INSIGHTS, MORTGAGE
Five rulebooks a nonbank lender is answering to at the same time.
A nonbank lender selling to several investors can carry five rulebooks at once: a federal rule, three contracts and one program requirement, each starting its clock differently.
The question usually arrives from a counterparty, not a regulator.
A warehouse bank, investor or subservicing client asks who performed your last independent penetration test, on what scope and date. The answer is scattered across a federal rule, a Seller/Servicer Guide and your approvals, and nothing reconciles them for you.
Nonbank or bank affiliated, not size, decides your federal rule; this is the nonbank stack, the split on Mortgage.
| Instrument | Why it matters here | Who it reaches, and who it does not |
|---|---|---|
| FTC Safeguards Rule, 16 CFR Part 314 | The federal rule underneath. | Reaches Nonbank financial institutions under FTC jurisdiction. Not Banks, savings associations, federally insured credit unions. Exempt Below 5,000 consumers whose information you maintain (not employees, loans or dollars), 314.6 lifts the written risk assessment (an unwritten one is still owed), testing cadence, written incident response plan and board report. The rest, 314.4(f) and FTC notice included, applies at any size. |
| Fannie Mae Information Security and Business Resiliency Supplement | Every compliance date has passed. | Status Contractual. Clock 36 hours to Fannie Mae, without undue delay, from identification or a reasonable conclusion that an incident may have occurred. Reaches Single-Family sellers and servicers, Multifamily lenders, technology service providers, document custodians, any size. Not Anyone outside a Fannie Mae relationship. |
| Freddie Mac Single-Family Seller/Servicer Guide, Chapter 1302 | A contract: a separate test from the Safeguards Rule. | Clock 48 hours to Freddie Mac from discovering a security incident, third party incidents included. Testing Annual penetration test by a qualified and independent third party, not an internal team; 314.6 does not remove it. Reaches Single-Family Sellers and Servicers, by contract, with no size exemption; Multifamily is separate. Not Anyone outside the relationship. |
| Ginnie Mae APM 24-02 | The earliest trigger: this row expires first. | Clock 48 hours to Ginnie Mae from detecting that a Significant Cybersecurity Incident may have occurred. Reaches Approved Issuers of any size, subservicers included. Not Anyone else, under this memorandum. A document custodian or other participant confirms its own position. |
| HUD Mortgagee Letter 2024-23 | With FHA approval, a second, later clock. | Clock 36 hours to the FHA Resource Center and HUD's Security Operations Center from determining a Reportable Cyber Incident occurred (material disruption or degradation of FHA origination or servicing, actual or reasonably likely). Reaches FHA approved mortgagees, bank or nonbank, any size. Not A lender without FHA approval. Superseded ML 2024-10 and its twelve hour clock, on 2 December 2024. |
| SAFE Act, Regulation H and the NMLS | Decides who examines you. | Reaches Nonbank mortgage companies and their loan originators, licensed state by state through the NMLS and examined by state financial regulators. The split is by employer type, not size. Not Originators at depository institutions, who register federally. It imposes no cybersecurity obligation. Exempt State licensing exemptions vary and are not stated here. This firm does not advise on licensing. |
| Freddie Mac Guide Section 1302.8 and Fannie Mae LL-2026-04 | Since 6 August 2026 both apply. | Requires Freddie Mac Guide 1302.8, from 3 March 2026, and Fannie Mae LL-2026-04, from 6 August 2026, require a Seller/Servicer using AI or machine learning in origination or servicing to hold a written governance framework for it. Reaches Any size, through the contract. Not Anyone outside either contract. |
One federal rule; four of its paragraphs stop at a count.
The count is of consumers whose information you maintain, not employees, revenue, assets or loans. The last row, FTC notice, survives the exception: a clock, not a control.
| Paragraph | What it requires | Exempt below 5,000 consumers under 16 CFR 314.6 |
|---|---|---|
| 314.4(a) | Designate a Qualified Individual | No |
| 314.4(b)(1) | Written risk assessment | Yes |
| 314.4(c) | Multifactor authentication, encryption at rest and in transit, access controls | No |
| 314.4(d)(2) | Annual penetration testing, vulnerability assessment every six months | Yes |
| 314.4(f) | Service provider selection, contracts, periodic assessment | No |
| 314.4(h) | Written incident response plan | Yes |
| 314.4(i) | Annual written report to the board | Yes |
| 314.4(j) | Notify the FTC of a qualifying notification event | No |
Three contracts and one program requirement, four triggers, no size exemption.
Failing one costs approved seller, servicer, Issuer or mortgagee status.
A company relieved of 16 CFR 314.4(d)(2) by the fewer than 5,000 consumers exception at 16 CFR 314.6 may still owe Freddie Mac an annual independent penetration test, which is the sentence in this article that most often surprises a small lender.
State licensing carries no security requirement and decides who examines you.
Your next examination is most likely a state one, but this quarter's demand comes from a counterparty. Two readers, one body of evidence.
THE AI LAYER IN THE STACK
Two counterparties now require a written AI governance framework.
Until March 2026 everything in this stack was about information security. Now the AI requirement comes through the same contract as the incident clocks: vendor AI switched on with no record of who approved it is a contractual gap as well as a governance one, which the AI Governance Assessment closes.
The AI came through vendors already in the file, in document classification, income and asset verification and servicing correspondence. Oversight at 16 CFR 314.4(f), which the count exception does not remove, reached each model the day it was switched on. Vendor data use and model changes go to AI Vendor and Third Party Review; denials a model shapes, to AI in Regulated Decisions.
Five steps to one page you can hand to somebody.
The artifact worth building is one timeline that maps every rulebook onto one incident.
- Count consumers, and date the count: customer information you maintain, not employees, loans, revenue or assets.
- List what you hold: Fannie Mae, Freddie Mac, Ginnie Mae Issuer or subservicer, FHA approval. Each switches a rulebook on or off, changing with each new investor.
- One row per obligation: to whom, what starts it, the window, who decides. Empty rows earn their place, because they are what you say when somebody asks about a requirement that is not yours.
- Name a person, not a department, against each determination; the clock map shows which clock each trigger starts.
- Settle testing and AI in writing: with a counterparty rulebook on, the test is owed whatever the count says, as a dated report of scope and performer, with a named owner and review date; with Fannie Mae or Freddie Mac and a model in use, so is the AI framework (the evidence structure).
What this article claims.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
This article describes method. The firm does not decide whether you are exempt, represent you to a regulator or attest that a finding is closed, and publishes no client names, logos, engagement details or anonymized accounts.
The next step needs nobody's permission: put the count and counterparty list on one page, rows against them, for your incident response owner and counsel. If the testing row is on and empty, close it first; a counterparty asks about it by name. Industry version: Mortgage. Examination side: Examination and Evidence Readiness.
Sources
- 16 CFR Part 314, Standards for Safeguarding Customer Information, eCFR.
- Fannie Mae Information Security and Business Resiliency Supplement, Fannie Mae.
- Fannie Mae Lender Letter LL-2026-04, 8 April 2026, Fannie Mae Single-Family.
- Freddie Mac Single-Family Seller/Servicer Guide, Chapter 1302, including Section 1302.8 added by Bulletin 2025-16, Freddie Mac.
- Ginnie Mae APM 24-02, Cybersecurity Incident Notification Requirement, Ginnie Mae.
- HUD Mortgagee Letter 2024-23, Reportable Cyber Incidents, 2 December 2024, HUD.
- 12 CFR Part 1008, Regulation H, SAFE Mortgage Licensing Act, eCFR.