The federal trigger-lead ban took effect March 5, 2026. Under the Homebuyers Privacy Protection Act, which amended the Fair Credit Reporting Act, the credit bureaus can no longer sell a “trigger lead” (the alert generated when someone’s credit is pulled for a mortgage) to most third parties. If a chunk of your pipeline came from buying those leads, or from the speed you got when a borrower’s inbox lit up with competitors, that source is now mostly closed. The fastest way to replace the volume is the database you already paid to build. Here is the 90-day version.
What the ban actually changed
Before March 2026, when a lender pulled a borrower’s credit, the bureaus could package that event and sell it to other lenders within hours. Now they cannot, unless the recipient meets a narrow exemption: a firm offer of credit paired with the consumer’s prior authorization, the lender that currently originates or services the loan, or an insured depository institution where the consumer already holds an account. For most independent loan officers buying leads off the open market, the firehose is off.
The instinct is to find a new lead vendor. The better move is to notice that you already have a list of people who know you, closed with you, or applied with you, and that almost nobody works it on purpose.
Why your database is the replacement, not a consolation prize
Trigger leads were valuable because of timing: you reached someone at the exact moment they were rate-shopping. You can recreate that timing inside your own book without the bureaus selling it to anyone. Credit-monitoring alerts on your past clients tell you when one of them has their credit pulled by another lender, so you hear about the refinance or the new purchase while there is still time to win it. Same trigger, except it fires on people who already trust you, and it is yours.
The 90-day plan
Weeks 1 to 2: clean and segment
You cannot recapture a list you cannot trust. Pull your database, dedupe it, and split it into past clients, closed-lost applicants, and partner referrals. Tag each contact with the loan you did, the rate they have, and the date. Most loan officers discover here that a third of the “database” is dead or duplicated. Fixing that is the prerequisite, not a side quest.
Weeks 3 to 6: turn on the triggers
Put credit-monitoring alerts on your past clients so you are notified when someone shops a mortgage. Layer in rate-based triggers: if rates drop into a range where a segment of your book benefits from a refinance, you want a list of exactly those people the same day. This is the part that replaces the trigger-lead timing, on contacts who are already yours to call.
Weeks 7 to 12: cadence and measurement
Build a simple, repeatable follow-up: a monthly value touch to the whole book, plus an immediate, personal reach-out the moment a trigger fires. Track one number, recaptured loans per 1,000 contacts, so you know whether the system is working instead of guessing. By day 90 you should have a motion that runs whether or not you remember to log in.
Who can still legally contact a trigger lead
The exemptions matter, because they describe an edge depository loan officers have and most do not know it. A lender can still reach a consumer when there is a firm offer of credit plus prior authorization, when it currently originates or services that consumer’s loan, or when the consumer holds an account at that insured depository institution. If you sit inside a bank or credit union, your existing-customer base is a legal, warm channel the open market just lost.
Frequently asked questions
When did the mortgage trigger-lead ban take effect?
March 5, 2026, under the Homebuyers Privacy Protection Act, which amended the Fair Credit Reporting Act.
Are all trigger leads banned now?
No. The bureaus cannot sell them to most third parties, but narrow exemptions remain for firm offers with prior consumer authorization, the current loan’s originator or servicer, and depositories where the consumer already has an account.
What replaces trigger-lead volume?
Credit-monitoring and rate-based alerts on your own database, which recreate the timing advantage on contacts who already know you.
How long does it take to stand up a database recapture system?
About 90 days: two weeks to clean and segment, a month to turn on alerts, and the rest to build cadence and measurement.
Credit-monitoring alerts and database triggers like these run inside a mortgage CRM built for it, including BNTouch. For the full list of 2026 rule changes that touch your outreach, see the 2026 Mortgage Compliance Tracker.
This article is general information for mortgage professionals, not legal advice. Confirm your specific obligations with your compliance team or counsel.
