Three Compliance Holes Still Costing Lenders

What are the primary compliance risks for mortgage lenders six months after the enactment of the federal trigger-leads ban? Six months following the implementation of the Homebuyers Privacy Protection Act, underprepared lenders face severe financial exposure within three distinct compliance holes: misjudging the narrow scope of the “existing relationship” exception, failing to account for stricter state-level overlays, and operating under outdated third-party lead-vendor contracts. To mitigate these regulatory and class-action risks, institutions must proactively formalize their compliance definitions, audit vendor agreements, and implement rigorous state-by-state mapping. Failing to address these vulnerabilities leaves non-bank lenders highly exposed, especially since the “existing relationship” exception has become a competitive weapon for depositories looking to dominate the market.

Hole 1: The “existing relationship” scope problem

The statute permits trigger-lead use where the creditor has an established financial relationship with the consumer. “Established financial relationship” is not as broad as many lenders assume. A prior loan inquiry is not an established financial relationship. A consumer who once received a rate quote is not in an established financial relationship. A consumer whose account is held by an affiliate may or may not be, depending on the structure of the affiliation.

Lenders that have not carefully defined the scope of “established financial relationship” in their compliance policies are making outreach calls that are technically prohibited. The cost is not visible until a state AG, a class-action plaintiff, or a competitor’s counsel notices.

Hole 2: The state-overlay problem

The federal trigger-leads ban establishes a national floor. It does not preempt state laws that go further. Several states — Rhode Island, Connecticut, Kansas, Kentucky, Maine, Texas, Utah, Wisconsin, Idaho, and Arkansas — had already enacted their own trigger-lead restrictions before the federal law took effect. Most of those state laws remain in force. Some impose stricter consent requirements. Some define “existing relationship” more narrowly than the federal statute. Some impose disclosure obligations the federal statute does not.

Lenders operating in multiple states should not assume federal compliance is state compliance. The penalty regimes differ. The private rights of action differ. The defenses available to lenders differ.

Hole 3: The lead-vendor problem

Most lenders did not generate trigger leads themselves. They bought them from third-party lead aggregators. The federal statute restricts the consumer reporting agencies, not the aggregators directly. But aggregators that continue to sell trigger leads to non-qualifying buyers are creating both direct and indirect liability — direct for the aggregator, indirect for any lender that accepts the leads with reason to know they were furnished in violation of the statute.

Lender contracts with lead aggregators should now contain explicit compliance representations, indemnification provisions, and audit rights specific to the trigger-leads ban. Most pre-2026 lead vendor agreements do not.

What sophisticated lenders are doing

In our practice, the lenders that have come out ahead of the trigger-leads ban have taken four steps. First, they have updated their consumer-direct marketing policies to define “established financial relationship” in writing, with examples. Second, they have mapped the federal statute against the trigger-lead overlays in every state in which they originate. Third, they have renegotiated lead vendor agreements to add compliance reps, audit rights, and indemnification. Fourth, they have trained their consumer-direct teams on what outreach is permitted and what is not, with documented sign-off.

The depository institutions and large mortgage servicers who already had existing relationships with consumers are, on net, the winners under the new statute. They can continue to market to their existing book. The non-bank direct-to-consumer lenders that relied on trigger leads for 10 to 30 percent of their pipeline are the losers, and they are now competing for a smaller pool of consumer attention at materially higher acquisition cost.

The window is open

Six months in, the first wave of enforcement has not yet hit. The class-action bar is watching. The state AGs are watching. The CFPB, under interim leadership, is less of an enforcement risk than it was a year ago — but the state AGs and the private rights of action under FCRA do not depend on the CFPB.

Lenders that close their three holes now are setting themselves up for two and three years of clean operation. Lenders that wait for an enforcement letter to start the conversation will pay materially more.

Goldsmith Associates represents depository institutions, non-bank lenders, fund managers, loan servicers, and broker-dealers in connection with the purchase, sale, servicing, and financing of whole loans and mortgage servicing rights. If you are facing any of the issues raised in this article, or if you are pricing a trade, negotiating a purchase agreement, defending a repurchase demand, or working through a counterparty event, we are on call and at the ready 24/7. Call 844-4-GOLDSMITH, email info@goldsmithpllc.com, or visit goldsmithpllc.com.