# Non-QM loan QC: what changes from agency QC

Updated September 26, 2026

A non-QM loan meets no qualified mortgage definition in Regulation Z. For transactions covered by the ability-to-repay rule, QC checks the documented ATR determination and applicable verification requirements, alongside the lender's or investor's guidelines. Determine coverage before applying those requirements; business-purpose credit and other specified exemptions need separate treatment.

## Key numbers

- **8 factors** the ATR determination must consider; verify relied-upon information under the rule and its exceptions (1026.43(c))
- **30 years** maximum term under the general QM definition (1026.43(e)(2))
- **3 years** after consummation to keep evidence of ATR compliance (1026.25(c)(3))

## The rule you are testing

Every covered transaction needs "a reasonable and good faith determination at or before consummation that the consumer will have a reasonable ability to repay the loan according to its terms." Regulation Z, 12 CFR 1026.43(c), requires that determination to consider eight factors. Verify the information relied upon using reasonably reliable third-party records under 1026.43(c)(3)–(4), subject to the specified exceptions; the payment and ratio factors also require calculations.

A QM carries a safe harbor or presumption of compliance. A non-QM loan doesn't, so the file itself has to show the work. For each factor, this is what QC should find in it:

| ATR factor, 1026.43(c)(2) | What QC should evidence |
|---|---|
| (i) Current or reasonably expected income or assets, other than the dwelling | Income and assets relied on, verified with third-party records (c)(4) |
| (ii) Current employment status, if employment income is relied on | Verification of employment. Oral is acceptable if recorded (c)(3)(ii) |
| (iii) Monthly payment on the loan | Payment at the greater of the fully indexed or introductory rate, fully amortizing (c)(5) |
| (iv) Payment on any simultaneous loan | Second-lien or HELOC payment included (c)(6) |
| (v) Mortgage-related obligations | Property taxes, creditor-required insurance premiums, association dues, ground rent, leasehold payments (b)(8) |
| (vi) Current debts, alimony, child support | Credit report plus any obligations not on it |
| (vii) DTI or residual income | Calculation per (c)(7), measured against the lender's threshold |
| (viii) Credit history | Credit report and any nontraditional references relied on |

The verification exceptions matter. Employment status can be verified orally if the creditor records the information. If a creditor relies on a credit report to verify current debts and the application discloses a debt not on that report, the creditor need not independently verify that obligation (1026.43(c)(3)(ii)–(iii); comment 43(c)(3)-6). Contrary information still has to be addressed. Do not turn the eight-factor requirement into a demand for eight separate third-party documents.

## Confirm the loan is covered, then confirm it's non-QM

Settle coverage first. ATR applies to every covered transaction, which the rule defines as consumer credit secured by a dwelling. Regulation Z doesn't apply at all to "an extension of credit primarily for a business, commercial or agricultural purpose" (1026.3(a)(1)).

The official interpretation, comment 3(a)-4, deems credit to acquire, improve or maintain rental property that isn't owner-occupied to be for business purposes. If the owner expects to occupy the property for more than 14 days in the coming year, it isn't treated as non-owner-occupied.

That matters for DSCR and other investor-property programs. Check that the file records how the lender decided the loan's purpose and that the decision matches the occupancy evidence. If the loan is consumer-purpose, ATR applies in full, whatever the program calls itself.

Exemptions are narrow. HELOCs and timeshares fall outside the section. Reverse mortgages, bridge loans and construction phases of 12 months or less, Housing Finance Agency programs, and certain community-development and nonprofit creditors are exempt from (c) through (f) (1026.43(a)).

Non-QM status turns on the loan's features and pricing, not the program's name. The general QM definition in 1026.43(e)(2) requires:

- regular, substantially equal payments with no negative amortization, no interest-only period and no balloon (with limited exceptions)
- a term of no more than 30 years
- points and fees within the limits in (e)(3)
- underwriting at the maximum rate that can apply in the first five years
- income, assets, debts and DTI or residual income that are considered and verified
- an APR below the priced thresholds over the average prime offer rate in (e)(2)(vi)

FHA, VA and USDA loans are QMs under those agencies' own definitions (1026.43(e)(4)). A loan that fits none of these, or the small-creditor and seasoned-loan variants, is non-QM. Interest-only payments and terms over 30 years, for example, fall outside (e)(2)(i)–(ii).

## What the rule leaves to the lender

A great deal, which is why the investor guideline matters. The CFPB commentary says the rule does "not provide comprehensive underwriting standards" and doesn't "specify how much income is needed to support a particular level of debt or how credit history should be weighed" (comment 43(c)(1)-1).

There's no DTI or residual income threshold: "an appropriate threshold... is for the creditor to determine" (comment 43(c)(7)-1). There's no minimum credit score, and creditors may weigh credit history "as much or as little" as appropriate. What does count is consistency. Applying standards inconsistently, or differently from similar loans "without reasonable justification," may be evidence the determination wasn't reasonable or in good faith.

So never ask whether the loan meets the rule's DTI cap; there isn't one. Ask whether the loan followed the lender's or investor's written standard, whether each ATR factor was considered, and whether the relied-upon information was verified under the applicable requirements and exceptions.

## Bank-statement, DSCR and asset-based income

The investor defines the program mechanics: which accounts count, the statement period, expense factors, how transfers are excluded, and the DSCR formula and minimums. Take them from the investor's guideline in effect for the loan, not a generic template. Regulation Z adds a floor on verification.

Bank statements are acceptable records, since "financial institution records" are among the listed third-party records for income or assets (1026.43(c)(4)(iv)).

But every deposit counted as income has to be identified. A creditor fails (c)(4) "if it observes an inflow of funds into the consumer's account without confirming that the funds are income," and the commentary's example is an unidentified $5,000 deposit that could be loan proceeds (comment 43(c)(4)-4). Trace each deposit counted as income, or confirm the investor's exclusion method was applied.

Assets can be the repayment source. The creditor may rely on income, "assets other than the dwelling," or both (1026.43(c)(2)(i)), and total monthly income for the DTI includes "any income from assets."

A creditor has to verify only the income or assets it actually relied on (comment 43(c)(4)-1), so the file has to show which figures those were.

## Recompute the payment

This is where interest-only and ARM loans go wrong. For ATR, the payment uses the greater of the fully indexed rate and any introductory rate, with fully amortizing, substantially equal monthly payments (1026.43(c)(5)(i)). For an interest-only loan, 1026.43(c)(5)(ii)(B) requires that payment to repay the loan amount over the term remaining at recast.

A balloon loan that isn't higher-priced uses the maximum payment in the first five years; a higher-priced balloon loan uses the maximum payment in the full schedule, including the balloon (1026.43(c)(5)(ii)(A)).

An illustrative case: a $400,000 consumer-purpose interest-only ARM with a 30-year term. The first 10 years are interest-only at an introductory 7.00%, and the fully indexed rate at consummation is 8.00%.

- Initial interest-only payment: $400,000 × 7.00% ÷ 12 = $2,333.33
- ATR payment under (c)(5)(ii)(B): 8.00%, the greater rate, amortizing $400,000 over the 20 years left at recast = about $3,345.76 principal and interest
- Then add taxes, insurance and HOA dues (factor (v)) and any simultaneous loan (factor (iv)), recompute the DTI or residual income, and compare it with the investor's maximum

If the file qualified the borrower at $2,333.33, the ATR payment was understated by more than $1,000 a month. That's a finding whatever the investor's ratio limit.

## Two more rule-level checks

A covered transaction may carry a prepayment penalty only if it's otherwise permitted by law, has an APR that can't increase, is a QM and isn't a higher-priced mortgage loan (1026.43(g)(1)). A consumer-purpose non-QM loan with a prepayment penalty is a finding.

Evidence of ATR compliance must be kept for three years after consummation (1026.25(c)(3)).

## Where agency QC habits don't carry over

Agency QC tests a loan against a published guide with prescribed QC mechanics. Fannie Mae, for example, requires every random full-file review to reverify income and employment, tax returns, assets, credit, property value and occupancy, and to re-underwrite when a reverification differs (D1-3-03). Regulation Z sets no QC sampling, reverification or defect-severity rules. For non-QM, those come from the lender's QC plan and the investor's contracts, and QC should cite them by version.

The lender remains responsible for its ATR determinations and its QC program.

## FAQ

**Does the ability-to-repay rule apply to non-QM loans?**
Yes. Every covered transaction must meet 1026.43(c). QM status only adds a safe harbor or presumption of compliance (1026.43(e)(1)).

**Is there a maximum DTI for non-QM loans?**
Not in Regulation Z. The creditor sets the threshold (comment 43(c)(7)-1). Investor guidelines usually set one, and QC tests against that.

**Do DSCR loans need an ATR review?**
Only if they are consumer credit. Credit for non-owner-occupied rental property is deemed business-purpose under comment 3(a)-4, but QC should confirm the file supports that determination.

## Sources

- 12 CFR 1026.43, Minimum standards for transactions secured by a dwelling (eCFR, current as of September 24, 2026; last amended March 1, 2026): https://www.ecfr.gov/current/title-12/chapter-X/part-1026/subpart-E/section-1026.43
- 12 CFR 1026.43 with official interpretations (CFPB, current version): https://www.consumerfinance.gov/rules-policy/regulations/1026/43/
- 12 CFR 1026.3, Exempt transactions, with comment 3(a)-4 (CFPB, current version): https://www.consumerfinance.gov/rules-policy/regulations/1026/3/
- 12 CFR 1026.25, Record retention (eCFR; last amended October 10, 2017): https://www.ecfr.gov/current/title-12/chapter-X/part-1026/subpart-D/section-1026.25
- Fannie Mae Selling Guide D1-3-03, Lender Post-Closing Quality Control Reverifications (04/01/2026; Guide published September 2, 2026): https://selling-guide.fanniemae.com/sel/d1-3-03/lender-post-closing-quality-control-review-data-integrity

This guide summarizes agency requirements as of the date above. It is not legal advice.