TL;DR
Compliance fails when it lives in QC reports rather than the workflow itself. The eight features below — TRID durable timers, QM/ATR per-loan verification, HMDA auto-population, ECOA decisioning + 30-day timer, RESPA Section 8 + servicing, HOEPA detection at lock, immutable audit logging, and 100% pre-close QC — are what separate workflow-enforced compliance from post-fund discovery. Each carries a CFR citation and a demo-day test criterion. Confer's compliance engine ships every one as architecture, not policy.
Why does compliance architecture matter more than compliance modules?
A compliance module reports on what already happened. Compliance architecture prevents the violation by gating the action. The cure cost difference is real: pre-close, you collect the missing document; post-close, you face a CFPB finding, an investor repurchase demand, or both. ACES Q4 2024 critical defect rate of 1.79% across the industry is the cost of compliance-as-module. Pre-close continuous validation targets sub-0.5%.
The eight features, with CFR citation and test criterion
#1 · 12 CFR § 1026.19(e)–(f)
TRID timing enforcement
The Closing Disclosure must reach the borrower exactly 3 business days before consummation. The Loan Estimate must go out within 3 business days of application. Tolerance buckets (0%, 10%, unlimited) constrain post-disclosure cost changes.
What the LOS must do
Durable workflow timers — Confer uses Temporal — that survive server restarts, deploys, and queue-worker crashes. Atomic state transitions on every clock event. Automatic redisclosure trigger when tolerance buckets are breached.
Cost of getting it wrong
TRID violation: $5K–$25K per CFPB incident. Late CD pushes closing 3+ business days. The cycle-time and reputation cost compounds.
#2 · 12 CFR § 1026.43(c)
QM / ATR — Ability to Repay verification
Eight factors must be verified on every loan: (1) current/expected income, (2) employment, (3) other income relied on, (4) monthly mortgage payment, (5) payments on simultaneous loans, (6) other obligations, (7) DTI/residual income, (8) credit history.
What the LOS must do
Per-loan verification of all 8 factors with stored evidence. Safe harbor vs. rebuttable presumption tracked. HPML detection at lock with auto-flag. No sampling — every loan verified.
Cost of getting it wrong
ATR violations expose lenders to indefinite borrower-foreclosure-defense liability. Investor repurchase demand on ATR-deficient loans: $15K–$50K per loan.
#3 · Regulation C, 12 CFR § 1003
HMDA LAR auto-population
110+ data points per loan must be filed annually with FFIEC. The 2024 reporting threshold lowered the bar; many mid-sized lenders that didn't report before now must.
What the LOS must do
Auto-population from origination data as the loan progresses. FFIEC edit-check validation continuously, not as a March crunch. Demographic data collected at borrower interaction, not retrofitted.
Cost of getting it wrong
Inaccurate HMDA: $50K–$2M+ in CFPB enforcement penalties. HMDA prep done manually consumes 80–120 FTE hours per cycle.
#4 · 12 CFR § 1002
ECOA / Reg B — Adverse action and decision timing
Adverse action notices must go out within 30 days of an application's completion. Demographic data must be collected with prescribed wording. Fair lending requires consistent decisioning logic that can be audited for disparate impact.
What the LOS must do
30-day decision timer that fires automatically. Adverse action notice generation from templates with correct ECOA disclosure language. Decisioning logic versioned and auditable for fair lending review.
Cost of getting it wrong
ECOA violations: civil penalties up to $1.087M per violation. Class-action exposure on disparate impact findings.
#5 · 12 CFR § 1024
RESPA — Section 8 and servicing transfer
Section 8 prohibits kickbacks for referrals. Servicing transfers require specific borrower notices. Escrow account analysis runs annually with refund/shortage rules.
What the LOS must do
Marketing service agreement (MSA) tracking with explicit value documentation. Servicing transfer notice generation with correct timing. Annual escrow analysis with auto-generated borrower notices.
Cost of getting it wrong
RESPA Section 8 violations: $10K+ per violation, treble damages possible. Servicing transfer notice failures generate borrower complaints and CFPB exam findings.
#6 · 12 CFR § 1026.32
HOEPA — High-cost mortgage detection
Loans crossing APR, points-and-fees, or prepayment-penalty thresholds become 'high-cost' and trigger additional disclosures, counseling requirements, and substantive loan-term restrictions.
What the LOS must do
Real-time HOEPA detection at lock with block-or-disclose workflow gating. APR and points-and-fees calculation automated. Counseling-completed verification before close.
Cost of getting it wrong
Originating an undisclosed HOEPA loan creates indefinite rescission rights for the borrower. The loan is effectively unsalable to most investors.
#7 · Operational standard — required by SOC 2, FFIEC, and CFPB exams
Immutable audit logging
Every agent action, data mutation, decision, and state transition must be captured in an append-only ledger with operator, timestamp, before/after state, and reasoning.
What the LOS must do
Append-only audit log written synchronously with every loan record change. Tamper-evident storage. Tenant isolation via row-level security. Retention aligned with state and federal requirements (typically 5–7 years post-close).
Cost of getting it wrong
Without immutable audit trails, regulator examinations rebuild history from logs and inferences. The reconstruction itself becomes a finding.
#8 · Operational standard — driven by ACES Q4 2024 industry critical defect rate of 1.79%
Continuous pre-close QC
Sampling 10% of files post-fund finds defects after the loan is sold. Continuous pre-close QC catches defects while they can still be cured.
What the LOS must do
100% pre-close validation on income reproducibility, AUS findings vs. final terms, TRID timing, HMDA completeness, and ULDD/MISMO export against investor specs. Defects route to a review queue, not a discovery report.
Cost of getting it wrong
Investor repurchase demand: $15K–$50K per loan. Critical defect industry average is 1.79%; pre-close continuous QC targets under 0.5%. At 5,000 loans/year that's a $1M+ exposure delta.