Non-bank lenders can license loan files that run from application to decision to performance, with borrower identities removed. Suspicious activity report material must stay out by law, credit reports bought from bureaus are not yours to resell, and federal privacy law limits sharing borrower information. No buyer publishes a price for loan files; Mercor publishes $80K to $900K for payments and fintech companies and $50K to $800K for investment firms, read through a third-party copy. Those are ceilings, not offers.
- Outcomes make loan files valuable: payoffs, delinquencies and defaults linked to the original decision.
- SAR-related material cannot be disclosed; leave all AML files out.
- Credit reports are furnished for a permitted purpose and usually licensed from the bureau: they stay out.
- For a closed lender, the trustee or assignee signs.
Who this page is for
Non-bank mortgage lenders and brokers, consumer and small-business lenders, merchant cash advance and equipment finance companies, and fintech lenders that have stopped lending or closed. In Origin's view, regulated banks move slowly on data licensing because any data sharing goes through their third-party risk reviews; this page is written for lenders outside that system.
This page is general information, not legal advice: it quotes each rule with its source, and your counsel decides how it applies to your company.
What AI buyers want from loan files
Developers building underwriting and servicing agents want each loan from application to outcome. Mercor lists "Finance & Insurance Statements, underwriting files, claims" among the data it seeks (Mercor). The public model of the fields is the government-sponsored datasets: Freddie Mac publishes "loan-level credit performance data on all mortgages that the company purchased or guaranteed from 1999 to 2026" (Freddie Mac).
| Part of the file | What it shows |
|---|---|
| Application and documents | What the borrower presented |
| Underwriting conditions and exceptions | What the underwriter asked for and why |
| Decision and terms | Approved, declined or countered, at what price |
| QC and post-closing findings | Errors caught after the decision |
| Payment history | Payoffs, delinquencies, modifications, defaults and recoveries |
A loan tape is the summary form of this file; see the detailed loan underwriting and credit decision data guide for what buyers say about each part.
What loan files are worth: the honest evidence
No buyer publishes a price for loan files and no closed lending-data deal has been published with a source. The figures that exist are published ranges for related business types.
| Evidence | What it says | Grade |
|---|---|---|
| Mercor, payments and fintech listing | "Payments & Fintech Company $80K–$900K" (TrackImpact) | A buyer's published range, read through a third-party copy |
| Mercor, investment firm listing | "Investment Firm $50K–$800K 5–200 employees Anywhere" (TrackImpact) | Same |
| micro1 company data program | Payments "typically ranging from $100K to over $3M" (micro1) | A buyer's published range, all industries |
TrackImpact notes these are "Ranges, not offers" (TrackImpact). They are ceilings for broad business types, not prices for loan files.
What must stay out: SAR files, credit reports and borrower identities
If you file suspicious activity reports, they are confidential by statute. Non-bank residential mortgage lenders and originators must file them: "Every loan or finance company shall file with FinCEN" reports of suspicious transactions (31 CFR 1029.320), and the term covers a "Residential mortgage lender or originator" (31 CFR 1010.100). Many consumer, merchant cash advance and equipment lenders file none. When a financial institution reports a suspicious transaction, it "may not notify any person involved in the transaction that the transaction has been reported" (31 U.S.C. 5318(g)(2)). Leave SAR material and the AML files around it out entirely.
Consumer credit reports are furnished for a permitted purpose: "A person shall not use or obtain a consumer report for any purpose unless" the report was obtained for a purpose the law authorizes (15 U.S.C. 1681b(f)). They are also licensed to you under bureau agreements. Keep the decision and your own derived fields; drop the reports themselves.
Borrower information falls under federal financial privacy law: "A financial institution may not disclose nonpublic personal information to a nonaffiliated third party" without notice and an opportunity to opt out (15 U.S.C. 6802). GLBA protects consumers: individuals who obtain "financial products or services which are to be used primarily for personal, family, or household purposes" (15 U.S.C. 6809); for business loans, personal guarantors' details, state law and your loan agreements set the limits. Remove names, account numbers, Social Security numbers and full addresses before any sample is shared; fair-lending fields need the same care.
Who signs: the lender, a loan buyer, or a trustee
The company that made and kept the file signs, usually its CEO with the general counsel. Two cases need more care.
- Loans sold to investors: the sale agreement may give the investor rights in the loan file. Check before including sold loans.
- A closed lender: the files belong to the estate, and the trustee or assignee for the benefit of creditors signs. See what happens to company data in a bankruptcy and assignment for the benefit of creditors.
Records checklist for a lender
The sector records checklist (CSV) has these rows for lending and the other four sectors.
| Item | What to write down |
|---|---|
| Origination system | Encompass, Byte, MeridianLink or similar; years in each |
| Servicing system | In-house or subservicer; whether payment history is available |
| Volume | Applications, funded loans and declined applications by year |
| Outcomes | Whether payoff, delinquency and default history links back to each loan |
| Loans sold | Share of loans sold to investors and the data terms in those sales |
| Exclusions | SAR and AML files, bureau credit reports, borrower identities |
What a one-page datasheet looks like (fictional example)
Invented to show the level of detail; it describes no real company.
| Field | Fictional example |
|---|---|
| Company | Small-business lender, term loans and lines of credit, 85 staff |
| Years | Origination system 2016 to 2026; servicing history for every funded loan |
| Volume | About 210,000 applications, 34,000 funded loans with full payment history |
| Outcomes | Payoff, delinquency and charge-off linked to the application and decision |
| Exclusions | SAR and AML files, bureau reports, owner identities and account numbers |
| Signer | CEO, after review by general counsel |
What happens next: three steps
A first conversation needs no files. You can stop after any step.
- Describe your records: answer six questions, with no files and no system access. Origin then checks which loans are yours, which were sold with data rights, and what must be excluded.
- Datasheet and sample: Origin turns your answers into a one-page datasheet like the example above, and you approve a small de-identified sample before anything leaves the company.
- Buyers and license: Origin shows the datasheet to the AI developers and data programs that have asked for credit and loan data, with their published terms. You approve scope, use, price and delivery, and sign the license yourself.
- Origin does not charge data owners; a buyer may pay Origin when a deal closes (how Origin is paid).
How long federal rules make lenders keep loan records
Federal consumer-lending rules set minimum retention periods, and they are short compared with the history an AI buyer wants. A lender that deletes files as soon as each period ends loses the closed and charged-off loans that make a data set useful, so decide what to keep before the next purge runs. The agencies that enforce Regulation Z may require longer, and so can state rules and investor agreements; treat the periods below as minimums.
| Record | Federal minimum | Rule |
|---|---|---|
| Consumer credit applications and related records | 25 months after notice of the action taken | Regulation B, 12 CFR 1002.12 |
| Business credit applications | 12 months; 60 days for businesses with gross revenues over $1 million, unless the applicant asks in writing within that time for the reasons or for records to be kept | Regulation B, 12 CFR 1002.12 |
| Truth in Lending compliance evidence | 2 years after disclosures are due or action is taken | Regulation Z, 12 CFR 1026.25 |
| Mortgage closing disclosures and related documents | 5 years after consummation | Regulation Z, 12 CFR 1026.25 |
| Evidence of compliance with the Loan Estimate and Closing Disclosure rules (12 CFR 1026.19(e) and (f)) | 3 years after the later of consummation, the disclosure date or the action date | Regulation Z, 12 CFR 1026.25 |
| Copy of the submitted annual HMDA loan/application register | At least 3 years | Regulation C, 12 CFR 1003.5 |
Resources for your credit and operations team
Guides for the people who keep these records:
- Loan tape template: fields, example and format
- Selling a closed lender's records in a 363 sale
- Loan underwriting and credit decision data
- Can investment firms license deal and credit data?
- De-identification before licensing
Hold years of loan files with payment history? Describe them in six questions, no files needed, and see what your data is worth.
Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes (how Origin is paid). See what your data is worth.
Common questions
Can a non-bank lender sell its loan files to AI companies?
Yes, with limits. Loan files from application to performance can be licensed once borrower identities are removed. SAR and AML material, bureau credit reports and anything restricted by a loan sale agreement stay out.
What has to be removed from loan files before licensing them?
Borrower names, Social Security and account numbers and full addresses; suspicious activity report material and the AML files around it; consumer credit reports obtained from bureaus; and any field restricted by investor or partner agreements.
Can a regulated bank license its loan data to AI developers the same way?
In Origin's view banks move slowly here, because data sharing goes through third-party risk reviews, and the same SAR, privacy and credit-report limits apply. This page is written for non-bank lenders; a bank should start with its regulators' guidance and its own counsel.
Are the credit reports in our loan files ours to license?
No. Consumer reports may be used only for a permitted purpose under the Fair Credit Reporting Act, and they are licensed from the bureau. Keep your decision and your own derived fields; leave the reports out.
Can we include loans that we have already sold to investors?
Only if the sale agreement allows it. Many loan sale agreements transfer the file or restrict use of loan data. Check each agreement, and leave those loans out where it is unclear.
Can the trustee of a closed lender sell its loan files to AI companies?
The files belong to the estate, so the trustee or assignee is the one who can license them, usually with court approval in a bankruptcy and with the same privacy limits. See the guides on business bankruptcy and assignments for the benefit of creditors.
What does Origin charge a lender?
Nothing. Origin does not charge data owners; a buyer may pay Origin when a deal closes. You approve every step and sign the license yourself.
What is a non-bank lender?
A lender that is not a deposit-taking bank: an independent mortgage company, consumer finance or installment lender, auto finance company, or online or small-business lender. It funds loans from its own capital, credit lines or loan sales rather than deposits, and is regulated mainly through state licensing and federal consumer finance law.
How long does a lender have to keep a consumer loan application?
At least 25 months after telling the applicant what action was taken, under Regulation B. Business credit has a 12-month period, cut to 60 days for businesses with gross revenues over $1 million, rising to 12 months if the applicant asks in writing within that time for the reasons or for the records to be kept. Those are minimums; the full set of federal periods, including the 5 years for mortgage closing disclosures, is in the retention table above (12 CFR 1002.12).
Sources and further reading
- TrackImpact: Mercor data licensing programme, published ranges by business type (checked October 30, 2026)
- micro1: Company Data Partnerships
- Mercor: data monetization
- Freddie Mac: Single-Family Loan-Level Dataset
- 31 U.S.C. 5318: compliance, exemptions and summons authority (suspicious activity reports)
- 31 CFR 1029.320: reports by loan or finance companies of suspicious transactions
- 31 CFR 1010.100(lll): definition of loan or finance company (residential mortgage lender or originator)
- 15 U.S.C. 1681b: permissible purposes of consumer reports (Fair Credit Reporting Act)
- 15 U.S.C. 6802: obligations with respect to disclosures of personal information (Gramm-Leach-Bliley Act)
- 15 U.S.C. 6809: definitions (consumer)
- CFPB: Regulation B, 12 CFR 1002.12 (record retention)
- CFPB: Regulation Z, 12 CFR 1026.25 (record retention)
- CFPB: Regulation C, 12 CFR 1003.5 (HMDA disclosure and reporting)