Purpose

This Advisory Bulletin communicates to Fannie Mae and Freddie Mac (the Enterprises) the Federal Housing Finance Agency's (FHFA) supervisory expectations for fraud risk management, including the establishment and maintenance of internal controls to prevent, deter, and detect fraud or possible fraud. 

Background

Effective fraud risk management is essential to the safe and sound operations of the Enterprises.  Potential exposure to the risk of fraud exists in Enterprise business operations.  For example, single-family and multifamily mortgage operations have exposure to the risk of fraud associated with activities of borrowers, loan originators, mortgage brokers, loan sellers, attorneys, servicers, appraisers, property managers, and third parties engaged to perform functions relating to loans or the collateral securing the loans.  Capital markets activities may expose an Enterprise to fraud committed by counterparties involved in securitizations.  The Enterprises also have potential exposure to fraud risk resulting from insider malfeasance.[1]

Fraud may subject an Enterprise to financial, operational, legal, or reputational harm.  For example, mortgage fraud may result in financial losses for an Enterprise if a seller does not have the financial ability and willingness to honor its obligation to repurchase fraudulent loans.  Other types of fraud may result in financial losses if the fraud is not fully covered by fidelity bond insurance.  An Enterprise may be exposed to litigation or civil money penalties for failure to comply with fraud-related statutes and regulations.  Further, fraud may cause reputational risk if an Enterprise's operations are used or perceived to be used to perpetrate fraud.  While experience demonstrates that fraud may not be prevented completely, it may be deterred or reduced through appropriate anti-fraud procedures that are maintained and reviewed over time.

Examples of Fraud

The Enterprises may encounter various types of fraud.  For example, mortgage fraud may occur in mortgage loans purchased for an Enterprise's own portfolios or for securitization.  Fraud may be committed as part of the origination, underwriting, or closing process or in conjunction with the servicing of a loan on behalf of an Enterprise. 

Mortgage-related fraud may be committed by various participants in the origination, selling, and servicing of mortgage loans.  Borrowers may provide false identification, employment, or income information to obtain approval for a mortgage loan.  Parties involved in loan originations, such as appraisers, attorneys, and title agencies, may engage in misrepresentation of collateral or performance of contracted responsibilities, or through diversion of funds.  Sellers of mortgage loans may misrepresent underwriting standards or deliver a single mortgage loan multiple times.  Servicers may divert custodial or other funds received to accounts used for their own purposes. 

Mortgage-related fraud may be part of larger schemes that include originating mortgage loans through the use of straw borrowers, illegal property flipping, double-pledging of collateral, and builder bailouts.  Post-origination mortgage fraud may target financially distressed borrowers to steal equity in or secure title to a property through fraudulent workout schemes or short sales. 

Insider fraud (i.e., fraud involving current or former employees and contractors) may include accounting fraud, payroll fraud, embezzlement, or collaboration with external parties in a fraud against an Enterprise or other financial institution. 

The wide variation of possible fraudulent activities creates a broad range of fraud risk; therefore, an Enterprise should implement a risk-based approach to fraud risk management that takes into account the scope and potential harm to the Enterprise of possible fraud.

Guidance

This Advisory Bulletin describes FHFA's expectations for the oversight of fraud risk management, key elements of a risk-based approach to fraud risk management, and the training and independent testing functions that should accompany an Enterprise's fraud risk management approach.  As described below, FHFA expects the Enterprises will take steps to manage fraud risk in all business lines and operational functions.[2]

Oversight of Fraud Risk Management

Each Enterprise's board of directors has a responsibility to ensure that the Enterprise's management is committed to effective fraud risk management and that the Enterprise has appropriate policies for preventing and detecting fraud or possible fraud.  The Enterprise should have documented processes in place to appropriately inform the board about fraud risk management activities and significant instances of fraud or possible fraud.  Fraud risk should be included in the risk management policies that are approved by the board or a committee thereof, and reviewed on a periodic basis. 

The policies should establish the Enterprise's standards and reporting processes relating to fraud and possible fraud.  The policies should designate the management official(s) responsible for the oversight of fraud risk management and define specific roles and responsibilities for personnel with fraud risk management responsibilities. 

Enterprise management should develop and oversee the implementation of business unit policies and procedures to implement and support anti-fraud and regulatory reporting programs and controls consistent with the Enterprise's policies.  Business unit policies should detail the Enterprise's fraud risk management processes, including risk assessments, internal controls, training, independent testing, fraud response protocols, and board and senior management reporting. 

The Enterprise should provide for appropriate coordination across business lines and functions of fraud risk management activities and resources.  Areas of coordination may include risk assessments, oversight of the design and implementation of anti-fraud and regulatory reporting programs and controls, and reporting to senior management and the board or a committee thereof, as appropriate, the results of the Enterprise's fraud risk management efforts. 

Elements of Fraud Risk Management

Effective fraud risk management should include:

• Ongoing risk assessments to determine areas of heightened risk for possible fraud and adequacy of the control environment.
• Risk-based internal controls that are designed to prevent and deter fraud from occurring.
• Risk-based internal controls that are designed to detect fraud when it occurs.
• Processes for responding to and reporting fraud or possible fraud.

Risk Assessments

An Enterprise should have an ongoing process for performing risk assessments to identify and assess risk of fraud and to evaluate controls in place to mitigate risk.  Risk assessments should consider factors such as products, services, customers, counterparties, and geographic locations, and should cover business units and operational and control functions.  Fraud risk assessments should provide the basis for internal controls to prevent and deter fraud and to detect fraud or possible fraud.  An Enterprise should have in place a process for periodically updating fraud risk assessments and making associated changes to internal controls. 

Fraud Prevention and Deterrence

Each Enterprise should maintain effective internal controls designed to prevent and deter fraud.  The type and scale of internal controls will vary depending on the operational area, product type, and fraud risk.  Types of controls include segregation of duties; a system of proper authorizations; physical safeguards to prohibit access to assets and records; a system of independent checks; and records to provide an audit trail. 

Internal controls should be clearly documented and subject to ongoing review to determine whether they are followed, are effective, and reflect current industry sound practices.  With regard to potential insider fraud, policies related to the consequences of committing or concealing fraud should be communicated clearly to all personnel. 

Fraud Detection

The complexity and extent of the internal controls for detection of different types of potential fraud in different business activities should be based on the fraud risk assessment, in light of the size, structure, risks, complexity, and vulnerability to fraud of the particular activity.  Fraud detection controls and tools may include, but are not limited to, internal and external tip hotlines; whistleblower vehicles; audits; quality control reviews; and analysis of financial, operational, and transaction data.  Detection methods may involve a review of transactions for possible fraud and, where possible, should include a review for red flags that indicate fraud or possible fraud.  Examples of red flags may include patterns of inconsistency in borrower information, loan documentation, servicer records, and significant servicer performance issues, as well as adverse public information.  Additionally, an Enterprise may identify individuals and firms known to have been involved in fraud.  Fraud detection procedures should document when findings will warrant the expansion of the scope of review consistent with current risk assessments.

Each Enterprise should have adequate information systems to timely capture information needed to detect fraud or possible fraud and comply with regulatory reporting requirements. 

Fraud Response and Reporting

Each Enterprise should have documented processes for evaluating and responding to various types of possible fraud and for complying with regulatory reporting requirements.  An Enterprise should take steps to make its employees and third parties aware of methods by which they may report possible fraud relating to Enterprise operations.  Furthermore, an Enterprise should ensure that its procedures and resources are sufficient to timely investigate possible fraud. 

An Enterprise's process should address investigation procedures, protocols for gathering evidence, decision-making authority, internal and regulatory reporting, escalation protocols, remedial action, and disclosure.  Individuals assigned to investigations should have the necessary training, authority, and skills to evaluate possible fraud and determine the appropriate course of action.  The process should include a tracking or case management system(s) where allegations of fraud are logged.  As appropriate, an Enterprise's procedures should also include a review of incidents to determine if improvements need to be made to processes or internal control systems to prevent future incidents of possible fraud. 

Each Enterprise should have effective, risk-based processes to timely investigate potential fraud to minimize and prevent loss.  Procedures should be in place for reporting investigation findings regarding fraud or possible fraud in accordance with regulatory requirements and Enterprise policy. 

Training

Each Enterprise should promote fraud awareness by conveying the importance of fraud prevention and penalties for fraud to all employees.  Each Enterprise should provide and document adequate fraud risk management training that is risk-based and commensurate with trainees' roles and specific responsibilities.  Training should include instruction on regulatory requirements and the Enterprise's policies and procedures to comply with those requirements.  Board and senior management training should reflect their oversight role.  Training should be updated as needed to reflect regulatory changes and industry sound practices, as well as changes to the Enterprise's risk assessments and internal controls. 

Independent Testing

Each Enterprise should conduct regular independent testing in all business lines to determine the overall adequacy and effectiveness of the Enterprise's fraud risk management.  Testing scope, procedures performed, and findings should be documented.

Related FHFA Guidance

Enterprise Fraud Reporting, Federal Housing Finance Agency Advisory Bulletin 2015-02, March 26, 2015, communicates to the Enterprises FHFA's fraud reporting requirements pursuant to 12 CFR Part 1233.

Oversight of Single-Family Seller/Servicer Relationships, Federal Housing Finance Agency Advisory Bulletin 2014-07, December 1, 2014, communicates to the Enterprises FHFA's supervisory expectations for managing counterparty risk associated with their relationships with single-family Seller/Servicers.

Suspended Counterparty Program at 12 CFR Part 1227, generally sets forth the requirements by which each regulated entity submits reports to FHFA when it becomes aware that an individual or institution with which it has been engaged in a covered transaction (as such term is defined in the regulation) within the previous three years has been convicted, debarred, suspended, or otherwise sanctioned, based on specified financial misconduct.  FHFA may issue suspension orders in appropriate cases, requiring the regulated entities to cease doing business with such individuals or institutions.

________________________________

[1] For purposes of this Advisory Bulletin, fraud occurs when a person(s), knowingly and willfully (1) falsifies, conceals, or covers up a material fact by any trick, scheme, or device; (2) makes any materially false, fictitious, or fraudulent statement or representation; or (3) makes or uses any false writing or document knowing the same to contain any materially false, fictitious, or fraudulent statement or entry.

[2] The risk management guidance in this Advisory Bulletin complements the requirements for reporting fraud and possible fraud found in: (i) 12 C.F.R. Part 1233, Reporting of Fraudulent Financial Instruments; (ii) 31 C.F.R. Parts 1010 and 1030, Anti-Money Laundering Program and Suspicious Activity Report Filing Requirements for Housing Government Sponsored Enterprises; and (iii) Advisory Bulletin 2015-02, Enterprise Fraud Reporting (March 26, 2015).