It is a slow Tuesday and you want to fill the pipeline, so you type a post into your phone. “Rates just dropped. I can get you 5.99% with zero down. DM me.” You hit publish, three people react, and you feel good for an hour. That one post just broke at least three federal advertising rules and probably a state one. If a competitor screenshots it, or the wrong examiner scrolls past, “5.99%, zero down, DM me” is not a lead magnet. It is evidence.
Here is the plain answer. You can absolutely advertise rates, payments and offers, but the moment your ad states a number like a payment, a down payment, or a rate, federal law switches on required disclosures. Skip them, or quote a number you cannot deliver, and you are exposed under Regulation Z, the MAP Rule, and the catch-all the CFPB calls UDAAP. The fix is not to go quiet. It is to know which words flip the switch, and what to say once they do.
This is written for a one-to-fifteen-person shop with no legal department, where the person writing the ad is usually the person closing the loan. It is educational, not legal advice; when real money is on the line, run it past counsel.
What a bad rate ad actually costs
Mortgage marketing is one of the most watched corners of advertising law. In the National Association of Realtors’ 2025 Profile of Home Buyers and Sellers, 88% of buyers purchased through a real estate agent or broker, and 91% of sellers used an agent, tied for the highest share on record (NAR, 2025). When nearly every deal runs through a referral network, one sanctioned ad costs more than a fine. It costs the realtor partners who no longer want their name next to yours.
The fine is real too. In 2020 the CFPB swept up mortgage companies that mailed deceptive ads for VA-guaranteed loans, citing deception, the MAP Rule, and Regulation Z. One lender, Low VA Rates, paid an $1.8 million civil money penalty for misrepresenting terms it was not prepared to offer and failing to make required disclosures (CFPB, 2020). Across the nine-company sweep the CFPB collected more than $4.4 million (CFPB, 2020).
Civil money penalties for deceptive mortgage advertising, USD thousands, from the CFPB’s 2020 VA-advertising sweep. Low VA Rates is confirmed on the CFPB order page; the rest are reported from the consent orders. Source: CFPB, 2020.
Those orders are from 2020, but that is not a reason to relax: the rules did not change, and a state regulator or a plaintiff’s attorney can act on the same ad long after the federal spotlight moves on.
The four rulebooks on every ad
Every rate ad sits under four separate sets of rules at once, and they stack: Regulation Z (Truth in Lending), which governs how credit terms appear; the MAP Rule, also called Regulation N, which bans material misrepresentations; UDAAP, the catch-all against unfair, deceptive, or abusive practices; and state advertising law, including the NMLS-ID-on-ads requirement. The rest of this guide walks each one, with the failure mode that trips up small shops and the words that keep you clear.
Regulation Z: trigger terms and the APR
This is the rule most loan officers break without knowing it exists. If a closed-end credit ad states any one of four “triggering terms,” it must carry a block of required disclosures. The four triggers are the amount or percentage of a down payment, the number of payments or period of repayment, the amount of any payment, and the amount of any finance charge (12 CFR 1026.24(d)(1)).
State any of those and you must also disclose, clearly and conspicuously, the down payment, the terms of repayment over the full loan term, and the APR using the words “annual percentage rate.” If the rate can rise after closing, you have to say that too (12 CFR 1026.24(d)(2)). The catch is the word “any”: a negative counts, so “no down payment” triggers the disclosures just like “3% down.”
There is a second trap in the same rule. When an ad states a rate, it must call it an “annual percentage rate,” and a note rate can only appear alongside the APR, never more prominently (12 CFR 1026.24(c)). A giant “5.99%” with a tiny “APR 6.74%” underneath is the textbook violation, and if the rate can increase, which it can on any adjustable product, the ad has to say so.
Where it bites. The short social post. “$1,750/mo” or “zero down” with nothing else looks harmless because it is short, and short is the problem: there is no room for the terms and the APR, so the ad is non-compliant the second it goes up. There is no social-media exemption in Regulation Z, and your state may treat a social post as an advertisement. “As low as” is no escape, since the hedge does not get you out of the APR rule.
The fix is a discipline, not a lawyer on retainer. If you name a payment or a down payment, you owe the full disclosure block; if the format cannot hold it, change the message. “Rates may have moved. Want me to run your numbers?” states nothing, triggers nothing, and still gets the DM. That is the logic behind our rate-drop callback scripts: the number belongs in the call, not the billboard.
The MAP Rule and keeping records
The Mortgage Acts and Practices Advertising Rule, better known as the MAP Rule or Regulation N, is broader and blunter than Regulation Z. It makes it a violation to make any material misrepresentation, expressly or by implication, about any term of a mortgage (12 CFR 1014.3), then lists the lies it cares about: the rate, the fees, whether a rate is fixed or variable, your affiliation with the borrower’s current lender, and their eligibility or likelihood of approval.
Two items catch small shops most. One is implying a government connection: the rule bars suggesting, through logos or wording, that your offer comes from or is endorsed by the VA, FHA, or any government body, and the mailer dressed up as an official notice was at the center of the 2020 sweep. The other is the word “fixed”: calling an adjustable product “fixed,” or an introductory rate permanent, is named in the rule.
Where it bites. “No fees” and “no closing costs.” Almost always a cost is hiding somewhere, and if “no closing costs” really means a higher rate, saying it without that context is a misrepresentation by implication. Never describe a benefit by subtraction unless you can state, in the same breath, what the borrower pays instead.
The MAP Rule also has a part nobody reads until an examiner asks: you must keep copies of your materially different ads, and documents describing the products you advertised, for 24 months from the last date you ran each one (12 CFR 1014.5). For a shop that improvises ads on a phone, this is the quiet killer: the post is gone the day you delete it, and the texts are scattered across a dialer. When a regulator asks to see every version you ran and when, a shrug is not an answer. Run outreach through a system that logs every message, timestamp, and template version by default, and the archive becomes a byproduct of how you work.
UDAAP and bait advertising
UDAAP is the backstop. Even if an ad clears Regulation Z and the MAP Rule, the CFPB can still act on it as an unfair, deceptive, or abusive act or practice (12 U.S.C. 5531 and 12 U.S.C. 5536). Deceptive means an omission or claim likely to mislead a reasonable consumer; unfair means it causes substantial injury the consumer cannot reasonably avoid. The CFPB spells out how it evaluates these in its UDAAP examination procedures.
The highest-risk pattern UDAAP catches is bait advertising: promoting a rate, payment, or approval you are not prepared to deliver to the people who respond. If you advertise “5.5%” and nobody who calls can get it because it required an 800 score, 40% down, and points nobody would pay, that is the bait-and-switch theory. That the 5.5% existed on paper for one borrower does not matter; the ad set an expectation the business could not meet, so it is deceptive.
Where it bites. Promising outcomes you do not control. “Get approved today,” “guaranteed approval,” and “we’ll beat any rate” all imply a certainty that depends on an underwriter, a credit profile, and a market you cannot promise. Automation helps here: set the compliant wording once and every message inherits it, instead of improvising a new promise when the pipeline goes quiet.
Your state adds its own layer
Here is the correction that surprises people. The federal SAFE Act requires you to hold an NMLS unique identifier, but the rule that the identifier actually appear on your advertising is state law, not a direct federal mandate (12 CFR Part 1008). Nearly every state adopted it, so the practical answer is still “put your NMLS ID on every ad.” The details vary, and two big states go further.
California. If you are a DRE-licensed originator, the state wants your eight-digit DRE license number on first-point-of-contact solicitation materials, and because you are an MLO, your NMLS identifier has to appear too. That is two numbers on your ads, and the DRE publishes a chart of what goes where in its Form RE 858 (California DRE). California splits MLO licensing between the DRE and the DFPI, so confirm which regulator you fall under first.
Texas. Under the Texas rule, an advertisement includes a social media post by name, and it must carry the company’s name and NMLS ID, the originator’s name and NMLS ID, and the company website (7 Tex. Admin. Code 56.203). The one break: for social media, the state’s guidance lets you satisfy the identifier requirements at the profile level rather than on every individual post (Texas SML).
Where it bites. The profile missing the ID. Loan officers put the NMLS ID in the email signature and flyers, then forget the Instagram bio, the Facebook page, and the Google listing. In a state that treats a social post as an advertisement, every one of those is an ad running without the required identifier. Fix it once at the profile level and you cover the account. For the licensing and renewal side, see our NMLS continuing education calendar.
Steal this: compliant ad copy
Here is non-compliant copy next to a version you can run. Swap the brackets for your details.
The social post.
Non-compliant: “Rates dropped! 5.99%, zero down. DM me to get approved today.”
Compliant: “Rates have been moving. If you bought or refinanced in the last couple of years, it may be worth a fresh look at your numbers. Reply or DM and I’ll run a personalized estimate, no obligation. [Your Name], NMLS #[0000000].”
No trigger terms fire, and it promises an estimate, not an approval.
The rate-drop text.
Non-compliant: “Hi [Name], I can get you 6.25% and save you $380/mo. Call me.”
Compliant: “Hi [Name], it’s [Your Name] at [Company]. Rates have moved since your loan closed. Want me to run a quick refinance estimate to see if it’s worth it? Reply STOP to opt out. NMLS #[0000000].”
The compliant text quotes no rate, flags a conversation, carries an opt-out for TCPA and A2P 10DLC, and shows the NMLS ID.
The landing page headline.
Non-compliant: “Lowest rates guaranteed. No fees. $1,800/mo payments.”
Compliant: “See what today’s options could look like for your home.” Sub-line: “Estimates only. Not a commitment to lend. Your actual rate, APR, and payment depend on a full application and credit review.”
A page may state a rate or payment, but then it owes the full Regulation Z block: the APR spelled out, the repayment terms, the down payment, and a note that the rate can increase. A landing page has room for that; a story slide does not.
Three scenarios: post, email, landing page
Caution depends on the channel, because the format changes what you can safely say.
The solo LO posting on social. You have no room for disclosures, so adopt one rule: never put a number in a social post. No rate, no payment, no down payment. Talk about the situation (“rates have moved”) and the offer of help (“I’ll run your numbers”). Put your NMLS ID in the profile, and in a state like Texas, confirm the profile carries the full identifier set. This removes the entire trigger-term risk in one move.
The small team sending an email blast. Email gives you room, but it scales the risk, because one bad template reaches your whole database at once. Standardize a single approved template with estimate-only language, the NMLS ID, an opt-out, and no quoted rate, and have one person own it.
The brokerage running paid landing pages. A paid page is the one place a stated rate can make sense, because you have the space to do it right. If you advertise a rate or payment, show the APR at equal or greater prominence, state the repayment terms and down payment, and flag that the rate can rise on an adjustable product. Archive every version and A/B variant, since each is a separate advertisement. At brokerage scale this is also a RESPA question when realtor co-marketing is involved, covered in the RESPA-safe co-marketing guide.
Common objections, answered
“Everybody posts rates on Instagram. Why can’t I?” Because “everybody does it” is not a defense, and most of those posts are non-compliant too. A post with 10,000 likes is still evidence if it quotes a payment with no APR. The safe version performs just as well, because borrowers respond to the help, not to a number.
“If I can’t say a rate, how do I compete?” By moving the number out of the ad and into the conversation. The ad’s job is to start the dialogue; the rate belongs in a real quote against a real file. A specific rate in a specific scenario, delivered one to one, beats a billboard number the borrower half-trusts. You are giving up only the quoting of rates to strangers who have not applied.
“I use a CRM. Doesn’t it handle this?” No. Software executes your templates; it does not write compliant ones or decide what is misleading, and it will blast a non-compliant message to 5,000 contacts faster than you could. What a well-configured system does is make the compliant version the default: your NMLS ID in every send, estimate-only language pre-written, an opt-out on every text, and a log that satisfies the recordkeeping rule. The guardrails are configuration, and configuration is on you.
Frequently asked questions
Mortgage advertising compliance, answered
Can I post a mortgage rate on social media?
You can, but a stated rate must appear as the 'annual percentage rate' at equal or greater prominence, and naming a payment, down payment, number of payments, or finance charge triggers the full Regulation Z disclosure block. Most social formats have no room for it, so the safe practice is to post no number and move the rate into a conversation.
What are Regulation Z trigger terms?
Four numbers: the amount or percentage of a down payment, the number of payments or period of repayment, the amount of any payment, and the amount of any finance charge. Stating any one in a credit ad requires you to also disclose the down payment, full repayment terms, and the APR. A negative like 'no down payment' counts too (12 CFR 1026.24).
Do I have to put my NMLS ID on every ad?
In practice, yes. The requirement comes from state law, not directly from the federal SAFE Act, but nearly every state adopted it, so put your NMLS identifier on your ads and social profiles. California also requires DRE-licensed originators to show their DRE license number, and Texas requires both the originator's and company's name and NMLS IDs.
Is 'no closing costs' allowed in a mortgage ad?
Only if it is true and not misleading. If 'no closing costs' really means the costs are covered by a higher rate, saying it without that context can be a misrepresentation under the MAP Rule and a deceptive act under UDAAP. State what the borrower pays instead, or do not use the phrase.
What happens if I advertise a rate I can't actually deliver?
That is bait advertising, the highest-risk pattern regulators pursue. The CFPB's 2020 sweep of deceptive VA-loan ads produced more than $4.4 million in penalties because the lenders promoted terms they were not prepared to offer. Advertise only terms a real borrower could get, and label illustrative numbers as estimates.
Advertising rates is not the trap. Advertising them carelessly is. The originators who get this right learn the words that flip the switch, keep numbers out of the ad and inside the conversation, and run outreach through a system that puts the NMLS ID, estimate-only language, and record-keeping on autopilot. Do that, and you can market as loudly as anyone in your market, without the version of this story that ends in a consent order. For the messaging side, see why pre-approvals go quiet and the TCPA-compliant marketing playbook.