Why this guide exists
Mortgage origination operates under TCPA (Telephone Consumer Protection Act), TILA-RESPA, CFPB UDAAP, and state-level consumer protection rules — overlapping regulations that each impose specific requirements on how you contact prospective borrowers.
Most originators don’t violate the rules deliberately. They violate them by accident — sending an SMS without consent, missing a STOP reply, advertising an APR without the required disclosures.
This guide is the playbook the Mortgage Snapshot enforces by default.
Rule 1 — Get prior express written consent
TCPA requires “prior express written consent” before you contact a consumer via SMS, autodialer call, or pre-recorded voice. The consent must be:
- Express — not implied, not inferred from a prior business relationship.
- Written — captured in writing (electronic check-box counts) with auditable evidence.
- Specific — naming the party who will contact (you / your firm), the methods (SMS, calls, email), and the purpose (mortgage offers).
What the snapshot ships: Every lead-capture form has a TCPA-compliant consent string above the submit button. The consent timestamp, IP, and user-agent are logged with the contact record.
Example consent language:
By submitting this form, I expressly consent to be contacted by [Firm Name] (NMLS #[NMLS]) and its representatives at the phone number(s) and email I provided, including via automated SMS, automated calls, pre-recorded voice messages, and AI-powered messaging, regarding mortgage products and services. I understand consent is not required to obtain a mortgage. Standard message and data rates may apply. I may opt out at any time by replying STOP.
Rule 2 — Honor opt-outs immediately
When a consumer replies STOP, UNSUBSCRIBE, QUIT, CANCEL, or END to an SMS, you must:
- Stop sending immediately (no “one more message” goodbye).
- Stop sending across every channel they opted out of — if they STOP’d SMS, they may still want email, but if your consent language was bundled “communications,” interpret broadly.
- Suppress across every workflow.
- Maintain the suppression indefinitely unless they re-opt-in.
What the snapshot ships: STOP keyword handler on every SMS workflow. Suppressed contacts are added to a global suppression list that blocks every outbound channel automatically. Re-opt-in requires a fresh consent capture.
Rule 3 — Disclose properly
Mortgage advertising rules (TILA Regulation Z, MAP Rule, state-level rules) require specific disclosures on rate-related advertising:
- APR: If you advertise an interest rate, you must also disclose the APR.
- Trigger terms: If your ad mentions a specific payment, down payment, or rate, additional disclosures kick in (terms of repayment, APR).
- Equal Housing Lender: Required on most mortgage advertising.
- NMLS: Your originator NMLS and your firm’s NMLS must be displayed.
- State-specific: Some states (CA, NY, IL, TX, FL) require additional disclosures.
What the snapshot ships: Default templates include Equal Housing Lender, your NMLS, and your firm NMLS. State-aware logic appends state-specific disclosures based on the contact’s identified state.
Rule 4 — Don’t make false promises
CFPB UDAAP rules prohibit “unfair, deceptive, or abusive acts or practices.” In practice this means:
- Don’t promise rates you can’t deliver.
- Don’t promise approval you can’t guarantee.
- Don’t imply government affiliation if you’re not.
- Don’t promise specific terms without underwriting.
What the snapshot ships: The AI receptionist’s prompts are explicit — every output is “estimated,” “subject to underwriting,” “not a commitment to lend.” The AI is instructed to hand off to a licensed loan officer for actual rate/term/approval discussions.
Rule 5 — Maintain audit logs
If you’re examined by your regulator (state DFI, CFPB, FTC), you’ll need to produce records of:
- When a consumer consented.
- What they consented to (channels, purposes, contacting parties).
- Every outbound communication sent.
- Every opt-out received and honored.
What the snapshot ships: Every action is logged with date/time, contact ID, channel, action, content snapshot, IP, user-agent, and originating workflow. Logs are exportable in CSV or JSON.
Special considerations
A2P 10DLC
If you send mass SMS in the US, you need 10DLC registration. Without it, your messages get blocked or filtered. The snapshot install includes a 10DLC registration walkthrough.
Refinance solicitation
Solicitation language to past clients is high-scrutiny. The snapshot’s rate-drop alerts are written conservatively — no rate guarantees, no approval implications, clear opt-out.
Reverse mortgage
Reverse mortgage (HECM) has additional HUD-required disclosure language. The snapshot’s reverse mortgage workflow ships those disclosures.
Spanish-language compliance
Spanish-speaking borrowers must receive disclosures in the language used for marketing. The snapshot’s bilingual workflow ships TCPA consent and disclosure language in Spanish where bilingual marketing is enabled.
What this guide is not
This guide is a working playbook the snapshot enforces by default. It is not legal advice. Your compliance officer and outside counsel should review your specific marketing program against your state of licensure, your product mix, and your firm’s risk posture.