E6-18034. Record Retention

AGENCY:

Office of Federal Housing Enterprise Oversight, HUD.

ACTION:

Final regulation.

SUMMARY:

The Office of Federal Housing Enterprise Oversight (OFHEO) is issuing a final regulation that sets forth record retention requirements with respect to the record management programs of the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation consistent with the safety and soundness responsibilities of OFHEO under the Federal Housing Enterprises Financial Safety and Soundness Act of 1992.

DATES:

The effective date of this regulation is October 27, 2006.

FOR FURTHER INFORMATION CONTACT:

Tina Dion, Associate General Counsel, telephone [phone] (not a toll-free number); Office of Federal Housing Enterprise Oversight, Fourth Floor, 1700 G Street, NW., Washington, DC 20552. The telephone number for the Telecommunications Device for the Deaf is [phone].

SUPPLEMENTARY INFORMATION:

I. Background

A. Introduction

Title XIII of the Housing and Community Development Act of 1992, Public Law 102-550, titled the “Federal Housing Enterprises Financial Safety and Soundness Act of 1992” (Act) (12 U.S.C. 4501 et seq.), established OFHEO as an independent office within the Department of Housing and Urban Development. OFHEO is statutorily mandated to ensure that the Federal National Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac) (collectively, the Enterprises) are capitalized adequately and operate in a safe and sound manner and in compliance with applicable laws, rules, and regulations.

The Act provides that the Director of OFHEO (the Director) is authorized to make such determinations, take such actions, and perform such functions as the Director determines are necessary regarding his supervisory authorities, which include examinations of the Enterprises.^[1] Under the Act, the Director is authorized to conduct on-site examinations of the Enterprises each year, and any other examinations that the Director determines are necessary to ensure their safety and soundness.^[2]

B. Record Retention and Safe and Sound Operations

OFHEO recognizes that the effectiveness of the examination process is dependent upon the prompt production of complete and accurate records. OFHEO, through the supervisory process, must have access to the records of an Enterprise that are necessary to determine the financial condition of the Enterprise or the details or the purpose of any transaction that may have a material effect on the financial condition of the Enterprise.^[3]

Retention of such records not only facilitates the examination process, but also allows an Enterprise to manage more effectively its business and detect improper behavior that might cause financial damage to the corporation. Additionally, such records serve as documentation for an Enterprise in any controversy over its business activities or transactions.

The importance of sound record retention policies and procedures by regulated institutions also has been recognized by Congress and other federal regulators. Adequate record retention by the institutions has been determined to have a high degree of usefulness in criminal, tax, and regulatory investigations or proceedings, and has been identified as a requisite component of an institution's operation and management on a safety and soundness basis.^[4]

In addition to facilitating the oversight and enforcement of federal banking laws, adequate record retention has been recognized by Congress as being essential to the oversight and enforcement of the federal securities laws. For example, as mandated by section 802 of the Sarbanes-Oxley Act,^[5] the U.S. Securities and Exchange Commission adopted rules requiring accounting firms to retain for seven years certain records relevant to their audits and reviews of issuers' financial statements. Records to be retained include an accounting firm's workpapers and certain other documents that contain conclusions, opinions, analyses, or financial data related to the audit or review.^[6]

Record Retention Regulation

On June 1, 2006, OFHEO published for comment a proposed regulation, at 71 FR 31121, which sets forth proposed safety and soundness requirements with respect to the Enterprises' record retention programs. The 60-day comment period ended on July 31, 2006. All comments received have been made available to the public in the OFHEO Public Reading Room and have been posted on the OFHEO Web site at http://www.OFHEO.gov.

II. Comments Received

Comments were received from Freddie Mac and Fannie Mae. Both Enterprises commented in support of the general approach under the proposed regulation. Each Enterprise also provided comments, many of which were technical in nature, on specific provisions of the proposal. All comments were taken into consideration. A discussion of the comments as they related to the proposed sections of the regulation follows.

A. § 1732.1 Purpose and Scope

Proposed § 1732.1 states that the purpose of the regulation is to set forth minimum requirements in connection with the record retention program of each Enterprise, and that the requirements are intended to ensure that complete and accurate records of an Enterprise are readily accessible by OFHEO for examination and other supervisory purposes.

Both Enterprises made technical comments regarding § 1732.1 with respect to the requirement to provide OFHEO with ready access to records. The Enterprises noted the dynamic nature of records management and the evolving nature of information technology. Freddie Mac commented that the methods of accessing hard copies of documents in off-site storage, electronic documents resident on a Local Area Network, and information in legacy databases, active databases, e-mail, and voicemail are quite different. Freddie Mac also noted that the level of management controls and ready access to records is not the same for records created and maintained years ago as that of records created and maintained today. Moreover, Freddie Mac commented that many of the records are subject to specific legal rights of the Enterprise or of individuals that cannot be disregarded. For these reasons, both Enterprises requested clarification that access to their records under the regulation is intended to mean “reasonable” access.

OFHEO understands that all records are not equally accessible. For purposes of clarification, OFHEO has added language to § 1732.1, as well as §§ 1732.6(a)(2)(iii) and 1732.7(d), which clarifies that the sections' accessibility requirements are intended to be by reasonable means, consistent with the nature and availability of the records and existing information technology.

B. § 1732.2 Definitions

Active Record

As proposed, the term “active record” would be defined under § 1732.2(b) to mean a document that is necessary to conduct the current business of an office or business unit of an Enterprise and, therefore, is readily available for consultation and reference.

The Enterprises made technical comments on this definition, as well as the definitions for the terms “inactive record” and “vital records,” requesting that the terms be amended by substituting the word “record” or “records” for “document” or documents,” as appropriate. Each Enterprise stated that such amendments would more fully incorporate what is intended by the proposal, i.e., its definition of “record,” and would be consistent with best practices.^[7]

OFHEO agrees with the recommended technical changes and has revised the definitions in § 1732.2(b), (h), and (m) accordingly in the final regulation.

Employee

As proposed, the definition of the term “employee” would be defined in § 1732.2(e) to mean any officer or employee of an Enterprise, any conservator appointed by OFHEO, or any agent or independent contractor acting on behalf of an Enterprise. Both Enterprises commented that including independent contractors and agents in the definition was significant because such individuals would be subject to several provisions of the proposed regulations, i.e., the training requirements under § 1732.6(b); the record hold notifications under § 1732.7(b); the reporting requirements of potential investigations under § 1732.7(b)(3), and the definition of “record” under § 1732.2(j)(3).

Fannie Mae stated that extending the regulation's general reach in this way would create obligations with regard to parties and documents beyond an Enterprise's control, would generate considerable burden and expense for the Enterprise without yielding commensurate gains with respect to improved operations or supervision, and would increase litigation risk by exposing the Enterprise to potential liability for the actions (or non-actions) of third parties or individuals outside the Enterprise's control.

Both Enterprises requested that OFHEO not include agents and independent contractors within the general definition of the term “employee.” Rather, they recommended that, to the extent that any section of the regulation is intended to apply to agents or independent contractors, OFHEO amend the section to include specific language making it apply to agents or independent contractors, tailored to what would be appropriate under the circumstances.

In response to the comments, OFHEO has deleted the phrase “or any agent or independent contractor acting on behalf of an Enterprise” from § 1732.2(e), and has added specific language for coverage of agents or independent contractors as appropriate in other sections of the final regulation, as noted below.

Inactive Record

As proposed, the term “inactive record” would be defined in § 1732.2(h) to mean a document that is seldom used but must be retained by an Enterprise for legislative, fiscal, legal, archival, historical, or vital records purposes.

In its technical comment, Fannie Mae requested that the words “legislative” and “archival” be deleted from the definition. Fannie Mae stated that the words do not appear to add anything substantive to the other qualifying terms, and that the proposal provides no elaboration as to what these words are intended to capture that is not otherwise covered. Fannie Mae noted that, as an industry practice, records generally are defined for record retention purposes as having operational, vital record, legal or regulatory, fiscal, and historical value.

OFHEO concurs with Fannie Mae's technical comment and has revised the definition of “inactive record” accordingly in the final regulation. Also, as noted above, the word “record” has been substituted for the word “document.”

Record

As proposed, the definition of the term “record” in § 1732.2(j) would mean: Any document whether generated internally or received from outside sources by an Enterprise or employee in connection with Enterprise business, regardless of the following: (1) Form or format, including hard copy documents (e.g., files, logs, and reports) and electronic documents (e.g., e-mail, databases, spreadsheets, PowerPoint presentations, electronic reporting systems, electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), and voicemail records; (2) where the document is stored or located, including network servers, desktop or laptop computers and handheld computers, other wireless devices with text messaging capabilities, and on-site or off-site at a storage facility; (3) whether the document is maintained or used on Enterprise-owned equipment, or personal or home computer systems of an employee; or (4) whether the document is active or inactive.

Fannie Mae recommended that the proposed regulation use the definition of the term “record” provided in Internal Organization for Standards, ISO 15849-1 § 3.15. That standard provides that a record “is information created, received, and maintained as evidence and information by an organization or person, in the pursuance of legal obligations or in the transaction of business.” Freddie Mac, also referencing industry standards, requested that the word “information” be used in the definition, rather than “document.” Freddie Mac requested another technical change that would modify the definition by inserting the term “maintained” between the word “employee” and the phrase “in connection with.” Both Enterprises explained that the recommended revisions better reflect the corporate practices and supervisory concerns.

OFHEO agrees with the technical changes recommended by Freddie Mac and has revised the definition of the term “record” in § 1732.2(j) to read “any information whether generated internally or received from outside sources or employee maintained in connection with Enterprise business * * *” Conforming changes have also been made to subsections (2), (3), and (4) accordingly.

OFHEO does not agree to make use of the entire ISO definition for the definition of the term “records,” as recommended by Fannie Mae, because other elements of the ISO definition are encompassed in § 1732.2 under the definition of the terms “active record” and “vital records.” In addition, the language of the definition in § 1732.2(j), namely “whether generated internally or received from outside sources” is necessary to ensure that records are appropriately retained even if they have not been generated or created by the Enterprise.

Record Retention Schedule

As proposed, the definition of the term “record retention schedule” would be defined in § 1732.2(k) to mean “a form that details the categories of records an Enterprise is required to store and their corresponding record retention periods. The record retention schedule includes reproductions, as well as all media, including microfilm and machine-readable computer records, for each record category.”

Fannie Mae commented that the inclusion of the term “reproductions” in the definition would be inconsistent with the standard industry approach, which does not require retention of copies because of the burden and expense of such retention. OFHEO understands that retention of all reproductions or copies of records would be burdensome and expensive. Reproductions would be listed in a record retention schedule only if the original of the official record is not available. Accordingly, OFHEO has revised the second sentence of the proposed definition to read: “The record retention schedule includes all media, such as microfilm and machine-readable computer records, for each record category. Reproductions are also included for each record category if the original of the official record is not available.”

Fannie Mae also commented that the record retention schedule is envisioned as a “form.” Fannie Mae also requested a technical change to the definition, i.e., substitution of the word “schedule” for the term “form,” to be consistent with the standard industry approach. OFHEO agrees and has changed the term “form” to “schedule” in the definition of the term “record retention schedule” in the final regulation.

Record Period

As proposed, the definition of the term “Retention period” would be defined in § 1732.2(l) to mean the length of time that records must be kept before they are destroyed. Records not authorized for destruction would have a retention period of “permanent.”

Fannie Mae made a technical comment that the definition is ambiguous, and requested that the definition be changed to state that: “Records not provided with a `retention period' must be retained, unless scheduled for destruction.”

OFHEO has determined that the definition, as proposed, is clear and, therefore, has not made the technical change.

Vital Records

As proposed, the term “vital records” would be defined in § 1732.2(m) to mean documents that are needed to meet operational responsibilities of an Enterprise under emergency or disaster conditions (emergency operating records) or to protect the legal and financial rights of an Enterprise and those affected by Enterprise activities. Emergency operating records would be defined to mean the type of vital records essential to the continued functioning or reconstitution of an Enterprise during and after an emergency. Moreover, a vital record would be further defined to include a record that could be both an emergency operating record and a legal and financial rights record.

Fannie Mae commented that the definition includes documents “needed * * * to protect the legal and financial rights of * * * those affected by Enterprise activities.” Fannie Mae stated that the company is very concerned about the possible impact of this language, as it arguably could be read to create new, unpredictable obligations to third parties, and thus potential legal risk. To allay such concerns and to be consistent with industry best practices, Fannie Mae requested that the words “those affected by Enterprise activities” be substituted with the phrase “its employees, creditors, customers and holders of its securities.”

In response to the comment, OFHEO has determined to delete the words “those affected by Enterprise activities” from the definition of the term “vital records” in the final regulation. Also, as noted above, the word “records” has been substituted for the word “documents.”

C. Section 1732.5 Establishment and Evaluation of Record Retention Program

Section 1732.5(a) of the proposed regulation would require each Enterprise to establish and maintain a written record retention program and provide a copy of such program to the Examiner-in-Charge (EIC) of the Enterprise within 120 days of the regulation's effective date, and annually thereafter, and whenever a significant revision to the program has been made.

Fannie Mae advised in its comments that the company will be prepared to submit a written plan within 120 days of the effective date on the understanding that the EIC will advise if the planned program is acceptable before investments are made in order to avoid costly changes and unnecessary delays. For the build-out process, Fannie Mae further advised that the company anticipates using one or more pilots to test and improve its proposed policy, approach and technology.

Freddie Mac stated that the company expects to include in its initial report to OFHEO a snapshot of its current records retention program, including any additional enhancements that are implemented by the date of that report, together with a description of planned enhancements (both short-term and long-term) to that program. That first report will reflect that Freddie Mac has a records management program in place that encompasses records retention, but that the company is continuing to develop and strengthen its program. Freddie Mac noted that with OFHEO feedback on both its record retention program, and on planned enhancements, the corporation can align the records retention program with the expectations of OFHEO under the final regulation.

OFHEO understands that both Enterprises are in the process of developing and upgrading their records management systems to comport with changing technology and the requirements of the final regulation. To that end, OFHEO encourages an Enterprise to submit relevant materials to and confer with its EIC as needed to ensure that its record retention program is compliant.

D. Section 1732.6 Minimum Requirements of Record Retention Program Requirements

Section 1732.6(a)(2)(iii) of the proposed regulation would require that the record retention program established and maintained by an Enterprise be reasonably designed to assure that the format of retained records and the retention period permit ready access by the Enterprise, and, upon request, by the examination and other staff of OFHEO.

As noted above, in response to technical comments received on § 1732.1, OFHEO has revised subsection (a)(2)(iii) of § 1732.6 in the final regulation to clarify the accessibility requirement to mean access by reasonable means, consistent with the nature and availability of the records and existing information technology.

Additionally, Freddie Mac made a technical comment requesting that OFHEO revise this subsection (and § 1732.7(d), which addresses access to and retrieval of records during a record hold) to include at the end the phrase “subject to applicable legal rights.”

OFHEO has determined that it is not necessary to add the requested phrase to either subsection because the record retention requirements of the regulation are imposed for purposes of supervisory access by OFHEO to Enterprise records and do not result in a waiver of existing rights.

Section 1732.6(a)(5) of the proposed regulation would require that the record retention program established and maintained by an Enterprise include an accurate, current, and comprehensive record retention schedule that lists records by major categories, subcategories, record type, and retention period, which retention period is appropriate to the specific record and consistent with applicable legal, regulatory, fiscal, and administrative requirements.

Fannie Mae commented that the term “administrative” is ambiguous. Fannie Mae stated that, if the term is intended to reference administrative requirements of OFHEO, the term “regulatory” already captures these requirements, so the term “administrative” should be deleted. If, however, what is intended to be captured are the Enterprises' business needs, the term “operational” or “business” should be substituted for the term “administrative.”

OFHEO notes that the term “administrative” refers to requirements that are internal to a company, i.e., the Enterprise. Therefore, the term is not duplicative of the term “regulatory.” However, for purposes of clarification, OFHEO has determined to revise § 1732.6(a)(5) in the final regulation by substituting the terms “operational and business” for the term “administrative.”

Training

Section 1732.6(b) of the proposed regulation would require that an Enterprise's record retention program provide for training of and notice to all employees on a periodic basis on their record retention responsibilities, including instruction regarding penalties provided by law for the unlawful removal or destruction of records.

The Enterprises commented that this provision should be modified to include specific language tailored to requirements appropriate for independent contractors and agents. In its technical comment, Freddie Mac requested that OFHEO modify the proposal to provide that the training provision applies only to actual employees of an Enterprise, and that the Enterprise also takes reasonable steps to ensure that agents or independent contractors who are involved with creating or maintaining Enterprise records receive notice and/or training regarding record retention responsibilities in a manner appropriate to their engagement. Fannie Mae requested amending the proposed section to include specific language making training for agents or independent contractors consistent with their roles and responsibilities.

As noted above in response to comments on § 1732.2(e), OFHEO has added specific language for coverage of agents or independent contractors to several sections of the final regulation. With respect to § 1732.6, a second sentence has been added to subsection (b) that reads as follows: “The record retention program also shall provide for training for the agents or independent contractors of an Enterprise, as appropriate, consistent with their respective roles and responsibilities to the Enterprise.”

E. Section 1732.7 Record Hold

Definition

Section 1732.7(a) of the proposed regulation would define the term “record hold” to mean a requirement, an order, or a directive from an Enterprise or OFHEO that the Enterprise is to retain records relating to a particular issue in connection with an actual or a potential OFHEO examination, investigation, enforcement proceeding, or litigation.

Both Enterprises expressed concern that criteria for a record hold is stated in terms of a “potential” investigation, enforcement proceeding or litigation. Fannie Mae commented that virtually everything that an Enterprise does raises some “potential” for litigation, and virtually every question that OFHEO asks raises some “potential” for an OFHEO investigation. Fannie Mae stated that the overly broad and ambiguous standard would needlessly create an onerous burden both on the Enterprises and OFHEO. Fannie Mae requested that the word “likely” be substituted for the word “potential.”

Freddie Mac made the technical comment that the term “potential” requires or suggests that an Enterprise or employee is obligated and accountable to accurately guess when a matter could possibly give rise to an OFHEO examination, investigation, enforcement proceeding or litigation, resulting in an impossible standard with which to comply in practice. Freddie Mac requested that subsection (a) of § 1732.7 be modified to require that an Enterprise receive notice from OFHEO.

To address these comments, OFHEO has amended subsection (a) of § 1732.7 in the final regulation to clarify that the record retention requirements of a record hold result upon receipt by the Enterprise of notice from OFHEO. As amended, subsection (a) reads as follows: “For purposes of this part, the term ‘record hold' means a requirement, an order, or a directive from an Enterprise or OFHEO that the Enterprise is to retain records relating to a particular issue in connection with an actual or a potential OFHEO examination, investigation, enforcement proceeding, or litigation of which the Enterprise has received notice from OFHEO.” As a result of the amendment, OFHEO has determined that it is not necessary to substitute the word “likely” for the word “potential.”

Notification by an Enterprise

Section 1732.7(b)(1) of the proposed regulation would require that the record retention program of an Enterprise “[a]ddress how all employees will receive prompt notification of a record hold; * * *.” Fannie Mae stated that it understands that this provision requires only that the program provide the mechanism by which all relevant employees will be notified of a record hold, and does not require that all employees in fact be made aware of each and every record hold issued. Otherwise, Fannie Mae stated the result would be a great deal of cost, confusion and unnecessary effort, as the vast majority of Enterprise employees would have nothing germane to a particular hold. Moreover, Fannie Mae stated that industry best practice is not to notify each employee at a company of every records hold, but rather to notify only those employees who are likely to have records covered by the records hold. To that end, Fannie Mae requested that the subsection be modified by deleting the words “all employees” and substituting the phrase “the Enterprise will determine which employees, agents and independent contractors need to and.”

OFHEO understands that not all employees of an Enterprise may fall within the scope of the notification requirements of § 1732.7(b)(1) in light of the nature of their responsibilities and activities. To clarify that understanding, OFHEO has deleted the word “all” before the word “employees” in the final regulation. Additionally, as noted above, because agents or independent contractors of the Enterprise have been deleted from the definition of the term “employees,” specific language has been added to the subsection to cover agents or independent contractors, as appropriate. As amended, § 1732.7(b)(1) reads as follows in the final regulation: “The record retention program of an Enterprise shall: (1) Address how employees and, as appropriate, how agents or independent contractors consistent with their respective roles and responsibilities to the Enterprise, will receive prompt notification of a record hold;”.

Section 1732.7(b)(3) of the proposed regulation would require that the record retention program of an Enterprise “[p]rovide that any employee who is aware of a potential investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee shall notify immediately the legal department of the Enterprise and shall retain any records that may be relevant in any way to such investigation, enforcement proceeding, or litigation.”

Similar to comments made on other sections, both Enterprises expressed concerns regarding the scope of coverage for the notification requirements of § 1732.7(b)(3) and criteria for determining a “potential” investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee.

The concerns expressed have been addressed by OFHEO. As noted above in its response to comments received on § 1732.2(e), OFHEO has deleted coverage of agents or independent contractors acting on behalf of an Enterprise from the definition of the term “employee,” and their coverage is limited to certain sections of the final regulation as appropriate. OFHEO also amended subsection (a) of § 1732.7 in the final regulation to clarify that the record retention requirements of a record hold result upon receipt by an Enterprise of notice from OFHEO.

To further allay any concerns, OFHEO has amended § 1732.7(b)(3) by replacing the words “aware of” with “has received notice of” and also by inserting the phrase “ , or otherwise has actual knowledge that an issue is subject to such an enforcement proceeding or litigation,” before the words “shall notify.” Thus, OFHEO would provide written notice to an Enterprise of its intent to conduct an investigation some time in the future, thereby providing notice of a “potential investigation.” Also, consistent with other sections discussed above, language has been added to the subsection to require that agents and independent contractors receive notice of a record hold to the extent appropriate in light of the nature of their engagement.

Specifically, § 1732.7(b)(3) of the final regulation provides that the record retention program of an Enterprise shall “provide that any employee and, as appropriate, any agent or independent contractor consistent with his or her respective role and responsibility to the Enterprise, who has received notice of a potential investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee, or otherwise has actual knowledge that an issue is subject to such an investigation, enforcement proceeding or litigation, shall notify immediately the legal department of the Enterprise and shall retain any records that may be relevant in any way to such investigation, enforcement proceeding, or litigation.”

It is noted that OFHEO also has revised subsection (b)(1) of § 1732.7, which requires prompt notification of a record hold, to include, as appropriate, coverage of agents and independent contractors consistent with their roles and responsibilities.

F. Section 1732.10 Supervisory Action

Section 1732.10(a) of the proposed regulation would provide that failure by an Enterprise to comply with this part may subject the Enterprise or the board members, officers, or employees thereof to supervisory action by OFHEO under the Act, including but not limited to cease-and-desist proceedings, temporary cease-and-desist proceedings, and civil money penalties.

Both Enterprises commented on compliance with the proposed section. Fannie Mae noted the necessary complexities of developing a comprehensive record retention scheme and suggested that, consistent with the approach of federal banking regulators, OFHEO establish a specific system for the submission of Enterprise remediation plans (over perhaps a thirty-day period) with regard to any deficiencies regarding compliance with § 1732.10(a). Fannie Mae stated that such a system would provide a routine, efficient framework for the resolution of issues that do not merit formal enforcement action, without foreclosing the ability to take more formal action, as OFHEO deemed appropriate.

Freddie Mac commented that in light of the lack of bright lines as to precisely what is required for full compliance with the regulation, the rapidly changing best practices in the records management field, and the time required to develop and implement enhancements to records management programs, it would be appropriate for OFHEO to first consider using feedback, followed by a request for a remediation plan, prior to considering formal enforcement actions, in instances where OFHEO believes an Enterprise acting in good faith is not in full compliance with the regulation. Thus, Freddie Mac requested that § 1732.10(a) be revised to require appropriate supervisory notification before noncompliance would subject the Enterprise to a supervisory action by OFHEO.

OFHEO understands that both Enterprises are in the process of developing and upgrading their records management systems to comport with changing technology. To that end, both during the 120-day implementation period and afterwards, OFHEO encourages each Enterprise to submit relevant materials to and confer with its EIC as needed to ensure that its record retention program is compliant.

III. Final Regulation

Except with respect to the technical and clarifying revisions of the proposed language as described above, OFHEO has determined to issue the regulation as proposed.

Regulatory Impact

Executive Order 12866, Regulatory Planning and Review

This regulation does not result in an annual effect on the economy of $100 million or more or a major increase in costs or prices for consumers, individual industries, Federal, State, or local government agencies, or geographic regions; or have significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based enterprises to compete with foreign-based enterprises in domestic or foreign markets. Accordingly, no regulatory impact assessment is required. Nevertheless, this regulation was submitted to the Office of Management and Budget for review under other provisions of Executive Order 12866 as a significant regulatory action.

Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires that a regulation that has a significant economic impact on a substantial number of small entities, small businesses, or small organizations must include an initial regulatory flexibility analysis describing the regulation's impact on small entities. Such an analysis need not be undertaken if the agency has certified that the regulation will not have a significant economic impact on a substantial number of small entities (5 U.S.C. 605(b)). OFHEO has considered the impact of the regulation under the Regulatory Flexibility Act. The General Counsel of OFHEO certifies that the regulation, as herein adopted, is not likely to have a significant economic impact on a substantial number of small business entities because the regulation is applicable only to the Enterprises which are not small entities for purposes of the Regulatory Flexibility Act.

Executive Order 13132, Federalism

Executive Order 13132 requires that Executive departments and agencies identify regulatory actions that have significant federalism implications. A regulation has federalism implications if it has substantial direct effects on the States, on the relationship or distribution of power between the Federal Government and the States, or on the distribution of power and responsibilities among various levels of Government. The Enterprises are federally chartered corporations supervised by OFHEO. This regulation sets forth minimum record retention requirements with which the Enterprises must comply for Federal supervisory purposes and address the safety and soundness authorities of the agency. This regulation does not affect in any manner the powers and authorities of any State with respect to the Enterprises or alter the distribution of power and responsibilities between State and Federal levels of government. Therefore, OFHEO has determined that this final regulation has no federalism implications that warrant the preparation of a Federalism Assessment in accordance with Executive Order 13132.

List of Subjects in 12 CFR Part 1732

• Government-Sponsored Enterprises
• Reporting and recordkeeping requirements
• Records

Accordingly, for the reasons stated in the preamble, OFHEO adds part 1732 to subchapter C of 12 CFR chapter XVII to read as follows:

Subchapter C—Safety and Soundness

PART 1732—RECORD RETENTION

Subpart A—General

1732.1

Purpose and scope.

1732.2

Definitions.

1732.3-4

[Reserved]

Subpart B—Record Retention Program

1732.5

Establishment and evaluation of record retention program.

1732.6

Minimum requirements of record retention program.

1732.7

Record hold.

1732.8-1732.9

[Reserved]

Subpart C—Supervisory Action

1732.10

Supervisory action.

Authority: 12 U.S.C. 4513(a), 4513(b)(1), 4513(b)(5), 4514, 4631, 4632, and 4632.

Subpart A—General

§ 1732.1

Purpose and scope.

In furtherance of the safety and soundness authorities of OFHEO, this part sets forth minimum requirements in connection with the record retention program of each Enterprise. The requirements are intended to ensure that complete and accurate records of an Enterprise are readily accessible by OFHEO for examination and other supervisory purposes. Such access shall be by reasonable means, consistent with the nature and availability of the records and existing information technology.

§ 1732.2

Definitions.

For purposes of this part, the term:

(a) Act means the Federal Housing Enterprises Financial Safety and Soundness Act of 1992, Title XIII of the Housing and Community Development Act of 1992, Public Law 102-550, section 1301, Oct. 28, 1992, 106 Stat. 3672, 3941 through 4012 (1993) (12 U.S.C. 4501 et seq.).

(b) Active record means a record that is necessary to conduct the current business of an office or business unit of an Enterprise and, therefore, is readily available for consultation and reference.

(c) Director means the Director of OFHEO, or his or her designee.

(d) Electronic record means a record created, generated, communicated, or stored by electronic means.

(e) Employee means any officer or employee of an Enterprise or any conservator appointed by OFHEO.

(f) Enterprise means the Federal National Mortgage Association or the Federal Home Loan Mortgage Corporation; and the term “Enterprises” means, collectively, the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation.

(g) E-mail means electronic mail, which is a method of communication in which:

(1) Usually, text is transmitted (but sometimes also graphics and/or audio information);

(2) Operations include sending, storing, processing, and receiving information;

(3) Users are allowed to communicate under specified conditions; and

(4) Messages are held in storage until called for by the addressee, including any attachment of separate electronic files.

(h) Inactive record means a record that is seldom used but must be retained by an Enterprise for fiscal, legal, historical, or vital records purposes.

(i) OFHEO means the Office of Federal Housing Enterprise Oversight.

(j) Record means any information whether generated internally or received from outside sources by an Enterprise or employee maintained in connection with Enterprise business, regardless of the following:

(1) Form or format, including hard copy documents (e.g., files, logs, and reports) and electronic documents (e.g., e-mail, databases, spreadsheets, PowerPoint presentations, electronic reporting systems, electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), and voicemail records;

(2) Where the information is stored or located, including network servers, desktop or laptop computers and handheld computers, other wireless devices with text messaging capabilities, and on-site or off-site at a storage facility;

(3) Whether the information is maintained or used on Enterprise-owned equipment, or personal or home computer systems of an employee; or

(4) Whether the information is active or inactive.

(k) Record retention schedule means a schedule that details the categories of records an Enterprise is required to retain and the corresponding retention periods. The record retention schedule includes all media, such as microfilm and machine-readable computer records, for each record category. Reproductions are also included for each record category if the original of the official record is not available.

(l) Retention period means the length of time that records must be kept before they are destroyed. Records not authorized for destruction have a retention period of “permanent.”

(m) Vital records means records that are needed to meet operational responsibilities of an Enterprise under emergency or disaster conditions (emergency operating records) or to protect the legal and financial rights of an Enterprise. Emergency operating records are the type of vital records essential to the continued functioning or reconstitution of an Enterprise during and after an emergency. A vital record may be both an emergency operating record and a legal and financial rights record.

§§ 1732.3-1732.4

[Reserved]

Subpart B—Record Retention Program

§ 1732.5

Establishment and evaluation of record retention program.

(a) Establishment. An Enterprise shall establish and maintain a written record retention program and provide a copy of such program to the OFHEO Examiner-in-Charge of the Enterprise within 120 days of the effective date of this part, and annually thereafter, and whenever a significant revision to the program has been made.

(b) Evaluation. Management of the Enterprise shall evaluate in writing the adequacy and effectiveness of the record retention program at least every three years and provide a copy of the evaluation to the board of directors and the OFHEO Examiner-in-Charge of the Enterprise.

§ 1732.6

Minimum requirements of record retention program.

(a) Requirements. The record retention program established and maintained by an Enterprise under § 1732.5 shall:

(1) Be reasonably designed to assure that retained records are complete and accurate;

(2) Be reasonably designed to assure that the format of retained records and the retention period—

(i) Are adequate to support litigation and the administrative, business, external and internal audit functions of the Enterprise;

(ii) Comply with requirements of applicable laws and regulations; and

(iii) Permit ready access by the Enterprise and, upon request, by the examination and other staff of OFHEO by reasonable means, consistent with the nature and availability of the records and existing information technology;

(3) Assign in writing the authorities and responsibilities for record retention activities;

(4) Include policies and procedures concerning record holds, consistent with § 1732.7;

(5) Include an accurate, current, and comprehensive record retention schedule that lists records by major categories, subcategories, record type, and retention period, which retention period is appropriate to the specific record and consistent with applicable legal, regulatory, fiscal, and operational and business requirements;

(6) Include adequate security and internal controls to protect records from unauthorized access and data alteration; and

(7) Provide for adequate back-up and recovery of electronic records.

(b) Training. The record retention program shall provide for training of and notice to all employees on a periodic basis on their record retention responsibilities, including instruction regarding penalties provided by law for the unlawful removal or destruction of records. The record retention program also shall provide for training for the agents or independent contractors of an Enterprise, as appropriate, consistent with their respective roles and responsibilities to the Enterprise.

§ 1732.7

Record hold.

(a) Definition. For purposes of this part, the term “record hold” means a requirement, an order, or a directive from an Enterprise or OFHEO that the Enterprise is to retain records relating to a particular issue in connection with an actual or a potential OFHEO examination, investigation, enforcement proceeding, or litigation of which the Enterprise has received notice from OFHEO.

(b) Notification by Enterprise. The record retention program of an Enterprise shall:

(1) Address how employees and, as appropriate, how agents or independent contractors consistent with their respective roles and responsibilities to the Enterprise, will receive prompt notification of a record hold;

(2) Designate an individual to communicate specific requirements and instructions, including, when necessary, the instruction to cease immediately any otherwise permissible destruction of records; and,

(3) Provide that any employee and, as appropriate, any agent or independent contractor consistent with his or her respective role and responsibility to the Enterprise, who has received notice of a potential investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee, or otherwise has actual knowledge that an issue is subject to such an investigation, enforcement proceeding or litigation, shall notify immediately the legal department of the Enterprise and shall retain any records that may be relevant in any way to such investigation, enforcement proceeding, or litigation.

(c) Method of record retention. The record retention program of an Enterprise shall address the method by which the Enterprise will retain records during a record hold. Specifically, the program shall describe the method for the continued preservation of electronic records, including e-mails, and the conversion of records from paper to electronic format as well as any alternative storage method.

(d) Access to and retrieval of records. The record retention program of an Enterprise shall ensure access to and retrieval of records by the Enterprise and access, upon request, by OFHEO, during a record hold. Such access shall be by reasonable means, consistent with the nature and availability of the records and existing information technology.

§§ 1732.8-1732.9

[Reserved]

Subpart C—Supervisory Action

§ 1732.10

Supervisory action.

(a) Supervisory action. Failure by an Enterprise to comply with this part may subject the Enterprise or the board members, officers, or employees thereof to supervisory action by OFHEO under the Act, including but not limited to cease-and-desist proceedings, temporary cease-and-desist proceedings, and civil money penalties.

(b) No limitation of authority. This part does not limit or restrict the authority of OFHEO to act under its safety and soundness mandate, in accordance with the Act. Such authority includes, but is not limited to, conducting examinations, requiring reports and disclosures, and enforcing compliance with applicable laws, rules, and regulations.

Dated: October 23, 2006.

James B. Lockhart, III,

Director, Office of Federal Housing Enterprise Oversight.

Footnotes

1.  12 U.S.C. 4513(b)(2).

2.  

12 U.S.C. 4517(a) and (b).

3.  12 U.S.C. 4632(c).

4.  See, e.g., 12 U.S.C. 1829b, and the Guidelines and Interagency Standards for Safety and Soundness at 12 CFR part 30, Appendix A, II, B.

5.  Pub. L. 107-204, 116 Stat. 745 (2002).

6.  17 CFR part 210. See Release Nos. 33-8180; 34-47241; IC-2591; FR-66; File No. S7-46-02.

7.  In their comments on best practices in the field of records management, both Enterprises referred to the guidelines and standards of the following organizations: The Sedona Conference (2005), the American National Standards Institute/Association of Records Managers and Administrators, and the International Organization for Standardization.