Mortgage Compliance & QC Software

Buy for the finding you never get

Compliance software earns its budget by preventing one specific finding, not by moving loans faster. That is why we weight functionality and depth highest in this category and cut production impact to our lowest tier. A QC platform that shaves an hour off a review but misses a state high-cost trigger has cost you money.

The buyers here are QC managers and compliance officers. They get judged on exam results and repurchase demands. Speed is nice. Coverage is the job.

Start with the 90-day clock

Fannie Mae's Selling Guide D1-3-01 gives you a hard deadline. The entire post-closing QC cycle must finish within 90 days from the month of the disbursement or acquisition date. That cycle includes selection, review, rebuttal, and reporting. Rebuttal is the part buyers forget. Your platform has to move a finding to the branch and capture the response. If it cannot close that loop inside the window, you run late. Fall behind by more than one 30-day cycle and you owe Fannie Mae written notice.

Ask every vendor how the tool ages a cycle against that 90-day rule. Some report on review completion only. That is the wrong measure. You want a view that ages the whole cycle from the disbursement month forward.

The 2026 changes moved the target

Fannie Mae issued SEL-2026-03 on April 1, 2026. It removed the fixed 10 percent minimum for prefunding sampling. Lenders now design sampling that reflects their own risk profile, using random or discretionary selections. The announcement also cut several reverification and operational reporting requirements. These changes were encouraged right away and became mandatory for reviews on or after July 1, 2026.

That flexibility shifts work onto you. Fannie Mae reserves the right to impose minimum sampling if your approach lacks adequate representation. So the sampling engine matters more now than it did two years ago. You define a risk-based sample and document why you chose it. You defend that choice at the next exam. A tool that only does flat random percentages is behind the guide.

Post-closing sampling did not change the same way. D1-3-01 still calls for a 10 percent sample of monthly production or a statistically valid alternative. The statistical route requires a 95 percent confidence level with a 2 percent precision rate. Most shops stay with the 10 percent random sample plus discretionary selections. The discretionary sample has to target real risk and shift as that risk shifts.

Depth means the tests that actually get cited

Federal coverage is table stakes. Every serious product tests TRID, HMDA, ability to repay, and the federal high-cost rules. Separation shows up in the state work and the edge cases.

Regulation Z thresholds reset every January. For 2026 the HOEPA total loan amount threshold is $27,592 and the points-and-fees trigger is $1,380. Qualified mortgage points-and-fees caps run on a sliding scale. Loans of $137,958 or more get the 3 percent cap. Smaller loans move to fixed dollar caps or higher percentages, down to 8 percent under $17,245. Ask the vendor when those 2026 numbers went live in production. The rule published in December 2025 and took effect January 1, 2026. A vendor who cannot give you a ship date is telling you something.

State high-cost and anti-predatory tests are where audits go wrong. Each state sets its own triggers, and they change on their own schedule. This is a content problem more than a software problem. You are buying a regulatory content team as much as a rules engine. Ask how many people maintain state content and how fast a change reaches production.

ComplianceEase built its reputation on exactly this work. SitusAMC acquired its parent, LogicEase Solutions, in September 2020. The product line includes ComplianceAnalyzer for automated loan audits and TRID Monitor for disclosure testing. There is also a Pre-Exam Portal for loan-level mock exams. That mock exam idea is worth taking seriously whoever you end up buying from.

TRID testing is narrower than people think

Most TRID findings come from a small set of mistakes. Fee bucket misassignment is the big one. Charges paid to the creditor or the broker carry zero tolerance under 1026.19(e)(3)(i). Affiliate charges land there too, as do charges the borrower cannot shop for. Recording fees and shopped services from your written list sit in the 10 percent cumulative bucket under 1026.19(e)(3)(ii). Prepaid interest, property insurance, escrow deposits, and property taxes have no tolerance limit.

A good engine does not just flag the overage. It tells you which bucket the fee belongs in and why. It also tracks valid changed circumstances so a legitimate increase does not generate noise. When a tolerance is blown, the fix is a refund to the borrower and a corrected Closing Disclosure. Test whether the tool produces the cure documentation or only the finding.

HMDA is graded on a curve you can look up

The FFIEC publishes the exact transaction testing tables examiners use. Sample sizes scale with LAR count. An institution with 501 to 100,000 LAR lines faces a 79-loan total sample and a 35-loan initial sample. Two errors in the initial sample expands the review. Four errors in the total sample triggers full file resubmission, which works out to 5.1 percent. Above 100,001 lines the resubmission threshold tightens to 2.5 percent.

Those numbers should set your internal accuracy target. If the examiner tolerance is 5.1 percent, do not run a program that accepts 6 percent. The guidelines also grant specific allowances. Application received date and action taken date allow a variance of three calendar days or less. Loan amount allows a thousand dollars or less. Gross annual income rounds to the nearest thousand. Race and ethnicity fields group together, so several errors inside the group count as one.

One scope question comes up often. The closed-end reporting threshold is 25 loans in each of the two preceding calendar years. A federal court vacated the 100-loan threshold on September 23, 2022. Smaller shops that stopped filing should check whether they are back in scope.

Fair lending analysis is a separate purchase

Loan-level QC and fair lending analytics are different products with different math. A QC platform reviews files. A fair lending tool runs statistics across your whole application population. Buying one and expecting the other is the most common mistake we see in this category.

Asurity's RiskExec is built for the second job. Its modules cover HMDA submission and validation, fair lending, CRA, and geocoding. A dedicated redlining module picks peer institutions and relevant geographies. There are also modules for fair servicing and small business lending data. If your exam risk is redlining or pricing disparity, a file-review tool will not answer the question.

Integrations decide whether your sample is honest

A sample built from a partial data feed is not a sample. It is whatever your integration happened to pull. That is why integrations carry the same weight as production impact here.

The connection to your loan origination system is the thing to test. Does it pull the full closing package or only the data record? Does it pull documents on its own, or wait for an upload? Can a finding write back so the branch sees it where they already work? And does the audit trail travel with it?

LoanLogics sells the document side directly. Its IDEA technology classifies documents and extracts data. LoanHD handles pre-close and post-close reviews with automated defect detection. That pairing matters because most QC labor is not judgment. It is finding the right page and reading a number off it.

You will also need reverification workflows and a way to produce files on demand. Fannie Mae gives lenders 30 days to send documentation after a QC selection notice. A pattern of extensive delays can lead to indemnification or repurchase. Continued unresponsiveness can be treated as a breach of contract.

Reporting is a requirement, not a feature

D1-1-03 sets out what the reports must contain. QC reports go to senior management in writing every month. Reports must reach leadership within 30 days of a review's completion. Post-closing reports must show the highest severity defect rate against your defined target rate at least quarterly. They must show defect trending for at least three months. They must also separate compliance-with-law defects from underwriting and eligibility defects.

Read that last requirement again during your demo. Many tools track defects in one flat taxonomy. If yours cannot split legal compliance defects from eligibility defects, someone rebuilds the report by hand every month. That is a real cost and it lands in the return-on-spend score.

Counterparty monitoring sits outside the audit

If you buy through brokers or correspondents, file review covers only half your exposure. Comergence, now part of Optimal Blue, handles the other half. It draws on NMLS Consumer Access data for originator and loan officer onboarding and renewals. It runs ongoing license monitoring and social media surveillance tied to your brand. That is a different budget line and often a different owner inside the company.

What we would test before signing

Send the vendor ten of your own loans, including the two that got cited last exam. Do not use their sample files. Watch whether the engine catches the finding your regulator caught. Then ask when the current-year Regulation Z thresholds went into production and get a date.

Ask for the state content release notes from the past twelve months. A vendor with a real content team can produce them. Ask how a rule change gets tested before it reaches your production instance. Bad releases in this category create false positives, and false positives burn analyst hours faster than anything else.

Matching the tool to the shop

ACES Quality Management leads our ranking because the audit engine is configurable without a developer. Audit packs cover origination, servicing, consumer lending, and specialty work. Questions can be edited by the QC team itself. For a lender running its own QC department, that self-service matters more than any single test.

ComplianceEase is the pick when regulatory test depth is the deciding factor. LoanLogics fits shops drowning in document handling. LauraMac serves a different buyer entirely. Its platform targets investors, aggregators, correspondent lenders, and third-party review firms. If you are a retail lender doing post-closing QC, that is not your product.

Wolters Kluwer sits upstream of all of this. Expere generates documents from maintained regulatory content, so compliance work happens before the loan closes. Buying it does not remove the need for post-closing QC. It does reduce what QC finds.

On pricing

Almost nobody in this category publishes a price. Expect per-loan or per-audit pricing on the compliance testing engines. Expect per-seat or tiered pricing on the QC platforms. Get the fully loaded number before you sign. Implementation, rules configuration, content subscriptions, and integration work are frequently separate line items.

One number justifies the spend on its own. Fannie Mae's rep and warranty relief arrives after 36 monthly payments with a clean history. A high LTV refinance can reach relief in 12. Life-of-loan representations never get relief, and compliance with law is one of them. Your compliance testing covers the exposure that never expires. Price it against that, not against headcount saved.