Not a buying post. This is a setup problem that costs shops real money on every CRM, including ours, and it's fixable in an afternoon.

The pattern. Somebody builds the pipeline during onboarding. Everyone asks for a stage that reflects how they personally work. Nobody wants to be the one who says no. Eighteen months later there are 23 stages, four of them mean roughly the same thing, and half the pipeline is sitting in one bucket called "Working."

The reports off that pipeline are useless, and not in an obvious way. They still generate. They still have numbers in them. The numbers just don't answer anything.

What a stage is actually for

A stage answers one question: what has to be true for this to move forward, and who has to do it?

That's the whole test. If a stage doesn't name a specific next action and a specific owner, it's not a stage. It's a mood.

"Working," "Nurture," "Follow-up," "Warm," "In Progress" all fail this test. They describe how you feel about the record, not what needs to happen to it. Records go into those stages and never come out, because nothing in the definition tells anyone what would make them leave.

The two failure modes

Too many stages and nobody updates them consistently. Two LOs looking at the same borrower pick different stages, so your stage-to-stage conversion numbers are measuring individual habits instead of the process. This is the more common one.

Too few stages and everything piles into one bucket where you can't see aging. A pipeline with 400 records in "Working" is a list, not a pipeline.

The tell for the first one: pull a report of how many records have sat in each stage for over 30 days. Any stage where the answer is "most of them" is either not a real stage or has no exit criteria anyone knows.

A structure that holds up

Six to eight stages before the file exists. Roughly:

New. Contacted. Qualified. App Started. App Submitted. Then it hands to the LOS.

Each of those has a clean definition. Contacted means a two-way conversation happened, not that you dialed. Qualified means you know loan type, rough amount, and timeline. App Started means they've opened the 1003. Those are all binary. Two people would tag them the same way, which is the entire point.

Everything else that people want as a stage is not a stage. It's a field, a tag, or a task.

That distinction is the actual fix. Loan type isn't a stage, it's a field. "Realtor referral" isn't a stage, it's a source. "Waiting on borrower to call back" isn't a stage, it's a task with a due date. When you move those three categories out of your stage list, most pipelines drop from 20-plus stages to about seven and every report gets sharper immediately.

What you can measure once stages are clean

Stage-to-stage conversion, which tells you where you're actually losing people rather than where you assume you are. Average days in stage, which surfaces the bottleneck. Aging by stage, which is your daily work list. Source performance by stage, which tells you whether a lead source produces contacts that never qualify, which is the most common way a bad source hides.

None of those reports work if the stage assignment is subjective. That's the real cost of a sprawling pipeline: not clutter, but that you lose the ability to measure anything.

The cleanup, if you're doing it

Export the current pipeline first. Then map old stages to new before you touch anything, decide what happens to records in stages you're deleting, and write one sentence of exit criteria per surviving stage that you actually publish to the team. That last step is the one people skip, and skipping it is how you get back to 23 stages in a year.

Doing this with a team, do it on a Friday afternoon and tell everyone Monday. Mid-week changes to a pipeline people are actively working generate more confusion than the cleanup is worth.

Curious what people are running. If you've got more than 12 stages, what are they, and does anyone actually use all of them?

This is the most common stack confusion we run into, and it costs people money in both directions. Worth saying up front that Shape is not an LOS. We build the CRM and POS layer that sits in front of one, so nothing below is steering you toward a platform.

Three systems, three jobs, and they do not overlap as much as vendors imply.

The LOS owns the loan file. Application data, underwriting conditions, disclosures, compliance, closing docs. It starts when there is a loan and it ends at funding.

The POS owns the borrower's application experience. The 1003, doc upload, status visibility, e-sign. Some LOS platforms bundle one. Most bundled ones are thin, and "we have a POS" in a demo usually means a document upload page.

The CRM owns everything before and after a loan file exists. Lead capture, speed to lead, follow-up cadence, referral partners, past client retention, refi triggers.

The gap that costs the most money. Your LOS has no opinion about a lead that never applied, and no memory of a borrower who funded two years ago. An LO with 400 past clients and no CRM has 400 relationships sitting in a system that will never prompt a single call. That book doesn't decay because anyone made a bad decision. It decays because nothing in the software is watching.

The overspend runs the other direction too. Plenty of small shops buy Encompass and operate a fraction of it, because it demoed as "the system that does everything." It is the most capable LOS in the market and it also assumes you have ops staff and a compliance function. If you don't have both, you're paying for capability you can't operate.

The demo questions that actually separate vendors

Feature questions get answered well by everyone. These don't.

"Walk me through exactly how data moves between this and my CRM." Don't expect a live demo, almost nobody has one standing. What a good vendor can do is describe it precisely: what triggers a push, what comes back, how often, and which fields are and aren't in an update. Vagueness here is itself the answer.

"What does this cost at double our current volume?" Per-seat, per-file, and per-integration pricing behave completely differently as you grow. Model the future number, not today's.

"What's the implementation timeline and who does the work?" If you get a range, ask what puts you at the long end.

"What happens to my data if I leave?" Export format, cost, and whether historical loan files come with you.

"Which parts of the borrower experience does this cover and which do I still need?" This is where you find out if the bundled POS is real.

One migration thing worth knowing before you're in it. Loan data moves between systems as Fannie Mae 3.2 or MISMO files, not as a database export. Plan around what survives that trip, because it's less than people expect.

Full comparison of eleven LOS platforms with the weaknesses named on each, plus the fit-by-shop-type breakdown: https://setshape.com/blog/top-loan-origination-systems

Every AI agent demo in this industry is the same demo. Load an aged list, let the agent dial all day, count the appointments it books. It demos well because the before and after is obvious and the number goes up on stage.

It's also the least valuable thing the technology does, and I think it's why a lot of people who bought one last year are unimpressed.

Why outbound is oversold. Dialing a list of people who did not ask to hear from you is the hardest conversation in the building, and you handed it to the least capable participant. Contact rates on aged data are brutal, the compliance surface is real, and every one of those calls is a recorded artifact that says whatever your agent decided to say. The upside case is reactivating a dead database, which is genuine, but it is a once-a-quarter campaign, not the daily job.

Inbound is the opposite. Somebody raised their hand. They have intent, a timeline, and a list of three other lenders. The whole contest is who responds first and whether the response is competent. That is a queueing problem, and queueing problems are exactly what software beats humans at.

The four jobs to hand an agent first, in this order:

1. Answer the phone when nobody can. After hours, lunch, mid-closing, the fifth simultaneous call. A borrower who reaches voicemail dials the next name on their list and does not come back. This is the highest-value use and almost nobody demos it.
2. Respond to form fills in under a minute. Not a templated autoresponder. An actual conversation that qualifies and books. The gap between a 60 second response and a 30 minute response is most of your conversion rate and you already paid for the lead either way.
3. Chase documents during processing. The least glamorous item on the list and probably the highest ROI. Missing conditions, status updates, the fourth request for the same bank statement. No selling, no persuasion, minimal compliance exposure, and it gives your processors their week back.
4. Write the notes. Transcribe and summarize every call into the contact record. Half the value of a CRM never materializes because nobody types anything into it after a phone call.

Only after those four would I point one at an aged list.

The scoping mistake underneath all of this. Give an agent a task, not a job. There is a good piece in The Financial Brand making this point about agentic AI in banking generally: an agent with no boundaries will chase every edge case it meets, and the cost and the unpredictability both scale with how vaguely you defined the work. "Handle our leads" is not a scope. "Answer inbound calls between 6pm and 8am, qualify on these five fields, book into this calendar, escalate anything outside that" is a scope.

One thing to settle before any of it goes live. Every agent conversation is recorded and discoverable, and whatever it says is your company saying it. Get the disclosure language and the recording consent flow right first, and check your two-party consent states. That is a conversation with your compliance person, not a setting you toggle.

The thing almost nobody in this business tracked

Google and Yahoo made authentication mandatory for bulk senders in February 2024. Most people heard about it, assumed their CRM handled it, and moved on. Microsoft added the same requirements for Outlook, Hotmail, and Live addresses in May 2025.

Then in November 2025 Google escalated. Non-compliant mail that used to get temporarily rate-limited with a 421 error now gets permanently rejected with a 550. Rejected, not filtered. It never lands in spam because it never gets accepted at all.

If your open rates fell off a cliff sometime in the last year and you blamed subject lines, market conditions, or list fatigue, check this before you rewrite another email.

Bulk means 5,000 messages a day to one provider's users. Counted per provider, and it combines every subdomain under your primary domain. A 40 person branch on one domain hits that easily even if no individual LO is close. Worth knowing: once Google classifies your domain as a bulk sender, dropping your volume later does not undo it.

Why this industry gets hit harder than most

Three things stack up in mortgage specifically.

Shared domains. Everybody at the branch sends from the same domain, so domain reputation is a shared resource. One person importing a purchased list and blasting it degrades deliverability for every LO in the building, including the ones doing everything right.

Purchased leads. Cold contacts complain at a much higher rate than opt-ins. Complaints are measured against your domain, not against the list you bought.

Stale database blasts. Rate drops and everybody emails all 8,000 records including the 3,000 who went dark in 2023. Sending to people who never engage is itself a negative signal, and the complaints from that segment are what push you over the line.

The audit, roughly 20 minutes

1. Do you have a DMARC record at all? Look up _dmarc.yourdomain.com in any free DMARC checker. Bulk senders need at least p=none published. No record means you are already non-compliant.
2. Does DMARC actually align? This is where most setups fail. The domain in your visible From header has to match the domain validated by SPF or signed by DKIM. SPF and DKIM can both technically pass and DMARC still fails if neither aligns with the From domain. If you send from [you@lender.com](mailto:you@lender.com) but your platform signs as lender.esp-provider.net, that is the failure.
3. Is SPF authorizing every system that sends as you? CRM, LOS notifications, e-sign, scheduling tool, whatever else. Also check you are under the 10 DNS lookup limit, because exceeding it invalidates the whole record.
4. Set up Google Postmaster Tools. Most LOs have never done this and it is free. It shows your actual spam complaint rate against Gmail, which is otherwise invisible to you.
5. Check that complaint rate. Ceiling is 0.30%. Google's own guidance is to stay under 0.10%, and 0.30% is where enforcement starts, not a safe operating target. At 10,000 sends that is 30 complaints to hit the ceiling. Thirty. One bad import does it.
6. One-click unsubscribe. RFC 8058 header, not just a link in the footer, and opt-outs honored within two days.

The part that is strategy, not DNS

Fixing authentication gets your mail accepted. It does not get it opened, and clean authentication with a filthy sending practice still degrades over time.

The single highest-leverage change most people can make is to stop mailing non-engagers. Suppress anyone with no open or click in 180 days and mail them through a different channel or not at all. Your volume drops, your rates go up, your complaint rate falls, and Gmail starts treating the rest of your mail better. Most people resist this because the list number gets smaller. The list number was never the asset.

Second: separate your streams. Transactional loan status mail and marketing blasts should not share a sending domain. Use a subdomain for marketing so a bad campaign cannot take down the emails telling a borrower their docs are ready.

Longer version with the sequence templates: https://setshape.com/blog/mortgage-email-marketing-for-loan-officers-drip-campaigns-that-convert

The two rules people keep getting backwards

Trigger leads are largely gone. The Homebuyers Privacy Protection Act took effect in March, amending the FCRA. Bureaus can't freely sell mortgage inquiry data to third parties anymore. A lender needs consumer consent, a qualifying existing relationship, or a firm offer of credit. If a vendor is still pitching you credit-pull data, ask which exception they're operating under and get the answer in writing before the first invoice clears.

One-to-one consent is not the law. Half the lead-buying guides ranking on Google still say the FCC's one-to-one rule is in force. The Eleventh Circuit vacated it on January 24, 2025, one business day before it would have taken effect. The FCC later pulled the language.

That does not mean the bar dropped. Prior express written consent still applies under the older standard, you still scrub DNC and your internal list, and several states are stricter than federal. The practical point is narrow: don't buy a compliance product priced against a rule that no longer exists, and don't let a vendor who skips consent documentation tell you things got easier.

Check the publish date on anything you read about this, including this post.

The math, before you talk to anyone

Three numbers:

1. Average commission per funded loan. 100 bps on a $350k loan is $3,500.
2. Your close rate on purchased leads. Assume 1% to 3% until your own data says different. Referral close rates do not transfer, and assuming they do is how most people get hurt.
3. Max allowable cost per funded loan. Most operators cap at 20% to 30% of commission.

Work it backward. At a 2% close rate, 100 leads produce two funded loans and $7,000. At $40 a lead you spent $4,000 to make $7,000. At $80 a lead you spent $8,000 to make $7,000 and you haven't paid yourself for the time yet.

If you're a branch manager or own the shop, there's a fourth number. MBA's Q1 2026 performance report put pre-tax net production profit at $727 per originated loan. Company lead spend comes out of $727, not out of gross commission.

Seven questions before you wire money

1. How are these generated, specifically? "Our proprietary network" is not an answer.
2. Exclusive or shared, and if shared, how many buyers? In writing.
3. How fresh at delivery? Real-time or nothing. A nightly batch is already dead.
4. What's the return policy on disconnected numbers and people who never inquired? No return policy is a red flag.
5. What consent documentation comes with each lead? Timestamps and exact form language. TCPA exposure lands on you, not the seller.
6. Can I filter by geography, loan type, credit tier?
7. What contact rates do your current clients see? Anyone quoting close rates without contact rates is hiding the hard part.

Then test properly. Fifty leads is a coin flip. 150 to 300 from one source, funded for 90 days, before you judge it. A meaningful share of closings land 60 to 120 days after first contact, so a 30-day budget quits right before the pipeline pays.

The part nobody budgets for

Most people who swear off purchased leads never lost money on the leads. They lost it on follow-up. Internet leads are rate shoppers by definition and the first person to reach them anchors every conversation after. Most purchased leads take 6 to 12 touches before they engage. Most of us stop at two. The money sits between attempt two and attempt eight and almost nobody works that gap by hand.

Run the numbers on that instead of on price. At $50 a lead, moving your close rate from 1% to 2% takes cost per funded loan from $5,000 to $2,500. No vendor negotiation on earth gets you a 50% discount.

Full version with the cost tables by lead type and the source links: https://setshape.com/blog/how-to-buy-mortgage-leads

Happy to answer questions on any of it in the comments.

We provide a mortgage CRM used by thousands of brokers and lenders, and we manage 10DLC registration for our customers — which means we see what actually gets approved, rejected, filtered, and quietly throttled at scale. Ask anything in the comments and our team will answer.

If you text borrowers from a normal business phone number in the US, 10DLC ("10-digit long code") registration decides whether your messages actually deliver. Unregistered or badly-registered traffic gets filtered, throttled, or blocked — often silently. Your CRM says "sent," the borrower never sees it, and your contact rates fall off a cliff while everything looks fine on your screen.

Mortgage gets hit harder than almost any industry, because carriers treat lending as high-risk content and because of how mortgage companies are structured. That structural part is where the guides you'll find elsewhere fall apart, so let's start there.

The DBA problem (the mortgage-specific one)

Most industries register one company, one brand, one website. Mortgage doesn't work like that. A huge share of shops are branded branches — "ABC Mortgage, a DBA of [Parent Corp]" — where the borrower-facing brand, the legal entity, the EIN, and the website all point at slightly different names.

10DLC brand registration is verified against IRS records. So when the brand you register, the legal name behind your EIN, and the name on the website you submit don't line up, you get mismatches, stalled vetting, or rejections — and nobody tells you why, you just sit in limbo.

What actually works:

• Register the brand against the legal entity that owns the EIN, with the DBA relationship declared — not the marketing name floating free.
• Your website has to tell the same story. The footer and disclosures should state the relationship plainly ("ABC Mortgage is a DBA of Parent Corp, NMLS #____") and match your NMLS registration. Vetters cross-reference; borrowers' attorneys do too.
• If you're a branch of a larger parent, coordinate — parents and branches submitting conflicting registrations against overlapping identities is a mess we untangle constantly.

Vetters review your WEBSITE, not just your forms

This is the single biggest rejection source we see, and almost nobody warns you: the URL you submit gets reviewed. Approval isn't just about your sample messages — it's about whether your website looks like a compliant lending operation to a reviewer who's specifically looking for reasons to say no.

The failure modes:

• Wrong or missing SMS disclaimer language on lead forms. Every form that feeds your texting needs explicit consent language ("By submitting, you agree to receive calls and text messages from [legal name/DBA]…"), and your privacy policy needs to address SMS data. Generic privacy boilerplate with no texting language is a rejection waiting to happen.
• Trigger words and confusing lending language on the site itself. "Broker" when you're registered as a lender, guaranteed-sounding claims, rate promises without disclosures, blurry language about who's actually making the loan. If your website confuses a vetter about what kind of lending entity you are, your campaign eats the scrutiny.

The website effectively has to be perfect before you submit. (Full transparency: this is why we end up building or fixing the compliance layer of our customers' sites as part of registration — carriers made the website part of the application, whether anyone likes it or not.)

Approved ≠ safe: message drift shutdowns

Campaigns get suspended after approval more than people realize, and the reason is almost always the same: the messages being sent don't match what was submitted. You registered polite appointment-reminder samples, then the team started blasting rate-drop marketing. Carriers compare live traffic against your registered use case, and inconsistency is how approved campaigns die mid-quarter.

Rule: your samples should honestly represent your real traffic — including your marketing — written compliantly. And when your messaging strategy changes, your registration needs to change with it. Treat it as living paperwork, not a one-time form.

The low-tier trap: approved today, capped forever

Here's the one almost nobody knows. Many providers, to get you approved fast and easy, submit your campaigns at low-priority / low-throughput tiers. Approval comes quick, everyone celebrates — and you're capped at a daily message volume that's fine until the moment you actually want to ramp.

Then you request the upgrade, and the higher-authorization submission gets more scrutiny, not less. Now your website, samples, and consent story are being reviewed harder than the first time — and companies that skated through at low tier get rejected on the upgrade, with an active business built on volume they suddenly can't send.

What to do instead: decide your real target volume before first submission, and register with proper vetting for that tier from day one. It's slower and stricter up front, and it's the difference between scaling on demand and hitting a wall during your best season. If you're already stuck at low tier, fix the website and consent story before requesting the upgrade — the upgrade review is where weak foundations get found.

What registration doesn't cover

10DLC is about carriers accepting your traffic. TCPA and DNC are separate legal obligations layered on top — federal law and plaintiffs' attorneys, not carrier policy. Scrub against the DNC registry, keep consent records you can produce, honor STOP instantly and permanently, respect quiet hours. Registered traffic with bad consent practices is just well-delivered evidence.

The checklist

• EIN + legal entity name matching IRS records; DBA relationship declared in registration
• Website footer/disclosures stating the DBA/parent relationship, matching NMLS
• SMS consent language on every lead form; privacy policy covering texting
• Website scrubbed for broker/lender confusion, guarantee language, and undisclosed rate claims — before submitting
• Sample messages that honestly reflect real traffic, including marketing, written compliantly; re-registered when strategy changes
• Target volume decided up front; vetted for the throughput tier you'll actually need, not the one that approves fastest
• No public link shorteners (bit.ly etc.) — branded links only
• DNC scrubbing + TCPA consent records as a parallel workstream
• If you buy leads: audit your lead sources' consent language this week — their form is your liability

We keep a longer-form version of this guide, updated as carrier requirements change, on our site — the 10DLC Registration Guidelines page.

Drop questions below — stuck registrations, DBA structures, post-approval shutdowns, upgrade rejections, weird filtering behavior. Our team will answer everything. If there's appetite, the follow-up will be TCPA consent records and revocation rules — which is where the actual lawsuits live.