A Compliance Checklist for Mortgage Lead-Capture Pages

This is general information for licensed professionals, not legal advice. Mortgage advertising and consent rules vary by state, by license type and by the products you offer, and they change. Use this checklist to prepare a conversation with your compliance team or counsel, not to replace one.

The short answer: a compliant mortgage lead-capture page shows who you are and where you are licensed, includes an Equal Housing Opportunity statement, avoids triggering advertising disclosures it does not carry, asks for clear and specific consent before you call or text, explains how you handle the borrower's data, works for people with disabilities, and keeps a record of all of it. Each section below opens with the requirement, then explains how it applies to a page with an embedded calculator.

Who is this checklist for?

Loan officers, brokers and branch managers who run their own websites or HighLevel funnels and collect leads through calculators or forms. If you work under a lender or brokerage with a marketing-approval process, run every new page through it; this checklist helps you arrive with fewer corrections.

It deliberately stays at the level of "what to look at". It does not cite rule sections or court decisions, because the right reading depends on your facts, and because several of these areas (especially TCPA consent) have changed in the last few years.

What licensing details must the page display?

Your name, your individual NMLS ID, your company's name and NMLS ID, and the states where you are licensed, on every page that collects leads. The footer is the usual place, as long as it appears on every page, including funnel steps.

The Secure and Fair Enforcement for Mortgage Licensing Act (SAFE Act, 2008) created the nationwide licensing system behind the NMLS ID. Federal loan originator rules issued by the CFPB (2013) require the identifier on certain loan documents, and many state regulators require it in advertising, which commonly includes websites and social profiles. See the NMLS ID glossary entry for the basics.

Practical points:

• Use the same name format everywhere that NMLS Consumer Access shows.
• If you list states, keep the list current when you add or drop a license.
• Some states require extra elements, such as the license type or a regulator's statement. Ask compliance for each state you serve.
• On HighLevel funnels, check that every step has the footer, not just the first page.

Where does the Equal Housing Opportunity statement go?

On every page, typically in the footer next to your licensing details, as the words "Equal Housing Opportunity" (or "Equal Housing Lender" where that applies to your institution) and, commonly, the HUD logo.

The Fair Housing Act (1968), enforced by HUD, prohibits discrimination in residential real estate transactions, including mortgage lending, and the Equal Credit Opportunity Act (1974), now administered by the CFPB as Regulation B, prohibits discrimination in credit. HUD's fair housing advertising guidance has long encouraged the statement and logo in housing-related advertising. Beyond the statement itself:

• Use imagery and copy that does not suggest a preference for or against any protected group.
• Do not target or exclude audiences in ads on protected characteristics. Ad platforms' special-category rules for housing and credit ads exist for this reason.
• Offer the same calculators and the same follow-up to everyone who submits.

When does quoting a payment or rate trigger extra disclosures?

When your ad states certain specific credit terms, the Truth in Lending Act (1968) and the CFPB's Regulation Z can require additional disclosures alongside them. This is the area where calculator pages most often get into trouble, not because of the calculator but because of the headline above it.

In general terms, for closed-end mortgage advertising:

• Rates should be stated as an annual percentage rate (APR). If you show a simple interest rate, the APR generally needs to appear with it, and with equal prominence is the safe approach. The APR glossary entry explains the difference.
• Trigger terms are specific credit terms such as the amount or percentage of the down payment, the number of payments or repayment period, the amount of any payment, or the amount of any finance charge. If an ad states one, it generally must also disclose the down payment, the terms of repayment and the APR, including whether the rate can increase.
• General statements such as "low down payment options" or "affordable monthly payments" are not usually trigger terms.

How this applies to a calculator page:

1. The calculator output is the borrower's own estimate, based on numbers they entered, with a disclaimer. That is generally viewed differently from an advertised rate or payment.
2. The default values in a calculator are visible before the borrower types anything. PrequalFunnel calculators start from an indicative rate (6.75%) clearly labeled as an estimate; if you change defaults, ask compliance whether your chosen values need disclosure.
3. The headline, buttons and ad copy are advertising. "Payments from $1,450 a month" or "3% down" in a headline is a trigger term. "See what your payment could be" is not.

The CFPB's Mortgage Acts and Practices rule (Regulation N) also prohibits misleading claims in mortgage advertising, such as implying a government endorsement or misrepresenting a rate as fixed. Write copy that describes what the tool does, not what the borrower will get.

What should TCPA consent wording say?

It should say, clearly and next to the submit button, that by providing their number the borrower agrees to be contacted by your named company, by the specific channels you intend to use (calls, texts, prerecorded or automated messages), that message and data rates may apply, that consent is not a condition of any purchase, and how to opt out.

The Telephone Consumer Protection Act (1991) and the FCC's rules under it require prior express consent for certain calls and texts, and prior express written consent for telemarketing calls and texts made with an autodialer or prerecorded voice. Recent history matters here:

• The FCC adopted a "one-to-one" consent rule in 2023 aimed at lead-generation sites that collected consent for many sellers at once. It did not take effect as adopted. Single-company consent on your own site was never the problem it targeted, but compliance teams continue to watch this area.
• In 2024 the FCC adopted rules on revoking consent, including that consumers may opt out by any reasonable means and that opt-outs must be honored promptly. Build your workflows so a "STOP", an email reply or a spoken request ends that channel.
• Several states have their own telemarketing and texting laws with stricter consent, timing or registration rules.

Read the TCPA consent entry for a plain-language summary, and have counsel approve your exact wording. Do not pre-check consent boxes, and do not bundle consent for marketing texts into your privacy policy acceptance.

What privacy notice does a lead-capture page need?

A link to a privacy policy that accurately describes what you collect, why, who you share it with, and how borrowers can contact you, placed next to the form. Mortgage companies are financial institutions under the Gramm-Leach-Bliley Act (1999), which carries privacy notice obligations (Regulation P, administered by the CFPB) and data security obligations; for non-bank lenders and brokers, the FTC's Safeguards Rule, significantly updated in 2021, sets the security program requirements.

For a calculator page specifically, your policy should cover:

• The inputs borrowers type (income, debts, price, down payment), not just name and contact details.
• Analytics and attribution data (cookies, UTM tags, ad click IDs, referrer).
• Third-party processors, such as your calculator provider and CRM.
• Whether and when you share information with real estate agents or other partners.
• State privacy rights where they apply to you.

PrequalFunnel's security page describes how lead data is stored on our side; your notice still needs to describe your own practices.

Does the page need to be accessible?

Yes, aim for it. The Americans with Disabilities Act (1990) prohibits disability discrimination by businesses open to the public, and the Department of Justice published guidance on web accessibility under the ADA in 2022. The Web Content Accessibility Guidelines (WCAG 2.2, W3C, 2023) are the usual technical benchmark.

On a lead-capture page, check that:

• Every form field has a visible label, not just placeholder text.
• The calculator and form can be completed with a keyboard alone.
• Text and buttons have sufficient color contrast in your chosen theme.
• Error messages explain what is wrong in words, not only in red.
• Consent text is readable, not tiny gray print.

What are the RESPA Section 8 risks in realtor co-marketing?

The risk is any payment or thing of value given in exchange for referrals. The Real Estate Settlement Procedures Act (1974), Section 8, prohibits kickbacks and unearned fees for referrals of settlement service business. Co-marketing with agents is allowed in principle, but each party must pay its fair share for the marketing it actually receives.

The CFPB's 2015 compliance bulletin on marketing services agreements described the significant risks such arrangements carry. For calculator pages, typical situations to take to compliance:

• Co-branded calculator pages on an agent's website. Who pays for the page, the tool and the ad spend, and is the split proportional to each party's exposure?
• Open house flyers with your QR code. Paying more than your share of printing for an agent's listing can look like a payment for referrals.
• Sharing leads with agents. Handing borrower leads to an agent who refers business to you is a thing of value, and also a privacy question.
• Free tools for agents. Giving agents free use of paid software in the hope of referrals deserves the same scrutiny.

The RESPA Section 8 glossary entry summarizes the rule. Document every co-marketing arrangement and its fair-market-value basis before it goes live.

How does the 2025 Homebuyers Privacy Protection Act change trigger leads?

At a high level, it restricts the sale of mortgage "trigger leads". The Homebuyers Privacy Protection Act, signed in September 2025, amends the Fair Credit Reporting Act so that credit bureaus can generally furnish mortgage-related trigger leads only where the consumer has consented or where the requester has an existing relationship with the consumer, such as the current lender or servicer. Its provisions took effect in 2026.

Interpretation and implementation are still settling, so confirm the details with compliance before buying any credit-based leads. For a website funnel, the practical takeaway is simple: first-party leads that borrowers submit to you directly, with consent recorded, are not trigger leads, and they become relatively more valuable as purchased trigger lists shrink. See trigger leads for background.

What consent records should you keep?

For every lead, the exact consent wording shown, the borrower's action (box checked, button clicked), the date and time, the page URL, the phone number and email consented, and any later opt-out. Without these, you cannot prove consent if a call or text is challenged.

PrequalFunnel saves consent with each lead in the built-in CRM, alongside the page URL, source and the borrower's inputs and results. A practical record-keeping routine:

1. Keep a dated archive of every version of your consent wording, so you can show what a borrower saw on a given day.
2. Make sure consent travels with the lead when it is sent to HighLevel or another CRM by webhook, and map it to a field there.
3. Record opt-outs per channel, with date and method, and suppress those channels everywhere the contact exists.
4. Set a retention period in writing. Many compliance teams keep TCPA consent records for at least four years.
5. Review a sample of records quarterly to confirm the fields are complete.

The checklist

Use this table as a pre-launch review for each new lead-capture page or funnel step.

Run new pages through this list before launch and existing pages at least once a year, or whenever a rule in the right-hand column changes. When something is unclear, the answer is the same every time: ask your compliance team or counsel before the page goes live.