F&I Compliance: TILA, ECOA, the Red Flags Rule, and AFIP Certification

In our chapter on dealer licensing and the regulatory maze, we mapped the full compliance stack a dealership operates under — state licensing, the FTC Safeguards Rule, lemon laws, environmental and OSHA requirements — and introduced the federal credit statutes at a high level. This chapter does not repeat that map. Instead, it opens a single deal jacket and walks through the federal consumer-credit requirements that apply to the documents inside it.

For an investor, F&I compliance is not an abstract legal topic. The F&I office produces a large share of a dealership's gross profit, as we covered in the previous two chapters, and it is also where the largest regulatory and litigation exposure tends to concentrate. Fair-lending enforcement actions, class actions over disclosures, and state attorney general investigations into add-on products have all centered on F&I practices. A store whose F&I income depends on noncompliant practices does not have durable earnings; it has a contingent liability that has not been priced.

This chapter walks through the Truth in Lending Act, the Equal Credit Opportunity Act and dealer markup, the Fair Credit Reporting Act, the Red Flags Rule, the current status of federal add-on product regulation, and the role of AFIP certification in a compliance program. It is general education about how these rules commonly apply to dealers. It is not legal advice, and any specific situation should be reviewed with qualified counsel. The Fund's actual terms are governed solely by its offering documents.

Why the Dealer Is the Creditor

Most dealer-arranged financing is indirect. The customer signs a retail installment sale contract with the dealership, which names the dealer as the original creditor, and the dealer then assigns that contract to a bank, credit union, or captive finance company. Because the dealer is the party to whom the obligation is initially payable, the dealer is generally the creditor for purposes of the Truth in Lending Act and its implementing rule, Regulation Z, and a creditor for purposes of the Equal Credit Opportunity Act and Regulation B. A jurisdictional point is worth noting. The Dodd-Frank Act generally excluded motor vehicle dealers that routinely assign their contracts to unaffiliated third parties from the rulemaking and enforcement authority of the Consumer Financial Protection Bureau. The Federal Trade Commission retains enforcement authority over those dealers, and the CFPB supervises many of the larger indirect auto lenders who buy their contracts. In practice, CFPB expectations reach dealers through their lender relationships even where the Bureau has no direct authority over the dealer.

TILA: The Federal Box and the Itemization

The Truth in Lending Act requires clear, conspicuous disclosure of the cost of credit before the customer becomes obligated. On a retail installment sale contract, the core disclosures appear in what the industry calls the federal box: the annual percentage rate, the finance charge, the amount financed, the total of payments, and, for a credit sale, the total sale price, along with the payment schedule. The disclosures must be accurate; for a regular transaction, Regulation Z treats an APR as accurate only if it is within one-eighth of one percentage point of the true rate.

The itemization of the amount financed is where F&I products show up. When a customer finances a service contract, GAP, or tire and wheel protection, the price is typically added to the amount financed and itemized on the contract. This is where TILA and product practices intersect. Charges for products that are truly optional, and that are offered to cash buyers on the same terms, are generally not finance charges. But if a product is required as a condition of the financing, its cost can be treated as part of the finance charge, which changes the APR — and an understated finance charge or APR is a TILA violation. GAP and other debt cancellation products have specific Regulation Z conditions for exclusion from the finance charge, including that the coverage not be required, that this be disclosed in writing, and that the customer affirmatively elect it after receiving the cost disclosure.

TILA also reaches advertising. Under Regulation Z, an ad that states certain triggering terms — such as the amount of a payment, the number of payments, the down payment, or the amount of any finance charge — must also disclose the down payment, the terms of repayment, and the annual percentage rate. Leases fall under a parallel framework, the Consumer Leasing Act and Regulation M. Separately, the FTC's Holder Rule requires consumer credit contracts arranged by sellers to include a notice preserving the customer's claims and defenses against any later holder of the contract — the reason lenders care deeply about how the dealers they buy from treat customers.

ECOA and the Dealer Markup Question

The Equal Credit Opportunity Act prohibits discrimination in any aspect of a credit transaction on the basis of race, color, religion, national origin, sex, marital status, or age (provided the applicant has capacity to contract), because the applicant's income comes from public assistance, or because the applicant has exercised rights under consumer credit laws. Regulation B adds specific procedural requirements that matter in the finance office. A creditor generally cannot require a spouse's signature if the applicant qualifies individually. And when a credit application is denied — including when the dealer cannot find a lender willing to buy the contract — the applicant is entitled to an adverse action notice, generally within 30 days, explaining the decision or the right to request the reasons.

The most consequential fair-lending issue for dealers is markup discretion. As we described in the F&I menu chapter, a dealer can typically write a contract at a rate above the lender's buy rate, within the lender's cap, and share in the difference. Regulators have taken the position that discretionary markup can produce a disparate impact: even without intent, customers in protected classes may end up paying higher markups on average. Between 2013 and 2016, federal regulators reached consent orders with several large indirect auto lenders that, among other remedies, reduced the maximum permitted markup or moved to flat-fee compensation.

The CFPB's 2013 guidance bulletin on indirect auto lending was later disapproved by Congress under the Congressional Review Act in 2018, but the underlying statute did not change, and fair-lending enforcement against dealers has continued at the federal and state level, including actions alleging that minority customers were charged higher markups and fees. The common industry response is a documented markup policy: a standard markup applied to every customer, with deviations allowed only for defined, legitimate business reasons — meeting a competing offer, accommodating a customer's payment budget — and documented in the file every time. NADA, together with other dealer associations, published a widely used model Fair Credit Compliance Policy and Program built on that approach.

FCRA, Risk-Based Pricing, and the Red Flags Rule

The Fair Credit Reporting Act governs the credit reports pulled in the finance office. A dealer needs a permissible purpose to obtain a consumer report, and the FCRA's risk-based pricing rules generally require a notice to customers who receive less favorable terms based on their credit report — or, under a commonly used exception, a credit score disclosure notice provided to every applicant. If credit is denied based in whole or in part on a consumer report, FCRA adverse action requirements apply alongside those of Regulation B.

The Red Flags Rule, issued by the FTC and other federal agencies under the Fair and Accurate Credit Transactions Act of 2003 and codified for FTC-regulated entities at 16 CFR Part 681, requires covered creditors to maintain a written identity theft prevention program. After Congress narrowed the definition of creditor in the Red Flag Program Clarification Act of 2010, dealers that regularly extend, renew, or arrange credit in the ordinary course of business generally remain covered. The program must identify the red flags relevant to the business, detect them in day-to-day operations, respond appropriately when they appear, and be updated periodically, with oversight by senior management or the board, staff training, and oversight of service providers.

In the finance office, red flags are concrete: a driver's license that does not match the applicant, a fraud alert on the credit report, a Social Security number associated with someone else, an address discrepancy notice from a credit bureau, an applicant who cannot answer basic questions about their own credit history. The Red Flags Rule is distinct from the Safeguards Rule discussed in our licensing chapter. Safeguards protects customer information the dealer already holds; Red Flags is about preventing someone from using stolen identity information to obtain credit through the dealer. Most programs also include screening against the Treasury Department's OFAC sanctions list, a separate legal obligation.

Add-On Products After the CARS Rule

In December 2023, the FTC finalized the Combating Auto Retail Scams Rule, known as the CARS Rule, which would have imposed specific federal requirements on dealer pricing disclosures and add-on product sales, including express, informed consent to any add-on charge. In January 2025, the U.S. Court of Appeals for the Fifth Circuit vacated the rule on procedural grounds, holding that the FTC had failed to follow required rulemaking steps. The obligations we described in our licensing chapter under the CARS Rule framework therefore no longer rest on that federal rule itself.

That has not reduced the compliance burden much in practice. The FTC continues to police deceptive and unfair practices in auto sales under Section 5 of the FTC Act, including charging customers for add-ons they did not agree to or that provide no benefit. State attorneys general enforce their own consumer protection statutes. And states have begun legislating directly: California's own Combating Auto Retail Scams Act, scheduled to take effect October 1, 2026, imposes state-level requirements on pricing disclosures and add-on products for California dealers. The safest operating posture is the one the vacated rule described anyway — voluntary products, clear pricing, documented consent, and products with real value.

Where AFIP Certification Fits

None of these rules enforces itself. They depend on F&I managers who understand them and follow them on every deal. The Association of Finance & Insurance Professionals, known as AFIP, is a nonprofit organization that certifies F&I personnel on the federal and state laws and ethical standards that govern dealership finance and insurance operations. Its certification has generally involved training and a proctored exam, adherence to a code of ethics, and periodic recertification — commonly every two years — so certified professionals stay current as rules change. The program has offered tiered levels, including a master certification.

AFIP certification is not a government license, and it is not legally required under federal law; some states separately license or register finance personnel, as we noted in our licensing chapter. Its value is as evidence. A dealer facing a regulatory inquiry or a lawsuit is in a materially stronger position if it can show that every F&I manager was trained and tested on the relevant rules, that the training was refreshed on a regular cadence, and that the store's policies were built around that training. Certification is one component of a compliance management system — alongside written policies, file audits, monitoring of markup and product penetration patterns, complaint tracking, and corrective action — not a substitute for it.

Compliance in Diligence

When we evaluate a target dealership, F&I compliance review is part of the core diligence, not an afterthought. We sample deal jackets against the requirements described here, review the store's written fair credit policy and test actual markup patterns against it, check that the Red Flags program exists on paper and operates in practice, examine product cancellation and refund practices, and review customer complaints filed with regulators and lenders. Patterns matter more than isolated errors: a single clerical mistake is a training issue, while a pattern of undocumented markup deviations or products appearing on contracts without signed menus is a liability that must be priced or remediated before closing. The investment logic is simple. F&I income earned through compliant practices is durable. F&I income that depends on practices regulators are actively targeting is not, and it can reverse — through restitution, chargebacks, and lender terminations — faster than it was earned. This closes Module 4. Our next module turns from the dealership to the fund itself, starting with how Regulation D Rule 506(c) offerings work.