Mortgage website compliance checklist: NMLS IDs, Equal Housing and trigger terms

A single loan officer page missing an NMLS ID, or a social post that says "only $1,950 a month!" without disclosures, is the kind of thing that turns up in exams and audits. For a group with dozens of LO pages, the challenge is less about knowing the rules and more about applying them consistently everywhere. This mortgage website compliance checklist walks through what pages usually need, page type by page type, and how to keep it consistent.

Where should NMLS IDs appear on a mortgage website?

The Nationwide Multistate Licensing System (NMLS) assigns a unique identifier to companies and individual mortgage loan originators. Federal rules under the SAFE Act framework and many state rules expect those identifiers on advertising and websites. In practice, most compliance teams want:

• The company NMLS ID in the footer of every page.
• The individual LO’s NMLS ID on their profile, near their name.
• A link to NMLS Consumer Access so borrowers can verify licensing.
• The states where the company and LO are licensed, plus any state-required license lines or addresses.

Do mortgage websites need the Equal Housing Opportunity logo?

HUD’s fair housing advertising guidance (24 CFR Part 109) encourages the Equal Housing Opportunity logo, statement or slogan in housing-related advertising, and many lenders are required by their regulators or investors to display it. The safe default is the statement in every page footer. If you use the logo, use the official asset unaltered.

What are Regulation Z trigger terms?

Calculators are a common gray area: a payment calculator that shows a result based on the borrower’s own inputs is generally treated differently from an ad that promises a payment, but your compliance officer should approve the calculator’s default values and disclaimer.

What does each page type need?

What are the rules for reviews and testimonials?

The FTC’s rule on consumer reviews and testimonials (16 CFR Part 465), effective in 2024, prohibits fake reviews, buying positive reviews, and suppressing negative ones, among other practices. For mortgage sites that means: ask every closed client the same way, display reviews with the platform and date, never edit them, and label any example content as a sample.

Does accessibility count as compliance?

Accessibility is both a legal exposure (ADA-related claims against websites are common in the US) and a fair-access issue. Target WCAG 2.2 Level AA: contrast, keyboard operation, labelled forms, alt text and captions.

How do you keep 40 LO pages consistent?

1. Central disclosure blocks: company NMLS, EHO, license lines and disclaimers edited once and inherited by every page.
2. Locked fields: LOs can’t edit disclosures, logos or license lines.
3. Approvals: changes to programs, promotions or anything with numbers go to a reviewer before publishing.
4. Audit log: who changed what and who approved it.
5. Quarterly sweep: check every LO page, funnel and calculator against this list.

These are the controls in Mortgage Funnel Suite’s governance module and compliance blocks, but the process works with any platform that supports reusable blocks and approvals.

How do you run a quarterly website compliance audit?

A quarterly audit doesn’t need special software, just a list and an hour per branch. Export a list of every live URL from your sitemap. For each page, check the footer block (company NMLS ID, equal housing statement, licensing link), then the page-specific items from the table above. LO profiles get a second check: is the LO still employed, still licensed in the states listed, and is the NMLS ID correct? Funnels and landing pages deserve extra attention because they are often created quickly for campaigns and copied from ads.

Record findings in a simple sheet with the URL, the issue, the owner and the date fixed. The first audit usually finds the most problems; after that, the approval workflow and central blocks keep the list short. Share the summary with branch managers so they see the pattern, for example that most issues come from one campaign or one branch’s old pages.

Does this apply to social media profiles too?

Yes. Advertising rules don’t stop at your website. LO bios on social platforms, pinned posts, link-in-bio pages and short videos are advertising too. The same principles apply: identify the LO and company with NMLS IDs where your policy requires it, avoid trigger terms without disclosures, and keep testimonials real. Many groups maintain an approved bio template and a short list of pre-approved post templates so LOs can stay active without improvising compliance.

When an LO leaves, remember their social profiles and any personal domain that pointed to company content. Update or redirect them as part of offboarding, so old claims and contact details don’t linger.