This note covers the smaller federal laws that still produce several test questions: FCRA, GLBA privacy and safeguards, BSA/AML and SARs, telemarketing and Do-Not-Call, the MAP rule, the Homeowners Protection Act, E-SIGN, and which agency enforces what.
Federal mortgage-related laws·5 min read·9 sections
★
Must-know for the exam
✓FCRA: pull credit only with a permissible purpose, such as an application the consumer starts (15 U.S.C. 1681b).
✓Mortgage applicants get their credit score and the Notice to the Home Loan Applicant (15 U.S.C. 1681g(g)).
✓GLBA: consumers apply; customers have an ongoing relationship; customers get a privacy notice when the relationship starts (12 CFR 1016.3-1016.4).
✓Opt-out is required before sharing NPI with nonaffiliated third parties outside exceptions; 30 days is a reasonable opt-out window (12 CFR 1016.10).
✓Non-bank lenders need a written information security program under the FTC Safeguards Rule (16 CFR 314).
✓SARs: $5,000 or more, filed with FinCEN within 30 days of detection (60 if no suspect), kept 5 years, never disclosed (31 CFR 1029.320).
✓Telemarketing: 8 a.m. to 9 p.m. local time; scrub against the registry at least every 31 days (16 CFR 310.4).
✓Established business relationship: 18 months after a transaction, 3 months after an inquiry or application (16 CFR 310.2(q)).
✓HPA: borrower may cancel PMI at 80% of original value; automatic termination at 78% (12 U.S.C. 4902).
▸On this page · 9 sections
⚠
Traps that cost marks
→Treating a past rate inquiry as permission to pull credit.
→Thinking the lender must attach the credit report to the denial notice.
→Thinking credit score disclosure is owed only on denials.
→Treating a fraud alert as an automatic denial or as something to ignore.
→Thinking the Red Flags Rule mandates a specific check rather than a written program.
→Treating every applicant as a customer.
→Delaying the initial notice until after closing.
→Thinking annual privacy notices are always required, or never required.
Why it matters on the test
These laws show up as one or two questions each, usually as scenarios: a credit pull without an application, a mailer that looks like a government notice, a call to a number on the Do-Not-Call list, or a borrower asking whether a SAR was filed.
The rule: credit reports (FCRA, Regulation V)
•A consumer report may be used only for a permissible purpose, such as a credit transaction the consumer initiates (15 U.S.C. 1681b(a)(3)(A)).
•Adverse action based on a report requires a notice with the score used, key factors, the bureau's contact details and the right to a free report within 60 days (15 U.S.C. 1681m).
•Mortgage lenders must give every applicant whose score they use the score and the 'Notice to the Home Loan Applicant' (15 U.S.C. 1681g(g)).
•An initial fraud alert lasts one year; the lender must take reasonable steps to verify identity before extending credit (15 U.S.C. 1681c-1).
•The Red Flags Rule requires a written identity theft prevention program (16 CFR 681.1 for FTC-supervised lenders).
•Mortgage 'trigger leads' are restricted from March 5, 2026 by the Homebuyers Privacy Protection Act, unless the consumer opted in or has an existing relationship with the requester.
Premium
Every note. Every question. One pass.
7 more sections of this note are part of Premium.
Every section of every study note
1,400+ original questions across every outline topic
