NMLS Scraper — Mortgage Loan Originators, Lenders & Branches

The open-source, audit-ready NMLS Consumer Access scraper — no mandatory intake survey, no hidden source. Pull mortgage loan originator (MLO), lender, and branch records — state licenses, federal registrations, regulator disclosures, sponsor relationships, contact info, and computed risk-rollup flags — by NMLS ID or by name. Open source, agent-ready, one normalized row per entity.

Disclaimer — please read before running. This actor is an independent data tool built by StackRelay. It is not affiliated with, endorsed by, or operated by the NMLS, the Conference of State Bank Supervisors (CSBS), or any state or federal regulator. Results are a best-effort, point-in-time snapshot of the public NMLS Consumer Access portal, provided AS-IS with no warranty of accuracy, completeness, or timeliness — license status, sponsorships, and regulatory-action history can change at any time after a record is fetched. Every record carries a source_url linking to the official NMLS page and a scraped_at timestamp: verify independently at the source before acting on any record. The risk-rollup / summary flags (has_regulatory_actions, has_active_regulatory_action, license_types, total_state_licenses_active) and the disclosures[].settled flag are StackRelay-computed heuristics from the public page — not official NMLS determinations or adjudications (see the derived_fields_note on every record); an empty disclosures list or a false risk flag does not prove a clean record. Output includes personal data about individuals (names, addresses, employment and license history); if you process data about EU/UK residents you may be a data controller under GDPR/UK GDPR. This actor's output is not a consumer report and must not be used for FCRA-regulated purposes — credit, insurance, employment, or tenant-screening decisions, or any adverse action about an individual. By running this actor you agree to the ./DEVELOPER_TERMS.md.

Use it to verify mortgage license status, build licensee lists for recruiting and sales, run compliance checks against the NMLS database, and enrich your mortgage CRM with structured Nationwide Multistate Licensing System data.

Why this exists

NMLS Consumer Access is CAPTCHA-protected behind Cloudflare, so there's no turnkey way to get its data into a warehouse or CRM. This actor wraps it as a clean, structured feed — and does it transparently. The source is open and auditable, there's no mandatory intake survey standing between you and a run, and every entity comes back as one normalized row with 25+ fields plus computed risk-rollup flags. If you need a mortgage-license data source your compliance team can actually inspect, that's the point.

Who this is for

• Mortgage recruiters building outreach lists of MLOs by state, sponsoring company, or license status
• Wholesale lender BD teams mapping broker territories and identifying licensed counterparties in target states
• Compliance and risk onboarding teams screening MLO and lender counterparties for active regulatory actions, license status, and disclosure history before approval
• Mortgage CRMs and fintech integrators enriching contact records with NMLS IDs, multi-state license coverage, sponsor relationships, and regulator disclosures (verify each against its source_url before relying on it)
• Market researchers sizing the mortgage origination market by state, license type, sponsor, or branch footprint

What you get

One structured JSON record per NMLS entity (MLO, mortgage company, or branch), written to the default Apify Dataset. Re-runs deduplicate cleanly on the id field (which equals nmls_id), so you can upsert into your warehouse without extra work.

Example input

{
  "mode": "by_nmls_id",
  "nmlsIds": ["3030"],
  "includeDisclosures": true,
  "maxItems": 100,
  "proxyConfiguration": { "useApifyProxy": true }
}

Example output (one row)

{
  "id": "3030",
  "nmls_id": "3030",
  "entity_type": "COMPANY",
  "legal_name": "Rocket Mortgage, LLC",
  "other_trade_names": [
    "Champion Mortgage", "Champion Mortgage Company", "Rocket",
    "Rocket HQ", "Rocket Mortgage", "Rocket Pro", "Rocket Professional",
    "Rushmore Servicing", "Rushmore Servicing Group"
  ],
  "prior_legal_names": ["Quicken Loans Inc.", "Quicken Loans, LLC"],
  "prior_other_trade_names": ["Quicken Loans", "Rock Financial", "QLMS"],
  "primary_address": {
    "street": "1050 Woodward Avenue",
    "city": "Detroit",
    "state": "MI",
    "zip": "48226",
    "country": "US"
  },
  "mailing_address": {
    "street": "1050 Woodward Avenue",
    "city": "Detroit",
    "state": "MI",
    "zip": "48226",
    "country": "US"
  },
  "state_licenses": [
    {
      "state": "Alabama",
      "regulator": "Alabama",
      "license_name": "Consumer Credit License",
      "license_number": "20979",
      "status": "Approved",
      "issue_date": "2009-11-10",
      "original_issue_date": "2009-11-10"
    }
  ],
  "license_types": ["Consumer Credit License", "Mortgage Lender License"],
  "federal_registrations": [],
  "sponsorships": null,
  "sponsored_individuals_count": 3705,
  "branch_count": 83,
  "branch_count_inactive": 3780,
  "employment_history": null,
  "office_locations": [],
  "disclosures": [
    {
      "date": "2021-09-22",
      "regulator": "Alabama",
      "action_type": "Order - Settlement Agreement and Order",
      "description": "Docket MC-2018-04; Multi-state ID M104096",
      "length_in_days": null,
      "settled": true
    }
  ],
  "has_regulatory_actions": true,
  "has_active_regulatory_action": false,
  "total_state_licenses_active": 165,
  "contact_email": "CompanyLicensing@rocketmortgage.com",
  "phone": "800-863-4332",
  "toll_free_phone": "800-863-4332",
  "fax": "855-455-4791",
  "website": "rocket.com/mortgage, www.rocketmortgage.com",
  "source_url": "https://www.nmlsconsumeraccess.org/EntityDetails.aspx/COMPANY/3030",
  "scraped_at": "2026-05-03T03:44:31.340Z"
}

Field notes

• id is always equal to nmls_id. Use it as your upsert key.
• entity_type is one of INDIVIDUAL, COMPANY, or BRANCH. The actor auto-detects when not pinned.
• state_licenses is one row per state-regulator pairing. An entity licensed in 51 jurisdictions returns 51 rows here.
• license_types is a deduped, sorted rollup of every distinct license_name in state_licenses — a quick filter without scanning the full array.
• prior_legal_names and prior_other_trade_names capture name history (e.g. Rocket's former "Quicken Loans" identities) — useful for entity resolution and KYC.
• sponsorships is populated for INDIVIDUAL records (current sponsoring company); null otherwise.
• office_locations lists where an INDIVIDUAL conducts business (company, NMLS ID, type, full address, start date) as structured rows; empty for COMPANY records (which use branch_count instead).
• sponsored_individuals_count, branch_count, and branch_count_inactive (historical/closed branches) are populated for COMPANY records; null otherwise.
• has_regulatory_actions and has_active_regulatory_action are StackRelay-computed heuristics, not official NMLS determinations. has_regulatory_actions is true if the entity has any action on record (active or settled). has_active_regulatory_action is true only when a disclosure is explicitly classified as unsettled/active — a settled consent order alone does not set it. (When you disable disclosure parsing, has_active_regulatory_action is false; has_regulatory_actions still reflects the page's Yes/No flag.) A false flag or empty disclosures array does not prove a clean regulatory record — verify at source_url.
• total_state_licenses_active and license_types are StackRelay-computed roll-ups from the page — convenience summaries, not source-of-truth values.
• source_name labels the data source and is identical on every row; derived_fields_note carries a verbatim caveat that the roll-up flags above are Developer-computed, not official NMLS facts. Both travel with exported data.
• contact_email is decoded from Cloudflare's data-cfemail obfuscation. phone, toll_free_phone, fax, and website come from the entity header and are null when the page doesn't list them (common for individuals).
• All timestamps are ISO-8601 UTC.

Inputs

Field	Type	Default	Notes
mode	enum	by_nmls_id	by_nmls_id or by_name
nmlsIds	string[]	["3030"]	Used when mode=by_nmls_id
names	string[]	["Rocket Mortgage"]	Used when mode=by_name
entityType	enum	""	"" (all), INDIVIDUAL, COMPANY, BRANCH
includeDisclosures	boolean	true	Parse regulator action history
maxItems	int	100	Hard cap, max 10,000
proxyConfiguration	object	Apify default	Switch to RESIDENTIAL if you see Cloudflare blocks
maxConcurrency	int	4	Polite default

CAPTCHA handling

NMLS Consumer Access uses BotDetect CAPTCHA at the session-warmup step. This is handled for you — you don't need a CAPTCHA key or any extra setup. The actor solves it once per run on its own solver, then reuses the session for every subsequent record, so the cost amortizes to fractions of a cent per record and is already built into the per-run pricing below.

The solver is provider-agnostic (src/solver/index.ts), so if you fork the open source you can swap in CapSolver, 2Captcha, Anti-Captcha, or a self-hosted OCR by pointing the CAPSOLVER_API_KEY env var (or a one-line solver swap) at your own account.

Pricing

Pay-per-event:

• Actor Start → ~$0.08 per run — tiered by your Apify plan ($0.082 on Free, as low as $0.07 on higher plans). Billed once per GB of run memory, and the actor runs at 1 GB by default, so it's a single start charge. Covers session warmup: the BotDetect CAPTCHA solve and the residential-proxy handshake against Cloudflare.
• result → $0.001 per entity record saved to the dataset (this is the primary event)

A few worked examples (at the ~$0.08 start tier) so you can budget:

Records returned	You pay
1 (single MLO lookup)	~$0.081
100 (recruit / sales list)	~$0.18
1,000 (territory map)	~$1.08
10,000 (quarterly compliance sweep)	~$10.08

Per-record charges only fire when records actually save to the dataset — so a search that legitimately matches nothing only incurs the one-time start fee for the warmup work, not per-record fees.

v1.1 roadmap (additive — no breaking changes): a Compliance event ($0.005/record) for parsed disclosures + cross-state risk score; a Bulk discount tier above 10K records in a single run; a Standby event ($0.01/call) for synchronous single-record lookups via the Apify Standby endpoint.

Limitations

• v1 supports by_nmls_id and by_name. by_state, by_company_employees, and by_license_status ship in v1.1.
• All three entity types are supported (COMPANY, INDIVIDUAL, BRANCH). For INDIVIDUAL records, sponsorships and federal_registrations are populated when present; employment_history is reconstructed from per-license sponsorship history and aggregated to one entry per unique employer.
• Disclosures are parsed from the public regulator-actions table. Length-in-days and full action descriptions live behind a "View Details" expansion not currently scraped (v1.1).
• The portal updates nightly on business days — fresher data than that requires hitting NMLS directly.

FAQ

Is there a public NMLS API? No — NMLS does not publish a free public API for company, branch, or MLO records. NMLS Consumer Access (the public web portal at nmlsconsumeraccess.org) is the only public source, and it's CAPTCHA-protected behind a Cloudflare-fronted Turing Test page. This actor wraps the portal as a stable, structured pay-per-record data feed.

What data does NMLS Consumer Access include? Mortgage Loan Originators (~500K active), mortgage companies (~40K), and branches (~125K). Per entity: identity, current and historical legal names, state licenses (regulator, license number, status, dates), federal registrations for depository-institution MLOs, regulator disclosures, sponsor relationships, employment history reconstructed from per-license sponsorships, branch counts, sponsored-MLO counts, and contact info.

How do I verify a mortgage loan originator's license? Pass the MLO's NMLS ID with mode=by_nmls_id. The returned record includes every state license they hold (state, license number, status, issue date), any federal registration, current sponsoring company, and the count and details of any regulator disclosures.

Can I bulk-verify mortgage lender licenses? Yes — pass an array of NMLS IDs in nmlsIds (up to 10,000 per run) and the actor returns one normalized record per ID. Compliance teams use this for quarterly renewal sweeps and pre-onboarding screens.

How do I find an MLO if I don't know their NMLS ID? Use mode=by_name. The actor calls the same JSON search API the NMLS frontend uses and auto-iterates COMPANY and INDIVIDUAL entity types if you don't pin one. For very common names, narrow with entityType to avoid the portal's "too many results" cap.

Why is the source open? Compliance and risk teams audit their data sources. An auditable scraper sells better — and lets you fork it if you ever need a custom field added.

Can I run on a schedule? Yes — Apify Schedules. Recommended cadence: weekly for license-renewal monitoring, monthly for full portfolio refreshes, on-demand for fraud / pre-onboarding lookups.

How does this handle the Cloudflare block and BotDetect CAPTCHA? One CAPTCHA solve at session warmup, then session cookies carry the rest of the run. Solving is handled for you and already priced into the per-run cost — no key or setup on your side. (Under the hood the default solver is CapSolver; if you fork the open source, Two-Captcha and Anti-Captcha are one-line drop-in alternatives.)

MCP / agentic support? Planned for v1.2. The actor's input shape is already designed to be MCP-packaged with no breaking changes — AI agents will be able to call it as a tool for live MLO verification.

Running locally

npm install
npm run typecheck
npm run start:dev

Set CAPSOLVER_API_KEY in your environment for the dev loop (e.g. CAPSOLVER_API_KEY=… npm run start:dev). Run apify push to deploy. On the published actor the key lives in Source → Environment variables as a secret, so production runs solve on the owner's account.

Data accuracy & legal notes

• What this data is. A best-effort, point-in-time snapshot of the public NMLS Consumer Access portal (nmlsconsumeraccess.org). The actor normalizes each entity page to one structured row; fields are passed through from the source except where explicitly derived (see below).
• It can be wrong or stale. License status, sponsorships, employment history, and regulatory-action history change continuously. A record is accurate only as of its scraped_at timestamp. Every record carries a source_url to the official NMLS page — independently verify any record there before relying on it for a hiring, onboarding, counterparty, compliance, or any other decision.
• Derived / risk-rollup fields are StackRelay-computed heuristics, not official determinations. has_regulatory_actions, has_active_regulatory_action, license_types, and total_state_licenses_active are roll-ups the actor computes from the public page; disclosures[].settled is a best-effort classification from the action-type wording. None are NMLS adjudications. A false risk flag or empty disclosures array does not establish that an entity has a clean regulatory record or is licensed/in good standing. Every record includes a derived_fields_note restating this.
• Not affiliated. This actor is independently developed by StackRelay and is not affiliated with, endorsed by, or operated by the NMLS, the Conference of State Bank Supervisors, the State Regulatory Registry, or any state or federal regulator.
• Prohibited uses. The output is not a "consumer report" and StackRelay is not a consumer reporting agency. Do not use this data for FCRA-regulated purposes — determining an individual's eligibility for credit, insurance, employment, or housing, or taking any adverse action against an individual. Verifying license status and enriching compliance/CRM records is the intended use. Do not use the data to harass or profile individuals, and comply with applicable privacy law (including GDPR/UK GDPR if you process data about EU/UK residents — you may be a data controller for your downstream use).
• A disclaimer travels with every run in the key-value store record META, and every dataset row carries source_name, source_url, scraped_at, and derived_fields_note provenance fields.
• Full terms. By running this actor you agree to the ./DEVELOPER_TERMS.md — AS-IS/no-warranty, duty to verify, FCRA ban, GDPR note, liability capped at fees paid, indemnity, governed by the laws of the State of Kansas, USA. Contact: nickmannoni@gmail.com.

License

MIT.