Mortgage Originators and Secondary Market Participants Take Note: The Final Rule on Automated Valuation Models Is Now Effective and Could Apply to You
On October 1, 2025, the final rule implementing the quality control standards mandated by the Dodd-Frank Wall Street Reform and Consumer Protection Act for the use of automated valuation models (“AVMs”) became effective (the “Final Rule”).1 An AVM is defined in the Final Rule as any computerized model used by mortgage originators and secondary market issuers to determine the value of a consumer’s principal dwelling collateralizing a mortgage.
Adopted by the CFPB, FDIC, FHFA, FRB, NCUA, and OCC, the Final Rule requires mortgage originators and secondary market issuers that use AVMs in credit decisions or covered securitization determinations, whether themselves or through a third party or affiliate, to adopt and maintain certain policies, practices, procedures, and control systems for the use of AVMs.
While the rule itself is short and deviates minimally from the underlying statute, the substance is in the defined terms. Specifically, the Final Rule applies to mortgage originators and secondary market issuers. A “mortgage originator” is defined as any person who, for direct or indirect compensation or gain, or in the expectation of direct or indirect compensation or gain, (i) takes a mortgage application; (ii) assists a consumer in obtaining or applying to obtain a mortgage; or (iii) offers or negotiates terms of a mortgage; as well as any person who represents to the public, through advertising or other means of communicating or providing information, that such person can or will provide any of the services or perform any of these activities.
The Final Rule excludes a number of persons from the definition, but “mortgage originator” does not exclude persons performing activities relating to business-purpose mortgages. In addition, the CFPB’s official interpretation makes clear that the term excludes servicers unless a servicer performs mortgage originator activities, such as originating a refinance. A “secondary market issuer” is defined as any party that creates, structures, or organizes a mortgage-backed securities transaction. The Final Rule does not define what it means to “create,” “structure,” or “organize” a mortgage-backed security, but notes that the definition covers those responsible for the core decisions required for the issuance of mortgage-backed securities.
The Final Rule imposes requirements on mortgage originators and secondary market issuers if they use AVMs to either engage in (a) a “credit decision,” defined as a decision regarding whether and under what terms to originate, modify, terminate, or make other changes to a mortgage, including a decision whether to extend new or additional credit or change the credit limit on a line of credit; or (b) a “covered securitization determination,” defined as a determination regarding (i) whether to waive an appraisal requirement for a mortgage origination in connection with its potential sale or transfer to a secondary market issuer; or (ii) structuring, preparing disclosures for, or marketing initial offerings of mortgage-backed securitizations. As recognized by the Final Rule, these defined terms do not include using AVMs for monitoring or verifying the quality or performance of mortgages or mortgage-backed securities.
Consistent with the expanded scope of a “mortgage originator,” the Final Rule defines a “mortgage” as a transaction in which a mortgage, deed of trust, purchase money security interest arising under an installment sales contract, or equivalent consensual security interest is created or retained in a consumer’s principal dwelling. “Mortgage” covers both open-end and closed-end transactions, as well as consumer-purpose and business-purpose transactions. Thus, business-purpose transactions otherwise excluded from the Truth in Lending Act are subject to the Final Rule if the mortgage secures the consumer’s principal dwelling.
If a mortgage originator or secondary market issuer uses AVMs to engage in credit decisions or covered securitization determinations, the Final Rule requires the originator or issuer to adopt and maintain policies, practices, procedures, and control systems to ensure that AVMs used in these transactions adhere to certain quality control standards. “Control systems” is defined as the functions (such as internal and external audits, risk review, quality control, and quality assurance) and information systems that are used to measure performance, make decisions about risk, and assess the effectiveness of processes and personnel, including with respect to compliance with statutes and regulations.
Specifically, the quality control standards must be designed to (i) ensure a high level of confidence in the estimates produced; (ii) protect against the manipulation of data; (iii) seek to avoid conflicts of interest; (iv) require random sample testing and reviews; and (v) comply with applicable nondiscrimination laws. Compared with the underlying statute, Section 1125 of the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 as amended by the Dodd-Frank Act, the Final Rule only adds the unique requirement (v)—items (i) through (iv) are identical to the criteria in Section 1125.2 The agencies noted that while existing nondiscrimination law applies to an institution’s use of AVMs, specifying a fifth factor on nondiscrimination would create an independent requirement for institutions to establish policies, practices, procedures, and control systems to specifically ensure compliance with applicable nondiscrimination laws, thereby further mitigating discrimination risk in their use of AVMs.
Although the Final Rule itself does not provide prescriptive requirements for the use of AVMs, the agencies recognize that different policies, practices, procedures, and control systems may be appropriate for institutions with different business models and risk profiles. Moreover, the agencies noted that guidance is already in place to assist regulated institutions in using AVMs in a safe and sound manner, and institutions that are not regulated by the agency or agencies providing that guidance may still look to that guidance for assistance with compliance.3 The agencies have declined to issue additional guidance specific to the Final Rule at this time.
The Final Rule does not create (or address) enforcement for failure to comply with the rule’s requirements. Rather, the consequences for non-compliance with the Final Rule are those applicable to non-compliance with the laws the agencies oversee, such as fines, penalties, and enforcement actions.4
In reviewing the Final Rule, institutions should take care to determine whether they fit within the definition of mortgage originator or secondary market issuer, and if so, whether they use AVMs to engage in credit decisions or covered securitization determinations. To the extent that the Final Rule applies, such institutions should carefully review whether their policies, practices, procedures, and control systems adhere to the Final Rule’s requirements, including by looking to AVM guidance already issued by the agencies.
1 89 Fed. Reg. 64538 (Aug. 7, 2024).
3 89 Fed. Reg. 64539 (Aug. 7, 2024) (citing (i) Interagency Appraisal and Evaluation Guidelines, 75 FR 77450, 77468 (Dec. 10, 2010); (ii) Comptroller’s Handbook, Model Risk Management, OCC Bulletin 2021-39 (Aug. 18, 2021); (iii) Supervisory Guidance on Model Risk Management, OCC Bulletin 2011-12 (Apr. 4, 2011); (iv) Guidance on Model Risk Management, Federal Reserve Board SR Letter 11-7 (Apr. 4, 2011); (v) Adoption of Supervisory Guidance on Model Risk Management, FDIC FIL-22-2017 (June 7, 2017); (vi) Supplement Guidance to Advisory Bulletin 2013-07—Model Risk Management Guidance 2013-07, FHFA Advisory Bulletin 2022-03 (Dec. 21, 2022); and (vii) Model Risk Management Guidance, FHFA Advisory Bulletin 2013-07 (Nov. 20, 2013)).
