The Military Lending Act website, at mla.dmdc.osd.mil, is the Department of Defense portal that lenders use to check whether a loan applicant is a “covered borrower” under 10 U.S.C. ยง 987. It queries the Defense Manpower Data Center (DMDC) database and returns a certificate documenting the result. Service members and dependents can use the same site to confirm their own protected status. Running the check correctly, and keeping the certificate, triggers the legal safe harbor that shields a lender from liability if the database later turns out to be wrong.1eCFR. 32 CFR 232.5 – Optional Identification of Covered Borrower
Who the Database Can Confirm
The DMDC lookup returns a “covered borrower” result for two groups. The first is covered members: anyone serving on active duty under orders specifying more than 30 days, including active Guard and Reserve duty.2Office of the Law Revision Counsel. 10 USC 987 – Terms of Consumer Credit Extended to Members and Dependents A Guard member on a weekend drill will not come back as covered; one called up for a six-month deployment will.
The second group is dependents: the service member’s spouse, children under 21 (or under 23 if enrolled full-time in college), and certain other family members who rely on the service member for more than half of their financial support. Because the DMDC tracks these relationships internally, a lender does not have to work out the family status independently. The database either flags the person or it does not.
Running a Single Record Search
The single record search takes three inputs: the applicant’s Social Security number, legal last name, and date of birth.1eCFR. 32 CFR 232.5 – Optional Identification of Covered Borrower Lenders collect these during the loan application, so nothing extra needs to be gathered. On the MLA site, select the single record request option, type the three fields exactly as they appear on the applicant’s identification, and complete the CAPTCHA.
Accuracy on those three fields matters more than speed. A transposed digit in the Social Security number, or a misspelled last name, will return a “no match” and could lead the lender to treat a covered borrower as an ordinary consumer. That mistake strips the service member of MLA protections and exposes the lender to the full range of penalties. Verifying the entries against the loan application before submitting is the simplest compliance step in the whole process.
Reading the Certificate
A successful search generates a PDF certificate bearing a Department of Defense watermark. The certificate carries the date and time of the search, a unique report ID, and the determination itself: covered borrower, or not.
The field to read carefully is the “As Of” date. It tells the lender whether the status was current on the day credit was extended. If the certificate shows covered borrower status as of June 1 and the loan closed on June 1, the record is clean. If a gap has opened between the certificate date and the loan date, the safe harbor weakens. The certificate may also show an active duty status date confirming the period of service tied to the search.
File the certificate with the loan documents. It is the primary evidence of compliance during a regulatory audit, and it is the first thing examiners look for when they review MLA-covered transactions.1eCFR. 32 CFR 232.5 – Optional Identification of Covered Borrower
Batch Requests for High Volume
Institutions that process large application volumes can use the multiple record request feature instead of running names one at a time. Batch access requires a registered account on the MLA website.3Department of Defense Military Lending Act. Military Lending Act Once registered, the user can upload request files, download results, and pull the certificate for each record in the batch.
The upload itself is a plain text file with a rigid layout. Each line represents one individual, and the Social Security number, last name, and date of birth sit in specific character positions. Formatting errors, special characters, or blank last-name fields will cause the file to be rejected. As of the February 2026 release, the system specifically rejects files where the last name field contains a null value.3Department of Defense Military Lending Act. Military Lending Act
Batch results do not come back immediately. The file enters a processing queue, and the portal notifies the user when results are ready to download. The legal effect matches a single search: each record generates its own certificate, and the safe harbor applies to each one on its own terms.
The Consumer Report Alternative
The DMDC website is not the only route to safe harbor. Under the same regulation, a lender can also confirm covered borrower status by pulling a consumer report from a nationwide consumer reporting agency. If that report includes a military status indicator, code, or similar flag, the lender may rely on it in the same way it would rely on a DMDC certificate.1eCFR. 32 CFR 232.5 – Optional Identification of Covered Borrower
This works well for lenders who already pull credit during underwriting, because it removes a separate step. The catch: the flag has to actually appear in the report. If the consumer reporting agency does not carry the borrower’s military status, the report will be silent, and the lender has not met the safe harbor. Many larger lenders use both paths. They check the credit report first, and if it says nothing about military status, they run a DMDC search.
How the Safe Harbor Works
The safe harbor is the practical reason most lenders visit the MLA website at all. A creditor who checks the DMDC database, or a qualifying consumer report, before extending credit gets a conclusive determination of the borrower’s status. If the system returns “not a covered borrower” and that later turns out to be wrong, the lender is not liable for failing to apply MLA protections, provided the search was timely and the record was kept.1eCFR. 32 CFR 232.5 – Optional Identification of Covered Borrower
“Timely” does real work in that sentence. A search run weeks before closing may not protect the lender if the borrower’s status changed in between. Best practice is to run the search as close to the credit transaction as possible and to document the date clearly. The regulation also requires the lender to create and maintain the record. Running a search and moving on is not enough; a lender who cannot produce the certificate during an audit has effectively given up the safe harbor.
What Skipping the Check Costs
A loan contract that violates the MLA is void from the moment it is signed.4eCFR. 32 CFR 232.9 – Penalties and Remedies The lender does not just lose the excess interest. They lose the legal basis for collecting on the debt at all.
A creditor who knowingly violates the MLA also faces criminal prosecution as a misdemeanor, punishable by up to one year in prison, a fine, or both.2Office of the Law Revision Counsel. 10 USC 987 – Terms of Consumer Credit Extended to Members and Dependents Service members have a private right of action as well. A borrower who proves a violation can recover actual damages, with a floor of $500 per violation, along with punitive damages, equitable relief, and attorney fees.5Office of the Law Revision Counsel. 10 USC 987 – Terms of Consumer Credit Extended to Members and Dependents The statute of limitations runs two years from when the borrower discovers the violation or five years from when it occurred, whichever comes first. A defense exists for unintentional, bona fide errors made despite reasonable compliance procedures, but a mistake of legal judgment does not count as a bona fide error.4eCFR. 32 CFR 232.9 – Penalties and Remedies
Federal regulators, including the CFPB and the relevant prudential regulators, enforce the MLA through their own examination authority on top of everything above. A single non-compliant loan can trigger a voided contract, a civil suit, a regulatory action, and a criminal referral at the same time. Against that stack of exposure, the two minutes it takes to run a DMDC search and save the certificate is the cheapest step in the file.