Question
Did HUD recently update its reporting requirements for cybersecurity incident?
Yes, on December 2, 2024, HUD published Mortgagee Letter 2024-23, which revised cybersecurity notification requirements for FHA-Approved Mortgagees to require notification to HUD as soon as possible and no later than 36 hours after the mortgagee determined a Reportable Cyber Incident occurred. Previous guidance required notification no later than 12 hours after determination that a cyber incident occurred.
In the recent Mortgage Letter, HUD also provided the following definitions:
- Cyber Incident = an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.
- Reportable Cyber Incident = a Cyber Incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the FHA-approved mortgagee’s ability to meet its operational obligations for originating or servicing FHA-insured mortgages.
Notification of Reportable Cyber Incidents must be emailed to HUD’s FHA Resource Center at answers@hud.gov and HUD’s Security Operations Center at cirt@hud.gov and include the following information:
- Mortgagee Name;
- Mortgagee ID;
- Name, email address, and phone number of the Mortgagee’s point of contact for coordinating follow-up activities;
- Description of the Cyber Incident, including the following, if known:
- date of Cyber Incident;
- cause of Cyber Incident;
- impact to Personally Identifiable Information;
- impact to login credentials;
- impact to Information Technology (IT) system architecture;
- list of any impacted subsidiary or parent companies; and
- Description of the current status of the Mortgagee’s Cyber Incident response, including whether law enforcement has been notified.
NOTE: This FAQ updates and supersedes AGMB’s prior FAQ on this topic published in May 2024.
Question
Are there any potential issues with advertising “Buy Now, Refinance Later” and/or offering discounts on such refinance?
Yes, advertising that a consumer should “buy now and refinance later” comes with potential risks– particularly depending on the express language used in the advertisement. It must be clear to a consumer that refinancing is not guaranteed as the consumer may not qualify or there may not be a benefit to refinancing if rates do not drop. The advertisement should also disclose that the consumer will have to apply to refinance the purchase loan at a later date and that there are costs and fees associated with that separate refinance loan transaction. Failing to provide this information may be misleading and/or deceptive in the eyes of a regulator.
Additionally, Fannie Mae specifically prohibits a seller/servicer from delivering a loan to it if the seller/servicer (or any affiliate or third party originator) and the borrower have entered into an arrangement for special terms, such as reduced fees, for a future refinance of the loan. In order to bypass this prohibition, the seller/servicer must obtain a negotiated contract from Fannie Mae that allows delivery of the loan in spite of its shortened prepayment expectation. See Selling Guide B2-1.3-04, Prohibited Refinancing Practices.
Question
Will a mortgage lender or broker still be permitted to obtain reimbursement from a VA borrower if the lender/broker pays the appraisal fee upfront in relation to a VA loan transaction?
No. On September 13, 2024, the Department of Veterans Affairs (VA) published Circular 26-24-19: Invoice Requirements for Itemized Fees and Charges and Updates to the State Fees & Charges Deviations List, which is effective January 1, 2025. The Circular clarifies when a lender needs to provide an invoice to support itemized fees charged to or paid by the borrower for VA loan transactions. Specifically, the Circular states:
- Lenders must support the amount charged to, or paid by, the VA borrower with an invoice or other documentation that clearly identifies the transaction and verifies the fee and associated charge (example: a recorded deed that displays the cost of recordation). If the lender is unable to support the charge with an invoice, a refund must be provided to the VA borrower.
- Lenders may not charge the VA borrower for services already paid for by another party. This means if the lender or mortgage broker paid for a VA appraisal, the borrower cannot reimburse the lender or mortgage broker at any time, whether at closing or prior to closing.
- VA may authorize local fee variances for additional fees and charges that may be charged to and paid by the VA borrower based on the location of the subject property. VA publishes a State Fees and Charges Deviations List on its website. Effective immediately, VA will no longer publish maximum dollar amounts for most fees and charges on this list.
Note, the Circular does not address, or apply to, the lender’s one percent allowable fee.
Question
What are some common questions and scenarios lenders encounter day-to-day in their preparation for FHA’s borrower-initiated Reconsideration of Value (ROV) process?
Approved mortgagees must comply with FHA’s ROV procedures for all loans with case numbers assigned on or after October 31, 2024. To prepare lenders, FHA hosted a live webinar in August 2024, during which time FHA subject matter experts addressed questions from attendees. FHA recently published FHA INFO 2024-70, which provides mortgagees with a summary of all questions and answers submitted in relation to the webinar. The questions and answers provide a useful resource to lenders who are implementing their ROV processes and include information related, but not limited to:
- New fields coming to FHAC for the ROV process;
- How to handle ROV requests received after loan denial;
- FHA underwriter and appraiser training; and
- Sellers and other interested parties initiating ROV requests.
Noteworthy, HUD’s Handbook 4000.1, II.A.1 indicates that while a borrower may seek assistance from a real estate agent regarding initiating a ROV request, FHA prohibits a lender from discussing the contents of an appraisal with anyone other than the borrower:
“Communications with Third Parties
The underwriter may request a clarification or reconsideration of value from the Appraiser, following the requirements in Reconsideration of Value. The Mortgagee may not discuss the contents of an appraisal with anyone other than the Borrower.”
Question
Are there any potential issues with advertising “Buy Now, Refinance Later” and/or offering discounts on such refinance?
Yes, advertising that a consumer should “buy now and refinance later” comes with potential risks – particularly depending on the express language used in the advertisement. It must be clear to a consumer that refinancing is not guaranteed as the consumer may not qualify or there may not be a benefit to refinancing if rates do not drop. The advertisement should also disclose that the consumer will have to apply to refinance the purchase loan at a later date and that there are costs and fees associated with that separate refinance loan transaction. Failing to provide this information may be misleading and/or deceptive in the eyes of a regulator.
Additionally, Fannie Mae specifically prohibits a seller/servicer from delivering a loan to it if the seller/servicer (or any affiliate or third party originator) and the borrower have entered into an arrangement for special terms, such as reduced fees, for a future refinance of the loan. In order to bypass this prohibition, the seller/servicer must obtain a negotiated contract from Fannie Mae that allows delivery of the loan in spite of its shortened prepayment expectation. See Selling Guide B2-1.3-04, Prohibited Refinancing Practices.
Question
With the onslaught of breaches affecting the mortgage industry, what can a mortgage lender do to prepare?
There are numerous ways mortgage lenders can prepare to not only try and prevent a breach, but to respond in the event that one does occur. This FAQ focuses on best practices related to a mortgage lender’s incident response procedures.
Maintaining a comprehensive and actionable plan that can be easily and efficiently implemented if a breach occurs is vital for a mortgage lender. A well-developed plan will include, among other things, written procedures that identify roles and responsibilities within the company (including contact information for critical personnel), as well as how and when to report incidents to regulators, agencies, law enforcement, business partners, and/or customers. Mortgage lenders should be aware of their reporting requirements before a breach occurs. This will involve reviewing applicable federal and state statutes, agency guidelines, and agreements with business partners. It may also involve drafting template notices to be used in the event of a breach. These notices will need to be revised and finalized if a breach actually occurs, but may assist in meeting reporting deadlines, which can be as short as two calendar days.
A mortgage lender should also consider what type of outsourced resources it may need in the event of a breach. For example, identify the company’s mission critical vendors in advance of an issue. Also, consider whether the company would need to retain third party assistance if a breach occurs – i.e. a cybersecurity specialist, law firm, and/or public relation firm. If so, identifying and vetting these resources upfront and before an issue arises could prove valuable.
Mortgage lenders must dedicate time and resources towards developing an action plan ahead of a breach. A mortgage lender should not be creating or reviewing a template incident management response plan for the first time following a breach. Once developed, hard copies of the customized plan should be available to all critical personnel with incident response roles. The company should also test the plan regularly so that critical personnel understand their roles and responsibilities and to ensure proper execution, while improving the plan based on information learned from the exercises.
Question
When should a cyber event result in a suspicious activity report (SAR) filing?
FinCEN defines a cyber-event as “an attempt to compromise or gain unauthorized electronic access to electronic systems, services, resources, or information” and requires financial institutions and mortgage companies to report any suspicious transaction conducted or attempted by, at, or through the institution that involves or aggregates to $5,000 or more in funds or other assets. This would include cyber-events that a financial institution knows, suspects, or has reason to suspect was intended, in whole or in part, to conduct, facilitate, or affect a transaction or a series of transactions. This is because these types of events are (i) unauthorized, (ii) relevant to a possible violation of law or regulation, and (iii) regularly involve efforts to acquire funds through illegal activities. In determining monetary amounts involved in the transactions or attempted transactions, a financial institution should consider in aggregate the funds and assets involved in or put at risk by the cyber-event. Further, whether to file a SAR involving a cyber-event or attempted cyber-event is not based on the success of the attempt.
FinCEN also encourages, but does not require, financial institutions to report egregious, significant, or damaging cyber-events when such events and crime do not otherwise require the filing of a SAR.
An example of a cyber-event that may require a SAR filing is a malware intrusion where a cybercriminal gains access to a lender’s systems/network or information and performs unauthorized transactions or exposes sensitive customer information, such as account balances or social security numbers. However, FinCEN advised in its Frequently Asked Questions (FAQs) regarding the Reporting of Cyber-Events, Cyber-Enabled Crime, and Cyber-Related Information through Suspicious Activity Reports (SARs) that filing a SAR to report continuous scanning or probing of a financial institution’s systems or network is impractical and not required. For more information see FinCEN’s Advisory, FIN-2016-A005.
Question
Has the Department of Veterans Affairs (VA) made any changes to its guidelines regarding a borrower’s ability to pay real estate broker commissions?
Yes, the VA recently issued Circular 26-24-14, which was effective August 10, 2024 and authorizes VA borrowers to pay compensation to a buyer’s real estate broker or agent.
VA regulations prohibit a veteran from paying for real estate brokerage charges. However, the Circular explains that this temporary allowance is appropriate to ensure veterans remain competitive buyers in the rapidly shifting real estate brokerage market. The Circular indicates that VA will develop a more permanent policy, through a new notice-and-comment rulemaking, as the real estate brokerage market restabilizes and new practices take hold.
VA loan borrowers may now pay reasonable and customary amounts for any buyer-broker charges, including commissions and any other broker-related fees, subject to terms set forth in the Circular. Noteworthy, the Circular requires lenders to collect the buyer-broker representation agreement as VA considers it part of the sales contract. VA expects lenders to upload the agreement as part of the package lenders use when requesting an appraisal. VA also expects lenders to retain the agreement in the loan file.
The VA also published Change 1 to Circular 26-24-14, which clarifies how veteran-paid buyer-broker charges are to be recorded on the Closing Disclosure.
Question
Has HUD updated its Unique Entity Identifier (UEI) requirements for FHA Eligibility?
Yes, on May 16, 2024, HUD published Mortgagee Letter (ML) 2024-09, Updating FHA’s Unique Entity Identifier (UEI) Requirements for FHA Eligibility. Effective immediately, ML 2024-09 updates FHA’s Unique Entity Identifier (UEI) policy for FHA approved mortgagees as well as other entities seeking eligibility to conduct FHA business.
All FHA-Approved Mortgagees must register for, obtain, and maintain a Unique Entity Identifier (UEI) number at www.SAM.gov. The registration must result in a status of “Active Registration.” All mortgagees must maintain an “Active Registration” status. To maintain an “Active Registration” in the SAM.gov database after the initial registration, the mortgagee is required to review and update its information in the SAM.gov database every 365 days to ensure it is current, accurate and complete.
The UEI must also be renewed every 365 days to remain active. If at any time the UEI status becomes “Inactive”, it will be reflected in the Lender Electronic Assessment Portal (LEAP). Mortgagees must address this failure to meet FHA’s requirements in accordance with the requirements for reporting material events in HUD’s Handbook 4000.1. A failure to maintain eligibility requirements will result in a referral to the Mortgagee Review Board.
Additionally, in order to streamline data reporting between LEAP and SAM.gov, ML 2024-09 also removes the home office geographic address from the data that must match in LEAP and SAM.gov.
Question
What is our potential liability for inaccurate HMDA data?
The Consumer Financial Protection Bureau (CFPB) has taken action against HMDA reporters in recent months for inaccurate reporting of HMDA data. In a previous FAQ on this subject we discussed the importance of monitoring employees to ensure their accurate HMDA data collection and reporting of demographic information (race, ethnicity, and sex). We highlighted that the CFPB imposed a $12 million fine after finding that bank employees failed to ask mortgage applicants certain demographic questions and falsely reported that applicants chose not to respond.
It is clear that enforcement actions, reputational risk, and potentially exorbitant fines and penalties are all risks. Also noteworthy is that the CFPB has often performed additional follow-up reviews of HMDA reporters found in violation. These additional reviews require company/bank time and resources on top of what would normally be allocated to HMDA data scrubbing and reporting and may result in additional actions and fines to the HMDA reporter.
Most recently, the CFPB filed a proposed order against a non-bank mortgage lender labeling it a repeat offender and, in addition to a large civil money penalty ($3.95 million), indicated it will:
1) Require the mortgage company to retain the services of a qualified third-party independent auditor to perform:
a. Quarterly HMDA data transaction testing;
b. Root cause analysis for each error identified by the testing; and
c. Quarterly written transaction test reports describing the methodology used and summarizing the HMDA transaction test and results, including errors identified, error rates per data filed, the root cause of the errors, and all actions taken to prevent re-occurrence of the error.
2) Establish a HMDA Compliance Subcommittee of the Board consisting of specific executive officers that meets at least every quarter (and maintains minutes of meetings) and reports to the Board the status and outcome of corrective actions arising out of HMDA testing;
3) Create and implement a comprehensive compliance plan, which includes enhanced employee training and controls, to ensure compliant HMDA reporting.
Question
Has HUD implemented new cybersecurity reporting requirements?
Yes. On May 23, 2024, HUD published Mortgagee Letter 2024-10 “Significant Cybersecurity Incident (Cyber Incident) Reporting Requirements” as part of its commitment to the security and integrity of all operations systems and technology.
Effective immediately, the Mortgagee Letter requires FHA-approved Mortgagees to notify HUD when a Cyber Incident occurs. A Significant Cybersecurity Incident (Cyber Incident) is an event that actually or potentially jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies and has the potential to directly or indirectly impact the FHA-approved mortgagee’s ability to meet its obligations under applicable FHA program requirements.
An FHA-approved Mortgagee that experiences a suspected Cyber Incident must report the Cyber Incident to HUD’s FHA Resource Center at answers@hud.gov and HUD’s Security Operations Center at cirt@hud.gov within 12 hours of detection. Reports must include the following information:
- Mortgagee name;
- Mortgagee ID;
- Name, email address, and phone number of Mortgagee’s point of contact for Security Operations Center follow-up activities;
- Description of the Cyber Incident, including the following, if known:
- Date of Cyber Incident;
- Cause of Cyber Incident;
- Impact to Personally Identifiable Information;
- Impact to login credentials; and
- Impact to Information Technology (IT) system architecture;
- List of any impacted subsidiary or parent companies; and
- Description of the current status of the Mortgagee’s Cyber Incident response, including whether law enforcement has been notified.
Question
We recently received a consent order as a result of a routine state examination. Do we need to report this to HUD?
Yes. HUD requires the timely notification of state sanctions. HUD’s Mortgage Review Board took numerous administrative actions against mortgagees in recent years for a failure to notify HUD of state sanctions. Note, reporting is required even if the state sanction is publicly set forth on the NMLS Consumer Access website. The current version of the HUD’s Handbook 4000.1 indicates:
A Mortgagee must submit a Notice of Material Event to FHA and provide relevant documentation if it or any officer, partner, director, principal, manager, supervisor, loan processor, loan underwriter, or loan originator employed or retained by the Mortgagee is subject to any Unresolved Findings or Sanctions. A Mortgagee must submit a Notice of Material Event to FHA of a change of status in any Unresolved Finding or Sanction previously reported. 4000.1.I.A.7.u.
Recent updates to the Handbook 4000.1, effective August 19, 2024, define Unresolved Findings and Sanctions as follows:
- Unresolved Finding = a material, adverse written finding, to include fair lending violations of the Fair Housing Act or Equal Credit Opportunity Act, contained in a lawsuit or report produced in connection with an investigation, audit, or review conducted by HUD, another federal, state, or local governmental agency, or by any other regulatory or oversight entity with jurisdiction over the Mortgagee or its officers, partners, directors, principals, managers, supervisors, loan processors, loan underwriters, or loan originators, that has not yet been resolved through final agency or judicial action.
- Sanction = any penalty, punitive, or restrictive measure taken either for a failure to comply with or an alleged failure to comply with a court order, federal, state, or local government law, rule, or regulation.
Question
Are there new requirements mortgage lenders must incorporate into their Reconsideration of Value (ROV) process?
Yes. In May 2024, Freddie Mac, Fannie Mae and HUD issued ROV process requirements in an effort to promote consistency and combat appraisal bias.
The updates highlight the importance of a borrower having the knowledge and opportunity to request a ROV and understand the process. Among other requirements, below is a summary of some of the ROV process requirements:
- Disclosure: lenders must provide an easy-to-understand disclosure to mortgage applicants at the time of loan application and upon delivery of the appraisal report with instructions that explain the ROV process, timeframes, etc.;
- Process: lenders must establish a standardized process for communicating with the loan applicant, as well as the appraiser. The ROV process and all communication must confirm with appraiser independent requirements;
- Turn times: lenders must set the turn-time expectations both with the loan applicant and the appraiser and resolution of the ROV must be completed prior to loan closing;
- Training: lenders must ensure valuation and related staff, inclusive of third parties, are trained to identify prohibited discriminatory practices and appraisal deficiencies through the valuation review and ROV processes; and
- Cost: no costs associated with a ROV may be charged to the loan applicant.
Fannie Mae and Freddie Mac updates are effective for loans with applications dated on or after August 29, 2024.
HUD requirements must be implemented for FHA case numbers assigned on or after September 2, 2024.
Question
Does an approved seller/servicer need to report a single fidelity bond or errors and omissions loss to Fannie Mae?
Yes, in some instances. Fannie Mae requires an approved seller/servicer to report to Fannie Mae within 30 days after discovery of the occurrence of a single fidelity bond or errors and omissions policy loss that is mortgage related and the amount exceeds the lesser of $250,000 or the policy’s deductible, even when no claim will be filed or when Fannie Mae’s interest will not be affected.
In fact, it is a common MORA examination finding that a seller/servicer does not have a process in place to ensure Fannie Mae of such notification within 30 days. The requirements are set forth in A3-5-04 of the Single Family Selling Guide.
In addition, a seller/servicer must report to Fannie Mae within 10 business days of receipt of a notice from the insurer regarding the intended cancellation, reduction, nonrenewal, or restrictive modification of the seller/servicer’s fidelity bond or errors and omissions policy. The seller/servicer must email Fannie Mae (fidelity_bond_and_errors_and_omissions_claims@fanniemae.com) a copy of the insurer’s notice, describe in detail the reason for the insurer’s action if it is not stated in the notice, and explain the efforts it has made to obtain replacement coverage or to otherwise satisfy Fannie Mae’s insurance requirements.
Question
Can weak password management or other ineffective information technology controls be considered UDAAP violations?
According to the Consumer Financial Protection Bureau (CFPB), yes. The CFPB’s Supervisory Highlights, Issue 30 (Summer 2023) indicated that CFPB examiners found institutions engaged in unfair acts or practices by failing to implement adequate information technology security controls that could have prevented or mitigated cyberattacks. The CFPB pointed to the following specific issues cited by examiners:
(i) Weak password management policies;
(ii) Failure to establish adequate log-in attempt controls; and
(iii) Failure to adequately implement multifactor authentication or a reasonable equivalent.
The CFPB rationalized that, in the instances reviewed, lacking information technology controls caused substantial consumer harm as bad actors were able to take advantage of the vulnerabilities and steal consumer funds. Further, the CFPB indicated that consumers were also injured because they had to devote significant time and resources to dealing with the impacts of the breach (i.e. time enrolling in credit monitoring and/or identity theft protection services, and/or changing their log-in credentials). The CFPB noted impacted consumers could not reasonably avoid such injuries as they did not have control over the institutions’ security measures. Further, the CFPB concluded that the injuries to consumers outweighed any countervailing benefits, such as avoiding the cost of implementing information technology controls necessary to prevent these types of attacks.
Question
What do lenders need to consider with regard to Fannie Mae’s QC calibration process?
Fannie Mae increased its performance of QC calibrations in recent months after announcing in June 2022 that it would expand and formalize the QC calibration process. QC calibration is the process of comparing a lender’s own internal QC results to a known measurement or standard to confirm the accuracy of the lender’s results. In its January 2024 Quality Insider, Fannie Mae shed light on some of its key learnings and observations from the QC calibrations recently performed. Specifically, among other issues, Fannie Mae indicated:
- It identified numerous instances of self-reporting violations. Fannie Mae requires lenders to self-report loans found to have a defect making the loan ineligible for sale to Fannie Mae within 30 calendar days of confirming the defect. The calibration exercises identified instances in which self-reporting did not occur or exceeded this timeframe. Lenders must self-report through Loan Quality Connect™. See Selling Guide D1-3-06.
- Lenders failed to identify collateral-related quality control issues at the same frequency and severity levels as Fannie Mae. For instance, Fannie Mae noted that more than half of the lenders reviewed cited no appraisal findings in their QC reviews on loans where Fannie Mae cited appraisal findings.
- Lenders may benefit from revising how they classify identified errors/issues related to the 4506-C. For example, citing the specific reasons tax transcripts were not in the file may assist a lender with performing a root cause analysis (i.e. specific reasons may include that transcripts were ordered but not returned in time for the QC review, transcripts were ordered but the 4506-C was rejected because of incorrect information, or that transcripts weren’t ordered because the 4506-C form was missing).
Fannie Mae will continue to perform these QC calibration exercises and indicates the key objective is to provide feedback to help lenders determine if their internal QC program is accurately identifying and classifying defects.
Question
Will a state-regulated mortgage company be required to report data breaches to the Federal Trade Commission (FTC)?
Yes, under an amendment to the Safeguards Rule effective May 13, 2024, the FTC will require certain nonbank financial institutions, including mortgage lenders and brokers, to notify it of data breaches and security events. Specifically, the amendment requires notice to the FTC after discovery of a “notification event” that involves the information of at least 500 consumers. The amendment defines a “notification event” as follows:
“cquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Customer information is considered unencrypted for this purpose if the encryption key was accessed by an unauthorized person. Unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.”
Notification events must be reported to the FTC as soon as possible and no later than 30 days after discovery. The notice must be made electronically on a form located on the FTC’s website: FTC.gov and include the following:
(i) Name and contact information of the reporting financial institution;
(ii) Description of the types of information that were involved in the notification event;
(iii) If possible to determine, the date or date range of the notification event;
(iv) Number of consumers affected or potentially affected by the notification event;
(v) General description of the notification event; and
(vi) Whether any law enforcement official provided the financial institution with a written determination that notifying the public of the breach would impede a criminal investigation or cause damage to national security, and a means for the FTC to contact the law enforcement official.
Question
What does Fannie Mae require when establishing a target defect rate in relation to a mortgage lender’s quality control (QC) program?
In order to evaluate and measure loan quality standards effectively, Fannie Mae requires mortgage lenders establish a target defect rate related to its post-closing random QC sample, reflecting the lender’s quality standards and goals. Fannie Mae advises that different target defect rates may be established for different severity levels. However, at a minimum, a target defect rate must be established for the lender’s highest level of severity. A lender must document the rationale for establishing its target defect rate(s). In the August 2023 issue of Beyond the Guide (Guide), Fannie Mae provided helpful tips to establish an appropriate target defect rate. The Guide advised that realistic targets should be:
- Set as low as possible;
- Designed to be reduced over time;
- Based on financial analysis of costs associated with defective loans;
- Evaluated at least annually against updated performance, default and capital needs; and
- Used to quantify the risk exposure of defects and drive change.
Fannie Mae requires lenders to document the rationale used to establish the target defect rate(s). Fannie Mae also requires lenders to measure performance against their target defect rate(s) at least quarterly and report results to management. The gross defect rate is the true measure of a lender’s manufacturing quality for its overall book of business. Lenders must evaluate the target defect rate(s) at least annually and reset, if necessary, with the goal of reducing defects over time.
Question
Will the NMLS be changing?
Answer
The Conference of State Bank Supervisors (CSBS), which oversees NMLS through the State Regulatory Registry LLC, recently announced a six-year plan to enhance and modernize NMLS in stages. CSBS outlined its agenda for phase 1 and phase 2 occurring over the next two years:
Phase 1 – 2024:
- Eliminate the need to call the NMLS Call Center to reset a password (the NMLS log-in site will soon have a “Password Reset” functionality);
- Establish a single log-in per individual user (multiple accounts by the same individual will be consolidated under one profile with a single log-in);
- Reduce duplication of individual records;
- Introduce survey and system usage tracking; and
- Update NMLS’ design and improve navigation.
Phase 2 – 2025:
- License workflow changes in an effort to make NMLS more intuitive;
- Implement enhanced integration (for example, ensure all license requirements can be found in one location rather than having to review checklists, statutes, etc.);
- Company/Mortgage Loan Originator associations updates:
- Streamlining processes related to company access, relationships, registered location links, and sponsorships;
- Incorporating system-driven rules for location and sponsorship requirements, such as auto-sponsorship (provided each state adopts); and
- More robust data validations and accuracy checks when completing the MU-4 form to help prevent incomplete applications.
CSBS launched a new NMLS Modernization site, which provides helpful information about upcoming changes and which will be used to collect industry feedback and provide demonstrations on new and/or proposed NMLS features.
Question
I know the Mortgage Call Report (MCR) has been updated, but where can I find information on it?
Answer
The NMLS Resource Center includes a dedicated webpage for the New Mortgage Call Report Form Version 6. Among other information and documents, the webpage provides links to the following:
- A chart outlining which state agencies granted a grace period for filing the initial MCR requiring the new form;
- A summary of the changes* made to the form, including a redline comparison between the old form and new form;
- Frequently Asked Questions related specifically to the new MCR and State Specific Supplemental Form;
- A list of states requiring the State Specific Supplemental Form;
- A copy of the new MCR and State Specific Supplemental Form; and
- A training demo of the new MCR Form Version 6 functionality, presented at the 2024 NMLS annual conference, and a link to register for a live training, which will be held on March 27, 2024, 2:30-4:00pm EST.
The Conference of State Bank Supervisors (CSBS) also advised inquiries may be emailed to MCRV6@csbs.org and it will be holding office hours via Zoom from 1:00-2:00pm EST on Monday, March 25, and Monday, April 8, 2024:
https://us02web.zoom.us/j/82102995323?pwd=dTV6WHdXWjZNUWVsQzVmVmpUdTR2UT09
Meeting ID: 821 0299 5323
Passcode: 102696
*Check out AGMB’s prior Compliance Question of the Week detailing the changes to the MCR: https://agmblaw.com/compliance-question-of-the-week-2023/#mcr
Question
Is HUD no longer requiring branch office registrations to conduct FHA business?
Answer
Yes, effective March 4, 2024, HUD will be eliminating the current requirement for mortgagees and lenders to register branch offices where they conduct FHA Title I and/or Title II loan originations. HUD explained that as the mortgage industry has evolved, it believes that requiring a mortgagee or lender to register all branches is an unnecessary administrative and cost impediment to program participation.
This final rule, Changes in Branch Office Registration Requirements, published in the Federal Register on February 2, 2024, revises 24 CFR 202.5(k) to give mortgagees and lenders the option to register all branch offices; and makes fees applicable only to branch offices that mortgagees or lenders register, rather than applying fees to each branch authorized to originate FHA loans. Branch offices not registered with HUD are not subject to branch registration fees and will be excluded from the HUD Lender List Search page.
Removing the requirement to register branch offices will not affect HUD’s monitoring of lenders and mortgagees. HUD will continue to maintain oversight and risk management of lenders and mortgagees that remain responsible to FHA for the actions of its branch offices and employees.
Question
Has Fannie Mae issued recent guidance related to appraiser identity theft?
Answer
Yes, in a recent Fraud Alert: Appraiser Identity Theft (January 2024), Fannie Mae identified a significant number of loans originated between 2021 and 2023, which involved appraisals completed by an unlicensed appraiser unlawfully using the identities of other actively licensed appraisers.
Fannie Mae provided lenders with the following red flags for this particular mortgage fraud scenario:
- The unlicensed appraiser’s name and signature are not found in any capacity within the appraisals (or loan files).
- The company name, phone number, and address listed under “contact information” on page six of Form 1004 will be different from that of the licensed appraiser.
- Email contact information reflects a name other than the name of the appraiser who is listed as having performed the appraisal.
- The signatures of the “victim” appraisers appear forged and/or cut and pasted to the identified appraisals.
- Appraisal fees for the appraisals were paid with proceeds going directly to the mailing address of the unlicensed appraiser, not to the address of the purported appraisers.
Fannie Mae also advised lenders that they should do the following to help minimize the risk of appraiser identity theft:
- Perform thorough due diligence when retaining services of appraisers and other outside vendors; and
- Utilize all available public records and licensing agencies in determining the validity of third-party documentation (including addresses) within loan files.
Fannie Mae maintains a dedicated Mortgage Fraud Prevention webpage, which provides valuable resources including publicly available data on fraud trends and recent fraud alerts.
Question
How important is it to evaluate the cybersecurity risk and protocols of our vendors?
Answer
In today’s environment, it is critical for mortgage companies and financial institutions to evaluate the cybersecurity risk and protocols of their vendors. A significant number of the network intrusions and data breaches occurring today originate with a third party, including vendors. Mortgage companies and financial institutions not only need to maintain adequate written third-party vendor management policies and procedures, but they must also perform a sufficient cybersecurity risk assessment of each vendor and ensure they conduct thorough due diligence of vendors deemed to be medium or high risk prior to on-boarding and on an ongoing basis. Due diligence may include, but is not necessarily limited to:
- Determining if the vendor maintains qualified information security personnel, internally or externally;
- Identifying and evaluating controls implemented to protect confidential data and/or non-public personal information (i.e. password protocols, access management, multifactor authentication, network scanning, etc.);
- Reviewing the vendor’s disaster recovery and incident management plans and related testing of such plans;
- Reviewing security awareness training, including phishing exercises;
- Reviewing external security audits performed (i.e. SOC, SSAE16, penetration tests, etc.); and
- Determining whether the vendor utilizes subcontractors and, if so, whether confidential data and/or non-public personal information is shared with those subcontractors.
Failing to perform appropriate cybersecurity reviews of vendors opens a mortgage company and financial institution up to significant risk.
Question
Does a mortgage lender need to monitor their employees to ensure accurate HMDA data collection and reporting of demographic information (race, ethnicity, and sex)?
Answer
YES! The regulatory requirement for lenders to collect demographic information dates back to 1977 and is used by regulators to help detect mortgage lending discrimination. The Consumer Financial Protection Bureau (CFPB) and other federal regulators stress the importance of collecting accurate data for this reason. Often mortgage lenders rely upon their employees to collect this data, but this is something which can result in severe monetary penalties for a mortgage lender.
For example, in a recent Consent Order with Bank of America, the CFPB imposed a fine of $12 million. The CFPB found that hundreds of Bank of America loan officers failed to ask mortgage applicants certain demographic questions as required under federal law, and then falsely reported that the applicants had chosen not to respond. The CFPB indicated Bank of America failed to adequately oversee its mortgage loan officers in regard to collection of this data, which resulted in inaccurate and false reports.
Unfortunately, this is a common theme in the mortgage industry. Mortgage lenders must train their mortgage loan originators regarding the responsibility to request and collect demographic information from applicants. For online applications, mortgage lenders must ensure their systems properly request and record this information as well. Mortgage lenders must also review and audit the data collected to make sure it is accurate. High percentages of “I do not wish to provide this information” from a particular mortgage loan originator may be a sign to a mortgage lender (and regulators) of inaccurate reporting and requires further investigation.
Appendix B to Part 1003 – Form and Instructions for Data Collection on Ethnicity , Race, and Sex is a useful tool for lenders. It provides a sample data collection form and explains how to report demographic information based on the applicant’s responses and method of application.
Question
Are there any significant risks to a mortgage lender for offering pricing exceptions to an applicant in an effort to retain the customer?
Answer
Yes.
In a previous AGMB FAQ, we addressed the risks posed to a lender when making a pricing exception. We detailed how the CFPB outlined in a 2014 Supervisory Highlights that any lender who makes pricing exceptions to their credit standards should:
- Memorialize written policies and procedures for pricing exceptions (when allowed) and how they must be documented.
- Monitor and Audit to make sure these policies are followed.
- Train staff on the policies (not just basic fair lending training).
- Include pricing exceptions in the Fair Lending Analysis a lender performs to ensure there are no patterns of disparity.
The CFPB again raised concerns with pricing exception practices in their Supervisory Highlights published in the Fall 2021 Supervisory Highlights and Summer 2023 Supervisory Highlights, finding that mortgage lenders violated ECOA and Regulation B by discriminating in the incidence of granting pricing exceptions across a range of ECOA-protected characteristics, including race, national origin, sex, or age.
Most recently, in December 2023, the CFPB issued a Matter Requiring Attention (MRA) notice to Wells Fargo regarding pricing exceptions (referenced by the CFPB as “loan discounts”). The CFPB has previously explained that examiners use MRAs “to communicate specific goals to accomplish to address violations of law, risk of such violations, or compliance management deficiencies.” It is not entirely clear whether the CFPB is investigating Wells Fargo for actual discrimination or found sloppy records, lack of written guidelines, poor oversight, or a combination of the foregoing.
Given the repeated warnings by the CFPB, mortgage lenders need to ensure their policies and procedures surrounding pricing exceptions are well-developed and equally applied. Staff must be properly trained and a lender must monitor its process and procedures to ensure fair treatment of applicants. Fair lending and anti-discrimination are key areas of concern for the CFPB and other regulators. In 2022, the CFPB carried out 32 fair lending investigations, more than doubling the number of probes it commenced in 2020. Lenders should expect this number to continue to rise.
