Compliance Guide — TRID, ECOA, and Oregon Requirements

This guide covers the compliance rules every CMS loan originator must understand before taking their first application. Compliance errors don't just kill individual loans — they trigger regulatory audits, license actions, and civil liability. The rules here are not suggestions. They are federal and Oregon law. When you encounter a situation this guide doesn't cover, stop and call your Compliance Officer before proceeding.

Last updated: 2026-02-25 | Owner: Compliance Officer Note: Compliance rules are subject to regulatory updates. Confirm currency of any specific rule before relying on it in a transaction.

Section 1: TRID Timeline and Requirements#

What Is TRID?#

TRID (TILA-RESPA Integrated Disclosure Rule) is the regulatory framework, implemented by the Consumer Financial Protection Bureau (CFPB), that governs mortgage disclosure requirements for most residential loans. It combines the Truth in Lending Act (TILA) disclosures with the Real Estate Settlement Procedures Act (RESPA) Good Faith Estimate into two key documents: the Loan Estimate (LE) and the Closing Disclosure (CD).

TRID applies to most closed-end consumer mortgages secured by real property — including purchase loans, refinances, construction-permanent loans, and lot loans. It does not apply to: home equity lines of credit (HELOCs), reverse mortgages, mortgages secured by mobile homes, and certain no-interest second liens from housing assistance programs.

1.1 TRID Timeline — Visual Reference#

APPLICATION RECEIVED
(All 6 elements present)
         │
         ▼
    ┌─────────────────────────────────────────────────────┐
    │  LOAN ESTIMATE must be DELIVERED                    │
    │  within 3 BUSINESS DAYS of application             │
    │  (Business day = any day except Sunday + holidays) │
    └─────────────────────────────────────────────────────┘
         │
         │   [Processing, Underwriting, Condition Clearing]
         │
         ▼
    CLEAR TO CLOSE
         │
         ▼
    ┌─────────────────────────────────────────────────────┐
    │  CLOSING DISCLOSURE must be RECEIVED                │
    │  at least 3 BUSINESS DAYS before CONSUMMATION      │
    │  (Business day = any day except Sunday + holidays) │
    │  SATURDAYS COUNT for CD waiting period             │
    └─────────────────────────────────────────────────────┘
         │
         ▼
    CLOSING / CONSUMMATION
         │
         ▼
    [3 Business Day Rescission Period — Primary Residence Refis Only]
         │
         ▼
    FUNDING

1.2 The Loan Estimate (LE)#

Trigger: A "completed application" containing these six elements:

1. Borrower name
2. Borrower income
3. Borrower Social Security number (for credit pull)
4. Property address
5. Estimated property value
6. Loan amount sought

Timing: Must be delivered to the borrower within 3 business days of receiving all six elements. For the LE, business days include all calendar days except Sundays and federal public holidays.

Delivery standards: CMS is a mortgage broker — the wholesale lender issues and delivers the LE. The LO is responsible for ensuring the lender delivers on time and tracking receipt confirmation. The following timing rules apply regardless of who executes delivery:

• Electronic delivery (lender portal / email with consent): Deemed received on the day of delivery + 3 days if no acknowledgment. Confirm receipt with borrower and log in Arive.
• U.S. Mail: Add 3 days to the delivery assumption (effectively 6 days from mailing)
• Hand delivery: Deemed received same day

Waiting period: The borrower has 3 business days to review the LE before you can collect any fee other than a bona fide credit report fee. Do not collect application fees, appraisal fees, or any other fee during the LE waiting period.

Intent to proceed: The borrower must indicate intent to proceed before you can charge fees or take further action. Arive tracks this electronically. Document it.

Loan Estimate content requirements:

• Loan terms (amount, interest rate, product type, term)
• Whether rate can increase after closing
• Monthly payment (principal, interest, mortgage insurance, estimated escrow)
• Itemized projected closing costs (origination charges, services you can shop for, services you cannot shop for, prepaid items, initial escrow)
• Cash to close estimate
• Comparisons: APR, Total Interest Percentage (TIP), Interest Amount in 5 Years
• Contact information for LO, mortgage broker, lender

1.3 The Closing Disclosure (CD)#

Timing: Must be received by the borrower at least 3 business days before consummation. The wholesale lender issues the CD — the LO's job is to ensure the lender issues it on time, confirm borrower receipt, and monitor the waiting period.

For the CD, "business day" means all calendar days except Sundays and federal public holidays. Saturdays are business days for CD purposes.

CD delivery examples:

Example: Closing on Friday March 14 → CD must be received by borrower no later than Tuesday March 11.

CD vs. LE comparison: The CD must be compared to the LE for tolerance compliance. See Section 1.4 below.

Changes that restart the 3-day CD waiting period:

1. APR increases more than 1/8% (fixed) or 1/4% (adjustable) above the disclosed APR
2. Loan product changes (fixed → adjustable or vice versa)
3. Prepayment penalty added when none was previously disclosed

Changes that do NOT restart the waiting period:

• Reduction in closing costs
• Decrease in APR
• Minor per diem adjustments from closing date changes

1.4 Tolerance Buckets — What Can Change, What Can't#

TRID establishes three tolerance categories that compare charges on the CD to the LE.

Zero Tolerance (Cannot increase at all)

These charges on the CD cannot exceed what was disclosed on the LE:

• Origination charges (points, origination fees, underwriting fee)
• Transfer taxes (in jurisdictions where amount is determinable)
• Fees for required third-party services where the borrower was not permitted to shop

If a zero-tolerance charge increases: The lender/broker must issue a "cure" — refunding the excess to the borrower within 60 calendar days of consummation.

10% Aggregate Tolerance

The sum of these charges cannot increase by more than 10% from LE to CD:

• Recording fees
• Fees for third-party services where the borrower was allowed to shop AND used a provider from the written list of service providers

No Tolerance (Can change without limit)

• Prepaid interest (per diem adjustments)
• Property insurance premiums (borrower's choice)
• Amounts placed in escrow
• Fees for third-party services where the borrower shopped and chose a provider NOT on the list

1.5 What Triggers a Re-Disclosure (Revised LE)#

A Revised LE is required when a "valid changed circumstance" occurs. Revised LEs must be delivered within 3 business days of the changed circumstance.

Valid changed circumstances that justify revised LE:

• Borrower-requested loan program or loan amount change
• Appraisal value comes in different than estimated (when using estimated value on initial LE)
• New information discovered about the borrower or property not known at application
• Natural disaster affecting the property
• Lender identifies information that inaccurately reflected on the original LE

What is NOT a valid changed circumstance:

• The LO underestimated costs at time of initial LE
• Market conditions changed
• Lender found a better rate elsewhere
• Changed business relationships with vendors

Critical rule: You cannot use a revised LE to "reset" tolerances on charges you knew about at application. If you disclosed a $500 origination fee and later want to charge $800, that is a TRID violation unless a valid changed circumstance supports the revision.

1.6 Common TRID Violations and How to Avoid Them#

Section 2: ECOA and Fair Lending#

What Is ECOA?#

The Equal Credit Opportunity Act (ECOA), implemented by Regulation B, prohibits discrimination in any aspect of a credit transaction based on: race, color, religion, national origin, sex, marital status, age (provided the applicant has capacity to enter a contract), receipt of income from any public assistance program, or exercise of any right under the Consumer Credit Protection Act.

This covers the entire transaction: taking applications, evaluating creditworthiness, setting loan terms, approving or denying credit, and post-closing servicing.

2.1 Adverse Action Notices — The 30-Day Rule#

When an adverse action is required:

• Denial of credit
• Withdrawal of an approved application by the creditor
• Termination of an account or an unfavorable change in loan terms that doesn't apply to all similarly-situated applicants
• Failure to grant credit substantially in the amount or on the terms requested

Timing requirements:

• Complete application: Notify within 30 calendar days of receiving a completed application
• Counteroffer: If you make a counteroffer and the applicant does not accept it within 90 days, you must send adverse action notice
• Incomplete application: Within 30 days of determining the application is incomplete (with notice to complete), if the applicant doesn't respond

What an adverse action notice must contain:

1. Statement of action taken (denied, approved at different terms, etc.)
2. Name and address of creditor
3. ECOA statement (your rights under ECOA)
4. Either: specific reasons for adverse action OR disclosure of borrower's right to request specific reasons within 60 days
5. Name, address, and phone number of consumer reporting agency if the decision was based in whole or in part on credit report information
6. FCRA notice (right to free copy of credit report, right to dispute inaccurate information)

CMS policy: Always provide specific reasons, not just "creditworthiness." Specific reasons = documented, non-discriminatory, guidelines-based. "Credit score below minimum" is specific. "Unable to meet our standards" is not.

Arive: The adverse action notice is generated in Arive. Do not create your own. Ensure the correct denial reason codes are selected.

2.2 Fair Lending Red Flags — LOs Must Avoid#

Disparate treatment is treating applicants differently based on a protected class. It can be intentional or unintentional. Both are violations.

Red flag behaviors to avoid:

Questions you CAN ask: Income, employment, assets, debts, property information, credit history, occupancy intent, loan purpose. Everything that is guidelines-relevant.

Questions requiring care:

• Marital status: Permissible for secured transactions (Oregon is not a community property state, but secured transaction exception applies)
• Number of dependents: Permissible (relevant to qualifying debt ratios in some programs)
• Age: Permissible, but cannot be used to deny credit to someone who has legal capacity to enter a contract

Questions you CANNOT use as a basis for credit decisions:

• Race, color, ethnicity
• Religion
• National origin
• Sex / gender identity (note: CFPB has taken the position that sex includes sexual orientation and gender identity)
• Receipt of public assistance (e.g., cannot deny because borrower receives SSI, disability, Section 8 voucher)

2.3 HMDA — What It Is and Why It Matters#

The Home Mortgage Disclosure Act (HMDA) requires most mortgage lenders to collect, record, and report data about their lending activity. This data is used by regulators to identify lending patterns and detect fair lending violations.

What CMS collects under HMDA:

• Applicant demographic information (race, ethnicity, sex) — collected but NOT used in credit decision
• Loan purpose, amount, property type, census tract
• Whether application was approved, denied, withdrawn, incomplete
• Rate spread information
• Action taken and date

Borrower's right to decline: Borrowers may decline to provide demographic information. If they decline, note "information not provided by applicant" on the 1003 and move on. This is their right. Do not push.

Arive handles HMDA data collection and LAR (Loan Application Register) entry. Ensure the data is entered accurately.

2.4 Oregon-Specific Fair Lending Requirements#

Oregon Revised Statutes 659A.421: Oregon prohibits discrimination in real estate-related transactions based on all federally protected classes PLUS: sexual orientation, gender identity (explicitly), and source of income (which may include housing assistance vouchers, disability payments, Social Security, and similar).

Source of income: Oregon law prohibits refusing to qualify or consider income from public assistance programs, disability benefits, Section 8/HCV vouchers, or other non-employment income sources that are otherwise qualifying income under lending guidelines. Document your income analysis clearly.

Oregon DFR (Division of Financial Regulation) has authority to investigate fair lending complaints. Consumer complaints can be filed at dfr.oregon.gov. If CMS receives a fair lending complaint from the DFR, contact the Compliance Officer immediately.

Section 3: Oregon-Specific Requirements#

3.1 Oregon Mortgage Lending Act (OMLA)#

The Oregon Mortgage Lending Act (ORS Chapter 86A) governs mortgage banker and mortgage broker activity in Oregon. Key requirements for CMS:

Licensing:

• All CMS loan originators must be individually licensed under OMLA and maintain an active NMLS record
• NMLS license must reflect CMS as current employer/sponsor — update within 10 business days of hire under Oregon rules
• Oregon state license (MLO license) must be renewed annually by December 31 each year
• Continuing education: 10 hours annually — 8 hours federal continuing education (3 hours Federal law, 2 hours ethics, 2 hours non-traditional mortgage products, 1 hour elective) + 2 hours Oregon state-specific CE = 10 hours total annually

Company license: CMS holds an Oregon Mortgage Banker license. LOs operate under this license. Do not originate under any other company license while employed at CMS.

Advertising rules under OMLA:

• All advertising must include the CMS NMLS company number
• Individual LO NMLS number must appear on all individual marketing materials
• Cannot use terms like "pre-approved" in advertising if it implies guaranteed approval

3.2 Required Disclosures Under Oregon Law#

Oregon Mortgage Loan Originator Disclosure: At application, Oregon requires a written disclosure identifying the mortgage loan originator by name and NMLS number, and disclosing the LO's compensation arrangement. This is typically incorporated into Arive's disclosure package — verify it is included.

Fees: Under OMLA, any fee charged to a borrower must be disclosed in advance. No undisclosed fees. If a fee changes, re-disclose.

Oregon credit score disclosure (FCRA): When credit is pulled and used in a credit decision, Oregon consumers have the right to receive the credit score used, the range, and information about factors affecting the score. This is typically satisfied by the credit disclosure in the standard disclosure package. Verify Arive includes this.

3.3 Oregon Records Retention#

Under OMLA:

• Loan transaction records: Minimum 3 years from date of loan transaction
• Advertising materials: 2 years from last use
• Compliance records: 3 years minimum

Federal requirements (RESPA, TILA, HMDA) may impose longer retention periods in some cases. CMS policy: retain all loan records for 5 years from date of loan transaction to satisfy the most stringent applicable requirement.

Electronic retention: Oregon permits electronic retention of records if they are accessible, readable, and can be reproduced. Arive's cloud storage satisfies this for active files. Confirm with Operations Manager where closed files are archived.

3.4 Oregon DFR — Regulatory Relationship#

Oregon Division of Financial Regulation (DFR) regulates CMS and all individual LOs. The DFR:

• Conducts periodic examinations of licensees
• Investigates consumer complaints
• Has authority to impose fines, license suspension, and license revocation

If you receive contact from DFR:

• Do not respond independently
• Immediately notify the Compliance Officer and CMS leadership
• Do not destroy or alter any records

Annual DFR examination: CMS undergoes periodic DFR examination. Maintain all files in Arive in organized, accessible format. Examiners look specifically at disclosure timing, adverse action, and fair lending practices.

Consumer complaint process: Consumers can file complaints against CMS or individual LOs at dfr.oregon.gov. If a borrower indicates they plan to file a complaint, notify your Compliance Officer immediately. Document all interactions with that borrower thoroughly going forward.

Section 4: Privacy and Data Security#

4.1 What NPI Is and Why It Matters#

Non-Public Personal Information (NPI) under the Gramm-Leach-Bliley Act (GLBA) includes any personally identifiable financial information a consumer provides in the course of obtaining a mortgage:

• Name, address, date of birth, SSN
• Income, assets, account numbers
• Credit history and credit score
• Loan application data
• All documents provided in the loan process

Why it matters: GLBA and Oregon's Consumer Privacy laws impose legal obligations on how CMS collects, uses, and protects NPI. Violations can result in civil liability, regulatory sanctions, and reputational damage. Borrowers trust us with some of the most sensitive financial information in their lives.

4.2 How to Handle Borrower Documents Securely#

Do:

• Upload all documents to Arive immediately upon receipt — this is the secure system
• Use Arive's borrower portal for document requests and collection whenever possible
• Store any temporary local copies in a password-protected folder
• Delete local copies once uploaded to Arive and confirmed

Do not:

• Email sensitive documents (SSN, bank statements, tax returns) as unencrypted attachments — use Arive portal or a secure file transfer link
• Print borrower documents unnecessarily
• Leave printed documents on your desk, in your car, or in common areas
• Share login credentials to Arive or CMS systems with anyone
• Access loan files on public Wi-Fi without a VPN
• Store NPI on personal devices without encryption

If a security incident occurs (lost laptop, unauthorized access, breach of borrower data):

• Report immediately to IT and Operations Manager
• CMS is required to notify affected consumers and, in some cases, Oregon DFR under Oregon's data breach notification law (ORS 646A.604)
• Do not wait — timing matters under breach notification law

4.3 Email and Communication Standards#

Secure communication rules:

• Use your CMS email address (@cmsoregon.com) for all mortgage-related communications. Personal email for mortgage business is prohibited.
• Never email SSNs, account numbers, or other NPI in the body of an email unless the email system is encrypted end-to-end
• For document exchange: use Arive's borrower portal (preferred) or a CMS-approved secure file transfer service
• If a borrower insists on emailing sensitive documents, you may receive them — but immediately upload to Arive and acknowledge receipt, then advise the borrower of the secure portal for future submissions

Texting:

• Text may be used for non-sensitive communication: appointment reminders, "I sent you an email — please check Arive," scheduling
• Text is not appropriate for: sharing financial information, discussing loan specifics, sending document links (security risk)
• All material loan communications should be in a medium that creates a clear record — Arive notes, email, or documented phone calls

Phone calls:

• Log every significant phone call in Arive notes: date, time, what was discussed, any commitments made
• If you discuss loan terms, rates, or conditions on the phone, note it immediately after the call

4.4 CMS Information Security Policy — Reference#

CMS has adopted a complete GLBA-compliant Information Security Policy. The full policy is maintained at:

/docs/CMS-Information-Security-Policy.md

Every CMS employee is required to read this policy at hire and annually thereafter. Key areas covered:

• Physical security of workspaces
• Network and device security
• Password and access management
• Vendor management requirements
• Incident response procedures
• Employee training requirements

Annual security training: Required for all CMS employees handling NPI. Contact Operations Manager for training schedule.

Section 5: Compliance Self-Audit Checklist#

Use this checklist monthly to verify compliance on your active pipeline.

TRID Compliance Check#

• Every active file has a documented LE delivery date within 3 business days of application
• No fees collected before LE waiting period expired (except credit report fee)
• All intent-to-proceed confirmations documented
• All changed circumstances that triggered revised LEs documented with dates
• All CD deliveries confirmed with at least 3 business day buffer before closing
• CD tolerance comparison completed for all closed files this month

ECOA Compliance Check#

• All denied applications have adverse action notices issued within 30 days
• Adverse action notices include specific reasons and required agency disclosures
• No applications pending over 30 days without status notification to borrower
• HMDA demographic data collected for all applicable applications

Oregon-Specific Check#

• NMLS license current and employer sponsorship updated
• CE hours tracking current (annual requirement)
• All originated loan records retained in Arive for accessibility
• No undisclosed fees charged to any borrower

Privacy/Data Security Check#

• No NPI transmitted via unencrypted email
• All borrower documents uploaded to Arive and local copies deleted
• Arive password last changed within 90 days
• No CMS system accessed on unsecured network without VPN

This guide reflects rules in effect as of the last-updated date. Regulatory requirements change. When in doubt, contact the Compliance Officer. "I didn't know" is not a defense in a regulatory examination.