What Happened?
On November 29, 2024, the Federal Housing Finance Agency (“FHFA”) released Advisory Bulletin AB 2024-06 (the “Advisory Bulletin”), which sets forth FHFA’s expectations and guidance for Fannie Mae and Freddie Mac (the “GSEs”) and the Federal Home Loan Banks (collectively, the “Regulated Entities”) regarding compliance with the prohibition against unfair and deceptive acts or practices under Section 5 of the Federal Trade Commission Act (“FTC Act”). The Advisory Bulletin follows the FHFA Final Rule on Fair Lending, Fair Housing, and Equitable Housing Finance Plans published in the Federal Register in May 2024 (“Final Rule”).
Why It Is important?
While the Advisory Bulletin applies directly to the Regulatory Entities, any company that does business with the GSEs or the Federal Home Loan Banks should take note, as there likely will be downstream implications. The Regulated Entities are required to certify compliance with Section 5 of the FTC Act. The Advisory Bulletin, however, raises several concerns.
First, the Advisory Bulletin conflates Section 5 UDAP compliance and fair lending principles. The Bulletin cautions that Regulated Entities are not only subject to the prohibition in Section 5 of the FTC Act against “unfair or deceptive acts or practices in or affecting commerce” but also the Fair Housing Act, the Equal Credit Opportunity Act (“ECOA”) and implementing regulations. To that end, the Final Rule requires the Board of Directors of Regulated Entities to bring their operations into compliance with these obligations in their “oversight of the [R]egulated [E]ntity and its business activities.” However, while the stated intent of the Advisory Bulletin is to provide guidance to the Regulated Entities consistent with the FTC Act, the Advisory Bulletin lumps together UDAP and discrimination, reminiscent of the CFPB’s similar attempt in 2022. In carefully worded language, FHFA states that its UDAP expectations “complement FHFA’s expectations regarding compliance with applicable fair lending laws.” And, specifically with respect to “unfairness,” FHFA states that its “duty to affirmatively further fair housing” may be considered when determining whether an act or practice is unfair. Yet any rule or bulletin by the FHFA providing that a violation of Section 5 of the FTC Act may be a violation of other federal and state laws (including fair housing, fair lending, and other consumer protection laws) undoubtedly extends fair lending laws beyond the bounds carefully set by Congress. See American Bankers Association, Unfairness and Discrimination: Examining the CFPB’s Conflation of Distinct Statutory Concepts (June 2022).
Second, the Advisory Bulletin suggests various theories of liability for violations of Section 5 of the FTC Act. In particular, the Advisory Bulletin points out that, in addition to direct liability for UDAP violations, the Regulated Entities may be held vicariously liable for UDAPs resulting from the conduct of their employees, agents, or third parties (depending on the Entity’s control or other legal responsibility over the third party’s conduct) regardless of whether such Entity knew or should have known of that conduct consistent with agency law. Moreover, the Regulated Entity may be liable for failing to take prompt action to correct UDAP violations in certain circumstances. Here again, the Advisory Bulletin conflates UDAP with fair lending, as the Bulletin delves into liability principles typically applicable to the Fair Housing Act and ECOA.
Finally, given the potential liability to the Regulated Entities for the conduct of its agents or other third parties, the Advisory Bulletin may serve to further incentivize the Agencies to act as de facto regulators in their oversight of single-family and multi-family seller servicer relationships. Not surprisingly, the Advisory Bulletin reminds the Regulated Entities of the importance of “assessing, monitoring, and taking corrective action related to legal, compliance, and reputation risks associated with potential sellers and servicers, including risks associated with compliance programs, records of compliance, and other relevant information related to compliance with all applicable laws.” Yet, if the GSEs were to exit conservatorship, it remains uncertain what kind of authority they would have to enforce and remediate compliance deficiencies.
What Do I Need To Do?
The Regulated Entities are directed to identify, assess, monitor, and mitigate risks associated with UDAP, including legal, compliance, operational, strategic and reputational risks. Given that the Regulated Entities are required to certify compliance with Section 5 of the FTC Act, companies should expect downstream implications and should work to ensure it has sufficient controls in place to mitigate UDAP risks and avoid unwelcome repurchase demands or rep and warrant breaches.