The Military Lending Act carries a penalty structure most consumer regulations don't: get it wrong and the contract is void from inception, not merely subject to reimbursement. Yet MLA compliance failures are usually operational — a covered borrower check skipped on a refinance, an oral disclosure step nobody built into the phone channel. This guide covers the full requirement set under the implementing regulation and how to operationalize it.
Key Takeaways:
- The MLA, implemented at 32 CFR Part 232, covers most consumer credit extended to active-duty servicemembers and their dependents
- The Military Annual Percentage Rate (MAPR) is capped at 36% and includes fees and ancillary charges that ordinary APR excludes
- Safe harbor requires checking the MLA Database or a nationwide consumer reporting agency record at the times the regulation specifies — and retaining proof
- Violations void the contract from inception and carry civil liability, and MLA is a standard consumer compliance exam module
Who Is a Covered Borrower Under the MLA?
The Military Lending Act, implemented at 32 CFR Part 232, protects covered borrowers: servicemembers on active duty (including active Guard and Reserve service) and their dependents, at the time they become obligated on a covered transaction.
The timing element matters. Covered borrower status is determined when the credit is extended, not later. A borrower who enters active duty after origination is not a covered borrower for that loan — that scenario belongs to the SCRA, covered below. Dependents are frequently missed in manual processes because their military affiliation is not obvious from the application.
What Credit the MLA Covers — and What It Excludes
The MLA applies to most consumer credit: credit cards, installment loans, payday loans, vehicle title loans, deposit advances, refund anticipation loans, and unsecured open-end lines. After the rule's expansion, the default assumption for a consumer lender should be that a product is covered unless a specific exclusion applies.
The two structural exclusions:
- Residential mortgages — purchase loans, refinances, home equity loans and lines secured by a dwelling
- Purchase-money loans — credit extended expressly to buy a motor vehicle or personal property when the credit is secured by the item purchased
The purchase-money exclusion is narrower than it looks. Adding cash-out or financing unrelated products alongside the purchase can pull a transaction back into coverage, so product design changes deserve MLA review before launch.
The 36% MAPR Cap and What It Includes
The MLA caps the Military Annual Percentage Rate (MAPR) at 36%. MAPR is deliberately broader than the Regulation Z APR: it pulls in charges that ordinary APR math excludes, including:
- Finance charges under Regulation Z
- Credit insurance premiums and debt cancellation or suspension fees
- Fees for ancillary products sold in connection with the credit
- Application fees and participation fees, with limited exceptions (for example, certain application fees on qualifying short-term small-dollar loans by insured depository institutions and credit unions)
For credit cards, bona fide fees that are reasonable and customary may be excluded from MAPR — a carve-out requiring its own documented analysis. The practical consequence: a product priced under 36% APR can still breach the MAPR cap once ancillary products are attached. MAPR testing has to reflect what was actually sold with each loan, not the product's rate sheet.
The Safe Harbor: Covered Borrower Checks Done Right
The regulation gives lenders a safe harbor for covered borrower determination: a lender that checks either the Department of Defense's MLA Database (maintained by the Defense Manpower Data Center) or a nationwide consumer reporting agency record carrying the MLA flag conclusively determines status — if the check happens at the right time.
The timing rules are where programs fail. The check confers safe harbor when performed at the time the consumer initiates the transaction or applies to establish the account, or up to 30 days before; or when the account is established. A check run outside those windows is informational, not protective. Two operational rules follow:
- Recheck on new obligations. Refinances, renewals, and rollovers create new credit extensions requiring fresh determinations — the original check does not carry forward
- Retain the record of every check, including timestamp and result, because a safe harbor you cannot prove at exam time is not a safe harbor
Required Disclosures and Prohibited Terms
For covered transactions, lenders must provide a statement of the MAPR (the model statement in the regulation satisfies this), the disclosures required under Regulation Z, and a clear description of the payment obligation. The MAPR statement and payment obligation description must also be delivered orally — in person or through a toll-free number the borrower can call. The oral disclosure step is routinely missing from digital-only origination flows and is an easy exam finding.
The regulation also prohibits contract terms for covered borrowers, including:
- Mandatory arbitration clauses and waivers of legal recourse
- Unreasonable notice requirements as a condition of legal action
- Prepayment penalties
- Waivers of rights under the SCRA
- Certain restrictions on account access as security, subject to specific exceptions
Under the statute and 32 CFR § 232.9, a contract that violates the MLA is void from inception, and violations carry civil liability including actual damages with a statutory floor per violation, plus potential criminal penalties for knowing violations. MLA is a regular module in consumer compliance exams alongside TILA requirements and fair lending review.
MLA vs. SCRA: Different Protections, Different Timing
Lenders regularly conflate the two military-borrower regimes. They protect different situations:
| MLA | SCRA | |
|---|---|---|
| Protects | Covered borrowers at origination | Servicemembers on obligations incurred before service |
| Rate limit | 36% MAPR cap | 6% interest rate cap on pre-service obligations |
| When it attaches | When credit is extended to a covered borrower | When the borrower enters active duty |
| Trigger process | Lender checks status before origination | Servicemember invokes (rate cap), plus lender-side protections |
A single borrower can implicate both: the MLA governs a loan originated during active duty, while the SCRA governs the loan they took out before enlisting. Programs need separate workflows — MLA checks at origination, SCRA processes for benefit requests and protections on the back book.
Operationalizing MLA Compliance
An MLA program that survives an exam is a set of controls running on every applicable transaction: a covered-borrower check embedded in the origination flow with correct timing, recheck logic wired to refinance, renewal, and rollover events, MAPR testing that accounts for ancillary products actually sold, oral disclosure delivery built into every channel, and retention of every check result and disclosure record.
This is where modern lending teams use Canarie: each MLA control becomes recurring, owned work — periodic testing of the covered-borrower check integration, channel reviews for oral disclosure delivery, MAPR sampling — with evidence captured at completion. When examiners open the MLA module, the record of every check and every test cycle is already assembled.
Turn MLA requirements into evidenced controls →
Frequently Asked Questions
What is the MAPR and how is it different from APR?
The Military Annual Percentage Rate is the MLA's cost-of-credit measure, capped at 36% for covered borrowers. It includes the Regulation Z finance charge plus items ordinary APR excludes: credit insurance premiums, debt cancellation fees, ancillary product charges, and most application and participation fees. A loan can comply with the product's advertised APR and still exceed the MAPR cap once add-on products are included.
How does a lender get MLA safe harbor?
By conclusively determining covered borrower status through the DMDC's MLA Database or a nationwide consumer reporting agency record, at the time the consumer initiates the transaction or applies (or up to 30 days prior), or when the account is established. Checks performed outside the regulation's timing windows do not confer safe harbor, and the lender must retain the record of each check to prove it at exam time.
Do I need to recheck MLA status on a refinance or renewal?
Yes. A refinance, renewal, or rollover creates a new extension of credit requiring a fresh covered-borrower determination — the check performed at the original loan's origination does not carry forward. This is one of the most common operational gaps in MLA programs, because recheck logic has to be deliberately built into servicing and renewal workflows.
What happens if a loan violates the MLA?
The contract is void from inception under 32 CFR § 232.9 — the harshest remedy in consumer credit regulation. Lenders also face civil liability including actual damages with a statutory minimum per violation, and knowing violations can carry criminal penalties. Because MLA is a standard consumer compliance exam module, violations typically surface through examination even without borrower complaints.
Does the MLA apply to mortgages and auto loans?
Residential mortgages are excluded, as is purchase-money credit — loans extended expressly to purchase a vehicle or personal property when secured by the item purchased. The exclusions are narrow: cash-out features or financing unrelated add-ons alongside a purchase can bring a transaction back into coverage, so structural product changes should get MLA analysis before launch.