Industry
Non-bank lenders & specialty finance.
Mortgage, consumer, and commercial credit issuers. State-licensed, CFPB-supervised, capital-markets-funded.
Non-bank lenders — independent mortgage banks, consumer finance companies, commercial specialty lenders, BNPL platforms — operate under a regulatory architecture that does not look like a bank's but produces similar pressure: state-by-state licensing, CFPB supervisory authority for the larger institutions, capital-market funding with covenants that imply control-environment expectations, and warehouse-line providers that require operational reps.
Our practice for this sector covers the work that does not have a natural home in a non-bank lender's organizational chart: internal audit functions that did not exist five years ago, model validation for credit and pricing models that were built by the founders, SOX programs for the issuers that are now public, and a particular focus on consumer-compliance posture for institutions whose product surface area is what the CFPB looks at first.
Funding-source diligence is the multiplier. A warehouse renewal request that includes operational reps is a separate audit cycle on its own. We help institutions get to a place where those reps are not a fire drill.
| Regulator | Authority |
|---|---|
| CFPB | Direct authority over larger issuers |
| State AGs · banking depts. | State licensing via NMLS / MMC |
| FinCEN | For institutions with covered activities |
| Warehouse lenders · ABS investors | Operational reps, covenants |
| SEC · PCAOB | For publicly-traded issuers |
| State AGs · FTC | Data-security expectations |
- Internal audit — Building a function from scratch — or rebuilding one that grew too fast and stopped scaling.
- Model validation — Credit scoring, pricing, and AI/ML underwriting — validated for fair-lending posture.
- SOX compliance — For publicly-traded non-bank issuers — scoping calibrated to a non-bank operating model.
- Fraud risk — Origination fraud, synthetic identity, and AI-enabled typologies on the application surface.
An independent mortgage bank with $4.7B in annual originations had grown to the point where its three primary warehouse lenders were requesting operational reps that the institution could not credibly sign. We built a first internal-audit function — risk assessment, an audit plan calibrated to the warehouse reps, and the first three audits of the cycle. Andres led; the function has continued in steady state for two years.
What the audit committee saw
- Finding 01 Audit plan calibrated to the warehouse reps — five lender reps covered in the first three audits.
- Finding 02 IT controls program rebuilt around the LOS, the pricing engine, and the third-party servicer interface.
- Finding 03 Pricing model validated; one finding closed before next warehouse renewal cycle.