Mortgage Lenders Scramble To Prove They're Policing Their Own AI

On its path to ubiquity, artificial intelligence has seeped into mortgage lending. Regulators are racing to catch up.

The same forces in the tech world that created the “move fast and break things” ethos are driving AI’s adoption today. With no overarching legislation, industry-specific rules are being rolled out, and mortgage lenders are erecting new guardrails to ensure their loans don’t run afoul of a growing oversight regime.

“Whether they want to recognize it or not, it's there, it's everywhere,” attorney James Brody said of AI. “I describe it as invasive.”

After noticing the lack of clear guidance on AI adoption, Brody last year co-founded Brody Gapp LLP specifically to focus on banking compliance and AI governance. New rules are starting to take shape.

Fannie Mae issued a letter on April 8 giving single-family lenders 120 days to develop and implement internal oversight of AI usage. That directive was taken further in Freddie Mac’s multifamily servicer guidance update for June, which requires that underwriters have insight into their AI systems and how they're being used.

Mismo, the nonprofit Washington, D.C.-based agency that sets the standards for how data is reported across the mortgage industry, has quickly developed a tool kit to get lenders on the right side of the regulations.

The tools — called the Framework for Responsible AI in the Mortgage Ecosystem, or FRAME — have a practical application, but they were also published to send a message, Mismo President Brian Vieaux said in a recent interview.

“FRAME is really intended to make it abundantly clear to the lender that they are on the hook. They better, at a minimum, understand where AI is being utilized across their entire organization,” he said. 

Mismo, short for the Mortgage Industry Standards Maintenance Organization, and the other agencies are late to the table — AI tools are already widely used by lenders and the third-party vendors they rely on — but arguably ahead of their pace in reining in earlier tech, from the rise of Uber to privacy concerns at the social media giants.

The Fannie Mae letter and Freddie Mac guidance led Mismo to expand a project to develop guardrails around AI into the creation of a full-fledged operating framework for members. It's been downloaded by more than a third of the agency’s 700-plus member firms, Vieaux said. 

Freddie Mac’s guidelines for AI and machine learning, which were published last month and went into effect on July 1, acknowledge that the tech is already widely used. There are no prohibitions on how it can be leveraged, but instead, rules mandate that firms standardize and document their AI usage and be prepared to have their books audited for compliance. 

“Agentic AI is doing more and more licensable activity, and there's going to come a point in time where there has to be a license attached to it,” Brody said. But to stay on the right side of the law, “you can’t just have a name without that person actually understanding what’s going on.”

The guidance exempts Freddie Mac from any legal liability related to a servicer’s use of AI and instructs the lender to ensure they’re meeting legal requirements, have established AI-related codes of conduct, and that mitigation efforts are in place against risks related to data security breaches. 

The Freddie Mac rules require that senior management sign off on implementation and maintenance policies around AI and that the policy, which must be reviewed at least annually, is communicated downward to staff. 

Without dedicated legislation, mortgage underwriters and regulators are left to piece together existing regulations to develop AI-related policy. Brody is looking to take FRAME's tool set a step further by developing actionable recommendations and legal interpretations to ensure lenders stay on the right side of regulators. 

For residential and multifamily lending, several layers of housing-related rules become hurdles for any AI policy. The most immediate regulatory hurdle is that rules around disclosures designed to protect consumers from financial harm and other regulations created in the wake of the Global Financial Crisis require a mortgage loan officer to be assigned to any quote. 

From a legal perspective, that means some individual has to take ownership of the AI’s output, not least because the regulations define a mortgage loan officer as “an individual,” which would presumably exclude AI models, said Caroline Stapleton, a partner at Orrick who worked with the Mortgage Bankers Association to publish a whitepaper outlining how existing rules are being interpreted in an AI-enabled world. 

There are few, if any, limitations on how the tech specifically can be used in mortgage underwriting, and MBA’s whitepaper stresses that disclosing how and where it's being used is currently the best path to avoid litigation. But without specific laws, there’s enough ambiguity that some AI-related risk will linger regardless of how much customers are aware a human isn’t in control.

“You may not be able to disclose around it,” Stapleton said. “Having a disclosure that says no human being was involved in the origination of this loan still may not be enough to fully mitigate your risk.”

Third-party vendors dominate the landscape for enterprise AI deployments, and the constant churn of updated software that a chief technology officer has to contend with is creating a web of compliance issues. For the firms that can afford it, in-house development of purpose-built tools is increasingly common, Stapleton said. 

Mismo, a nonprofit subsidiary of the Mortgage Bankers Association, initially set out to create what Vieaux described as guardrails around AI usage in the industry. But the rapid formation of regulations like Freddie Mac's led it to instead create FRAME to help companies get a grasp on and mitigate against their AI exposure, he said. 

The tool kit includes three pieces: an AI use case inventory to help figure out how AI is being utilized across a business, guidelines for creating AI policies, and a risk-assessment tool kit. An updated version set to publish next month will add an incident log template and a rubric to guide firms through policy updates. 

Much of the effort is in service of developing documentation so lenders are prepared when Freddie Mac or another federal agency comes looking for proof that AI is being used responsibly as it becomes more widespread.

“The vendors are going to want to make the AI supplant human discretion more and more — as much as they can get away with — because that will justify all of the investment that they've been making into AI,” Brody said.