Alston & Bird Consumer Finance Blog

mortgage lending

HUD Revises Borrower Residency Requirements for FHA-Insured Mortgages

By

What Happened?

On March 26, 2025, the U.S. Department of Housing and Urban Development (HUD or the Department) issued Mortgagee Letter 2025-09 (ML 2025-09), which updates HUD’s residency requirements for borrower eligibility for mortgages insured by the Federal Housing Administration (FHA). The provisions of ML 2025-09 apply to all FHA Title II Single Family forward and Home Equity Conversion Mortgage (HECM) programs.

HUD indicated that it issued its updated residency requirements in response to (and to align with) recent executive actions by the President “that emphasize the prioritization of federal resources to protect the financial interests of American citizens and ensure the integrity of government-insured loan programs.”  The Department stated that “[c]urrently, non-permanent residents are subject to immigration laws that can affect their ability to remain legally in the country,” which “poses a challenge for FHA as the ability to fulfill long-term financial obligations depends on stable residency and employment.” The update “ensures that FHA’s mortgage insurance programs are administered in accordance with [the Trump] Administration[’s] priorities while fulfilling its mission of providing access to homeownership.”

The provisions of ML 2025-09 may be implemented immediately but are required to be implemented for all FHA-insured mortgages with case numbers assigned on or after May 25, 2025.

Why Does it Matter?

ML 2025-09 removes the Non-permanent Resident sections of the FHA Single Family Housing Policy Handbook 4000.1 (the Handbook), in its entirety, eliminating eligibility for non-permanent resident borrowers, and updating the requirements for permanent residents in the following sections of the Handbook:

  • Residency Requirements (II.A.1.b.ii(A)(9));
  • Residency Requirements (II.B.2.b.ii(A)(4));
  • Non-credit Qualifying Exemptions (II.A.8.d.vi(C)(1)(a)); and
  • Special Documentation and Procedures for Non-credit Qualifying Streamline Refinances (II.A.8.d.vi(C)(5)(b)).

The mortgagee letter clarifies that the burden is on the lender to “determine the residency status of the borrower based on information provided on the mortgage application and other applicable documentation” and notes that a Social Security card is insufficient to prove immigration or work status. Rather, “[t]he U.S. Citizenship and Immigration Services (USCIS) within the Department of Homeland Security provides evidence of lawful permanent resident status.”

In addition to limiting eligibility to U.S. citizens and lawful permanent U.S. residents, ML 2025-09 clarifies that a borrower with citizenship in the Federated States of Micronesia, the Republic of the Marshall Islands, or the Republic of Palau may also be eligible for FHA-insured financing provided the borrower satisfies the same requirements, terms, and conditions as those for U.S. citizens, and the mortgage file includes evidence of such citizenship.

Under the revised guidance, individuals who may be eligible for FHA-insured loans with case numbers assigned on or after May 25, 2025 are limited to (1) U.S. citizens, (2) lawful permanent U.S. residents, and (3) citizens of the Federated States of Micronesia, the Republic of the Marshall Islands, or the Republic of Palau.

Notably, because ML 2025-09 applies prospectively to FHA-insured mortgages with a case number assigned on or after May 25, 2025, the revised requirements would not appear to impact the servicing of existing FHA-insured mortgages made to non-permanent residents, such as the availability of loss mitigation assistance.

What Do I Need to Do?

FHA-approved mortgage lenders should review their policies, procedures, and controls and make any necessary updates to implement the requirements of ML 2025-09 for all FHA-insured mortgages that will have a case number assigned on or after May 25, 2025. Alston & Bird’s Consumer Financial Services Team is actively engaged and monitoring these developments and can assist with any compliance concerns regarding these changes to HUD requirements.

 

New York Passes New Removal Procedures for Officers, Directors, Trustees, and Partners of Any Entity Regulated by Department of Financial Services

By ,

What Happened?

On December 21, 2024, New York Governor Kathy Hochul, signed into law, S7532, which repealed the existing section of the Banking Law addressing the removal of officers, directors, and trustees of banking organizations, bank holding companies and foreign banks (“covered individuals”), and enacted a new section providing a clearer process for removing such individuals and expanding the scope of the removal authority to apply to all entities regulated by the New York Department of Financial Services (“the Department”).

Repealed Section:

The former provisions regarding the removal of covered individuals were limited to banking organizations, bank holding companies, and foreign banks.

The Superintendent of the Department (“the Superintendent”) was authorized to bring an action to the Banking Board (“the Board”) to remove an officer, director, or trustee whenever it found that such individual:

  • violated any law or regulation of the Superintendent of financial services, or
  • “continued unauthorized or unsafe practices . . . after having been ordered or warned to discontinue such practices.”

Note that the Banking Board has not existed since the Department of Financial Services was created in 2011.

The Board would then serve notice of the action to the covered individual to appear before the Board to show why they should not be removed from office. A copy of this notice would be sent to each director or trustee of the banking organization and to each person in charge of and each officer of a branch of a foreign banking corporation.

If after a three-fifths vote by the Board members the Board found that the individual committed such violations, an order would be issued to remove the individual from office.

The removal became effective upon service of the order. The order and findings were not made public, and were only disclosed to the removed individual and the directors or trustees of the banking organization involved. Any such removed individual that participated in the management of such banking organization without permission from the Superintendent would be guilty of a misdemeanor.

Newly Enacted Section:

The new provision expands the removal authority of the Superintendent to apply to all entities regulated by the Department (“covered entities”), including: banks, trust companies, limited purpose trust companies, private banks, savings banks, safe deposit companies, savings and loan associations, credit unions, investment companies, bank holding companies, foreign banking corporations, licensed lenders, licensed cashers of checks, budget planners, mortgage bankers, mortgage loan servicers, mortgage brokers, licensed transmitters of money, and student loan servicers.

The Superintendent is authorized to bring an action to remove such individuals whenever it finds reason to believe that they:

  • caused, facilitated, permitted, or participated in any violation by a covered entity of a law or regulation, order issued by the Superintendent or any written agreement between such covered entity or covered individual and the Superintendent;
  • engaged or participated in any unsafe or unsound practice in connection with any covered entity; or
  • engaged or participated in any willful material act or omitted to take any material act that directly contributed to the failure of a covered entity.

The notice and hearing provisions were changed to allow the Superintendent to serve a statement of charges against the covered individual and a notice of an opportunity to appear before the Superintendent to show cause why they should not be removed from office. A copy of such notice must now be sent to the affected covered entity, instead of the directors or trustees of the covered entity and persons in charge of foreign bank branches.

Additionally, the threshold for removal was changed. Instead of being removed by a three-fifths vote of a board that no longer exists, the covered individual may be removed if, after notice and hearing: (1) the Superintendent finds that the covered individual has engaged in the unlawful conduct, or (2) if the individual waives a hearing or fails to appear in person or by authorized representative.

The order of removal is effective upon service to the individual. The order must also be served to any affected covered entity along with the statement of charges. The order remains in effect until amended, replaced, or rescinded by the Superintendent or a court of competent jurisdiction. Such removed individual is prohibited from participating in the “conduct of the affairs” of any covered entity unless they receive written permission from the Superintendent. If the individual violates such prohibition, they are guilty of a misdemeanor.

Furthermore, the Superintendent is now authorized to suspend the covered individual from office for a period of 180 days pending the determination of the charges if the Superintendent has reason to believe that:

  • a covered entity has suffered or will probably suffer financial loss that impacts its ability to operate in a safe and sound manner;
  • the interests of the depositors at a covered entity have been or could be prejudiced; or
  • the covered individual demonstrates willful disregard for the safety and soundness of a covered entity.

The suspension may be extended for additional periods of 180 days if the hearing is not completed within the previous period due to the request of the covered individual.

Why Does it Matter?

Prior to the update, the Superintendent only had the power to remove individual officers, directors, or trustees from office in various bank organizations. The new law expands this removal power to all entities regulated by the Department.

The amended statute creates an additional penalty for individuals who caused, facilitated, permitted, or participated in the violation of the Banking Law in their positions of power of a regulated entity. Such individuals may be removed from their positions and prohibited from participating in the management of any regulated entity, until they receive written permission from the Superintendent. If they violate the prohibition, they are guilty of a misdemeanor, which can be punished by imprisonment for up to 364 days or by a fine set by the Superintendent.

What Do I Need To Do?

Entities regulated by the Department that are now covered under this section should be aware that violations of law by a licensee may also lead to the removal of certain high-level individuals within the organization. If removed, such individuals would also be prohibited from managing any regulated entity until the Superintendent provides written permission to do so. Affected entities and individuals should take care to ensure compliance with the law to avoid these new penalties.

CFPB’s War on Mortgage Fees Continues

By ,

What Happened?

Immediately following President Biden’s State of the Union Address announcing plans to lower homebuyer and refinancing costs, the CFPB issued a blog post seeking public input on how mortgage closing costs impact consumers. The CFPB also announced that it will work to monitor closing costs and, “as necessary, issue rules and guidance to improve competition, choice and affordability.” Significantly, the CFPB also signaled that it will continue to use its supervision and enforcement tools for companies that fail to comply with the law.

Why Is It Important?

The CFPB is putting companies on notice that the Bureau will be taking a close look at the total loans costs for originating a residential mortgage loan, including origination fees, appraisal fees, credit report fees, title insurance, discount points, and other fees. In particular, the CFPB is paying “significant attention to the recent rise in discount points,” and seems concerned with the lack of competition in connection with certain fees, such as lender’s title insurance and credit reports. The CFPB also has expressed concerns with how companies may charge lender credits and fees that are financed into the loan amount (through higher interest rates or mortgage insurance payments).

While the CFPB’s blog post does not identify any specific laws, it does provide some clues. First, the Bureau is concerned that some closing costs are high and increasing due to lack of competition. According to the Bureau, “[b]orrowers are required to pay for many of the costs associated with closing a home loan but cannot pick the provider and do not benefit from the service.” Taking unreasonable advantage of the inability of a consumer to protect their interests in selecting or using a consumer financial product or service could be construed as abusive under the Dodd-Frank Act’s UDAAP statute.

Because certain fees are fixed and don’t fluctuate with the loan size or interest rate, the Bureau is concerned that such fees could disproportionately impact borrowers with smaller loans, such as low-income borrowers, first-time borrowers, or Black or Hispanic borrowers.  This could present a fair lending problem under the Equal Credit Opportunity Act. Indeed, the CFPB already has announced that, pursuant to its authority to prevent unfair, deceptive, and abusive acts or practices (“UDAAPs”), the Bureau will begin examining institutions for alleged discriminatory conduct that the Bureau deems to be unfair.

Of course, Congress passed the Dodd-Frank Act to address many of the above concerns, and the TRID Rule already attempts to ensure that consumers are provided with greater and more timely information on the nature and costs of the residential real estate settlement process and are protected from unnecessarily high settlement charges.

What Do I Need to Do?

The CFPB is sending a strong message to the industry that closing fees will be receiving scrutiny from the CFPB.  And knowing that the CFPB has been on a hiring spree in its enforcement division, now is a good time to take a close look at the fees being charged from both a UDAAP and fair lending perspective.  The team at Alston & Bird has deep knowledge on mortgage fees and is happy to assist with such a review.

Ginnie Mae Imposes Cybersecurity Incident Notification Obligation

By ,

What Happened?

On March 4, 2024, Ginnie Mae issued All Participant Memorandum (APM) 24-02 to impose a new cybersecurity incident notification requirement. Ginnie Mae has also amended its Mortgage-Backed Securities Guide to reflect this new requirement.

Effective immediately, all Issuers, including subservicers, of Ginnie Mae Mortgage-Backed Securities (Issuers) are required to notify Ginnie Mae within 48 hours of detection that a “Significant Cybersecurity Incident” may have occurred.

Issuers must provide email notification to Ginnie Mae with the following information:

  • the date/time of the incident,
  • a summary of in the incident based on what is known at the time of notification, and
  • designated point(s) of contact who will be responsible for coordinating any follow-up activities on behalf of the notifying party.

For purposes of this reporting obligation, a “Significant Cybersecurity Incident” is “an event that actually or potentially jeopardizes, without lawful authority, the confidentiality, integrity of information or an information system; or constitutes a violation of imminent threat of violation of security policies, security procedures, or acceptable use policies or has the potential to directly or indirectly impact the issuer’s ability to meet its obligations under the terms of the Guaranty Agreement.”

Once Ginnie Mae receives notification, it may contact the designated point of contact to obtain further information and establish the appropriate level of engagement needed, depending on the scope and nature of the incident.

Ginnie Mae also previewed that it is reviewing its information security requirements with the intent of further refining its information security, business continuity and reporting requirements.

Why Is It Important?

Under the Ginnie Mae Guarantee Agreement, Issuers are required to furnish reports or information as requested by Ginnie Mae.  Any failure of the Issuer to comply with the terms of the Guaranty Agreement constitutes an event of default if it has not been corrected to Ginnie Mae’s satisfaction within 30 days.  Moreover, Ginnie Mae reserves the right to declare immediate default if an Issuer receives three or more notices for failure to comply with the Guarantee Agreement.  It is worth noting that an immediate default also occurs if certain acts or conditions occur, including the “submission of false reports, statements or data or any act of dishonestly or breach of fiduciary duty to Ginnie Mae related to the MBS program.”

Ginnie Mae’s notification requirement adds to the list of data breach notification obligations with which mortgage servicers must comply. For example, according to the Federal Trade Commission, all states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information. In addition, depending on the types of information involved in the breach, there may be other laws or regulations that apply. For example, with respect to mortgage servicing, both Fannie Mae and Freddie Mac impose notification obligations similar to that of Ginnie Mae.

What Do I Need to Do?

If you are an Issuer and facing a cybersecurity incident, please take note of this reporting obligation. For Issuers who have not yet faced a cybersecurity incident, now is the time to ensure you are prepared as your company could become the next victim of a cybersecurity incident given the rise in cybersecurity attacks against financial services companies.

As regulated entities, mortgage companies must ensure compliance with all the applicable reporting obligations, and the list is growing.  Our Cybersecurity & Risk Management Team can assist.

New York DFS to Impose Climate Change Safety and Soundness Expectations on Mortgage Lenders, Servicers, and other Regulated Organizations

By

What Happened?

On December 21, 2023, the New York Department of Financial Services (“NYDFS”) published an 18-page guidance document (the “Guidance”) on managing material, financial and operational risks due to climate change. The NYDFS issued the Guidance after considering feedback it received on proposed guidance it issued in December 2022 on the same topic. The Guidance applies to New York State regulated mortgage lenders and servicers, as well as New York State regulated banking organizations, licensed branches and agencies of foreign banking organizations (collectively, “Regulated Organizations”).

Why Is It Important?

The NYDFS has set forth its expectations, replete with examples, for Regulated Organizations to strategically manage climate change-related financial and operational risks and identify necessary actions proportionate to their size, business activities and risk profile.  Such expectations include:

  • Corporate Governance: An organization’s board of directors should establish a risk management framework, including its overall business strategy and risk appetite, which include climate related financial and operational risks, and holding management accountable for implementation. Such framework should be integrated within an organization’s three lines of defense – quality assurance, quality control and internal audit. Recognizing that low and moderate income (“LMI”) communities may be adversely impacted from climate change, the NYDFS expects an organization’s board of directors to direct management to “minimize and affirmatively mitigate disproportionate impacts” which could violate fair lending and other consumer finance laws. On that note, the NYDFS reminds organizations to consider opportunities to mitigate financial risk through financing or investment opportunities which enhance climate resiliency and are eligible for credit under the New York Community Reinvestment Act.
  • Internal Control and Risk Management: Regulated Organizations should also consider and incorporate climate related financial risks when identifying and mitigating all types of risks, including credit, liability, market, legal/compliance risk, and operational and strategic risk. The NYDFS defines financial risks from climate change to include physical risks from more intense weather events as well as transition risks, resulting from “economic and behavior changes driven by policy and regulation, new technology, consumer and investor preferences and changing liability risks.” The NYDFS recognizes that insurance is an important mitigant to climate change risk but cautions that the availability of such insurance in the future is not guaranteed.
  • Data Aggregation and Reporting: Regulated Organizations should establish systems to aggregate data and internally report its efforts to monitor climate related financial risk to facilitate board and senior management decision making. Such organizations also should consider developing and implementing climate scenario analyses.

What Do You Need to Do?

The NYDFS stresses that organizations should not let “uncertainty and data gaps justify inaction.” Although the NYDFS has not issued a timeline for implementation of the Guidance or begun incorporating such expectations into examinations (which will be coordinated with the prudential regulators to align with joint supervisory processes), now is the time to begin integrating climate-related financial and operational risks into your company’s organizational structure, business strategies and risk management operations.  This will help you prepare for when your organization is required to respond to the request for information which the NYDFS anticipates sending out later this year.  It is anticipated that the NYDFS will ask for information on the steps your organization has taken or will take within a specified period to manage financial and operational climate-related risks, including government structure, business strategy, risk management, operational resiliency measures, and metrics to measure risks.