Top F&I Compliance Pitfalls in 2026—and Exactly How to Avoid Them

Avoid payment packing, inconsistent rate markups, sloppy spot deliveries, missing adverse action/RBP notices, skipping OFAC/Red Flags checks, and weak privacy controls. Lock down menu accuracy, document every T.O., deliver required notices on time, and run a daily compliance checklist. Do this and you’ll protect CSI, PVR, and your license.

What are the biggest F&I compliance landmines right now?

These are the hits that sink gross, trigger chargebacks, and invite regulators:

Payment packing and misleading menus (showing a payment with products baked in before disclosing base payment)
Inconsistent rate markups and discounting (fair lending/ECOA risk)
Sloppy spot deliveries and backdating on re-contracts (yo-yo exposure)
Missing or late Adverse Action or Risk-Based Pricing/Score notices
Skipping OFAC checks on all parties before delivery
Weak Red Flags Identity Theft procedures and poor ID verification
GLBA Privacy and FTC Safeguards Rule gaps (data left open in the box, unsecured eDocs)
Inaccurate TILA disclosures, bundle pricing, or product misrepresentation
Product cancellations/refunds not processed on time after payoff or unwind
Poor documentation: no menu signature, no We-Owe, no due bill, no T.O. notes

If you fix these, your deals fund faster, chargebacks drop, and you don’t get invited to a state AG party.

How do I eliminate payment packing and menu risk?

Payment packing kills trust and gets you fined. Make your menu bulletproof:

Lock the base deal first: APR, term, price, cash/trade. No products in the base payment.
Present a clean base payment on its own page or first line before any options.
Itemize every product: price, term, coverage. No bundles without line-item pricing.
Mark every product as voluntary. No tying products to approval or rate.
Reprint the menu if APR, term, or product prices change—no editing with pen.
Capture customer signatures/initials on the final chosen option plus the base payment page.
Keep the signed menu in the jacket and your DMS imaging. If it’s not documented, it didn’t happen.
Train desking to stop quoting packed payments on the floor. Sales managers set you up for risk.

Pro tip: Use a visible “Base Payment” watermark and require a manager T.O. signoff before moving to options.

What’s the right way to handle spot deliveries and re-contracts?

Spotting is part of the game, but do it clean:

Use a written conditional delivery agreement that spells out the conditions, time limits, and customer options.
No backdating. If you re-contract, today’s date goes on the new contract. Always.
If the buy rate changes, redisclose the base payment and re-present the menu. New signatures.
If the deal cannot be bought, unwind quickly, return the trade/title, and process product cancellations and refunds immediately per state/lender timelines.
Never condition financing on buying products or “keeping” products to save the deal. That’s tying.
Keep an auditable log of lender decisions, callback notes, and customer contact attempts.

Clean spotting keeps you out of UDAP trouble and protects CSI when you have to pivot.

Which notices are mandatory on most F&I deals?

You don’t need a law degree—just a checklist and timing discipline:

Adverse Action Notice (ECOA/Reg B): When credit is denied or you can’t approve on requested terms, issue within required timeframes (commonly 30 days) and keep a copy.
Risk-Based Pricing or Credit Score Disclosure Exception Notice: If the APR is higher than the best tier the consumer qualifies for, provide an RBP notice or use the exception notice at/around consummation. Keep proof it was delivered.
OFAC SDN check: Run on every buyer and co-buyer before delivery; document screenshots or system logs.
GLBA Privacy Notice: Provide at signing; include opt-out when applicable. BHPH stores have ongoing annual obligations.
Red Flags Identity Theft: Complete your ID checklist (photo ID match, Red Flags clear, any discrepancies resolved and documented) before funding.

Put these forms in the same spot in every jacket so auditors and lenders see the pattern.

How do I protect customer data under the FTC Safeguards Rule?

Your F&I office touches the most NPPI. Treat it like cash in a safe:

Clean desk: lock drawers when you leave the box, face-down any NPPI, and shred immediately.
eSign right: obtain E-SIGN consent, use secure portals, and store audit trails. No raw PDFs over open email.
Multi-factor authentication and role-based access for your DMS/eContracting tools.
Vendor oversight: verify your menu, eContract, and data vendors have written safeguards and SOC reports.
Least-privilege: salespeople don’t need full bureau reports—keep access tight.
Incident response: know who you call, how you contain, and how you notify per state rules.
Training and testing: quarterly refreshers, phishing simulations, and spot audits of your jacket files.

Safeguards isn’t optional. Fines are real, and breaches crush CSI and reputation.

How do I enforce fair lending and rate integrity?

ECOA problems happen when markups are all over the map.

Set a written rate markup cap and a limited set of documented, non-discriminatory reasons to deviate (e.g., competitor rate match, employee deal).
Use a rate matrix and require a manager note for any deviation.
Apply the same discounting logic across all customers. Consistency is your shield.
Keep lender callbacks, approval tiers, and buy rates in the jacket.

Tight rate discipline protects gross and kills disparate impact risk.

What daily routine keeps me clean and fast?

A 10-minute rhythm that saves hours of pain:

Morning: verify form packs are current; test-print your menu and privacy notice.
Run an OFAC self-audit on yesterday’s deliveries.
Red Flags log: ensure checklists are complete before the deal hits accounting.
Rate cap report: scan yesterday’s markups for outliers.
Deal jacket order: privacy, OFAC, Red Flags, bureau/score notice, menu, contract, product forms, We-Owes.
Product cancellation queue: process refunds/unwinds from the prior day.
T.O. notes: make sure every handoff is timestamped in the CRM/DMS.

Consistency funds deals faster and keeps lenders happy.

Frequently Asked Questions

Do I need both a Risk-Based Pricing Notice and a Credit Score Disclosure?

No. Most stores use the Credit Score Disclosure Exception Notice instead of the RBP notice. Pick one compliant path and document delivery every time.

How long should I keep F&I documents?

Follow state and lender guidance, but as a baseline keep adverse action records at least 25 months (ECOA) and deal jackets 5–7 years. When in doubt, retain longer and secure them.

Can I sell products on cash deals without TILA disclosures?

Yes, but the same UDAP rules apply. Present a clean base price, itemize products, show they’re voluntary, and get a signed menu. No payment packing—ever.

What happens if I miss an OFAC check?

Civil penalties can be severe. Run OFAC before delivery on every signer, document the result, and include it in your funding package. Build it into your DMS workflow so it can’t be skipped.

Is recording F&I presentations a good idea?

If legal in your state and with customer consent, recordings are powerful for training, dispute resolution, and compliance audits. Store securely and limit access.

Bottom line

Compliance isn’t a memo—it’s a daily muscle. Nail your menu, rate integrity, notices, OFAC/Red Flags, and data security, and you’ll drive faster funding, higher PVR, and better CSI with less drama.

Want a coach in your ear that keeps you compliant while you sell? Try DealerSpark.Ai—real-time voice coaching that protects the deal, the gross, and your name on the license.