MORTGAGE, THE SPECIALIZATION
Five rulebooks, four counterparties, and clocks that start at different moments.
A mortgage company can answer to five rulebooks at once, each starting its clock at a different moment. Nothing reconciles them for you.
Discovery FTC Identification Fannie Mae Discovery Freddie Mac Detection Ginnie Mae Determination FHA
Nonbank or bank affiliated decides the rest.
Which rulebooks reach you turns on this, not on your size. The wrong answer produces the wrong program, not a smaller one.
- Nonbank lender, broker or servicer
- A Gramm-Leach-Bliley financial institution without a prudential banking regulator. Your rule is the FTC Safeguards Rule, 16 CFR Part 314, read with 16 CFR 314.6.
- Bank or thrift affiliate
- Generally the banking guidelines, the operative appendix set by the charter. The FTC's rule is not yours.
A warehouse line or bank sponsor can complicate the answer; ask your counsel, not a vendor.
Four Safeguards paragraphs apply only at 5,000 or more consumers.
Two counts decide this rule, neither of them size: consumers whose information you maintain, and consumers a notification event reaches.
| Paragraph | What it requires | Exempt below 5,000 consumers under 16 CFR 314.6 |
|---|---|---|
| 314.4(a) | Designate a Qualified Individual | No |
| 314.4(b)(1) | Written risk assessment | Yes |
| 314.4(c) | Multifactor authentication, encryption at rest and in transit, access controls | No |
| 314.4(d)(2) | Annual penetration testing, vulnerability assessment every six months | Yes |
| 314.4(f) | Service provider selection, contracts, periodic assessment | No |
| 314.4(h) | Written incident response plan | Yes |
| 314.4(i) | Annual written report to the board | Yes |
| 314.4(j) | Notify the FTC of a qualifying notification event | No |
FTC Safeguards Rule, 16 CFR Part 314, read with the exception at 16 CFR 314.6
- Risk assessment
- Still required under 314.4(b); only the written form is excepted.
- Cadence
- 314.4(d)(2) testing applies absent continuous monitoring, and again after a material change.
- A tenant
- 314.4(c) governs a cloud tenant.
- Reaches
- Nonbank financial institutions under FTC jurisdiction, mortgage lenders, brokers and servicers included.
- Not
- Banks, savings associations, federally insured credit unions.
- Counted
- Consumers whose customer information you maintain, not employees, revenue, assets or loans: a long established broker with a small payroll may be well over 5,000; a newer lender writing large balances may not be.
FTC notification, 16 CFR 314.4(j)
Since 13 May 2024, a covered institution notifies the FTC as soon as possible and no later than 30 days after discovering a notification event involving the unencrypted customer information of 500 or more consumers. No consumer count exempts it; below 500 it never starts. State breach duties run separately.
Four counterparty rulebooks, four clocks, no size exemption.
Three are contracts, one a program requirement, none supervision. Failing one costs approved status, and with it the ability to sell and insure loans; one incident procedure written to one misses the other three.
| Who owes it | What starts it | The window |
|---|---|---|
| Fannie Mae sellers and servicers | Identification Identification, or the reasonable conclusion that an incident may have occurred | 36 hours, to Fannie Mae, without undue delay |
| Freddie Mac Sellers and Servicers | Discovery Discovery of a security incident, including one affecting a third party | 48 hours, to Freddie Mac |
| Approved Ginnie Mae Issuers | Detection Detecting that a Significant Cybersecurity Incident may have occurred | 48 hours, to Ginnie Mae |
| FHA approved mortgagees | Determination Determining that a Reportable Cyber Incident has occurred, meaning one that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the ability to originate or service FHA insured mortgages | 36 hours, to the FHA Resource Center and HUD's Security Operations Center, under Mortgagee Letter 2024-23 |
Every row, and who each does not reach, on the notification clock map
A company relieved of 16 CFR 314.4(d)(2) by the fewer than 5,000 consumers exception at 16 CFR 314.6 may still owe Freddie Mac an annual independent test: the Guide is a contract, not the Safeguards Rule.
Fannie Mae Information Security and Business Resiliency Supplement
Contractual, and its compliance dates have all passed: Single-Family sellers and servicers 12 August 2025, technology service providers 31 December 2025, document custodians 1 April 2026.
Those three and Multifamily lenders, at any size. Not an entity that neither sells to nor services for Fannie Mae.
Freddie Mac Single-Family Seller/Servicer Guide, Chapter 1302
Chapter 1302 requires penetration testing at least annually by a qualified and independent third party, on systems that handle Freddie Mac information or connect to its systems. An internal team cannot satisfy it. Sections 1302.2 and 1302.3 were revised by Bulletin 2025-13 effective 1 January 2026.
Single-Family Sellers and Servicers, and anyone handling its information or systems, with no size exemption of any kind. Not anyone outside the relationship; Multifamily is separate.
Ginnie Mae APM 24-02
Issued 4 March 2024. The word significant carries the threshold, and the defined term is broad: an event that actually or potentially jeopardizes the confidentiality, integrity or availability of information or a system, or violates or threatens to violate security policy, or has the potential to affect the Issuer's ability to meet its Guaranty Agreement obligations. Any one limb is enough.
Approved Issuers only, subservicers included, at any size. A document custodian or other participant confirms its own position under the current memoranda.
HUD Mortgagee Letter 2024-23, Reportable Cyber Incidents
Dated 2 December 2024, it superseded Mortgagee Letter 2024-10 and its twelve hour clock from detection, so a procedure written to it runs from the wrong moment, to the wrong number. An Issuer that is also an FHA mortgagee runs both clocks, from two moments.
FHA approved mortgagees, bank and nonbank, at any size. Not a lender without FHA approval.
Counterparty questionnaires usually fail on the evidence, not the control: the dated artifact, the named owner, the event that refreshes it. Security Assessment shows that structure.
Origination and servicing differ in exposure, not scale.
- Origination
- A wide, short lived vendor chain, point of sale to settlement: access, transfer and retention after closing.
- Servicing
- A narrow, permanent chain: entitlement review, and what a subservicer reaches on your behalf.
Your most likely next examination is a state examination.
SAFE Act, Regulation H and the NMLS
The SAFE Act imposes no cybersecurity obligation. It decides who examines you: state financial regulators, in Louisiana the Office of Financial Institutions. The division is by employer type, not size; state licensing exemptions vary and are not stated here. This firm does not advise on licensing.
Nonbank mortgage companies and their loan originators, licensed through the NMLS. Not depository originators, who register federally and are examined by the depository's supervisor.
The readiness work is the same either way: Examination and Evidence Readiness.
New York reaches you through your authorization, not your borrowers.
NYDFS Cybersecurity Regulation, 23 NYCRR Part 500
New York licensed mortgage bankers, brokers, servicers and insurance licensees are Covered Entities under 23 NYCRR Part 500; the final amended requirements took effect on 1 November 2025. One that is not exempt owes the CISO designation, penetration testing, multifactor authentication for user access, a documented asset inventory, an annual certification of material compliance or acknowledgment of noncompliance with a remediation plan, and the 500.17 notices: 72 hours to the Superintendent from determining that a cybersecurity incident, narrower than an event since the Second Amendment, has occurred, and 24 hours after an extortion payment, with a written explanation within 30 days.
| Test | The threshold | What is counted |
|---|---|---|
| People | Fewer than 20 employees and independent contractors | Those of the entity and its affiliates |
| Revenue | Under $7.5 million in gross annual revenue in each of the last three fiscal years | All of the entity's own business operations wherever conducted, plus its affiliates' New York operations |
| Assets | Under $15 million in year end total assets | Calculated under GAAP, including the assets of all affiliates |
Read the revenue limb carefully: your own revenue counts in full wherever it is earned, and the New York limitation attaches only to the affiliates' operations.
A limited exempt entity is relieved of the CISO designation, penetration testing and vulnerability assessments and the written incident response plan, among others, never of 500.17. Under 500.12(a) its multifactor duty narrows to remote access to its information systems, remote access to third party applications from which nonpublic information is accessible, and privileged accounts other than service accounts that prohibit interactive login. Further exemptions: 500.19(b) to (e), the insurance ones on Insurance.
Holders of a DFS license, registration, charter or similar authorization. Not a firm merely doing business with or lending to a New York resident. Other states and counterparties borrow from this text.
Two counterparties now require AI governance in writing.
AI entered the loan workflow through your vendors. Document classification came to origination first; correspondence and loss mitigation triage now reach servicing, and a borrower in distress. 16 CFR 314.4(f) reaches every vendor at any consumer count, so one that adds AI stays in your vendor review; a SOC 2 alone does not discharge that duty (how to read one). When a model shapes a denial, see AI in Regulated Decisions. The one AI rule in force covers one use: the AVM quality control rule.
Freddie Mac Section 1302.8 and Fannie Mae LL-2026-04
Both require a Seller/Servicer that uses AI or machine learning in origination or servicing to hold a written governance framework for it. Since 6 August 2026 both apply.
| Element | Freddie Mac 1302.8 | Fannie Mae LL-2026-04 |
|---|---|---|
| In force | 3 March 2026, by Bulletin 2025-16 of 3 December 2025 | 6 August 2026, 120 days after its 8 April 2026 issue |
| Policies | Policies, processes and procedures for mapping, measuring and managing AI risk | Written policies and procedures |
| Accountability | Named, trained roles | A designated owner who reviews them at least annually |
| Security | Assessment for data poisoning and adversarial input | Compliance with the Information Security and Business Resiliency Supplement |
| Audit | Regular internal and external audit | Not listed |
| Monitoring | Performance, security and bias | Not listed |
| Vendors | Vendor AI within the framework and its external audit | Vendor and subcontractor AI governed no less protectively |
| Disclosure | Not listed | On request, promptly: the types of AI in use, their purpose and safeguards |
Section 1302.8 uses the NIST framework's terms of mapping, measuring and managing AI risk; it does not adopt the framework.
A Seller/Servicer through its contract, whatever its size; not a company outside both. The AI Governance Assessment and Program build the inventory, tiering, approval record and monitoring; the AI Vendor and Third Party Review answers the vendor element.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
What changes when the work is done.
| Before | After |
|---|---|
| Five rulebooks, one questionnaire at a time | One evidence set mapped to all five |
| An exemption assumed from size | Established against the paragraph that grants it, or ruled out |
| Clocks never set side by side | One timeline, a named person per trigger |
| A test by whoever built the system | A qualified and independent third party, as contracted |
| Vendor AI on, approver unrecorded | An AI use register and approval record shaped to 1302.8 and LL-2026-04 |
Bring the questionnaire, the finding or the counterparty letter.
Name your counterparties, any FHA approval or New York authorization, your rough consumer count and any vendor AI.