TILA and Regulation Z compliance is not, at its core, a forms problem. The federal rule (implemented at 12 CFR Part 1026) requires lenders to disclose APR, finance charge, amount financed, and payment schedule on every vehicle contract, and most dealer management systems generate that form correctly by default. What actually draws CFPB enforcement is narrower and more dangerous: costs that should have gone into the APR and finance-charge calculation but didn’t, because a warranty, a GPS device, or a negotiated price gap got treated as separate from the “cost of credit.”
That distinction should change how a compliance review is built.
Key insight
If your review process checks whether the disclosure form exists and is filled in, it will pass exactly the deals that later get flagged, because the form can be complete and still be wrong.
What Regulation Z actually requires
Truth in Lending Act (1968), implemented through Regulation Z, exists to let consumers comparison-shop credit on standardized terms. Rulemaking authority sits with the Consumer Financial Protection Bureau, which took it over from the Federal Reserve in 2011. For vehicle financing, the core disclosures are:
- Annual percentage rate (APR): the cost of credit expressed as a yearly rate
- Finance charge: the total dollar cost of credit over the life of the loan
- Amount financed: the loan principal after the down payment and trade-in
- Payment schedule: number, amount, and timing of payments
These four numbers have to be internally consistent. The APR is derived from the finance charge, so if the finance charge is understated, the APR is automatically wrong too, and the form can still look complete. The full requirement text is at eCFR Title 12, Part 1026.
Where the enforcement risk actually sits
The clearest illustration is a CFPB action against a Colorado buy-here-pay-here dealer, Herbies Auto Sales. The dealer advertised a 9.99% APR, which was accurate for the sticker price alone, but not for what customers actually paid. The CFPB’s public summary describes three items that were left out of the disclosed finance charge:
- A required repair warranty, $1,650, sold as mandatory but not counted as part of the cost of credit
- A required GPS payment reminder device, $100, same treatment
- A price differential: the dealer negotiated price with cash buyers but not with credit buyers, so credit customers effectively paid more for the same vehicle, and that gap should have flowed into the finance charge
None of those three items was a missing form. The Buyers Guide was presumably on the windshield, the contract presumably had an APR field filled in. What the Bureau found was that mandatory add-on costs and a documented price gap between cash and credit deals weren’t flowing into the number that has to be accurate: the disclosed cost of credit. The dealer paid $700,000 in consumer restitution plus a suspended civil penalty for roughly two years of deals across an estimated 1,000 consumers a year.
That’s the pattern worth internalizing: enforcement risk concentrates in the math behind the disclosure, not in whether the disclosure exists.
Why “the form generated correctly” is the wrong check
Most F&I desks and back-office teams that review deal jackets for compliance are checking presence and completeness: is the disclosure form there, is it signed, does the APR field have a number in it. That check catches missing paperwork, which is real and common: deal jackets bundle a dozen-plus documents from different departments and software, and a document filed under the wrong deal is a routine finding in dealer audits. But it does not catch a correctly formatted disclosure built on an incomplete finance-charge calculation, because the form itself has no way to flag that a mandatory add-on was excluded from the number it’s displaying.
A review structured around the actual risk asks a different question for every deal: does every mandatory cost of obtaining credit (the warranty that was required to close, the aftermarket device that was required to close, any documented price differential between cash and credit terms) appear inside the finance charge, not outside it as a line item that happens to sit next to it on the invoice. That’s a reconciliation between deal structure and disclosure math, not a completeness check on a PDF.
This is the same shape of problem we’ve written about in how a leading automotive marketplace cut its document review error rate from 7% to 1%: the failure mode wasn’t a missing document, it was a document that looked fine on its face but encoded the wrong underlying fact. TILA disclosure review has the identical structure. The check that matters isn’t “is the form here,” it’s “does the number on the form match the deal.”
What this means for a lender’s back office
If you run compliance review for an auto lender or a BHPH operation, three things follow from where the actual risk sits:
- Treat "mandatory" as the trigger, not "add-on." Anything a customer must purchase or accept to get financed, whether it's framed as a service contract, a warranty, or a tracking device, belongs in the finance charge. Anything genuinely optional and separately declinable can sit outside it. The dividing line is whether the customer had a real choice, not what the line item is called on the invoice.
- Check cash-versus-credit pricing symmetry. If your sales desk negotiates price with cash buyers and holds a firmer line with credit buyers, that gap is a finance charge in substance even if it never appears as a labeled fee. Reviewing only the disclosed APR field won't surface this. It requires comparing the credit deal's price against what a cash buyer would have paid for the same unit, which is exactly the kind of cross-document reconciliation that's easy to specify as a rule and tedious to do by hand at volume.
- Audit the calculation, not just the form. A disclosure review that only confirms a document exists, is signed, and has numbers in the right fields will pass a Herbies-shaped deal every time, because the form was internally consistent with an incomplete finance charge. The review needs to trace each disclosed number back to the deal components that should have fed it.
TILA disclosure review is one piece of a larger back-office compliance surface; our auto lender back office operations guide covers where this fits alongside funding, stips, and title work. For lenders and BHPH back offices dealing with funding delays on top of compliance pressure, the operational playbook overlaps heavily with what we cover in cutting funding delay at an auto lender and in evaluating a BPO vendor for auto finance back-office work: the same document reconciliation discipline that catches a missing stip also catches a finance charge that’s missing a mandatory cost. If your loan origination system doesn’t flag this automatically, see our guide on integrating AI document review with your loan origination system. And for the enforcement side specifically, our companion piece on what actually triggered CFPB enforcement against buy-here-pay-here dealers goes deeper into the pattern across multiple cases.
FAQ
What does Regulation Z require in vehicle financing disclosures? Standardized disclosure of APR, finance charge, amount financed, and payment schedule, so consumers can compare credit offers across lenders. These four figures must be internally consistent: the APR is mathematically derived from the finance charge, so an understated finance charge produces an understated APR even when the form itself is complete. See 12 CFR Part 1026 for the full text.
What has drawn CFPB enforcement attention in this area? Cases have targeted the exclusion of required add-on costs, such as service warranties, tracking or starter-interrupt devices, and cash-versus-credit price differentials, from the APR and finance-charge calculation, not just missing or malformed disclosure forms. The Herbies Auto Sales action is a documented example: a mandatory warranty and a mandatory GPS device were left out of the disclosed finance charge, and the dealer paid $700,000 in consumer restitution.
Does a properly filled-out disclosure form protect a lender from enforcement risk? Not by itself. A form can be complete, signed, and formatted correctly while still reporting an APR that excludes mandatory costs the borrower actually had to pay. The compliance question that matters is whether every mandatory cost of credit was included in the underlying calculation, not whether the form exists.
If your compliance review is still built around confirming that a disclosure form exists rather than reconciling the finance-charge math behind it, that’s a structural gap worth closing before an examiner finds it for you. Deskflow applies the same document-and-rule reconciliation logic lenders need for TILA review to the rest of the deal jacket, catching the mismatches that a presence check alone would miss.
This article summarizes public information for operations teams and is not legal advice. Requirements change; always confirm with the linked official source or your compliance counsel.