CPA comfort letters have become a routine request in today’s mortgage and lending environment, especially when dealing with self-employed borrowers, small businesses, and complex financial situations. Yet many borrowers, Mortgage Loan Officers (MLOs), and even some accountants misunderstand what a CPA is legally and ethically allowed to provide.
At the core of these limitations are the AICPA rules for CPA comfort letters, a framework that governs professional conduct, ethical boundaries, and what CPAs may, and may not, verify for third-party users such as lenders, underwriters, and loan processors.
This guide breaks down the AICPA, State Board of Accountancy, and attestation standard requirements so borrowers and lenders clearly understand the difference between a comfort letter and a verification letter, and how these apply in real-world mortgage situations.
Understanding What a CPA Comfort Letter Actually Is
CPA comfort letters are non-assurance communications that clarify a borrower’s relationship with their accountant or confirm general facts already known to the CPA. They do not verify accuracy, confirm income, or express opinions about financial strength.
Contrast this with a verification letter, which is factual and limited in scope, but still bound by AICPA rules.
CPA Comfort Letter vs. CPA Verification Letter, Why the AICPA Draws a Line
cpa comfort letter vs. cpa verification letter
Comfort Letter (Non-Assurance Letter)
A comfort letter typically includes:
- Statements based on client-provided information
- No verification of accuracy
- No assurance or attestation
- General clarification only
A CPA is restricted from:
- Confirming projected or expected income
- Stating a borrower is “financially stable”
- Indicating that the client “can afford” a mortgage
These restrictions stem directly from AICPA Code of Professional Conduct and Non-Assurance Letter Guidelines.
Verification Letter (Third-Party Factual Confirmation)
A verification letter can confirm objective facts, such as:
- Years the CPA has prepared tax filings
- Business entity type (LLC, S-Corp, C-Corp, Partnership, Sole Proprietorship)
- Whether tax returns were filed
- Whether the client is self-employed
Unlike comfort letters, verification letters rely on documentation the CPA already has.
Why AICPA Rules Matter for Lenders, Borrowers, and CPAs
Lenders, including Fannie Mae, Freddie Mac, FHA, VA, USDA, Non-QM lenders, and portfolio lenders, often ask for CPA letters when an underwriting file involves self-employment.
However, CPAs must follow:
- AICPA (American Institute of Certified Public Accountants) rules
- State Board of Accountancy regulations
- IRS privacy and confidentiality rules
- FHFA (Federal Housing Finance Agency) mortgage documentation requirements
- PCAOB oversight rules for firms performing audit-level work
These organizations collectively define the limits of what a CPA may legally communicate.
AICPA Code of Professional Conduct, The Core Framework
Below is a breakdown of relevant AICPA sections and how they apply to CPA comfort letters.
ET Section 1.000, Integrity & Objectivity
A CPA must avoid:
- Misrepresentation
- Conflicts of interest
- Statements that mislead a lender
This rule is the reason CPA comfort letters cannot confirm subjective financial claims.
ET Section 1.300, General Standards
This includes the obligation to:
- Act with professional competence
- Properly supervise staff
- Ensure work is accurate and sound
A CPA must decline lender-requested statements that would violate these standards.
ET Section 1.310, Compliance With Standards Rule
This rule prohibits CPAs from implying:
- An audit
- A review
- A compilation
- An attestation
when none was performed.
Many lenders incorrectly request statements implying assurance, CPAs must decline these.
ET Section 1.320, Accounting Principles Rule
CPAs cannot confirm compliance with GAAP unless the financial statements were prepared under the proper standards (SSARS, audit, review, or compilation).
ET Section 1.400, Acts Discreditable
A CPA may not:
- Issue misleading comfort letters
- Confirm borrower’s “creditworthiness”
- Guarantee loan approval
- State that income is “stable” or “sufficient”
Doing so may result in sanctions from the State Board of Accountancy.
ET Section 1.600, Advertising & Solicitation
CPAs cannot exaggerate what a comfort letter can provide.
ET Section 1.700, Confidential Client Information
A CPA cannot provide any information to a lender without written consent.
ET Section 1.800, Form of Organization & Name
Applies to how CPA firms must present themselves when issuing third-party letters.
SSARS and Attestation Standards, Where Many Borrowers Get Confused
Comfort letters are not assurance services, so they do not fall under the following:
SSARS Standards
- Preparation engagements
- Compilation engagements
- Review engagements
Attestation Standards (AT-C Series)
Including:
- AT-C 105 – Common Concepts
- AT-C 205 – Examination (full assurance)
- AT-C 210 – Review (limited assurance)
- AT-C 215 – Agreed-Upon Procedures
Lenders often request statements that would require an attestation engagement, but they rarely want to pay for one.
What CPAs Cannot Say Under AICPA Comfort Letter Rules
Under the AICPA rules for CPA comfort letters, CPAs must decline statements that:
Imply Assurance or Future Performance
A CPA cannot:
- Predict future income
- Guarantee loan approval
- Confirm the borrower’s ability to repay
- Validate future business projections
Confirm Subjective Financial Conditions
Such as:
- “The business is stable”
- “Income is expected to increase”
- “The borrower is financially strong”
Provide Documentation They Did Not Prepare or Verify
If the CPA did not prepare the financials or has no knowledge of them, they cannot attest to them.
What CPAs Can Provide Within AICPA Rules
Permissible Comfort Letter Content
A CPA can state:
- How long the borrower has been their client
- That tax returns were prepared
- That the borrower is self-employed
- The business entity type (LLC, S-Corp, etc.)
- That documents were provided by the client
- That no assurance is provided
Permissible Verification Letter Content
A CPA may confirm:
- Tax returns filed (1040, 1120, 1120-S, 1065)
- K-1 forms issued
- Existence of a business
- Years the CPA has worked with the client
This falls under factual confirmation, not assurance.
Why Lenders Ask for Letters Despite AICPA Restrictions
Underwriters for:
- Fannie Mae (FNMA)
- Freddie Mac (FHLMC)
- FHA, VA, USDA
- Non-QM lenders
- Portfolio lenders
often request these letters to clarify details flagged by AUS systems such as Desktop Underwriter (DU) and Loan Product Advisor (LPA).
However, lenders cannot require CPAs to violate professional standards.
Practical Guidance for Borrowers and Loan Officers
Borrowers
- Request only permissible statements
- Provide written authorization
- Avoid asking CPAs to “certify income”, they legally cannot
Mortgage Loan Officers
- Understand AICPA limitations
- Request factual, not subjective, confirmations
- Avoid lender overlays that conflict with AICPA rules
CPAs
- Use consistent templates
- Include appropriate disclaimers
- Avoid language that suggests assurance
