Conventional mortgage lenders often ask self-employed borrowers for a “CPA letter” to verify aspects of their business or financial history. But when the loan is being sold to Fannie Mae or Freddie Mac. The rules are much stricter than many borrowers, and even some loan officers, realize.
Understanding what a CPA can legally confirm, and what lenders are prohibited from requesting, is essential for avoiding delays and unnecessary underwriting conditions.
This guide breaks down the real-world expectations behind a CPA comfort letter for Fannie Mae and Freddie Mac loans, how they differ from generic verification letters, and how the AICPA rules for CPA comfort letters shape what CPAs are allowed to say.
Why Fannie Mae and Freddie Mac Care About CPA Letters
Fannie Mae (FNMA) and Freddie Mac (FHLMC) operate under the oversight of the Federal Housing Finance Agency (FHFA). Together, they purchase the bulk of conventional conforming mortgages. In the U.S. Because these loans ultimately transfer to the GSEs, every document in the underwriting file must comply with their guidelines.
Lenders use automated underwriting systems
- Desktop Underwriter (DU) for Fannie Mae
- Loan Product Advisor (LPA) for Freddie Mac
These AUS systems generate findings and conditions that underwriters must clear before final loan approval.
For self-employed borrowers, the AUS findings often include requirements such as:
- Verify years in business
- Confirm ownership percentage
- Validate that the business is currently active
- Provide P&L statements, balance sheets, or business bank statements
- Document business structure (LLC, S-Corp, C-Corp, Partnership, Sole Proprietorship)
When a CPA is involved in the borrower’s accounting or tax preparation, the underwriter may request a CPA letter to clarify these factual matters.
What a CPA Comfort Letter Really Is
A CPA comfort letter is simply a document that a Certified Public Accountant prepares to confirm factual information within their scope of professional knowledge.
However, when dealing with GSE-backed loans, lenders and processors often misunderstand what CPAs can legally certify.
That’s where the AICPA rules for CPA comfort letters come in.
AICPA Rules That Shape What CPAs Can and Cannot Say
The American Institute of Certified Public Accountants (AICPA) publishes strict standards on what a CPA may verify for third parties such as mortgage lenders.
The following ethical sections apply to all CPA letters:
AICPA Code of Professional Conduct
ET Section 1.000 – Integrity & Objectivity
CPAs must only state facts they can objectively substantiate.
ET Section 1.300 – General Standards
Requires competence, due care, and factual accuracy.
ET Section 1.310 – Compliance with Standards Rule
CPAs may not imply an audit, review, or examination unless one was actually performed.
ET Section 1.320 – Accounting Principles Rule
Applies when referencing financial statements prepared under GAAP or tax basis.
ET Section 1.400 – Acts Discreditable
Prohibits CPAs from issuing misleading or unsupported letters.
ET Section 1.700 – Confidential Client Information
Requires written authorization before sending any third-party verification.
These ethics rules are reinforced by SSARS and Attestation Standards.
SSARS and Attestation Standards
- Preparation Engagement Standards – basic preparation with no assurance
- Compilation Standards– compiling financial statements
- Review Standards – limited assurance
- Attestation Standards (AT-C)for third-party reporting
- AT-C 105 – Concepts common to attestation
- AT-C 205– Examination engagements
- AT-C 210– Review engagements
- AT-C 215– Agreed-Upon Procedures (AUP)
A comfort letter is typically a non-assurance letter, NOT an attestation engagement.
Therefore, the CPA must avoid language that implies assurance, prediction, or examination.
What Fannie Mae and Freddie Mac Actually Require from CPA Letters
Despite common misconceptions, **GSEs rarely require CPA letters themselves**.
Instead, their guidelines require lenders to verify certain facts for **self-employed borrowers**, and the easiest source for that verification is often the borrower’s CPA.
Items a CPA May Confirm for Conventional Loans
- The borrower’s years in business
- The legal structure (LLC, S-Corp, C-Corp, Partnership, or Sole Proprietorship)
- The borrower’s percentage of ownership
- Whether the business is active and operating
- Whether the CPA prepared IRS tax returns (1040, 1120-S, 1120, 1065)
- Whether the CPA prepared P&L statements, balance sheets or bookkeeping records
- Whether the CPA maintains financial records through QuickBooks, Xero, or other accounting software
All of these are factual statements within the CPA’s scope.
What CPA Letters Are Not Allowed to Say (Critical for Underwriters)
Many lenders mistakenly request prohibited statements that violate AICPA professional standards.
The CPA Cannot Predict or Guarantee Future Performance
- No predicting future income
- No confirming ability-to-repay (ATR)
- No endorsing DTI qualification
- No validating future business stability
The CPA Cannot Provide Credit-Related Assurances
- No attesting to the borrower’s creditworthiness
- No guaranteeing loan approval
- No verifying financial soundness”
- No confirming reserves
- No assessing risk-based underwriting
These are solely lender responsibilities, governed by QM standards and ATR regulation.
The CPA Cannot Imply an Audit or Review
Unless the CPA actually performed those services, they cannot state:
- We audited these financial statements
- We verified income
- We certify the accuracy of…
This would violate ET Sections 1.300, 1.310, and AT-C standards.
CPA Comfort Letter vs. CPA Verification Letter for GSE Loans
For Fannie Mae and Freddie Mac, lenders often request something called a CPA verification letter.
This differs from a traditional comfort letter.
Key Differences
| Topic | CPA Comfort Letter | CPA Verification Letter |
| Purpose | Provide factual statements | Verify borrower’s business facts |
| Allowed | Yes | Yes (if factual only) |
| Includes assurance | No | No |
| Fannie/Freddie preferred | Not specifically | Often preferred for self-employed verifications |
| Prohibited claims | All predictions/assurances | Same prohibitions |
Why Underwriters Ask for CPA Letters Even When They’re Not Required
AUS findings from DU or LPA may flag:
- Business viability concerns
- Unusual income patterns
- Multiple business ownership
- Missing documents
- Conflicting tax data
- IRS transcripts inconsistencies
When this happens, a CPA can help verify:
- Ownership
- Years in business
- Operating status
- That the borrower is indeed self-employed
- That the business filings match the tax returns submitted
Underwriters use this information when analyzing:
- Income trending
- DTI calculations
- Business viability tests
- Reserves requirements
Documents Underwriters Commonly Request Alongside CPA Letters
To support the CPA’s statements, lenders may also ask for:
Business Financial Documentation
- Profit & Loss (P&L) Statements
- Balance Sheets
- General Ledger exports (QuickBooks, Xero)
- Business bank statements
- E-commerce reports (Shopify, Etsy, Amazon)
- Merchant processing statements (Stripe, PayPal, Square)
- Invoices and receipts
Personal Financial Documentation
- IRS Tax Returns (1040)
- IRS Tax Transcripts
- Personal bank statements
The CPA letter helps tie these items together in a way the lender can interpret under GSE guidelines.
What a Compliant CPA Letter Typically Looks Like
A fully compliant CPA letter for a GSE loan will:
- Confirm years in business
- Confirm ownership percentage
- Confirm entity structure
- Confirm business activity
- State whether the CPA prepared the borrower’s tax returns
- Avoid ALL prohibited assurances
It will not:
- Predict future income
- Certify ability-to-repay
- Comment on creditworthiness
- Guarantee loan approval
Practical Tips for Borrowers and Loan Officers
For Borrowers
- Tell your CPA exactly what the lender is asking.
- Ask the lender to revise the request if it violates AICPA rules.
- Have updated financials ready (P&L, bank statements).
For Mortgage Loan Officers and Processors
- Request only items that a CPA can legally confirm.
- Avoid sending template letters that include prohibited language.
- Use GSE-approved verification formats whenever possible.
For Underwriters
- Cross-check CPA confirmations with tax returns and bank statements.
- Ensure the letter does not imply assurance or financial predictions.
- Use the letter only to support factual business information.
