2024-00731. Prudential Management and Operations Standards

AGENCY:

Federal Housing Finance Agency.

ACTION:

Final rule.

SUMMARY:

The Federal Housing Finance Agency (FHFA) is amending its prudential management and operations standards rule (rule) to clarify that procedural requirements for corrective plans apply to prudential management and operations standards (Standards) established as regulations as well as guidelines, and to make the Office of Finance of the Federal Home Loan Bank System (OF) subject to the rule and some of the existing Standards in the appendix to the rule.

DATES:

This rule is effective February 20, 2024.

FOR FURTHER INFORMATION CONTACT:

Clinton Jones, General Counsel, (202) 649–3006, [e-mail]; or Francisco Medina, Assistant General Counsel, (202) 649–3076, [e-mail]. These are not toll-free numbers. The mailing address is: Federal Housing Finance Agency, 400 Seventh Street SW, Washington, DC 20219. For TTY/TRS users with hearing and speech disabilities, dial 711 and ask to be connected to any of the contact numbers above.

SUPPLEMENTARY INFORMATION:

I. Introduction

A. Background

The Federal Housing Enterprises Financial Safety and Soundness Act (the Safety and Soundness Act) requires the Director of FHFA to establish Standards that address ten subjects relating to the management and operation of the regulated entities, authorizes the Director to establish other Standards in addition to those on the ten listed subjects, and authorizes the Director to establish Standards by regulation or guideline.^[1] The Safety and Soundness Act also addresses FHFA corrective actions if a regulated entity fails to comply with a Standard and requires FHFA to establish some procedures for corrective actions by regulation.^[2] FHFA currently implements these requirements through a procedural rule, 12 CFR part 1236, and Standards that FHFA has established as guidelines set forth in an appendix to the rule, as well as Standards established as regulations or as parts of regulations.^[3]

The current rule and initial Standards, all of which were established as guidelines, were promulgated in 2012. Because FHFA did not then identify any regulations as Standards, the current rule addresses only Standards established as guidelines, which could imply that Standards FHFA has since established as regulations are not covered by the rule's procedures. Neither the current rule nor any Standards apply to OF.

B. Overview of Proposed Amendments to the Rule

On May 4, 2023, FHFA proposed to amend part 1236 to reflect the scope of FHFA's statutory authority to establish Standards as regulations as well as guidelines, and to clarify that the rule's procedural aspects related to corrective actions that may result from failure to comply with a Standard apply equally to Standards established as guidelines or as regulations.^[4] FHFA also proposed to follow a notice-and-comment process to establish Standards as guidelines or to make material modifications of such Standards, and reaffirmed its intention to locate Standards established as guidelines in the appendix to the rule.

FHFA further proposed to amend the rule and the appendix to part 1236 so that OF would be subject to the rule and certain Standards. The Standards FHFA proposed to apply to OF are the General Responsibilities of the Board of Directors and Senior Management, and Standards 1, 2, 8, and 10. Standard 1 addresses “Internal Controls and Information Systems.” Standard 2 addresses “Independence and Adequacy of Internal Audit Systems.” Standard 8 addresses “Overall Risk Management Processes.” Standard 10 addresses “Maintenance of Adequate Records.”

Consistent with the foregoing changes, FHFA also proposed to revise and clarify definitions and make conforming changes to part 1236 and its appendix.

II. Discussion of Comments and Agency Response

A. Overview of Comments Received

FHFA received two comments on its proposed amendments to the rule: one from the Council of Federal Home Loan Banks (Council) and one from the Federal Home Loan Mortgage Corporation (Freddie Mac). The Council commented on the proposed amendments to apply the rule and identified Standards to OF and on the applicability of notice-and-comment rulemaking to the establishment of Standards by guideline. Freddie Mac also commented on the applicability of notice-and-comment rulemaking to the revision or revocation of Standards that had been established by guideline. After carefully reviewing and considering the comments, FHFA has determined to issue the final rule as it was proposed.

B. Applying the Rule and Identified Standards to OF

The Council observed that OF is not a “regulated entity” as defined in the Safety and Soundness Act and is therefore not explicitly subject to section 4513b, which applies to regulated entities. The Council nonetheless noted that FHFA has express general regulatory authority over OF under 12 U.S.C. 4511(b)(2), as FHFA also noted in its proposal, which provides a statutory basis for FHFA to apply the rule and identified Standards to OF. The Council suggested FHFA clarify its authority regarding OF in the rule. FHFA observes that the rule's authority provision already references 12 U.S.C. 4511; on that basis, further clarification of FHFA's authority is not necessary.

The Council asked that FHFA identify the specific purposes of section 4513b that would be served by subjecting OF to the rule and Standards. As the Council noted in its letter, however, OF “is an integral component of the FHLBank System.” OF is the fiscal agent for the Federal Home Loan Bank System, through which the Banks issue consolidated obligations of the System in the public capital markets. OF's role and the activities OF performs for the Banks require OF to have appropriate governance, adequate internal controls and information systems, appropriate risk management, and adequate records maintenance. For those reasons, applying the rule and identified Standards to OF would further the purposes of section 4513b in the same manner that subjecting the Banks to the rule and Standards does.

The Council also requested that FHFA specify “the matters that are not relevant” to OF for purposes of compliance with the identified Standards and raised concerns about potential conflicts between existing regulations and the Standards in the appendix. FHFA notes that its proposal particularly specified the Standards and portions of Standards that would apply to OF; in other words, the proposed amendments specified the matters that are relevant to OF. Moreover, the current version of the rule and the proposed amendments to the rule both specify that in the case of a conflict between a Standard and a regulation, “the regulation shall control.” ^[5]

Finally, the Council requested that FHFA establish an implementation timeframe for OF to comply with the rule and identified Standards. FHFA expects that the interim between publication of the final rule and its effective date will provide OF sufficient time either to come into compliance with the identified Standards or to engage with appropriate FHFA supervision staff on a reasonable timeframe to come into compliance with an identified Standard.

C. Notice-and-Comment Procedures and Standards Established by Guidelines

The Council and Freddie Mac both offered comments on the applicability of notice-and-comment rulemaking to Standards established by guidelines. The current version of the rule provides that the Director may “modify, revoke, or add to the Standards” established by guidelines “by order or notice,” ^[6] consistent with FHFA's authority to issue guidance without going through notice-and-comment rulemaking.^[7]

Based on FHFA's past practice of establishing Standards as guidelines and because FHFA has determined to continue locating all Standards established as guidelines in the appendix to the rule, which would require a Federal Register notice, FHFA proposed amending the rule to require FHFA to provide public notice of and seek public comment on any Standard it planned to establish as a guideline or any material modification to any Standard established as a guideline.^[8] FHFA proposed to retain the right to revoke any Standard established as a guideline at any time by order or notice, as provided in the current version of the rule.

The Council noted that guidance setting forth FHFA's supervisory expectations is not subject to the notice-and-comment rulemaking requirements of the Administrative Procedure Act (APA) and expressed its appreciation for FHFA's proposal to use a notice-and-comment process for Standards FHFA planned to establish by guideline. The Council asked FHFA to clarify whether it would use existing or new advisory bulletins to establish Standards without going through notice-and-comment.

As FHFA explained in the preamble to the proposed amendments, the rule as amended will now require FHFA to establish Standards that are guidelines through a Federal Register notice-and-comment process and to locate all Standards established as guidelines in the appendix to part 1236.^[9] Those procedural requirements would preclude FHFA from using existing or new advisory bulletins to establish Standards as guidelines (although they would permit FHFA to re-cast an advisory bulletin as a Standard following a notice-and-comment process).

Freddie Mac requested that FHFA revoke or modify Standards established as guidelines through a notice-and-comment process in the same way that FHFA proposed to establish such Standards. Freddie Mac suggested that Standards established through the notice-and-comment process are “legislative rules” subject to the APA even if they were established as guidelines; thus, such Standards must be modified or revoked in accordance with procedures for “legislative rules.”

Without opining on whether Standards established as guidelines, using a notice-and-comment process, are “legislative rules,” FHFA has already committed to using a notice-and-comment process when establishing a Standard as a guideline and making any material modification to such a Standard. As it did when promulgating the rule, FHFA again observes that section 4513b authorizes and distinguishes between Standards established as regulations and as guidelines and that the APA does not require guidance to be promulgated through a notice-and-comment process. As a practical matter, however, FHFA also observes that removing a Standard from the appendix to the rule will require a Federal Register notice, which creates the opportunity to request public comment on revocation. FHFA anticipates requesting public comment on revocation in appropriate circumstances, balancing the public interest in application of the Standard and considering other relevant, applicable, regulatory requirements or guidance, with more immediate reduction of any burden imposed by a Standard (or a provision of a Standard) that FHFA has determined is unnecessary.

III. Differences Between Banks and Enterprises

Section 1313(f) of the Safety and Soundness Act (12 U.S.C. 4513(f)), as amended by section 1201 of the Housing and Economic Recovery Act of 2008, requires the Director, when promulgating regulations relating to the Banks, to consider the differences between the Banks and the Enterprises with respect to the Banks' cooperative ownership structure; mission of providing liquidity to members; affordable housing and community development mission; capital structure; and joint and several liability. The Director may also consider any other differences that are deemed appropriate. In preparing this final rule, the Director considered the differences between the Banks (including OF) and the Enterprises as they relate to the above factors and determined that the rule is appropriate.

IV. Regulatory Analyses

A. Paperwork Reduction Act

The final rule does not contain any information collection requirement that would require the approval of the Office of Management and Budget (OMB) under the Paperwork Reduction Act (44 U.S.C. 3501 et seq.). Therefore, FHFA has not submitted any information to OMB for review.

B. Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires that a regulation that has a significant economic impact on a substantial number of small entities, small businesses, or small organizations must include an initial regulatory flexibility analysis describing the regulation's impact on small entities. Such an analysis need not be undertaken if the agency has certified that the regulation will not have a significant economic impact on a substantial number of small entities. 5 U.S.C. 605(b). FHFA has considered the impact of the final rule under the Regulatory Flexibility Act and FHFA certifies that this final rule will not have a significant economic impact on a substantial number of small entities because the regulation applies only to the regulated entities and OF, which are not small entities for purposes of the Regulatory Flexibility Act.

C. Congressional Review Act

In accordance with the Congressional Review Act (5 U.S.C. 801 et seq.), FHFA has determined that this final rule is not a major rule and has verified this determination with the Office of Information and Regulatory Affairs of OMB.

List of Subjects in 12 CFR Part 1236

• Administrative practice and procedure
• Federal home loan banks
• Government-sponsored enterprises
• Office of Finance
• Prudential Management and Operations Standards
• Reporting and recordkeeping requirements

Accordingly, for the reasons stated in the Preamble, FHFA amends part 1236 of chapter XII of title 12 of the Code of Federal Regulations as follows:

PART 1236—PRUDENTIAL MANAGEMENT AND OPERATIONS STANDARDS

1. The authority citation for part 1236 continues to read as follows:

Authority: 12 U.S.C. 4511, 4513(a) and (f), 4513b, and 4526.

2. Revise § 1236.1 to read as follows:

§ 1236.1

Purpose.

This part addresses prudential management and operations standards that are required and authorized by 12 U.S.C. 4513b, including the establishment of Standards by Federal Housing Finance Agency (FHFA) and the processes by which FHFA can notify a regulated entity or the Office of Finance of its failure to operate in accordance with a Standard and direct the regulated entity or the Office of Finance to take corrective action. This part further specifies the possible consequences if any regulated entity or the Office of Finance fails to operate in accordance with an applicable Standard or otherwise fails to comply with this part.

3. Revise § 1236.2 introductory text, remove the definition of “Standards”, and add the definition of “Standard(s)” to read as follows:

§ 1236.2

Definitions.

Unless otherwise indicated, terms used in this part have the meanings that they have in part 1201 of this chapter, in the Safety and Soundness Act, 12 U.S.C. 4501 et seq., or in the Bank Act, 12 U.S.C. 1421 et seq.

* * * * *

Standard(s) means any one (or more) of the prudential management and operations standards established by the Director pursuant to 12 U.S.C. 4513b(a). Standard includes the introductory statement of general responsibilities of boards of directors and senior management of the regulated entities set forth in the appendix to this part.

4. Revise § 1236.3 to read as follows:

§ 1236.3

Prudential standards as regulations or guidelines.

(a) Form. As expressly authorized by 12 U.S.C. 4513b(a), FHFA may establish Standards as regulations or guidelines.

(b) Standards established as guidelines. Each Standard that has been established as a guideline is located in the appendix to this part. FHFA will provide public notice of, and seek public comment on, any Standard it plans to establish as a guideline, or on any material modification to any Standard established as a guideline. FHFA may revoke any Standard established as a guideline at any time by order or notice. Standards established as guidelines are subject to the remedial provisions of §§ 1236.4 and 1236.5.

(c) Standards established as regulations. When establishing a Standard as a regulation or amending such a Standard, FHFA shall follow applicable rulemaking procedures of the Administrative Procedure Act, 12 U.S.C. 553. Standards established as regulations may be set forth as subparts or provisions of this part; or as other parts or subparts, or as provisions of such other parts or subparts, of this chapter XII of title 12. When not set forth as a subpart of this part, the regulation or any provision thereof that is a Standard shall be identified as a Standard in the body of the regulation. Standards established as regulations are subject to this part, including the remedial provisions of §§ 1236.4 and 1236.5, and to the enforcement provisions of 12 U.S.C. chapter 46, subchapter III.

(d) Conflicts. In the case of a direct conflict between a Standard established as a guideline and any FHFA regulation, when it is not possible to comply with both that Standard and the FHFA regulation, the FHFA regulation shall control.

5. Revise § 1236.4 to read as follows:

§ 1236.4

Failure to meet a Standard; corrective plans.

(a) Determination. FHFA may determine, based upon an examination, inspection, or any other information, that a regulated entity or the Office of Finance has failed to meet one or more of the Standards. Failure to meet any Standard may constitute an unsafe and unsound practice for purposes of the enforcement provisions of 12 U.S.C. chapter 46, subchapter III.

(b) Submission of corrective plan. When a regulated entity or the Office of Finance is required to submit a corrective plan, FHFA shall inform the regulated entity or the Office of Finance of that requirement by written notice, which shall also set forth FHFA's determination that the regulated entity or the Office of Finance has failed a particular Standard or Standards. FHFA shall require a regulated entity or the Office of Finance to submit a corrective plan if FHFA determines that the regulated entity or the Office of Finance has failed to meet a Standard established as a regulation. FHFA may require a regulated entity or the Office of Finance to submit a corrective plan for failure to meet a Standard established as a guideline.

(c) Corrective plans —(1) Contents of plan. A corrective plan shall be in writing and shall describe the actions the regulated entity or the Office of Finance will take to correct its failure(s) as determined by FHFA, and the time within which each action will be taken.

(2) Filing deadline —(i) In general. A regulated entity or the Office of Finance must file a corrective plan with FHFA within thirty (30) calendar days of being notified by FHFA of the requirement to file a corrective plan, unless FHFA notifies the regulated entity or the Office of Finance in writing that the plan must be filed within a different time period.

(ii) Other plans or submissions. If a regulated entity must file a capital restoration plan submitted pursuant to 12 U.S.C. 4622, it may submit the corrective plan required under this section as part of the capital restoration plan, subject to the deadline established in accordance with paragraph (c)(2)(i) of this section. If a regulated entity or the Office of Finance is operating under a cease-and-desist order entered into pursuant to 12 U.S.C. 4631 or 4632, or a formal or informal agreement, or must file a response to a report of examination or report of inspection, it may, with the permission of FHFA, submit the corrective plan required under this section as part of its compliance with that order, agreement, or response, subject to the deadline established in accordance with paragraph (c)(2)(i) of this section, but the corrective plan would not become a part of the order, agreement, or response. FHFA may also permit a regulated entity or the Office of Finance to submit a corrective plan required under this section as part of another type of required plan or submission by a regulated entity or the Office of Finance, as deemed appropriate by FHFA.

(d) Amendment of corrective plan. A regulated entity or the Office of Finance that is operating in accordance with an approved corrective plan may submit a written request to FHFA to amend the plan as necessary to reflect any changes in circumstance. Until such time that FHFA approves a proposed amendment, the regulated entity or the Office of Finance must continue to operate in accordance with the terms of the corrective plan as previously approved.

(e) Review of corrective plans and amendments. Within thirty (30) calendar days of receiving a corrective plan or proposed amendment to a plan, FHFA will notify the regulated entity or the Office of Finance in writing of its decision on the plan, will direct the regulated entity to submit additional information, or will notify the regulated entity in writing of any extended deadline for review that FHFA has established.

6. Amend § 1236.5 by revising the introductory text to paragraph (a), paragraph (a)(6), the introductory text to paragraph (c)(1), paragraphs (c)(1)(i), (c)(2) through (4), paragraph (d), and the introductory text to paragraph (e) to read as follows:

§ 1236.5

Failure to submit a corrective plan; noncompliance.

(a) Remedies. If a regulated entity or the Office of Finance fails to submit an acceptable corrective plan under § 1236.4(b), or fails in any material respect to implement or otherwise comply with an approved corrective plan, FHFA shall order the regulated entity or the Office of Finance to correct that deficiency, and may:

* * * * *

(6) Require the regulated entity or the Office of Finance to take any other action that the Director determines will better carry out the purposes of the statute by bringing the regulated entity or the Office of Finance into conformance with the Standards.

* * * * *

(c) * * *

(1) Notice. Except as provided in paragraph (c)(4) of this section, FHFA will notify a regulated entity or the Office of Finance in writing of FHFA's intent to issue an order requiring the regulated entity or the Office of Finance to correct its failure to submit a corrective plan or its failure in any material respect to implement or otherwise comply with an approved corrective plan. Any such notice will include:

(i) A statement that the regulated entity or the Office of Finance has failed to submit a corrective plan under § 1236.4, or has not implemented or otherwise has not complied in any material respect with an approved plan;

* * * * *

(2) Response to notice. A regulated entity or the Office of Finance may file a written response to a notice of intent to issue an order, which must be delivered to FHFA within fourteen (14) calendar days of the date of the notice, unless FHFA determines that a different time period is appropriate in light of the safety and soundness of the regulated entity or the Office of Finance or other relevant circumstances. The response should include:

(i) An explanation of why the regulated entity or the Office of Finance believes that the action proposed by FHFA is not an appropriate exercise of discretion;

(ii) Any recommended modification of the proposed order; and

(iii) Any other relevant information, mitigating circumstances, documentation or other evidence in support of the position of the regulated entity or the Office of Finance regarding the proposed order.

(3) Failure to file response. The failure of a regulated entity or the Office of Finance to file a written response within the specified time period will constitute a waiver of the opportunity to respond and will constitute consent to issuance of the order.

(4) Immediate issuance of final order. FHFA may issue an order requiring a regulated entity or the Office of Finance immediately to take actions to correct a Standards deficiency or to take or refrain from taking other actions pursuant to paragraph (a) of this section. Within fourteen (14) calendar days of the issuance of an order under this paragraph, or other time period specified by FHFA, a regulated entity or the Office of Finance may submit a written appeal of the order to FHFA. FHFA will respond in writing to a timely filed appeal within sixty (60) days after receiving the appeal. During this period, the order will remain in effect unless FHFA stays the effectiveness of the order.

(d) Request for modification or rescission of order. A regulated entity or the Office of Finance subject to an order under this part may submit a written request to FHFA for an amendment to the order to reflect a change in circumstance. Unless otherwise ordered by FHFA, the order shall continue in place while such a request is pending before FHFA.

(e) Agency review and determination. FHFA will respond in writing within thirty (30) days after receiving a response or amendment request, unless FHFA notifies the regulated entity or the Office of Finance in writing that it will respond within a different time period. After considering the response or amendment request from a regulated entity or the Office of Finance, FHFA may:

* * * * *

7. Amend the appendix to part 1236 by:

a. Revising the introductory text to the appendix;

b. Revising the introductory text and paragraphs 1 through 8 and 10 under the undesignated heading “General Responsibilities of the Board of Directors and Senior Management”;

c. In Standard 1, revising paragraphs 1, 4 through 14, and 16;

d. In Standard 2, revising paragraphs 1, 3, 5 through 7, and 11;

e. In Standard 8, revising paragraphs 1 through 3 and 7 through 12; and

f. Revising Standard 10.

The revisions read as follows:

Appendix to Part 1236—Prudential Management and Operations Standards

The following provisions constitute the prudential management and operations standards established as guidelines pursuant to 12 U.S.C. 4513b(a). The General Responsibilities of the Board of Directors and Standards 1, 2, 8, and 10 apply to the Office of Finance as appropriate.

General Responsibilities of the Board of Directors and Senior Management

The following provisions address the general responsibilities of the boards of directors and senior management of the regulated entities as they relate to the matters addressed by each of the Standards, and the general responsibilities of the board of directors and senior management of the Office of Finance to the extent a particular Standard is applicable to the Office of Finance. The descriptions are not a comprehensive listing of the responsibilities of either the boards or senior management, each of whom have additional duties and responsibilities to those described in these Standards.

Responsibilities of the Board of Directors

1. With respect to the subject matter addressed by each applicable Standard, the board of directors of each regulated entity and of the Office of Finance is responsible for adopting business strategies and policies that are appropriate for the particular subject matter. The board should review all such strategies and policies periodically. It should review and approve all major strategies and policies at least annually and make any revisions that are necessary to ensure that such strategies and policies remain consistent with the overall business plan of the entity or the Office of Finance.

2. The board of directors is responsible for overseeing management of the regulated entity or the Office of Finance, which includes ensuring that management includes personnel who are appropriately trained and competent to oversee the operation of the regulated entity and the Office of Finance as it relates to the functions and requirements addressed by each applicable Standard, and that management implements the policies set forth by the board.

3. The board of directors is responsible for remaining informed about the operations and condition of the regulated entity or the Office of Finance, including operating consistently with the applicable Standards, and senior management's implementation of the strategies and policies established by the board of directors.

4. The board of directors must remain sufficiently informed about the nature and level of the regulated overall risk exposures of the entity or the Office of Finance, including, as applicable, market, credit, operational, and counterparty risk, so that it can understand the possible short- and long-term effects of those exposures on the financial health of the regulated entity, including the possible short- and long-term consequences, as applicable, to earnings, liquidity, and economic value. The board of directors should: establish the risk tolerances of the regulated entity or the Office of Finance and provide management with clear guidance regarding the level of acceptable risks; review the entire risk management framework of the regulated entity or the Office of Finance, including policies and entity-wide risk limits at least annually; oversee the adequacy of the actions taken by senior management to identify, measure, manage, and control the risk exposures of the regulated entity or the Office of Finance; and ensure that management takes appropriate corrective measures whenever risk limit violations or breaches occur.

Responsibilities of Senior Management

5. With respect to the subject matter addressed by each applicable Standard, senior management is responsible for developing the policies, procedures and practices that are necessary to implement the business strategies and policies adopted by the board of directors. Senior management should ensure that such items are clearly written, sufficiently detailed, and are followed by all personnel. Senior management also should ensure that the regulated entity or the Office of Finance has personnel who are appropriately trained and competent to carry out their respective functions and that all delegated responsibilities are performed.

6. Senior management should ensure that the regulated entity or the Office of Finance has adequate resources, systems, and controls available to execute effectively the business strategies, policies, and procedures of the entity or the Office of Finance, including operating consistently with each of the applicable Standards.

7. Senior management should provide the board of directors with periodic reports relating to the condition and performance of the regulated entity or the Office of Finance, including the subject matter addressed by each of the applicable Standards, that are sufficiently detailed to allow the board of directors to remain fully informed about the business of the regulated entity or the Office of Finance.

8. Senior management should regularly review and discuss with the board of directors information regarding the risk exposures of the regulated entity or the Office of Finance that is sufficient in detail and timeliness to permit the board of directors to understand and assess the performance of management in identifying and managing the various risks to which the regulated entity or the Office of Finance is exposed.

Responsibilities of the Board of Directors and Senior Management

* * * * *

10. The board of directors and senior management should ensure that the overall risk profile of the regulated entity or the Office of Finance is aligned with its mission objectives.

Standard 1—Internal Controls and Information Systems

Responsibilities of the Board of Directors

1. Regarding internal controls and information systems, the board of directors of each regulated entity and the Office of Finance should adopt appropriate policies, ensure personnel are appropriately trained and competent, approve and periodically review overall business strategies, approve the organizational structure, and assess the adequacy of senior management's oversight of this function.

* * * * *

Framework

4. Each regulated entity and the Office of Finance should have an adequate and effective system of internal controls, which should include a board approved organizational structure that clearly assigns responsibilities, authority, and reporting relationships, and establishes an appropriate segregation of duties that ensures that personnel are not assigned conflicting responsibilities.

5. Each regulated entity and the Office of Finance should establish appropriate internal control policies and should monitor the adequacy and effectiveness of its internal controls and information systems on an ongoing basis through a formal self-assessment process.

6. Each regulated entity and the Office of Finance should have an organizational culture that emphasizes and demonstrates to personnel at all levels the importance of internal controls.

7. Each regulated entity and the Office of Finance should address promptly any violations, findings, weaknesses, deficiencies, and other issues in need of remediation relating to the internal control systems.

Risk Recognition and Assessment

8. Each regulated entity and the Office of Finance should have an effective risk assessment process that ensures that management recognizes and continually assesses all material risks, including credit risk, market risk, interest rate risk, liquidity risk, and operational risk.

Control Activities and Segregation of Duties

9. Each regulated entity and the Office of Finance should have an effective internal control system that defines control activities at every business level.

10. The control activities of each regulated entity and the Office of Finance should include:

a. Board of directors and senior management reviews of progress toward goals and objectives;

b. Appropriate activity controls for each business unit;

c. Physical controls to protect property and other assets and limit access to property and systems;

d. Procedures for monitoring compliance with exposure limits and follow-up on non-compliance;

e. A system of approvals and authorizations for transactions over certain limits; and

f. A system for verification and reconciliation of transactions.

Information and Communication

11. Each regulated entity and the Office of Finance should have information systems that provide relevant, accurate and timely information and data.

12. Each regulated entity and the Office of Finance should have secure information systems that are supported by adequate contingency arrangements.

13. Each regulated entity and the Office of Finance should have effective channels of communication to ensure that all personnel understand and adhere to policies and procedures affecting their duties and responsibilities.

Monitoring Activities and Correcting Deficiencies

14. Each regulated entity and the Office of Finance should monitor the overall effectiveness of its internal controls and key risks on an ongoing basis and ensure that business units and internal and external audit conduct periodic evaluations.

* * * * *

Applicable Laws, Regulations, and Policies

16. Each regulated entity and the Office of Finance should comply with all applicable laws, regulations, and supervisory guidance ( e.g., advisory bulletins) governing internal controls and information systems.

Standard 2—Independence and Adequacy of Internal Audit Systems

Audit Committee

1. The board of directors of each regulated entity and the Office of Finance should have an audit committee that exercises proper oversight and adopts appropriate policies and procedures designed to ensure the independence of the internal audit function. The audit committee should ensure that the internal audit department includes personnel who are appropriately trained and competent to oversee the internal audit function.

* * * * *

3. The audit committee of the board of directors is responsible for monitoring and evaluating the effectiveness of the internal audit function of each regulated entity and the Office of Finance.

* * * * *

Internal Audit Function

5. Each regulated entity and the Office of Finance should have an internal audit function that provides for adequate testing of the system of internal controls.

6. Each regulated entity and the Office of Finance should have an independent and objective internal audit department that reports directly to the audit committee of the board of directors.

7. The internal audit department of each regulated entity and the Office of Finance should be adequately staffed with properly trained and competent personnel.

* * * * *

Applicable Laws, Regulations, and Policies

11. Each regulated entity and the Office of Finance should comply with applicable laws, regulations, and supervisory guidance ( e.g., advisory bulletins) governing the independence and adequacy of internal audit systems.

* * * * *

Standard 8—Overall Risk Management Processes

Responsibilities of the Board of Directors

1. Regarding overall risk management processes, the board of directors is responsible for overseeing the process, ensuring senior management are appropriately trained and competent, ensuring processes are in place to identify, manage, monitor and control risk exposures (this function may be delegated to a board appointed committee), approving all major risk limits, and ensuring incentive compensation measures for senior management capture a full range of risks to the regulated entity or the Office of Finance.

Responsibilities of the Board and Senior Management

2. Regarding overall risk management processes, the board of directors and senior management should establish and sustain a culture that promotes effective risk management. This culture includes timely, accurate and informative risk reports, alignment of the overall risk profile of the regulated entity or the Office of Finance with its mission objectives, and the annual review of comprehensive self-assessments of material risks.

Independent Risk Management Function

3. A regulated entity or the Office of Finance should have an independent risk management function, or unit, with responsibility for risk measurement and risk monitoring, including monitoring and enforcement of risk limits.

* * * * *

Risk Measurement, Monitoring, and Control

7. Each regulated entity and the Office of Finance should measure, monitor, and control its overall risk exposures, reviewing, as applicable, market, credit, liquidity, and operational risk exposures on both a business unit (or business segment) and enterprise-wide basis.

8. Each regulated entity and the Office of Finance should have the risk management systems to generate, at an appropriate frequency, the information needed to manage risk. As applicable, such systems should include systems for market, credit, operational, and liquidity risk analysis, asset and liability management, regulatory reporting, and performance measurement.

9. Each regulated entity and the Office of Finance should have a comprehensive set of risk limits and monitoring procedures to ensure that risk exposures remain within established risk limits, and a mechanism for reporting violations and breaches of risk limits to senior management and the board of directors.

10. Each regulated entity and the Office of Finance should ensure that it has sufficient controls around risk measurement models to ensure the completeness, accuracy, and timeliness of risk information.

11. Each regulated entity and the Office of Finance should have adequate and well-tested disaster recovery and business resumption plans for all major systems and have remote facilitates to limit the impact of disruptive events.

Applicable Laws, Regulations, and Policies

12. As applicable, each regulated entity and the Office of Finance should comply with all applicable laws, regulations, and supervisory guidance ( e.g., advisory bulletins) governing the management of risk.

* * * * *

Standard 10—Maintenance of Adequate Records

1. Each regulated entity and the Office of Finance should maintain financial records in compliance with Generally Accepted Accounting Principles (GAAP), FHFA guidelines, and applicable laws and regulations.

2. Each regulated entity and the Office of Finance should ensure that assets are safeguarded and financial and operational information is timely and reliable.

3. Each regulated entity and the Office of Finance should have a records retention program consistent with laws and corporate policies, including accounting policies, as well as personnel that are appropriately trained and competent to oversee and implement the records management plan.

4. Each regulated entity and the Office of Finance, with oversight from its board of directors, should conduct a review and approval of the records retention program and records retention schedule for all types of records at least once every two years.

5. Each regulated entity and the Office of Finance should ensure that reporting errors are detected and corrected in a timely manner.

6. Each regulated entity and the Office of Finance should comply with all applicable laws, regulations, and supervisory guidance ( e.g., advisory bulletins) governing the maintenance of adequate records.

Sandra L. Thompson,

Director, Federal Housing Finance Agency.

Footnotes

1.  12 U.S.C. 4513b (“section 4513b”).

2.   Id. at 4513b(b)(1)(C).

3.   See12 CFR 1242.1(b), identifying the Enterprise Resolution Planning Regulation as a Standard, and 1240.1(e)(3), identifying provisions of the Enterprise Capital Adequacy Regulation as Standards.

4.  88 FR 28433 (May 4, 2023); correction notice at 88 FR 35780 (June 1, 2023).

5.  In the current rule, see12 CFR 1236.3(c). In the proposed amendments to the rule, see12 CFR 1236.3(d).

6.  12 CFR 1236.3(b).

7.   See generally Perez v. Mortgage Bankers Ass'n, 575 U.S. 92, (2015) (“Not all `rules' must be issued through the notice-and-comment process. Section 4(b)(A) of the [Administrative Procedure Act] provides that . . . the notice-and-comment requirement `does not apply' to `interpretative rules, general statements of policy, or rules of agency organization, procedure, or practice.' ”).

8.  88 FR 28433, 28437 (May 4, 2023) (amending 12 CFR 1236.3(b)).

9.   Id. at 28434. After FHFA initially proposed the rule and Standards in 2011, FHFA received and responded to comments on the Standards as well as the rule. At the time, commenters requested that FHFA provide an opportunity for comment on any future changes to the Standards. FHFA responded that the final rule would not require use of a notice-and-comment rulemaking process to amend the Standards, but that it did “allow [FHFA] the flexibility to seek public comment on particular changes to the guidelines, as [FHFA] deems appropriate. FHFA believes the decision . . . to seek public comment . . . is best addressed on a case-by-case basis when future changes are proposed.” 77 FR 33950, 33954 (June 8, 2012). Since 2012, FHFA has established one additional Standard as a guideline, and it did so through a notice-and-comment process. 80 FR 72327 (Nov. 19, 2015).