The federal posture toward mortgage oversight changed sharply over 2025, and a mortgage banking audit is now the most reliable way for lenders and servicers to prove their controls hold up under a patchwork of state regulators. As the Consumer Financial Protection Bureau scaled back enforcement, attorneys general and state financial supervisors moved into the gap. For mortgage banking executives, that means compliance risk did not disappear: it multiplied across jurisdictions, each with its own rules and its own willingness to litigate.
The practical takeaway is that a single federal examiner is no longer the primary audience for your control environment. You now answer to many regulators, each with its own statute, fine schedule, and appetite for litigation. Treating compliance as a multistate discipline, backed by independent control reviews, is how mortgage banks stay defensible in 2026.
Quick answer: The CFPB sharply reduced enforcement in 2025, dismissing cases, ending consent orders early, and narrowing fair-lending theories. State attorneys general and financial regulators, including those in New York, Illinois, California, Connecticut, New Jersey, and Ohio, are filling that void with new laws and active enforcement. Mortgage banks should respond by strengthening multistate compliance programs and commissioning independent control reviews and a mortgage banking audit, because state-level exposure has replaced, not removed, federal risk.
What Actually Changed at the CFPB
The shift began at the top. In early 2025, CFPB leadership changed and the agency froze much of its operational activity, including enforcement and rulemaking, before resuming a far narrower program. The result was a measurable collapse in output rather than a brief pause, and lenders felt the change in the kinds of cases the agency was willing to bring.
The agency dismissed or wound down a series of pending cases and allowed mortgage-related consent orders to expire ahead of schedule. It also signaled a retreat from disparate-impact theories under the Equal Credit Opportunity Act, redirecting fair-lending attention toward intentional discrimination with identified victims. That is a meaningful narrowing of how federal fair-lending law is enforced against lenders, and it changes the calculus for any institution that built its program around federal disparate-impact risk.
It is worth being precise about what did not happen. The CFPB did not shut down, and its enforcement actions docket still shows filings during 2025, including matters as late as that August. The accurate description is a steep reduction in volume and ambition, not a complete halt, which is why some lenders misread the moment as an all-clear.
That misreading is the trap. A quiet federal regulator does not lower your legal exposure when the same conduct violates state consumer-protection statutes that carry their own penalties and private rights of action. The risk simply migrated to a more decentralized set of enforcers who know your conduct just as well.
Why Are States Ramping Up Mortgage Oversight?
The states moved quickly, and they moved with statute and litigation rather than rhetoric. National Mortgage News documented a coordinated state response across both parties and several regions, summarized in its reporting on how states ramp up oversight as the CFPB retreats. The reporting frames much of this as state supervisors preparing to address gaps left by federal retrenchment.
A few examples show the breadth of activity:
- New York advanced the FAIR Business Practices Act in March 2025, which broadens the state statute to reach unfair acts and not only deceptive ones, and the attorney general’s office hired the CFPB’s former deputy enforcement director.
- Illinois introduced a Consumer Financial Protection Law shortly after the change in federal administration, building state-level authority that mirrors federal coverage.
- California, through its Department of Financial Protection and Innovation, has been active on servicing relief and multistate consent orders, and the state passed a law targeting zombie mortgage foreclosures.
- Connecticut passed comparable legislation curbing zombie foreclosures, while New Jersey is weighing a Community Reinvestment Act bill covering nonbank lenders.
- Ohio‘s attorney general sued one of the industry’s largest lenders over alleged predatory practices, a reminder that enforcement appetite is not confined to one political party.
The strategic point for mortgage banks is that these regimes do not move in unison. A practice that draws no attention in one state can trigger an investigation, a fine, or a private suit in another, and a multistate lender is exposed to the strictest interpretation in its footprint. That asymmetry is what makes a uniform, defensible control environment so valuable.
It is also worth noting that state activity is not a single partisan story. The National Mortgage News reporting describes both Democratic-led and Republican-led states stepping forward, with the Ohio attorney general’s suit against a major lender standing out as a Republican-led enforcement action rather than a blue-state one. That breadth matters because it removes the comfort of assuming that a lender’s political read of a state predicts its enforcement posture. The safer planning assumption is that any state in your footprint may act, and that the timing and theory will not be coordinated with the others.
Why Does Multistate Compliance Now Drive the Audit?
When oversight was federally centered, many lenders ran compliance to a single playbook keyed to CFPB examination priorities. That model is now insufficient because the controlling standard varies by state and, in some cases, has grown more stringent than the federal baseline the CFPB has stepped away from. A program calibrated only to federal priorities can leave material gaps in states that went further.
Multistate compliance starts with an honest map of your licensing footprint against the statutes that apply in each jurisdiction. Fair-lending obligations, fee and disclosure rules, servicing requirements, and foreclosure protections all differ, and several states retained or expanded disparate-impact exposure even as the federal agency moved away from it. The compliance question is no longer “does this satisfy the CFPB” but “does this satisfy every state where we lend and service.”
Independent verification is what turns that map into something defensible. A mortgage banking audit tests whether documented controls actually operate as designed across origination, servicing, and complaint handling, and whether evidence exists to demonstrate compliance to a state examiner who arrives with a different framework than the one you prepared for. Firms with deep mortgage banking experience understand both the financial reporting and the regulatory control expectations that state supervisors scrutinize.
The reviews most worth running now are control-focused rather than purely financial. Structured risk advisory services can stress-test fair-lending controls, vendor oversight, complaint management, and the servicing functions that have drawn the most state attention. The goal is to find and fix gaps internally before a state regulator finds them for you, when the cost of remediation is far lower and the narrative is still yours to write.
A Practical 2026 Compliance Checklist
You do not need to rebuild everything at once. A focused sequence covers the highest-exposure areas first and produces evidence you can show a regulator. Sequencing the work this way also lets leadership demonstrate steady, documented progress rather than a single rushed effort.
- Re-map your footprint. Confirm every state where you originate or service, and pair each with its current consumer-protection statute and any 2025 amendments.
- Reassess fair lending. Where states retained disparate-impact exposure, keep statistical monitoring in place even though the CFPB narrowed its own theory.
- Tighten servicing and foreclosure controls. Zombie-foreclosure and loss-mitigation rules vary and are an active state enforcement target.
- Strengthen complaint handling. State attorneys general often build cases from consumer complaint patterns, so capture, route, and resolution data should be clean and auditable.
- Commission an independent control review. An external mortgage banking audit gives the board and regulators objective assurance that controls operate, not just that they exist on paper.
Running this sequence annually, and refreshing the state-statute map whenever legislatures act, keeps the program current as the regulatory map keeps shifting. Building the calendar around legislative sessions, rather than around a single federal examination cycle, reflects where the real exposure now sits.
Frequently Asked Questions
Did the CFPB stop enforcing mortgage rules in 2025?
No. The CFPB sharply reduced enforcement volume, dismissed cases, and allowed some consent orders to lapse early, but its enforcement docket still showed new filings during 2025. The accurate read is a steep pullback in activity and a narrowing of legal theories, not a complete withdrawal from the field.
Why does a mortgage banking audit matter more now?
Because the binding standard has fragmented across states, each with its own statutes, penalties, and enforcement appetite. An independent mortgage banking audit verifies that your controls operate consistently across every jurisdiction in your footprint and produces evidence you can present to a state examiner, which is harder to assemble after an investigation has already opened.
Which states are most active on mortgage oversight?
Reporting identifies New York, Illinois, California, Connecticut, New Jersey, and Ohio among the states that introduced new laws, expanded statutes, or filed suits in 2025. Activity spans both political parties and multiple regions, so a multistate lender should not assume any single jurisdiction is low risk.
Should we still monitor for disparate impact if the CFPB stepped back?
Yes. Several states retained or expanded disparate-impact exposure under their own fair-lending and consumer-protection laws even as the federal agency narrowed its approach. Continuing statistical monitoring protects you against state enforcement and private litigation that federal retrenchment does not touch.
