Address Verification for Mortgage Lending and HMDA

An address verification API helps a mortgage lender put the property address into the form HMDA's Regulation C asks for: street address, city, two-letter state code and ZIP Code. In our October 16, 2026 test, sthan.io's verification API returned the county name, its geocoding API returned the five-digit county FIPS code, and neither returned the census tract, which came from the FFIEC geocoder.

What Regulation C asks for about the property

Section 1003.4(a)(9) of Regulation C asks for "the location of the property securing the covered loan" in two parts: "(i) The property address", and, when the property is in an MSA or MD (a metropolitan area or one of its divisions) where the lender has a home or branch office, or the lender is subject to paragraph (e), the property's "(A) State; (B) County; and (C) Census tract", with the tract required only "if the property is located in a county with a population of more than 30,000".

The official interpretation (Supplement I to Part 1003) and the 2026 Filing Instructions Guide spell out the format of each field. Here they are next to what sthan.io returned on October 16, 2026.

The filing guide says U.S. Postal Service Publication 28 "can be used as a guide for formatting the street address to help improve geocoding accuracy", and lists "Spelled-out numbers" among the formats that are "generally not preferred". When we sent 350 Fifth Avenue, New York NY 10118, sthan.io returned the street line as 350 5th Ave. Running verification first gives the tract lookup a standardized street line to work from. A postal match standardizes the address; on its own it does not establish the secured parcel, the jurisdiction it sits in, or whether your institution must report the loan.

One property, end to end

On October 16, 2026 we sent one address to sthan.io: 1355 Market St Suite 900, San Francisco CA 94103, an office building with suites. We used a commercial building so that no private home appears on this page; a home address goes through the same steps and fields. We then looked up the same building in the FFIEC Geocoding/Mapping System with the 2026 activity year selected. Every HMDA location field, and where its value came from:

This is one example. It shows how the fields line up; it does not show that a postal county value is the HMDA location for every property, so take the county, tract and MSA/MD for each loan from the geographic lookup for its reporting year.

The 11-digit tract is the state code, the county code and the six-digit tract code written together: the Census Geocoder listed this tract with state "06", county "075" and tract "017603". The guide's own example follows the same pattern: 06037264000 for a tract in Los Angeles County, CA.

The verification response also carried deliverableStatus "Confirmed" and record type "H" (highrise), with the suite returned as unitType "STE" and unitNumber "900". When we sent 350 Fifth Avenue, New York NY 10118 with no suite, the status was "ConfirmedPrimaryOnly", which sthan.io defines as "primary OK but secondary unit missing or invalid". For a loan file, that is a prompt to get the unit number before you report the street address.

Report the property address, even when mail goes elsewhere

The official interpretation is direct: if a loan is secured by a property at 123 Main Street and the borrower's mailing address is a post office box, "The financial institution should not report the post office box, and should report 123 Main Street." The 2026 guide lists General Delivery and Post Office Box addresses among the formats that are "generally not preferred".

A verification API helps here because it labels the address type. sthan.io's recordType is "P" for a PO box, "S" for a street address and "H" for a highrise. A "P" in the property address field is worth a second look before filing.

The borrower's address under the CIP rule

Banks also collect the borrower's own address under the customer identification program (CIP) rule, 31 CFR 1020.220. For an individual, the address "shall be" "a residential or business street address", and for someone without one, an APO or FPO box number or the street address of next of kin or another contact. The program "must contain procedures for verifying the identity of the customer", and those procedures "must describe when the bank will use documents, non-documentary methods, or a combination of both methods".

An address API can standardize that address and say whether it is a known, deliverable address and whether it is a PO box. It does not confirm that the borrower lives there or prove who the borrower is. That part stays with your identity verification procedures.

What an address API does not do for HMDA

• No census tract. The FFIEC says its Geocoding/Mapping System "allows institutions to enter a street address to determine the corresponding geocode" (MSA/MD, state, county and census tract), and that "It is critical that the correct activity year is selected". The Census Geocoder offers "interactive & programmatic (REST) access" for matching addresses to geographies.
• No MSA/MD from sthan.io. Whether a property falls in an MSA or MD where you have an office is a question for the FFIEC system.
• County code from geocoding only. The verification response gives the county name; the five-digit code came from the geocoding response. Treat either as a cross-check on the geographic lookup for the reporting year.
• No property identification. A deliverable postal address does not by itself confirm that it is the property securing the loan or which parcel it is.
• No compliance decision. Whether a field is reported, "NA" or "Exempt" depends on your institution and the transaction, as set out in Regulation C and the filing guide.

Sources

All read October 16, 2026: eCFR 12 CFR 1003.4 and Supplement I to Part 1003 (official interpretation, comments 4(a)(9)(i)-1 to 4(a)(9)(ii)(C)-1), eCFR text up to date as of October 14, 2026; CFPB/FFIEC 2026 HMDA Filing Instructions Guide (ffiec.cfpb.gov/documentation/fig/2026/overview); eCFR 31 CFR 1020.220; U.S. Census Bureau 2020 county codes for California (www2.census.gov/geo/docs/reference/codes2020/cou/st06_ca_cou2020.txt); FFIEC Geocoding/Mapping System (geomap.ffiec.gov), with a lookup of 1355 Market St, San Francisco, CA 94103 for 2026; Census Geocoder (geocoding.geo.census.gov), with a geographies lookup of the same address; live sthan.io API calls to /v2/address-verification/usa/ and /Geocoding/USA/Forward/; sthan.io/docs (deliverableStatus and recordType definitions); sthan.io/products/address-verification-usa and sthan.io/products/geocoding-usa (free tier and prices). This page explains what the rules say; it is not legal advice.