FAQs – Compliance

Under CFPB Regulation Z (TILA), mortgage advertising on social media must include accurate Annual Percentage Rate (APR) disclosures whenever a specific interest rate is stated, required payment disclosures when payment amounts are mentioned, and clear identification of the lender’s NMLS ID. The CFPB’s UDAAP authority also prohibits deceptive, unfair, or abusive representations about mortgage products on any channel — including social media. The CFPB regularly includes social media review in mortgage examinations and has issued consent orders against lenders for advertising violations originating on social media.

FINRA Rule 17a-4 requires broker-dealers to preserve all business-related electronic communications — including social media — for a minimum of three years, with the first two years in an accessible, searchable format. Records must be stored in a non-rewriteable, non-erasable format and be available for production during FINRA examinations. This rule applies to any social media communication related to the firm’s business, including posts by registered representatives on personal accounts. SocialShield^® is designed to meet FINRA 17a-4 archiving requirements.

UDAAP stands for Unfair, Deceptive, or Abusive Acts or Practices — a broad enforcement standard the CFPB applies to all consumer-facing communications, including social media. A mortgage social media post can violate UDAAP if it omits material information a consumer would need to make an informed decision, creates a misleading impression about rates or fees, uses pressure tactics, or makes claims that are technically true but practically deceptive. UDAAP violations discovered on social media have resulted in CFPB consent orders and multi-million dollar penalties.

The Fair Housing Act (FHA) and Equal Credit Opportunity Act (ECOA) prohibit mortgage lenders from making statements that suggest a preference for or against any protected class — including race, color, national origin, sex, disability, familial status, or religion. On social media, this means loan officers must avoid language that could be interpreted as steering consumers toward or away from particular neighborhoods, products, or terms based on protected characteristics. The CFPB and HUD actively monitor social media for fair lending violations. SocialShield^® flags potentially discriminatory language in real time.

Preparing for a CFPB examination requires demonstrating that your institution has active, documented supervision of all consumer-facing communications — including social media, websites, and marketing content. Specifically, you should be able to produce: a written social media policy, evidence of ongoing monitoring, archives of employee social media activity, documentation of how violations were identified and remediated, and records of compliance training. ActiveComply automates the monitoring and archiving that generates this evidence, so firms are always in a state of exam readiness rather than scrambling when an exam is announced.

CFPB enforcement actions related to mortgage social media advertising can include civil money penalties ranging from thousands to millions of dollars, mandatory restitution to affected consumers, consent orders requiring ongoing compliance monitoring and reporting, restrictions on business activities, and significant reputational harm. Enforcement actions are published publicly on the CFPB’s website. Beyond financial penalties, a CFPB consent order requires years of enhanced compliance oversight that disrupts normal business operations and diverts significant management attention.

Mortgage compliance risk management is the process of identifying, assessing, monitoring, and mitigating the regulatory risks arising from a mortgage company’s operations — including how its loan officers communicate on social media, what its websites say, how it manages remote workers, and how it reviews marketing content. Effective compliance risk management requires both written policies and active, documented monitoring — the combination regulators look for during examinations. ActiveComply provides the monitoring and documentation layer that converts compliance policies into demonstrable compliance programs.

Mortgage companies use compliance audit software to systematically review their social media activity, website content, marketing materials, and employee communications for regulatory violations. ActiveComply provides purpose-built compliance audit capabilities across all four digital compliance vectors: SocialShield^® for social media, WebCompass^® for websites, TrustFrame™ for marketing content, and VirtualVerify^® for remote workspaces and events. The platform generates exam-ready audit reports that can be produced during regulatory examinations.

Audit-ready social media records means your institution can immediately produce complete, unaltered archives of employee social media activity — posts, comments, profile changes, images, and video content — in response to a regulatory request. Records must be tamper-evident (demonstrating they have not been altered), complete (covering all platforms and accounts), organized (searchable by employee, date, and platform), and formatted for production (in a format regulators can review). SocialShield^® automatically generates audit-ready records that meet these standards.

Digital marketing compliance for financial services is the discipline of ensuring that all digital marketing activities — social media posts, website content, email campaigns, paid advertising, and video content — comply with applicable regulations including CFPB rules, FINRA requirements, fair lending laws, state licensing regulations, and internal policies. Financial services firms face heightened digital marketing compliance obligations because regulators treat digital communications with the same seriousness as print advertising. ActiveComply automates digital marketing compliance monitoring across social media, websites, and marketing content review.

Independent mortgage banks need compliance software that addresses their specific regulatory exposure: CFPB supervision of mortgage advertising, state regulator oversight of LO social media and websites, NMLS licensing compliance, and fair lending monitoring across a distributed sales force. ActiveComply is purpose-built for IMBs — particularly those with 15 to 150 loan officers — because its NMLS-native LO discovery eliminates the manual setup that makes other tools unworkable at IMB scale. The all-in-one platform covers social media, websites, remote workspaces, and marketing content in a single system.

Managing compliance across multiple states is one of the most significant challenges for growing IMBs. Each state has its own licensing disclosure requirements, social media guidance, and advertising rules — and the patchwork of state-specific obligations is difficult to track manually. ActiveComply monitors compliance against both federal requirements (CFPB, FINRA, HUD/FHA) and state-specific rules, with particular depth in high-enforcement states including California, Texas, Florida, New York, and Washington. WebCompass^® tracks state licensing disclosures on websites, while SocialShield^® flags state-specific advertising violations.

Distributed mortgage teams — where loan officers work across multiple locations, states, and home offices — create compliance supervision challenges that centralized firms don’t face. ActiveComply is specifically designed for distributed teams: SocialShield^® scales to monitor any number of LO profiles without proportionally increasing compliance staff, VirtualVerify^® inspects remote workspaces without requiring travel, and WebCompass^® discovers and monitors LO websites across every location. The platform’s NMLS-native discovery means new LOs are automatically added to monitoring as they are licensed.

The best mortgage compliance management platform for a growing IMB combines automated LO discovery, continuous social media monitoring, website compliance scanning, and marketing content review in a single system that scales without adding compliance headcount. ActiveComply meets all of these criteria and adds a critical advantage for IMBs: its NMLS Consumer Access™ integration automatically identifies and monitors every licensed LO, eliminating the administrative burden of maintaining monitoring lists as the organization grows.

Yes. ActiveComply serves broker-dealers and addresses their FINRA-specific compliance obligations. SocialShield^® archives all monitored social media communications in FINRA Rule 17a-4 compliant formats, supports the supervision and review workflows that FINRA requires for registered representatives’ social media activity, and provides the audit trail documentation that FINRA examiners request. ActiveComply is also an official LinkedIn compliance partner — a critical advantage for broker-dealers where LinkedIn is the primary business development platform.

ActiveComply serves wealth management firms and registered investment advisors (RIAs) through its partnership with ACA Group, a leading GRC solutions provider for the global wealth management industry. For wealth management firms, SocialShield^® addresses FINRA recordkeeping requirements, SEC marketing rule compliance for investment advisors, and FINRA Rule 4511 electronic recordkeeping obligations. The platform monitors all social media platforms where advisors maintain a presence and archives communications in formats compliant with both SEC and FINRA examination requirements.

Mortgage social media posts require several disclosures depending on content type. All posts by licensed loan officers should include the LO’s NMLS ID number. Any post mentioning a specific interest rate must include the APR. Posts mentioning specific payment amounts require additional Regulation Z disclosures. Posts that constitute general mortgage advertising should include the Equal Housing Lender statement. Posts on behalf of the company should display the company NMLS ID. Missing any of these required disclosures is a regulatory violation that can be identified during a CFPB or state regulator examination.

A missing NMLS ID number on a loan officer’s social media profile or posts is one of the most frequently cited compliance violations in mortgage examinations. The consequence can range from a written supervisory finding that must be corrected and documented, to civil money penalties in cases where the violation is systemic or repeated. The firm — not just the LO — is held responsible for the failure to supervise. SocialShield^® continuously scans all monitored LO profiles and posts for missing NMLS disclosures and alerts compliance teams immediately when violations are detected.

Yes. Posting a specific interest rate on social media without the required APR disclosure is a Regulation Z violation — the most common compliance violation found in CFPB mortgage examinations. Rate teaser posts — ‘Get a 6.5% rate today!’ — that omit the APR, loan terms, or other required disclosures violate CFPB advertising rules regardless of the platform. SocialShield^® flags all rate-related social media posts in real time, allowing compliance teams to contact the LO for correction before the post is seen by regulators or consumers.

A CFPB consent order for mortgage advertising violations requires the company to immediately cease the violating practices, pay civil money penalties, implement a remediation plan for affected consumers, and operate under enhanced CFPB supervision for a defined period — typically two to five years. During the supervisory period, the company must submit regular compliance reports, maintain documented monitoring programs, and cooperate with CFPB oversight. Consent orders are public records that damage the company’s reputation with consumers, regulators, and business partners.

Yes. Mortgage companies face significant ADA Title III litigation risk for inaccessible websites. Serial plaintiffs and their attorneys actively scan financial institution websites for ADA accessibility failures and file lawsuits demanding remediation and damages. Courts have consistently found that financial institution websites are places of public accommodation subject to ADA requirements. Defense costs alone can reach six figures even when cases are resolved without trial. WebCompass^® identifies ADA accessibility violations across all monitored websites so firms can remediate them before becoming litigation targets.

The most common Instagram compliance violations by loan officers include: missing NMLS ID numbers in the profile bio or post captions, rate advertisements without APR disclosures, promotional claims about loan products that omit required disclosures, use of the company name or logo without authorization, and fair lending-sensitive language in captions or comments. Instagram is particularly high-risk because its visual format encourages LOs to post attractive rate graphics that rarely include the required disclosure text. SocialShield^® monitors all Instagram content, including image-based posts, using OCR scanning.