Is buying mortgage leads legal

No federal statute read for this page prohibits buying a mortgage lead. What federal law regulates is what happens after the record changes hands: the call, the text, the credit pull and, since March 2026, one particular kind of list. Each sits under a separate regime with its own conditions, and each duty attaches to the party performing the act rather than to the party that sold the file.

Calling and texting the number is where the first duty lands

The Telephone Consumer Protection Act at 47 U.S.C. 227 makes it unlawful for a person to make the covered call, and the FCC rules implementing it live at 47 CFR 64.1200. Consent is the condition. Prior express written consent is defined at 64.1200(f)(9) as a signed agreement authorising the seller to deliver those messages to a stated number. The do-not-call registry has a narrower door at 64.1200(c)(2)(ii): a signed agreement saying the consumer agrees to be contacted by that seller.

A purchase moves the file. It does not make the buyer the party the consumer authorised. The FCC's attempt to require a separate consent per seller was vacated by the Eleventh Circuit in Insurance Marketing Coalition v. FCC on 24 January 2025, so consent need not name one seller at a time. The registry exemption was not what was vacated, and still asks for a named seller. What a usable record contains is in prior express written consent and what TCPA consent on a mortgage lead is.

Consent also ends. Under 64.1200(a)(10) a called party may revoke by any reasonable method, and 64.1200(d) requires anyone making telemarketing calls to keep its own do-not-call list and honour a request on it for five years. The mechanics are in revocation of consent.

Source: Telephone Consumer Protection Act, 47 U.S.C. 227, read on govinfo.gov on 20 September 2026 for 227(b)(1)(A), which places the prohibition on the person who makes the call, and for the two private rights of action at 227(b)(3) and 227(c)(5), whose damages language differs and is not merged here · 47 CFR 64.1200, read in full through the eCFR renderer API on the same date, for the definition of prior express written consent at (f)(9), the do-not-call registry exemption at (c)(2)(ii), revocation at (a)(10) and the caller's own do-not-call list at (d) and (d)(6) · Insurance Marketing Coalition v. FCC, Eleventh Circuit, 24 January 2025, for the vacated one-to-one consent requirement. None of these sources addresses the purchase of a lead, and none is cited here as permitting or prohibiting it.

The FTC rule reaches the company behind the dialer as well as the dialer

The Telemarketing Sales Rule at 16 CFR 310 covers the same call from a second direction. Section 310.4(b)(1) makes the listed conduct a violation for a telemarketer to engage in, and for a seller to cause a telemarketer to engage in. The seller is defined at 310.2(ee) as the party providing the goods or services, the telemarketer at 310.2(hh) as the party placing the call. Handing the file to a call centre adds a party to the exposure rather than moving it.

The registry rule sits at 310.4(b)(1)(iii)(B). A call to a registered number is a violation unless the seller can show a written agreement evidencing that person's authorisation for calls by or on behalf of a specific party, carrying the number and the signature, or an established business relationship. Calling hours are fixed at 310.4(c): 8 a.m. to 9 p.m. local time where the called person is.

There is a safe harbour, and it is a checklist rather than a defence asserted afterwards. Section 310.4(b)(3) sets out six conditions, all part of routine business practice: written procedures, trained personnel, a maintained internal list, a documented process using a registry version no more than 31 days old, monitoring and enforcement, and the offending call being an error. That list is unpacked in the national do-not-call registry.

One divergence matters before anyone builds a rule into a dialer. The FTC's established business relationship at 310.2(q) runs 540 days from a purchase or financial transaction and 90 days from an inquiry. The FCC's, at 64.1200(f)(5), runs 18 months and three months. The windows are not the same length and both rules reach the same call, so the narrower of the pair is what keeps a call inside both.

A purchased file is not a permissible purpose for a credit pull

The Fair Credit Reporting Act lists the circumstances in which a consumer reporting agency may furnish a report at 15 U.S.C. 1681b(a), and closes that list with the words "and no other". Section 1681b(f) is the mirror rule for the user: a person shall not use or obtain a consumer report unless it is obtained for a purpose authorised by that section and that purpose is certified.

The purposes a buyer would reach for all turn on something the consumer did with the buyer. 1681b(a)(3)(A) covers a credit transaction involving that consumer, 1681b(a)(3)(F)(i) a legitimate business need in connection with a business transaction initiated by the consumer, 1681b(a)(2) the consumer's own written instructions. The purchase is between buyer and vendor, and the consumer is not a party to it. The test is unpacked in permissible purpose.

One category of list closed on 4 March 2026

The Homebuyers Privacy Protection Act, Public Law 119-36, added a paragraph to section 604(c) of the Fair Credit Reporting Act. Where someone requests a consumer report in connection with a credit transaction involving a residential mortgage loan, the agency may not furnish a report to another person on the strength of that request unless the transaction is a firm offer of credit or insurance and that other person clears a short list of conditions.

Those are documentation filed with the agency certifying the consumer's authorisation, having originated the consumer's current residential mortgage loan, servicing it, or being an insured depository institution or credit union holding a current account for that consumer. Section 3 sets the effective date at 180 days after enactment and the enrolled text closes "Approved September 5, 2025", counting out to 4 March 2026 rather than the 5th most trade coverage prints. The mechanism is in trigger lead.

Source: Fair Credit Reporting Act, 15 U.S.C. 1681b, read on govinfo.gov on 20 September 2026 for the permissible purposes at (a) and the closing words "and no other", for (a)(2), (a)(3)(A) and (a)(3)(F)(i), and for the user-side prohibition at (f) · Homebuyers Privacy Protection Act, Public Law 119-36, enrolled text at govinfo.gov, section 2 for the new paragraph (4) of section 604(c) and its four permitted recipients, section 3 for the effective date of 180 days after enactment, and the closing line "Approved September 5, 2025" · 16 CFR 310, read in full through the eCFR renderer API on 20 September 2026, for 310.2(ee), (hh) and (q), 310.4(b)(1), 310.4(b)(3) and 310.4(c). The 180-day count to 4 March 2026 was recomputed for this page rather than carried across from another.

State rules go further in places, and this page has not read them

47 U.S.C. 227(f)(1) provides that nothing in that section or its regulations preempts state law imposing more restrictive intrastate requirements on automatic dialing systems, prerecorded voice messages, or the making of telephone solicitations. Some states legislate there with their own consent definitions and private rights of action. No state statute was opened for this page, so none is named and no count is given. A half-finished list reads as a promise that the states left out have nothing to check. Treat the federal rules above as the floor.

Licensing attaches to originating the loan, not to the file on your desk

The SAFE Act defines a loan originator at 12 U.S.C. 5102(4)(A)(i) as an individual who takes a residential mortgage loan application and offers or negotiates terms for compensation, and 12 U.S.C. 5103(a) bars such an individual from that business without a registration or a state licence and a unique identifier. The trigger in both is the origination work, and neither mentions buying a list. That is as far as this page goes: it does not claim purchasing leads is free of licensing consequence anywhere, because state licensing statutes were not read here.

Two things follow. The exposure sits with whoever makes the call, sends the text or pulls the report, ordinarily the buyer rather than the vendor. And the paperwork that would answer a challenge, meaning the language the consumer saw, the date, the capture method and the company it named, either exists at the vendor before the sale or does not exist at all. This page is an orientation to the regimes that apply, not legal advice.

Source: S.A.F.E. Mortgage Licensing Act, 12 U.S.C. 5102(4)(A)(i) for the definition of loan originator and 12 U.S.C. 5103(a) for the licensing or registration requirement, read on govinfo.gov on 20 September 2026 · 47 U.S.C. 227(f)(1) for the preservation of more restrictive intrastate state law. Neither SAFE Act section addresses the purchase of leads, and this page attaches no claim about purchasing to them. No state telemarketing, lead generation or licensing statute was read for this page, which is why none is cited, named or counted.