HMDA Data Review Reminders
Written by: Jean Comeau
As we quickly approach year-end (yes, I said it), lenders continue to review their current HMDA data, but what often gets missed, is making sure lenders are reporting all HMDA reportable loans and excluding all non-reportable loans by performing some validation steps as outlined below:
Are you comparing your LAR to your closed loan and non-originated reports?
Did any loans get withdrawn or become non-originated in one month and were re-activated in another causing either duplicate reporting or an inaccurate Action Taken Code or Action Taken Date?
Are you running a report out of your Core and comparing it to the LAR?
Have you reviewed all of your commercial loans to make sure they are being reported or excluded, as applicable?
Due to the current rate environment this past year, has your Home Equity product(s) volume increased and have you made sure to validate the loan purpose? This field is often one where the highest error rates can occur.
Type of Purchaser Code
Another area to consider is the reporting of Type of Purchaser as this code is a fluid code and can change throughout the reporting year. A loan that was not sold in Q2, could then be sold in Q4 for example. Once all your HMDA reportable loans are identified and your LAR is all set, make sure to perform a last validation of this code to make sure you have accounted for any last-minute sales that may have occurred by year-end.
Home mortgage disclosure reporting requirements (HMDA) | Consumer Financial Protection Bureau
AI Readiness Review Week 4
Written by: Rob Ellis, Senior Compliance Consultant, CRA & Fair Lending Specialist
Generative AI Is Already in Your Shop
Generative AI is the category that moved fastest and got governed least.
Large language models, chatbots, content generators, agentic tools that can take actions with limited human direction — these are no longer experimental. Staff are using them. Sometimes with approval. Often without.
Examiners ask whether the institution uses generative AI or similar tools, and the follow-up questions get specific fast: what data goes in, who reviews what comes out, what happens when the output is wrong, and whether anyone can stop the tool when it acts on its own.
The risks have names now — hallucination, prompt injection, data exposure. A model that invents a borrower detail in a drafted notice is not a minor inconvenience. It is a consumer-protection event with a paper trail.
The institutions that are ahead are not the ones that banned these tools. They are the ones that decided deliberately: which tools are approved, what data is allowed, who checks the output, and what the kill switch looks like.
Most shops have none of that. They have a tool someone found useful and a policy that predates it.
If generative AI is in use at your institution and you cannot describe the controls around it, that is not a technology problem. It is a governance gap — and it is the kind that shows up in an exam before it shows up anywhere else.
Not All AI Deserves the Same Attention
A chatbot answering FAQs and a model influencing credit decisions are not the same risk. Examiners know it. Most institutions have not acted on it.
The question examiners ask is whether the institution differentiates its AI use cases based on risk, impact, or required level of review. In plain terms: do you treat the high-stakes uses differently from the low-stakes ones?
The answer for most shops is no — because they have not tiered anything. Everything gets the same attention, which means the things that matter get the same attention as the things that do not. That is not governance. That is hope.
Risk-tiering is not about building a bureaucracy. It is about knowing which uses need a human in the loop, which need validation, which need board visibility, and which can run with lighter oversight. It is the difference between a program and a pile.
The institutions that get this right spend their limited compliance resources where the exposure actually is. The ones that do not find out during an exam which uses should have had more eyes on them.
If you cannot rank your AI uses from highest to lowest risk, you are managing by assumption — and assumptions are exactly what examiners are trained to test. Reach out to us today!
