For most lenders, the Secure and Fair Enforcement for Mortgage Licensing (SAFE) Act falls into a familiar category: established, understood, and embedded into day-to-day compliance.
But “familiar” is not the same as “done.”
As we move into the back half of the year, the SAFE Act deserves a second look; not because the regulation has changed, but because timing, documentation, and independent validation continue to create risk for even well-run organizations.
What Hasn’t Changed (and Why That Matters)
The SAFE Act has been in effect for years, and most lenders already have policies, procedures, and training programs. Your Mortgage Loan Originators are registered, your framework is established, and your compliance team understands the requirements. However, there are a few realities that continue to surface in reviews:
- Compliance is not just a one-time setup. It includes ongoing adherence to both federal and state requirements.
- Annual independent testing is required to demonstrate compliance. This is where many organizations unintentionally create exposure.
The Overlooked Risk: Rolling 12-Month Timing
Unlike fixed regulatory deadlines, SAFE Act compliance operates on a rolling 12-month cycle. This creates two challenges for leadership teams:
- There is no single “season” for compliance
Testing often gets deprioritized because it does not align with other audit or regulatory timelines. - Gaps are easy to create and hard to defend
When testing slips beyond a 12-month window, even by a small margin, it can raise questions during examinations.
From a regulator’s perspective, the expectation is straightforward: You maintain policies, you follow them, and you validate them independently on a consistent annual basis.
What Regulators Expect to See
For covered financial institutions, SAFE Act compliance is not optional, and other regulatory bodies, such as HUD, make it clear that approved lenders are expected to maintain compliance with SAFE Act requirements as part of their broader governance framework.
In practice, that means your organization should be able to demonstrate:
- Documented SAFE Act policies and procedures
- Alignment between policy and actual operations
- Clear ownership and accountability
- Evidence of independent, objective testing within a 12-month period
- Documentation of findings and remediation, if applicable
Most lenders have the first three items well-in-hand. Testing and documentation are where scrutiny tends to increase.
Independent Testing: More Than a Check-the-Box Exercise
There is a tendency to view SAFE Act testing as a routine compliance step. In reality, it serves a more important function: It provides defensible evidence that your program is functioning as designed.
Independent testing helps:
- Validate that your controls align with regulatory expectations
- Identify gaps between written policies and execution
- Provide documentation that stands up in audits and examinations
- Reduce last-minute remediation efforts tied to regulatory reviews
And while SAFE Act testing is generally straightforward, the absence of proper documentation or independence can quickly elevate its importance during an exam.
Planning for the Second Half of the Year
As organizations shift focus to the back half of the year, attention naturally turns to year-end financial audits, agency reviews, and broader operational planning. SAFE Act testing should be part of that conversation, not something addressed after the fact. Because it operates on a rolling 12-month cycle, timing becomes critical.
If your last review occurred in late Q3 or Q4 of last year, your next testing window is approaching quickly. Waiting until year-end often creates unnecessary compression alongside other audit and compliance activities.
Key Steps To Take Now
Because SAFE Act testing is required annually, and because many lenders operate on similar compliance cycles, availability for independent testing becomes more limited as the year progresses. To stay ahead of timing challenges, we recommend:
- Assessing your last completed SAFE Act review date now
- Confirming whether you remain within your 12-month window
- Scheduling independent testing before year-end audit activity peaks
The SAFE Act may not be new, but expectations around documentation, independence, and consistency have not relaxed. For executive teams, this is less about regulatory interpretation and more about operational discipline.
Reach out to the Richey May team by August 1 to be included in this year’s testing schedule.
