Regulation Z & TILA: What Fintech Lenders Must Disclose in 2027

Regulation Z turned 57 this year, and it has never been more dangerous to ignore. The CFPB's 2026 Supervisory Highlights — released March 2027 — identified Truth in Lending Act violations as the single largest category of findings across non-bank lenders, accounting for 34% of all enforcement referrals. For fintech companies that move fast and treat compliance as an afterthought, that statistic is an existential warning.

The irony is that most Reg Z failures are not exotic. They are arithmetic errors in APR disclosures, missing rescission notices, or closing-document timing mistakes that a competent compliance officer could catch in an afternoon. This guide is for fintech lenders — from embedded-lending startups to full-stack consumer credit platforms — who want to know exactly what regulators are looking for in 2027 and how to build disclosure workflows that do not blow up in an exam.

What Regulation Z Actually Requires (The Precise Version)

Regulation Z is the Federal Reserve's implementing rule for the Truth in Lending Act of 1968, codified at 12 CFR Part 1026 and now administered by the CFPB. Its core obligation is deceptively simple: before a consumer becomes obligated on a credit transaction, the lender must disclose the cost of that credit in a standardized, meaningful way.

In practice, that means five categories of mandatory disclosure:

1. Annual Percentage Rate (APR) — the cost of credit as a yearly rate, calculated using the actuarial method or the U.S. Rule method, accurate to one-eighth of one percentage point.
2. Finance Charge — the dollar cost of the credit, including interest, origination fees, and certain third-party fees.
3. Amount Financed — the net credit extended after prepaid finance charges are deducted.
4. Total of Payments — the sum the borrower will have paid when all scheduled payments are made.
5. Payment Schedule — the number, amounts, and timing of payments.

For mortgage-related credit, the Loan Estimate and Closing Disclosure forms (introduced by the TRID rule in 2015) layer on additional requirements around timing and fee tolerances. For open-end credit like credit cards and lines of credit, a separate regime under Subpart B applies, including periodic statement requirements and rate-change notices.

The APR Calculation Problem That Keeps Showing Up

The CFPB's 2026 exam findings singled out APR miscalculation as the most common Reg Z defect — and it is easy to see why. Fintech lenders frequently charge fees that are plainly finance charges under TILA but are coded in their loan origination systems as non-finance-charge items to keep disclosed APRs optically lower.

Common misclassified fees include:

• Subscription or "membership" fees required to access a credit product
• "Express funding" or expedited disbursement fees on personal loans
• Debt-protection or credit-insurance premiums added at origination
• Document-preparation fees charged by the lender itself

Under 12 CFR 1026.4, a fee is a finance charge if it is imposed as an incident to or a condition of the extension of credit. Rebranding it does not change its legal character. A fintech that charges a $49 "platform fee" on a $500, 30-day loan and excludes it from the APR calculation is understating the APR by roughly 480 percentage points on an annualized basis — the kind of number that ends up in a consent order.

Practical rule: If a borrower cannot get the loan without paying the fee, it is almost certainly a finance charge. Run it through your compliance team before coding it as excluded.

The tolerance for APR disclosure error is tight. For most closed-end loans, the disclosed APR must be within 0.125% (one-eighth of a percentage point) of the correctly calculated APR. For irregular transactions, the tolerance is 0.25%. Errors beyond these tolerances trigger liability under TILA's civil remedy provisions — up to twice the finance charge, capped at $2,000 per individual action, with no cap on class actions.

Right of Rescission: The Three-Day Clock and Its Exceptions

For non-purchase-money mortgages and home-equity lines of credit, Reg Z gives borrowers a three-business-day right to rescind after consummation, delivery of the rescission notice, or delivery of all required disclosures — whichever is latest. If the notice or disclosures are never properly delivered, the rescission period extends to three years.

This three-year tail is where fintech home-equity lenders get caught. A borrower who received a defective Closing Disclosure in 2024 can rescind in 2027. The CFPB does not need to find the defect during an exam — the borrower's attorney will find it when the borrower is in financial distress.

The required rescission notice must:

1. Identify the transaction.
2. Clearly disclose the borrower's rescission right.
3. State how to exercise the right and the deadline.
4. Disclose the lender's obligation to return money and release the security interest within 20 calendar days of rescission.

Digital delivery of rescission notices is permissible under the E-SIGN Act if the borrower has affirmatively consented to electronic records in a compliant consent flow — but "I agree to Terms of Service" language bundled with other consents does not satisfy ESIGN's separate-consent requirement. In 2027, the CFPB has made clear it will not accept that shortcut.

TRID Timing and Fee Tolerance: Where 90% of Mortgage Actions Originate

The CFPB's own enforcement data, cited in the 2026 Supervisory Highlights, confirms that TRID-related violations — specifically Loan Estimate timing failures and Closing Disclosure fee tolerance busts — account for the majority of mortgage-related TILA enforcement activity. Here is what the rules actually require:

Loan Estimate Timing

The Loan Estimate must be delivered or placed in the mail no later than three business days after receiving the consumer's application (defined by the six-piece application trigger under 12 CFR 1026.2(a)(3)(ii)) and no later than seven business days before consummation.

Closing Disclosure Timing

The Closing Disclosure must be received by the borrower at least three business days before consummation. "Received" means actual receipt — not mailing date. If mailed, the lender must assume three additional business days for delivery unless the borrower signs an acknowledgment of receipt.

Fee Tolerance Categories

Fees fall into three buckets:

• Zero tolerance: Lender and broker origination charges, transfer taxes, and fees for required services where the borrower was not given a permitted provider list. Any increase at all triggers a cure obligation.
• 10% tolerance: Recording fees and fees for required third-party services where the borrower chose from the lender's written provider list. Aggregate increases up to 10% are permissible.
• Unlimited tolerance: Prepaid interest, property insurance premiums, and fees for services the borrower selected outside the lender's list.

Fee tolerance cures must be made by lending credits at or before closing. The cure must equal the amount by which the tolerance was exceeded. There is no grace period after consummation — if the loan closes with a tolerance violation, the cure obligation is permanent.

Open-End Credit: What Fintech Card and BNPL Issuers Miss

Buy-now-pay-later products structured as open-end credit lines fall under Reg Z Subpart B. The CFPB's 2024 interpretive rule — which courts have since affirmed — confirmed that BNPL arrangements with a defined credit limit and the ability to make multiple purchases constitute open-end credit, not closed-end installment loans. That reclassification imposes a significant new compliance surface:

• Account-opening disclosures must be provided before the first transaction, including the APR, grace period, minimum payment formula, and balance computation method.
• Periodic statements must be sent for each billing cycle in which a balance of more than $1 exists or a finance charge has been imposed.
• Rate-increase notices must be provided at least 45 days before a rate increase takes effect on existing balances.
• Credit card-specific rules under the CARD Act (which amended TILA) require 21-day payment-to-due-date minimums and restrict over-limit fees.

For BNPL lenders, the periodic-statement requirement is particularly disruptive. Many platforms were designed around a four-payment installment model with no statement infrastructure. Retrofitting that into a compliant open-end statement system is a six-to-twelve month engineering project.

Building a Compliant Disclosure Workflow in 2027

Compliance with Regulation Z is not a policy document problem — it is a systems and data problem. The disclosures have to be generated by software, delivered through channels that create verifiable audit trails, and stored in a format that survives a six-year examination lookback. Here is a practical architecture:

1. Centralize fee classification. Every fee in your LOS (loan origination system) should be tagged with a TILA character: finance charge, excluded finance charge, or third-party passthrough. That tag should drive APR calculation automatically.
2. Automate tolerance monitoring. Build a comparison engine that checks the final Closing Disclosure fee against the last valid Loan Estimate for every fee in each tolerance bucket before the loan can close.
3. Timestamp every delivery event. Loan Estimate send time, Closing Disclosure send time, borrower receipt acknowledgment, and rescission deadline should all be written to an immutable log. Object storage with write-once policies works well here.
4. Test APR calculation quarterly. Run a sample of closed loans through an independent APR calculator (the CFPB publishes reference software) and compare to disclosed APRs. Systematic deviation is a sign of a coding bug, not a data entry error.
5. Train underwriters on application triggers. The six-piece application rule is commonly misunderstood. The moment your system collects name, income, SSN, property address, estimated value, and loan amount, the Loan Estimate clock starts — regardless of whether the borrower has formally "submitted" an application.

For lenders building this infrastructure from scratch, partnering with a compliance-aware API layer can cut 60–70% of the engineering time. The AtlasForge Financial API includes disclosure-timing logic, fee-tolerance monitoring, and APR calculation modules built to current Reg Z specifications — so your team is not rebuilding solved problems from a regulatory text.

What the CFPB Is Actually Prioritizing in 2027

The CFPB under its current leadership has shifted enforcement toward systemic violations — patterns of conduct that affect large numbers of consumers — rather than one-off errors. According to the CFPB's 2027 Supervisory and Enforcement Priority Statement, the bureau is specifically targeting:

• Fintech lenders with high APR products (above 36%) that obscure total cost through fee structures
• BNPL providers that have not updated disclosure systems following the 2024 open-end interpretive rule
• Mortgage lenders with TRID tolerance violation rates above 5% on closed loans
• Lenders whose electronic rescission notice delivery is not supported by compliant ESIGN consent

The practical implication: if your error rate is low and your remediation process is documented, you are likely to receive a matter requiring attention rather than a public enforcement action. But if examiners find a systemic APR underdisclosure — even one that results from a coding error rather than intent — expect a consent order, civil money penalties, and mandatory redress to affected borrowers. The Wall Street Journal's 2026 analysis of CFPB consent orders found a median civil money penalty of $4.2 million for TILA violations in non-bank lending, with the largest reaching $38 million.

Getting Ahead of the Exam

The fintech lenders who survive CFPB exams in 2027 are not the ones with the most elaborate compliance manuals — they are the ones whose systems generate accurate disclosures automatically and whose teams can produce a complete audit trail within 48 hours of a document request. That is an engineering outcome, not a legal outcome.

If you are building or scaling a consumer lending product and want to see how compliance-aware infrastructure changes the calculus, explore the AtlasForge Financial API or review how Safe to Spend 365 approaches real-time financial obligation tracking in a way that complements your borrower-facing disclosure strategy. Compliance at scale starts with data architecture — and that conversation is worth having before your next product launch, not after your first exam finding. Reach out through our contact page to talk with our team about where your current disclosure workflow has exposure.

Further reading

• Regulation E in 2027: Electronic Funds Transfer Rules