The Mortgage Broker Website Compliance Checklist: NMLS, State Disclosures, ADA

A mortgage broker website that skips compliance is a lawsuit waiting to happen. The bad news is that the disclosure rules change from state to state, and from year to year. The good news is that the baseline is the same for almost every broker in the US, and it fits on a checklist. Here is what has to be on the site, where it has to appear, and the three easy mistakes that trigger consumer complaints.

One disclaimer up top. This post is written for brokers who want a working starting point. It is not a substitute for counsel. If you are licensed in heavily regulated states (New York, California, Massachusetts, Texas are the usual suspects) or you have prior consumer complaints on file, have an attorney review your footer, your privacy policy, and your advertising language before launch.

The baseline federal requirements

Every mortgage broker website in the US needs five things in the footer or on a clearly linked disclosures page:

Company legal name and d/b/a if operating under one
Your company NMLS Unique Identifier (also called NMLSR ID or NMLS ID)
Individual NMLS IDs for any loan originator whose name or photo appears on the site
Equal Housing Opportunity or Equal Housing Lender statement, typically paired with the logo
The NMLS Consumer Access link pointing to nmlsconsumeraccess.org so a visitor can verify you

Those five items are the floor. A site missing any one of them is out of compliance with either the SAFE Act, FHA Fair Housing rules, or the CSBS Model State Regulatory Framework. Penalties vary by state, but the cleanest summary is: regulators rarely open an investigation over a footer alone, but they always check the footer first when an investigation starts for other reasons.

A common footer pattern that gets all five done in one block:

Acme Mortgage Brokers, LLC | NMLS #123456 | Equal Housing Opportunity
Licensed Mortgage Broker in [states]
Verify us at NMLS Consumer Access

That pattern is a starting point, not a verdict. States add to it.

State-level disclosures: where they have to live

Every state you are licensed in adds requirements on top of the federal baseline. A broker licensed in one state has one additional paragraph. A broker licensed in fifteen states has fifteen, many with specific wording that cannot be paraphrased.

The three categories of state additions:

License number and state agency callouts. Most states require the phrase “Licensed by the [State Agency]” followed by your state license number. California calls its agency the DFPI. New York calls it the DFS. Texas calls it the OCCC or the SML depending on license type. Using the wrong agency name is a factual error and a complaint magnet.

State-specific complaint procedures. Several states (California, Massachusetts, New York, Washington, and a growing list) require a named complaint procedure with contact information on the website. California’s is tied to the DFPI complaint process. Massachusetts requires a specific sentence naming the Division of Banks. These paragraphs run 50 to 150 words each and cannot be combined.

State NMLS Consumer Access links. Some states mandate a specific link format. Most accept the generic NMLS Consumer Access link. The cleanest approach is to use the generic link in the footer and then reproduce it once in each state disclosure block.

Where these live on the site: the footer is the default, but the footer gets crowded fast. The common pattern in 2026 is a footer with the baseline federal items plus a “State Licensing Disclosures” link that opens a dedicated page. That page runs state-by-state down the screen, each block headed with the state name and followed by that state’s required language.

If you are only licensed in one or two states, put everything in the footer. If you are licensed in six or more, use the dedicated page and link it from the footer. Either pattern is compliant. The failure mode is having the wording itself missing or wrong, not the placement.

If reading this has you wondering how compliance fits into the broader website build, the pillar guide covers it in context. See the end-to-end guide for the full picture.

The NMLS Consumer Access link: placement rules

The NMLS Consumer Access link is the one compliance element almost every broker gets slightly wrong. The SAFE Act requires that a visitor be able to verify the broker’s license, and the accepted mechanism is a link to nmlsconsumeraccess.org.

Three rules:

The link must be present on every page where the broker’s name, NMLS ID, or loan officer bios appear. In practice: every page.
The link must open the actual NMLS Consumer Access site. Some plugin-based compliance footers generate a link that looks correct but routes through a tracking redirect. Regulators have flagged this pattern. Link directly.
The link must include the NMLS ID it is verifying. The safest format: https://www.nmlsconsumeraccess.org/EntityDetails.aspx/COMPANY/123456 for the company ID and a second link per individual loan originator that includes their individual ID.

A one-line compliant implementation in the footer:

NMLS #123456 | Verify all loan officers

The ID number becomes the link. The “verify all loan officers” hyperlink points to the consumer access root. That satisfies both the federal and every state version of this rule.

ADA and accessibility (WCAG 2.1 AA in practice)

ADA compliance is the area where broker websites get sued most often. Not fined. Sued, by private plaintiffs and their attorneys, under Title III of the ADA for failing to provide a website usable by people with disabilities.

The standard that courts and the DOJ currently reference is WCAG 2.1 Level AA. In practical terms, for a broker website, that means:

Color contrast of at least 4.5:1 for normal text and 3:1 for large text. Automated checkers catch most violations.
Keyboard navigation through every interactive element. If you cannot tab through your contact form and submit it without a mouse, the form is not compliant.
Alt text on every meaningful image. Decorative images can have empty alt attributes but they cannot be missing.
Form labels that are programmatically tied to their inputs. “First Name” next to a box is not enough. The label must be in a <label> tag bound to the input’s ID.
Heading structure that flows logically: one H1 per page, H2s under it, H3s under those. Skipping levels for visual effect breaks screen readers.
Captions or transcripts for video content. If you have a single intro video on your about page, it needs a transcript.

A site that hits WCAG 2.1 AA on every page is generally defensible against drive-by ADA litigation. A site with obvious violations (unlabeled forms, missing alt text, 2:1 contrast on CTAs) is vulnerable.

The cheapest compliance path is to run automated scans quarterly with one of the free or $100-a-month tools, fix everything they flag, and then commission a manual audit every 12 to 18 months. The manual audit catches issues the automation misses. Expect to spend $800 to $2,500 per audit depending on site size.

Privacy policy and cookie consent in 2026

Privacy law in the US is now a fifty-state patchwork. Ten states have enacted comprehensive consumer privacy laws as of 2026: California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, and the list keeps growing.

For a mortgage broker website, the practical impact:

A written privacy policy is table stakes. Every compliant site needs one, published at a stable URL, linked from the footer. The policy has to name what data you collect (form fields, calculator inputs, analytics data, chat logs), who you share it with (your CRM, your email provider, any ad networks), and how a visitor can exercise their rights under applicable state laws.

California residents trigger CCPA requirements regardless of where you are based. If anyone from California visits your site, you need a “Do Not Sell or Share My Personal Information” link if you share data with third parties for cross-context advertising. Using Google Analytics 4 with Google Signals enabled is sharing.

Cookie consent banners are required for visitors from most state privacy law jurisdictions. The implementation has to allow “reject all” as easily as “accept all.” Dark patterns (preselected opt-ins, hidden reject buttons, nag banners) are an increasing source of enforcement actions.

Data minimization matters. Calculators that ask for email, phone, and name before showing a result are legally defensible but practically risky. Collect what you need. If you do not need a phone number to return a calculation, do not ask for one.

For most independent brokers, the cleanest path is a privacy policy subscription service ($8 to $16 per month) that updates the policy when laws change, paired with a cookie consent plugin that handles geo-based banner logic. Total cost around $15 to $25 per month. Much cheaper than getting sued by a California resident.

Advertising rules under Regulation N

Regulation N (the Mortgage Acts and Practices rule, also known as the MAP rule) governs what a mortgage broker can and cannot say in advertising. The website counts as advertising.

The four places Regulation N shows up on a broker website:

Rate and APR claims. If you advertise a rate or APR, the APR must be equal to or higher than the rate (or vice versa, depending on how it’s framed), and you must disclose the conditions that qualify a borrower for the advertised rate. “Rates as low as 6.25%” needs a footnote explaining who gets that rate, what credit score, what down payment, what loan type.

Triggering terms. Specific phrases in advertising trigger required disclosures. Examples: mentioning a down payment amount, a monthly payment number, a specific loan term, or the number of payments. If your site says “from $1,200 a month on a 30-year loan,” you now have to disclose the APR, the assumed loan amount, the assumed rate, the assumed term, and any payment variability. This is why most compliant broker sites do not quote specific payment numbers on marketing pages.

Misleading government affiliation. A broker website cannot imply a government connection that does not exist. “Endorsed by FHA” is out unless the broker is approved by FHA. Even then the phrasing is narrow. Logos, color schemes, or headlines that could suggest FHA, VA, HUD, or USDA sponsorship are a violation if not specifically authorized.

Bait-and-switch framing. Advertising rates or terms the broker cannot actually deliver, or burying the conditions, is a Regulation N violation. In practice this means if your site says “Apply in 5 minutes” and the actual process takes 45 minutes of document uploads, the advertising is misleading.

A defensible rate-page pattern: show a generic range, footnote the assumptions, link to a compliance page that names the rate-quote methodology, and never advertise a number you cannot verifiably deliver to at least some borrowers.

Testimonials and endorsement compliance

The FTC Endorsement Guides apply to mortgage broker testimonials the same way they apply to every other industry. Three rules that most brokers miss:

Material connections must be disclosed. If the testimonial comes from a paid spokesperson, a realtor who refers you business, or a family member, the connection has to be disclosed in the testimonial itself. “My realtor, who is also my brother” is fine. A testimonial presented as neutral when the reviewer has a business relationship is not.

Typical experience framing. If the testimonial describes an outcome (closed in 14 days, saved $400 a month), the ad has to either reflect what consumers generally experience or disclose what the typical outcome is. “Results vary” as a line under the quote is the common pattern.

Verifiability. You must be able to produce the underlying substantiation for claims in the testimonial if asked. “Saved $400 a month” needs the supporting loan documents. Not for posting, but for the file.

For practical purposes, the safest mortgage broker testimonials are Google reviews displayed as-is with name, date, and star rating pulled from the live review. They are verifiable (Google shows them), they are presented without editorial framing, and their material connections are bounded (Google has anti-fake-review mechanisms you can point to).

The three mistakes that generate actual complaints

State regulators and the CFPB publish annual enforcement summaries. The three issues that generate the most website-related mortgage broker complaints in order of frequency:

1. Missing or wrong NMLS ID in the footer. Easily the most common. Either the ID is absent, or it belongs to a loan originator rather than the company, or it is an outdated ID from a prior licensing period. Fix: audit the footer on launch, re-audit every 6 months, re-audit any time an LO leaves or joins.

2. Rate claims without Regulation N disclosures. A broker writes a blog post that mentions “current rates around 6.5%” without footnoting the assumptions. A consumer clicks through, gets quoted 7.1%, and files a complaint. Fix: either avoid specific numbers or footnote them rigorously, and timestamp every rate-containing page.

3. Inaccessible forms, particularly the main contact form. A screen reader user cannot complete the form, submits an ADA complaint, and the cost of resolving the complaint is higher than the cost of the initial fix would have been. Fix: test your forms with a keyboard and a free screen reader quarterly.

Three smaller issues that show up often enough to mention: unlicensed-state page exposure (a broker licensed in Texas ranking for “mortgage broker Oklahoma” with no state limitation language), stale loan officer profiles (an LO who left 18 months ago still on the bio page), and active calculators that produce numbers without any “for estimation only” language.

A copy-paste compliance footer template

The template below is a starting point. Adapt it to your specific states and licenses. Have a compliance officer or attorney review before you publish. Do not copy this verbatim without that review.

Acme Mortgage Brokers, LLC d/b/a Acme Mortgage
Equal Housing Opportunity | Equal Housing Lender
NMLS #[COMPANY NMLS ID]
Verify us at nmlsconsumeraccess.org
State Licensing Disclosures: [link to dedicated page]

Licensed Mortgage Broker in [list states with license numbers]:
[State 1], License #[number]
[State 2], License #[number]

Company address: [physical office address]
Phone: [main phone]
Not a commitment to lend. All loans subject to credit approval, underwriting, and program guidelines. Rates and terms are subject to change without notice. Not all applicants will qualify.

[link to Privacy Policy]
[link to Terms of Use]
[link to Accessibility Statement]
[link to Complaint Procedure, if state-required]

Every Broker Foundry site ships with a compliance-ready footer configured to the broker’s licensed states at setup. See our platform page for what is included by default.

How often to re-audit (and who should do it)

Compliance is not a one-time task. Three audit cadences every broker should run:

Quarterly (you or your marketing person):

Walk through the footer on the homepage and three interior pages. Verify every disclosure is present and readable.
Run an automated ADA scan with the tool of your choice.
Check every loan officer bio against the current NMLS roster. Remove any LO who has left.
Verify any rate or payment number on the site is either current or appropriately hedged.

Annually (you + an outside reviewer):

Full manual ADA audit by a specialist. Expect $800 to $2,500.
Privacy policy review against any new state laws passed in the prior year.
State disclosure review against any licensing changes in your footprint.
Testimonial audit (remove outdated ones, verify material connections are still accurate).

When triggered (immediately):

Any time you add or drop a state license.
Any time a loan officer joins or leaves.
Any time a new state privacy law goes into effect in a state you serve.
Any time the NMLS roster shows a status change for the company or an LO.

For brokers with heavy multi-state footprints or prior consumer complaints, outside compliance counsel makes sense. A retainer-based compliance firm runs $300 to $1,500 per month depending on scope. For most independent brokers with clean histories in 1 to 5 states, the quarterly internal audit plus annual outside review pattern is sufficient and runs under $3,000 per year.

The managed platform path is the compliance-lazy alternative. A platform built for mortgage brokers keeps the footer, the privacy policy, the cookie banner, and the disclosure pages updated as state laws change. The broker does not rerun the audit because the platform runs it. This is a genuine value prop of managed over DIY: one vendor owns the ongoing compliance layer, across every state you serve, on every page of your site.

Next steps

If you are building a broker website and want compliance handled by default, that is the whole premise of Broker Foundry. Book a 20-minute demo. We walk through the footer template live, in your states, with your loan officers configured.

If you want to continue reading: the pillar guide puts compliance in the context of the full build, and the DIY vs agency vs managed post covers the trade-offs of each path against the compliance burden.

FAQ

What has to appear on a mortgage broker website by law?

At a minimum: the company legal name (and any d/b/a), the company NMLS Unique Identifier, individual NMLS IDs for any loan officer featured on the site, an Equal Housing Opportunity or Equal Housing Lender statement, and a link to NMLS Consumer Access where visitors can verify your license. On top of that, every state you are licensed in adds state-specific disclosure language, complaint procedures in some states, and license numbers. A written privacy policy, cookie consent for applicable state residents, and WCAG 2.1 AA accessibility are also effectively required.

Where should I put my NMLS ID on my website?

The footer is the standard placement, and it should appear on every page. The ID must be present, correctly formatted (NMLS #123456), and linked to the company’s page on NMLS Consumer Access. Individual loan officer NMLS IDs should appear on their bio pages and on any page where their name or photo is used. Avoid burying the ID in a disclosures-only page that is only reachable from the footer.

Do I need ADA compliance on my mortgage broker site?

Yes. Courts have repeatedly held that commercial websites fall under Title III of the ADA, and mortgage brokers are frequent targets of drive-by ADA litigation. The practical standard is WCAG 2.1 Level AA. Automated scans catch most common violations. An annual manual audit catches the rest. A site that meets WCAG 2.1 AA on every page is generally defensible against most complaints.

Does my broker website need a cookie consent banner?

If you serve visitors from any state with a comprehensive privacy law (California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, and others as they pass), yes. The banner has to allow “reject all” as easily as “accept all” and cannot use dark patterns. Most brokers are best served by a consent plugin that geo-detects the visitor and shows the correct banner logic. Total cost runs $10 to $30 per month.

What is the penalty for a missing disclosure?

Penalties vary widely. For a single missing NMLS ID discovered during a routine examination, expect a cure letter and a corrective deadline, not a fine. For a pattern of violations (multiple states, multiple pages, combined with other issues), state regulators can impose per-violation fines ranging from a few hundred dollars to tens of thousands, plus required corrective disclosures on the site for a period. CFPB actions are larger and rare for independent brokers. The bigger practical risk is private ADA litigation (typical settlement $3,000 to $15,000 per site) and CCPA-style private actions from consumers.

Share This Guide