CFPB-Proof Loan Application Interfaces: How Banks, Credit Unions, and Mortgage Companies Capture Fair Lending Data Examiners Trust in 2026

Banks, credit unions, and mortgage companies entered 2026 in a regulatory landscape that pulled back at the federal level and pushed forward in every state capital. Acting Director Russell Vought was designated to lead the Consumer Financial Protection Bureau on February 7, 2025, paused most enforcement, and proposed reducing the Bureau's workforce by more than 80 percent. A D.C. Circuit panel acknowledged that figure in litigation over the reduction-in-force plan. None of that repealed a single statute. The Home Mortgage Disclosure Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Truth in Lending Act, the Real Estate Settlement Procedures Act, and the Bank Secrecy Act are all federal laws that the CFPB implements through regulation. They survive any administrative pullback.

State attorneys general, state banking departments, state credit union examiners, and consumer-protection divisions moved fast to fill the federal gap. New York enacted the FAIR Business Practices Act in 2025. California finalized a single regulation package covering automated decision-making technology, risk assessments, and annual cybersecurity audits, effective January 1, 2026. The Homebuyers Privacy Protection Act amended the Fair Credit Reporting Act and took effect March 4, 2026, restricting mortgage trigger leads nationwide. Multi-state coordination through the Conference of State Bank Supervisors keeps moving toward standardized examination formats. The 2026 HMDA asset-size exemption threshold rose to $59 million per the CFPB's January 7, 2026 final adjustment. Every lender above that threshold still files.

This article walks through what your loan application interface must capture in 2026 to satisfy whichever examiner walks in, how Microsoft 365 governance and audit tooling supports the data-trail requirements across banks, credit unions, and mortgage companies, and the seven specific steps that turn a brittle application workflow into an examination-ready system of record.

The CFPB Rollback Did Not Repeal Your Data Rules

The Consumer Financial Protection Bureau is one federal agency. The statutes it enforces sit in the United States Code. A change in CFPB leadership cannot rewrite Congress. The Home Mortgage Disclosure Act lives at 12 USC 2801. The Equal Credit Opportunity Act lives at 15 USC 1691. The Fair Credit Reporting Act lives at 15 USC 1681. The Truth in Lending Act lives at 15 USC 1601. These statutes assign data-collection, recordkeeping, and consumer-disclosure obligations to lenders. Reduced examination cadence does not change the obligations.

The 2022 CFPB interpretive rule on state enforcement of the Consumer Financial Protection Act remains in effect. That rule confirmed that state attorneys general can bring civil actions to enforce CFPA provisions, including the prohibition on unfair, deceptive, or abusive acts or practices. The delegation survived the leadership change. State AGs are not waiting for federal coordination.

Three categories of obligation continue regardless of federal enforcement posture.

• Data collection at the application stage. HMDA Loan Application Register fields apply to mortgage applications at lenders above the $59 million asset threshold. Equal Credit Opportunity Act monitoring information applies to consumer applications across every product where a bank or credit union takes a consumer credit application. Bank Secrecy Act Customer Identification Program fields apply at account opening. None of this is optional.
• Recordkeeping by statutory period. HMDA records under Regulation C must be retained for three years. ECOA application records under Regulation B require 25 months for consumer applications and 12 months for business applications. TILA general records under Regulation Z require two years. The TRID closing disclosure record under 12 CFR 1026.25(c)(1)(ii)(A) requires five years. RESPA mortgage servicing records under 12 CFR 1024.38(c)(1) require one year after the loan is paid off or servicing is transferred. Your interface and your archival platform must hit the longest applicable window for the document type.
• Audit-trail evidence. Every consumer protection rule that lets a borrower or applicant challenge a lending decision presumes the lender can reconstruct that decision from contemporaneous records. Adverse action notices under ECOA, fair-lending disparate-treatment analysis, and HMDA quality control all assume the underlying data has not been altered after the fact. Tamper-evident audit trails are what makes the assumption defensible.

The CFPB has not formally rescinded its prior compendium of supervisory guidance. State examiners and federal prudential regulators including the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Federal Reserve continue to expect the same documentation discipline they expected before 2025. The path of least resistance for a community bank, a credit union, or a mortgage company is to keep collecting the same fields, retain them under the longest applicable period, and design the interface so the audit trail is automatic.

The 2026 State-Level Patchwork Banks, Credit Unions, and Mortgage Companies Now Navigate

Federal enforcement contracted. State enforcement expanded. The result is a patchwork of consumer-protection regimes that lenders operating in more than one state must reconcile. The strictest state controls. Designing for the federal minimum no longer protects against examination risk in California, New York, Massachusetts, Colorado, or Connecticut.

For a multi-state lender, the practical implication is straightforward. Configure your loan application interface against the strictest state requirement applicable to your footprint, then satisfy every other state by default. Trying to maintain separate workflows by state creates a maintenance burden that scales as you grow.

What Your Loan Application Interface Must Capture in 2026

The fields your application interface must capture vary by institution type and product. The principle is the same. Collect the regulated data at the point of entry, validate it before the application advances, and protect it from after-the-fact editing. Retrofitting data collection creates gaps that examiners and plaintiffs lawyers both find.

HMDA fields for mortgage applications above the $59 million asset threshold

Regulation C requires the following data points on the Loan Application Register for every covered application.

• Applicant demographics collected using the standardized HMDA categories for race, ethnicity, and sex, including the disaggregated subcategories required since the 2018 LAR update.
• Loan characteristics including loan type, purpose, loan amount, interest rate, points, loan term, introductory rate period, balloon payment, interest-only payment, negative amortization, prepayment penalty term, and the manufactured home secured property type.
• Property information including property address with full geocoding, occupancy type, construction method, total units, multifamily affordable units, lien status, property value, and AUS used.
• Underwriting data including debt-to-income ratio, combined loan-to-value ratio, credit score used and the model that produced it, the applicant's reported income, and the application channel.
• Action taken as originated, approved not accepted, denied, withdrawn, incomplete, purchased, or preapproval-related categories.
• Denial reasons captured for every denied application using the Regulation C denial-reason code set.

ECOA monitoring information for non-mortgage consumer applications at banks and credit unions

Regulation B requires creditors to collect monitoring information for applications made primarily for the purchase or refinancing of an applicant's principal residence. For other consumer credit, the Bureau allows but does not require monitoring information collection. Many banks and credit unions choose to collect anyway, both for fair-lending analytics and to align with their HMDA workflow on the mortgage side.

• Monitoring information at the same point of entry as the credit application, with the applicant given the option to decline using language that does not invite a particular response.
• Adverse action data when an application is denied, including the specific principal reasons and the data that supported the decision. This includes consumer credit, deposit account opening, member loan applications at credit unions, and small business credit when ECOA applies.
• Pricing data sufficient to run disparate-treatment analysis across applicant demographic categories. Banks and credit unions with significant indirect auto lending, residential real estate lending, or commercial real estate lending exposures all draw fair-lending scrutiny.
• Exception logs recording every time a loan officer or branch manager overrides automated pricing or underwriting recommendations. Examiner fair-lending review compares exception rates across demographic groups.

BSA Customer Identification Program data at account opening

Banks and credit unions are required to capture and verify identifying information at account opening under the Customer Identification Program rules implementing the Bank Secrecy Act. The application interface for a deposit account or member account is where the CIP data enters the system.

• Identifying information including legal name, date of birth, residential address, and tax identification number for U.S. persons, with comparable documentation for non-U.S. persons.
• Verification evidence including the identification document presented, the issuing authority, and the comparison method used to verify the applicant's identity.
• Beneficial ownership data for legal entity customers under the FinCEN beneficial ownership rule.
• OFAC and politically-exposed-person screening records associated with the application at the time the screening was performed.

Seven Steps to Build a CFPB-Proof Application Interface

The same seven steps apply to a community bank's deposit application portal, a credit union's member loan application, and a mortgage company's loan origination system. The fields change. The discipline does not.

Build a crosswalk document that ties each field in your application interface to the specific regulation requiring it. HMDA Regulation C, ECOA Regulation B, TILA Regulation Z, RESPA Regulation X, FCRA, BSA Customer Identification Program, OFAC, state UDAP statutes, and any state-specific application-data rules should all be referenced. A field without a regulatory source is either a business field your team can drop in if the workflow gets reworked, or a field your compliance team forgot to map. Either way, it is information your IT director needs.

For banks and credit unions, include core banking application fields that feed your compliance reporting outputs, including the call report, FFIEC 002 if applicable, and Suspicious Activity Report data sources. For mortgage companies, include Fannie Mae and Freddie Mac delivery data fields that depend on application-entry data.

Do not wait for a downstream quality control review to catch missing or inconsistent data. Build validation rules into the application interface itself. Required fields cannot be left blank without an explicit applicant-decline path. Format checks catch transposed digits in property values, dates outside reasonable ranges, and credit score values outside the model's possible output. Cross-field validation flags inconsistencies, like an application with a stated 80 percent loan-to-value that does not arithmetically match the loan amount and property value entered.

Examiner expectations have shifted toward proactive control design. The FFIEC Development, Acquisition, and Maintenance Booklet released August 2024, communicated to national banks through OCC Bulletin 2024-26, to state member banks through Federal Reserve SR 24-6, and to credit unions through NCUA Letter 24-CU-01, all emphasize that data integrity should be designed into the system development lifecycle, not added through post-hoc remediation.

Once an applicant submits monitoring information under Regulation B or HMDA demographic data under Regulation C, that data should be protected from editing by loan officers, processors, or branch staff. Subsequent changes must be tracked through an audit trail showing the original entry, the changed value, the user who made the change, the timestamp, and the reason recorded.

Microsoft Purview Audit captures the underlying activity log automatically across Microsoft 365 applications. Microsoft Entra ID privileged-identity management ensures that the small group of users who do have authority to override locked fields cannot do so without a just-in-time elevation that itself is logged and approved. The audit trail your examiner expects to see is the same audit trail your security team wants for insider-threat detection. Both groups read the same evidence.

The 2026 HMDA asset-size threshold is $59 million. The 2026 HOEPA points-and-fees triggers update annually. The QM safe-harbor APR-to-APOR spread thresholds adjust with the average prime offer rate. The TILA exempt-loan threshold for higher-priced mortgage loans changes. The CFPA UDAAP enforcement priorities shift. Your application interface should reference current threshold values from a centrally managed configuration table, not hardcoded numbers from last year's release.

Your IT and compliance teams should publish a January refresh checklist that runs through every regulatory threshold and updates the production configuration. The same refresh should propagate into Power BI dashboards, alerting rules, and quality-control reports.

State examiners and federal regulators now arrive with detailed data requests. Campaign archives, NMLS identifier verification for mortgage loan originators, branch-level fair lending data, exception logs, and Bank Secrecy Act monitoring evidence are all expected on short turnaround. Build report templates inside your Power BI compliance dashboard environment or your business intelligence layer of choice that pull directly from the application interface data store.

Include calculation methodology, source-system attribution, and timestamps inside the report output itself. Examiners want to know how a number was produced, not just that it is correct.

Have your compliance team simulate a state or federal examination at least once per quarter. The compliance officer plays the examiner role and submits the data requests a real examiner would submit. The IT and operations teams produce the data on the timeline a real examination would impose. Gaps found during a mock examination are easy to close. Gaps found during a real examination become enforcement-action narratives.

Include a different consumer-protection theme each quarter. Fair lending one quarter. Servicing compliance the next. BSA and AML the next. HMDA data integrity the next. Rotate the theme so coverage stays broad.

The application interface is one component. The data trail behind it depends on the surrounding Microsoft 365 tenant and Azure infrastructure. Microsoft Purview Audit retains the activity log. Microsoft Entra ID Conditional Access controls who can reach the interface and under what conditions. Microsoft Defender for Cloud Apps watches for risky integrations. Microsoft Sentinel correlates the telemetry. The application is only as compliant as the environment around it.

A Tier 1 Microsoft Cloud Solution Provider that manages your Microsoft 365 tenant and hosts your Azure environment closes the loop between application interface and audit trail by design. ABT serves community banks, credit unions, and mortgage companies in that capacity, with explicit configuration of Purview, Entra, Defender, and Sentinel controls against the consumer-protection regulations applicable to each customer.

Retention Windows by Regulation: Get These Right

The single most common compliance error in cross-functional teams is treating retention as a single number. There is no single number. Retention is a matrix indexed by the regulation, the document type, the institution type, and sometimes the action taken on the application. The simplest defensible policy is to retain to the longest applicable window for the document type, and to design the archive so individual records can be retrieved on examiner timelines.

For an institution serving consumer mortgage borrowers, the binding constraint is typically the 5-year TRID Closing Disclosure retention. Building archive policy against that floor handles the shorter HMDA, ECOA, TILA, and RESPA windows automatically. For state-licensed lenders, layer state-specific retention requirements on top. Several states require 7 or 10 years for mortgage records. Your retention policy should be a matrix, not a single value, and your compliance IT framework should encode the matrix in the archive configuration, not in a procedure document that nobody reads at retrieval time.

Mock Examination Test: 12 Questions Examiners Will Ask in 2026

Use this list inside a quarterly mock examination. Each question is one a state attorney general, a state banking department, or a federal prudential regulator can credibly submit during a 2026 examination cycle. If your application interface and supporting Microsoft 365 controls cannot produce the answer inside one business day, address the gap before the real request lands.

1. For the most recent 12-month period, produce a Loan Application Register sample with all HMDA fields populated, including geocoded property addresses, AUS used, denial reasons for denied applications, and a verification trail showing whether the data has been edited after applicant submission.
2. For three randomly selected denied consumer applications, produce the adverse action notice as sent, the data that supported the denial, the user who entered the data, and the timestamp at each stage.
3. Show the disparate-treatment fair-lending analysis your institution ran on residential mortgage applications by demographic category for the most recent 12-month period. Include the methodology, the input data, and the disposition of any pricing or denial-rate anomalies.
4. Produce the exception log showing every override of automated pricing or underwriting for the most recent quarter, broken down by loan officer and demographic category of the applicant.
5. For any consumer who received a prescreened solicitation in the last six months, demonstrate compliance with the Homebuyers Privacy Protection Act standard. Show express consumer authorization or an existing customer relationship that justified the solicitation.
6. Produce the Microsoft Entra ID Conditional Access policy set governing who can access the loan origination system, the deposit application portal, or the member loan application interface. Include the device-compliance posture required for access.
7. Produce the Microsoft Purview Audit retention configuration for the workloads handling consumer application data. Confirm the retention period meets the longest applicable regulatory window for the data type.
8. For a randomly selected closed loan, retrieve the TRID Closing Disclosure from your archive. Confirm the timestamp of generation, the version control of the document, and the retention period configured.
9. Produce evidence of the BSA Customer Identification Program data captured for the most recent 100 account openings, including verification documents and screening evidence.
10. For the most recent annual cybersecurity review, produce the audit report, the management response, and the remediation timeline for any identified gaps. California-domiciled institutions above the revenue threshold should additionally show progress toward their annual cybersecurity audit certification.
11. For any automated decision-making technology that affects California consumers, produce the disclosure provided to consumers, the methodology summary, and the consumer opt-out path.
12. Produce the September 2024 release of the FFIEC Operational Resilience Booklet self-assessment for your institution, with named owners for each control objective and the most recent test result.

If three or more questions on this list would take more than one business day to answer, your application interface and supporting Microsoft 365 environment are not yet examination-ready for 2026. The remediation is rarely a new product purchase. The remediation is configuration, retention, and audit-trail discipline that ABT and most other Microsoft Tier 1 Cloud Solution Providers can complete inside a 90-day engagement.

Frequently Asked Questions

Justin Kirsch

CEO, Access Business Technologies

Justin Kirsch has guided Microsoft licensing and compliance strategy for credit unions, banks, and mortgage companies since 1999. As CEO of Access Business Technologies, the largest Tier-1 Microsoft Cloud Solution Provider dedicated to financial services, he helps more than 750 financial institutions capture examination-ready lending data and meet fair-lending requirements across their Microsoft 365 environments.