US federal AVM rule: who it covers and what its five factors require

In this article

Written by

Kooky

Builder of Shaka, the payment router that pays every agent their commission on closing date.

About Kooky and Shaka →

A computer model that estimates what a home is worth can sit behind some of the most consequential decisions in American housing finance: whether a loan is made, whether a credit line is cut, whether an appraisal is waived. Since 1 October 2025, a federal rule has told the lenders and securitisers who lean on those models what kind of quality control they must have in place. The rule is short. Its operative sentence fits in a paragraph, and its list of standards has five lines.

That brevity makes it easy to misread. The rule is not a regulation of valuation software, and it is not a rule for every estimate of a home's value. This guide sets out what the six federal agencies actually adopted: where the rule comes from, what counts as an automated valuation model, who has to comply, which decisions bring the rule into play, what the five quality control factors say, and what the text deliberately leaves alone. It draws on the final rule as published in the Federal Register, the regulatory text in Title 12 of the Code of Federal Regulations, the underlying statute, and the Consumer Financial Protection Bureau's compliance guide for small entities.

Federal Register, Quality Control Standards for Automated Valuation Models, 89 FR 64538, published 7 August 2024.

Where the rule comes from

The rule did not begin with the agencies. It began with Congress. According to the preamble of the final rule, section 1473(q) of the Dodd-Frank Act added a new section 1125 to Title XI of the Financial Institutions Reform, Recovery, and Enforcement Act (FIRREA). That section, as it appears in the United States Code, says that automated valuation models must adhere to quality control standards designed to do four named things, plus a fifth, open-ended one: to account for any other factor the agencies determine to be appropriate.

The same section names the agencies that must write the regulations: the Board of Governors of the Federal Reserve System, the Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Federal Housing Finance Agency and the Consumer Financial Protection Bureau. The statute tells them to act in consultation with the staff of the Appraisal Subcommittee and the Appraisal Standards Board of the Appraisal Foundation.

The Federal Register record shows three dates. The six agencies published a proposed rule on 21 June 2023 and received approximately 50 comments. The final rule, titled Quality Control Standards for Automated Valuation Models, was published on 7 August 2024 at volume 89, page 64538, and runs to 43 pages. Its effective date is stated in one sentence: the final rule is effective 1 October 2025. The CFPB's compliance guide, issued as version 1.0 in October 2024, confirms that mortgage originators and secondary market issuers had to begin complying on that date. At the date of this guide the rule has therefore been in force for one year and nine days.

Because six agencies adopted the same rule, the text sits in six places in Title 12 of the Code of Federal Regulations. The wording of the standards is the same in each; what differs is whose institutions each copy governs.

What counts as an automated valuation model

The statute supplies the definition and the regulation follows it closely. An automated valuation model is any computerised model used by mortgage originators and secondary market issuers to determine the collateral worth of a mortgage secured by a consumer's principal dwelling. Three things are packed into that sentence, and each one narrows the rule.

The first is the tool. The CFPB's compliance guide breaks the question into three parts: an entity asks whether the product is automated, whether it is a model, and whether it is designed to estimate the value of a principal dwelling. A product that fails one of the three is not an automated valuation model for the purposes of the rule.

The second is the user. The definition is tied to mortgage originators and secondary market issuers. A model used by someone else, for some other purpose, is outside the definition however sophisticated it is. A home value estimate shown to the public on a property website is not, for that reason alone, a model covered by this rule; what matters is whether an originator or an issuer uses a model to value collateral for one of the decisions the rule lists.

The third is the property: a consumer's principal dwelling securing a mortgage. That phrase does a great deal of work and has its own section below.

Who has to comply

Two kinds of business carry the obligation.

A mortgage originator, in the regulatory text, is a person who, for direct or indirect compensation or gain, or in the expectation of it, takes a mortgage application, assists a consumer in obtaining or applying for a mortgage, or offers or negotiates the terms of a mortgage. It also includes a person who advertises or otherwise represents to the public that they can provide those services. The preamble notes that the agencies adopted the Truth in Lending Act definition of the term with technical revisions.

A secondary market issuer is any party that creates, structures or organises a mortgage-backed securities transaction.

The definition of mortgage originator comes with a list of people who are not originators. As the CFPB's Regulation Z text sets them out, they are:

• people who perform purely administrative or clerical tasks;
• certain retailers of manufactured or modular homes, and their employees, who meet listed conditions;
• real estate brokers, unless they are compensated by a lender, a mortgage broker or another mortgage originator;
• seller financers who meet the conditions in two paragraphs of Regulation Z, section 1026.36(a)(4) and (5);
• servicers, including when they modify a mortgage for a borrower who is in default or likely to default.

The CFPB guide adds two details. The real estate broker exclusion is for a licensed person who only performs real estate brokerage activities. And the servicer exclusion has a limit: according to the guide, a servicer becomes a mortgage originator when it makes a new extension of credit, a refinancing included.

Which agency's copy of the rule applies depends on who supervises the business. The OCC's subpart applies to mortgage originators and secondary market issuers regulated by the OCC. The FHFA's subpart says it applies to entities regulated by the Federal Housing Finance Agency. The CFPB's provision is the residual one: by its own scope paragraph it applies to mortgage originators and secondary market issuers other than the financial institutions, and their regulated subsidiaries, that fall to the banking and credit union regulators. The CFPB guide describes the bureau's enforcement reach as covering non-depository participants, which makes Regulation Z the copy of the rule written for them.

The decisions that bring the rule into play

Using a model is not enough to trigger the rule. The model has to be used for one of two kinds of decision.

The first is a credit decision. The regulation defines it as a decision regarding whether and under what terms to originate, modify, terminate or make other changes to a mortgage, including a decision whether to extend new or additional credit or to change the credit limit on a line of credit. The definition reaches well past the day a loan is made. The preamble states that loan modifications are covered and that decisions to reduce or suspend a home equity line of credit are covered. The CFPB guide gives further examples: terminating the draw period on a line of credit, and approving or denying the assumption of an existing mortgage.

The second is a covered securitisation determination, a term the rule defines. It has two limbs. One is a determination whether to waive an appraisal requirement for a mortgage origination in connection with its potential sale or transfer to a secondary market issuer. The other is a determination regarding structuring, preparing disclosures for, or marketing initial offerings of mortgage-backed securitisations.

The appraisal waiver limb settles a practical question about who answers for the model. The preamble explains that when the government-sponsored enterprises use automated valuation models to decide whether to offer an appraisal waiver, it is the enterprise that is making a covered securitisation determination and that must comply. The originator that asks for the waiver is not making that determination and, the agencies say, does not have to ensure that the enterprise's model complies. Their reasoning, in the preamble's words, is that secondary market issuers are "best positioned" to carry out that quality control.

One further inclusion is easy to miss. The preamble says that the final rule covers automated valuation models used in the preparation of evaluations. The exclusion described below is worded for appraisals developed by a certified or licensed appraiser.

The principal dwelling test

Everything in the rule is anchored to a mortgage, and the rule defines a mortgage as a transaction in which a mortgage, deed of trust, purchase money security interest arising under an instalment sales contract, or equivalent consensual security interest is created or retained in a consumer's principal dwelling. If the collateral is not a consumer's principal dwelling, the rule does not apply.

The CFPB guide and the FHFA's regulatory text agree on the main points. A consumer can have only one principal dwelling at a time. A vacation home or other second home is not a principal dwelling. A dwelling that has just been bought or built is treated as the principal dwelling if it will become one within a year or upon the completion of construction. The guide says the term has the same meaning as in three existing provisions of Regulation Z.

On what a dwelling physically is, the two texts are not worded alike, and the difference is worth stating plainly. The FHFA's definition describes a residential structure that contains one to four units, and says the term includes condominiums, cooperatives, factory-built housing and manufactured homes used as residences. The CFPB guide says the dwelling need not be real property under the applicable law, and lists a condominium unit, a cooperative unit, a mobile home, a boat or a trailer, provided it is used as the consumer's principal dwelling. An institution reads the definition in the copy of the rule that governs it.

The purpose of the loan matters less than a reader of Regulation Z might expect. The preamble states that the CFPB's authority for this provision is FIRREA, not the Truth in Lending Act, even though the text is housed in Regulation Z. The CFPB guide draws the consequence: a transaction can be a mortgage under the rule even if it is exempt from other parts of Regulation Z, and a consumer, for this purpose, is a natural person to whom credit is offered or extended, even when the credit is primarily for business, commercial, agricultural or organisational purposes.

The guide illustrates the boundary with examples, summarised here:

• A business-purpose loan made to a natural person and secured by that person's principal dwelling is a mortgage under the rule.
• A business loan made to a corporation with a single shareholder is not extended to a consumer, and is outside the rule.
• Credit extended to a trust for tax or estate planning purposes counts as credit extended to a consumer.

Read together with the second-home point, the test gives a simple map, shown here with an illustration. A model used to value an owner-occupied home for a cash-out refinance sits inside the rule. The same model, used by the same lender to value the same borrower's holiday home, sits outside it, because that property is not the principal dwelling.

The five quality control factors

The obligation itself is a single sentence, given here as it stands in the CFPB's copy. Mortgage originators and secondary market issuers that engage in credit decisions or covered securitisation determinations, themselves or through or in cooperation with a third party or affiliate, must adopt and maintain policies, practices, procedures and control systems to ensure that the automated valuation models used in those transactions adhere to quality control standards designed to meet five factors.

The first four are the statute's. The fifth is the agencies' use of the power Congress gave them to account for any other factor they judged appropriate; the preamble says so directly. The agencies also observe in the preamble that existing nondiscrimination laws apply to appraisals and to automated valuation models, so the fifth factor does not create a new anti-discrimination law. What it does is make compliance with the existing ones part of the quality control an institution must design. The CFPB guide names the laws it has in mind: the Equal Credit Opportunity Act, its implementing Regulation B, and the Fair Housing Act.

Notice what the sentence regulates. It does not say a model must reach a given accuracy. It says an institution must have policies, practices, procedures and control systems, and that these must be designed to meet the factors. The regulation defines control systems as the functions, such as internal and external audits, risk review, quality control and quality assurance, and the information systems, that an institution uses to measure performance, make decisions about risk and assess the effectiveness of its processes and personnel, compliance included. The rule is addressed to how an institution governs its use of a model.

The rule sets no accuracy score for a valuation model. It asks whether the institution relying on the model can show how it keeps that model honest.

Why the rule contains no numbers

A reader looking for a confidence threshold, a sample size or a testing calendar will not find one. The preamble records that commenters asked for standardised confidence scores and that the agencies declined to set prescriptive standards. No frequency or sample size is given for random sample testing. The CFPB guide says the same thing from the other side: it sets no specific requirements for any of the five standards and says that different policies, practices, procedures and control systems may be appropriate for institutions of different sizes, business models and risk profiles.

The agencies gave their reasons. A flexible approach, the preamble says, would allow the implementation of the standards to evolve along with the technology, and would reduce compliance costs. A more prescriptive rule, they wrote, "could unduly restrict institutions' efforts" to set their risk management practices.

In place of numbers, the preamble points institutions towards guidance that already exists: the Model Risk Management Guidance, Appendix B of the Appraisal Guidelines, and guidance on third-party risk. It is careful about who those documents bind. The OCC, the Federal Reserve Board, the FDIC and the NCUA are parties to Appendix B. The OCC, the Board and the FDIC issued the Model Risk Management Guidance; the NCUA is not a party to it. The CFPB and the FHFA are parties to neither, though the preamble notes that the FHFA has model risk guidance of its own. Institutions not regulated by the agencies that issued a given document, the preamble says, "may still look to the guidance" for help. The agencies declined to write any of that guidance into the rule itself.

The result is a rule whose content depends on the institution. A large lender running its own models and a small originator using one outside product are held to the same five factors, and each is expected to meet them in a way scaled to its size, complexity and risk profile.

Third-party models and the firms that build them

The rule anticipates that an institution may not build its own valuation model. The operative sentence covers decisions made by an institution itself or through or in cooperation with a third party or affiliate, and the preamble states that the obligation applies regardless of whether the institution uses its own models or those of a third party.

The rule does not apply directly to the firms that develop or sell the models. The preamble says so, and the CFPB guide adds that institutions may work with model providers. The responsibility stays with the institution that makes the decision.

The CFPB guide spells out what that means for a business that buys in a model. It may work with the provider. It should not rely solely on the provider's own representations about testing and validation. It does not necessarily have to run its own testing and validation. But it must adopt and maintain processes for evaluating whether the provider's testing is sufficient, and those processes should be appropriate to the institution's size, complexity and risk profile. The guide refers readers to the CFPB's 2016 compliance bulletin on service providers.

On independent standard-setting organisations and third-party testing entities, the preamble says such bodies "could be beneficial". It neither endorses nor establishes one.

What the rule does not cover

The regulation lists three uses of an automated valuation model that fall outside it, and the preamble explains each.

Monitoring is the first exclusion. A model used only to watch the quality or performance of a portfolio of loans, or of mortgage-backed securities, is not being used to make a credit decision. The preamble adds that a model used to monitor, verify or validate a value that has already been determined is likewise outside the rule, and gives a tax assessment model as an example.

Reviews are the second. Where a model is used to check the quality of a collateral value that has already been determined, the rule does not apply, and the preamble says this holds regardless of when the review takes place.

Appraisers are the third. A certified or licensed appraiser who uses a model in developing an appraisal is not covered.

Beyond those three express exclusions, the limits of the rule follow from its definitions. It does not reach collateral that is not a consumer's principal dwelling, which leaves out second homes. It does not reach a loan that is not extended to a natural person, as the CFPB's corporate borrower example shows. It does not reach the people the definition of mortgage originator leaves out, real estate brokers acting only as brokers among them. And it does not regulate model developers.

Who enforces the rule

The statute divides enforcement in two. For financial institutions, and for subsidiaries that a financial institution owns and controls and that a federal regulator oversees, compliance is enforced by the institution's primary federal supervisor. For other participants in the market for appraisals of one-to-four unit single-family residential real estate, the statute gives enforcement to the Federal Trade Commission, the Consumer Financial Protection Bureau and state attorneys general.

The CFPB guide describes the same split in practical terms. The banking agencies and the NCUA enforce the rule against insured banks, savings associations, credit unions and their federally regulated subsidiaries. The CFPB, the Federal Trade Commission and state attorneys general have enforcement authority over non-depository participants. The guide notes one asymmetry: the Federal Trade Commission and the state attorneys general can enforce the standards but were not given the power to write them.

What the published texts leave open

Several points a reader may want answered are not answered in the documents this guide rests on. The CFPB's compliance guide does not address penalties for a breach, and it does not address record retention. Neither the regulatory text nor the guide says how often random sample testing must be run, how large a sample must be, or what level of confidence counts as high; those were deliberate choices, as the preamble explains.

The guide also carries a caution about its own status. It says that answers CFPB staff give to inquiries about the rule are informal, and are not official interpretations or legal advice. How the five factors apply to a particular institution therefore depends on its regulator, its size, the models it uses and the decisions it uses them for.

The framework itself can be stated in one line. A business that originates mortgages or issues mortgage-backed securities, and that uses a computer model to value a consumer's principal dwelling for a credit decision or a covered securitisation determination, has had to keep quality control designed around five factors since 1 October 2025. Everything else in the rule is a definition of one of the terms in that sentence.

Kooky, from Shaka

Kooky edits Agents Estate and builds Shaka, the payment router he made for real estate professionals. One payment comes in, and every agent, agency and party in the deal receives their signed share on closing date.

About Kooky and Shaka →