions, providing the notices required by Section 10 at the time of 

the transaction and requesting that the consumer decide, as a necessary part of the 

transaction, whether to opt out before the completion of the transaction 

[§10(a)(3)(iii)]?

43. Does the institution allow the consumer to select certain nonpublic personal information or certain nonaffiliated third parties with respect to which the consumer wishes to 

opt out [§10(c)]?
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 10

NOTE: An institution may allow partial opt outs in addition to, but may not allow them 

instead of, a comprehensive opt out.

Limits on Redisclosure and Reuse of Information

44. If the institution receives information from a nonaffiliated financial institution under an 

exception in §14 or §15, does the institution refrain from using or disclosing the information except:

 To disclose the information to the affiliates of the financial institution from which it 

received the information [§11(a)(1)(i)];

 To disclose the information to its own affiliates, which are in turn limited by the 

same disclosure and use restrictions as the recipient institution [§11(a)(1)(ii)]; and

 To disclose and use the information pursuant to an exception in §14 or §15 in the 

ordinary course of business to carry out the activity covered by the exception under 

which the information was received [§11(a)(1)(iii)]?

NOTE: The disclosure or use described in section c of this question need not be directly 

related to the activity covered by the applicable exception. For instance, an institution 

receiving information for fraud-prevention purposes could provide the information to its 

auditors. But “in the ordinary course of business” does not include marketing 

[§11(a)(2)].

45. If the institution receives information from a nonaffiliated financial institution other 

than under an exception in Section 14 or 15, does the institution refrain from disclosing 

the information except:

 To the affiliates of the financial institution from which it received the information 

[§11(b)(1)(i)];

 To its own affiliates, which are in turn limited by the same disclosure restrictions as 

the recipient institution [§11(b)(1)(ii)]; and

 To any other person, if the disclosure would be lawful if made directly to that person by the institution from which the recipient institution received the information 

[§11(b)(1)(iii)]?
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 11

Limits on Sharing Account Number Information for Marketing Purposes

46. Does the institution refrain from disclosing, directly or through affiliates, account numbers or similar forms of access numbers or access codes for a consumer's credit card 

account, deposit account, or transaction account to any nonaffiliated third party (other 

than to a consumer reporting agency) for telemarketing, direct mail or electronic mail 

marketing to the consumer, except:

 To the institution’s agents or service providers solely to market the institution’s own 

products or services, as long as the agent or service provider is not authorized to directly initiate charges to the account [§12(b)(1)] or

 To a participant in a private label credit card program or an affinity or similar program where the participants in the program are identified to the customer when the 

customer enters into the program [§12(b)(2)]?

NOTE: An “account number or similar form of access number or access code” does not 

include numbers in encrypted form, so long as the institution does not provide the recipient with a means of decryption. [§12(c)(1)] A transaction account does not include 

an account to which third parties cannot initiate charges [§12(c)(2)].

SUBPART C

Exception to Opt-Out Requirements for Service Providers and Joint Marketing

47. If the institution discloses nonpublic personal information to a nonaffiliated third party 

without permitting the consumer to opt out, do the opt-out requirements of Sections 7 

and 10 and the revised notice requirements in Section 8 not apply because:

 The institution disclosed the information to a nonaffiliated third party who performs 

services for or functions on behalf of the institution (including joint marketing of financial products and services offered pursuant to a joint agreement as defined in 

paragraph (b) of §13) [§13(a)(1)];

 The institution has provided consumers with the initial notice [§13(a)(1)(i)]; and

 The institution has entered into a contract with that party prohibiting the party from 

disclosing or using the information except to carry out the purposes for which the 

information was disclosed, including use under an exception in §14 or §15 in the 

ordinary course of business to carry out those purposes [§13(a)(1)(ii)]?
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 12

Exceptions to Notice and Opt-Out Requirements for Processing and Servicing 

Transactions

48. If the institution discloses nonpublic personal information to nonaffiliated third parties, 

do the requirements for initial notice in §4(a)(2), opt out in §§7 and 10, revised notice in 

§8, and for service providers and joint marketing in §13, not apply because the information is disclosed as necessary to effect, administer, or enforce a transaction that the 

consumer requests or authorizes, or in connection with:

 Servicing or processing a financial product or service requested or authorized by the 

consumer [§14(a)(1)];

 Maintaining or servicing the consumer's account with the institution or with another 

entity as part of a private label credit card program or other credit extension on behalf of the entity or [§14(a)(2)];

 A proposed or actual securitization, secondary market sale (including sale of servicing rights) or other similar transaction related to a transaction of the consumer 

[§14(a)(3)]?

49. If the institution uses a Section 14 exception as necessary to effect, administer, or enforce a transaction, is it :

 Required, or is one of the lawful or appropriate methods to enforce the rights of the 

institution or other persons engaged in carrying out the transaction or providing the 

product or service [§14(b)(1)] or

 Required, or is a usual, appropriate, or acceptable method to[§14(b)(2)]:

 carry out the transaction or the product or service business of which the transaction is a part, including recording, servicing, or maintaining the consumer's 

account in the ordinary course of business [§14(b)(2)(i)];

 administer or service benefits or claims [§14(b)(2)(ii)];

 confirm or provide a statement or other record of the transaction or information 

on the status or value of the financial service or financial product to the consumer or the consumer’s agent or broker [§14(b)(2)(iii)];

 accrue or recognize incentives or bonuses [§14(b)(2)(iv)];

 underwrite insurance or for reinsurance or for certain other purposes related to 

a consumer's insurance [§14(b)(2)(v)]; or 

 in connection with: 
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 13

o the authorization, settlement, billing, processing, clearing, transferring, 

reconciling, or collection of amounts charged, debited, or otherwise 

paid by using a debit, credit, or other payment card, check, or account 

number, or by other payment means [§14(b)(2)(vi)(A)];

o the transfer of receivables, accounts or interests therein 

[§14(b)(2)(vi)(B)]; or

o the audit of debit, credit, or other payment information 

[§14(b)(2)(vi)(C)]?

Other Exceptions to Notice and Opt-Out Requirements

50. If the institution discloses nonpublic personal information to nonaffiliated third parties, 

do the requirements for initial notice in Section 4(a)(2), opt out in Sections 7 and 10, 

revised notice in Section 8, and for service providers and joint marketers in Section 13, 

not apply because the institution makes the disclosure:

 With the consent or at the direction of the consumer [§15(a)(1)]:

 to protect the confidentiality or security of records [§15(a)(2)(i)];

 to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability [§15(a)(2)(ii)];

 for required institutional risk control or for resolving consumer disputes or inquiries [§15(a)(2)(iii)];

 to persons holding a legal or beneficial interest relating to the consumer 

[§15(a)(2)(iv)]; or

 to persons acting in a fiduciary or representative capacity on behalf of the consumer [§15(a)(2)(v)].

 To insurance rate advisory organizations, guaranty funds or agencies, agencies rating the institution, persons assessing compliance, and the institution's attorneys, 

accountants, and auditors [§15(a)(3)];

 In compliance with the Right to Financial Privacy Act or to law enforcement agencies [§15(a)(4)];

 To a consumer reporting agency in accordance with the FCRA or from a consumer 

report reported by a consumer reporting agency [§15(a)(5)];

 In connection with a proposed or actual sale, merger, transfer, or exchange of all or 

a portion of a business or operating unit, if the disclosure of nonpublic personal information concerns solely consumers of such business or unit [§15(a)(6)];
CFPB 

Examination Checklist PCFI

Yes No

CFPB FFIEC Rev. 06/2011 PCFI 14

 To comply with Federal, state, or local laws, rules, or legal requirements 

[§15(a)(7)(i)];

 To comply with a properly authorized civil, criminal, or regulatory investigation, or 

subpoena or summons by Federal, state, or local authorities [§15(a)(7)(ii)]; or

 To respond to judicial process or government regulatory authorities having jurisdiction over the institution for examination, compliance, or other purposes as 

authorized by law [§15(a)(7)(iii)]?

NOTE: The regulation gives the following as an example of the exception described in 

section A of this question: “A consumer may specifically consent to [an institution’s] 

disclosure to a nonaffiliated insurance company of the fact that the consumer has applied to [the institution] for a mortgage so that the insurance company can offer 

homeowner’s insurance to the consumer.”

COMMENTS

[click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 1

Examination Procedures –

Mortgage Servicing

After completing the risk assessment and

examination scoping, examiners should use these 

procedures, in conjunction with the compliance management system review procedures, to 

conduct a mortgage servicing examination. The examination procedures contain a series of 

modules, grouping similar requirements together. Depending on the scope, each examination 

will cover one or more of the following modules:

Routine Servicing

Module 1 Servicing Transfers, Loan Ownership Transfers, and Escrow Disclosures

Module 2 Payment Processing and Account Maintenance

Module 3 Customer Inquiries and Complaints

Module 4 Maintenance of Escrow Accounts and Insurance Products

Module 5 Credit Reporting

Module 6 Information Sharing and Privacy

Default Servicing

Module 7 Collections and Accounts in Bankruptcy

Module 8 Loss Mitigation

Foreclosure

Module 9 Foreclosures

Examination Objectives

1. To assess the quality of the regulated entity’s compliance risk management systems, 

including internal controls and policies and procedures, for preventing violations of federal 

consumer financial law in its mortgage servicing business. 

2. To identify acts or practices that materially increase the risk of violations of federal consumer 

financial law in connection with mortgage servicing. 

3. To gather facts that help determine whether a regulated entity engages in acts or practices 

that are likely to violate federal consumer financial law in connection with mortgage 

servicing. 

4. To determine, in consultation with Headquarters, whether a violation of a federal consumer 

financial law has occurred and whether further supervisory or enforcement actions are 

appropriate. 

Exam Date: [Click&type]

Prepared By: [Click&type]

Reviewer: [Click&type]

Docket #: [Click&type]

Entity Name: [Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 2

Background

A servicer may service loans on behalf of itself or an affiliate. It may service as a contractor of 

the trustee where a mortgage is included in a mortgage-backed security, or it may service whole 

loans for an outside third-party investor.1

 A servicer may sell the rights to service the loan 

separately from any ownership transfers. This is because some entities have expertise in payment 

processing and other servicing responsibilities, while others seek to invest in the underlying 

mortgages. These procedures apply whether the servicer obtained the servicing rights from 

another entity or the servicing responsibility is transferred within a company from the origination 

platform to the servicing platform.

Servicers must comply with various laws to the extent that the law applies to the particular 

servicer and its activities:

• The Real Estate Settlement Procedures Act (RESPA) and its implementing regulation, 

Regulation X, impose requirements for servicing transfers, written consumer inquiries, and 

escrow account maintenance.

• The Truth in Lending Act (TILA) and its implementing regulation, Regulation Z, generally 

impose requirements on owners for home mortgage ownership transfers. It also imposes 

requirements on servicers regarding crediting of payments, imposition of late fee and 

delinquency charges, and provision of payoff statements with respect to closed-end consumer 

credit transactions secured by a principal dwelling. For open-end mortgages, Regulation Z 

provisions related to payment crediting and error resolution apply to the extent that the 

servicer is a creditor. 

• The Electronic Funds Transfer Act (EFTA) and its implementing regulation, Regulation E, 

impose requirements if servicers within the scope of coverage obtain electronic payments 

from borrowers.

• The Fair Debt Collection Practices Act (FDCPA) governs collection activities conducted by 

third-party collection agencies, as well as servicer collection activities if the servicer acquired 

the loan when it was already in default.

• The Homeowners Protection Act (HPA) limits private mortgage insurance that can be 

assessed on customer accounts.

• The Fair Credit Reporting Act (FCRA) requires servicers that furnish information to 

consumer reporting agencies to ensure the accuracy of data placed in the consumer reporting 

system. The FCRA also limits certain information sharing between company affiliates. 

• The Gramm-Leach-Bliley Act (GLBA) requires servicers within the scope of coverage to 

provide privacy notices and limit information sharing in particular ways.

• The Equal Credit Opportunity Act (ECOA) and its implementing regulation, Regulation B,

apply to those servicers that are creditors, such as those who participate in a credit decision 

 1 If the owner is a separate entity, the servicer generally has contractual commitments to the owner of the loan. In the private 

securitization market, the contracts generally are called Pooling and Servicing Agreements or PSAs. If a Fannie Mae or Freddie

Mac owns the loan, the commitments are set forth in the company’s seller/servicer guides.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 3

about whether to approve a mortgage loan modification. The statute makes it unlawful to 

discriminate against any borrower with respect to any aspect of a credit transaction:

o On the basis of race, color, religion, national origin, sex or marital status, or age 

(provided the applicant has the capacity to contract); 

o Because all or part of the applicant’s income derives from any public assistance program; 

or 

o Because the applicant has in good faith exercised any right under the Consumer Credit 

Protection Act.

2

To carry out the objectives set forth in the Examination Objectives section, the examination 

process also will include assessing other risks to consumers that are not governed by specific 

statutory or regulatory provisions. These risks may include potentially unfair, deceptive, or 

abusive acts or practices (UDAAPs) with respect to servicers’ interactions with consumers.3

 

Collecting information about risks to consumers, whether or not there are specific legal 

guidelines addressing such risks, can help inform the Bureau’s policymaking. The standards the 

CFPB will use in assessing UDAAPs are: 

o A representation, omission, act, or practice is deceptive when:

(1) the representation, omission, act, or practice misleads or is likely to mislead the 

consumer;

(2) the consumer’s interpretation of the representation, omission, act, or practice is 

reasonable under the circumstances; and 

(3) the misleading representation, omission, act, or practice is material.

o An act or practice is unfair when: 

(1) it causes or is likely to cause substantial injury to consumers, 

(2) the injury is not reasonably avoidable by consumers, and 

(3) the injury is not outweighed by countervailing benefits to consumers or to 

competition.

 2 The Consumer Credit Protection Act, 15 U.S.C. § 1601 et seq., is the collection of federal statutes that protects consumers when 

applying for or receiving credit. The Act includes statutes that have dispute rights for consumers, such as the Fair Credit 

Reporting Act. The ECOA prohibits discriminating against an applicant who has exercised a dispute right pursuant to one of the 

statutes outlined in the Act.

3 Sec. 1036, PL 111-203 (July 21, 2010).
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 4

o An abusive act or practice: 

(1) materially interferes with the ability of a consumer to understand a term or condition 

of a consumer financial product or service or

(2) takes unreasonable advantage of –

 a lack of understanding on the part of the consumer of the material risks, costs, or 

conditions of the product or service;

 the inability of the consumer to protect its interests in selecting or using a 

consumer financial product or service; or

 the reasonable reliance by the consumer on a covered person to act in the interests 

of the consumer. 

Please refer to the examination procedures regarding UDAAPs for more information about the 

legal standards and the CFPB’s approach to examining for UDAAPs.

The particular facts in a case are crucial to a determination of unfair, deceptive, or abusive 

practices. As set out in the Examination Objectives section, examiners should consult with 

Headquarters to determine whether the applicable legal standards have been met before a 

violation of any federal consumer financial law could be cited, including a UDAAP violation.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 5

Module 1: Servicing Transfers, Loan Ownership 

Transfers, and Escrow Disclosures

Servicing Transfers

Examiners should engage in several steps to assess potential violations of law in connection with 

servicing transfers, loan ownership transfers, and escrow disclosures. First, examiners should 

review a sample of servicing records, from the servicer’s primary computer system, for loans 

transferred within the previous year. Examiners also may need to review copies of the electronic 

and paper documents transferred from the prior servicer. Additionally, they should review

relevant records outside the servicer’s primary computer system, such as copies of monthly 

statements sent to consumers, copies of the RESPA disclosures, and evidence of delivery. If 

consumer complaints or document review indicate potential violations in these areas, examiners 

also may conduct interviews of consumers from the sample and ask questions relevant to each 

topic area below.

RESPA

1. Assess compliance with RESPA, Notice of Transfer Provisions. Please refer to the 

examination procedures regarding RESPA, 24 CFR 3500.21, for more information.

[Click&type]

FDCPA

2. Assess compliance with FDCPA, Right to Validation Notice for Certain Consumers. 

Please refer to the examination procedures regarding FDCPA, 15 U.S.C. § 1692g (a), for 

more information.

[Click&type]

Other Risks to Consumers

3. Determine whether the servicer conducts adequate due diligence in connection with 

acquiring servicing rights to ensure that it does not misrepresent amounts owed after 

transfer of account servicing. 

[Click&type]

4. For loans subject to modification agreements and forbearance agreements:

a. Determine that the servicer has received executed copies of prior servicers’ 

modification agreements and forbearance agreements.

b. Determine whether the servicer is properly applying, after transfer, payments due 

under a loan modification agreement or other payment modification to which the 

prior servicer agreed. 

c. Determine whether the servicer is charging amounts not due under a loan 

modification agreement or forbearance agreement.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 6

[Click&type]

5. For loans subject to negotiations related to modification agreements and forbearance 

agreements, determine whether the servicer receives adequate information about loan 

modifications or other foreclosure alternatives that were under discussion with the prior 

servicer. If the servicer does not receive system notes or other information documenting 

such discussions, assess and document the information that the servicer does receive.

[Click&type]

Ownership Transfer

Reg. Z

Examiners should determine whether the servicer is required to transmit the loan ownership 

transfer notice. The institution would have this obligation if (a) it owns any of the loans in the 

servicing portfolio and (b) the loan is secured by the principal dwelling of the consumer. (12 

CFR 226.39(a)(1)).4

To assess whether the servicer is complying with obligations under Reg. Z to notify consumers 

of changes in the loan ownership, examiners should sample from the list of loans in which the 

loan’s owner changed within the previous year. For the loans in the sample, examiners should 

review copies of consumer disclosures regarding loan ownership and evidence of delivery.

6. Assess compliance with Reg. Z, Notice of Ownership Transfer Provision. Please refer to 

the examination procedures regarding Reg. Z, 12 CFR § 226.39, for more information.

[Click&type]

Escrow Transfers

RESPA

To assess whether the servicer is complying with obligations under Reg. X to notify consumers 

of changes in the escrow account requirements resulting from a transfer of servicing, examiners 

should sample from the list of loans transferred within the previous year that included escrow 

accounts. For the loans in the sample, examiners should review copies of consumer disclosures 

regarding the escrow accounts and evidence of delivery.

7. Assess compliance with RESPA, Escrow Transfer Provisions. Please refer to the 

examination procedures regarding RESPA, 24 CFR § 3500.17, for more information.

[Click&type]

 4 A servicer of a mortgage loan is not treated as an owner of the obligation if the servicer holds title to the loans, or 

title is assigned to the servicer, solely for the administrative convenience of the servicer in servicing the obligation.

Contractually, the loan owner may have delegated the Reg. Z obligation to the servicer. Although the loan owner 

cannot delegate its obligation under law, examiners should assess whether the servicer is fulfilling its commitment, 

if applicable.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 7

Module 2: Payment Processing and Account 

Maintenance

To assess payment posting and fee practices, examiners should review a sample of servicing 

records. Examiners should begin by reviewing a sample of records from the servicer’s primary 

record system; if potential problems are found, examiners should review copies of relevant 

records outside the primary system, such as copies of monthly statements, copies of consumer 

payment records, and copies of bills from vendors documenting any services related to the 

consumer’s loan account. If consumer complaints or document review indicates potential 

violations in these areas, examiners also may conduct interviews of consumers from the sample 

and ask questions relevant to each topic area below. 

Payment Processing

Reg. Z

1. Assess compliance with Reg. Z, Payment Posting Provisions for closed-end accounts. 

Please refer to the examination procedures regarding Reg. Z, 12 CFR § 226.36, for 

more information.

[Click&type]

2. Assess compliance with Reg. Z, Payment Posting Provisions for open-end mortgages. 

Please refer to the examination procedures regarding Reg. Z, 12 CFR § 226.10, for 

more information.

[Click&type]

Other Risks to Consumers – Payment Posting

3. Assess how the servicer uses suspense accounts in the time period before the servicer 

has provided the customer notice that the contract has been declared in default and 

the remaining payments due under the contract have been accelerated. 

a. For loans that are not Daily Simple Interest Loans:

i. Determine the circumstances under which the servicer places payments into a 

suspense account. Determine whether the servicer informs consumers of these 

actions in a timely, clear, and understandable manner.

[Click&type]

ii. Determine the servicer’s practices in connection with crediting amounts held in a 

suspense account, including whether the servicer leaves money in the suspense 

account without assessing whether the consumer has cumulatively made a PITI 

payment and applying such a payment.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 8

iii. Determine the servicer’s practices in connection with the use of funds in a 

suspense account, including whether the servicer pays late fees or default-related 

fees from suspense accounts before crediting those funds towards the PITI 

payment.

[Click&type]

iv. Determine the circumstances under which the servicer sends back payments, 

including, if applicable, whether the servicer in a timely, clear, and 

understandable manner explains the reason a payment is sent back, and the future 

payment amount that would be accepted.

[Click&type]

b. For Daily Simple Interest Loans: Determine whether the servicer promptly accepts 

and applies all borrower payments, including cure payments, trial modification 

payments, and payments by or on behalf of a borrower in bankruptcy while the case is 

pending, as well as non-conforming payments. 

[Click&type]

4. Determine whether the servicer credits payments toward principal and interest before 

it applies payments to fees and other charges. 

[Click&type]

Optional Products

ECOA

5. Determine whether the servicer offers debt cancellation, debt suspension, or other 

similar additional products or services and, if so, which products and/or services the 

servicer offers.

[Click&type]

6. Determine whether each such optional product or service is offered and provided in a 

manner consistent with ECOA. Targeted marketing of these products on the basis of 

race, for example, may indicate an increased risk of potential ECOA violations and 

require further inquiry. In consultation with Headquarters, assess whether marketing 

is targeted on such a basis to particular consumers or in particular areas.

[Click&type]

Other Risks to Consumers

7. Determine whether the servicer offers additional products or services (such as 

payment protection or credit protection) and, if so, which products and/or services the 

servicer offers.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 9

8. Review marketing materials, whether they are telemarketing scripts, direct mail, 

Web-based, or other media, and determine whether each optional product’s costs and 

terms are clearly and prominently disclosed. If consumer complaints or document 

review indicates potential violations in these areas and the servicer engages in 

telemarketing, monitor call center activity, and statements of representatives

marketing the products. If the servicer engages in web-based marketing, monitor 

Internet communications related to the marketing.

[Click&type]

9. Determine whether the servicer added on optional products or services without 

obtaining explicit authorization from the consumer. If the servicer obtains written 

authorization, review records of customers who received additional products or 

services to ensure that written authorization has been provided and retained.

[Click&type]

Fees

Other Risks to Consumers – Fees Imposed to Protect the 

Owner’s Security Interest

10. Determine the servicer’s practices in assessing attorney’s fees, property inspection 

fees, sheriff’s fees, publication fees, and other charges, including whether the servicer 

ensures that fees are only assessed when the activity or service actually takes place.

a. Determine the servicer’s practices in assessing foreclosure attorney’s fees, 

including whether these fees are assessed in stages to ensure that the servicer does 

not charge the entire fee for a foreclosure at the initial stage of the foreclosure 

referral before all of the charged services have been rendered.

[Click&type]

b. Determine the servicer’s practices in connection with obtaining invoices for 

services rendered, for example determining whether it assesses charges when it 

has a valid invoice.

[Click&type]

c. Determine whether the servicer assesses charges for estimated fees in connection 

with the reinstatement or payoff of a loan in foreclosure, including, if applicable, 

whether it:

1. Clearly and conspicuously explains the estimated fees; and 

2. For borrowers who reinstate or pay off the loan, (1) perform a timely 

reconciliation of the fees paid to ensure that all fees assessed were 

imposed for services that were valid and actually performed and 

(2) reimburses the borrower in the event of any overpayment, within a 

reasonable time, using reasonable efforts to update the borrower’s address.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 10

[Click&type]

d. Determine whether the servicer or any of its affiliates impose mark-ups on any 

third-party fees or insurance products without performing administrative work, 

quality control, or providing other services consistent with the mark-up.

[Click&type]

11. Document the timing and frequency of fees, and determine whether the servicer has 

established reasonable intervals for repeat services.

[Click&type]

Periodic Statements and Other Disclosures

Examiners must review the servicer’s policies, procedures, and systems to assess the adequacy of 

periodic statements and whether applicable disclosures are furnished when required by Reg. Z. 

Examiners also should review a sample of periodic statements.

Reg. Z

12. Assess compliance with Reg. Z – Change in Term Disclosures for Open-End 

Mortgages. Please refer to the examination procedures regarding Reg. Z, 12 CFR § 

226.9, for more information.

[Click&type]

13. Assess compliance with Reg. Z – Periodic Statements for Open End Mortgages. 

Please refer to the examination procedures regarding Reg. Z, 12 CFR § 226.7, for 

more information.

[Click&type]

EFTA

14. Assess compliance with EFTA – Electronic Payments. Please refer to the 

examination procedures regarding EFTA’s provisions on pre-authorized electronic 

transfers, 12 CFR § 205, for more information.

[Click&type]

Other Risks to Consumers – Periodic Statements

15. Review sample periodic statements to ensure that information provided is clear and 

understandable. If the servicer uses general categories such as “other fees,” 

determine whether the reason for the fee is otherwise made clear.

[Click&type]

16. Determine whether the servicer adequately informs the customer of the reason for 

any amounts due (particularly those other than PITI) in a timely manner.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 11

17. Determine whether the servicer has adequate controls and an adequate data integrity 

program to ensure that information about amounts due and the loan’s status that is

communicated to consumers is accurate and contains all material information.

[Click&type]

18. Determine whether the factual assertions made in periodic statements and other 

communications to the borrower are accurate and contain all material information. 

[Click&type]

19. For any adjustable rate mortgage, determine whether the monthly payment amount 

stated on a periodic statement after an interest rate change is consistent with the 

consumer’s obligations under the note.

[Click&type]

Payoff Statements

Reg. Z – Payoff Statements

20. Examiners should verify whether the servicer failed to provide, within a reasonable 

time after receiving a request from the consumer or person acting on behalf of the 

consumer, an accurate statement of the total outstanding balance that would be 

required to satisfy the consumer’s obligations in full as of a specific date. Please 

refer to the examination procedures regarding Reg. Z, 12 CFR § 226.36, for more 

information.

[Click&type]

Other Risks to Consumers – Payoff Statements

21. Determine whether, when calculating the payoff amount, the servicer includes late 

charges and fees owed in the payoff amount or instead deducts such fees and charges 

from the escrow account.

[Click&type]

Treatment of Credit Balances

Reg. Z – Treatment of Credit Balances

22. Assess compliance with Reg. Z – Treatment of Credit Balances. Please refer to the 

examination procedures regarding Reg. Z, 12 CFR § 226.11 and 226.21, for more 

information.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 12

Treatment of Private Mortgage Insurance

Homeowners’ Protection Act of 1998

23. Assess compliance with Homeowners’ Protection Act. Please refer to the 

examination procedures regarding the HPA, 12 U.S.C. § 4902, for more information.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 13

Module 3: Customer Inquiries and Complaints

Examiners should review consumer complaints and call specific complaining consumers to 

interview them regarding their experiences. Examiners should determine whether their 

complaints were resolved adequately, and whether they were resolved in a timely manner. 

RESPA − Responses to Qualified Written Requests

1. Assess compliance with RESPA – Requirements Related to Responses to Qualified 

Written Requests. Please refer to the examination procedures regarding RESPA, 24 CFR 

§ 3500.21(e), for more information.

[Click&type]

Open-End Mortgages − Billing Errors 

2. Assess compliance with Reg. Z – Open-End Credit, Billing Errors Procedures. Please 

refer to the examination procedures regarding this regulation, 12 CFR § 226.13, for more 

information.

[Click&type]

Other Risks to Consumers

3. Identify all channels and physical locations the servicer provides for receipt of customer 

complaints and inquiries.

[Click&type]

4. Evaluate the comprehensiveness of systems, procedures, and/or flowcharts for capturing, 

logging, tracking, handling, and reporting complaints and their resolutions.

[Click&type]

5. Assess the effectiveness of any telephone line available for inquiries or complaints, 

including (a) whether it is toll-free, (b) the ease of accessing a live person, (c) the hold 

times, and (c) the call abandonment rates.

[Click&type]

6. Assess the effectiveness of other means available for inquiries or complaints, including 

written submissions and any online portal.

[Click&type]

7. Evaluate the servicer’s processes and speed for responses to consumer complaints. 

Review reports to management and the board of directors (or principals). Review the 

consumer complaint log(s), performance metrics, and exception/trend reports to 

determine whether consumer complaints are captured, correctly categorized, and are

handled appropriately.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 14

8. Determine if staffing levels are sufficient for volume. Then determine whether

assumptions used for staffing determinations are validated or supported by analysis. 

[Click&type]

9. Listen to live calls and taped calls to assess the quality and training of call center 

personnel.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 15

Module 4: Maintenance of Escrow Accounts and 

Insurance Products

Maintenance of Escrow

Examiners should obtain a sample of servicing records. For the loans in the sample, examiners 

should assess whether the servicer is complying with the law in the areas listed below. If the file 

review indicates potential risks, examiners also should conduct interviews of a sample of 

consumers and staff, if appropriate, to assess consumer experiences with escrow accounts and 

any force-placed insurance products. 

Escrow Disclosures

1. Assess compliance with RESPA – Escrow Disclosures. Please refer to the RESPA 

examination procedures, 24 CFR § 3500.17, for more information.

[Click&type]

Escrow Disbursement

2. Assess compliance with RESPA – Escrow Disbursement. Please refer to the RESPA 

examination procedures, 24 CFR § 3500.21, for more information.

[Click&type]

Other Risks to Consumers

3. Determine whether the customer incurred penalties or unnecessary charges in the event 

the servicer failed to make disbursements of escrow funds for insurance, taxes, and other 

charges with respect to the property in a timely manner.

[Click&type]

4. Evaluate whether the servicer has established adequate procedures to ensure customers 

are not improperly assessed force-placed insurance, including the servicer’s procedures 

for notifying customers that the servicer needs evidence of insurance coverage.

[Click&type]

5. Review the extent to which borrowers are provided with relevant information about 

force-placed insurance in a timely, accurate, and understandable manner. Review the 

servicer’s practices when borrowers fail to respond to such notices.

[Click&type]

6. Determine whether the servicer cancels force-placed insurance when the customer 

provides adequate evidence of existing and sufficient insurance coverage.

[Click&type]

7. Determine whether the servicer refunds insurance premiums and any related fees that 
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 16

were assessed for force-placed insurance coverage that ran concurrent with the 

customer’s existing insurance coverage.

[Click&type]

8. Determine whether the servicer or any of its affiliates imposes mark-ups, or received 

commissions or other payments, related to any force-placed insurance products.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 17

Module 5: Credit Reporting

Examiners should obtain a sample of loan servicing records. For the loans in the sample, 

compare the information in the servicer’s system of record with the information reported to the 

credit reporting agencies. If consumer complaints or document review indicates potential FCRA 

violations, examiners also may conduct interviews of consumers from the sample.

FCRA Furnisher Requirements

1. Assess compliance with FCRA Furnisher Requirements. Please refer to the FCRA 

examination procedures, 12 CFR § 222.40-43, for more information.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 18

Module 6: Information Sharing and Privacy

Privacy Notices 

1. Assess compliance with Privacy of Consumer Financial Information Regulations that 

implement the GLBA. Please refer to the GLBA examination procedures, 12 CFR 216.4 

and 216.5, for more information.

[Click&type]

Information Sharing With Affiliates 

2. Assess compliance with the FCRA Affiliate Marketing Rule. Please refer to the FCRA 

examination procedures, 12 CFR 221.21, for more information.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 19

Module 7: Collections and Accounts in Bankruptcy

Examiners should obtain a sample of servicing records of customers in default, including a 

sufficient number of loans in which the consumer has filed for bankruptcy, to assess collection 

practices. Examiners should obtain collection call records and listen to a sample of collection 

calls. If consumer complaints or document review indicates potential violations in these areas, 

examiners also may conduct interviews of consumers from the sample and ask questions relevant 

to each topic area below. In connection with these steps, examiners should evaluate the 

following.

Under the FDCPA, a “debt collector” is defined as any person who regularly collects, or attempts 

to collect, consumer debts for another person or institution or uses some name other than its own 

when collecting its own consumer debts, with certain exceptions. The definition includes, for 

example, an institution that regularly collects debts for an unrelated institution. 

The debt collector definition has an exception that frequently applies to mortgage servicing: an 

institution is not a debt collector under the FDCPA when it collects debts that were not in default 

when they were obtained by the servicer.5 Thus, a servicer that purchases the servicing rights for 

a portfolio of loans will be a debt collector only for loans that were in “default” at the time of the 

purchase.6

Examiners should obtain a sample of collection call records and assess whether collectors 

complied with the requirements listed in the FDCPA procedures. Examiners should also listen 

on a sample of collection calls. 

FDCPA

1. Assess compliance with FDCPA. Please refer to the FDCPA examination procedures for 

more information.

[Click&type]

 5 15 U.S.C. §1692a (6)(F)(iii). 

6 The FDCPA itself does not contain a definition of the term “default.” The standard mortgage note states that the debt is in 

default if the payment is even one day late.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 20

Other Risks to Consumers

2. Determine whether the servicer contacts borrowers in an appropriate manner:

a. Employees and third-party contractors clearly indicate to consumers that they are 

calling about the collection of a debt.

b. Employees and third-party contractors do not disclose the existence of a 

consumer’s debt to the public without the consent of the consumer, except as 

permitted by law.

c. The entity has policies on avoiding repeated telephone calls to consumers that 

annoy, abuse, or harass any person at the number called.

[Click&type]

3. Determine whether the servicer’s representatives make misrepresentations or use 

deceptive means to collect debts.

[Click&type]

4. Determine whether collections staff transfer borrowers to loss mitigation staff, in 

accordance with the institution’s policies and procedures, to discuss loss mitigation 

alternatives.

[Click&type]

Bankruptcy

Other Risks to Consumers

5. If the servicer does not perform an annual escrow analysis because of the bankruptcy, 

determine whether the borrower is notified of any escrow account deficiency or shortage.

[Click&type]

6. For customers who have filed for bankruptcy, determine whether the servicer provides

notice of fees or other amounts charged to the account to the debtor, the bankruptcy

trustee, or the court during the pendency of the bankruptcy case.

[Click&type]

7. Determine whether payments received from a bankruptcy trustee are properly applied to 

the customer’s account. 

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 21

Module 8: Loss Mitigation

Examiners should obtain a sample of servicing records of customers who are delinquent or at 

imminent risk of default to assess loss mitigation activity. If consumer complaints or document 

review indicates potential concerns in these areas, examiners also may conduct interviews of 

consumers from the sample who sought loss mitigation in the prior year and ask questions 

relevant to each topic area below. 

ECOA

Disparate Treatment in Loss Mitigation

As discussed above, examiners should obtain a sample of servicing records of customers in 

default or at imminent risk of default to assess loss mitigation activity. While conducting the 

review of the servicer’s loss mitigation activities discussed above, examiners must be mindful of 

activities that may indicate disparate treatment of consumers in violation of the ECOA on the 

bases of race, color, religion, national origin, sex or marital status, or age (provided the applicant 

has the capacity to contract); because all or part of the applicant’s income derives from any 

public assistance program; or because the applicant has in good faith exercised any right under 

the Consumer Credit Protection Act. 

Examiners should:

1. Determine whether the file documents indicate that decisions were made based upon any 

protected status.

[Click&type]

2. Determine whether there were clear policies and procedures for making loss mitigation 

decisions or whether there was broad employee discretion. If employees have discretion, 

determine whether the procedures, controls, and monitoring that govern the exercise of 

discretion are adequate.

[Click&type]

3. Assess policies and procedures for assessing fees, with a specific focus on discretion.

[Click&type]

4. Determine whether there were adequate processes and controls for policy exceptions and 

adequate documentation of decisions. 

[Click&type]

5. Review complaints of discrimination and litigation alleging discrimination.

[Click&type]

6. Review any internal fair lending audits or reports.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 22

Disparate Impact in Loss Mitigation

An examination of whether a servicer’s loss mitigation program results in adverse impact on the 

basis of a protected class will rely on procedures outlined in the CFPB’s ECOA Examination 

Program Manual and the Interagency Fair Lending Examination Procedures (IFLEP). 

Examiners, in consultation with Headquarters, should:

7. Obtain information sufficient to determine whether loss mitigation workouts have been 

provided to consumers in compliance with ECOA and Regulation B. For example, this 

may involve an analysis of the distribution of protected class members in the pool of 

delinquent borrowers versus the distribution of protected class members receiving a 

range of loss mitigation outcomes, including: reinstatement, repayment plan, 

forbearance, loan modification, short sale, deed-in-lieu, and foreclosure. 

[Click&type]

8. Obtain information sufficient to determine whether loan modifications have been 

provided in compliance with ECOA and Regulation B. For example, this may involve an 

analysis of processing times and loan modification attributes including interest rate, 

principal, and monthly payment reductions for protected class members when compared 

to non-protected class members.

[Click&type]

9. Obtain information sufficient to determine whether the rate and timing of foreclosures 

are in compliance with ECOA and Regulation B. For example, this may include analysis 

of the representation of protected classes in the group of seriously delinquent borrowers 

versus their representation among borrowers who lose their homes to foreclosure.

[Click&type]

To complete a disparate impact analysis of a servicer’s loss mitigation program, and determine 

whether a facially neutral policy or practice that has an adverse effect on a protected class meets 

a legitimate business need that cannot reasonably be achieved by a less discriminatory 

alternative, refer to Section B of the CFPB’s Fair Lending Examination Procedures and consult 

with Headquarters.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 23

Other Risks to Consumers

Application Process

10. Determine whether information provided to consumers about loss mitigation alternatives 

is clear, prominent, and readily understandable.

[Click&type]

11. Determine whether the servicer advises customers to stop payments in order to qualify 

for loss mitigation relief.

[Click&type]

12. Determine whether the servicer is providing customers with accurate information 

throughout the loss mitigation process.

If there are consumer complaints or other indications that the servicer is not providing 

customers with accurate information throughout the process, evaluate the servicer’s 

practices in the following areas: 

a. Determine whether the servicer provides adequate methods for consumers to contact 

it for information about the loss mitigation process, and timely responds to those 

contacts.

[Click&type]

b. Determine whether the servicer adequately documents its contacts with consumers 

regarding loss mitigation. Appropriate documentation of oral contacts includes the 

dates of communications, names of contact person(s), and a summary of the 

conversation.

[Click&type]

c. If the servicer represents to consumers that it is accessible for intake of loss 

mitigation requests, including if it represents that it has a “single point of contact” 

system in place, evaluate whether consumers can readily access the servicer’s 

representatives and obtain complete responses.

[Click&type]

d. Determine whether the servicer has procedures in place to ensure all paperwork is 

collected and tracked in an efficient and reliable manner.

[Click&type]

e. Determine whether the servicer is providing customers with timely information on the 

status of loan modifications and other foreclosure alternatives.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 24

f. Determine whether the servicer is accurately applying its procedures for evaluating 

customers for foreclosure alternatives, including compliance with Home Affordable 

Modification Program requirements, if applicable.

[Click&type]

g. Determine whether any collection contacts occurring during the loss mitigation 

process acknowledge the loss mitigation process and avoid UDAAPs. In particular, 

determine whether collections staff transfer borrowers to loss mitigation staff, in 

accordance with the institution’s policies and procedures, to discuss loss mitigation 

alternatives.

[Click&type]

h. If the servicer denies the customer’s application for loan modification, determine 

whether it provides the customer with timely notice of rejection as well as the 

rationale and any other options that may be available to the consumer.

[Click&type]

i. Evaluate the servicer’s training programs for employees involved in the loan 

modification process.

[Click&type]

13. Determine whether the servicer discloses all fees associated with modifications in a 

timely, prominent, and understandable manner.

[Click&type]

Consequences of Loss Mitigation

14. Determine whether the servicer discloses any rescheduling of payments that may occur 

under an existing obligation in a clear, prominent, and understandable manner.

[Click&type]

15. Determine whether the servicer discloses any negative consequences that may occur as a 

result of the borrower’s failing to make payments during the loss mitigation process. 

[Click&type]

16. Determine whether the servicer discloses any material negative consequences that may 

occur as a result of a completed loan modification (e.g., decreased credit score, income 

tax implications if principal reduction is offered, and any increase in monthly payment 

amount). 

[Click&type]

17. Determine whether the servicer discloses future changes in the modified loan terms (e.g., 

with respect to any principal forbearance or temporary interest rate reductions). 

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 25

18. Determine if the servicer includes any waiver of legal rights in its loan modification or 

other foreclosure alternative agreements.

[Click&type]

Short Sales

19. If the servicer is offering short sales as a loss mitigation tool, determine whether it 

provides clear, timely disclosures to the customer about the process.

[Click&type]

20. If the servicer demands deficiency payments upon agreeing to a short sale to recoup any 

principal not recovered through the short sale, determine whether the servicer discloses 

in a clear, prominent, and understandable manner that it or an investor will demand a 

deficiency payment or related cash contribution and the approximate amount of that 

deficiency.

[Click&type]

Deeds-In-Lieu of Foreclosures

21. If the servicer offers deeds-in-lieu of foreclosures, determine whether it provides clear, 

timely disclosures about requirements and cost to the customer.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 26

Module 9: Foreclosures

Examiners should obtain a sample of servicing records of consumers whose loans have been 

referred to foreclosure. For the loans in the sample, examiners should focus on whether the 

consumer is in fact in default and whether all amounts due are correct. Examiners should review 

amounts set forth in foreclosure affidavits, compare them to amounts recorded in the servicer’s 

primary computer system, and compare them to all statements made in communications from the 

borrower, including consumer complaints. Examiners also should review all complaints of 

consumers whose loans were referred to foreclosure in the prior year. In reviewing foreclosure 

practices, examiners should focus on the following areas:

ECOA

1. See above, Module 8. Examiners should collect information sufficient to determine 

whether there has been disparate treatment discrimination in violation of the ECOA and 

Regulation B in the servicer’s foreclosure processing as part of the file review. 

Examiners should work with OFLEO to determine whether there has been disparate 

impact discrimination in foreclosure processing as part of the loss mitigation data 

analysis discussed above. 

[Click&type]

Other Risks to Consumers

Referrals to Foreclosure

2. Evaluate the servicer’s process for determining whether to refer a loan to foreclosure. 

Determine whether the servicer has reviewed adequate information to confirm the 

borrower’s default, including the borrower’s loan history, notes in the servicing system 

regarding borrower communications, whether the borrower is entitled to protection from 

foreclosure under applicable law, and any complaints lodged with the servicer. 

[Click&type]

3. Determine whether the servicer has referred to foreclosure, or foreclosed upon, any 

customer who is current or not seriously delinquent.

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 27

Dual Tracking

4. Determine whether the servicer has foreclosed on any customers paying on a trial 

modification agreement, permanent modification agreement, forbearance agreement, or 

other similar agreement.

[Click&type]

5. Determine whether the servicer has foreclosed on any customer with whom the servicer 

had agreed to a modification agreement, forbearance agreement, or other similar 

agreement, but the first payment was not yet due.

[Click&type]

6. Determine whether the servicer has proceeded with foreclosure without giving customers 

an adequate opportunity for consideration for a foreclosure alternative, or has foreclosed 

on any customer who has a modification or forbearance agreement request pending.

[Click&type]

Accuracy of Filings

7. Determine whether the factual assertions made in foreclosure documents filed by or on 

behalf of the financial institution are accurate and adequately supported by file 

documentation. Examiners should focus on whether the borrower is in default and 

statements regarding amounts owed.

[Click&type]

8. Determine whether affiants have reviewed adequate information to confirm the right to 

foreclose, including required ownership documentation. 

[Click&type]

9. Determine under what circumstances the servicer files a lost note affidavit instead of 

filing the note in a foreclosure action. 

[Click&type]

Walkaways

10. Evaluate the servicer’s process for informing consumers about changes in the foreclosure 

process, including decisions not to go forward. 

[Click&type]
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 28

GLOSSARY

BPOs: broker price opinions, which provide estimates of the property value. 

Consumer Reporting Agency: a person which, for monetary fees, dues, or on a cooperative 

non-profit basis, regularly engages in whole or in part in the practice of assembling or evaluating 

consumer credit information or other information on consumers for the purpose of furnishing 

consumer reports to third parties, and which uses any means or facility of interstate commerce 

for the purpose of preparing or furnishing consumer reports. 

Daily Simple Interest Loan: any loan on which interest is calculated based on a daily accrual 

or daily interest method. For these loans, if a consumer pays before the payment due date, the 

amount of interest paid should decrease. If a consumer pays after the due date, the amount of 

interest paid should increase.

Deed in Lieu of Foreclosure: a foreclosure alternative in which the consumer voluntarily 

transfers the property title to the servicer in exchange for cancellation of the remainder of the 

debt.

Escrow Account: an account the servicer maintains to pay property taxes and insurance on 

behalf of the borrower. 

Forbearance: a foreclosure alternative in which the servicer reduces or suspends the customer’s 

mortgage payments for an agreed period of time. At the end of that time, the consumer resumes 

making the regular payments as well as a lump sum payment or additional monthly payments to 

bring the loan current. Forbearance may be an option if the consumer’s income is reduced 

temporarily and the mortgage is affordable.

Force-Placed Insurance: an insurance policy taken out by a lender or creditor when it 

determines that a customer has breached the mortgage contract by failing to carry appropriate 

insurance on the home that is collateral for the mortgage.

Foreclosure Trustee: an individual or company chosen to administer the assets of the 

beneficiary and facilitate the foreclosure process.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 29

HAMP: The Home Affordable Modification Program (HAMP) is a temporary government 

program encouraging certain loan modifications. HAMP modifications lower consumer’s 

mortgage payment to 31 percent of verified monthly gross income.

A consumer is eligible to apply for a HAMP modification if he: (a) occupies the house as his 

primary residence; (b) obtained the mortgage on or before January 1, 2009; (c) has a 

mortgage payment that is more than 31 percent of monthly gross income; (d) owes up to 

$729,750 on the home; (e) has a financial hardship and is either delinquent or in danger of 

falling behind; (f) has sufficient, documented income to support the modified payment; and 

(g) has not been convicted within the last ten years of felony larceny, theft, fraud or forgery, 

money laundering or tax evasion, in connection with a mortgage or real estate transaction.

The list of servicers participating in HAMP is available at 

http://www.makinghomeaffordable.gov/get-assistance/contact-mortgage/Pages/default.aspx.

Loan Instruments: the promissory note and the security instrument that detail the rights and 

obligations of the parties. 

Loan Modification: a foreclosure alternative in which the servicer changes one or more of the 

terms of the mortgage contract, typically to lower the monthly payments. Modifications may 

include reducing the interest rate, extending the term of the loan, or adding missed payments to 

the loan balance. A modification also may involve reducing the amount of money the consumer 

owes by forgiving a portion of the mortgage debt, which is known as “principal forgiveness.”

Loss Mitigation: a process for considering alternatives to foreclosure when customers fall 

behind on their mortgage payments or are at risk of default.

PITI Payment: principal, interest, taxes, and insurance payment

Promissory Note: a document that evidences the debt and the promise to repay. 

Property Inspection Fees: fees for inspections of the property so that the servicer can make 

sure that it is occupied and not abandoned. 

Property Preservation Fees: fees for services purchased to maintain the property in good 

condition and typically include lawn mowing, winterizing, and making repairs.

Proprietary Loan Modifications: loan modifications other than HAMP modifications. The 

eligibility requirements and structure of these modifications depend on the servicer and the 

investor that owns the particular loan. 

Reinstatement: a process by which, after going into default, the customer pays the loan servicer 

the entire past-due amount, plus any late fees or penalties, by an agreed date. This option may be 

appropriate if the consumer’s problem paying the mortgage is temporary.
CFPB Mortgage

Examination Procedures Servicing

CFPB Mortgage Servicing 30

Repayment Plan: a foreclosure alternative in which the servicer allows the customer a fixed 

amount of time to repay the amount he is behind by adding a portion of what is past due to the 

regular payment. This option may be appropriate if the consumer has missed a small number of

payments and can afford the mortgage. 

Security Instrument: a document that evidences the lien on the property. Depending on the 

state, the security instrument is called either a deed of trust or mortgage deed.

Short Sale: a foreclosure alternative in which the servicer allows the consumer to sell the home 

for less than the mortgage balance before it forecloses on the property and may agree to forgive 

any shortfall between the sale price and the mortgage balance. 

Suspense Account: an account holding funds that are earmarked for − but not immediately 

credited to − the consumer’s loan account. Also called an unapplied funds account.

Uniform Instruments: form instruments developed by Fannie Mae and Freddie Mac that are 

used to document the large majority of mortgage loans.
CFPB 

Template Entity Profile

CFPB Page 1 of 2

Date Prepared Click here to enter text.

Prepared By Click here to enter text.

Docket #: Click here to enter text.

RSSD Click here to enter text.

Entity Name Click here to enter text.

City Click here to enter text.

State Click here to enter text.

Prudential and/or 

State Regulator(s)

Click here to enter text.

Contact Name Click here to enter text.

Contact Information Click here to enter text.

Work City Click here to enter text.

Work State Click here to enter text.

Top Tier Entity Click here to enter text.

Affiliated DIs (RSSD) Click here to enter text.

Principal products or 

lines of business

Click here to enter text.

CFPB Region Click here to enter text.

Total Assets (000) Click here to enter text.

Assets as-of date Click here to enter text.

Attach current Risk 

Assessment results

Click here to enter text.

Current Compliance 

Rating

Click here to enter text.

Last Compliance 

Exam Started

Click here to enter text.

Next Compliance 

Exam Scheduled

Click here to enter text.

Current CAMELS Click here to enter text.

CAMELS as-of date Click here to enter text.
CFPB 

Template Entity Profile

CFPB Page 2 of 2

Formal Action in 

Place

Click here to enter text.

Formal Action in 

Process

Click here to enter text.

Enforcement 

Attorney Name

Click here to enter text.

Contact Information Click here to enter text.

Informal Agreement 

in Place

Click here to enter text.

Informal Agreement 

in Process

Click here to enter text.

Safety and Soundness 

Action(s)

Click here to enter text.

Fair Lending Issues Click here to enter text.

Fair Lending Data 

Analysis Results

Click here to enter text.

HMDA Outlier (Y/N) Click here to enter text.

Previous Outlier 

Years

Click here to enter text.

# Discrimination 

Complaints

Click here to enter text.

FL Reviewer Name Click here to enter text.

Contact Information Click here to enter text.

UDAAP Issues Click here to enter text.

Other Significant 

Regulatory Issues

Click here to enter text.

Complaint Analysis Click here to enter text.

Other Noteworthy 

Information

Click here to enter text.
CFPB

Template Risk Assessment

CFPB Risk Assessment 1

CONSUMER RISK ASSESSMENT 

CFPB’s Risk Assessment process is designed to evaluate on a consistent basis the extent of risk to 

consumers arising from the activities of a particular supervised entity and to identify the sources of 

that risk. “Risk to consumers” for the purpose of the CFPB Risk Assessment is the potential for 

consumers to suffer economic loss or other legally-cognizable injury as a result of a violation of 

Federal consumer financial law. To determine risk to consumers, the Risk Assessment considers the 

interaction of two broad sets of factors: the inherent risks in a particular line of business or the entity 

as a whole and the quality of controls implemented by the entity to manage and mitigate those risks. 

As noted below, the Risk Assessment will be used during CFPB’s supervision planning process to set 

priorities and focus examination and supervision activities.

Inherent risk includes factors that increase the potential for unfair, deceptive or abusive acts or 

practices, for discrimination, or for violations of other Federal consumer financial laws. It also 

includes factors that increase the compliance management challenges of a business and thereby 

increase the risk of such violations. The quality of risk controls includes factors related to both 

managing and mitigating specific inherent risks as well as the strength of an entity’s overall system of 

compliance management. 

The questions and considerations in this template may be used to conduct risk assessments of 

individual lines of business, supervised entities as a whole, and groups of affiliated entities when 

feasible and applicable. Assessments of individual lines of business in large complex entities may be 

considered together to reach conclusions about the entity as a whole.

The risk assessment is not a determination of whether a violation of law exists.

Using the Risk Assessment Template

The template provides a series of factors that bear on inherent risk and relevant risk controls. 

Examiners conducting the assessment should rate each relevant factor (low, moderate, or high inherent 

risk; strong, adequate, or weak risk controls and mitigation), and comment briefly on the basis for each 

rating and issues to consider during the examination. The factor ratings, taken as a whole, result in the 

Risk Summary, which is a conclusion about whether the overall risk to consumers is low, moderate, or 

high. The Risk Summary also includes a judgment about the expected change in the overall risk 

(decreasing, increasing, or stable/unchanged), and when that direction last changed. The Risk 

Summary, and the basis for it, will be included with the Examination Report. 

The factor ratings and comments should be used to inform the Examination Scope. For example, if the 

nature and structure of certain products point to high inherent risk and the quality of risk controls is 

only adequate, then the examination scope should likely include a review of those products and the 

related compliance controls. The magnitude and severity of potential consumer harm arising from 

particular risks should be considered when setting priorities for review. 

There may be other institution or industry-specific risk factors beyond those included in the template 

that should be considered when assessing risk to consumers. Examiners should use their knowledge 

and judgment to identify risks that are unique to a particular entity or its specialized business focus. 
CFPB

Template Risk Assessment

CFPB Risk Assessment 2

The sections below include (1) factors that specifically increase the risk that unfair, deceptive, abusive acts or practices, 

discrimination, or other violations of Federal consumer financial law will occur and (2) factors that generally increase the 

difficulty of managing compliance in an organization.

Inherent Risk

Comments in each section should identify any specific factors present in the line of business or entity being assessed, note 

the potential UDAAP, discrimination, or other regulatory issues to review during an examination, and comment briefly 

on the basis for the rating assigned to that factor. The rating should reflect the degree of risk.

Nature and Structure of Products 

The profitability of a product is dependent upon penalty fees (e.g., fees 

for a late payment, for exceeding a credit limit, or for overdrawing 

deposited funds). 

Comments

[Click&type]

The terms of the product are subject to change at the discretion of the 

entity, and the entity has frequently made changes in the terms.

The entity reverses fees at a significantly higher rate than other entities 

of similar size offering similar products.

Pricing structure (interest rate, points, fees) and other features and 

terms are combined in a manner that is likely to make the total costs of 

the product difficult for consumers to understand.

Products are bundled in a way that may obscure relative costs.

Consumers pay penalties to terminate a relationship, including 

forgoing money or benefits they would otherwise earn.

Consumers face barriers to information, such as costs to access 
CFPB

Template Risk Assessment

CFPB Risk Assessment 3

customer service or information about their account.

Credit decision-makers have wide discretion over setting terms and 

features of products with inadequate policies and procedures 

addressing appropriate exercise of that discretion. 

Credit products are not underwritten based upon the likely ability of 

the consumer to make the required (or, in the case of adjustable rate 

products, potentially required) payments over the term of the loan.

RATING – Nature and Structure of Products Low Moderate High

Consumers to whom products are marketed

Consider the extent to which the marketing of a product or service is 

targeted to particular populations including:

• Students or young adults

• Elderly

• Minorities

• Immigrants

• Consumers of certain national origins

• Members of specific religious groups or denominations 

• Military service members or former service members

• Consumers with limited education

Comments

[Click&type]
CFPB

Template Risk Assessment

CFPB Risk Assessment 4

• Consumers with limited English proficiency

• Low-income consumers or consumers on limited fixed 

incomes

• Consumers receiving any type of public assistance

• Consumers with limited experience with financial products or 

services

• Consumers in or who have recently experienced financial 

distress

• Consumers with low credit scores (e.g., FICO below 620)

• Consumers of a certain gender or marital status

Products targeted to consumers who fall in multiple categories may be 

of particular concern.

Consider whether any particular populations are missing or excluded 

from the entity’s advertising.

RATING – Consumers to whom products are marketed Low Moderate High
CFPB

Template Risk Assessment

CFPB Risk Assessment 5

Marketing methods and sales organizations

Incentives and Compensation Comments

Incentives encourage the sale of high-cost products regardless of [Click&type]

consumer’s request or situation.

Compensation or performance evaluation of person-to-person sales 

staff (telephone, face-to-face)is based on:

• The number of sales made

• The size of the sales made (for example, average loan size) or 

the volume of sales

• The price of the product sold or

• The particular product sold, 

without consideration of product outcomes or performance(for 

example, default or attrition rates, etc.).

Person-to-person sales staff has discretion to set prices (interest 

rate, points, fees) with inadequate policies and procedures 

addressing exercise of that discretion.

Person-to-person sales staff is not accountable for product 

outcomes or performance (default rates, attrition rates, etc.).

Marketing and Advertising

Marketing materials are not written in a language or at a level 

understandable by targeted consumers.

Key product terms or features are not readily available to 

consumers.

Targeted consumers would not likely qualify for advertised 

products or terms.
CFPB

Template Risk Assessment

CFPB Risk Assessment 6

Advertising includes teaser rates or low fees with little or no 

information about important conditions (such as periodic or exit 

charges).

Complex products are marketed to consumers not likely to benefit 

from them or who may likely be harmed by them.

Product marketing and sales, including branch locations, are 

targeted in a manner that may be discriminatory.

Advertising utilizes media outlets targeted to particular populations

only to advertise its higher-cost products and not its full range of 

products.

RATING – Marketing Methods and Sales Organization Low Moderate High
CFPB

Template Risk Assessment

CFPB Risk Assessment 7

Ongoing customer relationship management 

Employees with customer service responsibilities, including 

collections, are not evaluated or compensated based on the quality of 

service or level of customer satisfaction.

Comments

[Click&type]

The compensation of customer service representatives with discretion 

to adjust prices or modify other terms is impacted by the frequency 

and/or size of such adjustments.

Customer service representatives with discretion to adjust prices or 

modify other terms operate with inadequate policies and procedures 

addressing exercise of that discretion.

Vendors with customer service responsibilities, including collections, 

are not evaluated based on quality of service or level of customer 

satisfaction.
CFPB

Template Risk Assessment

CFPB Risk Assessment 8

The compensation of vendors that provide customer service 

representatives with discretion to adjust prices or modify other terms is 

impacted by the frequency and/or size of such adjustments.

Vendors that provide customer service representatives with discretion 

in pricing operate with inadequate policies and procedures addressing 

exercise of that discretion.

The number of customer service staff is insufficient to provide timely 

service.

Customer service information systems do not have sufficient capacity 

to support the number of customers. 

RATING – Ongoing customer relationship management Low Moderate High

Compliance management challenges

The entity maintains multiple, discrete un-integrated information 

systems to originate and service product relationships, including new 

product relationships with existing customers.

Comments

[Click&type]

Solicitation is conducted through active cross-selling, outbound 

telemarketing, or use of third parties for direct marketing.

The entity uses internet advertising or a wide variety of other mass 

media.

The entity has an extensive or decentralized retail network.
CFPB

Template Risk Assessment

CFPB Risk Assessment 9

Numerous subsidiaries or affiliates provide consumer financial 

products and services on behalf of the entity.

The entity relies heavily on third parties other than subsidiaries or

other affiliates to provide products and services to consumers.

RATING – Compliance Management Challenges Low Moderate High

Other factors that point to heightened consumer risk

DESCRIBE FACTOR Comments

[Click&type]

RATING – Other factors Low Moderate High
CFPB

Template Risk Assessment

CFPB Risk Assessment 10

The considerations below bear on both the general quality of an entity’s consumer compliance risk management and 

specifically on controlling the risks of unfair, deceptive or abusive acts or practices, discrimination, or other violations of 

Federal consumer financial law. The specific factors indicate strong compliance management.

QUALITY OF CONSUMER COMPLIANCE RISK CONTROLS AND MITIGATION

Comments in each section should identify any factors of concern in the line of business or entity being assessed, note

particular compliance management issues to review during an examination, and comment briefly on the basis for the 

rating assigned to that factor. The rating should reflect the strength of compliance management.

Board of Directors and Management

The board of directors has adopted comprehensive policies that 

establish clear standards for compliance with applicable laws, 

including laws prohibiting unfair, deceptive or abusive acts or 

practices, and discrimination:

• Policies and procedures are comprehensive and thorough.

• Policies are current and consistent with consumer business 

activities, and reflect current laws and regulations.

• A clear process exists for aligning compliance policies with 

changing business activities.

Comments

[Click&type]

Management’s commitment to consumer compliance has been 

communicated throughout the regulated entity.

The board and management receive regular and meaningful reporting 

with respect to consumer protection issues, consumer compliance, or

complaints.
CFPB

Template Risk Assessment

CFPB Risk Assessment 11

The board and management follow up on a timely basis on issues 

identified with respect to consumer compliance.

Management anticipates, plans, and reacts promptly to changes in 

markets, technology, regulations, or consumer need.

RATING – Board of Directors and Management Strong Adequate Weak

Authority and accountability for compliance

Sufficient resources have been allocated to compliance, including 

monitoring of compliance throughout the organization and monitoring

third parties that perform activities involving consumers.

Comments

[Click&type]

Management and staff responsible for compliance with consumer 

protection laws are independent from the business line when 

appropriate given the size, nature, and complexity of the entity and 

have clear authority to identify and resolve consumer compliance 

issues.

Unit or individual performance expectations include responsibility for 

compliance.

Units or individuals have sufficient authority to effect a strong 

compliance program.

RATING – Authority and accountability for compliance Strong Adequate Weak
CFPB

Template Risk Assessment

CFPB Risk Assessment 12

Compliance risk management program and oversight 

The compliance risk management program is well tailored to the size, 

nature, and complexity of the entity.

Comments

[Click&type]

The compliance program is independent from the business line when 

appropriate given the size, nature, and complexity of the entity and 

provides sufficient oversight of the entity.

The compliance program provides sufficient oversight of third parties 

interacting with consumers on behalf of the entity in relation to

consumer compliance risk.

Regular compliance testing is conducted and includes samples of 

sufficient size covering all relevant product types, decision centers, 

customer points of contact, and customer communications.

Compliance testing includes regular and comprehensive selfassessments for compliance with consumer laws and regulations

including fair lending.

The compliance management program promptly addresses issues of 

potential unfairness, deception, abuse, or discrimination.

The compliance risk management program includes comprehensive 

controls and systems to assure prompt and thorough corrective action 

when problems are found.

RATING – Compliance risk management program and oversight Strong Adequate Weak
CFPB

Template Risk Assessment

CFPB Risk Assessment 13

Product and system development and modification

Consumer compliance risks are considered throughout the product and 

system lifecycle.

Comments

[Click&type]

Management and staff responsible for consumer compliance are 

involved in the product life cycle, including product development and 

changes, marketing, product delivery, and customer service.

Possible unfair, deceptive, abusive, or discriminatory effects of 

product design or delivery are considered and resolved at an early 

stage.

Management and staff responsible for consumer compliance are 

involved in the structuring of incentives, including those for 

employees and third-party vendors and their employees who interact 

with consumers.

RATING – Product and system development and modification Strong Adequate Weak
CFPB

Template Risk Assessment

CFPB Risk Assessment 14

Training

Appropriate training is provided to all staff, including those 

responsible for product development, marketing, and customer service

and covers consumer protection laws and the obligation to avoid 

unfair, deceptive, abusive, or discriminatory practices.

Comments

[Click&type]

Training is timely, repeated as necessary, and tailored to the particular 

responsibilities of the staff receiving it.

Training encourages all employees to take responsibility for consumer 

compliance and to identify and correct issues.

Policies and procedures and oversight mechanisms are designed to 

ensure that appropriate and current training is provided to employees 

of third parties who interact with consumers.

RATING – Training Strong Adequate Weak
CFPB

Template Risk Assessment

CFPB Risk Assessment 15

Complaint Management

The entity provides consumers with the opportunity to submit 

complaints through channels of the customer’s choice, including mail, 

email, or phone.

Comments

[Click&type]

The entity provides complete and timely responses to complaints 

received either directly from consumers or indirectly through 

regulators or other third parties that process complaints.

Third parties that provide services involving consumers have an 

established complaint process that is appropriately monitored by the 

supervised entity.

The entity tracks all types of complaints.

The entity actively monitors complaints to identify issues that may 

require changes in products, procedures, and/or training.

The entity tracks the time to final resolution of consumer complaints.

Complaints are resolved without requiring the direction or 

involvement of executives, regulators, or third parties (such as the 

Better Business Bureau), or the prospect of litigation or enforcement 

actions.

RATING – Complaint Management Strong Adequate Weak
CFPB

Template Risk Assessment

CFPB Risk Assessment 16

Other factors that point to potential lack of controls or mitigation

<DESCRIBE FACTOR> Comments

[Click&type]

RATING – Other factors Strong Adequate Weak

Magnitude and Severity of Potential Harm – This factor should be considered when setting priorities for examination activities 

based on potential risks identified in particular products, lines of business, or the entity overall. Comments should discuss and 

compare the likely magnitude and severity of potential harm from any identified sources of risk.

The magnitude and severity of potential harm to consumers will vary 

based upon the number of consumers who may be directly impacted 

and the risks identified. For example, a smaller entity, or smaller line 

of business within an entity, may pose a greater risk to consumers than 

a larger one if the consumers potentially impacted by the smaller entity

or line of business face much larger harmful consequences than those 

of the larger entity. 

Comments

[Click&type]

RATING – Magnitude and Severity of Potential Harm Low Moderate High
CFPB

Template Risk Assessment

CFPB Risk Assessment 17

Background Considerations – these factors indicate a likelihood of existing weaknesses and may bear on the direction of risk

Supervisory History –Regulatory violations and Matters 

Requiring Attention identified in previous examinations; 

consumer compliance rating

Comments

[Click&type]

Violations involve prohibited kickbacks, discrimination, unfair, 

deceptive or abusive acts or practices, need for reimbursements, or 

other harm to consumers.

Violations are repeated or continuing.

Violations result from systemic causes.

Violations and Matters Requiring Attention reflect compliance 

management weaknesses.

Consumer compliance rating of 3, 4 or 5.

RATING – Supervisory History Low Moderate High
CFPB

Template Risk Assessment

CFPB Risk Assessment 18

Consumer complaints

Numerous complaints from consumers are filed against the entity, or 

its third-party vendors that interact with consumers, relative to the size 

of the customer base or in comparison to other entities of similar size 

offering similar products.

Comments

[Click&type]

Complaints allege or involve:

• Misleading or false statements.

• Lack of disclosure of information about material terms of a 

product or service.

• Unauthorized fees, fees for services not provided, or 

duplicative fees.

• Previously undisclosed charges.

• Customer service.

• Loan servicing and collections.

Complaints evidence non-compliance with consumer protection laws.

Complaints raise issues of discrimination.

Complaints raise issues of potential unfair, deceptive, or abusive acts 

or practices.

RATING – Consumer Complaints Low Moderate High
CFPB

Template Risk Assessment

CFPB Risk Assessment 19

SUMMARY WORKSHEET

Use this worksheet for an overall view of the Risk Assessment findings. 

Enter the rating for the different risk factors reviewed on the previous pages and note the priorities for examination review

Risk Factors Rating Review Priorities

INHERENT RISK

Nature and structure of products [Click&type] [Click&type]

Consumers to whom products are marketed [Click&type]

Marketing methods and sales organization [Click&type]

Ongoing customer relationship management [Click&type]

Complexity of organization [Click&type]

Other factors [Click&type]

RISK CONTROLS AND MITIGATION

Board of directors and management [Click&type]

Authority and accountability for compliance [Click&type]

Compliance risk management program and oversight [Click&type]

Product and system development and modification [Click&type]
CFPB

Template Risk Assessment

CFPB Risk Assessment 20

Training [Click&type]

Complaint management [Click&type]

Other factors [Click&type]

Magnitude and severity of potential harm [Click&type]

BACKGROUND CONSIDERATIONS

Supervisory history – regulatory violations, Matters Requiring Attention, 

rating

[Click&type]

Consumer complaints [Click&type]
CFPB

Template Risk Assessment

CFPB Risk Assessment 21

RISK ASSESSMENT CONCLUSIONS 

Risk Summary

Supervised entity or line of business reviewed: [Click&type]

Element

Current

MM/DD/YYYY

Preceding

MM/DD/YYYY

Inherent Risk [Click&type] [Click&type]

Quality of Risk Controls and Mitigation [Click&type] [Click&type]

[Click&type] [Click&type]

Overall Risk to Consumers* [Click&type] [Click&type]

Expected Change/Direction of Risk Increasing Decreasing Stable

Last Change in Direction

MM/DD/YYYY

Increasing Decreasing Stable
CFPB

Template Risk Assessment

CFPB Risk Assessment 22

*Overall Risk to Consumers:

The overall risk is the inherent risk identified in a particular business line or supervised entity, 

mitigated or amplified by the strength or weakness of the controls to address those risks. The 

following chart is a general guide to assessing the overall risk to consumers. Examiners must apply 

their judgment in making this determination; however, a risk controls conclusion of “Weak” should 

result in an overall risk conclusion that is no more favorable than “Moderate,” even if the degree of 

risk is concluded to be “Low.”

Overall Risk to Consumers

Quality of Risk Controls

Strong Adequate Weak

Inherent Risk

High Moderate High High

Moderate Low Moderate High

Low Low Low Moderate
CFPB

Template Risk Assessment

CFPB Risk Assessment 23

Summarize the primary bases for the summary conclusions:

[Click&type]
CFPB

Template Supervision Plan

Supervision Plan 1

Supervision Plan for 

Depository Institutions and Affiliates

Data Section

Entity Name: [Click&type]

Entity Headquarters City, State: [Click&type]

Entity RSSD No. or Other Identifier (specify if Other): [Click&type]

Affiliated Entity Name(s): [Click&type]

Narrative Section

[boxes will expand]

Institution Profile

Summarize thecurrent Profile of the lead institution and any affiliate(s): 

[Click&type]

Risk Assessment

Summarize the results of the current Risk Assessment(s):

[Click&type]

SupervisionPlan 

Based on the Profile and Risk Assessment, summarize the plan for supervising the institution and 

its affiliates. Identify the purpose of particular activities, and note any that require particularly 

close coordination with Enforcement or Fair Lending.

[Click&type]
CFPB

Template Supervision Plan

Supervision Plan 2

Priorities: Describe the priorities for CFPB supervision activities, which should relate to the 

risks present in the institution and its affiliates. Clarifying priorities will assist in scheduling 

examiner resources.

[Click&type]

Monitoring: Describe the plan and timeline for monitoring the institution and affiliates, 

including any follow-up for Matters Requiring Attention or Enforcement Actions.

[Click&type]

Examination(s): Describe the proposed focus, scope,and schedule of examination activities 

during the year (either in a full examination or a series of limited examinations). Note the 

location of proposed activities. Include information about coordination with the prudential or 

state regulator(s), including examination schedule(s) if known. If an examination is not 

scheduled during the current year, note why. 

[Click&type]

Examination Resource Requirements: Proposed number of examiners, any special skills or 

knowledge needed, and projected number of examiner work weeks. 

[Click&type]

Additional Notes

[Click&type]
CFPB

Template Scope Summary

Entity Name Scope Summary 1

EXAMINATION SCOPE SUMMARY

Name of Supervised Entity: [Click&type]

City, State: [Click&type]

Entity website: [Click&type]

Organization chart (insert or attach as pdf if available)

Number of Open Offices/Branches (including Main Office): [Click&type]

Number of Agents (where applicable): [Click&type]

Total Assets (where applicable) (xx/xx/xxxx) $ [Click&type]

CFPB Docket # [Click&type]

Lead Regional Office: [Click&type]

Regional Office(s) Performing Examination: [Click&type]

Examiner-In-Charge (Current Examination): [Click&type]

Lead Examiner (if applicable): [Click&type]

Examination Team Members: 

Name Role Specialty

 [Click&type] [Click&type] [Click&type]

 [Click&type] [Click&type] [Click&type]

 [Click&type] Enforcement contact [Click&type]

 [Click&type] Fair Lending contact [Click&type]

Prudential and/or State Regulator(s): [Click&type]

Regulator Contact(s): [Click&type]

Contact phone #: [Click&type]

Contact email: [Click&type]

Examination Start Date: [Click&type]

Completion Date: [Click&type]

Examination Period: [Click&type]

Anticipated Hours: [Click&type]

Communication Plan: [Who is responsible for communicating with entity? List any expected or 

scheduled meetings.] [Click&type]
CFPB

Template Scope Summary

Entity Name Scope Summary 2

COMPLAINTS

Consumer Complaints received by CFPB since the previous examination: 

OUTSTANDING ENFORCEMENT ACTIONS

EA Type Issue Date Agency Comments

 [Click&type] [Click&type] [Click&type] [Click&type]

OUTSTANDING MATTERS REQUIRING ATTENTION

Matter 

Requiring 

Attention

Status Due Date Required 

Response

Comments

 [Click&type] [Click&type] [Click&type] [Click&type] [Click&type]

BREAKDOWN OF LOAN ORIGINATION AND PORTFOLIO

(xx/xx/xxxx – xx/xx/xxxx)

Loan Type Dollar Volume 

Originated

% Originated in 

Portfolio

% of Total Portfolio

Residential Loans [Click&type] [Click&type] [Click&type]

Consumer Loans [Click&type] [Click&type] [Click&type]

Small Business Loans [Click&type] [Click&type] [Click&type]

Other [Click&type] [Click&type] [Click&type]

Is HMDA Applicable? Yes No (If yes, must consult Fair Lending)

ASSET VOLUME CHANGE

Date: [Click&type] Date: [Click&type]

Total Assets: [Click&type] Total Assets: [Click&type]

Source of Information: [Call report? Public filing? Other source? If other, specify] 

[Click&type]
CFPB

Template Scope Summary

Entity Name Scope Summary 3

OTHER FINANCIALINFORMATION (as applicable)

Deposits Total Deposits: $[Click&type] Total Consumer Deposits: 

$[Click&type]

Money Transmission Volume: $[Click&type]

Check Cashing Volume: $[Click&type]

Debt Collection Account Volume: $[Click&type]

Other (Add 

additional lines for 

areas applicable to 

the entity being 

examined)

 [Click&type] [Click&type]

ENTITYASSESSMENT SUMMARY

(Prior to onsite portion of examination.)

Risk Summary: [Copied from Risk Assessment]

Element Current

MM/DD/YYYY

Preceding

MM/DD/YYYY

Inherent Risk [Click&type] [Click&type]

Quality of Risk Controls and Mitigation [Click&type] [Click&type]

Overall Risk to Consumers [Click&type] [Click&type]

Expected Change/Direction of Risk Increasing Decreasing Stable

Last Change in Direction MM/DD/YYYY

Increasing Decreasing Stable

[Narrative description of primary basis for Risk Assessment. Copy from Risk Assessment 

template.] [Click&type]
CFPB

Template Scope Summary

Entity Name Scope Summary 4

SCOPE OF THE EXAMINATION

(Completed prior to onsite portion of examination) 

[narrative description of related examination activities]

UDAAP

 [Click&type]

Compliance Management System

 [Click&type]

Fair Lending Review

 [Click&type]

Complaints

 [Click&type]

Indicate the specific regulations that will be subject to transactional testing, noting the 

relationship with activities in the previous section. 

AREA

Review

Yes | NA Comments

LENDING

Truth In Lending Act [Click&type]

Real Estate Settlement 

Procedures Act [Click&type]

Homeowners 

Protection Act [Click&type]

Equal Credit 

Opportunity Act [Click&type]

Home Mortgage 

Disclosure Act [Click&type]

Fair Credit Reporting 

Act [Click&type]

Consumer Leasing Act [Click&type]

Fair Credit Billing Act [Click&type]

Home Ownership and 

Equity Protection Act [Click&type]

Alternative Mortgage 

Transaction Parity Act [Click&type]

S.A.F.E. Mortgage 

Licensing Act [Click&type]

Fair Debt Collection 

Practices Act [Click&type]
CFPB

Template Scope Summary

Entity Name Scope Summary 5

Section 626 of the 

Omnibus 

Appropriations Act 

(Mortgage Acts and 

Practices –Advertising 

and Mortgage 

Assistance Relief 

Services)

 [Click&type]

AREA

Review

Yes | NA Comments

DEPOSITS

Truth In Savings Act [Click&type]

Electronic Fund 

Transfer Act [Click&type]

Disclosure of Lack 

of Deposit Insurance [Click&type]

AREA

Review

Yes | NA Comments

PRIVACY

Sections 502-509 of 

the Gramm Leach 

Bliley Act (Privacy 

provisions, but not 

information security)

 [Click&type]

FINAL SCOPE SUMMARY

Describe changes to the scope of the examination that occurred during the examination, 

including changes to the Risk Summary.

 [Click&type]

Note considerations for the scope of the next examination. [Click&type]
CFPB

Examination Report

CFPB Examination Report 1

<Delete following instructions:

General Instructions:

The primary purpose of the report is to communicate examination findings to a supervised 

entity’s board of directors or principals. The report must emphasize significant matters and 

avoid issues that do not affect or support a rating. Throughout the report, present information 

under Comments and Supporting Analysis in a well-organized and logical manner. Report 

comments should be concise, discussing major strengths and/or weaknesses to support the 

examiners’ conclusions. Limit supporting analysis to information that clearly and succinctly 

demonstrates the conclusions, and avoid including material for informational purposes that does 

not provide support for the rating or risk assessment. 

Plain Language

Reports should follow “plain language” principles:

• Identify your audience.

• Write in active voice (e.g., “identify the doer”). 

• Use strong verbs and the simplest tense possible.

• Use simple everyday words except for necessary technical terms.

• Avoid jargon, excessive acronyms and abbreviations, multiple negatives, unnecessary 

qualifiers, and redundancies. 

• Construct short, concise sentences. 

• Express parallel ideas in parallel constructions (e.g., the bullets listed here each begin with a 

verb).

Definition of Dates used in Examinations

The following definitions ensure accurate and consistent presentation of financial data in the 

report and consistent records of examination activities. The Federal financial institution 

regulatory agencies use similar definitions.

Examination (As Of) Date – The date of the data presented in the report. Generally, this is the 

most recent quarterly information that is available. Significant subsequent events may result in 

the presentation of more recent data. 

Current Examination Start Date (Examination Commenced) – The date the examination activity 

commenced. For all examinations, use the date that time was first charged to the examination. 

Examination Completion Date (Examination Concluded) – The last day of examination 

activities. 

Close (ER Mail) Date – The day that CFPB mails the final report to the entity. 

Previous Examination Date – The examination start date of the prior examination. >
CFPB

Examination Report

CFPB Examination Report 2

Table of Contents

EXAMINATION CONCLUSIONS 3

REVIEW AND FINDINGS 8

COMPLIANCE WITH ENFORCEMENT ACTIONS 10

APPENDIX 11
CFPB

Examination Report

CFPB Examination Report 3

Examination Conclusions Docket Number: [Click&type]

Examination Start Date: DD/MM/YYYY

Conclusions on the findings of this examination and the results of interim monitoring and reviews.

Scope

<Delete following instruction: The scope should include a brief explanation of the examination 

activities undertaken, including, as applicable, the Risk Assessment, reviews for potential 

violations of Federal consumer financial law (particularly unfair, deceptive or abusive acts or 

practices, and discrimination), review of the entity’s compliance management system, or review 

of complaints. Identify the products/services and regulatory issues reviewed. Examples of 

Products/Services Reviewed: [credit cards, mortgage origination, mortgage servicing, private 

student lending, auto lending, payday lending, unsecured consumer lending, deposit-related, and 

financial advisory services].>

Click Here and Type

Conclusions and Comments

<Delete following instruction: The Conclusion must contain an overall conclusion, followed by 

a concise summary of the findings. The conclusion should match the tone and language of the 

rating definition. This section should include summary details or facts supporting the conclusion, 

including a summary of material deficiencies that support 3, 4, and 5 ratings. The narrative 

should include both positive and negative conclusions and be concise, constructive, and direct. 

The narrative comments do not need to cover every area reviewed during an examination. 

Rather, the comments should focus on those matters that support the overall conclusion and 

rating. >

Click Here and Type

Risk Assessment 

<Delete following instruction: The results of the final Risk Assessment should be included in 

this section. A narrative explanation should be provided in the Review and Findings section of 

the report. The supporting documentation and analysis for the risk assessment findings entered 

below should be documented in the Risk Assessment template and included in the examination 

workpapers. The date used for the current examination should be the examination (as of) date. 

The date used for previous examinations should be the examination (as of) date(s).>
CFPB

Examination Report

CFPB Examination Report 4

Element

Current

MM/DD/YYYY

Preceding

MM/DD/YYYY

Inherent Risk MM/DD/YYYY MM/DD/YYYY

Quality of Risk Controls and Mitigation MM/DD/YYYY MM/DD/YYYY

Overall Risk to Consumers* MM/DD/YYYY MM/DD/YYYY

Expected Change/Direction of Risk <increasing/decreasing/stable>

Last Change in Direction < MM/DD/YYYY >

<increasing/decreasing/stable>

* The inherent risk identified in a particular business line or supervised entity, mitigated or 

amplified by the strength or weakness of the controls to address those risks. 

Consumer Protection Compliance Rating 

<Delete following instruction: Insert the current examination rating for the regulated entity and 

choose the correct rating definition below. Ensure that the examination rating is supported in 

the workpapers and the Final Scope Summary. The procedures for determining the examination 

rating as well as the definitions for each rating are located in the “Close the Examination” 

section of the Examination Manual. The dates are the examination start dates.>

Current 

Examination

Previous Examinations

(if applicable)

MM/DD/YYYY MM/DD/YYYY MM/DD/YYYY

Compliance Rating MM/DD/YYYY MM/DD/YYYY MM/DD/YYYY
CFPB

Examination Report

CFPB Examination Report 5

A supervised entity with this rating [choose appropriate definition language]

“1”

Is in a strong compliance position. Management is capable of and staff is sufficient for 

effectuating compliance. An effective compliance program, including an efficient system of 

internal procedures and controls, has been established. Changes in consumer statutes and 

regulations are promptly reflected in the institution's policies, procedures, and compliance 

training. The institution provides adequate training for its employees. If any violations are noted, 

they relate to relatively minor deficiencies in forms or practices that are easily corrected. There is 

no evidence of discriminatory acts or practices, reimbursable violations, or practices resulting in 

repeat violations. Violations and deficiencies are promptly corrected by management. As a 

result, the institution gives no cause for supervisory concern. 

“2”

Is in a generally strong compliance position. Management is capable of administering an 

effective compliance program. Although a system of internal operating procedures and controls 

has been established to ensure compliance, violations have nonetheless occurred. These 

violations, however, involve technical aspects of the law or result from oversight on the part of 

operating personnel. Modification in the institution's compliance program and/or the 

establishment of additional review/audit procedures may eliminate many of the violations. 

Compliance training is satisfactory. There is no evidence of discriminatory acts or practices, 

reimbursable violations, or practices resulting in repeat violations. 

“3”

Is in a less than satisfactory compliance position. It is a cause for supervisory concern and 

requires more than normal supervision to remedy deficiencies. Violations may be numerous. In 

addition, previously identified practices resulting in violations may remain uncorrected. 

Overcharges, if present, involve a few consumers and are minimal in amount. There is no 

evidence of discriminatory acts or practices. Although management may have the ability to 

effectuate compliance, increased efforts are necessary. The numerous violations discovered are 

an indication that management has not devoted sufficient time and attention to consumer 

compliance. Operating procedures and controls have not proven effective and require 

strengthening. This may be accomplished by, among other things, designating a compliance 

officer and developing and implementing a comprehensive and effective compliance program. 

By identifying an institution with marginal compliance early, additional supervisory measures 

may be employed to eliminate violations and prevent further deterioration in the institution's 

less-than-satisfactory compliance position. 
CFPB

Examination Report

CFPB Examination Report 6

“4”

Requires close supervisory attention and monitoring to promptly correct the serious compliance 

problems disclosed. Numerous violations are present. Overcharges, if any, affect a significant 

number of consumers and involve a substantial amount of money. Often practices resulting in 

violations and cited at previous examinations remain uncorrected. Discriminatory acts or 

practices may be in evidence. Clearly, management has not exerted sufficient effort to ensure 

compliance. Its attitude may indicate a lack of interest in administering an effective compliance 

program, which may have contributed to the seriousness of the institution's compliance 

problems. Internal procedures and controls have not proven effective and are seriously deficient. 

Prompt action on the part of the supervisory agency may enable the institution to correct its 

deficiencies and improve its compliance position. 

“5”

Is in need of the strongest supervisory attention and monitoring. It is substantially in noncompliance with the consumer statutes and regulations. Management has demonstrated its 

unwillingness or inability to operate within the scope of consumer statutes and regulations. 

Previous efforts on the part of the regulatory authority to obtain voluntary compliance have been 

unproductive. Discrimination, substantial overcharges, or practices resulting in serious repeat 

violations are present. 

< Delete following instructions: The Examiner-in-Charge (EIC) will sign the examination 

report. If an examiner is acting as the EIC for professional development purposes (EIC in 

training), a commissioned examiner must review the EIC in training’s work and sign the 

report.>

/s/ <EIC signature>

Examiner-in-Charge
CFPB

Examination Report

CFPB Examination Report 7

Examination Conclusions 

Matters Requiring Attention

Specific expectations and time frames for actions requiring prompt response and corrective action.

< Delete following instructions: This section should include significant matters requiring prompt

board or principal attention and corrective action. There may be corrective actions that do not 

get incorporated here – these findings are those that require attention from the Board or 

Principal(s) and a written response to the CFPB. Communicate specific expected actions and 

time frames. Do not use of the term “should” when you require the board or principal(s) and 

management to take corrective action; instead, use “must.”>

<Select one of the following paragraphs and delete the other.>

1) This examination found no matters requiring a written response from the [board of directors 

or principals]; however, [the board or principal(s)] is responsible for the adoption and 

implementation of any corrective actions discussed in other sections of this report.

[or]

2) This examination found the following matters that the [board of directors or principals] must 

specifically address in their written response to this examination report. The [board of 

directors or principals] is also responsible for the adoption and implementation of any 

corrective actions discussed in other sections of this report.

Matter Requiring 

Attention

Due Date Required Response

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]

[Click&type] [Click&type] • [Click&type]
CFPB

Examination Report

CFPB Examination Report 8

Review and Findings

Areas or activities examined; violations of law, deficiencies in systems, or other weaknesses identified; and 

required corrective actions.

Assessment of Risks

Aspects of a supervised entity’s products or operations that increase the risk of unfair, deceptive, or abusive acts 

or practices for discrimination, or for violations of other Federal consumer financial laws (inherent risks).

<Delete following instructions: The conclusion must contain an overall conclusion about the 

Inherent Risk findings from the CFPB Risk Assessment and should include summary details or 

facts supporting the conclusion. Include details supporting the conclusion in the Comments and 

Supporting Analysis section.>

Conclusion

[Click&type]

Comments and Supporting Analysis

[Click&type]

Compliance Management Review

The effectiveness of the supervised entity’s strategy for identifying and managing inherent risks and the strength of 

the entity’s overall system of compliance management.

<Delete following instruction: The conclusion must contain an overall conclusion about the 

effectiveness of the supervised entity’s strategy for identifying and managing the inherent risks to 

consumers and managing its consumer compliance responsibilities, and summary details or 

facts supporting the conclusion, including a summary of material deficiencies. Include details 

supporting the conclusion in the Comments and Supporting Analysis section.>

Conclusion

[Click&type]

Comments and Supporting Analysis

[Click&type]
CFPB

Examination Report

CFPB Examination Report 9

Required Corrective Actions 

To address weaknesses in managing risks of potential unfair, deceptive, or abusive acts or practices, discrimination, 

or other violations of Federal consumer financial law.

<Delete following instruction: This section identifies specific actions that management must take 

to resolve supervisory concerns, including specific time frames for completion. If there are no 

corrective actions for a particular area, just insert “N/A.” Actions requiring board or principal 

attention should also be included in the Matters Requiring Attention section of the report. 

Include repeat deficiencies as Matters Requiring Board or Principal Attention. Do not include 

recommendations or ideas for management to consider in the Required Corrective Actions 

section; they should be provided in the Recommendations section.>

Click Here and Type

Area Reviewed: [insert name or description]

<Delete following instruction: The area reviewed should include findings for the specific 

product or service that was reviewed. For example, the area reviewed may be Mortgage 

Origination. The Conclusion, Comments and Supporting Analysis, and Required Corrective 

Actions should focus on mortgage origination and any regulatory issues identified for the area 

reviewed. The conclusion must contain an overall conclusion on the area reviewed and 

summary details or facts supporting the conclusion, including a summary of material 

deficiencies. Include details supporting the conclusion in the Comments and Supporting Analysis 

section. If no deficiencies exist, it should be stated and the Required Corrective Actions section 

should state “N/A.”>

Click Here and Type

Conclusion

Click Here and Type

Comments and Supporting Analysis

<Delete following instruction: If a regulatory violation is identified, include the citation for the 

violation, consistent with the format from the Supervision and Examination System.>

Click Here and Type

Required Corrective Actions

<Delete following instruction: This section identifies specific actions that management must 

take to resolve supervisory concerns, including specific time frames for completion. If there are 

no required corrective actions for a particular area, state “N/A”. Actions requiring board or 

principal attention should also be included in the Matters Requiring Attention section of the 

report. Include repeat deficiencies as Matters Requiring board or principal Attention. Do not 

include recommendations or ideas for management to consider in the Required Corrective 

Actions section; they should be provided in the Recommendations section.>

Click Here and Type
CFPB

Examination Report

CFPB Examination Report 10

Area Reviewed: [insert name or description]

Conclusion

Click Here and Type

Comments and Supporting Analysis

Click Here and Type

Required Corrective Actions

Click Here and Type

Recommendation(s)

Suggestions to improve or strengthen currently satisfactory entity practices.

<The section is an optional section to provide recommendations to improve or strengthen entity 

practices that are currently found to be satisfactory.>

Click Here and Type

Compliance with Enforcement Actions

The status of the supervised entity’s compliance with both formal and informal consumer financial protectionrelated enforcement actions, including any areas of non-compliance or partial compliance.

<This section should be completed if the supervised entity has existing consumer financial 

protection-related enforcement action(s) in place from CFPB or the entity’s prudential 

regulator. Remove this section from the report if there are no existing or previous consumer 

financial protection-related enforcement action(s). Use this section to document conclusions 

and supporting analysis as well as required corrective actions concerning the supervised entity’s 

compliance with formal and informal consumer financial protection-related enforcement 

actions.>

Conclusion

Click Here and Type

Comments and Supporting Analysis

Click Here and Type

Corrective Actions

Click Here and Type
CFPB

Examination Report

CFPB Examination Report 11

APPENDIX

Examination Team Members

<Delete following instruction: Use this section of the report to identify all examiners who 

participated in the examination of the regulated entity.>

The following individuals participated in this examination:

Click Here and Type
EXAMINATION REPORT

Examination Start Date: [Click&type]

Examination Cycle Ending Date: [Click&type]

Entity name: [Click&type]

City, State: [Click&type]

CFPB Docket Number: [Click&type]

Entity Type: [Click&type: Depository Institution/DI 

Affiliate/DI Subsidiary/Non-Depository]

Examination Type: [Click&type: Full (10), Limited (11), Target 

Review(12), Horizontal Review (15)>] 

Subordinate and Affiliated Organizations Examined: [Click&type]

Prohibition of Disclosure or Release

This document is the property of the Consumer Financial Protection Bureau (CFPB), and CFPB furnishes 

this document to the entity for its confidential use. Except as provided in 12 C.F.R. Section 1070.42, the 

entity’s directors, officers, or employees may not disclose the report or any portion of it, to unauthorized 

persons or organizations. Unauthorized persons or organizations include anyone not officially connected 

with the entity as an officer, director, employee, attorney, auditor, independent auditor, or parent holding 

company. 

If the entity receives a subpoena or other legal process calling for production of this document, notify the 

Regional Director and the CFPB General Counsel immediately. Advise the attorney issuing the subpoena 

and, if necessary, the court of the above prohibition and refer them to 12 C.F.R. Part1070. 
Consumer Financial Protection Bureau [use letterhead if available] <office>Region

[Click and Type Office Name]•[Click and Type Phone Number]• Fax: Click Here and Type Fax Number

[Click and Type Address]

Click Here and Type P.O. Box Address

Click here and type date

[BOARD OF DIRECTORS / Principal(s)]

<Entity name>

<street address>

<city state zip>

Dear [Directors/Principal(s)]:

Pursuant to the authority of the Dodd-Frank Wall Street Reform and Consumer Protection Act,

the Consumer Financial Protection Bureau (CFPB) performed a risk-focused examination of 

<entity name>. The examination began on <Month XX, 20XX>.

The following report summarizes the findings of our examination. Any matters of criticism, 

violations of laws or regulations, and other matters of concern identified within this Examination 

Report require the [Board of Directors’/principal’s] and management’s prompt attention and 

corrective action.

The comments and conclusions in this report are based on an analysis of information obtained 

from the entity’s records and from other authoritative sources. CFPB prepared this report for 

supervisory purposes, and you should not consider it an audit report.

<Select one of the following paragraphs and delete the other two paragraphs. If you select the 

third paragraph, indicate when a reply is due. >

[Please review the entire report at your next meeting and note your review in the minutes of that 

meeting. or Please review the entire report and retain written documentation confirming your 

review.] You need not prepare or send CFPB a written response to the report.

[Please review the entire report at your next meeting, adopt any corrective actions called for, and 

note your review and actions in the minutes of that meeting. or Please review the entire report, 

adopt any corrective actions called for, and retain written confirmation confirming your review.] 

You need not prepare or send CFPB a written response to the report.

[Please review the entire report at your next meeting. Please send us a certified copy of excerpts 

from your minutes stating that you reviewed the report, or Please review the entire report and 

send us written confirmation of your review,] and advise us of what action you took, or will take, 

regarding each point discussed in the Matters Requiring Attention section of this report. Please 

reply within [Click and Type Number of Days] days from the date of this letter.

If you have any questions, please call me at [Click and Type phone number]. If I am unavailable, 

please call [Click and Type Name and Title of Alternate], at [Click and Type phone number].

/s/

[Click and Type: name title]

cc: <prudential regulator>