Vendor Due Diligence Checklist for Mortgage Compliance
Reglith Editorial Team · November 2026
A vendor due diligence checklist is the documented set of verifications a mortgage institution completes before contracting with a third party—entity identity, licensing, financial stability, information security, privacy controls, operational resilience and reputational history. Compliance officers and risk managers use it to confirm that a vendor can support regulated mortgage activity without creating supervisory exposure.
What is a vendor due diligence checklist?
A vendor due diligence checklist defines the scope of pre-contract verification. It covers third-party compliance posture, information security, data privacy and operational stability—the questions a compliance or risk team asks before a vendor touches consumer data, disclosure content or loan files.
The checklist is distinct from ongoing vendor risk management (VRM). Due diligence happens before onboarding or renewal; VRM is the continuous cycle of monitoring, re-assessment and offboarding that follows. Many institutions combine both in a single vendor management system, but the checklist itself is a point-in-time gate.
The primary audience is compliance officers and risk managers at mortgage lenders, servicers, banks and credit unions. Loan originators and business unit owners often supply the business rationale, but compliance and risk own the verification standard and the documentation of approval.
A practical checklist is tiered. Higher-risk vendors—those with access to nonpublic personal information, disclosure generation, or servicing data—typically warrant deeper review than vendors with no consumer data access. The tier determines which checklist items are mandatory, which can be satisfied by certification, and which require site or document review.
Which regulatory frameworks drive the checklist?
Several frameworks shape what the checklist asks, even though none prescribes a single form.
- SAFE Act and NMLS: The SAFE Act requires mortgage loan originators to be licensed or registered, and NMLS maintains the licensing record. For vendors that perform origination activity, the checklist commonly verifies NMLS IDs and license status in the states where the vendor operates. State licensing rules vary; see State mortgage licensing requirements for state-specific context.
- Regulation Z and TRID: Where a vendor generates, hosts or transmits Loan Estimate or Closing Disclosure content, the checklist typically covers disclosure accuracy controls, change management and audit logging. Regulation Z, 12 CFR 1026, and the TRID rules set the substantive requirements the vendor must support.
- RESPA Section 8: Vendors in settlement service relationships raise Section 8 referral and fee-splitting questions. The checklist often captures the fee structure and confirms that compensation is not tied to referrals; the analysis is fact-specific.
- HMDA and Regulation C: Data-sharing vendors that feed HMDA reporting need data integrity controls, validation routines and error-correction workflows. The HMDA reporting guide covers the reporting framework.
- GLBA and privacy: The Gramm-Leach-Bliley Act (GLBA) safeguards and privacy rules apply to how consumer financial information is handled, which drives the security and contract provisions in the checklist.
- Fair lending: Vendors that support underwriting, pricing or marketing can affect fair lending outcomes. The fair lending compliance guide outlines the broader program.
What basic company information must be verified?
The identity and standing of the legal entity are foundational. The checklist typically confirms the legal entity name, state of incorporation or formation, and any NMLS ID if the vendor performs licensed activity. Trade names and DBAs should be captured so the contract matches the entity that will perform the work.
Ownership structure matters for anti-money laundering (AML) and sanctions screening. Many institutions verify beneficial owners and check ownership against sanctions and exclusion lists. Where ownership is layered or foreign, the review tends to be deeper and may require documentation.
Litigation, regulatory actions and bankruptcy filings are also checked. Searches commonly cover court records, regulator enforcement databases and NMLS records for licensed entities. A pending matter does not automatically disqualify a vendor, but it should be documented and escalated according to the institution's risk appetite.
What financial and insurance criteria apply?
Financial review tests solvency and stability. The checklist commonly requests financial statements or audited financials covering the last two to three years, plus credit reports or creditworthiness indicators where the vendor's failure would disrupt operations.
Insurance verification usually includes general liability, errors and omissions, and—if consumer data is shared—cyber liability. Certificates of insurance should name the institution where required and show coverage limits consistent with the contract.
Business continuity and financial stability are linked. A vendor with thin capitalization or declining revenue is a higher operational risk, and the checklist should record how that risk is mitigated—through contractual protections, escrow, transition plans or additional monitoring.
| Option | Best for | Notes |
|---|---|---|
| Audited financials | High-risk vendors with data access | Most reliable; may not be available for smaller vendors |
| Reviewed or compiled statements | Mid-tier vendors | Less assurance; pair with credit checks |
| Self-reported financial summary | Low-risk vendors | Weakest evidence; document the limitation |
What security and data privacy controls are required?
Security review typically covers information security policies, encryption in transit and at rest, access controls, multi-factor authentication and logging. Independent assurance—such as SOC 2 Type II or ISO 27001 certification—is commonly requested for vendors with consumer data access.
Privacy review confirms how the vendor handles nonpublic personal information under GLBA and applicable state law. Data breach notification obligations vary by state, and the checklist may confirm the vendor's ability to notify the institution within contractual and legal timeframes. Payment card data, where present, brings PCI DSS into scope.
Incident response planning and past breach history are standard items. A vendor's incident history is not automatically disqualifying, but undisclosed incidents or weak response plans are commonly escalated. CISA and FTC guidance can inform the questions, though neither prescribes a checklist.
How do you assess operational and reputational risk?
Operational review examines business continuity and disaster recovery plans, including recovery time objectives and testing evidence. For vendors supporting loan origination or servicing, a disruption can affect regulatory deadlines, so continuity planning is often weighted heavily.
Reputational screening reviews media coverage, regulatory sanctions and litigation history. Negative coverage alone is not determinative, but patterns or unresolved enforcement matters may warrant escalation. The institution's own third-party risk management expectations also apply to the vendor's subcontractors—so the checklist often asks whether the vendor has its own VRM program.
Where the vendor relies on fourth parties, the checklist should identify critical subcontractors and confirm whether the vendor conducts comparable due diligence on them.
What is a vendor due diligence questionnaire?
A questionnaire is the standardized instrument that gathers self-reported vendor data—security posture, financial condition, compliance attestations and insurance details. It makes responses comparable across vendors and creates a record of what the vendor represented.
Questionnaires are evidence, not verification. Responses should be corroborated with certifications, audit reports and independent searches. The checklist should state which items the questionnaire satisfies and which require separate documentation.
A questionnaire does not replace the checklist; it feeds it. Each response maps to a checklist line item, and gaps are documented as open items with owners and due dates.
How do you implement vendor management compliance?
Implementation begins with documenting due diligence findings and the approval decision. The record typically includes the checklist, supporting evidence, risk rating, approver and any conditions imposed. This documentation should be retrievable for examination.
Ongoing monitoring follows onboarding. Re-assessment triggers commonly include contract renewal, changes in ownership or control, security incidents, regulatory actions and changes in the vendor's services. Periodic re-assessment frequency often depends on the risk tier.
Vendor management compliance fits within the broader compliance management system. The CMS guide covers policies, monitoring and audits, and the mortgage compliance calendar guide helps schedule recurring reviews. For servicing vendors, the servicing compliance audit guide addresses audit design.
The checklist
- Confirm legal entity name, state of formation and NMLS ID where licensed activity applies (SAFE Act and NMLS records; varies by state).
- Verify ownership and beneficial owners against sanctions and exclusion lists.
- Search litigation, regulatory actions and bankruptcy filings; document sources and dates.
- Obtain two to three years of financial statements and assess solvency and creditworthiness.
- Verify insurance certificates, including cyber liability where consumer data is shared.
- Review information security policies, encryption, access controls and logging.
- Collect SOC 2 Type II or ISO 27001 evidence for data-access vendors.
- Confirm GLBA privacy and state breach notification capabilities; include PCI DSS where card data is present.
- Review incident response plans and past breach history.
- Assess business continuity and disaster recovery plans and testing evidence.
- Screen media, sanctions and regulatory records for reputational risk.
- Document findings, risk rating, approval and re-assessment triggers (varies by investor and loan program).
Frequently asked questions
What is included in vendor due diligence?
Vendor due diligence typically includes entity verification, licensing and NMLS checks, ownership and sanctions screening, financial review, insurance verification, information security and privacy controls, incident history, business continuity planning and reputational screening. The scope often scales with the vendor's risk tier and data access.
What should be included in a due diligence checklist?
A checklist should list each verification item, the evidence required, the responsible reviewer and the approval standard. It should distinguish items satisfied by questionnaire from those requiring independent documentation, and record dates and sources for each finding.
What are the "Four P's" of due diligence?
The "Four P's" is a common training framework rather than a regulatory term, and its elements vary by source. Teams sometimes use it to organize people, processes, performance and profitability—or purpose, process, people and performance—so confirm the definition your institution uses and map it to the checklist.
How often should vendor due diligence be performed?
Frequency typically depends on risk tier and contract terms. High-risk vendors are often re-assessed annually or at renewal, while lower-risk vendors may be reviewed less often. Events such as ownership changes, security incidents or regulatory actions commonly trigger off-cycle review.
What is the difference between vendor due diligence and vendor risk management?
Due diligence is the pre-contract verification gate. Vendor risk management is the ongoing program—monitoring, re-assessment, issue tracking and offboarding—that follows onboarding. Due diligence informs the initial risk rating; VRM keeps that rating current.
Keep the rules behind each step current: Reglith follows CFPB, agency, GSE and state regulator changes as they publish. Reglith regulatory updates