Advisory Bulletins

About Us

Performance and
Accountability Report

This annual report describes FHFA's accomplishments, as well as challenges, the agency faced in meeting the strategic goals and objectives during the past fiscal year.

FHFA Values

Fairness	We value varied perspectives and thoughts and treat others with impartiality.
Accountability	We are responsible for carrying out our work with transparency and professional excellence.
Integrity	We are committed to the highest ethical and professional standards to inspire trust and confidence in our work.
Respect	We treat others with dignity, share information and resources, and collaborate.

Supervision
& Regulation

Annual Report to Congress

Read about the agency’s 2022 examinations
of Fannie Mac, Freddie Mac and
the Home Loan Bank System.

Plans and Reports

We Want to Hear From You

Submit comments and provide input on FHFA Rules Open for Comment by clicking on Rulemaking and Federal Register.

Conservatorship

Conservatorship of Fannie Mae
and Freddie Mac

As conservator, FHFA is focused on ensuring that each Enterprise builds capital and improves its safety and soundness.

Conservatorship
Performance Goals

1.	Operate the business in a safe and sound manner.
2.	Promote sustainable and equitable access to affordable housing.

2023 Scorecard

Data & Tools

Downloadable Data
& Data Reports

FHFA experts provide reliable data, including all states, about activity in the U.S. mortgage market through its House Price Index, Refinance Report, Foreclosure Prevention Report, and Performance Report.

House Price Index Release Dates

See HPI Release Dates for 2023 and 2024

Policy, Programs & Research

Source: FHFA

FHFA economists and policy experts provide reliable research and policy analysis about critical topics impacting the nation’s housing finance sector. Meet the experts...

Mortgage Translations
Mortgage Translations

Glossaries

COVID-19 Resources

Fannie Mae & Freddie Mac

Federal Home Loan Bank System

FHLB System Rulemaking & Federal Register

Legal Documents & Suspensions

Rulemaking and Federal Register

Advisory Bulletins

Dodd-Frank Act Stress Tests

LIBOR Transition

Home / Supervision & Regulation / Federal Home Loan Bank System / Advisory Bulletins

Advisory Bulletins

AB 2023-06: FHLBank Framework for Pilot and Voluntary Programs

44435

FHL Banks

11/9/2023 5:00:00 AM

AB 2023-06

11/9/2023 4:00:30 PM

Home / Supervision & Regulation / Advisory Bulletins / AB 2023-06: FHLBank Framework for Pilot and Voluntary Programs Advisory Bulletin [view PDF of Advisory Bulletin 2023-06

3936

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

AB 2023-03: FHLBank Changes to Internal Market Risk Models

39756

FHL Banks

4/17/2023 4:00:00 AM

AB 2023-03

4/17/2023 6:00:35 PM

Home / Supervision & Regulation / Advisory Bulletins / AB 2023-03: FHLBank Changes to Internal Market Risk Models Advisory Bulletin [view PDF of Advisory Bulletin 2023-03

6286

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Supplemental Guidance to Advisory Bulletin 2017-02 - Information Security Management

39067

All

1/13/2023 5:00:00 AM

AB 2023-02

<tbody><tr><td> ADVISORY BULLETIN AB 2023-02:  Supplemental Guidance to Advisory Bulletin 2017-02 - Information Security Management <a>[view PDF of Advisory Bulletin 2023-02]</a>    </td></tr></tbody></table><h1> Purpose</h1>The Federal Housing Finance Agency (FHFA) is issuing this Advisory Bulletin (AB) as supplemental guidance to FHFA AB 2017-02: Information Security Management, published on September 28, 2017.<a>[1]</a> This AB is applicable to Freddie Mac, Fannie Mae,<a>[2]</a> the Federal Home Loan Banks, and the Office of Finance (OF) (collectively, the regulated entities<a>[3]</a>) and clarifies FHFA’s existing guidance and provides insight on industry trends.<h1> Background</h1>Since the publication of AB 2017-02: Information Security Management, new cybersecurity threats have emerged, and existing threats have evolved. As the cyber landscape continues to change, FHFA expects the policies, procedures, and practices that the regulated entities use to ensure safe and sound information security risk management to evolve accordingly. The regulated entities’ information security management program should be commensurate with the level of risk and complexity of its threats and should be periodically reviewed to verify that it reflects industry standards. This AB elaborates on and clarifies elements of AB 2017-02: Information Security Management, and FHFA expects each regulated entity to individually assess the risks associated with protecting the confidentiality, integrity, and availability of its information. FHFA expects the regulated entities to protect their information technology (IT) environments using a risk-based approach to determine the appropriate activities to include in a comprehensive program. <h1> Guidance</h1>This AB’s guidance is organized by illustrative questions that a reader may have when considering the emergence of new cybersecurity threats and the evolution of existing threats since the publication of AB 2017-02: Information Security Management. Each regulated entity’s program should consider adopting appropriate industry standards commensurate with the complexity and risk profile of the entity, such as those promulgated by the National Institute of Standards and Technology (NIST).<a>[4]</a> 1.  How does cyber resiliency factor into AB 2017-02: Information Security Management?Cyber resiliency can be defined as “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.”<a>[5]</a> The regulated entities should secure their IT systems in order to continually deliver business operations during cyber events and incidents and/or breaches; remain prepared to detect and respond to compromises to mission critical functions from potential threats; and minimize disruption from an event, incident, or breach.<a>[6]</a>The confidentiality, integrity, and availability of key regulated entity systems and data should inform information security management at the regulated entities. Incidents affecting the confidentiality, integrity, and availability of systems can significantly impair the operations of the regulated entities. For these reasons, the regulated entities should consider adopting cyber resiliency standards such as those outlined in NIST publications,<a>[7]</a> such as planned redundancy, network segmentation, and strategic contingency planning with third parties to maximize the continuity of business operations. 2.  How can the regulated entities manage the risk from current information security threats?The regulated entities should be able to react to and consider the threats outlined below, among others, that expand on the concepts outlined in AB 2017-02: Information Security Management. The regulated entities should also remain familiar with emerging risks and mitigants within the industry by participating in financial sector information sharing workstreams (e.g., FSSCC, FS-ISAC).<a>[8]</a> FHFA expects a continual practice of cyber hygiene such as scanning for and timely patching of vulnerabilities and conducting penetration tests.Social EngineeringSocial engineering exploits weaknesses in people rather than in technology. Often, social engineering attackers gather information to support the beginning stages of a sophisticated attack. By improving awareness and implementing technical measures, the regulated entities reduce the chance of social engineering leading to a successful cyberattack.Phishing, or similar business email compromise (BEC) attacks, continues to be a commonly used social engineering tactic. Cyber attackers can be innovative and adopt new and creative social engineering tactics to trick company employees into disclosing their credentials or other non-public information. Email and web gateway servers can help defend against BEC attacks through URL filtering. The regulated entities should ensure that these defenses are frequently updated. Additionally, the regulated entities should, as a matter of routine, ensure they update security awareness trainings regularly, conduct social engineering testing (e.g., phishing simulations), and review network device configurations to ensure only legitimate traffic is allowed. Malware & RansomwareWhile the regulated entities may not be able to prevent being the target of malware and ransomware attacks, having appropriate operational resiliency measures can reduce the effect of these incidents on business operations. Each regulated entity should maintain a communications plan with response and notification procedures for a ransomware incident within its broader incident response plan. The procedures and plans should be tested regularly. All critical information should be regularly backed up as immutable data. Each regulated entity should test the ability to resume critical business processes using backups in a timely manner. The regulated entities should enable spam filters to prevent phishing emails from reaching end users, authenticate inbound email, and use behavior-based malware protection on servers and endpoints. Furthermore, the regulated entities should analyze the need to financially insure against ransomware. AccountsThe regulated entities should have individually attributable accounts for accessing IT assets and prohibit the sharing of user accounts. The use of shared accounts increases the risk of sharing passwords and typically will not allow for an attributable audit trail of activity. Furthermore, the regulated entities should enforce security controls over individual and privileged accounts, such as multi-factor authentication. Privileged accounts should be managed centrally and more stringently than non-privileged user accounts. Privileged accounts should be limited to only those who require elevated privileges for specific actions. For example, a privileged account should only be used for approved business purposes. Cybersecurity Supply Chain Risk Management <a>[9]</a> The regulated entities increasingly rely on suppliers to support critical functions, which potentially exposes the regulated entities to additional cybersecurity risk. These suppliers have their own suppliers, creating extended supply chains. Complex supply chains and cyber threat actors targeting supplier and acquirer networks increase the importance of supply chain resilience, business continuity, and disaster recovery planning. The regulated entities should consider the following supply chain risk mitigation activities to enhance their third-party risk and business resiliency management programs.<a>[10]</a>The regulated entities should manage risk from unexpected interruptions to the supply chain to ensure business continuity. Examples of potential disruptions include suppliers ceasing support for hardware and software, merger, acquisition, or change in leadership.<a>[11]</a> The regulated entities should proactively identify risks arising from potential disruptions and mitigate the risks accordingly. The regulated entities will benefit from including contractual provisions to modify or terminate a contract if the supplier is no longer able to meet regulated entity’s requirements. Furthermore, the regulated entities should consider incorporating lessons learned from prior supply chain incidents into planning, response, and recovery processes, and sharing such lessons learned with appropriate parties within the regulated entity.The regulated entities should consider strengthening their supplier management programs to monitor for potential security and privacy risks. This includes ensuring that suppliers are meeting regulated entity cybersecurity requirements and remediating any identified issues per agreed-upon timelines. The regulated entities should assess significant suppliers on a regular basis to identify potential changes to the suppliers’ risk profile. 3.  How do third-party provider relationships introduce user access management risks?To elaborate on the security risks identified in AB 2018-08: Oversight of Third-Party Provider Relationships, the regulated entities’ engagement with third-party providers can increase user access management risks if external users access the regulated entity’s network and data. If the third-party provider’s contract does not outline specific user access requirements, third-party users may not be subject to sufficiently stringent access controls, and the regulated entities may have insufficient transparency and visibility into the third party’s controls over their users. Finally, poor user access management within third-party providers’ own networks can increase the risk of disclosure of non-public information. As a result, the regulated entities should consider the cyber posture of a third party prior to engagement with the third party. The regulated entities should incorporate the access management guidance provided in this AB into the third-party risk management program, as well as the policies and procedures that implement the guidance detailed in AB 2016-04: Data Management and Usage.<a>[12]</a> 4.  How can information security be addressed at third-party providers?Information security risks should be addressed as early as possible during the third-party provider risk management life cycle. The degree of due diligence performed on the third-party providers’ information security program should be commensurate with the risk to the regulated entity’s confidentiality, integrity, and availability of systems and information. The regulated entity should determine if the third party has cybersecurity insurance and the extent and provisions of its coverage. If the third party uses subcontractors,<a>[13]</a> the regulated entity should understand the third party’s ability to control the subcontractors’ access. The regulated entity should approve subcontractor access to its IT systems or data based on the potential risk to the regulated entity. If applicable, the third party should fully disclose the extent of the subcontractors’ access to regulated entity data. Furthermore, if a third party loses or otherwise compromises regulated entity data, the third party should be contractually obligated to notify the affected regulated entity within an agreed-upon timeframe. The third party should have policies, procedures, certifications, and/or accreditations describing its information security program. Information security related expectations for the third party should be explicitly outlined in the contract.In addition to performing due diligence and contract negotiation, the regulated entities should conduct ongoing monitoring (and where necessary, on-site reviews) of a third-party provider’s information security program. Periodically, third-party providers should be required to attest that they meet contractually agreed-upon information security requirements, including robust risk management over their own third parties. The regulated entities should also review independent reports on a third-party provider’s security program, such as ISO 27001 certification, and PCI compliance and control reports (e.g., Service Organization Control). As part of ongoing monitoring of the third-party provider, the regulated entities should regularly monitor news, social media, and intelligence feeds for issues that may raise concerns regarding a third-party provider’s information security posture. In scenarios that warrant heightened risk monitoring, the regulated entities may use external third-party providers that specialize in supply chain cyber risk assessments to perform ongoing monitoring over the extended supply chain. 5.  What are examples of appropriate password safeguards?To address common attacks, industry best practices recommend a defense-in-depth strategy.<a>[14]</a> Multi-factor authentication is a strong preventative measure against most password attacks. To elaborate on AB 2017-02: Information Security Management, each regulated entity’s program should align with appropriate industry standards on multi-factor authentication, such as those promulgated by NIST, commensurate with the complexity and risk profile of the entity.<a>[15]</a> The regulated entities should also use detective measures such as logging and monitoring failed authentication attempts. Because industry best practices, such as password composition recommendations, adapt frequently to the changing threat landscape, the regulated entities should also review authentication protocols and rules at least annually.Additionally, employees and/or contractors should be given the least privilege necessary to perform their job duties. The regulated entity should identify an appropriate party to review privileges regularly, commensurate with the asset’s risk profile. Actions taken using elevated privileges should be monitored. Logs of elevated privilege actions should be parsed into a security information and event management (SIEM) tool.To elaborate on the guidance on remote access management set forth in AB 2017-02: Information Security Management, the regulated entities should account for “non-traditional” device<a>[16]</a> access to the network and adapt password security policies, procedures, and standards accordingly. The regulated entity’s management and monitoring of all mobile devices connected to its network through an established mobile device or application management program is critical to promoting sound endpoint security.As part of a strong information security culture, training users on security awareness and strong password management techniques can help employees mitigate user access risks. In addition to requiring training on regulated entity policies, procedures, and standards, regulated entities should periodically educate employees on both common and novel password security threats. 6.  How can the regulated entities address user access management risk given the new threat environment?The regulated entities’ information security programs should address risks associated with user access management. In recent years, cyber attackers accessed more entry points (e.g., off-premises “non-traditional” devices, traditional on-premises systems, and the Internet of Things<a>[17]</a>) and used more sophisticated methods of targeting users. Cyber attackers have targeted users with network access to escalate their own privileges and pivot within the network. Thus, the regulated entities should monitor user access, conduct user access reviews, and remove user access when no longer needed. Furthermore, the regulated entity should identify the access necessary for a user to perform job duties before granting access. 7.  What measures can be taken to mitigate the risk of unauthorized privilege escalation?Measures taken to mitigate the risk of privilege escalation may be incorporated into multiple layers of the regulated entity’s defense-in-depth posture. Security researchers note that efforts should start with defending against intrusions early in the chain of activities leading to privilege escalation. The regulated entities should disable unnecessary or unused services, block unnecessary or unused ports, and use automated command-shell tools (e.g., PowerShell) with discretion. Additionally, the regulated entities should harden defenses at endpoints by appropriately configuring applications such as email and web browsers and limiting executables. Attacks using remote desktop protocol and software have increased as more employees work remotely. Unauthorized parties may remotely access a network and escalate privileges to conduct an attack. The regulated entities should avoid the use of default passwords and reliance on default settings for remote desktop technology. The regulated entities may further secure remote access by enforcing strong controls such as requiring multi-factor authentication, patching, and updating software, and restricting access using firewalls. Additionally, unauthorized privileged escalation risk may be mitigated by applying principles such as “Zero Trust”<a>[18]</a> from industry best practices of granular and specific access permissions: <ul><li>The regulated entities may consider continuously reauthenticating a user rather than granting static authentication at the beginning of a user’s session.</li><li>Regularly review users with administrative or otherwise privileged access and deprovision access once the user no longer needs it.<a>[19]</a></li></ul> 8.  How can the regulated entities mitigate risks presented by incorporating new technology into existing infrastructure?New technology may require a learning curve before it is managed effectively. Therefore, it is beneficial for the regulated entities to have reliable and proven processes in place for designing and maintaining a secure and resilient enterprise IT architecture before introducing new technologies. Systems should be evaluated in a test environment before they are incorporated into the production environment. The regulated entities may consider developing a risk-based security strategy integrated with the business strategy that defines its appetite for risks posed by new technology. Furthermore, the regulated entities should establish appropriate governance processes for new technology, including risk assessment, and ensure relevant controls are in place prior to the new technology’s implementation. Once the new technology is in use, the regulated entity should continue to monitor and evaluate its risks. If new technology is replacing old technology, the regulated entities should ensure that they properly secure and retire any legacy infrastructure. The regulated entities should have a process in place to train users on any system migrating into production. This can be either formal training or a transfer of knowledge from users of a system in the test environment. 9.  How does information security management of cloud environments differ from information security management of on-premises environments?Whereas AB 2018-04: Cloud Computing Risk Management,<a>[20]</a> covers differences between the cloud environment and the on-premises environment and details third-party cloud provider management and information security, the sections below provide additional detail to the cloud information security operations topics parallel to Section III: Operations in AB 2017-02: Information Security Management. Continuous MonitoringThe regulated entity should integrate any cloud monitoring and logging tools into an existing SIEM platform for centralized threat detection and management. Most leading cloud service providers (CSP) offer built-in monitoring and logging tools, but the customers are responsible for configuring these tools. If a regulated entity chooses to use a CSP tool, the regulated entity should understand the tool’s capabilities. Vulnerability ManagementThe vulnerability management concepts outlined in AB 2017-02: Information Security Management apply to the cloud environment. Vulnerability management of cloud infrastructure is typically managed by the CSP; however, in a platform-as-a-service and infrastructure-as-a-service model, the customer is responsible for vulnerability management in the cloud. The regulated entities should prioritize vulnerability management for cloud applications at the start of the cloud build processes rather than as an afterthought at the end. Baseline ConfigurationRegulated entities should include cloud-based IT assets in the IT inventories referenced in AB 2017-02: Information Security Management. The process for baselining and monitoring IT asset configurations should be the same for both on-premises and cloud-hosted assets. Baseline configurations are especially important for virtual servers that are decommissioned and then recommissioned using established baselines. Secure baseline configurations should be established based on manufacturer or industry best practice. Additionally, leading CSPs provide security configuration guidelines for foundational services used for establishing connectivity, authentication, data access, and encryption settings. The regulated entities should identify and adopt appropriate baseline configuration standards that ensure a comprehensive view of potential security configuration gaps within all its cloud-based services and provide assurance that the cloud-based IT environment is configured to maintain the expected level of protection against threats to data. Asset LifecycleWith more critical processes moving to cloud environments, some asset management responsibilities could shift to the CSP. The regulated entities should continue to maintain an asset lifecycle program as detailed in AB 2017-02: Information Security Management. While the regulated entities may have fewer physical infrastructure assets such as servers, the regulated entities may need to enhance asset lifecycle policies and procedures to reflect trends such as BYOD (bring your own device) and increased teleworking. The regulated entities should consider how “nontraditional” devices fit into their asset lifecycle. Incident Response and RecoveryThe regulated entities should evaluate the design and operating effectiveness of the CSP’s incident response controls. Each Enterprise is expected to meet the provisions of AB 2020-05: Enterprise Cybersecurity Incident Reporting, in the event of a cybersecurity incident at a CSP that compromises the confidentiality, integrity, or availability of an Enterprise asset.<a>[21]</a> Similarly, each Federal Home Loan Bank is expected to meet data reporting provisions established by FHFA’s Division of Federal Home Loan Bank Regulation. Awareness and TrainingThe regulated entities should consider how using cloud technology affects the existing information security culture. Existing policies and procedures may need to be modified or supplemented to provide personnel with adequate information on securely developing and using cloud-based applications. As needed, the regulated entities should administer cloud-specific training to provide personnel with a baseline understanding of cloud systems. The regulated entities should administer role-based training to users with access to cloud systems, with more rigorous training required for those with privileged access. User Access ManagementWhen virtually connecting to a CSP, the regulated entities should extend existing user identity and access management policies such as federation<a>[22]</a> to the cloud. The regulated entities should tie identities to a centralized internal identity and consider the use of identity brokers where appropriate. Threat Intelligence SharingMost cloud industry leaders offer built-in threat intelligence services and publish whitepapers on using these services. Cloud customers are responsible for enabling and configuring these services. CSPs, federal agencies such as the Cybersecurity and Infrastructure Security Agency, and third-party security providers also produce alerts. The regulated entities’ existing SIEM framework should incorporate these alerts. The regulated entities should continue to participate in private and public threat intelligence coordination. As a small number of CSPs are heavily used within the financial sector, information exchange on threats affecting these platforms promotes financial sector security and resiliency. EncryptionIn addition to the guidance provided in Section III of AB 2017-02: Information Security Management, the regulated entities should also incorporate cloud encryption and key management concepts into policies and procedures. The regulated entities should define what data need to be encrypted and where the data are stored and then implement encryption and key management accordingly. For certain types of data that have specific regulatory or statutory requirements, each regulated entity should carefully evaluate whether the encryption of such data and the location in which such data are stored within a cloud environment comply with these requirements. Regulated entity information security personnel should work with their organization’s compliance and legal staff to clearly understand all applicable encryption-related laws and regulation and to ensure ongoing compliance. Many CSPs offer key management services; therefore, the regulated entities and their CSPs should agree upon roles and responsibilities for key storage and management services and document them in their service contracts. The regulated entities should adopt NIST standards to implement encryption and key management appropriately.<a>[23]</a> 10.  How should the information security program adapt to changing privacy laws?As many privacy laws are enacted at the state rather than the federal level, the regulated entities should continuously monitor the applicability of and their compliance with new and changing state privacy laws, as well as any relevant federal laws. These laws may require changes to the regulated entity’s information security program, as privacy laws may have implications on how and where certain data can be stored, the level of security needed to protect that data, and specific data retention and deletion requirements. For example, some state-specific privacy laws stipulate the level and type of encryption needed for certain kinds of data, the circumstances under which certain information can be shared with a third-party provider, notification requirements for data breaches, and the deletion of certain kinds of information on request. Data encryption should be balanced with data transparency to ensure that the relevant data can be easily located and removed when the law requires it to be deleted. Privacy laws underscore the necessity for the regulated entities to understand what data they own, where it is housed, who has access and for what purposes, and how the data is protected. The regulated entities should maintain a comprehensive and current inventory of all data they own, where data is located, with which third parties their data was shared, and for what purpose. Additionally, because laws may have different requirements and applicability depending on the location of the consumer and the kinds of data involved, regulated entity information security personnel should work with the regulated entity’s privacy, compliance, and legal offices to clearly understand the applicable requirements, best practices, and to ensure ongoing compliance with privacy laws. To effectively anticipate and address the implications of any new activity on privacy compliance and information security, the regulated entities should perform a privacy assessment prior to approving any new activities (including pilot initiatives and the commencement of any new third-party service provider relationship). 11.  What are avenues for discovering vulnerabilities? Penetration TestingThe regulated entities should engage third parties to perform independent penetration testing,<a>[24]</a> as well as perform internal penetration testing as necessary. Though penetration testing may proactively identify potential vulnerabilities during the development lifecycle, it generally is used to test a deployed system at any specific point in time and should not be used as a substitute for secure development practices. The regulated entities should conduct penetration tests on systems periodically post-deployment. Threat ModelingThe regulated entities may also use established frameworks to perform threat modeling<a>[25]</a> on their systems. The regulated entities should embed security protections into information systems by creating a feedback loop of identifying, mitigating, and reassessing threats. Rather than finding vulnerabilities in pre-deployed or deployed systems, the regulated entities may find them during the development process if security is prioritized in the design of the system. Additionally, both technical and non-technical vulnerabilities can be highlighted if threat modeling is performed by both the technical and functional stakeholders throughout the software development lifecycle. The regulated entities may incorporate threat modeling into the ongoing management and monitoring of high-risk systems. Vulnerability Disclosure ProgramA Vulnerability Disclosure Program (VDP) may enable the regulated entity to learn of vulnerabilities through external parties, such as IT and information security researchers, ethical hackers, etc. The discovery and shared disclosure of previously unknown vulnerabilities enables faster identification and remediation. Additionally, a VDP may potentially mitigate reputational risk if the regulated entities are informed of vulnerabilities through a non-public communication channel rather than through exploitation or publication of the vulnerability on public channels.<h1> Related Guidance</h1> Enterprise Risk Management Program, FHFA AB 2020-06, December 11, 2020. Business Resiliency Management, FHFA AB 2019-01, May 7, 2019. Oversight of Third-Party Provider Relationships, FHFA AB 2018-08, September 28, 2018. Cloud Computing Risk Management, FHFA AB 2018-04, August 14, 2018. Information Security Management, FHFA AB 2017-02, September 28, 2017. Internal Audit Governance and Function, FHFA AB 2016-05, October 7, 2016. Data Management and Usage, FHFA AB 2016-04, September 29, 2016. Operational Risk Management, FHFA AB 2014-02, February 18, 2014. <hr /> <a>[1]</a><a>AB 2017-02: Information Security Management, September 2017</a>. <a>[2]</a> Common Securitization Solutions, LLC (CSS) is an “affiliate” of both Fannie Mae and Freddie Mac, as defined in the Federal Housing Enterprises Financial Safety and Soundness Act of 1992, as amended. 12 U.S.C. 4502(1), and this AB applies to it. <a>[3]</a> The OF is not a “regulated entity” as the term is defined in the Federal Housing Enterprises Financial Safety and Soundness Act as amended. See 12 U.S.C. 4502(20). However, for convenience, references to the “regulated entities” in this AB should be read to also apply to the OF. <a>[4]</a> If a regulated entity chooses not to adopt or adhere to the NIST standards, the regulated entity could nevertheless meet FHFA’s supervisory expectations by demonstrating to the examiner’s satisfaction that adoption and adherence to a comparable set of current industry standards is safe and sound information security management. <a>[5]</a> Defined in NIST SP 800-160 Vol. 2 Rev. 1, December 2021. <a>[6]</a> Refer to <a>AB 2019-01: Business Resiliency Management</a>, for more information related to an entity’s ability to minimize disruptions and maintain business operations at predefined levels. <a>[7]</a>See footnote 4. <a>[8]</a>E.g., The Financial Services Sector Coordinating Council and Financial Services Information Sharing and Analysis Center. <a>[9]</a> Defined in NIST SP 800-161r1, May 2022. <a>[10]</a> Refer to <a>AB 2018-08: Oversight of Third-Party Provider Relationships</a>, for expectations related to the regulated entities’ risk management of third-party suppliers. <a>[11]</a>See NIST IR 8276, Key Practices in Cyber Supply Chain Risk Management: Observations from Industry. <a>[12]</a><a>AB 2016-04: Data Management and Usage, September 2016</a>. <a>[13]</a> Subcontractors are also referred to as fourth parties. <a>[14]</a> Defined in NIST SP 800-53 Rev. 5, September 2020. <a>[15]</a>See footnote 4. <a>[16]</a>E.g., smartphones, tablets, wearable technology. <a>[17]</a> Defined in NIST SP 800-172, February 2020. <a>[18]</a> Defined in NIST SP 800-207, August 2020. <a>[19]</a> For more information on “Zero Trust” principles, see <a>NIST Special Publication 800-207: Zero Trust Architecture</a> (2020). <a>[20]</a><a>AB 2018-04: Cloud Computing Risk Management, August 2018</a>. <a>[21]</a>See<a>AB 2020-05: Enterprise Cybersecurity Incident Reporting</a>, for FHFA’s definition of a “reportable cybersecurity incident.” <a>[22]</a> Defined in NIST SP 800-63 Rev. 3, June 2017. <a>[23]</a>See footnote 4. <a>[24]</a> Defined in NIST SP 800-95, August 2007. <a>[25]</a> Defined in NIST SP 800-53 Rev. 5, September 2020. <div><div><table><tbody><tr><td>FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. Questions about this advisory bulletin should be directed to: <a>SupervisionPolicy@fhfa.gov</a>.    </td></tr></tbody></table> <div><div></div><div></div></div> </div></div>

1/14/2023 4:17:39 PM

Home / Supervision & Regulation / Advisory Bulletins / Supplemental Guidance to Advisory Bulletin 2017-02 - Information Security Management Advisory Bulletin

8664

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Model Risk Management Guidance

38732

All

12/21/2022 5:00:00 AM

AB 2022-03

<table width="100%" class="ms-rteTable-default" cellspacing="0" style="margin:0px;padding:0px;line-height:inherit;font-family:"source sans pro", sans-serif;font-size:14px;vertical-align:baseline;table-layout:fixed;border-spacing:0px;font-stretch:inherit;background-color:#ffffff;"><tbody style="font:inherit;margin:0px;padding:0px;border:0px currentcolor;vertical-align:baseline;"><tr style="font:inherit;margin:0px;padding:0px;border:0px currentcolor;vertical-align:baseline;"><td class="ms-rteTable-default" style="font:inherit;margin:0px;width:776px;"> <span style="margin:0px;padding:0px;border:0px currentcolor;line-height:inherit;font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;vertical-align:baseline;font-stretch:inherit;font-weight:700 !important;">ADVISORY BULLETIN <span style="margin:0px;padding:0px;border:0px currentcolor;line-height:inherit;font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;vertical-align:baseline;font-stretch:inherit;font-weight:700 !important;">AB 2022-03:  Supplemental Guidance to Advisory Bulletin 2013-07 - Model Risk Management Guidance <span style="margin:0px;padding:0px;border:0px currentcolor;line-height:inherit;font-family:inherit;font-size:inherit;font-style:inherit;font-variant:inherit;vertical-align:baseline;font-stretch:inherit;font-weight:700 !important;"> <a href="/SupervisionRegulation/AdvisoryBulletins/AdvisoryBulletinDocuments/AB-2022-03_Supplemental-Guidance-to-AB-2013-07-Model-Risk-Management-Guidance.pdf">[view PDF of Advisory Bulletin 2022-03]</a> </td></tr></tbody></table><h1> PURPOSE</h1>The Federal Housing Finance Agency (FHFA) is issuing this Advisory Bulletin (AB) as supplemental guidance to FHFA AB 2013-07: Model Risk Management Guidance, published on November 20, 2013. This AB is applicable to Freddie Mac, Fannie Mae,<a href="#footnote1" class="super-script">[1]</a> the Federal Home Loan Banks (FHLBanks), and the Office of Finance (OF) (collectively, the regulated entities<a href="#footnote2" class="super-script">[2]</a>) and clarifies and expounds on various topics covered in FHFA's existing guidance.   The intent of this AB's guidance, formatted as Frequently Asked Questions (FAQs), is to provide supplemental guidelines that will address some of the gaps in AB 2013-07 prompted by changes in model-related technologies and questions generated from the expanded use of complex models by the FHLBanks. The supplemental guidance also addresses model documentation, the communication of model limitations, model performance tracking, on-top adjustments, challenger models, model consistency, and internal stress testing.  <h1> BACKGROUND</h1>Since the publication of AB 2013-07, we have observed changes in model-related technologies which have prompted changes in guidance and generated questions regarding existing guidance. The advent of cloud technology and artificial intelligence/machine learning techniques have led to FHFA's issuance of specific guidance on these topics.<a href="#footnote3" class="super-script">[3]</a> However, the issuance of that guidance has created gaps in AB 2013-07.  In addition, the FHLBanks have increased the use of models, employing internally developed models as well as complex vendor models. Since the issuance of AB 2013-07, FHFA has also amended the regulation addressing FHLBank capital requirements<a href="#footnote4" class="super-script">[4]</a> and issued related FHLBank guidance on modeling. Specifically, FHFA issued additional guidance on market risk models (AB 2016-02; AB 2018-01) and mortgage credit risk models (AB 2018-02).<a href="#footnote5" class="super-script">[5]</a> The FHLBanks' expanded model use as well as recent FHFA regulations and guidance applicable to the FHLBanks have also created the need for expanded clarification of AB 2013-07.<a href="#footnote6" class="super-script">[6]</a>     <h1> GUIDANCE</h1> 1.  Model Risk Management Framework 1(a).  How should “less complex" entities address expectations in AB 2013-07? Model risk management should be commensurate with a regulated entity's model use and risk exposure. AB 2013-07 provides a distinction between “complex" (Fannie Mae and Freddie Mac) and “less complex" (FHLBanks and OF) entities. Over time, the FHLBanks have expanded the scope, scale, and complexity of their modeling activities. Thus, the FHLBanks and OF should be attentive to changes in the complexity, impact, and scope of their modeling environments and modify their model risk management practices accordingly. Pointedly, the distinction between “complex" and “less complex" does not exempt “less complex" regulated entities from the expectations in AB 2013-07, but it could affect the frequency and rigor of certain model risk management practices. 1(b).  Does the existing definition of “model use" in AB 2013-07 encompass all potential model applications considering recent changes to model uses? AB 2013-07 defines model use “as using a model's output as a key basis for informing business decision-making, managing risk, or developing financial reports." The adoption of artificial intelligence and machine learning techniques has expanded the definition of model use beyond business decision-making, risk management, and the development of financial reports. The regulated entities employ artificial intelligence and machine learning for various business processes (e.g., productivity tools such as facial recognition for access management and document digitization).  Although FHFA has articulated expectations for risk management of artificial intelligence and machine learning in AB 2022-02: Artificial Intelligence/Machine Learning Risk Management (Feb. 10, 2022), the governance for models used for business decision-making, risk management, and financial reporting should still adhere to the expectations outlined in AB 2013-07. Models not directly used for those purposes should follow a governance framework commensurate to the risk, consistent with AB 2013-07. For example, if a model is used for scanning and digitizing documents, controls appropriate to the process should be developed to manage the risk. In addition to AB 2013-07, other appropriate FHFA guidance should be considered and applied in those instances.<a href="#footnote7" class="super-script">[7]</a> 1(c).  What are the expectations for mapping of key dependencies on external model-related data, software, storage, and technology? Since the publication of AB 2013-07, FHFA has observed a wider adoption of technologies in the mortgage industry. Many of these technologies reside externally to the regulated entities and are largely outside of the regulated entities' control. Examples of such technologies are cloud servers, vendor models, and external data used by the regulated entities as inputs for their models. Although FHFA has published guidance related to externally sourced technologies such as AB 2018-04: Cloud Computing Risk Management (Aug. 14, 2018) and AB 2018-08: Oversight of Third-Party Provider Relationships (Sept. 28, 2018), FHFA expects the regulated entities to take a macro-prudential view of the risks posed by externally sourced data and technologies. The regulated entities should map their external dependencies to significant internal systems and processes to determine their systemic dependencies and interconnections. In particular, the regulated entities should have an inventory of key dependencies on externally sourced models, data, software, and cloud providers. This inventory should be regularly updated and reviewed by senior management and presented to the board of directors, as deemed appropriate. 1(d).  How should a regulated entity treat processes or components of modeling processes that incorporate qualitative elements or judgements? AB 2013-07, in its definition of models, covers quantitative approaches whose inputs are partially or wholly qualitative or based on expert judgment, provided that the output is quantitative in nature.  2.  Model Documentation 2(a).  What elements should the regulated entities' model use policies and procedures include to ensure that model documentation is sufficient? For all model uses, a regulated entity should have policies and procedures in place to ensure model owners compile and maintain comprehensive model documentation that is sufficiently detailed to enable a qualified third party to independently operate and maintain a model for each model use. A regulated entity's processes should be designed and operated reliably to maintain comprehensive model documentation that is complete prior to the independent model validation for a specific use. A regulated entity should have processes in place for revising or augmenting the documentation based on the results of the model validation prior to model implementation. Procedures and policies that require updates to model documentation are important to memorialize all model components correctly and comprehensively for each model use.  2(b).  How should a regulated entity address and mitigate the risks associated with model limitations across the model lifecycle? The regulated entities should clearly document significant model limitations within the model documentation, along with any root causes and mitigation strategies where appropriate. A regulated entity should document and clearly communicate to the model user community model limitations identified during model development and model validation. Model limitations do not only arise from technical limitations. Limitations arise in part from weaknesses in the model because of its various shortcomings, approximations, and uncertainties. Limitations are also a consequence of assumptions underlying a model that may restrict the scope of appropriate use to a limited set of specific circumstances and situations. Decision makers need to understand the limitations of a model to avoid using it in ways that are not consistent with the original intent. 3.  Model Validation Program 3(a).  Should a regulated entity's internal model validation guidelines provide specific standards for an independent validation? A regulated entity's internal model validation guidelines and practices should align with AB 2013-07's specific standards to ensure independent review and challenge to model assumptions, mathematical formulae, and inputs. The internal guidelines should include a sufficient level of detail to ensure that qualified experts perform the review at a sufficient breadth and depth. Further, the model validation report should include thorough descriptions of these reviews and relevant outcomes. An independent model validation should extend beyond an affirmation of the model's correctness and reasonableness.  3(b).  How should the regulated entities evaluate third-party model validations? When using an external vendor to complete an independent model validation, the regulated entity's model validation group is accountable for the quality, recommendations, and opinions of any third-party review. When evaluating a third-party model validation, a regulated entity should implement model risk management policies and practices that align the vendor-completed specific standards for an independent validation with the specific standards included in AB 2013-07.  3(c).  How should model validation findings and other model risk issues be monitored and reported? A regulated entity should establish processes for monitoring the remediation status of identified model validation findings and other model risk issues and for providing reports to senior management and management-level committees. Findings and issues with production models that are significant in nature should be governed in accordance with the regulated entity's issues management program.   3(d).  What are acceptable practices for effective challenge? Model risk management policies, as AB 2013-07 notes, should include acceptable practices for “effective challenge" of models. Effective challenge involves critical analysis by independent, informed parties who can identify model limitations, evaluate assumptions, and recommend appropriate changes. The efficacy of effective challenge depends on a combination of incentives, competence, and influence. For example, effective challenge requires that the regulated entities invest human capital resources in qualified personnel and ensure the distinct separation of the model challenge process from the model development process. In addition, the regulated entity should foster a corporate culture where senior levels of management give those responsible for effective challenge processes explicit authority, support, and stature within the organization.  3(e).  Do challenger or benchmark models play a role in the effective challenge of models? The regulated entities should have a well-developed effective challenge process in place to assess the effectiveness of models and the reasonableness of key assumptions. This may include a champion-challenger framework in which challenger models give an alternative perspective to a primary, or champion model, and provide a point of comparison allowing for analysis of model results and sensitivity of the output. It is desirable that potential challenger models are well vetted, and employ alternative approaches to estimation, which may include theoretical or methodological differences from the primary model. Effective challenge should be in place at all levels of estimation where model or estimation risk is affected – this includes overall loss estimates, component level estimates, assumptions, and component level inputs. The regulated entities should document the effective challenge process as well as any changes that result from it and the rationale for their decisions. Although benchmark models may never be considered to be replacements for the primary model, they provide a point of comparison for understanding how the primary model results differ from other widely-referenced available models used in industry. Benchmark models may also aid in understanding the primary model.    3(f).  What should a regulated entity consider when deciding if an end-user computing tool (EUC) or calculator should be subject to the guidance set forth in AB 2013-07? The increase in the complexity and reliance on EUCs and calculators to carry out critical financial operations has also fostered the requirement for enhanced EUC/calculator risk mitigation.  For example, a regulated entity should classify a significant or important EUC, calculator, or other data generating process as a model if the EUC, calculator, or process (1) feeds into or out of a model; (2) makes assumptions; and/or (3) incorporates thresholds or quantitative methodologies. Additionally, EUCs and calculators may be integrated into broader modeling processes. When applicable, a regulated entity should also treat integrated EUCs and calculators as models and subject the EUCs, calculators, or processes to model validations and governance in accordance with the frequency and rigor outlined in the regulated entity's model risk management policies and procedures. A regulated entity that includes EUCs and calculators as part of the broader modeling process is likely already subjecting those EUCs and calculators to the guidance set forth in AB 2013-07. 4.  Model Control Framework 4(a).  How is model performance tracking integral to the model control framework? A regulated entity should have policies and procedures in place for ongoing model performance tracking (MPT) for each significant model use prior to model production implementation. Performance tracking preemptively ensures model integrity through the business cycle. Properly designed model performance tracking metrics, thresholds, and alerts provide the model diagnostics necessary to identify and measure sources of model error. Model diagnostics are intended to capture model performance degradation timely and facilitate the appropriate corrective action. MPT metrics and thresholds should be tied to both downstream use effects and a model's integrity as measured by the accuracy of the key outputs. Model owners are expected to involve model users and model risk management teams to ensure MPT metrics are appropriate, and thresholds are set below the risk tolerance of the business unit. 4(b).  What should a regulated entity consider when establishing thresholds for model performance tracking? Ongoing model performance tracking should include well-supported and documented thresholds and procedures for responding to outputs outside these thresholds. A regulated entity should select, fully document, and reevaluate, on an ongoing basis, thresholds for each significant model use. As models alone do not drive these business decisions and risk management, model performance thresholds and alerts should be set at a level below the point where model error approximates or equals management risk limits or risk appetite. 4(c).  Should model performance tracking include an evaluation of model adjustments?   Ongoing model performance tracking should also include monitoring and analysis of any model overrides, on-top adjustments, recalibration, and use of (or changes to) tuning parameters. This monitoring should include documented, ongoing analysis establishing that any adjustments are appropriate for the model uses to which they are applied. 4(d).  How should a regulated entity use model performance tracking metrics and reports? MPT results show the model's reasonableness, robustness, and range with respect to its historical performance.  Backward-looking performance metrics provide a useful measure of error due to the model. In both normal and stressed economic environments, model performance reports can help identify a model's fundamental flaws or weaknesses. Model performance reports should include aggregate model errors that directly affect business decisions and risk management. Upstream models errors can propagate to downstream models which could amplify the errors. 4(e).  Should regulated entities document support for on-top adjustments that align model predictions to actual results? Periodically, model outputs will require on-top adjustments to produce more accurate results. These adjustments can occur at the component level or be applied to the overall result depending on the need for the adjustment. The regulated entities should develop and document a clear and transparent process for determining (1) when on-top adjustments to models are needed; (2) how the adjustment will be applied; and (3) the length of time for having these adjustments in place before finding a permanent solution. 4(f).  Is it sufficient to state that assumptions or on-top adjustments are conservative? Simply indicating that model assumptions or on-top adjustments are “conservative" is a qualitative assessment and does not provide sufficient support for a quantitative assumption or adjustment. A regulated entity should provide documentation to support significant modeling assumptions or on-top adjustments whether they are “conservative" or not. 4(g).  What role does effective challenge play in establishing on-top adjustments? When on-top adjustments are applied, the regulated entities should document the justification for the on-top adjustment, articulate the effect of the adjustment, and state for how long it will be applied. On-top adjustments should also be subjected to effective challenge. Model risk management should also track and review on-top adjustments to get a broad view that may reveal an enterprise-wide issue. 4(h).  How should a regulated entity manage the recurrent use of on-top adjustments? The use of on-top adjustments should initiate a review process to determine the reason for the on-top adjustment. The recurrent use of on-top adjustments in model estimates can be an indicator of an insufficient model or process robustness and should trigger a review. This review should assess whether the causes leading to use of the on-top adjustment are temporary. If the on-top adjustment is deemed to be recurrent rather than temporary, then the model or forecast process may require updating. If updates are necessary, the regulated entities should have in place a feedback process that engages with the relevant committees, business units, or individuals in a manner that allows model owners to promptly execute any necessary updates to the models. With the continued use of on-top adjustments, a regulated entity's documentation of the need to maintain the adjustments during the next validation cycle is an important feature of any review process. Full documentation of the findings of the review process, and the rationale for any decision and outcome, is another important element concluding the review process. 4(i).  Is a regulated entity expected to incorporate modeling assumptions and inputs in the same manner across various model uses? The regulated entities' policies and procedures should ensure that models, assumptions, and inputs, such as housing price appreciation or macroeconomic factors, are used in a consistent manner across the various financial and business practices where applicable. However, model flexibility is desirable to address circumstances in which models and assumptions cannot be used consistently. For example, if accounting rules prescribe a specific use, then the regulated entity would need a process to address that use and to evaluate and assess the effect of the inconsistency. The regulated entity should document the occurrence, the reason for the differences, and if it has a material effect, determine what steps may be needed to mitigate the effect.  4(j).  What are model implementation risks and how can these be mitigated? Errors can occur at any point from design through implementation, thus model risk management should include disciplined and knowledgeable development, testing and implementation processes. Data and other model inputs used to generate model results often rely on EUCs, upstream models, or other supplemental data generating processes that can be subject to human error or operational errors. A regulated entity should regularly evaluate and confirm that data or other input generating processes align with the documented model theory and have not been subject to human error.  5.  Internal Scenario and Sensitivity Analysis and Stress Testing 5(a).  What are FHFA's model expectations for scenario analysis? A regulated entity should use scenario analyses to assess the reliability, effectiveness, and stability of forecasts the models produce in a variety of situations and to identify potential issues with the models that can lead to inaccurate results. Scenario analysis should be distinguished from stress testing as both can be applied enterprise-wide and will often employ the regulated entities' most significant models. Internal scenario analysis and stress testing should be conducted on a recurring basis but should also be conducted as needed. 5(b).  What are FHFA's model expectations for sensitivity analyses? Sensitivity analysis can be conducted to assess the effect of many model-related factors (e.g., variables, model specification, key assumptions, constraints on intermediate outputs such as a loss severity floor). Because models are highly influenced by underlying assumptions in forecasted values, the regulated entity should assess how different assumptions and processes can affect the estimates. The regulated entity should use realistic expectations and an approach that makes intuitive sense when stressing key variables. Sensitivity analyses should be completed for each significant component model as well as the overall model or forecast. A regulated entity should vet thresholds or criteria they use for sensitivity analysis to ensure they are meaningful and realistic. 5(c).  What are FHFA's model expectations for internal stress testing? Stress testing is a critical tool for a regulated entity's risk management because it alerts senior management to unexpected adverse outcomes for a range of potential risks. Stress testing also may enable the regulated entity to better understand its models' expected losses by exposing model behavior or risk factor behavior that may not be otherwise realized. This may lead to reconsideration of existing model formulations that improve performance or enhance the usefulness of the model. Stress test scenarios should be designed to capture risks relevant to model predictions for each model use. Stress test scenarios should be developed using reasonable, potential scenarios and incorporate historical events and hypothetical future events, or those not observed historically, (e.g., scenarios without government intervention). Stress test scenarios should also consider potential systematic issues that may adversely affect the model's forecasts.  A stress test is designed to simulate the eﬀect of one or more shocks or prolonged downturns on the entire regulated entity. A “shock" is a large, sudden, adverse change in the state of the external world or the internal state of a regulated entity. A shock appears suddenly, and its eﬀects are felt immediately. A “prolonged downturn" is a large, adverse change in the state of the world that emerges and becomes apparent slowly over time. Stress scenarios should be designed to ensure that, in the aggregate, the scenario is sufficiently stressful to challenge the risk management processes, capital, and earnings positions of the regulated entity. Scenario severity should consider countercyclical scenario design principles (i.e., a more pronounced economic downturn when current conditions are stronger and a less pronounced economic downturn when current conditions are weak). Each scenario variable follows a predetermined path over time. For computational ease, a stress test can assume that the regulated entity has “exact foresight," a more deterministic approach where at each point in time within the planning horizon the regulated entity knows the exact path that a variable will follow. Alternatively, a stress test can assume that a regulated entity has only “incomplete foresight" – that at each point in time the regulated entity can only imperfectly forecast a variable's future path. To ensure that stress tests are realistic regarding what can be known ex ante about the future, stress tests should include incomplete foresight when feasible. Incomplete foresight incorporates a more stochastic approach to scenario generation of variables where outcomes are random or uncertain. In addition, stress tests should provide a range of potential losses in addition to point estimates, and these results should be regularly reported to senior management so that they are aware of the output uncertainties associated with models. <h1> RELATED GUIDANCE AND REGULATIONS</h1> Model Risk Management Guidance, FHFA AB 2013-07 (Nov. 20, 2013). Operational Risk Management, FHFA AB 2014-02 (Feb. 18, 2014). FHLBanks Changes to Internal Market Risk Models, FHFA AB 2016-02 (Apr. 21, 2016). Data Management and Usage, FHFA AB 2016-04 (Sept. 29, 2016). Information Security Management, FHFA AB 2017-02 (Sept. 28, 2017). Scenario Determination for Market Risk Models Used for Risk-Based Capital, FHFA AB 2018-01 (Feb. 7, 2018). FHLBank Use of Models and Methodologies for Internal Assessments for Mortgage Asset Credit Risk, FHFA AB 2018-02 (Apr. 26, 2018). Cloud Computing Risk Management, FHFA AB 2018-04 (Aug. 14, 2018). Oversight of Third-Party Provider Relationships, FHFA AB 2018-08 (Sept. 28, 2018). Business Resiliency Management, FHFA AB 2019-01 (May 7, 2019). Compliance Risk Management, FHFA AB 2019-05 (Oct. 3, 2019). Enterprise Risk Management Program, FHFA AB 2020-06 (Dec. 11, 2020). Artificial Intelligence/Machine Learning Risk Management, FHFA AB 2022-02 (Feb. 10, 2022). 12 CFR part 1236, Appendix, Prudential Management and Operations Standards 12 CFR part 1277, Federal Home Loan Bank Capital Requirements, Capital Stock and Capital Plans. <hr /> <a name="footnote1" class="super-script">[1]</a> Common Securitization Solutions, LLC (CSS) is an “affiliate" of both Fannie Mae and Freddie Mac, as defined inthe Federal Housing Enterprises Financial Safety and Soundness Act of 1992, as amended.  12 U.S.C. 4502(1), and this AB applies to it. <a name="footnote2" class="super-script">[2]</a> The OF is not a “regulated entity" as the term is defined in the Federal Housing Enterprises FinancialSafety and Soundness Act as amended.  See 12 U.S.C. 4502(20).  However, for convenience, references to the “regulated entities" in this AB should be read to also apply to the OF. <a name="footnote3" class="super-script">[3]</a> Cloud Computing Risk Management, FHFA AB 2018-04 (Aug. 14, 2018).  Artificial Intelligence/Machine Learning Risk Management, FHFA AB 2022-02 (Feb. 10, 2022). <a name="footnote4" class="super-script">[4]</a> 12 CFR part 1277—Federal Home Loan Bank Capital Requirements, Capital Stock and Capital Plans; see 84 Fed. Reg. 5426 (Feb. 20, 2019) (amending FHFA's regulation on FHLBank capital requirements). <a name="footnote5" class="super-script">[5]</a> FHLBank Changes to Internal Market Risk Models, FHFA AB 2016-02 (Apr. 21, 2016); Scenario Determination for Market Risk Models Used for Risk-Based Capital, FHFA AB 2018-01 (Feb. 7, 2018); FHLBank Use of Models and Methodologies for Internal Assessments for Mortgage Asset Credit Risk, FHFA AB 2018-02 (Apr. 26, 2018). <a name="footnote6" class="super-script">[6]</a> The capital rule (12 CFR part 1277—Federal Home Loan Bank Capital Requirements, Capital Stock and Capital Plans) requires the FHLBanks to use models for credit risk (as opposed to their previous reliance on credit ratings). FHFA's Division of Bank Regulation (DBR) can direct an FHLBank to revise its credit risk methodology or model to address any deficiencies identified by FHFA. DBR's capital rule also requires that the FHLBanks seek approval for changes to their market risk models. A Bank making a change to a market risk model should follow the process outlined in AB 2016-02.  <a name="footnote7" class="super-script">[7]</a> Other appropriate FHFA guidance includes, for example:  Artificial Intelligence/Machine Learning Risk Management, FHFA AB 2022-02 (Feb. 10, 2022); Enterprise Risk Management Program, FHFA AB 2020-06 (Dec. 11, 2020); Compliance Risk Management, FHFA AB 2019-05 (Oct. 3, 2019); Business Resiliency Management, FHFA AB 2019-01 (May 7, 2019); Oversight of Third-Party Provider Relationships, FHFA AB 2018-08 (Sept. 28, 2018); Information Security Management, FHFA AB 2017-02 (Sept. 28, 2017); Data Management and Usage, FHFA AB 2016-04 (Sept. 29, 2016); Operational Risk Management, FHFA AB 2014-02 (Feb. 18, 2014).   <div><table width="100%" class="ms-rteTable-default" cellspacing="0" style="font-family:"source sans pro", sans-serif;font-size:14px;font-style:normal;font-weight:400;"><tbody><tr><td class="ms-rteTable-default" style="width:776px;">FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. Questions about this advisory bulletin should be directed to: <a href="mailto:SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov</a>.    </td></tr></tbody></table> </div>

1/17/2023 10:42:17 PM

Home / Supervision & Regulation / Advisory Bulletins / Model Risk Management Guidance Advisory Bulletin AB 2022-03: Supplemental Guidance to Advisory Bulletin 2013-07

11128

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Supervisory Letter on FHLBank Membership Issues - September 2021

35450

FHL Banks

9/9/2021 4:00:00 AM

A number of issues relating to Federal Home Loan Bank (FHLBank or Bank) membership eligibility have arisen recently both through the examination process and as a result of inquiries to the Federal Housing Finance Agency (FHFA). FHFA has issued this supervisory letter to ensure that all FHLBanks are aware of these issues and to provide uniform guidance in the event other Banks encounter similar circumstances.

9/9/2021 4:30:40 PM

Home / Supervision & Regulation / Advisory Bulletins / Supervisory Letter on FHLBank Membership Issues - September 2021 Advisory Bulletin A number of issues relating to

9532

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Framework for Adversely Classifying Loans, Other Real Estate Owned, and Other Assets and Listing Assets for Special Mention

34027

FHLB & Fannie Mae & Freddie Mac

8/25/2021 4:00:00 AM

AB 2021-03

<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;"> ADVISORY BULLETIN AB 2021-03:  FRAMEWORK FOR ADVERSELY CLASSIFYING LOANS, OTHER REAL ESTATE OWNED, AND OTHER ASSETS AND LISTING ASSETS FOR SPECIAL MENTION</td></tr></tbody></table> Purpose This Advisory Bulletin (Advisory Bulletin, or guidance) establishes guidelines for adverse and non-adverse classification of assets (assets refer to on-balance sheet or off-balance sheet credit exposures) at Fannie Mae and Freddie Mac (Enterprises) and the Federal Home Loan Banks (FHLBanks) (collectively, the regulated entities).  These guidelines describe sound practices for managing credit risk at the regulated entities.  This guidance does not apply to investment securities.<a href="#footnote1">[1]</a>  This Advisory Bulletin rescinds and replaces Framework for Adversely Classifying Loans, Other Real Estate Owned, and Other Assets and Listing Assets For Special Mention (AB 2012-02), and rescinds Clarification of Implementation for Advisory Bulletin 2012-02, Framework for Adversely Classifying Loans, Other Real Estate Owned, and Other Assets and Listing Assets for Special Mention (AB 2013-02). FHFA examiners will evaluate how the regulated entities apply this guidance to their classification practices. BackgroundThe purpose of this Advisory Bulletin is to establish a standard and uniform methodology for classifying regulated entity assets based on their credit quality, as well as to affirm the basis for writing off loans classified as Loss.  Asset classification is a critical element in evaluating the risk profile of the regulated entities.  Asset classification also provides a mechanism to validate the regulated entity's internal risk identification processes and establishes a common set of classification definitions to serve as the basis for asset quality metrics.  In addition, this Advisory Bulletin describes procedures for listing assets for Special Mention, which can be an effective method to identify and rectify weaknesses in credit management practices before deterioration occurs.  This guidance considers and is generally consistent with the Uniform Retail Credit Classification and Account Management Policy  issued by the Federal Financial Institutions Examination Council (FFIEC) in June 2000, which established specific procedures for the adverse classification of residential mortgage loans and other retail loans. This Advisory Bulletin is intended to be consistent with applicable statutes, regulations, and Generally Accepted Accounting Principles (GAAP).  It does not relieve or diminish the responsibility of a regulated entity's board of directors or management to follow applicable laws, rules, and regulations and to conform to applicable accounting standards, i.e., GAAP.  Any conflicts should be resolved to comply with applicable laws and regulations, and to conform to applicable accounting standards.   Guidance I. DefinitionsThe following definitions apply when considering the adverse classification of assets at the regulated entities. An asset classified Substandard is protected inadequately by the current net worth and paying capacity of the obligor, or by the collateral pledged, if any.  Assets so classified must have a well-defined weakness or weaknesses that jeopardize the liquidation of the debt.  They are characterized by the distinct possibility that the institution will sustain some loss if the deficiencies are not corrected. An asset classified Doubtful has all the weaknesses inherent in one classified Substandard with the added characteristic that the weaknesses make collection or liquidation in full, on the basis of currently existing facts, conditions, and values, highly questionable and improbable. An asset, or portion thereof, classified Loss is considered uncollectible, and of such little value that its continuance on the books is not warranted.  This classification does not mean that the asset has absolutely no recovery or salvage value; rather, it is not practical or desirable to defer writing off an essentially worthless asset (or portion thereof), even though partial recovery may occur in the future. II. Adverse Classification of Assets<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px;"> A. Single-Family Residential Mortgage Loans</blockquote> Single-family residential mortgage loans, including FHLBank Acquired Member Assets (AMA),<a href="#footnote2" style="font-family:"source sans pro", sans-serif;font-size:14px;">[2]</a> consist of first mortgages secured by one-to-four family residential real estate.  Given their size, general homogeneity, and the volume of residential mortgage loans at the Enterprises and the FHLBanks, it may be impractical to individually review specific loans to determine credit quality.  Such loans should be classified using the following guidelines:<ul><li> Single-family residential real estate loans that are delinquent 90 days or more with loan-to-value ratios greater than 60 percent, should be classified Substandard.</li><li> A current assessment of value should be made before a single-family residential mortgage loan with a loan-to-value ratio greater than 60 percent is more than 180 days past due.  Any outstanding loan balance in excess of the sum of (i) current fair value of the collateral, less costs to sell, and (ii) any expected proceeds from non-freestanding<a href="#footnote3" style="font-family:"source sans pro", sans-serif;font-size:14px;">[3]</a> credit enhancements should be classified Loss not later than when the loan is 180 days delinquent.  Properly secured residential real estate loans with loan-to-value ratios equal to or less than 60 percent are generally not classified based solely on delinquency status.</li><li> When a borrower is in bankruptcy, a portion of the loan should be classified as Loss and written down to the fair value of the collateral, less costs to sell, within 60 days of receipt of the notification of filing from the bankruptcy court or within the delinquency time frames specified in this policy, whichever is shorter, unless it can be clearly demonstrated and documented that repayment is likely to occur.  Any loan balance remaining after write-off should be classified Substandard until the borrower demonstrates the ability and willingness to repay for a period of at least six consecutive months.</li><li> Fraudulent loans, if not covered by any existing representations and warranties in the loan purchase agreement, should be classified as Loss and written off within 90 days of discovery of the fraud, or within the delinquency time frames specified in this adverse classification policy, whichever is shorter.</li></ul>Regulated entities should write off the portion of the asset adversely classified as Loss except in certain limited circumstances.<a href="#footnote4">[4]</a>  A write-off should result in the balance of the asset being reduced by the amount of the loss.  The write-off associated with any Loss classification should be taken by the end of the month in which the applicable time period elapses. If the regulated entity can clearly document that the delinquent loan is well-secured and in the process of collection, such that collection will occur regardless of delinquency status, then the loan need not be adversely classified.  A well-secured loan is collateralized by a perfected security interest in real property with an estimated fair value, less costs to sell, sufficient to recover the loan balance.  "In the process of collection" means that either a collection effort or legal action is proceeding and is reasonably expected to result in recovery of the loan balance or restoration of the loan to a current status, generally within the next 90 days.  Other exceptions to this adverse classification policy might be for loans that are supported by valid insurance claims, such as federal loan guarantee programs.In determining a single-family mortgage loan's delinquency status, the regulated entity should use one of two methods to recognize partial payments.  A payment equivalent to 90 percent or more of the contractual payment may be considered a full payment in computing delinquency.  Alternatively, the regulated entity may aggregate payments and give credit for any partial payment received.  For example, if a regular payment is $300 and the borrower makes payments of only $150 per month for a six-month period, the loan would be $900, or three full months delinquent.  A regulated entity may use either or both methods for loans in its portfolio but may not use both methods simultaneously with a single loan. <blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px;"> B. Multifamily Residential Mortgage Loans </blockquote>Multifamily residential mortgage loans consist of first mortgages secured by multifamily (5 units or more) residential real estate.  Multifamily real estate loans should not be adversely classified if they are current and are adequately protected by the underlying collateral value and debt service capacity of the property, or a guarantor with demonstrated ability and willingness to perform on the loan.  The following applies to the adverse classification of multifamily residential mortgage loans.To determine the appropriate adverse classification, examiners will evaluate the prospects that the loan will be repaid in the normal course of business considering all relevant information.  This includes information on the borrower's creditworthiness and payment record, the nature and degree of protection provided by the cash flow and value of the underlying collateral, and any support provided by financially responsible guarantors.  As a general principle, a performing multifamily real estate loan should not automatically be adversely classified or written off solely because the value of the underlying collateral has declined to an amount that is less than the loan balance.  Similarly, loans to sound borrowers that are refinanced or renewed in accordance with prudent underwriting standards and have not been formally restructured due to troubled condition should not be adversely classified unless well-defined weaknesses exist that jeopardize repayment in the normal course of business.  However, it would be appropriate to adversely classify a performing loan when well-defined weaknesses exist that jeopardize repayment – such as the lack of credible support from reliable sources – using the definitions of Substandard, Doubtful, and Loss set forth above. Multifamily loans with well-defined weaknesses that subject the regulated entity to the possibility of loss, even if the loan is not seriously delinquent (90 days or more), should be classified Substandard.  For a multifamily loan where there are no available and reliable sources of repayment other than the sale of the underlying real estate collateral, any portion of the loan balance that exceeds the sum of (i) current fair value of the collateral, less costs to sell, and (ii) any expected proceeds from non-freestanding credit enhancements, should be classified Loss and written off.  The remaining portion of the loan balance that is adequately secured should generally be classified no worse than Substandard.  The amount of the loan balance in excess of the value of the collateral, or portions thereof, should be classified Doubtful, and not Loss, only when the potential for loss may be mitigated by the outcome of certain near-term (generally, within 90 days) pending events.  The Doubtful classification is seldom used and is reserved for situations like those described here. Regulated entities should write off the portion of the asset adversely classified as Loss except in certain limited circumstances.<a href="#footnote5">[5]</a>  A write-off should result in the balance of the asset being reduced by the amount of the loss.  The write-off associated with any Loss classification should be taken by the end of the month in which the applicable time period elapses. When analyzing a formally restructured multifamily loan, the examiner will focus on the borrower's ability to repay the loan in accordance with its modified terms.  Adversely classifying a formally restructured loan would be appropriate, if, after the restructuring, well-defined weaknesses continue to exist that jeopardize the repayment of the loan in accordance with the modified terms. <blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px;"> C. Other Real Estate Owned</blockquote>Other Real Estate Owned (REO) should be evaluated for possible adverse classification of Substandard, Doubtful or Loss.  The regulated entity should make periodic (at least annual) reappraisals of the value of the REO.  In cases when a reliable appraisal is not available, or the appraisal on file is outdated, there are other acceptable methods the regulated entity can use for determining and documenting the value of the REO.  For purposes of classification, any portion of the balance of the REO in excess of fair value, less costs to sell, should be classified Loss.  However, the portion of the held-for-sale REO classified as Loss should not be written off.  Examiners will review all relevant factors in evaluating the regulated entity's adverse classification of the remaining book value of the REO. <blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px;"> D. Other Assets (including Off-Balance Sheet Credit Exposures)</blockquote>Although not specifically enumerated, the regulated entities may have other assets such as accrued interest receivables, property tax and insurance advance receivables, reverse repurchase (repo) receivables, and insurance benefit receivables that warrant adverse classification.  Similarly, off-balance sheet credit exposures such as standby letters of credit and financial guarantees may also warrant adverse classification.  Examiners will review all relevant factors in evaluating the regulated entity's adverse classification of the assets and off-balance sheet credit exposures. <blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px;"> E. FHLBank Advances</blockquote>Advances made by the FHLBanks to their members and housing associates generally pose minimal credit risk.  Advances must be fully secured by eligible collateral and, in the case of member advances, are further secured by the borrowing members' FHLBank capital stock.  In addition, the Federal Home Loan Bank Act grants each FHLBank a priority lien over the liens of other similarly-situated creditors on assets securing member advances.<a href="#footnote6">[6]</a>  However, there may be instances in which collateral adequacy may be uncertain and/or the priority lien may not be relied upon, such as in the case of advances to  housing associates, or where another creditor has a superior lien under applicable law (for example, where the other creditor's lien is perfected, but the FHLBank's lien is not).  In such cases, examiners will evaluate the facts and circumstances to determine whether it is appropriate to adversely classify the advance. III. Non-Adverse Classification of Assets – Special Mention In some instances, it may be appropriate to list an asset for Special Mention.  The following definition should be used for listing an asset for Special Mention: A Special Mention asset has potential weaknesses that deserve management's close attention.  If left uncorrected, these potential weaknesses may result in deterioration of the assets' repayment prospects or may cause deterioration in the regulated entity's credit position at some future date.  Special Mention assets are not adversely classified and do not expose a regulated entity to sufficient risk to warrant adverse classification. Ordinarily, assets listed for Special Mention have deficiencies in the administration of those assets which corrective management action might remedy, for example, weak loan origination and/or weak servicing policies.  While inadequate policies and practices could ultimately result in deterioration of the asset and adverse classification, an asset should not be adversely classified unless it also meets one or more of the adverse classification indicators.  The Special Mention classification serves as an indicator of the quality of the asset portfolio and should be used to provide direction to management on corrective measures that might be taken to strengthen an asset to avoid potential deterioration in the asset's quality. Mortgages held by the regulated entities that are in loss mitigation, or have been modified and are performing according to the terms of the modification, should be listed as Special Mention but not adversely classified.  The loan no longer needs to be listed as Special Mention after performance according to the terms of the modification has occurred for a period of six consecutive months.  If the loan becomes delinquent after modification, adverse classification could apply according to the previously described criteria. The level of adversely classified assets or assets listed for Special Mention is an indicator of the regulated entity's asset quality and overall risk profile, and may indicate whether risk management practices regarding underwriting and loan administration are effective.  At a minimum, management and boards of directors of the regulated entities should evaluate risk management and other asset-specific policies and procedures annually to ensure that appropriate risk controls have been implemented.<a href="#footnote7">[7]</a>  If the level of adversely classified assets suggests deterioration in any asset category, more frequent evaluations of the related policies and procedures are appropriate.  Risk management and other policies will be reviewed by FHFA as part of its supervision program. Related Guidance and Regulations FASB ASC 326-20, Financial Instruments - Credit Losses – Measured at Amortized Cost Uniform Retail Credit Classification and Account Management Policy, FFIEC <div> <a name="footnote1">[1]</a> Investment securities refer to securities subject to the guidance of the Financial Accounting Standards Board (FASB)'s Accounting Standards Codification (ASC), Topic 320, Investments – Debt Securities, and Subtopic 325-40, Investments – Other - Beneficial Interests in Securitized Financial Assets. <a name="footnote2">[2]</a> The AMA regulation (12 CFR part 1268) authorizes FHLBanks to acquire certain assets (principally, conforming residential mortgage loans) from their members and housing associates and prescribes the parameters within which each FHLBank may do so.  <a name="footnote3">[3]</a> Examples of non-freestanding credit enhancements include, but are not limited to, private mortgage insurance, the Federal Housing Administration's (FHA) insurance, the Department of Veteran Affairs' (VA) guarantee, and for the FHLBanks' Acquired Member Assets (AMA) program, the various types of permissible agreements to share credit losses in purchased loans with the selling members. <a name="footnote4">[4]</a> 1) As required to maintain compliance with GAAP.  2) For loans classified as Held For Sale (HFS) and loans which a regulated entity has elected to account for under the Fair Value Option (FVO), no portion classified as Loss would be written off. <a name="footnote5">[5]</a> 1) As required to maintain compliance with  GAAP. 2) For loans classified as Held For Sale (HFS) and loans which a regulated entity has elected to account for under the Fair Value Option (FVO), no portion classified as Loss would be written off. <a name="footnote6">[6] </a>See 12 U.S.C. § 1430(e).  Although this provision grants FHLBank liens priority over those of similarly-situated creditors, it does not grant FHLBank liens priority over those of creditors with liens entitled to priority under otherwise applicable law. <a name="footnote7">[7]</a> See 12 CFR part 1236, Appendix (Prudential Management and Operations Standards).   </div><div> </div><table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;">FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance.  Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance.  Questions about this advisory bulletin should be directed to:  <a href="mailto:SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov</a>. </td></tr></tbody></table>

8/25/2021 2:00:32 PM

Home / Supervision & Regulation / Advisory Bulletins / Framework for Adversely Classifying Loans, Other Real Estate Owned, and Other Assets and Listing Assets for Special

10356

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Agency Commercial Mortgage-Backed Securities Risk Management

35784

FHL Banks

8/16/2021 4:00:00 AM

AB 2021-02

<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;"> ADVISORY BULLETIN AB 2021-02: AGENCY COMMERCIAL MORTGAGE-BACKED SECURITIES RISK MANAGEMENT</td></tr></tbody></table> Purpose This Advisory Bulletin (AB) provides Federal Housing Finance Agency (FHFA) guidance regarding Federal Home Loan Banks' (individually Bank, or collectively Banks) investments in Agency Commercial Mortgage-Backed Securities (CMBS) issued and guaranteed by either the U.S. Government (Ginnie Mae) or by one of the Government-Sponsored Enterprises (Fannie Mae and Freddie Mac, or collectively the Enterprises). The guidance recommends risk management practices, including the establishment of certain limits, to address the risks associated with unexpected prepayments of Agency CMBS investments.  FHFA encourages early adherence to this AB.  However, by December 31, 2021, all Banks should have appropriate Agency CMBS concentration risk limits in place.  Background The Banks have exposures to Agency CMBS within their investment portfolios.<a href="#footnote1">[1]</a>  Agency CMBS include prepayment protection clauses that are not offered on Agency Residential Mortgage-Backed Securities (RMBS).  Prepayment (i.e., call) protection features included on the underlying loans within Agency CMBS are designed to discourage borrower prepayments and protect investors through the payment of fees if voluntary prepayments occur.  The additional prepayment protection offered by Agency CMBS makes these investments attractive alternatives to Agency RMBS.  The loans included in Agency CMBS may include varying call protection features such as lockout periods, yield maintenance, point penalties, and defeasance.  In addition, these loans may have complex structures, including amortization schedules beyond thirty years and floating interest rates.  The variability of call protection features combined with the complexity of loan structures make estimating Agency CMBS prepayments difficult, leaving investors at risk when prepayments occur unexpectedly.  Voluntary prepayments may occur when borrowers determine that the benefits associated with prepayment exceed the cost of any resulting penalties.  For example:  <ul><li>When short term interest rates rise and the interest rate curve flattens, borrowers with floating-rate loans may refinance into fixed-rate products.  </li><li>When interest rates decrease, borrowers with fixed-rate loans may refinance into lower fixed- or floating-rate loans.</li><li>Borrowers with loans secured by properties with significant appreciation may leverage the equity through cash-out refinances or more favorable loan terms and/or rates.</li><li>Certain loans are structured so that the penalties decline over their lives.  Borrowers may be more likely to prepay these loans when they become more seasoned. </li></ul>Additionally, Agency CMBS may include floating-rate loans where borrowers are assessed only partial or no penalties for early prepayments, provided the loans are refinanced with specified loan products.<a href="#footnote2">[2]</a>  When this occurs, Agency CMBS investors receive minimal or no compensation for voluntary prepayments.  Furthermore, involuntary prepayments, or defaults, may occur.  Involuntary prepayments are more likely to occur in periods of economic downturn generally driven by weakened real estate market fundamentals, such as declining property values, rising vacancies, breaches of lender representations and warranties, and possibly rising interest rates for adjustable rate borrowers.  Although Ginnie Mae and the Enterprises guarantee timely principal payments to bondholders upon default, investors do not receive any prepayment fees under these involuntary prepayment scenarios.  In summary, unexpected prepayments may force Banks to reinvest in lower yielding assets, write off any premiums when valued above par, and incur the costs of associated debt overhang and transactions to unwind hedges.  Depending on the nature of Agency CMBS and prepayment, a Bank may receive limited or no penalty fees to cover these costs.  GuidanceAs described above, prepayments on Agency CMBS investments expose Banks to potential losses.  Agency CMBS investments with a relatively high premium to par value increase Banks' exposure to prepayment risk and the resulting losses.  To minimize the risk of losses from Agency CMBS investments, Banks should consider incorporating the following risk management practices into their existing market and model risk management programs. Pre-purchase Analytics Banks should analyze each Agency CMBS prior to purchase.  The analysis should include a careful assessment of the security's structure, including prepayment protection features, price variability, and prepayment history for a comparable benchmark Agency CMBS.  Most importantly, the pre-purchase analysis should include stress scenarios to compare the amount of call protection premiums or fees the Bank will receive versus any loss of income resulting from the reinvestment of the prepayment proceeds under various stressed interest rate scenarios.  In addition, a Bank's pre-purchase analysis should ensure that the security the Bank is considering for purchase conforms to the Bank's investment strategy and is consistent with the Bank's board-approved strategic plans and risk appetite. Minimum Risk-Adjusted Spread RequirementEach Bank should establish a minimum acceptable risk-adjusted spread requirement for Agency CMBS investments.  Banks should consider factors such as their risk appetite when establishing the required minimum.<a href="#footnote3">[3]</a>  Regardless of the approach, Banks should make certain each Agency CMBS purchase meets the established minimum risk-adjusted spread requirement. Concentration LimitsTo limit exposure to both voluntary and involuntary prepayments, Banks should diversify their Agency CMBS investments to prevent concentrations of loans with shared characteristics.  To accomplish this, Banks should establish appropriate limits based on the characteristics of the underlying loans within Agency CMBS investments.  For example, Banks should consider individual loan size limits within a securitization, especially for single loan pool CMBS.  In addition, Banks should consider implementing limits for loans, as a percentage of all Agency CMBS loans, for the following:<ul><li>Floating-rate securities versus fixed-rate securities;</li><li>Geographic location of collateral such as region, state, city, zip code, or Metropolitan Statistical Area (MSA);</li><li>Collateral types – multifamily, student housing, senior living;</li><li>Loan products with minimal or no prepayment penalties under certain conditions of refinance, as available and determined by the Bank at acquisition; and</li><li>Loan originators.</li></ul> Reporting Banks should monitor and report on Agency CMBS investments as a separate investment segment.  A Bank's Asset-Liability Committee (ALCO) and a responsible board committee should receive quarterly reporting on Agency CMBS investments.  At a minimum, quarterly reporting should include the following:<ol><li> Minimum Risk-adjusted Spread – Current minimum acceptable risk-adjusted spread requirement and monthly conformance with this minimum.</li><li> Concentration Limits – Current limits for Agency CMBS loans with specific characteristics and monthly conformance with these limits.</li><li> Earnings - Income or loss associated with Agency CMBS investments.</li><li> Strategy – Any planned changes to the existing funding and hedging strategies for purchases and portfolio rebalancing.</li></ol> Prepayment Projections Currently, Banks use static prepayment assumptions and/or vendor supplied multifamily prepayment models for Agency CMBS valuations.  To support and improve the accuracy of Agency prepayment projections, Banks may use Bank-derived curves or vendor models which meet the principles outlined in FHFA AB 2013-07, and should further consider the following:<ol><li>Developing research-based prepayment curves for fixed- and floating-rate Agency CMBS.  Once developed, Banks should perform periodic reevaluations of the constructed curves by comparing them to appropriate third-party curves (if using static prepayment assumptions). </li><li>Performing prepayment back-testing at appropriate levels to provide meaningful assessments of the Agency CMBS portfolio's performance.</li><li>When relying on a prepayment model, benchmarking the model's performance against third-party prepayment projections as appropriate.  </li><li>Based on portfolio composition, periodically assessing and stress-testing the key drivers of prepayment performance, for example, stressful interest rate levels, yield curve shape changes, and spread widening scenarios. </li><li>Establishing appropriate analytical threshold(s) for prepayment differences ascertained during prepayment back-testing and benchmarking analyses that would trigger investigations into the causes of differences in prepayment behavior and changes to prepayment modeling assumptions.</li></ol>While the above actions will improve upon current prepayment estimations, a Bank may need a vendor-provided prepayment model in concert with a stochastic interest rate model to more accurately estimate the prepayment behavior of Agency CMBS.  Each Bank should carefully evaluate the available modeling alternatives and determine if any single model, or a combination of multiple models, is suitable to meet its Agency CMBS portfolio's analytical needs.  In acquiring the model(s), Banks should make certain that the model's estimation process fully and accurately incorporates the prepayment penalties charged to borrowers and passed on to the investors.  Any mitigating risk factors such as tranche priority in sequential pay structures should be documented.   Related Guidance and Regulations The following provides a summary of some of FHFA's regulation and guidance for governance and investments: <ul><li> Responsibilities of Boards of Directors, Corporate Practices, and Corporate Governance Regulation.  This regulation provides that the management of each regulated entity shall be by or under the direction of its board of directors.<a href="#footnote4">[4]</a>  It states, “while a board of directors may delegate the execution of operational functions to officers and employees of the regulated entity, the ultimate responsibility of each entity's board of directors for that entity's oversight is non-delegable."<a href="#footnote5">[5]</a> Included in the responsibilities of each Bank's board of directors is the establishment of a risk management program that aligns with the Bank's risk appetite and that each of the Bank's business lines has appropriate risk limitations.<a href="#footnote6">[6]</a> </li></ul><ul><li> Prudential Management and Operating Standards (PMOS).  FHFA addresses limits on investments and management of assets in guidelines set out in the appendix to its PMOS regulation, including the following:<a href="#footnote7">[7]</a> </li></ul><ul><ul><li>Standard 3 (Management of Market Risk Exposure) which highlights the expectation that each regulated entity has a clearly defined and well documented strategy for managing market risk and establishes responsibilities for the board and senior management;</li><li>Standard 4 (Management of Market Risk – Measurement Systems, Risk Limits, Stress Testing, and Monitoring and Reporting) includes guidelines for market risk management in these areas;</li><li>Standard 6 (Management of Asset and Investment Portfolio Growth);</li><li>Standard 7 (Investments and Acquisitions of Assets);</li><li>Standard 8 (Overall Risk Management Processes) includes responsibilities for internal audit, the board, and senior management along with an independent risk management function; and</li><li>Standard 9 (Management of Credit and Counterparty Risk).</li></ul></ul>The failure to meet any of the PMOS may constitute an unsafe or unsound practice for purposes of FHFA's administrative enforcement authority<a href="#footnote8">[8]</a>  If FHFA determines that a Bank has failed to meet a standard, it also may require the Bank to submit a corrective plan.<a href="#footnote9">[9]</a> <hr /> <a name="footnote1">[1]</a> The Federal Home Loan Bank Investments regulation permits investments in Agency CMBS.  See 12 CFR part 1267. <a name="footnote2"> [2]</a> For example, Fannie Mae's Structured Adjustable-Rate Mortgages (SARM) allow borrowers to convert their floating-rate loans to one of Fannie Mae's fixed-rate loan programs by paying a one percent premium which is not passed on to investors. <a name="footnote3"> [3]</a> If a Bank cannot use an option-adjusted spread approach to determine the risk-adjusted spread for each Agency CMBS, then the Bank may choose to apply a purchase price premium, duration, or net interest income spread approach.  <a name="footnote4"> [4]</a> 12 CFR § 1239.4. <a name="footnote5">[5]</a> 12 CFR § 1239.4(a). <a name="footnote6"> [6]</a> 12 CFR § 1239.11(a). <a name="footnote7"> [7]</a> 12 CFR part 1236, Appendix. <a name="footnote8">[8]</a> 12 CFR § 1236.3(d).  FHFA has authority to address unsafe or unsound practices through issuance of an order to cease-and-desist, assessment of civil money penalties, or removal from office.  See 12 U.S.C. §§ 4631(a)(1), 4636(b)(2)(A), 4636a(a)(1), 4636a(a)(2)(A). <a name="footnote9" style="text-decoration:underline;">[9]</a> 12 CFR § 1236.4. <table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;">FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities and the Office of Finance. Questions about this advisory bulletin should be directed to <a href="mailto:SupervisionPolicy@fhfa.gov">SupervisionPolicy@fhfa.gov</a>. </td></tr></tbody></table>

8/18/2021 3:44:30 PM

Home / Supervision & Regulation / Advisory Bulletins / Agency Commercial Mortgage-Backed Securities Risk Management Advisory Bulletin FHFA encourages early adherence to this

15395

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Board Diversity Data Collection

33110

FHLB & Office of Finance

3/17/2021 4:00:00 AM

AB 2021-01

3/17/2021 6:00:54 PM

Home / Supervision & Regulation / Advisory Bulletins / Board Diversity Data Collection Advisory Bulletin AB 2021-01: BOARD DIVERSITY DATA COLLECTION The 2020 AB also speaks to

9001

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Financial Reporting and Disclosure and External Audit

28435

All

8/20/2020 4:00:00 AM

AB 2020-04

<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;"> ADVISORY BULLETIN AB 2020-04: FINANCIAL REPORTING AND DISCLOSURE AND EXTERNAL AUDIT</td></tr></tbody></table> PurposeThis Advisory Bulletin (AB) articulates the Federal Housing Finance Agency's (FHFA) supervisory expectations for oversight and management of financial reporting and disclosures and of the external audit function. This AB applies to Fannie Mae and Freddie Mac (the Enterprises), the Federal Home Loan Banks (FHLBanks), and the FHLBanks' Office of Finance (OF) (collectively, the regulated entities) <a href="#footnote1"> [1]</a> and is effective immediately.  This AB rescinds, and along with AB 2016-05 Internal Audit Governance and Function, replaces FHFA's Examination for Accounting Practices guidance.  Transparent financial reporting and disclosures, subject to strong internal control over financial reporting (ICFR) and confirmed by a high-quality external audit, help ensure that published financial information is reliable and free from material misstatements for all stakeholders.    Timely, accurate, complete, and meaningful reporting and disclosures regarding financial condition and performance support FHFA's risk-focused supervision of the regulated entities.  For FHFA as a prudential regulator, such reporting facilitates effective risk assessments, off-site monitoring, and examination planning.  Financial condition and performance metrics for capital adequacy, liquidity, earnings adequacy, and asset quality are based on information in these reports. BackgroundThe Office of Federal Housing Enterprise Oversight (OFHEO) issued the Examination for Accounting Practices guidance to the Enterprises in 2006.  FHFA revised and updated that guidance in 2009 and expanded its application to the FHLBanks.  With the issuance of this financial reporting and external audit guidance and AB 2016-05 Internal Audit Governance and Function, FHFA has updated and revised the 2009 guidance to reflect our regulatory experience and that of other financial regulators, and to more clearly communicate FHFA's supervisory expectations in these areas to the regulated entities. Regarding financial reporting and external audit, the regulated entities are governed by different, yet generally concordant, FHFA and/or Securities and Exchange Commission (SEC) regulations and auditing standards. <a href="#footnote2"> [2]</a>  Notably: <ul><li>The Enterprises are SEC registrants. Their external audits are subject to Public Company Accounting Oversight Board (PCAOB) auditing standards.  Under FHFA regulations, the Enterprises are subject to specified New York Stock Exchange (NYSE) requirements.</li><li>The FHLBanks are SEC registrants.  Their external audits are subject to PCAOB auditing standards and under FHFA regulations, are subject to Generally Accepted Auditing Standards (GAAS) and Generally Accepted Government Auditing Standards (GAGAS). <a href="#footnote3"> [3]</a>  Applicable FHFA rules further detail specific requirements for audit committees regarding external audit and financial reporting oversight.</li><li>The OF is not an SEC registrant.  Under FHFA regulations, FHLBank System combined financial reports are subject to GAAS and GAGAS. <a href="#footnote4"> [4]</a>  The regulations also address oversight of the external auditor for the combined financial reports. <a href="#footnote5"> [5]</a></li></ul>Each Enterprise and FHLBank is covered by FHFA's Prudential Management and Operations Standards (PMOS) and each regulated entity reports financial information in conformance with U.S. Generally Accepted Accounting Principles (GAAP). <a href="#footnote6"> [6]</a>  Enterprise and FHLBank management assess the effectiveness of their respective entity's ICFR based on the criteria in the Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The referenced FHFA, SEC, and NYSE rules and regulations, as applicable, address a wide range of audit committee governance topics including: <ul><li>Committee composition and members' qualifications, including financial literacy and expertise, and independence requirements;</li><li>Committee oversight of the integrity of financial statements and earnings releases and compliance with legal and regulatory requirements;</li><li>Committee charter content and minimum frequency of reviews and re-approval;</li><li>Boards' responsibility to provide the audit committee sufficient funding for payments to the external auditor and to advisors/counsel that the committee retains as it deems necessary to carry out its duties;</li><li>Committee duties and responsibilities regarding external auditor oversight including:</li><ul><li>Responsibility for selecting the auditor, evaluating the auditor's performance, replacing the auditor if needed, and ensuring that the auditor is solely responsible to the committee;</li><li>Ensuring that the external auditor submits a formal written statement regarding relationships and services that may adversely affect independence and discussing any disclosed relationships that may impact objectivity and independence with the external auditor;</li><li>Reviewing the auditor's internal quality control procedures;</li><li>Meeting with, including in executive sessions, auditors and management;</li><li>Reviewing and approving procedures for handling complaints received by the regulated entity regarding accounting, internal accounting controls, or auditing matters; and confidential, anonymous submission by regulated entity staff of concerns regarding questionable accounting or auditing matters; and</li><li>Providing for an annual committee self-evaluation or external review.</li></ul></ul>The guidance in this AB is intended to be consistent with applicable statutes, regulations, GAAP, and auditing standards.  In some instances, substantive elements of guidance herein for all regulated entities may be addressed by FHFA regulation, SEC regulation, or applicable accounting or auditing standards for one or more regulated entities.  This guidance does not relieve or diminish the responsibility of a regulated entity's board of directors or management to follow applicable laws, rules, and regulations and to conform to applicable accounting standards.  Any perceived conflicts should be resolved so as to comply with applicable laws and regulations, and in conformance with accounting standards. Guidance I. Financial Reporting and Disclosure Oversight and ManagementRegulated entities' boards of directors and senior managers are responsible, within their respective roles as described in FHFA's corporate governance regulation and prudential standards, for the institution operating in a safe and sound manner.  Entities should maintain effective accounting and reporting systems and ICFR to produce reliable and accurate financial reports and meaningful disclosures. To address accounting, financial reporting, and disclosure, audit committees should: <ul><li>Review and discuss annual audited financial statements, quarterly SEC filings or equivalent financial statements, and earnings releases;</li><li>Meet regularly with management and external auditors and hold regular executive sessions with the external auditor;</li><li>Oversee that management establishes, implements, and maintains accounting policies and procedures that comply with applicable laws, rules, and regulations and conform to applicable guidance, including GAAP and other relevant reporting and disclosure standards;</li><li>Ensure that the regulated entity has policies in place to notify FHFA of any accounting treatments or policies identified as posing significant legal, reputation, or safety and soundness risk, with a focus on accounting treatments or policies that do not employ GAAP or preferred methods; and</li><li>Direct management to provide the committee with adequate information and reports to carry out its duties and responsibilities and challenge management and auditors where appropriate. </li></ul> A. Assessing Materiality An entity's audit committee should review and clearly understand how management and the external auditor assess financial statement materiality.  For public financial disclosures, FHFA's regulated entities should follow materiality guidelines established by the SEC and other U.S. standard-setters and regulators as appropriate.  FHFA is informed by the SEC's statements regarding materiality and generally considers them as part of its ongoing review of regulated entities' accounting practices and controls. A regulated entity's determination that an accounting matter is material or presents a materiality issue may be a factor in FHFA's oversight of a regulated entity.  An item not being deemed to be “material" or not having “materiality" for financial reporting purposes, however, would not necessarily preclude FHFA from having supervisory concerns about the item.  Further, FHLBanks may be required to provide information that is less than material to their individual financial statements to the OF in order to support FHLBank System combined financial filings.  B. Accounting Policies and Procedures FHFA expects each regulated entity's management, with appropriate audit committee oversight, to establish and maintain: <ul><li>A formal written procedure for developing accounting policies;</li><li>A process for disclosing those policies and the regulated entity's compliance with applicable regulatory requirements and GAAP to the committee;</li><li>Accounting and disclosure policies and procedures that reflect applicable regulatory requirements and GAAP; and</li><li>A complete and current accounting guide that lists all of the regulated entity's accounting policies, including a procedure for documenting the business purpose of all significant types of transactions. </li></ul>Each regulated entity currently submits its accounting guide to FHFA annually, and significant revisions to FHFA quarterly, although the FHFA Chief Accountant may request more frequent submissions.    C. Internal Control over Financial ReportingEach regulated entity is responsible for designing, implementing, monitoring, and maintaining its ICFR. <a href="#footnote7"> [7]</a>   Each regulated entity should ensure that its ICFR system is designed to minimize the risk of a material financial misstatement, whether due to reporting error, fraud, or other external or company-specific risks. FHFA expects regulated entities to develop, implement, and maintain robust business and accounting systems and processes subject to rigorous quality controls to minimize the possibility of material misstatements.  Regulated entities should remediate identified deficiencies timely and should not allow significant control deficiencies to persist.  ICFR review functions <a href="#footnote8"> [8]</a> should be structured to ensure that those persons performing and evaluating testing are appropriately independent of the controls being tested.  Each regulated entity should ensure that it has protocols in place for its employees and vendors to comply with the regulated entity's ICFR-related policies and procedures. Each regulated entity should have a system in place to provide reasonable assurance that accounting and disclosure policies and procedures reflect regulatory and GAAP requirements and should have proper procedures and processes in place to evaluate compliance with those requirements.  The ICFR risk assessment process should include assessing new products and business lines, as well as significant growth, shrinkage, and other changes in existing products and business lines.  This should help ensure that key controls are identified and tested so that potential control deficiencies are identified timely and properly addressed. Each regulated entity's management should ensure, and its audit committee should oversee, that the regulated entity establishes, implements, and maintains effective controls over information reported to FHFA through FHFA's Call Report System and in formal data requests.  D. Regulated Entity Accounting StaffEach regulated entity's management should hire sufficient numbers of technically competent accounting staff and that staff should remain professionally competent and current in professional standards.  Accounting departments should implement and maintain quality control procedures to ensure that they follow accounting policies and procedures.  Further, accounting staff should be charged with reporting any non-compliance with GAAP to appropriate management and/or auditors.  E. Financial StatementsAs SEC registrants, each FHLBank and Enterprise must prepare and timely file with the SEC periodic financial statements and disclosures that comply with applicable SEC regulations.  Each regulated entity also should prepare and timely file financial statements and information as required by FHFA regulations.  FHFA encourages the regulated entities to maximize transparency in their public financial reporting and disclosures, and to establish and implement policies that lead to comparable and consistent accounting and disclosures to the extent practicable. <a href="#footnote9"> [9]</a>FHFA expects each FHLBank and Enterprise to submit to FHFA any financial information, disclosures, or other items it submits to the SEC that are not available to FHFA in public filings.  FHFA also expects each regulated entity to provide additional information about the financial information, disclosures, and other items it submits to the SEC when and in the manner requested by FHFA. F. Non-GAAP Measures in Financial StatementsRegulated entities should consider risks associated with presenting non-GAAP measures in public financial reports, along with their responsibilities to transparently inform stakeholders about the entity's financial condition and results of operations.  If a regulated entity decides to disclose a non-GAAP measure in its periodic filings, that measure should be subject to rigorous internal controls, should not be presented more prominently than similar GAAP measures, and should otherwise conform to applicable regulations.  Any new proposed non-GAAP measure should be discussed with the audit committee, as appropriate, prior to initial publication.  G. Alternate and Preferable GAAP Accounting TreatmentsAt least quarterly, each regulated entity's audit committee should review management's analyses of significant financial reporting issues and accounting judgments made in preparing the entity's financial statements.  To facilitate this review, management should highlight, and the committee should review, significant new or unusual items arising during the financial quarter, and management's anticipated implementation of significant new or revised GAAP.  These reviews should include effects of alternative GAAP methods.  The audit committee should also review and discuss these areas (and others as described in applicable rules, regulations, and guidance) with the external auditor. FHFA believes that it is prudent for the regulated entities' audit committees to assess the costs and benefits of engaging an independent third party to evaluate one or more accounting policy areas at least every two years.  Committees should report their findings to their board of directors and to FHFA.  Such a review may be appropriate for new or revised GAAP guidance and/or for new types of transactions that the regulated entity expects to become material, especially those for which the accounting may involve significant estimates and/or management judgments.   If the audit committee determines that the results of any such assessment warrant a targeted evaluation, it should then consider the appropriate form and scope of the engagement.  Given the potential relevance of such assessments to FHFA's supervisory responsibilities, the regulated entity should structure any targeted evaluation engagement so as to make reports and workpapers available for review by FHFA.  II. External Audit Function OversightRigorous and effective audit committee oversight of external audit functions is critical to secure the benefits of an independent, high-quality audit.  FHFA expects each regulated entity's audit committee to perform this role in accordance with applicable FHFA, SEC, and NYSE requirements.  Further, FHFA expects each audit committee to establish and maintain appropriate charter elements, and well-documented policies where needed, around this oversight role.  Finally, FHFA encourages regulated entities to develop, and audit committees to regularly review and approve for publication, disclosures that provide insight and information to stakeholders about how the committees oversee their external auditors.A. Overseeing the External Audit RelationshipThe concepts in this section should be considered when appointing, retaining, or terminating an external auditor.1. Monitoring PerformanceEach regulated entity's audit committee should perform and document a comprehensive assessment of the external audit firm's performance at least annually.  As part of the review, the committee should request and review input from audit committee members, management, and internal auditors regarding the performance of the external auditors.  The current external auditor's tenure should be considered as a factor in the assessment. FHFA expects each audit committee to identify and consider Audit Quality Indicators (AQIs) to inform dialogue and discussions with the external auditor.  AQIs are qualitative and quantitative performance metrics to help inform stakeholders, including audit committees, about key conditions or attributes that may contribute to audit quality.  AQIs may be defined at both the auditing firm and the audit engagement team levels.  While there is no regulation or auditing standard requiring firms to report or audit committees to use AQIs, larger auditing firms provide firm-level AQIs and/or similar information to their stakeholders. <a href="#footnote10"> [10]</a>  FHFA views identifying and assessing AQIs as a best practice in assessing external auditor performance. The audit committee should consider the external auditor's internal quality control procedures, including the auditing firm's processes for performing quality control reviews, when evaluating the external auditor.  The committee should discuss the auditing firm's internal quality control reviews and external PCAOB inspection results with the external auditors as part of their performance assessment.  The committee should pay particular attention to any deficiencies or non-compliance issues identified by the PCAOB or internal reviews that are relevant to their regulated entity's audit.  To aid in this process, the audit committee should request that the external auditor align any PCAOB inspection deficiencies with potential areas of exposure to the audit of the regulated entity.  The audit committee should have a good understanding of how the audit firm is addressing any identified deficiencies, including remediation plans and timetables.Auditing firm tenure is not explicitly addressed by FHFA or SEC regulations.  Even if an incumbent auditing firm has performed satisfactorily, FHFA considers it prudent for audit committees to periodically consider, and document their consideration of, the potential costs and benefits of changing or retaining their incumbent auditing firms at least every five years, or more frequently if circumstances warrant. <a href="#footnote11"> [11]</a>  2. Monitoring IndependenceExternal auditor independence is necessary for a reliable audit.  Therefore, each regulated entity's audit committee should carefully consider regulatory and professional requirements regarding independence in fact and appearance during all phases of the audit engagement. <a href="#footnote12"> [12]</a>  Independence requirements apply to the external auditing firm, to engagement and concurring partners, and to auditing firm staff and contractors working on the engagement. The audit committee should have a robust process for monitoring and assessing the external auditor's independence, including understanding how the external auditor assesses and monitors independence within the auditing firm. The external auditor's communications to the audit committee regarding independence and the committee's related discussions and decisions regarding the auditor's independence should be appropriately documented.  Arrangements regarding any permissible non-audit services to be provided by the audit firm should be clear and transparent, should not involve contingent compensation other than appropriate arrangements for tax work, and should be pre-approved by the audit committee.  If the committee delegates some of its pre-approval authority to, for example, its Chair, it should subsequently ratify the delegate's approval.  At least annually, the committee should review the nature of all services performed by the external audit firm and assess the relative magnitude of fees and personnel involved.  The committee should then consider establishing safeguards, as needed, to mitigate potential threats to audit independence that may arise as a result of providing these other services.  Further, the audit committee should be informed about and consider business and financial relationships between the auditor and the regulated entity or its officers, directors, or significant shareholders, and about employment of former regulated entity employees by the auditing firm and vice versa, as necessary to identify and address circumstances that could indicate a lack of independence or the appearance thereof.  B. Communication with External Auditor and Audit Engagement LettersEach regulated entity's audit committee and its external auditor should have an open working relationship.  Communications should be frank and robust and should cover the full range of potential topics related to financial reporting and audit risks.  Significant discussions during scheduled audit committee meetings should be clearly documented in committee minutes.  Other relevant substantive discussions should be appropriately documented in audit committee packages or minutes.  Audit committees can promote effective communications by: <ul><li>Maintaining a direct line of communication with the external auditor, including periodic, informal contact by the committee chair and regular executive sessions;</li><li>Requesting periodic involvement of other external audit partners, such as concurring, review, and tax partners at the audit committee meetings; </li><li>Discussing the external auditor's audit risk assessment and audit plan for the regulated entity;</li><li>Discussing with the auditor (and management, as applicable) any new, unusual, or non-standard representations made by management in their management representations letter; and</li><li>Requesting and reviewing insights from audit committee members, management, and internal auditors regarding the performance of the external auditors, at least annually. </li></ul>It is also important for the audit committee to have ongoing communication with the external auditor regarding its audit fees.  One objective of those communications is to provide assurance to the audit committee that negotiations for the fees and the fee arrangements themselves encourage the external auditor to conduct rigorous, high-quality audits and reviews. The engagement letter is the key document defining the relationship between the regulated entity and its external auditor.  FHFA's authority to examine the regulated entities allows it to have access to all regulated entity documents, including accounting records.  FHFA expects regulated entities' external audit engagement letters to be consistent with FHFA's examination authority.  Accordingly, FHFA expects that each regulated entity's engagement letter should: <ul><li>Provide that the external auditor may, upon FHFA's request, provide FHFA with access to the senior audit partners on the engagement and any other personnel whom such partners deem necessary, as well as to the external auditor's working papers prepared in the course of performing the services set forth in the engagement letter, and that such access to the external auditor may be without regulated entity personnel in attendance;</li><li>Not contain any provisions that would be characterized as unsafe and unsound under the “Interagency Advisory on the Unsafe and Unsound Use of Limitation of Liability Provisions in External Audit Engagement Letters";<a href="#footnote13">[13]</a> and</li><li>Provide that the external auditor, without the approval of the regulated entity, may meet with FHFA with such frequency and about such matters as determined by FHFA, and may provide reports or other communications arising from the audit engagement directly to FHFA.</li></ul> C. Audit Committee TransparencyFHFA regulations and guidelines require that the audit committees for the regulated entities review their charters annually and that the boards of directors reapprove them at least every three years. <a href="#footnote14"> [14]</a>   FHFA's regulated entities regularly publish their audit committee charters.  Besides serving as the committee's roadmap to help ensure that it fulfills all of its duties and obligations, a well-drafted charter can provide outside readers with insights on the committee's governance and functions. Under the PCAOB standards, auditor tenure is now a required element of the independent auditor's report.  Also, critical audit matters—which are matters that have been communicated to the audit committee, are related to accounts or disclosures that are material to the financial statements, and involved especially challenging, subjective, or complex auditor judgment—must be reported by the auditor beginning in the next few years. <a href="#footnote15"> [15]</a>  While this reporting is the responsibility of public companies' external auditors, we believe that these requirements evidence increased demand by financial statement users for information on audits and audit governance.  While effective audit committee oversight of and engagement with the external auditor are keys to obtaining a high-quality audit, there are no formal rules or standards that require those topics to be reported to shareholders.  That said, industry studies confirm an increasing trend among public companies to make enhanced voluntary disclosures about their audit committees' oversight of the external audit function.  Examples include disclosures about the factors that the audit committee considers when appointing or retaining an external auditor, the role of the audit committee in fee negotiations and compensation, the length of time the auditor has been engaged, whether evaluations of the auditing firm are done annually, and audit partner selection and rotation. <a href="#footnote16"> [16]</a> FHFA encourages each regulated entity's audit committee to consider providing such voluntary disclosures regarding its role in supporting a quality audit.  The audit committee should remain aware of industry trends and developments regarding audit committee transparency and should work to provide the regulated entity's stakeholders with relevant information regarding their activities to the extent practicable.  III. Annual Review by Audit CommitteeAt least annually, each regulated entity's audit committee should review, with any appropriate professional assistance, the committee's performance in light of the requirements of laws, rules, and regulations that are applicable to its activities and duties.  The committee should also assess whether it is operating consistent with applicable regulatory guidance.  The audit committee should provide the FHFA Chief Accountant with the materials and procedures employed in such review, as well as the final report.  The review may be done as part of a committee self-assessment, an outside review, or a combination of approaches.  Related Regulations and Guidance12 CFR Part 1236 and Appendix – Prudential Management and Operations Standards 12 CFR Part 1239 – Responsibilities of Boards of Directors, Corporate Practices and Corporate Governance Matters 12 CFR Part 1273 – Office of Finance 12 CFR Part 1274 – Financial Statements of the Banks Securities and Exchange Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934, 72 Fed. Reg. 35324 (June 27, 2007) (codified at 17 CFR Part 241)Securities and Exchange Commission Rule 10A-3: Listing Standards Relating to Audit Committees (National Securities Exchanges), 17 CFR § 240.10A-3Securities and Exchange Commission Rule Reg. S-X: Form and Content of and Requirements for Financial Statements, Securities Act of 1933, Securities Exchange Act of 1934, Investment Company Act of 1940, Investment Advisers Act of 1940, and Energy Policy and Conservation Act of 1975 (Qualifications and Reports of Accountants), 17 CFR § 210.2-01 through -07Securities and Exchange Commission Rule Reg. S-K: Standard Instructions for Filing Forms under Securities Act of 1933, Securities Exchange Act of 1934 and Energy Policy and Conservation Act of 1975, 17 CFR Part 229Public Company Accounting Oversight Board Rule 3526: Auditor Communications with Audit Committees Concerning IndependenceNYSE, Inc., Listed Company Manual, § 303A (Corporate Governance Standards) (2018)  <hr width="25%" align="left" /> <a name="footnote1">[1]</a> The OF is not a “regulated entity" as the term is defined by 12 U.S.C. 4502(20), but for convenience, references to the “regulated entities" in this AB should be read to also apply to the OF as regards its roles in issuing combined financial reports and engaging the external auditor for those reports, and to regulated entities' affiliates as regards their roles, if any, in issuing public financial reports and in engaging external auditors. <a name="footnote2">[2]</a> Duties of FHLBank audit committees are described in 12 CFR 1239.32. Duties of the OF audit committee are described in 12 CFR 1273.9. Part 1239 stipulates that the duties and responsibilities of Enterprise audit committees are set forth under rules issued by the New York Stock Exchange, and further requires that those committees comply with requirements set forth under section 301 of the Sarbanes-Oxley Act, 15 U.S.C.§ 78j-1(f). The Prudential Management and Operations Standards set forth in the Appendix to 12 CFR Part 1236 also include standards applicable to the audit committees of the FHLBanks and Enterprises. <a name="footnote3"> [3]</a> See 12 CFR 1274.2(c). <a name="footnote4"> [4]</a> See 12 CFR 1274.2(c). <a name="footnote5"> [5]</a> See 12 CFR 1274.2(d), (e). <a name="footnote6"> [6]</a> See 12 CFR Part 1236, Appendix (Standard 10.1) and 12 CFR 1273.6(b) (2). <a name="footnote7"> [7]</a> SEC Exchange Act Rule 13a-15(f) defines the term “internal control over financial reporting" as: a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:<ol><li>Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer;</li><li>Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer; and</li><li>Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuer's assets that could have a material effect on the financial statements.</li></ol> See 17 CFR 240.13a-15(f). <a name="footnote8"> [8]</a> For the OF, this refers to the ICFR over the OF's process for producing the FHLBanks' combined financial reports.  <a name="footnote9"> [9]</a> On comparability and consistency, see FASB Statement of Financial Accounting Concepts No. 8 as amended August 2018. <a name="footnote10"> [10]</a> See Center for Audit Quality, “Audit Quality Indicators:  The Journey and Path Ahead," Jan. 12, 2016. <a name="footnote11"> [11]</a> The FHLBanks and the OF, in light of the FHLBank System's requirement to issue combined financial statements, have historically engaged the same external audit firm.  Therefore, they undertake external auditor performance reviews and decisions on which audit firm to engage jointly. <a name="footnote12"> [12]</a> The external auditor must meet the requirements of independence set forth by the PCAOB Auditing Standard 1005 and in the SEC regulations at 17 CFR § 210.2-01.  <a name="footnote13"> [13]</a> 71 Fed. Reg. 6847 (Feb. 9, 2006). <a name="footnote14"> [14]</a> See 12 CFR Part 1236, Appendix (Prudential Management and Operations Standard 2.2) (regulated entity boards); 12 CFR 1239.32(d) (1), (2) (Bank audit committees and boards of directors); 12 CFR 1273.9(c) (1) (i), (ii) (Office of Finance). Enterprise boards of directors must adopt a written charter for each board committee and comply with the committee requirements of the NYSE rules and section 301 of the Sarbanes-Oxley Act, 15 U.S.C. § 78j-1. See 12 CFR 1239.5(b). Neither those incorporated provisions nor the regulation itself imposes any requirements with respect to the review or re-approval of committee charters. <a name="footnote15"> [15]</a> See PCAOB Auditing Standard 3101. <a name="footnote16"> [16]</a> See 2018 Audit Committee Transparency Barometer prepared by the Center for Audit Quality and by Audit Analytics (November 2018).   <table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;">FHFA has statutory responsibility to ensure the safe and sound operations of the regulated entities and the Office of Finance. Advisory bulletins describe FHFA supervisory expectations for safe and sound operations in particular areas and are used in FHFA examinations of the regulated entities. Questions about this advisory bulletin should be directed to <a href="mailto:SupervisionPolicy@FHFA.gov">SupervisionPolicy@FHFA.gov</a>. </td></tr></tbody></table>

8/20/2020 5:00:54 PM

Home / Supervision & Regulation / Advisory Bulletins / Financial Reporting and Disclosure and External Audit Advisory Bulletin AB 2020-04: FINANCIAL REPORTING AND DISCLOSURE

12280

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Guidance on the Use of Proxies

28094

FHL Banks

7/20/2020 4:00:00 AM

AB 2020-03

<table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;"> ADVISORY BULLETIN AB 2020-03: GUIDANCE ON THE USE OF PROXIES FOR DETERMINING THE INCOME OF SUBSEQUENT PURCHASERS OF OWNER-OCCUPIED UNITS SOLD BY AHP-ASSISTED HOUSEHOLDS DURING THE AHP RETENTION PERIOD </td></tr></tbody></table> PurposeThis Advisory Bulletin (AB) contains guidance, pursuant to the Affordable Housing Program (AHP) regulation, on the Federal Home Loan Banks’ (FHLBanks) or their designees’ use of proxies for determining whether the subsequent purchaser of an owner-occupied unit sold, transferred, or assigned by an AHP-assisted household during the AHP five-year retention period is low- or moderate-income (LMI). Specifically, the guidance provides for the use of a proxy based on the U.S. Department of Housing and Urban Development’s (HUD) HOME Investment Partnerships Program (HOME) and Housing Trust Fund (HTF) homeownership value limits for existing housing. The AB also discusses the option for FHLBanks to adopt an alternative proxy or proxies that are reliable indicators that the subsequent purchaser is LMI. In addition, the AB provides guidance on documentation requirements as well as content of a FHLBank’s AHP Implementation Plan. BackgroundThe Federal Housing Finance Agency’s (FHFA) AHP regulation provides that, for each household that receives AHP subsidy for purchase, for purchase in conjunction with rehabilitation, or for construction of an owner-occupied unit, the unit must be subject to a retention agreement. <a href="#footnote1">[1]</a> The retention agreement must provide that, if the AHP-assisted household sells, transfers, or assigns (hereafter referred to as "sells," for ease of reading) the unit within five years of closing on the unit, the FHLBank is to be repaid a pro rata portion of the AHP subsidy from any net proceeds realized by the household minus the household’s investment, subject to certain exceptions. <a href="#footnote2">[2]</a> One such exception is when the AHP-assisted household sells the unit to a LMI household, i.e., a household with income at or below 80 percent of the area median income (AMI). <a href="#footnote3">[3]</a> This exception predates the 2018 AHP final rule. <a href="#footnote4">[4]</a> Because subsequent purchasers of units sold by AHP-assisted households are under no obligation to provide income documentation to the FHLBanks or their designees for purposes of determining the AHP-assisted household’s AHP subsidy repayment obligation, it has been difficult for FHLBanks and their designees to determine subsequent purchasers’ actual incomes and, therefore, whether this subsidy repayment exception applies. Accordingly, FHFA requested comments in the 2018 AHP proposed rule preamble on potential geographically-based and person-based proxy approaches for determining subsequent purchaser income. After reviewing the comments received on the proposed rule, FHFA determined in the 2018 AHP final rule that the use of proxies for determining subsequent purchaser income would facilitate the FHLBanks’ implementation of the LMI subsequent purchaser exception.<a href="#footnote5"> [5]</a> Accordingly, the final rule revised the regulation to provide for the use of proxies pursuant to guidance to be issued by FHFA for determining a subsequent purchaser’s income. Specifically, the final rule provides that for any sale by an AHP-assisted household of an owner-occupied unit after a date established by FHFA in the guidance, a FHLBank or its designee must determine the subsequent purchaser’s income using one or more proxies that are reliable indicators of the subsequent purchaser’s income, which may be selected by the FHLBank pursuant to the guidance, unless documentation demonstrating the subsequent purchaser’s actual income is available.<a href="#footnote6"> [6]</a> This AB contains the guidance referenced in the final rule on the use of proxies for this purpose. Guidance The Proxy: HUD HOME and HTF Homeownership Value Limits for Existing Housing FHFA has determined that the sale of an owner-occupied unit by an AHP-assisted household at a price that is at or below the applicable HUD HOME and HTF homeownership value limit for existing housing (hereinafter "value limit") is a reliable indicator that the subsequent purchaser of the unit is LMI.<a href="#footnote7"> [7]</a> In reaching this conclusion, FHFA analyzed Home Mortgage Disclosure Act (HMDA) data which indicates that, in 2018, approximately 58 percent of national HMDA-reported home sales at or below the applicable value limit were to LMI purchasers. Significantly, in the ten states in which the greatest number of AHP owner-occupied subsidies under the FHLBanks’ competitive application programs and homeownership set-aside programs were awarded in 2018, over 65 percent of such sales were to LMI purchasers. FHFA also analyzed the 2018 HMDA income data to determine the percentage of homebuyers who purchased a home above the applicable value limit that were LMI. FHFA found that only 14.6 percent of 2018 HMDA homebuyers who purchased a home above the applicable value limit were LMI, making it relatively unlikely that applying the HOME and HTF price limits as a proxy would be under-inclusive of low-and-moderate income subsequent purchasers. Because proxies are approximations, no proxy can definitively determine the income of a subsequent purchaser. FHFA acknowledges this limitation of proxies generally, and the possibility that any proxy based on house sales price might fail to fully account for gentrification of areas in which the home is located, as noted by some commenters on the proposed rule. In rapidly gentrifying areas, a comparatively higher percentage of non-LMI purchasers may purchase homes at or below the value limit than in areas experiencing lower rates of gentrification. However, as noted above, the data generally suggest that house sales price at or below the applicable value limit reliably indicates that the subsequent purchaser is LMI. This proxy indicates subsequent purchaser LMI status even more reliably when the review analyzes the ten states with the highest number of AHP owner-occupied subsidies historically. In addition, although FHFA’s priority in selecting a proxy is identifying one that reliably indicates subsequent purchaser income, FHFA has selected one that, as applied to AHP-assisted households, weighs in favor of allowing households to retain AHP subsidy and thereby enjoy the full benefits of homeownership. FHFA analyzed data available under the FHLBanks’ homeownership set-aside programs to determine the likelihood that any particular AHP-assisted household would be required to repay AHP subsidy under the value limits proxy. In 2018, only 7.7 percent of AHP-assisted households who received set-aside grants in connection with purchase purchased their homes at a price greater than the applicable value limit, which suggests that the large majority of home sales by AHP-assisted households will qualify for the LMI subsequent purchaser exception under this proxy. <a href="#footnote8">[8]</a> Implementing the ProxyThe FHLBanks or their designees may use the value limits, posted on the HUD Exchange, as a proxy for determining whether the exception to the AHP subsidy repayment requirement for sales to subsequent LMI purchasers applies. HUD calculates and posts the value limits annually on the HUD Exchange website. FHFA will also post the value limits on its website and notify the FHLBanks when new annual value limits are available. However, if a FHLBank or its designee has documentation demonstrating the subsequent purchaser’s actual income, the FHLBank may not apply the value limits proxy or any other proxy to determine subsequent purchaser income. If neither the FHLBank nor its designee has such documentation, and the FHLBank elects to apply the value limits proxy, the FHLBank or its designee must use the value limits in effect at the time the AHP-assisted household sells its unit during the AHP five-year retention period. The FHLBank or its designee will determine the applicable value limit based on the specific county where the unit is located and the size of the unit (i.e., 1-unit, 2-unit, 3-unit, or 4-unit). The FHLBank or its designee will then compare the price at which the AHP-assisted household sold the unit to that value limit. If the sales price is less than or equal to the value limit, the subsequent purchaser is regarded as LMI under the value limits proxy. If the sales price is more than the applicable value limit, the subsequent purchaser is not regarded as LMI under the value limits proxy. The FHLBank or its designee must document its determinations under the value limits proxy.Alternative Bank ProxiesIn lieu of or in addition to the value limits proxy, a FHLBank may, in its discretion, adopt an alternative proxy or proxies that are reliable indicators that the subsequent purchaser of an owner-occupied unit sold by an AHP-assisted household is LMI. The FHLBank should retain documentation and data that provide a sufficient basis for the adoption of the alternative proxy or proxies, including an explanation of how the proxy or proxies reliably indicate(s) that the subsequent purchaser is LMI. In addition, as with application of the value limits proxy, the FHLBank should document its determinations under an alternative proxy for each subsequent purchaser’s income. AHP Implementation PlansThe FHLBanks must ensure that their AHP Implementation Plans include the specific proxy or proxies they have chosen to adopt pursuant to this AB. <a href="#footnote9">[9]</a> If a FHLBank adopts more than one proxy, its AHP Implementation Plan must include the policies determining which proxy or set of proxies will be applied in any particular circumstance. If these policies provide for the application of more than one proxy per sale, they must specify how conflicting determinations of subsequent purchaser LMI income will be resolved. <a href="#footnote10">[10]</a> Effective DateThis AB is effective for any sale of an owner-occupied unit by an AHP-assisted household that occurs on or after January 1, 2021 and is during the unit’s AHP five-year retention period. However, FHFA strongly encourages the FHLBanks to implement this AB before that date as practicable.  <hr width="25%" align="left" /> <a name="footnote1"> [1]</a> 12 CFR 1291.23(d)(1); 1291.42(e); 1291.15(a)(7); see also Questions and Answers on the November 28, 2018 Final Rule--Part I (July 2019), available at fhfa.gov. <a name="footnote2"> [2]</a> 12 CFR 1291.15(a)(7)(v); 1291.1 (par. (1) of the definition of "retention period"). <a name="footnote3"> [3]</a> 12 CFR 1291.15(a)(7)(ii)(B); 1291.1 (definition of "low- or moderate-income household").  <a name="footnote4">[4]</a> 12 CFR 1291.9(a)(7)(ii)(B) (Jan. 1, 2018 edition). <a name="footnote5"> [5]</a> 83 Fed. Reg. 61186, 61204 (Nov. 28, 2018). <a name="footnote6">[6]</a> 12 CFR 1291.15(a)(7)(ii)(B). <a name="footnote7"> [7]</a> For more information on these value limits, how they are derived, and their function in the applicable HUD programs, see the HOME and HTF program pages on the HUD Exchange website at www.hudexchange.info. <a name="footnote8"> [8]</a> FHFA does not collect the prices at which competitive application program subsidy recipients purchase or sell their homes. FHFA also does not collect the prices at which homeownership set-aside program subsidy recipients purchase their homes, unless the subsidy is used in connection with purchase (e.g., down payment assistance). In 2018, 68 percent of all AHP owner-occupied subsidies were awarded through set-aside programs, and 92 percent of set-aside subsidies were used in connection with purchase. <a name="footnote9"> [9]</a> 12 CFR 1291.15(a)(7)(ii)(B). <a name="footnote10"> [10]</a> 12 CFR 1291.13(b)(6).            <table width="100%" class="ms-rteTable-default" cellspacing="0"><tbody><tr><td class="ms-rteTable-default" style="width:100%;">FHFA has statutory responsibility to ensure that the regulated entities carry out their missions consistently with the provisions and purposes of FHFA's statute and the regulated entities' authorizing statutes. Advisory Bulletins describe supervisory expectations in particular areas and are used in FHFA examinations of the regulated entities. For comments or questions pertaining to this Advisory Bulletin, contact Ted Wartell at <a href="mailto:Ted.Wartell@fhfa.gov">Ted.Wartell@fhfa.gov</a> or by phone at 1-202-649-3157; or Tiffani Moore at <a href="mailto:Tiffani.Moore@fhfa.gov">Tiffani.Moore@fhfa.gov</a> or by phone at 1-202-649-3304. </td></tr></tbody></table>

7/20/2020 8:58:52 PM

Home / Supervision & Regulation / Advisory Bulletins / Guidance on the Use of Proxies Advisory Bulletin AB 2020-03: GUIDANCE ON THE USE OF PROXIES FOR DETERMINING THE INCOME

9018

https://www.fhfa.gov/SupervisionRegulation/AdvisoryBulletins/Pages/Forms/AllItems.aspx

html

False

aspx

Get Started Here:

Performance and
Accountability Report

FHFA Values

Annual Report to Congress

We Want to Hear From You

Conservatorship of Fannie Mae
and Freddie Mac

Conservatorship
Performance Goals

Downloadable Data
& Data Reports

House Price Index Release Dates

Advisory Bulletins

Advisory Bulletins

Want to Subscribe?

Get Started Here:

Performance and Accountability Report

FHFA Values​

Annual Report to Congress

We Want to Hear From You

Conservatorship of Fannie Mae and Freddie Mac​​

Conservatorship ​Performance Goals​

Downloadable Data ​& Data Reports​​

House Price Index Rele​ase Dates​​​

Advisory Bulletins

Advisory Bulletins

Want to Subscribe?

Performance and
Accountability Report

FHFA Values

Conservatorship of Fannie Mae
and Freddie Mac

Conservatorship
Performance Goals

Downloadable Data
& Data Reports

House Price Index Release Dates