2011-14055. Record Retention for Regulated Entities and Office of Finance

AGENCY:

Federal Housing Finance Board; Federal Housing Finance Agency; Office of Federal Housing Enterprise Oversight.

ACTION:

Final regulation.

SUMMARY:

The Federal Housing Finance Agency is issuing a final regulation to set forth record retention requirements for the Federal National Mortgage Association, the Federal Home Loan Mortgage Corporation, the Federal Home Loan Banks, and the Office of Finance.

DATES:

Effective Date: July 8, 2011.

FOR FURTHER INFORMATION CONTACT:

Andra Grossman, Senior Counsel, telephone [phone] (not a toll-free number); Federal Housing Finance Agency, Fourth Floor, 1700 G Street, NW., Washington, DC 20552. The telephone number for the Telecommunications Device for the Deaf is [phone].

SUPPLEMENTARY INFORMATION:

I. Background

The Federal Housing Enterprises Financial Safety and Soundness Act of 1992 (12 U.S.C. 4501 et seq.), as amended (Safety and Soundness Act) provides that the Director is to establish standards for the Federal National Mortgage Association, the Federal Home Loan Mortgage Corporation, and the Federal Home Loan Banks (collectively “regulated entities”) and the Office of Finance to maintain adequate records in accordance with consistent accounting policies and practices that enable the Director to evaluate the financial condition of each regulated entity and the Office of Finance and such other operational and management standards as the Director determines to be appropriate.^[1] The Safety and Soundness Act further provides the Director with general supervisory and regulatory authority over the regulated entities and the Office of Finance, and requires the Director to ensure that they operate in a safe and sound manner and in compliance with applicable laws, regulations, and supervisory guidance and directives.^[2]

II. Discussion of Comments

On August 4, 2009, the Federal Housing Finance Agency (FHFA) published for comment a proposed regulation setting forth proposed requirements for the regulated entities and the Office of Finance to establish and maintain a record retention program to ensure that records are readily accessible for examination and other supervisory purposes.^[3] FHFA received comments from the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation, ten Federal Home Loan Banks, the Office of Finance, and ARMA International, a professional association of record and information managers. All comments are posted to the FHFA Web site at http://www.fhfa.gov and have been taken into consideration in issuing the final regulation.

A discussion of the comments as they relate to the sections of the final regulation follows.

Section 1235.1 Purpose and Scope

This section provides that the purpose of the proposed regulation is to set forth minimum requirements for a record retention program for each regulated entity and the Office of Finance. The proposed requirements are intended to ensure that complete and accurate records of each regulated entity and the Office of Finance are readily accessible by FHFA.

One commenter requested that FHFA clarify whether the regulation is intended to apply on a prospective or retroactive basis to existing records of a Federal Home Loan Bank. FHFA clarifies that the minimum requirements of the record retention program are applicable prospectively to regulated entities and the Office of Finance. FHFA notes that the Federal Home Loan Banks were subject to FHFB Resolution 93-50 “Approval of the Policy Statement on Retention of Records” (May 26, 1993) (Resolution) issued by the Federal Housing Finance Board, a predecessor agency of FHFA, which discussed the objectives of the policy, the retention periods of Federal Home Loan Bank documents, and the availability of such documents, and attached a record retention schedule. (See the discussion below on the rescission of the Resolution.) Consequently, establishing a record retention program that meets the minimum requirements of the regulation should not create a significant burden on any Federal Home Loan Bank.

In reviewing the proposed Purpose and Scope section, FHFA has determined to include the express purpose of furthering prudent management within the scope of the final regulation, which was implied in the proposed regulation.

Section 1235.2 Definitions

Active, inactive, and vital records. The proposed regulation provides definitions for “active,” “inactive,” and “vital” records. Several commenters requested that the definitions of the terms “active record,” “inactive record,” and “vital record” be removed from the regulation. One commenter pointed out that the terms are not used in other parts of the regulation. Another commenter suggested providing a period of time a record is active, such as to the end of the last year in which the matter is active or as long as property is owned. In addition, a commenter suggested that the definition of “inactive record” and “vital record” include a clearly defined retention period consistent with the organization's record retention schedule.

FHFA has determined to remove the definitions of the terms “active record,” “inactive record,” and “vital record” as requested by several commenters because such terms are not used in the proposed regulation. FHFA notes, however, that a regulated entity and the Office of Finance must have a record retention period that pertains to all records regardless whether a record is active, inactive, or vital. FHFA will evaluate the reasonableness of the record retention period established by each regulated entity and the Office of Finance.

Electronic Record. The proposed regulation defines the term “electronic record” as “a record created, generated, communicated, or stored by electronic means.” One commenter suggested clarifying the terms “created” and “generated” within the definition because such terms appear to be synonymous. FHFA is adopting the definition as proposed because the definition is a widely-used, generally accepted definition of the term electronic record.

E-mail. One commenter recommended revising the definition of the term “e-mail” to include reference to computers or computer networks. FHFA has revised the definition to clarify that the term “e-mail” means a document created or received on a computer network for transmitting messages electronically, and any attachment transmitted with the document.

Record. The proposed regulation defines “record” as any information, whether generated internally or received from outside sources by a regulated entity or the Office of Finance or employee, maintained in connection with a regulated entity or Office of Finance business (which business, in the case of the Office of Finance, includes any functions performed with respect to the Financing Corporation), regardless of the following—(1) Form or format, including hard copy documents (e.g., files, logs, and reports) and electronic documents (e.g., e-mail, databases, spreadsheets, PowerPoint presentations, electronic reporting systems, electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), and voicemail records; (2) where the information is stored or located, including network servers, desktop or laptop computers and handheld computers, other wireless devices with text messaging capabilities, and on-site or off-site at a storage facility; (3) whether the information is maintained or used on regulated entity-owned or Office of Finance equipment, or on personal or home computer systems of an employee; or (4) whether the information is active or inactive.

One commenter suggested that FHFA revise the definition of the term “record” to include regulatory requirements as well as business needs. FHFA notes that records needed for the business of the regulated entities and the Office of Finance include records to meet regulatory requirements, but has determined to include an express reference to regulatory requirements for greater clarity.

Several Federal Home Loan Banks suggested the deletion of the term “voice mail” from the example of the form or format of a record. These commenters stated that as a matter of course, business is not conducted over voicemail such that a voicemail would not need to be maintained as a record. They suggested that recorded telephone lines that document formal communications and business transactions are the more appropriate form of documented telephone related communications. In response to this suggestion, FHFA has included the term “recorded telephone line records” in the description of form and format of a record but has not deleted the term “voicemail records” because some regulated entities or the Office of Finance may now or in the future use “voicemail records” in the transaction of business. If a regulated entity or the Office of Finance does not use voicemail records for business purposes and such records are not identified in its record retention policy as a category of records that represent business records, the voicemail records would not be records for purposes of the regulation.

One commenter suggested that the definition of the term “record” should apply only to business records and not to personal records, public periodicals, and similar documents that would be burdensome to catalog. In addition, the commenter requested that confidential and privileged records be exempt from the requirements of the regulation. FHFA notes that under the Safety and Soundness Act and the Federal Home Loan Bank Act, the Director may require the production of records, whether confidential or privileged; therefore, confidential or privileged records are not exempt from the requirements of the regulation. In addition, it is a prudent management practice for confidential and privileged records to be retained. To clarify the definition of the term “record,” FHFA has revised the definition to apply to records related to the conduct of the business of a regulated entity.

Two commenters suggested the removal of the reference to personal or home computers. A regulated entity or the Office of Finance may maintain a record for purposes of this regulation solely on equipment it owns, as one commenter stated, even if employees access and use records on their home computers. Each regulated entity and the Office of Finance is required to maintain a record, in at least one form or format, regardless of where the record is created, used, or maintained, and may prohibit the transfer of business records to personal or home computers. If business records are transferred to personal or home computers, then such records would be records for purposes of the regulation. Consequently, FHFA has determined not to delete the reference to personal or home computers.

One commenter sought clarification on the required form or format of a record; others sought clarification as to the required type and number of records that must be maintained. Another commenter sought clarification with regard to the destruction of drafts of records not subject to a record hold.

In response to these comments, FHFA notes that a regulated entity or the Office of Finance may maintain only one copy of a record if the record is not subject to a record hold, there is no mandatory legal requirement to retain the record in the form or format, and another form or format of the record is not necessary to support administrative, business, external audit, or internal audit functions or litigation. Copies may be destroyed in accordance with the record retention schedule of the regulated entity or Office of Finance. In addition, FHFA notes that a record retention schedule should specifically address those records for which original signature documents will be maintained in electronic copy with the understanding that electronic copies of physical documents may face challenges as to authenticity and admissibility in court if the actual original signature is no longer available.

One commenter requested that FHFA clarify that, unless subject to a record hold, transitory documents such as “to do” lists, unsolicited information, advertisements, and other similar documents would not be considered records. For purposes of this regulation, the permanent or transitory nature of a document does not determine whether it is a record. If a document is considered a record for purposes of this regulation, it must be retained in accordance with the record retention schedule of the regulated entity or Office of Finance. That schedule may establish a category of transitory documents with a short or no-retention period in accordance with the record retention program of the regulated entity or Office of Finance.

Record Hold. The proposed regulation defines “record hold” as a requirement, an order, or a directive from a regulated entity, the Office of Finance, or FHFA that the regulated entity or the Office of Finance is to retain records relating to a particular issue in connection with an actual or a potential FHFA examination, investigation, enforcement proceeding, or litigation of which the regulated entity or the Office of Finance has received notice from FHFA. One commenter requested that the definition of the term “record hold” be modified since the occurrence of an FHFA examination should not trigger the formal record hold process. FHFA notes that the occurrence of an FHFA examination does not automatically trigger a record hold; FHFA must provide notice of the record hold.

As a matter of prudent management, regulated entities and the Office of Finance should have a record hold program with respect to anticipated litigation regardless of notice from FHFA. Consequently, FHFA has clarified the definition of the term “record hold” to include litigation of which the regulated entity or the Office of Finance becomes aware.

Record Retention Schedule. The proposed regulation defines the term “record retention schedule” as “a schedule that details the categories of records a regulated entity or the Office of Finance is required to retain and the corresponding retention periods. The record retention schedule includes all media, such as microfilm and machine-readable computer records, for each record category. Reproductions are also included for each record category if the original of the official record is not available.”

One commenter requested that the definition of the term “record retention schedule” be revised to cover only the information media that the regulated entity has determined to be the form in which it will retain a particular record in order to avoid maintaining duplicate records. As explained above in the discussion of the definition of the term “record,” a regulated entity may maintain only one copy of a record unless a record is subject to a record hold, there is a mandatory legal requirement to retain the record in another format, or a duplicate record is necessary to support administrative, business, external audit, or internal audit functions or litigation. For clarity, FHFA has deleted from the final regulation the sentence, “[r]eproductions are also included for each record category if the original of the official record is not available.”

Another commenter suggested revising the definition of the term “record retention schedule” by striking “is required to retain” and inserting “retains” to clarify that many records retained by a regulated entity are kept for discretionary business reasons, not because a legal requirement forces retention. FHFA has determined that because a requirement to retain records may be based on a legal requirement or internal policy, it is not necessary to revise the definition as suggested.

Finally, one commenter recommended including in the definition of the term “record retention schedule” that the record retention schedule must define the policies and procedures to be followed relative to access, safeguards, dispositions, and record holds. FHFA notes that although the record retention program should address such policies and procedures, they do not need to be addressed in the record retention schedule.

Retention Period. The proposed regulation defines “retention period” as “the length of time that records must be kept before they are destroyed. Records not authorized for destruction have a retention period of `permanent.'” One commenter recommended adding the clarifying phrase “as determined by the organization's record retention schedule.” FHFA agrees with the recommendation and has modified the definition accordingly.

Another commenter suggested revising the definition of the term “retention period” by striking “must be kept” and inserting “are kept” to clarify that many records retained by a regulated entity are kept for discretionary business reasons, not because a legal requirement forces retention. As noted above, FHFA has determined that because a requirement to retain records for a certain period may be based on a legal requirement or internal policy, it is not necessary to revise the definition as suggested.

Finally, after reviewing the proposed definitions, FHFA determined that the definition of the term “employee” in § 1235.2 needed a technical correction and has made the correction by deleting the reference to employees of a conservator.

Section 1235.3 Establishment and Evaluation of a Record Retention Program

As proposed, a regulated entity and the Office of Finance must provide a copy of its record retention program within 120 days of the effective date of the regulation. Several commenters questioned the length of time given to create a program and requested several alternatives. In consideration of the requests, FHFA has changed the requirement to produce a record retention program to within 180 days of the effective date of the regulation. This timeframe applies to the submission of a record retention program, including projected milestones, and does not apply to the implementation of the program. Those regulated entities currently submitting an annual record retention program also must comply with the time requirements of this regulation.

One commenter asked whether a copy of the record retention program should also be submitted to the examiner-in-charge of a regulated entity. FHFA notes that a regulated entity or the Office of Finance is not required to provide a copy of its record retention program to the examiner-in-charge unless he or she requests a copy.

The proposed regulation provides that management of each regulated entity and the Office of Finance is to evaluate in writing the adequacy and effectiveness of its record retention program. One commenter asked whether management may rely on an audit conducted by an internal or external auditor. FHFA clarifies that an auditor may provide information to be taken into account by a regulated entity or the Office of Finance, but an auditor's opinion may not replace management's evaluation.

Two commenters asked FHFA to provide the form and content of management's evaluation of a record retention program. One commenter requested that FHFA provide for appropriate qualifications on management's evaluation of its record retention program in that it will not be able to test each employee's compliance as a practical matter and so will have to rely on the assertions of each employee as to such employee's compliance. Another commenter recommended that FHFA require that the record retention program be audited at least annually, rather than be evaluated every three years, as set forth in the section.

In response to these comments, FHFA notes that it will rely on each regulated entity and the Office of Finance to determine the appropriate form and content of the evaluation, which is subject to review by FHFA examiners. FHFA notes that the scope, expense, and evaluation of a record retention program should be reasonable in light of the size, complexity, and structure of the regulated entity or the Office of Finance. With respect to the evaluation of the record retention program, considering the importance of a record retention program and the recommendation for an annual evaluation, FHFA has determined to require an evaluation every two years rather than every three years.

Section 1235.4 Minimum Requirements of a Record Retention Program

Section 1235.4 of the proposed regulation provides minimum requirements of a record retention program. One commenter recommended that FHFA requirements be labeled as “elements” of a record retention program and instead include a list of general principles. FHFA has considered the recommendation and has determined not to restructure the minimum requirements, which encompass general principles. The purpose of the regulation, set forth in § 1235.1, and the principle underlying a record retention program of a regulated entity and the Office of Finance is that the records be complete and accurate and readily accessible by FHFA.

One commenter suggested adding a requirement to audit the record retention program at least annually, and to include in the program a means of detecting any internal or external risks to the integrity of a record retention schedule, and the safeguarding and disposal of records. FHFA is not adding an audit requirement because it is more appropriate for the internal and external audit functions of the regulated entity and the Office of Finance to determine the frequency and scope of audits of the record retention program. Such determinations are reviewable by FHFA examiners. However, FHFA is adding a clarifying minimal requirement that the record retention program must provide for periodic testing of the ability to access records.

Two commenters sought clarification of the term “existing information technology” used in proposed § 1235.4(a)(2)(iii) and questioned whether FHFA requires upgrades to technology. Records must be accessible. If a record is stored in an electronic format that is no longer accessible with existing information technology of a regulated entity or the Office of Finance, the record must be converted into a format that is accessible. Recognizing that each regulated entity and the Office of Finance may have a different information technology infrastructure, FHFA is not requiring that a specific type of information technology be used. Nevertheless, FHFA is deleting proposed § 1235.4(a)(2)(iii) because it is duplicative of § 1235.6, and is adding clarifying language in § 1235.4(b) to address the minimum storage requirements for electronic records; that is, they must be maintained on immutable, non-rewritable storage, preferably searchable, in a manner that provides for access to and accurate reproduction of such records for later reference by transmission, printing, or other means.

One commenter asked that the final regulation clarify that the record retention program may specify which kinds of agents and independent contractors should be subjected to the record retention program and how often training will be provided to those agents and independent contractors. FHFA notes that it would be appropriate for the record retention program to address those matters. The commenter also asked FHFA to clarify whether existing contracts must be modified to inform agents and independent contractors of the record retention program. FHFA is not requiring that existing contracts be modified.

Several commenters suggested clarification that a record retention program must account for the proper disposition of records. FHFA agrees and has added clarifying language to § 1235.4.

Lastly, two commenters requested that FHFA clarify that manual controls are appropriate so long as they are shown to be effective and that the regulation does not require a regulated entity or the Office of Finance to purchase expensive records management software and utilize costly consultants and vendors to advise on the additions of systems that may offer no more protection than the record management system currently in place. FHFA notes that the regulation does not require records management software be purchased or that consultants be utilized. The regulation requires that the record retention program meet the minimum requirements of § 1235.4, provide for record holds under § 1235.5 and access to records under § 1235.6, and be evaluated under § 1235.3.

In addition to the clarifying revisions discussed above, the final § 1235.4 includes clarifying language as follows. As proposed, § 1235.4(a)(3) provides that one of the minimum requirements of a record retention program is that it assign in writing the authorities and responsibilities for record retention activities. That section has been clarified to provide expressly that the authorities and responsibilities for record retention activities of employees, line managers, and corporate management must be assigned. As proposed, § 1235.4(a)(4) provides the record retention program include policies and procedures concerning record holds. It has been clarified to provide expressly that such policies and procedures must be integrated, as appropriate, with other policies and procedures throughout the organization. Finally, proposed § 1235.4(b), redesignated as § 1235.4(c) of the final regulation, has been clarified to address specifically communication of the record retention program.

Section 1235.5 Record Hold

Section 1235.5 of the proposed regulation requires that the record retention program of a regulated entity and the Office of Finance address how employees and, as appropriate, how agents or independent contractors consistent with their respective roles and responsibilities to the regulated entity or the Office of Finance, will receive prompt notification of a record hold. It also would provide that any employee and, as appropriate, any agent or independent contractor who has received notice of a potential investigation, enforcement proceeding, or litigation by FHFA involving the regulated entity or the Office of Finance or an employee, or otherwise has actual knowledge that an issue is subject to such an investigation, enforcement proceeding, or litigation, notify immediately the legal department or senior management of the regulated entity or the Office of Finance of a record hold.

Two commenters sought clarification as to how a record hold notice will be provided by FHFA and requested that notice be given to the chief executive officer and general counsel to ensure that the record hold notice is promptly disseminated to the appropriate persons. In response to this comment, FHFA has added a new paragraph (a) in the final regulation, which clarifies that FHFA will notify the chief executive officer of the record hold.

With respect to notice to independent contractors or agents, one commenter asked FHFA to clarify that although regulated entities and the Office of Finance may be required to notify independent contractors, they cannot accept legal or regulatory responsibility for the actions or inactions of independent contractors. FHFA notes that proposed § 1235.5(a)(1) requires that the record retention program address only how independent contractors consistent with their respective roles and responsibilities to the regulated entity or the Office of Finance, will receive prompt notification of a record hold.

Another commenter asked how the obligation to notify certain agents and independent contractors of a record hold in proposed § 1235.5(a)(1) relates to other obligations a regulated entity or the Office of Finance may have to ensure the confidentiality of FHFA materials, such as under 12 CFR 911.3. FHFA sees no conflict between the obligation to notify certain agents and independent contractors to retain specific records without disclosing that FHFA required the record hold or the obligation of a regulated entity or the Office of Finance not to disclose unpublished FHFA information without written authorization.

Two other commenters sought confirmation that a regulated entity is not required to have a legal department in light of the provision in proposed § 1235.5(a)(3) that employees notify the legal department of a potential investigation, enforcement proceeding, or litigation by FHFA. In response to these commenters, § 1235.5(a)(3), redesignated as § 1235.5(b)(3) in the final regulation, has been revised to provide that employees must notify the legal department or the individual providing legal services to the regulated entity or the Office of Finance as well as to senior management.

Section 1235.5(b) of the proposed regulation, redesignated as § 1235.5(c) in the final regulation, requires that the record retention program of each regulated entity and the Office of Finance address the method for retaining records during a record hold, including a description of the method for the continued preservation of electronic records, including e-mail, and the conversion of records from paper to electronic form as well as any alternative storage method. One commenter requested clarification that a regulated entity or the Office of Finance is not required to convert records from paper to electronic format. FHFA clarifies that electronic conversion is not required and has added the phrase “as applicable” in connection with the conversion of records from paper to electronic form and alternate storage methods. Although electronic conversion is not required, FHFA notes in § 1235.5(d) of the final regulation that a record retention program must ensure access to and retrieval of records by the regulated entity and the Office of Finance, and access, upon request, by FHFA, during a record hold. Such access must be by reasonable means, consistent with the nature and availability of the records and existing information technology.

Section 1235.6 Access to Records

Section 1235.6(a) of the proposed regulation provides that each regulated entity or the Office of Finance make its records readily available for inspection and other supervisory purposes within a reasonable period upon request by FHFA, at a location acceptable to FHFA, and by reasonable means, consistent with the nature and availability of the records and existing information technology. As proposed, § 1235.6(b) would provide that a reasonable period for requests for records made during the course of an on-site examination and pursuant to the examination's scope is no longer than one business day. For requests for records made outside of an on-site examination, a reasonable period would be three business days.

Several commenters requested either clarification or deletion of the requirement to produce records within a reasonable period. Some recommended deleting the one- and three-day presumption, but retaining the reasonable period requirement. Others requested a longer period of time in which to provide access to FHFA, that the presumptive time-periods could be rebutted, or that FHFA should take into consideration the location of the records in determining what time-period is reasonable.

Taking the comments into consideration, FHFA has revised § 1235.6 by deleting the presumptive time periods and the reference to a reasonable time period and has added that records are to be made available promptly upon request by FHFA. Facts and circumstances that FHFA will consider in determining whether records are made promptly available include, but are not limited to, the time-sensitivity of the request, whether the request is made pursuant to an examination or other supervisory activity, and the format, volume and the location of the records.

Section 1235.7 Supervisory Action

Section 1235.7 of the proposed regulation provides that failure by a regulated entity or the Office of Finance to comply with the regulation may subject the regulated entity or the Office of Finance or their board members, officers, or employees to supervisory action by FHFA under the Safety and Soundness Act. One commenter recommended the removal of the imposition of supervisory action on board members, officers, and employees in the absence of willful and wrongful conduct. The commenters are of the view that there should be no individual liability. After considering the comment, FHFA has determined, consistent with its statutory enforcement authority, to adopt the proposed section without change.

Discussion of FHFB Resolution 93-50

FHFB Resolution 93-50 “Approval of the Policy Statement on Retention of Records” (May 26, 1993) (Resolution) issued by the Federal Housing Finance Board, a predecessor agency of FHFA, discussed the objectives of the policy, the retention periods of Federal Home Loan Bank documents, and the availability of such documents and attached a record retention schedule. One commenter asked whether the Resolution survives after the regulation becomes final; another commenter recommended that the regulation expressly rescind the Resolution. FHFA clarifies that the Resolution is terminated on the effective date of the Record Retention regulation.^[4] FHFA notes that it may issue advisory or supervisory guidance on the implementation of the final Record Retention regulation.

III. Final Regulation

Section 1313(f) of the Safety and Soundness Act (12 U.S.C. 4513(f)), requires the Director, when promulgating regulations relating to the Federal Home Loan Banks, to consider the differences between the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation (Enterprises) and the Federal Home Loan Banks with respect to the Federal Home Loan Banks' cooperative ownership structure, liquidity mission, affordable housing and community development mission, capital structure, and joint and several liability. The Director may also consider any other differences that are deemed appropriate.

In preparing the final regulation, the Director considered the differences between the Federal Home Loan Banks and the Enterprises as they relate to the above factors. The Director believes that none of the unique factors relating to the Federal Home Loan Banks warrants establishing different treatment under the final regulation. The regulation speaks at a high level and permits a regulated entity and the Office of Finance to adopt a records retention policy that is appropriate to its own size, complexity, and business activities.

The final regulation requires the regulated entities and the Office of Finance to establish and maintain a record retention program to ensure that records are readily accessible for examination and other supervisory purposes. FHFA recognizes that the effectiveness of the examination process is dependent upon the prompt production of complete and accurate records. FHFA, through the supervisory process, must have access to the records of a regulated entity and the Office of Finance so as to be able to determine the financial condition of the regulated entity and the Office of Finance, assess the details or the purpose of any transaction that may have a material effect on the financial condition of the regulated entity and the Office of Finance, evaluate the entity's compliance with applicable laws, regulations, and supervisory guidance and directives, or otherwise fulfill the mission of FHFA.

Retention of such records not only facilitates the examination process, but also allows a regulated entity and the Office of Finance to manage more effectively its business and detect improper behavior that might cause financial damage. Additionally, such records serve as documentation for a regulated entity and the Office of Finance in any controversy over its business activities or transactions.

The importance of sound record retention policies and procedures by regulated institutions also has been recognized by Congress and other federal regulators. Adequate record retention by institutions has been determined to have a high degree of usefulness in criminal, tax, and regulatory investigations or proceedings, and has been identified as a requisite component of an institution's operation and management on a safety and soundness basis.^[5]

In addition to facilitating the oversight and enforcement of federal banking laws, adequate record retention has been recognized by Congress as being essential to the oversight and enforcement of the federal securities laws. For example, as mandated by the Sarbanes-Oxley Act, the U.S. Securities and Exchange Commission adopted rules requiring accounting firms to retain for seven years certain records relevant to their audits and reviews of issuers' financial statements.^[6] Records to be retained include an accounting firm's workpapers and certain other documents that contain conclusions, opinions, analyses, or financial data related to the audit or review.^[7]

The final regulation is not intended to have an effect on the policies, rules, or guidance of other federal agencies that may require record retention terms or practices different from those set forth in this regulation.

FHFA is issuing the final regulation as proposed with the clarifying revisions and technical correction discussed above. On the effective date of this regulation, the regulations at 12 CFR 914.3 (access to books and records) and 12 CFR part 1732 (record retention) are removed and FHFB Resolution 93-50, dated May 26, 1993, is terminated.

IV. Regulatory Impact

Paperwork Reduction Act

The final regulation does not contain any information collection requirement that requires the approval of the Office of Management and Budget under the Paperwork Reduction Act (44 U.S.C. 3501 et seq.).

Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires that a regulation that has a significant economic impact on a substantial number of small entities, small businesses, or small organizations must include an initial regulatory flexibility analysis describing the regulation's impact on small entities. Such an analysis need not be undertaken if the agency has certified that the regulation will not have a significant economic impact on a substantial number of small entities. 5 U.S.C. 605(b). FHFA has considered the impact of the regulation under the Regulatory Flexibility Act. FHFA certifies that the regulation is not likely to have a significant economic impact on a substantial number of small business entities because the regulation is applicable to only the regulated entities and the Office of Finance, which are not small entities for purposes of the Regulatory Flexibility Act.

List of Subjects

12 CFR Part 914

• Federal home loan banks
• Reporting and recordkeeping requirements

12 CFR Part 1235

• Federal home loan banks
• Government-sponsored enterprises
• Records
• Reporting and recordkeeping requirements

12 CFR Part 1732

• Government-sponsored enterprises
• Records
• Reporting and recordkeeping requirements

Authority and Issuance

Accordingly, for the reasons stated in the preamble, under the authority of 12 U.S.C. 4513b, FHFA amends Chapters IX, XII and XVII of title 12 of the Code of Federal Regulations, as follows:

CHAPTER IX—FEDERAL HOUSING FINANCE BOARD

PART 914—DATA AVAILABILITY AND REPORTING

1. The authority citation for 12 CFR part 914 is revised to read as follows:

Authority: 12 U.S.C. 1440 and 4526.

§ 914.3

[Removed and reserved]

2. Remove and reserve § 914.3.

CHAPTER XII—FEDERAL HOUSING FINANCE AGENCY

SUBCHAPTER B—ENTITY REGULATIONS

3. Add part 1235 to subchapter B to read as follows:

PART 1235—RECORD RETENTION FOR REGULATED ENTITIES AND OFFICE OF FINANCE

1235.1

Purpose and scope.

1235.2

Definitions.

1235.3

Establishment and evaluation of a record retention program.

1235.4

Minimum requirements of a record retention program.

1235.5

Record hold.

1235.6

Access to records.

1235.7

Supervisory action.

Authority: 12 U.S.C. 4511(b), 4513(a), 4513b(a)(10) and (11), 4526.

§ 1235.1

Purpose and scope.

The purpose of this part is to set forth minimum requirements for a record retention program for each regulated entity and the Office of Finance. The requirements are intended to further prudent management as well as to ensure that complete and accurate records of each regulated entity and the Office of Finance are readily accessible to FHFA.

§ 1235.2

Definitions.

For purposes of this part, the term—

Director means the Director of FHFA, or his or her designee.

Electronic record means a record created, generated, communicated, or stored by electronic means.

E-mail means a document created or received on a computer network for transmitting messages electronically, and any attachments which may be transmitted with the document.

Employee means any officer or employee of a regulated entity or the Office of Finance.

Federal Home Loan Bank means a Bank established under the Federal Home Loan Bank Act; the term “Federal Home Loan Banks” means, collectively, all the Federal Home Loan Banks.

FHFA means the Federal Housing Finance Agency.

Financing Corporation means the entity established by the Competitive Equality Banking Act of 1987, as a mixed-ownership government corporation whose purpose is to function as a financing vehicle for the Federal Savings & Loan Insurance Corporation. The Financing Corporation has a board of directors consisting of the managing director of the Office of Finance and two Federal Home Loan Bank presidents.

Office of Finance means the Office of Finance of the Federal Home Loan Bank System.

Record means any information, whether generated internally or received from outside sources by a regulated entity or the Office of Finance, related to the conduct of the business of a regulated entity or the Office of Finance (which business, in the case of the Office of Finance, shall include any functions performed with respect to the Financing Corporation) or to legal or regulatory requirements, regardless of the following—

(1) Form or format, including hard copy documents (e.g., files, logs, and reports), electronic documents (e.g., e-mail, databases, spreadsheets, PowerPoint presentations, electronic reporting systems, electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), and voicemail or recorded telephone line records;

(2) Where the information is stored or located, including network servers, desktop or laptop computers and handheld computers, other wireless devices with text messaging capabilities, and on-site or off-site at a storage facility;

(3) Whether the information is maintained or used on regulated entity or Office of Finance equipment, or on personal or home computer systems of an employee; or

(4) Whether the information is active or inactive.

Record hold means a requirement, an order, or a directive from a regulated entity, the Office of Finance, or FHFA that the regulated entity or the Office of Finance is to retain records relating to a particular issue in connection with an actual or a potential FHFA examination, investigation, enforcement proceeding, or litigation of which the regulated entity or the Office of Finance has received notice from FHFA or otherwise has knowledge.

Record retention schedule means a schedule that details the categories of records a regulated entity or the Office of Finance is required to retain and the corresponding retention periods. The record retention schedule includes all media, such as microfilm and machine-readable computer records, for each record category.

Regulated entity means the Federal National Mortgage Association and any affiliate thereof, the Federal Home Loan Mortgage Corporation and any affiliate thereof, or any Federal Home Loan Bank; the term “regulated entities” means, collectively, the Federal National Mortgage Association and any affiliate thereof, the Federal Home Loan Mortgage Corporation and any affiliate thereof, and the Federal Home Loan Banks.

Retention period means the length of time that records must be kept before they are destroyed, as determined by the organization's record retention schedule. Records not authorized for destruction have a retention period of “permanent.”

Safety and Soundness Act means the Federal Housing Enterprises Financial Safety and Soundness Act of 1992 (12 U.S.C. 4501 et seq.), as amended.

§ 1235.3

Establishment and evaluation of a record retention program.

(a) Establishment. Each regulated entity and the Office of Finance shall establish and maintain a written record retention program and provide a copy of such program to the Deputy Director of the Division of Enterprise Regulation, or his or her designee, or the Deputy Director for the Division of Federal Home Loan Bank Regulation, or his or her designee, as appropriate, within 180 days of the effective date of this part, and annually thereafter, and whenever a significant revision to the program has been made.

(b) Evaluation. Management of each regulated entity and the Office of Finance shall evaluate in writing the adequacy and effectiveness of the record retention program at least every two years and provide a copy of the evaluation to the board of directors and the Director.

§ 1235.4

Minimum requirements of a record retention program.

(a) General minimum requirements. The record retention program established and maintained by each regulated entity and the Office of Finance under § 1235.3 shall:

(1) Assure that retained records are complete and accurate;

(2) Assure that the form of retained records and the retention period—

(i) Are appropriate to support administrative, business, external and internal audit functions, and litigation of the regulated entity or the Office of Finance; and

(ii) Comply with requirements of applicable laws and regulations, including this part;

(3) Assign in writing the authorities and responsibilities for record retention activities for employees, including line managers and corporate management;

(4) Include policies and procedures concerning record holds, consistent with § 1235.5, and, as appropriate, integrate them with policies and procedures throughout the organization;

(5) Include an accurate, current, and comprehensive record retention schedule that lists records by major categories, subcategories, record type, and retention period, which retention period is appropriate to the specific record and consistent with applicable legal, regulatory, fiscal, operational, and business requirements;

(6) Include appropriate security and internal controls to protect records from unauthorized access and data alteration;

(7) Provide for appropriate back-up and recovery of electronic records to ensure the same accuracy as the primary records;

(8) Provide for a periodic testing of the ability to access records; and

(9) Provide for the proper disposition of records.

(b) Minimum storage requirements for electronic records. Electronic records, preferably searchable, must be maintained on immutable, non-rewritable storage in a manner that provides for both ready access by any person who is entitled to access the records, including staff of FHFA, and accurate reproduction for later reference by transmission, printing or other means.

(c) Communication and training.—(1) The record retention program established and maintained by each regulated entity and the Office of Finance under § 1235.3 shall provide for periodic training and communication throughout the organization.

(2) The record retention program shall:

(i) Provide for communication throughout the organization on record retention policies, procedures, and record retention schedule updates; and

(ii) Provide for training of and notice to all employees on a periodic basis on their record retention responsibilities, including instruction regarding penalties provided by law for the unlawful removal or destruction of records. The record retention program also shall provide for training for the agents or independent contractors of a regulated entity or the Office of Finance, as appropriate, consistent with their respective roles and responsibilities to the regulated entity or the Office of Finance.

§ 1235.5

Record hold.

(a) Notification by FHFA. In the event that FHFA is requiring a record hold, FHFA shall notify the chief executive officer of the regulated entity or the Office of Finance. Regulated entities and the Office of Finance must have a written policy for handling notice of a record hold.

(b) Notification by a regulated entity or the Office of Finance. The record retention program of a regulated entity and the Office of Finance shall—

(1) Address how employees and, as appropriate, how agents or independent contractors consistent with their respective roles and responsibilities to the regulated entity or the Office of Finance, will receive prompt notification of a record hold;

(2) Designate an individual to communicate specific requirements and instructions, including, when necessary, the instruction to cease immediately any otherwise permissible destruction of records; and

(3) Provide that any employee and, as appropriate, any agent or independent contractor consistent with his or her respective role and responsibility to the regulated entity or Office of Finance, who has received notice of a potential investigation, enforcement proceeding, or litigation by FHFA involving the regulated entity or the Office of Finance or an employee, or otherwise has actual knowledge that an issue is subject to such an investigation, enforcement proceeding or litigation, shall notify immediately the legal department or the individual providing legal services as well as senior management of the regulated entity or the Office of Finance and shall retain any records that may be relevant in any way to such investigation, enforcement proceeding, or litigation.

(c) Method of record retention during a record hold. The record retention program of each regulated entity and the Office of Finance shall address the method by which the regulated entity or the Office of Finance will retain records during a record hold. Specifically, the program shall describe the method for the continued preservation of electronic records, including e-mail, and, as applicable, the conversion of records from paper to electronic form as well as any alternative storage method.

(d) Access to and retrieval of records during a record hold. The record retention program of each regulated entity or the Office of Finance shall ensure access to and retrieval of records by the regulated entity and the Office of Finance, and access, upon request, by FHFA, during a record hold. Such access shall be by reasonable means, consistent with the nature and availability of the records and existing information technology.

§ 1235.6

Access to records.

Each regulated entity and the Office of Finance shall make its records available promptly upon request by FHFA, at a location and in a form and manner acceptable to FHFA.

§ 1235.7

Supervisory action.

(a) Supervisory action. Failure by a regulated entity or the Office of Finance to comply with this part may subject the regulated entity or the Office of Finance or the board members, officers, or employees thereof to supervisory action by FHFA under the Safety and Soundness Act, including but not limited to cease-and-desist proceedings, temporary cease-and-desist proceedings, and civil money penalties.

(b) No limitation of authority. This part does not limit or restrict the authority of FHFA to act under its safety and soundness mandate, in accordance with the Safety and Soundness Act. Such authority includes, but is not limited to, conducting examinations, requiring reports and disclosures, and enforcing compliance with applicable laws, rules, and regulations.

CHAPTER XVII—OFFICE OF FEDERAL HOUSING ENTERPRISE OVERSIGHT, DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

PART 1732—[Removed]

4. Remove part 1732.

Dated: June 1, 2011.

Edward J. DeMarco,

Acting Director, Federal Housing Finance Agency.

Footnotes

1.  12 U.S.C. 4513b(a)(10) and (11).

2.  12 U.S.C. 4511(b) and 4513(a).

3.  74 FR 38559.

4.  Resolutions of the Federal Housing Finance Board, such as FHFB Resolution 93-50, remain in effect until modified, terminated, set aside, or superseded by the FHFA Director. Sec. 1312(a) of the Housing and Economic Recovery Act of 2008.

5.  12 U.S.C. 4513b(a)(10) and 4514(c). See also 12 U.S.C. 1829b.

6.  Public Law 107-204, 116 Stat. 745 (2002).

7.  17 CFR part 210.