Avoid $500–$1,500 Penalties: U.S. Mortgage SMS Opt In Checklist
You can text borrowers, but only after you get and document prior express written consent that names your company and describes the messages you’ll send. That’s the standard the Federal Communications Commission (FCC) enforces under the TCPA. Skip the paperwork and you’re not looking at a warning. You’re looking at statutory damages, per message.
TL;DR:
- Sending marketing texts without documented prior express written consent can lead to statutory damages ranging from $500 to $1,500 per violation.
- Consent disclosures must explicitly name the company, describe message types, and cannot be required as a condition for loan approval or services.
- Proper records of consent include the exact disclosure text, timestamps, source IP or phone number, and must be retained for at least four years.
- Revocations of consent can be made through any reasonable method, including verbal requests, and must be processed immediately across all communication channels.
- Mortgage teams should integrate automated consent capture, opt-out enforcement, and audit logs into their CRM to maintain TCPA compliance effectively.
Table of Contents
- What Are the TCPA and FCC Rules for SMS Opt-In in Mortgages?
- How Do You Write Compliant SMS Opt-In Language?
- What Records Prove SMS Consent Was Properly Obtained?
- How Should Lenders Handle Opt-Out and Revocation Requests?
- Why Do A2P/10DLC and TCR Registration Matter for Mortgage Texting?
- How Do You Operationalize Compliant SMS Programs?
- Does CAN-SPAM Apply to Mortgage Text Messaging?
- How Do You Protect Borrower Data Collected Through SMS?
- What Do Real SMS Compliance Violations in Mortgage Look Like?
- How Does SMS Opt-In Affect Borrower Engagement?
- How Do You Request Consent at Different Mortgage Transaction Stages?
- Can You Use SMS Opt-In Beyond Initial Mortgage Marketing?
- Compliance Is a Trust Signal, Not Just a Legal Shield
- Get Compliant SMS Opt-In Built Into Your CRM
- Sources
What Are the TCPA and FCC Rules for SMS Opt-In in Mortgages?
The Telephone Consumer Protection Act treats autodialed or prerecorded texts the same as autodialed calls. Before you send a promotional text to a borrower’s cell phone, you need prior express written consent, and the FCC’s guidance is specific about what that consent has to include: a clear disclosure of who’s texting, what kind of messages they’ll receive, and confirmation that the borrower isn’t required to consent as a condition of getting a loan.
There’s an important distinction between transactional texts and marketing texts. A servicing update about an escrow shortage or a closing reminder tied to an existing loan file generally falls under a looser standard than a cold marketing blast pitching a refinance. Regulators and courts still expect consent for both, but marketing texts carry more legal exposure because they’re the ones most often flagged in class actions.
Consumers can revoke consent through any reasonable method, not just by texting “STOP.” A borrower who says “please stop texting me” in a chat window or tells a loan officer verbally has revoked consent, and lenders must honor it promptly.
Recent Federal Register rule changes have adjusted how prior express written consent gets defined and applied, including vacaturs that shifted the legal landscape mid-year. Mortgage compliance teams need to track these updates, not assume last year’s playbook still holds.
TCPA violations carry statutory damages that can reach into the thousands of dollars per unauthorized text, and plaintiffs’ attorneys actively pursue mortgage companies because loan files contain rich, provable contact histories.
- Prior express written consent is required before sending marketing texts to a cell phone.
- Consent disclosures must name the company and describe message types.
- Consent cannot be a condition of loan approval or service.
- Revocation is valid through any reasonable method, spoken or written.
- Damages range from $500 to $1,500 per violation, and can be trebled for willful conduct.
How Do You Write Compliant SMS Opt-In Language?
Getting the wording right up front saves you from rebuilding your consent flow after a compliance review flags it. The safest approach borrows language directly from what regulators and industry guides recommend for mortgage lenders.
For a web checkbox on a loan application or landing page, keep the disclosure separate from other terms and unchecked by default:
For a standalone text opt-in, such as a borrower replying to an initial outreach text, confirm consent in the very next message:
For verbal capture during a phone call, loan officers should read a similar disclosure aloud and log the date, time, and borrower’s affirmative response, ideally backed by an e-signature or recorded confirmation.
- Never bundle SMS consent with required loan disclosures or make it a condition of service.
- Always disclose frequency, rates, and opt-out method in the same message or screen.
- Log verbal consent with a timestamp and, where possible, a follow-up written confirmation.
What Records Prove SMS Consent Was Properly Obtained?
An auditor or plaintiff’s attorney won’t take your word for it. You need a record that reconstructs exactly what the borrower saw and agreed to, tied to that specific loan file.
- Capture the exact text of the disclosure shown at the moment of consent, not a later version.
- Timestamp the consent event and store the IP address or phone number source.
- Save the borrower’s signature, checkbox confirmation, or recorded verbal agreement.
- Link the consent record to the borrower’s file and, where applicable, their NMLS Consumer Access loan officer record.
- Retain records for at least four years, the general TCPA statute of limitations window, though many compliance teams keep them for the life of the loan plus several years.
- Export logs in a searchable format so legal or compliance staff can pull a single borrower’s history in minutes, not days.
A detailed TCPA compliance guide for mortgage teams walks through how to structure these records so they hold up under review.
How Should Lenders Handle Opt-Out and Revocation Requests?
Opt-outs aren’t optional paperwork. They’re the mechanism that keeps a compliant program compliant, and mishandling them is where a lot of mortgage companies get burned.
Borrowers can opt out with “STOP,” but also with phrases like “quit texting me,” “remove me,” or a verbal request during a call. Your systems and staff both need to recognize nonstandard language as valid revocation, not just the standard keyword.
- Send exactly one confirmation text after an opt-out, containing no marketing content, per FCC guidance.
- Suppress the borrower across every channel, SMS, phone, chat, and email campaigns tied to that contact.
- Process revocation requests immediately; delays of even a few days create exposure.
- Flag any campaign still reaching an opted-out borrower as a compliance failure requiring immediate review.
Pro Tip:Build your opt-out logic once, at the CRM level, so a “STOP” reply automatically suppresses every automated sequence tied to that borrower, instead of relying on individual loan officers to remember to update five different systems.
Why Do A2P/10DLC and TCR Registration Matter for Mortgage Texting?
Consent alone doesn’t guarantee your texts get delivered. Carriers now filter unregistered or miscategorized traffic before it ever reaches a borrower’s phone, regardless of whether you followed every TCPA rule.
Application-to-person messaging over long code numbers, known as A2P/10DLC, requires brand and campaign registration through The Campaign Registry (TCR). Mortgage teams sending anything beyond a handful of texts a day need to register their business and declare what kind of campaign they’re running, whether that’s account notifications, marketing, or mixed content.
- Register your brand and campaign type with TCR before scaling any SMS program.
- Categorize campaigns accurately; mislabeling marketing texts as transactional risks throttling.
- Avoid spam trigger words and excessive links, which carriers flag automatically.
- Monitor your trust score regularly and remediate flagged campaigns before volume increases.
Carrier registration has become mandatory in practice for higher-volume senders. Even a fully consented, GDPR-compliant campaign gets throttled or blocked if the underlying brand and campaign aren’t properly registered with TCR.
How Do You Operationalize Compliant SMS Programs?
Rules on paper don’t protect you. Controls built into your daily workflow do. The gap between knowing the TCPA and actually complying with it is almost always a systems problem, not a knowledge problem.
Start with a checklist your team actually follows: capture consent at every entry point (web forms, verbal calls, referral intake), timestamp and store it immediately, sync consent status to your loan origination system (LOS) so no one texts a borrower who hasn’t opted in, and automate opt-out enforcement so it doesn’t depend on someone remembering.
- Require consent capture at every lead intake point, no exceptions for “warm” referrals.
- Sync consent and opt-out status between your CRM and LOS in real time.
- Automate suppression lists so revoked contacts are blocked across every future campaign.
- Choose vendors that provide exportable audit logs and registered A2P partnerships.
Loan Officer AI builds these controls directly into its workflow: consent capture tied to the borrower record, automated opt-out enforcement across every channel, and audit-ready logs that sync with your LOS. CTIA’s Messaging Principles & Best Practices frame consent and opt-out handling as the foundation of message trust, and CTIA’s own guidance notes that carriers reward senders who maintain clean opt-out records with better deliverability. A platform comparison of TCPA-safe mortgage texting tools is worth reviewing before you commit to a vendor.
Does CAN-SPAM Apply to Mortgage Text Messaging?
The CAN-SPAM Act governs commercial email, not SMS, so it doesn’t directly regulate mortgage text campaigns. But mortgage lenders running multichannel outreach, texts paired with email drip sequences, still need to comply with CAN-SPAM for the email side, and the overlap trips people up.
CAN-SPAM requires accurate sender information, a working opt-out mechanism, and honoring unsubscribe requests within 10 business days. If your CRM sends a borrower a text and an email as part of the same nurture sequence, an opt-out on one channel doesn’t automatically satisfy the other unless your systems are built to sync suppression across channels.
The FCC, not the Federal Trade Commission, governs the texting side through the TCPA. That means mortgage compliance officers are juggling two regulatory frameworks with different opt-out timelines, different disclosure requirements, and different enforcement bodies. A lender who treats “unsubscribe” as one universal button across email and SMS is making an assumption the law doesn’t actually support.
The safest posture treats every channel’s opt-out as channel-specific unless your platform explicitly links them. If a borrower opts out of texts, suppress texts. If they unsubscribe from email, suppress email. Build your CRM logic to cross-reference both, but don’t assume regulators will read a single opt-out as blanket consent withdrawal across every communication method you use. Document which framework applies to which message type in your compliance procedures, so an examiner or plaintiff’s attorney can see you understood the distinction rather than treating all messaging as interchangeable.
How Do You Protect Borrower Data Collected Through SMS?
Every phone number, consent timestamp, and message thread you store is borrower data that carries the same sensitivity as their loan application. Mortgage companies handle Social Security numbers and income details daily, but text consent records often get treated as an afterthought, stored in spreadsheets or disconnected systems with far less protection than the loan file itself.
Encrypt consent records and message logs both in transit and at rest. A CRM that stores phone numbers, opt-in timestamps, and message history should apply the same access controls you’d expect for credit report data, role-based permissions, audit trails on who accessed what, and encrypted backups.
Limit access to consent and messaging records to staff who need them for servicing or compliance review. A loan officer doesn’t need visibility into every borrower’s full text history across the company, just their own pipeline.
Vet any third-party SMS vendor for its own security posture before you integrate it with your LOS. Ask specifically about data retention policies, breach notification procedures, and whether the vendor’s servers meet standards comparable to what your core banking systems require. A vendor that can’t answer basic questions about encryption or access logging is a liability, not a convenience.
A borrower who paid off a loan five years ago and never re-consented shouldn’t still be sitting in an active marketing list.
What Do Real SMS Compliance Violations in Mortgage Look Like?
TCPA class actions against mortgage and financial services companies follow a predictable pattern, and it’s worth knowing what it looks like before it happens to you.
The most common violation isn’t a rogue loan officer texting without any consent at all. It’s a lender who obtained consent for one purpose, say, a rate quote request, and then used that same number for an ongoing marketing campaign months later without renewing consent or confirming the borrower still wanted messages. Courts have repeatedly sided with plaintiffs when consent scope didn’t match the actual use.
Another frequent pattern involves purchased or scraped lead lists. A mortgage company buys a list of “interested homeowners” from a third-party lead generator, assumes consent transferred with the list, and starts texting. It didn’t transfer. Consent is specific to the company that collected it and the purpose disclosed at the time, and courts have not been sympathetic to lenders who relied on a vendor’s assurance that a list was “TCPA clean.”
A third pattern is failure to honor opt-outs across systems. A borrower texts “STOP” to one campaign, but a separate marketing automation tool, unaware of the request, keeps sending. Regulators and plaintiffs’ attorneys treat this as a straightforward violation regardless of intent, because the law doesn’t care which internal system dropped the ball.
Settlements in mortgage-adjacent TCPA cases have run into the millions when class sizes are large, since each unauthorized text is a separate violation multiplied across thousands of contacts. The financial exposure scales with your database size, which is exactly why lenders with larger borrower lists need tighter controls, not looser ones.
How Does SMS Opt-In Affect Borrower Engagement?
Compliant opt-in isn’t just a legal hurdle. It changes how borrowers respond to you, and the effect is measurable in ways that matter to a loan officer’s pipeline.
Borrowers who explicitly opt in to text communication read those messages faster and respond more often than borrowers reached through cold calls or unsolicited email. A text confirming a document request or a closing date gets seen within minutes for most people, since text notifications sit on a lock screen in a way email doesn’t.
The opt-in process itself sets expectations. A borrower who agreed to receive “rate updates and loan status notifications” isn’t surprised or annoyed when your text matches that description. A borrower who never explicitly consented and receives an unsolicited marketing text is far more likely to mark it as spam, complain to their carrier, or file a TCPA complaint, none of which help your deliverability or your reputation.
There’s a compounding effect here too. Clean consent and honored opt-outs keep your sender reputation strong with carriers, which means your legitimate messages, closing reminders, rate lock expirations, document requests, actually reach borrowers instead of getting filtered as suspected spam. Lenders who treat opt-in as a formality to rush past often end up with worse deliverability across their entire messaging program, not just their marketing campaigns.
Framed correctly, SMS opt-in becomes a relationship-building moment rather than a legal checkbox. A borrower who understands exactly what they’re signing up for, and trusts that a STOP reply will actually stop the messages, engages more openly throughout the loan process.
How Do You Request Consent at Different Mortgage Transaction Stages?
Consent language should match where the borrower actually is in the loan process, not a generic template used for every touchpoint.
At the initial lead stage, before any application exists, keep the disclosure broad but honest: describe that you’ll send rate information, loan program updates, and general mortgage content. This is the highest-risk stage for TCPA exposure because the relationship is thinnest, so the disclosure needs to be crystal clear that texting isn’t required to get a quote.
During active loan processing, once an application is underway, consent language can reference specific transactional content: document requests, appraisal scheduling, underwriting status updates. Many of these fall closer to the transactional end of the spectrum, but best practice is still to obtain explicit consent rather than assume it, since courts haven’t drawn a bright line every lender can rely on.
At closing, borrowers often expect and want text updates: closing disclosure timing, wire instructions confirmations (never actual wire details over SMS, for security reasons), and appointment reminders. Consent obtained earlier in the process should already cover this, but it’s worth confirming preferences remain current, especially if weeks or months passed between application and closing.
Post-closing, for servicing communications, a fresh consent conversation makes sense if the original opt-in was scoped narrowly to the origination process. Servicing texts about payment reminders, escrow changes, or refinance opportunities are a different use case, and lenders who treat origination consent as covering the entire loan lifecycle are making an assumption worth documenting carefully rather than leaving to guesswork.
Can You Use SMS Opt-In Beyond Initial Mortgage Marketing?
Yes, and this is where a lot of mortgage companies leave value on the table. SMS consent obtained properly covers far more than the initial marketing push that got the borrower into your pipeline.
Servicing communications, payment due reminders, escrow analysis notifications, and annual statement availability, benefit enormously from text delivery. Borrowers open these messages far faster than servicing emails, which often land in spam folders or get ignored entirely.
Refinance and HELOC opportunity alerts represent one of the highest-value uses of an existing opted-in database. A loan officer monitoring rate movements or home equity changes can trigger a compliant text the moment a past client’s situation shifts, rather than relying on that client to remember to check in. This only works, though, if the original consent scope covers ongoing marketing communications, not just origination-specific messages, so scoping your initial disclosure carefully pays off months or years later.
Realtor partnership touchpoints, coordinating showing schedules or pre-approval letter delivery, also run through SMS in many workflows, though these typically involve business-to-business communication rather than consumer-facing TCPA concerns.
The throughline is that a well-scoped, properly documented opt-in isn’t a one-time compliance task. It’s an asset that supports the entire borrower relationship, from first contact through servicing and eventual refinance, as long as your records clearly show what the borrower agreed to receive.
Compliance Is a Trust Signal, Not Just a Legal Shield
Lenders who treat SMS opt-in as a box to check usually end up with worse results than lenders who treat it as the start of a relationship. Compliance-first teams see better open rates and fewer spam complaints, not because regulators reward them, but because borrowers respond better to communication they actually agreed to receive.
The practical takeaway: build consent capture and opt-out enforcement into your systems once, correctly, rather than patching it loan officer by loan officer. The teams that get this right stop thinking about TCPA as friction and start treating it as the foundation of a messaging program that actually performs.
— Jared Hart
Get Compliant SMS Opt-In Built Into Your CRM
Manually tracking consent language, opt-out timestamps, and audit logs across spreadsheets is how mortgage teams end up exposed. Loan Officer AI is the alternative to that patchwork approach: consent capture, opt-out enforcement, and audit-ready logs live inside the same platform that already manages your pipeline, so there’s no separate system to keep in sync with your LOS.
The Mortgage CRM captures consent at every borrower touchpoint, automatically suppresses opted-out contacts across SMS, phone, and email campaigns, and exports the audit trail examiners actually ask for. Brokerages managing multiple loan officers get centralized visibility into consent status across the whole team, while independent originators get the same automated protection without hiring a compliance staffer. Whether you’re rebuilding a texting program from scratch or tightening up an existing one, start with a demo of the mortgage CRM and see how consent, opt-out, and audit logging work together before your next campaign goes out.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
