12 Compliance Pitfalls F&I Managers Must Avoid to Protect Gross

Compliance misses can wipe out months of PVR in one bad audit or a single angry regulator. TL;DR: Eliminate payment packing, lock in a fair lending policy, document OFAC/Red Flags, clean up your menu process, and tighten deal-jacket proof. Standardize, disclose, and log—protect your gross and your CSI.

What compliance mistakes quietly crush PVR and CSI?

Payment packing and junk fees disguised in payments
Sloppy or inconsistent menu disclosures
Uncapped dealer reserve and undocumented rate exceptions
OFAC/Red Flags performed late or without proof
Weak credit disclosure process (Reg B, adverse action, Risk-Based Pricing)
Shaky spot deliveries and yo-yo unwind practices
Misrepresenting GAP/VSC benefits or tying products to approval
Poor eSign/eContract consent and delivery of copies
Privacy/Safeguards lapses with customer PII
Missing, mismatched, or incomplete deal-jacket documentation

If any of these are loose in your store, your gross is on borrowed time.

Are you quoting payments the right way (no packing, no surprises)?

Payment packing is the fastest way to tank PVR, CSI, and your job. Keep quotes clean:

Always show a base payment first (vehicle, tax, fees, buy rate, no products). Document it.
Present products on a separate, consistent, signed menu showing price and optional nature.
If you re-quote with products, show both with-and-without comparisons in writing.
Never bury product costs in price or rate. If it’s optional, disclose it clearly as optional.

Pro tip: Lock your desking tool so desk managers can’t default to “with products” payments.

How do you avoid fair lending trouble on rate and product pricing?

Disparate impact doesn’t care about intent. Put a fence around rate and price:

Set a written cap on dealer reserve (e.g., max 150–200 bps over buy).
Use a rate matrix and price grid for products. Same customer profile, same pricing.
Maintain an exception log. If you deviate, record the legitimate business reason (competing offer, lender program, credit tier error). No protected-class descriptors—ever.
Audit penetration and reserve by lender and salesperson monthly for anomalies.

Consistency protects gross and approvals—and keeps you out of headlines.

What are the credit and disclosure traps in the box?

Accurate credit app data: No straw buyers, no income inflating. Verify sources when it smells off.
Reg B/Adverse Action: If credit is denied or materially different than requested, ensure required notices go out timely (often the lender handles denial, but you own the process clarity).
Risk-Based Pricing Notice: If the customer doesn’t receive the lender’s Credit Score Disclosure Exception, you likely owe an RBP notice at delivery. Know your lender workflows.

Build a checklist so every deal gets the right notice at the right time.

Are your OFAC and Red Flags documented before the T.O. is done?

Run OFAC on every buyer, co-buyer, and business entity before funding. Print or digitally save the timestamped result in the jacket.
Follow your Red Flags program. If a flag hits (ID mismatch, fraud indicators), stop, resolve, and document the resolution before contracting.
Train on what an OFAC hit looks like and escalation steps. Never deliver before clearing it.

“No print, no proof” is a losing argument in an audit.

How do you keep spot deliveries legal (and out of yo-yo territory)?

Use a lawyer-vetted conditional delivery agreement that’s state-compliant.
Do not change price, rate, or products after the fact to make a spot fund. If you can’t match the terms, unwind cleanly and quickly.
Provide temporary tags and insurance guidance by the book; honor We Owes regardless of funding outcome.
Time-box your spots. If it’s not funded within the set window, escalate and decide.

Spotting is a tool, not a crutch. Sloppy spots create complaints that invite regulators.

Are GAP, VSC, and ancillaries being sold accurately and fairly?

Clearly state products are optional. No tying approval or rate to buying products.
Make coverage truthful: no “bumper-to-bumper” claims if it’s not. Align GAP term/limit with loan term and LTV reality.
Disclose cancellation rights and refund expectations (pro rata vs. rule of 78s per state and contract).
Document lender requirements if the lender mandates GAP on high LTV—don’t misrepresent it as your requirement.

Misrepresentation today equals chargebacks and attorneys tomorrow.

Is your eSign process bulletproof (consent, copies, audit trail)?

Obtain E-SIGN consent before eSigning. Capture and retain the consent record.
Deliver completed copies (contract, menu, product agreements, privacy notice) electronically or in print—and prove delivery.
Lock version control so customers sign the same docs you store. Preserve metadata and audit trails.

If you can’t show who signed what, when, and how, you didn’t.

Are you meeting Privacy and Safeguards in the box?

Provide GLBA privacy notices and honor opt-outs where applicable.
Follow your written Safeguards program: clean desk policy, locked cabinets, no PII on sticky notes, no thumb drives.
Vet your vendors (menus, eContract, aftermarket) for data security and keep agreements on file.
For California and similar states, follow CCPA/CPRA processes for data requests.

Data sloppiness is a reputational and legal time bomb.

What belongs in every deal jacket (no exceptions)?

Signed base payment disclosure and signed menu with accepted/declined boxes
Buy rate proof, rate markup policy reference, and any exception log entry
OFAC result, Red Flags resolution notes, and ID copies per policy
Credit app, credit score disclosure/RBP notice proof, adverse action copy if applicable
Contract, buyer’s order, product contracts, We Owes/due bills, eSign consent proof
Form 8300 if applicable (cash > $10k) and anti-structuring notes

If it’s not documented, it didn’t happen.

How do you prevent Form 8300 and cash-reporting mistakes?

Aggregate cash, money orders, cashier’s checks, and traveler’s checks over a 12-month period for the same buyer/transaction as required.
File within 15 days, give the written statement to the customer, and document delivery.
Train the floor not to coach customers into splitting transactions (structuring is illegal).

This is low-hanging compliance fruit. Don’t trip over it.

What cadence keeps compliance tight without killing gross?

Daily: self-audit yesterday’s deals for menu, OFAC, and base payment proof.
Weekly: 10-deal spot check with the desk and a lender rep if possible.
Monthly: Fair lending penetration/reserve review and exception log audit.
Quarterly: Retrain on hot spots (packing, spots, Red Flags) and update policies.

Discipline wins. Your PVR and CSI will reflect it.

Frequently Asked Questions

What’s the difference between payment packing and a value menu?

Packing hides products in the base payment without disclosure. A value menu presents optional products with clear prices and side-by-side payment impact after you’ve shown a clean base payment. The customer can accept or decline—no surprises.

How much should I cap dealer reserve at?

Most stores land between 150–200 bps over buy rate with tight exception controls. The exact cap is your call—just write it, train it, and audit it. No cap plus no log equals fair lending risk.

Do I need to provide a Risk-Based Pricing Notice on every deal?

Not if the lender delivers a compliant Credit Score Disclosure Exception to the customer. If they don’t, you likely owe an RBP notice at or before delivery. Know each lender’s workflow and document who delivered what.

Are spot deliveries illegal?

No. Spots are legal when done with proper state-specific forms, transparent terms, and clean unwinds if funding fails. Changing price, rate, or products after the fact is where you get into trouble.

What belongs in a fair lending exception log?

Date, deal number, lender, buy rate, sell rate, amount of markup waived or added, product price variance, and a legitimate, non-discriminatory business reason (e.g., competing offer, lender program). Manager signature. Keep it audit-ready.

Ready to harden your process without killing momentum in the box? Try DealerSpark.Ai to coach your team’s voice on compliant, high-conversion conversations—no scripts, just results.