How to Stay Compliant While Scaling Your Lending Operation

Updated November 2026

Compliance gets harder faster than loan volume grows. The manual checks that hold up at fifty deals a month break at five hundred, and in a regulated business every missed disclosure, unverified registration, undocumented decision, or collection slip can turn into a penalty, a regulatory inquiry, a merchant dispute, or a lost capital partner.

The good part: compliance does not have to slow growth. With the right operating model, technology, and a few outside specialists, you can add volume, products, brokers, and states without adding a proportional compliance team. This guide is written for commercial and alternative lenders, merchant cash advance funders included. It covers how compliance attaches across the lending lifecycle, which rules may apply, what breaks as you scale, how to measure it, and a 90-day plan to put it in place.

This is general information for funders, not legal advice. What applies to you depends on your products, your states, your counterparties, and the facts of each deal. Confirm current obligations with qualified counsel.

Start here

How do commercial lending workflows impact compliance requirements?

Every stage of a commercial lending workflow creates a compliance obligation, so your workflow and your compliance program are the same system seen from two angles. When volume is low, a person can carry each obligation by hand from step to step. As you scale, the handoffs become the weak point: a disclosure goes out too late, a registration never gets verified, an exception gets approved with no documentation, or a complaint never gets categorized. A scalable program treats each stage as a control point, like this:

The practical takeaway: compliance works best as a set of controls embedded in the workflow, so each obligation is met and the evidence captured as the deal moves. That reframing is what lets compliance scale, and it starts with knowing which rules actually reach your business.

The rulebook

Know which rules may apply to you

Commercial and alternative lenders do not all carry the same load. The first move is to classify the product, identify the states involved, and work out which federal, state, and contractual requirements actually apply. The core consumer-credit laws, the Truth in Lending Act, RESPA, and HMDA, are built around consumer and residential mortgage lending, and most commercial loans and merchant cash advances fall outside them.

Federal

• ECOA and fair lending: ECOA reaches extensions of credit to businesses, so keep consistent criteria, document decisions and exceptions, and apply Regulation B adverse-action rules where they fit.
• UDAP and the FTC Act: unfair or deceptive practices standards can reach advertising, disclosures, servicing, and collections, even where no statute names your specific product.
• GLBA and privacy or security laws: determine whether GLBA, the FTC Safeguards Rule, or state laws like CCPA apply, then put appropriate administrative, technical, and physical safeguards on the data you hold.
• AML and KYC: determine whether Bank Secrecy Act obligations apply directly. Even where they do not, bank partners, processors, and capital providers often require identity verification, sanctions screening, and beneficial-ownership review.
• Section 1071: the CFPB's revised small-business data rule excludes merchant cash advances, with a January 1, 2028 compliance date for covered institutions. For most funders, state law is the more immediate surface.

State

State commercial-financing, sales-based-financing, and revenue-based-financing laws are now the central compliance issue for MCA funders. At least eleven states have disclosure laws that can reach MCA-style deals (California, Connecticut, Florida, Georgia, Kansas, Louisiana, Missouri, New York, Texas, Utah, and Virginia), and Vermont has enacted a licensing-and-disclosure framework that takes effect July 1, 2027. Our state-by-state regulation guide breaks down each one. Do not assume one national workflow works everywhere: coverage can turn on the merchant's location, where the deal was solicited, where the offer was extended, the product structure, and the amount.

The scaling trap

What breaks as you grow

Growth exposes weak controls. These five failure points create the most compliance risk, and each has a control that contains it.

• Fragmented data. When application, decision, disclosure, funding, servicing, and complaint data live in separate systems, producing evidence becomes a manual scramble, and missing timestamps are hard to explain under audit. Control: keep one deal record that links the application, decision, disclosure, contract, funding approval, servicing activity, and complaint history.
• Manual handoffs. Spreadsheets and email approvals work at low volume and create errors at scale. A missed disclosure trigger is usually a workflow problem, not a knowledge problem. Control: convert recurring checks into system-enforced steps, with required fields, approval gates, and document-generation rules.
• Multi-state expansion. Each new state can add disclosure, registration, licensing, broker, usury, or collection requirements, and entering one without updating templates and training creates exposure on the first deal. Control: use a state-entry checklist, and do not enable funding in a state until legal review, disclosure logic, registration, and training are done.
• Broker and vendor risk. Brokers, ISOs, servicers, processors, and capital partners can all introduce risk, and a broker's misleading marketing can land on you even though it was outsourced. Control: use vendor due diligence, written compliance requirements, audit rights, approved-marketing controls, and complaint escalation.
• Model and pricing risk. AI-driven underwriting and automated pricing can create fair-lending risk if no one monitors inputs, outcomes, and overrides. Control: keep a model inventory, test outcomes periodically, monitor overrides, and require human review for material exceptions.

The framework

Build a compliance program that scales

A durable program has five components that work together:

• Risk assessment. Map every product, state, channel, broker, vendor, and data flow to the laws that apply, rate the risk, and assign an owner to each one. Refresh it whenever you enter a state, launch a product, add a broker, change pricing, or adopt a new model.
• Written policies and procedures. A policy says what must happen; a procedure says who does it, when, in which system, and what evidence to keep. Version-control every policy, template, and state rule so you can show what was in effect on any given date.
• Embedded controls. Build the checks into origination and servicing so issues surface before a deal closes: the required state disclosure before its trigger, registration verified before funding, APR calculated from deal terms, exceptions approved and documented, and a timestamped audit trail on every material action.
• Complaint and incident management. Treat complaints as an early-warning system, categorized by product, state, channel, broker, and root cause, and run a separate incident process for security events and material disclosure failures.
• Training and reporting. Give role-based training to sales, underwriting, funding, servicing, collections, and leadership, train brokers on the rules that apply to them, and report key risk indicators on a regular cadence.

Measure it

Track compliance with a KRI dashboard

A dashboard makes compliance measurable instead of a gut feel. Start with a small set of high-value indicators rather than tracking everything at once. The thresholds below are suggested starting points, so tune them to your risk tolerance. Treat the middle band as a trigger for documented management review and the top band as immediate escalation.

For MCA funders

Add the MCA-specific controls

MCA funders need controls that generic commercial-lending compliance misses, because the product and its collection mechanics are specific.

• Product classification. Work out whether the deal is a true purchase of receivables, revenue-based financing, a loan, factoring, or a hybrid. The classification drives disclosure, registration, usury, and UCC analysis. Our lending glossary defines the terms.
• UCC and collateral. Review UCC-1 filings, collateral descriptions, jurisdictions, continuations, and terminations, because stale or inaccurate filings create perfection and priority problems at enforcement.
• Guarantees and confessions of judgment. Personal guarantees and confession-of-judgment provisions affect collection rights, and their enforceability varies by state, so they need legal review and consistent handling.
• Reconciliation and default. MCA disputes often turn on how payments were applied, how holdbacks were calculated, and how default was declared, so keep clear records of each.
• Collections conduct. Aggressive tactics create legal, reputational, and capital-partner risk, so apply documented scripts, escalation rules, complaint handling, and vendor oversight.

Technology

Let technology carry the load

Technology turns recurring manual checks into repeatable controls, which is how you handle ten times the volume without ten times the headcount. Look for a platform that can:

• Run compliance checks inside origination and servicing, not after the fact
• Generate jurisdiction-specific disclosures from deal data
• Calculate APR or estimated APR consistently
• Verify and document registration or licensing status
• Keep a timestamped audit trail showing user, action, deal, document version, and time
• Configure rules by state, product, broker, and deal type
• Capture merchant acknowledgments and signed disclosures
• Produce exception reports and KRI dashboards, and intake and escalate complaints

How Onyx IQ helps

Onyx IQ builds compliance into the funding workflow, so the work happens as the deal moves and the evidence is there the moment someone asks for it. For a growing funder, the gains are the point: you expand into new states without a legal project for each one, you stop risking per-violation fines over a missed disclosure, and you walk into an exam or a capital-partner review with the file already built. Subject to your own legal review, here is what that looks like in practice:

• Expand into new states without the overhead. Onyx IQ detects the merchant's state and generates the right disclosure at the funding event, and when a new state law takes effect the template is added for you. When Mississippi's law took effect, its disclosure was live in the platform that day, so funders did not have to build it under a deadline.
• Stop missing disclosures and APRs. The platform generates the state disclosure and calculates the APR to spec before the contract, then captures the merchant's signature and a timestamp and attaches the signed copy to the deal record.
• Walk into any exam audit-ready. Every approval, modification, and decision is logged automatically across underwriting, servicing, and collections, so the audit file is built continuously instead of assembled the week before an exam.
• Give capital partners the reports they ask for. Static pool reports by vintage, collection curves, and GAAP-formatted outputs come out of the box, which is exactly what a bank sponsor or syndicator wants before extending a facility.
• Clear security diligence once. SOC 2 Type II covers the platform end-to-end, from origination through reporting, under one attestation.

As Nick Lavoie of Lavoie Capital put it, Onyx IQ “gave us the structure and compliance framework we needed from day one.” One honest caveat on that last point: SOC 2 Type II is strong evidence of security controls, but it does not by itself satisfy GLBA, state privacy laws, or every contractual requirement, so treat it as one input into a broader data-security review. For the mechanics of how the disclosures run, see our guide to automated disclosures for MCA compliance, and the servicing and audit trail behind it.

Partners

Use outside specialists strategically

You do not have to build every capability in-house. Compliance counsel can interpret state laws, review disclosures, and track legal changes. An independent consultant can design policies, run gap assessments, and prepare you for audits. A specialized servicer can handle payment processing, escrow, reconciliation, and collections under strong oversight. An independent auditor or model-validation provider can test controls and fair-lending outcomes. The rule of thumb: outsource work that is operationally heavy and far from how you win deals, and keep accountability for the compliance outcomes, the vendor performance, and the regulatory change.

Put it in place

A 90-day implementation plan

Days 1 to 30: baseline

• Inventory products, states, channels, brokers, vendors, and data systems
• Map the deal lifecycle from lead to payoff or default
• Pull a sample of recent deals and test disclosure, registration, documentation, and exception controls
• Identify the missing owners, policies, and evidence

Days 31 to 60: build controls

• Update policies and procedures, and configure state rules, disclosure templates, and approval gates
• Create a state-entry checklist and a pre-funding checklist
• Stand up complaint categorization and corrective-action tracking
• Assign an owner to every material control

Days 61 to 90: operate and prove

• Launch the KRI dashboard and run a targeted self-audit
• Train origination, underwriting, funding, servicing, and collections teams
• Set quarterly regulatory-change, vendor, and model-review cycles
• Report results to leadership with owners and deadlines

FAQ

Compliance and scaling FAQ

Sources

Sources and references

• Truth in Lending Act overview and Equal Credit Opportunity Act overview
• Husch Blackwell, CFPB Finalizes Revised Section 1071 Rule (2026 narrowing, MCA exclusion)
• Onyx IQ, Merchant Cash Advance Regulation in 2026 (state disclosure and registration laws)