The enforcement action is only part of the story
On August 12, 2026, NewRez entered into a coordinated multistate Settlement Agreement and Consent Order resolving mortgage servicing concerns identified through a Multi-State Mortgage Committee examination.
The examination began in January 2022 and reviewed NewRez’s servicing activity for the period from November 1, 2020 through October 31, 2021. Regulators identified instances of noncompliance involving lender-placed insurance, or LPI, under the Real Estate Settlement Procedures Act and its implementing Regulation X.
Lender-placed insurance generally arises when a servicer obtains insurance coverage to protect the lender’s interest in a property when required borrower coverage is believed to be absent or insufficient. Because that coverage can result in premiums and fees being charged to a borrower, determining whether adequate insurance was already in place is a significant servicing compliance issue.
NewRez neither admitted nor denied wrongdoing under the settlement. The company represented that it had taken steps to address the examination findings and had remediated impacted borrowers.
The monetary resolution totals $15.5 million. That amount consists of a $9.9 million administrative penalty, approximately $1.09 million in administrative costs, and approximately $4.51 million reflecting consumer relief previously paid in connection with the LPI issues.
Those numbers will understandably attract attention. For compliance testing professionals, however, some of the most instructive language appears elsewhere in the order.
Regulators prescribed a testing framework
The agreement requires NewRez to implement enhanced servicing review standards and specifically requires testing to assess compliance with those standards.
The order permits the testing to be performed either internally or by a third party. If performed internally, the individuals conducting the work must come from Internal Audit or Compliance and must be independent of the applicable line of business.
That requirement establishes the first important element of the framework: testing independence.
But the order goes significantly further.
Rather than merely instructing NewRez to "test compliance," regulators define important elements of the testing methodology itself.
1. The population is defined
Monthly testing applies to newly boarded loans with lender-placed insurance within participating jurisdictions where NewRez operates.
The loans subject to targeted monthly sampling are those for which LPI coverage was initiated during the preceding month.
This is significant because a defensible test begins with a clear understanding of what activity is subject to evaluation. A testing requirement without a properly defined population leaves considerable uncertainty about whether the resulting conclusion actually addresses the intended risk.
2. The sampling methodology is prescribed
The agreement establishes a state-level sampling methodology.
Where a jurisdiction has 20 or more applicable loans during the review period, NewRez must randomly select 10% of the population.
Where there are 19 or fewer applicable loans, at least one loan must be reviewed.
This transforms sampling from an informal reviewer decision into a documented component of the regulatory requirement.
3. The evidence to be evaluated is identified
For selected loans, the order requires manual inspection of imaged documentation to determine whether valid homeowners insurance existed when LPI was assessed.
The broader testing provisions also contemplate review of servicing-system notes or data and management inquiries and interviews when necessary.
This is an important distinction. Effective compliance testing does not stop with identifying a sample. The test methodology must establish what evidence is sufficient to evaluate the requirement being tested.
4. The failure condition is explicit
The agreement provides a direct loan-level evaluation criterion.
A loan fails the test if NewRez assessed lender-placed insurance when valid documentary evidence demonstrated that a valid homeowners insurance policy was already in place.
That is effectively a defined testing assertion: determine whether LPI was assessed despite evidence of valid existing coverage.
A reviewer therefore does not need to improvise the standard after examining the evidence. The regulatory expectation, evidence, and failure condition are connected.
The order also defines how results become meaningful
Individual exceptions are only one level of a testing program. The NewRez agreement additionally defines how those results are aggregated and escalated.
If failed loans exceed 5% of the total loans tested, NewRez is considered to have failed the applicable metric for the reporting period.
That 5% threshold error rate creates a distinction between an individual exception and an overall testing conclusion.
The order then requires NewRez to report monthly testing outcomes to an Executive Committee representing participating regulators, including instances where the error rate exceeds the threshold. Reporting is required within 30 days after the monthly report is finalized.
This illustrates another important feature of mature compliance testing: the methodology does not end when the tester records pass and fail results.
A complete framework determines how exceptions affect the overall conclusion, when escalation occurs, who receives the results, and what happens next.
Failure is tied directly to remediation
The agreement connects testing outcomes with corrective action.
NewRez may cure an identified LPI failure by terminating the improper lender-placed insurance and refunding premiums and fees paid by affected borrowers.
Potential violations may similarly be mitigated where corrective action includes remediation of impacted borrowers.
This creates a traceable path:
Requirement → population → sample → evidence → evaluation → exception → threshold → reporting → remediation
That sequence is particularly relevant for organizations designing compliance testing programs.
Testing is most defensible when each stage can be traced to the next rather than operating as a collection of disconnected review activities.
A second self-audit expands the framework
The settlement also requires NewRez to conduct an additional self-audit covering LPI fees collected or refunded for newly boarded loans in participating states from January 1, 2023 through the effective date of the agreement.
NewRez must provide the proposed audit methodology to the Executive Committee for review. The company must then provide the results after completing the audit.
Where the review identifies LPI that was erroneously placed and for which a borrower actually paid premiums or fees, NewRez must refund those amounts.
The agreement also requires periodic updates on remediation progress until affected consumers have been made whole.
The methodology-review provision is especially noteworthy. It reflects the importance not merely of producing results, but of establishing an acceptable testing methodology before relying on those results.
What compliance leaders should take from the NewRez order
The NewRez settlement should not be interpreted as establishing a universal testing methodology for every mortgage servicer or every Regulation X requirement. Its specific testing provisions arise from a particular examination, particular findings, and a negotiated enforcement resolution.
The broader lessons, however, are useful.
When regulators required NewRez to demonstrate that the identified risk was being controlled, the resulting framework included:
independence from the business activity being tested; a defined testing population; a prescribed sampling methodology; identified evidence sources; explicit failure criteria; a quantitative error threshold; required escalation and reporting; corrective action and consumer remediation; and governance over additional audit methodology and results.
Those elements closely resemble the building blocks of a mature compliance testing lifecycle.
The enforcement action therefore provides compliance and risk professionals with something more useful than another penalty headline. It provides a practical example of how regulatory requirements can be translated into a structured testing methodology capable of producing a supportable conclusion.
The larger compliance testing lesson
Enforcement actions are frequently analyzed by asking what went wrong.
Compliance testing teams should also ask a second question:
How did regulators require the organization to prove that the problem was corrected and remained controlled?
In the NewRez settlement, that answer is unusually concrete.
Regulators did not simply require stronger compliance. They established expectations around independence, population selection, sampling, documentary review, failure determination, aggregation, reporting, and remediation.
For organizations building or evaluating compliance testing programs, those details are often where the most valuable regulatory intelligence resides.