The 30-day clock is a due date
Due-date offsets run from the date the application became complete, so the notice task is due before day 30. The Tasks grid shows every open notice, and analytics report time from application to decision.
Loan Origination Checklist Template
Most origination findings are not bad credit calls. They are a decline notice sent on day 34, an approval signed above someone’s limit, or a loan funded before a condition was cleared.
This free checklist takes one application from intake to a booked, quality-checked loan. It is for credit teams at banks, credit unions, specialist lenders and fintechs writing consumer or business loans other than mortgages. It covers intake and KYC, underwriting, approval authority, adverse action notices, disclosures, security, funding, booking and post-closing QC. Answers at intake decide which steps appear: a consumer loan gets the disclosure phase, a commercial loan gets security and conditions precedent, and a decline opens the notice phase with its deadline set.
One Origination Process, Three Rulebooks
Every loan passes through the same stages: application, identity checks, underwriting, approval, documents and funding. What changes between a personal loan and a working capital facility is the paperwork the law attaches to each stage. Consumer credit carries prescribed disclosures and tight notice rules. Business credit carries security, conditions precedent and covenants.
In the US, Regulation B governs every credit decision, consumer or business, including the 30-day clock for telling an applicant what you decided. Residential mortgages add their own timing rules, so they have a separate Mortgage Application Processing Checklist.
Consumer loan
Personal loans, auto, cards, lines of credit
Main rules: Reg B, FCRA, Truth in Lending (Reg Z); in the UK the Consumer Credit Act and CONC.
Pressure points: affordability evidence, pre-contract disclosures and decline notices.
This template: adds Phase 5, disclosures.
Commercial loan
Term loans, revolvers, equipment and CRE finance
Main rules: Reg B, beneficial ownership and KYC, bank lending limits and insider rules; Section 1071 data from 2028 for covered lenders.
Pressure points: approval authority, conditions precedent, security perfection.
This template: adds Phase 6, security.
Residential mortgage
A different checklist
Main rules: TRID, ability-to-repay and QM, HMDA, flood and appraisal rules.
Pressure points: the Loan Estimate and Closing Disclosure deadlines.
Use instead: the mortgage application processing checklist.
What the Loan Origination Checklist Covers
Phases 1 to 3 run on every application and Phase 7 on every approved loan. Three appear only when the answers call for them: decline notices, consumer disclosures, and commercial security.
Phase 1
Phase 1: Application Intake & KYC
Assigned to the loan officer. The borrower type, jurisdiction and revenue answers recorded here decide which later phases and tasks appear.
- Log the application, the product and the date received — then the date it became complete, which starts the Reg B notice clock
- Record the borrower type and jurisdiction — Consumer or Commercial, US or UK; name the underwriter and the credit approver at the same time
- Record a US business applicant’s gross revenue band — $1 million or less, or more, in its last fiscal year; it sets the adverse action rules in Phase 4
- Check the file against the product’s document list — where the applicant can supply what is missing, send a notice of incompleteness within 30 days
- Verify the identity of borrowers, guarantors and beneficial owners — US banks under their CIP and beneficial ownership rule; UK firms under the MLRs 2017
- Screen every party against the sanctions lists you apply — and disposition any potential match before underwriting starts
- Collect Section 1071 small business data where it applies — covered US lenders from 1 January 2028; keep the answers from decision-makers under your documented firewall procedure, or give the required notice
Phase 2
Phase 2: Credit Analysis & Underwriting
Assigned to the underwriter, who must not be the loan officer who sourced the deal.
- Pull credit reports with a permissible purpose — for consumer applicants and for individual guarantors of a business loan
- Verify income or spread the financials — payslips and bank statements for a consumer; accounts and tax returns for a business
- Assess repayment capacity — affordability and debt-to-income for a consumer (UK lenders follow CONC 5.2A); debt service coverage and leverage for a business
- Value the collateral — check any valuation or appraisal against policy and record the loan-to-value
- Assess guarantees without requiring a spouse to sign where the applicant qualifies alone — Reg B 1002.7(d)
- Risk-grade and price the loan — record the grade, the pricing basis and every policy exception
- Write the credit memo — recommendation, structure, covenants, conditions and exceptions
Phase 3
Phase 3: Credit Decision & Approval Authority
The approval task is assigned to a named approver whose delegated limit covers the total exposure. The checklist halts until it is answered.
- Calculate total exposure to the borrower and connected parties — against lending and concentration limits
- Check for insider or related-party lending — US banks need prior board approval above the Regulation O threshold, with the insider abstaining
- Credit approval by the authorised approver — Approved or Not approved; exposures above the approver’s limit go to credit committee
- Record the decision — Approved, Approved on different terms (counteroffer), Declined, or Withdrawn or closed as incomplete
- Issue the commitment letter or offer — with the conditions of approval and an expiry date
Phase 4 — Declined, Countered or Incomplete Only
Phase 4: Adverse Action & Decline Notices
Shown only when the decision is Declined, a counteroffer, or an application closed as incomplete. The due date is set from the Phase 1 dates.
- Calculate the notice deadline — 30 days after a completed application or after adverse action on an incomplete one; 90 days after an unaccepted counteroffer
- State the specific principal reasons — the actual reasons for the decision, not “did not meet our criteria”
- Add the FCRA disclosures where a consumer report was used — the credit score and key factors, the agency’s contact details and the right to a free report within 60 days
- Apply the business credit rules — revenue $1 million or less: 30-day timing, oral or written; over $1 million: notice within a reasonable time and written reasons if asked within 60 days
- UK: say when a consumer decline relied on credit reference agency data and name the agency — CCA s.157(A1); designated banks also offer declined SMEs a finance platform referral
- Send the notice and attach a copy — Reg B keeps records 25 months for consumer credit and 12 months for most business credit
Phase 5 — Consumer Loans Only
Phase 5: Consumer Disclosures & Explanations
Shown only when the borrower type is Consumer. The jurisdiction answer shows the US or the UK tasks.
- US: check covered borrower status under the Military Lending Act — before consummation; a covered borrower’s loan must stay within the 36% MAPR cap and carry the MLA disclosures
- US closed-end: deliver the Truth in Lending disclosures before consummation — APR, finance charge, amount financed and payment schedule
- US open-end: give the account-opening disclosures before the first transaction
- US: send the risk-based pricing notice where the terms were set using a consumer report — Regulation V, unless an exception applies
- UK: give the pre-contract credit information and adequate explanations before the agreement is made — CONC 4.2
- UK: record the 14-day right of withdrawal start date — CCA s.66A, for most unsecured agreements
Phase 6 — Commercial Loans Only
Phase 6: Documentation, Security & Conditions Precedent
Shown only when the borrower type is Commercial. Owned by loan documentation or legal, with the loan officer chasing the borrower.
- Prepare the facility and security documents from the approved terms — any change to pricing, covenants or security goes back to the approver
- Collect the conditions precedent — constitutional documents, board resolutions, signatory evidence, insurance and legal opinions
- Take the guarantees and any intercreditor agreements the approval requires
- Perfect the security — US: file the UCC-1 and any real estate mortgage; UK: register the charge at Companies House within 21 days (s.859A)
- Approve any condition precedent waiver — a waiver is a credit decision, so the approver signs it, not the loan officer
Phase 7
Phase 7: Closing, Funding, Booking & Post-Closing QC
Runs on every approved loan. Funding needs a second person, and QC is done by someone outside the deal team.
- Pre-closing check — conditions met, documents match the approval, nothing material changed since the decision
- Execute the loan documents — confirm the signatories are authorised and every required party has signed
- Fund the loan after a second person checks the payee and disbursement instructions — confirm changed bank details by phone to a known contact
- Book the loan — rate, payment schedule, collateral, covenants, maturity and the first annual review date
- Diary the follow-ups — covenant tests, insurance renewals, UCC continuation before the five-year lapse
- Post-closing QC on the file — documents, disclosures, notice timing and approval authority, with exceptions logged for MI
- Close the file and set its retention date — under Reg B and your retention policy
The Rules Behind Each Stage
The main obligations, mapped to the phase that handles them. Which apply depends on your charter or licence, product and borrower, so treat this as a starting point, not legal advice.
| Requirement | United States | United Kingdom | Phase |
|---|---|---|---|
| Identify the customer and its owners | CIP, 31 CFR 1020.220 (banks); beneficial ownership, 31 CFR 1010.230 | MLRs 2017, regs. 27–28 | 1 |
| Notice of incompleteness or decision | Reg B 1002.9(a) and (c): 30 days | No equivalent fixed deadline | 1, 4 |
| Small business lending data | Reg B subpart B (Section 1071), from 1 January 2028 | Not applicable | 1 |
| Affordability or repayment capacity | Safety and soundness and your credit policy; ability to repay for card accounts, Reg Z 1026.51 | CONC 5.2A for regulated credit | 2 |
| No spouse signature where applicant qualifies | Reg B 1002.7(d) | Not applicable | 2 |
| Insider lending approval | Regulation O, 12 CFR 215.4(b) | Firm policy and conflicts rules | 3 |
| Decline reasons and credit data | Reg B 1002.9(b); FCRA s.615(a) | CCA s.157(A1); SME bank referral scheme | 4 |
| Pre-contract disclosures | Reg Z 1026.17–18 (closed-end), 1026.6 (open-end); Reg V risk-based pricing | Pre-contract information and adequate explanations, CONC 4.2 | 5 |
| Security registration | UCC Article 9 financing statement; real property recording | Companies Act 2006 s.859A, 21 days | 6 |
| Record retention | Reg B 1002.12(b): 25 months consumer; 12 months business, or 60 days for larger businesses that do not ask for reasons | Firm policy and FCA record-keeping rules | 7 |
A few things are moving. The CFPB issued a revised Section 1071 rule on 1 May 2026, effective 30 June 2026. It covers lenders with at least 1,000 covered originations in each of the two preceding years, defines a small business as one with gross annual revenue of $1 million or less, drops several data points including denial reasons and pricing, and sets a single compliance date of 1 January 2028, with the first filing due 1 June 2029. Separate Regulation B amendments effective 21 July 2026 removed the disparate-impact language and narrowed discouragement, without changing the notice deadlines. In the UK, HM Treasury’s May 2026 policy statement confirmed that most of the Consumer Credit Act will be replaced by FCA rules through new legislation. Until that happens and the FCA consults, the current Act and CONC apply.
In the UK, lending to a company is generally outside consumer credit regulation, but lending to sole traders and small partnerships can be regulated: the business purposes exemption in article 60C of the Regulated Activities Order applies only above £25,000. Run those smaller applications as Consumer.
Why Run Loan Origination in CheckFlow?
Approvals stop the line
Credit approval and condition waivers are approval tasks assigned to a named approver, and nothing after them can be completed until they record Approved or Not approved. A data set of approvers and limits keeps the dropdown to people with the right authority.
Consumer and commercial in one template
Conditional logic reads the borrower type, jurisdiction and decision, then shows only the phases that apply. The credit memo, notices and QC findings sit on their tasks in an exportable, timestamped trail.
CheckFlow is not a loan origination system, credit decision engine or document generator, and it does not hold your loan documents. It runs the workflow around them: who does each step, when each notice is due and who approved what. Start a checklist by hand or from your LOS through the API. The financial services overview and our guide to financial services workflow automation show other lending workflows run the same way.
Residential mortgages need their own timing rules, so use the Mortgage Application Processing Checklist. New customers can go through the Customer Due Diligence Checklist first, and existing borrowers join the KYC Periodic Review Checklist cycle. CheckFlow’s compliance checklist software covers the wider lending compliance calendar.
Frequently Asked Questions
What are the stages of loan origination?
Most lenders run the same sequence: intake, identity and KYC checks, underwriting, the credit decision and approval, disclosures and documentation, closing and funding, then booking and post-closing quality control. Declined or countered applications branch off to an adverse action notice.
How long does a lender have to send an adverse action notice?
Under Regulation B, 30 days after receiving a completed application, 30 days after taking adverse action on an incomplete application, or 90 days after a counteroffer that the applicant does not accept or use. For business applicants with gross revenue above $1 million in the last fiscal year, notice can be given orally or in writing within a reasonable time, with written reasons if the applicant asks within 60 days. Where a consumer report contributed, the FCRA disclosures go in the same notice.
Does Regulation B apply to business loans?
Yes. The Equal Credit Opportunity Act covers business credit, including the ban on discrimination, the spouse signature rule and the duty to notify the applicant of the decision. Notice rules are lighter for businesses with revenue over $1 million, and records are kept for 12 months rather than 25.
When does the CFPB Section 1071 small business lending rule take effect?
The CFPB issued a revised rule on 1 May 2026 that replaced the 2023 rule’s staggered dates. It took effect on 30 June 2026, data collection starts on 1 January 2028 and the first filing is due by 1 June 2029. It applies to lenders that originated at least 1,000 covered transactions in each of the two preceding calendar years, and only to businesses with gross annual revenue of $1 million or less.
Who should approve a loan?
Someone whose delegated authority covers the total exposure to the borrower and its connected parties, and who did not originate the deal. Larger or exceptional credits go to credit committee. US banks lending to insiders above the Regulation O threshold need prior approval from a majority of the full board, with the insider abstaining.
Is CheckFlow free for this template?
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.