On the Horizon: Expanding State Prudential Standards for Nonbanks

State regulators are accelerating efforts to impose bank-like prudential standards on nonbank mortgage companies—a shift that could materially reshape governance, liquidity expectations, and supervisory scrutiny across the sector.

In July 2021, the Conference of State Bank Supervisors (CSBS) published its model state prudential standards for nonbank mortgage servicers (Model Standards), focusing on financial condition and corporate governance for some of the largest nonbank mortgage servicers in the nation. These standards addressed areas characteristic of bank prudential regulation: capital and liquidity, risk management, data standards and borrower information, data protection, and cyber risk. Several states had already adopted similar prudential standards at that time, and many others enacted the Model Standards in the three years that followed. Today, many loans serviced in the U.S. are serviced by mortgage licensees subject to the Model Standards through those states that have adopted them.

In 2025, we saw a meaningful increase in adoption as Nevada, Wisconsin, Arkansas, North Carolina, and Georgia all took action to implement the Model Standards. This led to optimism among some regulators that more states will not only adopt prudential standards, but that these standards may expand beyond servicers to other nonbank participants in the mortgage market.

For example, Maryland has expanded certain corporate governance concepts embedded in the Model Standards to both licensed mortgage and money transmission entities. Similarly, Georgia expanded applicability of general concepts embedded in the Model Standards to all mortgage-related licensees.

What Are the Model Standards?

During a recent Orrick panel on state financial services regulation, a representative for state regulators shared that 17 states have already adopted some form of the Model Standards, with some states beginning to expand beyond the largest mortgage servicers. But what are these standards, how important are they, and what impact do they have?

As a general matter, covered institutions under these standards—defined as nonbank mortgage servicers with servicing portfolios of 2,000 or more 1-4 unit residential mortgage loans and that operate in two or more states—are required to:

• Maintain written policies and procedures on capital and liquidity requirements;
• Use Generally Accepted Accounting Principles (GAAP) for all financial data;
• Meet the Federal Housing Finance Agency (FHFA) Eligibility Requirements for Enterprise Single-Family Seller/Servicers, including requirements related to capital, net worth ratio, and liquidity;
• Maintain sufficient allowable assets for operational liquidity in addition to amounts required for servicing liquidity, to cover normal business operations;
• Establish and maintain a board of directors, or similar body, responsible for operational oversight and establishing a durable corporate governance framework;
• Conduct an external audit that meets the requirements set out in the Model Standards;
• Establish a risk management program that identifies, measures, monitors, and controls risk sufficient for the level of sophistication of the servicer; and
• Conduct an annual risk management assessment with a formal report to the board of directors.

Some mortgage servicers may be subject to more requirements than others. For example, the Model Standards provide for both baseline standards and enhanced standards, the latter of which apply to large and complex servicers.

What Expectations Are Emerging, Even Where Model Standards Have Not Been Adopted?

Even if certain nonbanks are not technically subject to these prudential standards, there is an expectation among some regulators that mortgage companies will have a structure in place addressing many elements therein. For example, the Multistate Mortgage Committee (MMC), which coordinates joint multi-state mortgage examinations, provides for in its current examination manual what it considers a “safety and soundness” construct around two primary areas of focus—financial condition and management—which is conceptually similar to the Model Standards.

Within the MMC examination construct is a review of core components around:

• Financial Condition: “Liquidity, earnings, asset quality, capital, and sensitivity to market risk”
• Board Oversight and Management: “Effective, rational organizational structure, exhibited by sound and clear policies and procedures and effective internal routine and control processes”
• Compliance Program: “An effective [compliance management system or] CMS”
• Violations of Law and Consumer Harm: “The severity and level of violations incurred” and in consideration of “repeat violations and … success in address[ing] outstanding violations”

As noted by the Financial Stability Oversight Council (FSOC) in a 2024 report, “[a]s the primary regulators, states are the only entities with authority to directly supervise [nonbank mortgage companies] for prudential risks and with examination and enforcement authorities to promote safety and soundness …. While the CFPB has examination, enforcement, and rule-writing authority for federal consumer financial law applicable to the [nonbank mortgage companies], the CFPB is not a comprehensive prudential regulator.”

Therefore, even if a mortgage company operates in one or more states that have not yet implemented the Model Standards or falls outside the definition of a covered institution within those states, it may still find itself confronted with similar principled expectations from its regulators.

How Can Financial Institutions Prepare?

Regardless of whether a mortgage company finds itself in a jurisdiction that has enacted these prudential standards or has otherwise set similar expectations, there are several actions mortgage companies can consider to proactively address corporate governance and reduce regulatory risks.

• Internal Awareness: Ensure the right internal stakeholders are aware of potential expectations from state regulators. This should go beyond any compliance and legal personnel—senior management and boards of directors should also be aware not only of potential expectations but also should have clear lines of sight into potential risks on a routine basis.
• Risk Assessment: Companies should assess their risk profiles and think about their own risk tolerances, taking into account the size and complexity of their business models and other factors which may impact regulators’ assessments of business objectives and related compliance infrastructures. Ultimately, informed risk management, including appropriate decisioning around risk acceptance, should form transparent business expectations and position companies to strategically react to regulatory scrutiny.
• Peers: Pay attention to what other industry participants are doing. Regulatory standards and guidelines are often tied to industry best practices. Companies should ensure that whatever actions they decide to take, or not take, are within market tolerances relative to their peers, in addition to being otherwise defensible. To the extent that certain objectives deviate compared to other peer organizations, make sure such actions are informed and decisioned through appropriate governance protocols.
• Regulatory Approvals: Consider regular regulatory approvals and interactions under state licensing regimes, including strategic engagements such as change of control implications and other potential needs to interact with regulators when making critical business decisions. Companies may need to demonstrate adherence to the Model Standards—or the spirit of such standards—in order to obtain regulatory blessings for critical business opportunities.
• Due Diligence: Lastly, consider implications for business combinations and third-party partnerships. Acquiring companies may want to pay attention to prudential considerations both for the entity they are purchasing as well as the resulting institution. To limit regulatory objections and ensure a smooth transaction, legal due diligence should include an assessment of the selling entity’s compliance with prudential standards and the potential enforcement risk that may result from acquiring a company that lacks adequate controls. Similarly, leveraging third-party partnerships, including critical vendors, may be key to efficient and effective operations. However, ensuring continuity of compliance to the prudential standards is key, especially when relying on third parties to engage in certain aspects of regulated activities.

As state regulators continue to expand prudential expectations, mortgage companies should evaluate whether their governance, liquidity, and risk management frameworks would withstand supervisory scrutiny across jurisdictions. Orrick’s team is actively advising clients on how to align with evolving standards and prepare for increased regulatory focus.