Non-bank capital requirements
During the pandemic, amid a historically low-interest rate environment, the Federal Housing Finance Agency (FHFA) and the Government National Mortgage Association (GNMA) collaboratively worked to align and formalize new servicer eligibility and capital requirements. The first rounds of updates were effective Sept. 30, 2023, and Dec. 31, 2023, refer to our prior article which walks through these updates.
The following updates are effective Mar. 31, 2024:
Annually, FHFA requires a capital and liquidity plan, including an MSR stress test.
The following updates are effective Dec. 31, 2024:
GNMA is implementing a risk weighted capital model, whereas FHFA is not implementing one.
- Originally required for Dec. 31, 2023, GNMA deferred the effective date until Dec.31, 2024.
- Under the model, adjusted net worth, less excess MSRs divided by risk weighted assets need to be greater than or equal to 6%.
- Excess MSRs are defined as MSRs greater than adjusted net worth.
The following risk weighting will be applied under the model:
- 0% - Cash and cash equivalents
- 0% - Prepaid expenses
- 0% - Reverse mortgages held for investment
- 0% - Ginnie Mae loans eligible for repurchase
- 0% - Adjusted net worth equity adjustments
- 20% - Agency and government loans held for sale
- 50% - Non agency and other loans held for sale
- 250% - Mortgage servicing rights
- 100% - All additional assets
As discussed above, many IMB’s are building servicing portfolios in higher multiples to their annual originations. MSRs are a significant portion of an issuer’s assets, this subjects these IMBs to interest rate volatility affecting MSR valuations. As noted under APM 24-12, Ginnie Mae will offer risk-based capital requirement (RBCR) relief to issuers that demonstrate successful hedging over time.
The APM also highlighted the following takeaways:
- Ginnie Mae will calculate issuer hedging efficacy ratios based on the quarterly Mortgage Bankers' Financial Reporting Form (MBFRF) reports submitted by Issuers.
- Ginnie Mae defines “hedging efficacy” as “proportion of derivative gains/losses used to hedge MSRs relative to the change in MSR values due to market and model change as noted in the MBFRF.”
- Hedging efficacy will be used to determine the MSR value adjustments on a quarterly basis and Ginnie Mae will then take the average of the MSR value adjustments over twelve quarters to determine the percentage by which the issuer’s MSR values will be reduced for RBCR.
- The MSR value adjustments will not affect the Issuers adjusted net worth.
- Issuers who would like relief must submit their MSR value adjustment and the resulting RBCR with their annual audited financial statements.
- If issuers have not hedged in each of the most recent twelve quarters, Ginnie Mae will use the average of hedging performance where hedging results are available, subject to the minimum eligibility requirements.
IMBs and Issuers should refer to Ginnie’s APB 24-12 for the complete listing of the program requirements.
Basel III
The Federal Deposit Insurance Company (FDIC), the Federal Reserve and the Office of the Controller of the Currency (OCC) collaborated to issue new capital rules, known as Basel III Endgame on July 27, 2023. The rules go into effect in July 2025 and are implemented over a three-year period. The new guidelines propose more stringent guidelines for banks with over $100 billion in assets. The new requirements have raised concerns not only for the banks that are impacted, but also for the mortgage industry.
Some of the potential impacts to the mortgage industry included:
- With banks above $100 billion now being required to have more capital, this could force banks to reduce their overall mortgage platform as they allocate their capital.
- Basel III proposes a loan to value (LTV) risk weighted approach to hold loans on the balance sheet. The proposed LTV approach increases the capital required to hold loans. Some banks could reduce the number of mortgages that they originate, which could create more origination flow for the IMBs, but overall could decrease the amount of mortgage originations when combining traditional banks and IMBs.
- More capital is required to hold MSRs, which could create less demand for MSRs and could impact MSR values, and MSR liquidity. This could also limit the availability of MSR financing, as lenders may become less willing to provide funding.
- Lower MSR values could decrease liquidity in the correspondent channel, further straining this segment of the market.
- Over the last couple of years there have been a few warehouse lenders that have already left the space. The capital requirement change could impact how much resources are allocated to warehouse lending and or increase the cost of debt for the facilities.
- Special interest groups are concerned about how this will impact the overall mortgage origination market, still in a challenged environment. With a push to provide affordable housing options, many feel that this would continue to compound the space.
While we are quickly approaching the July 2025 deadline, there has been a lot of debate on Basel III endgame. On Sept.10, 2024, the Federal Reserve issued a re-proposal, with the intent to reduce capital requirements from the original proposal. The following were highlighted as part of the re-proposal:
- The re-proposal raises capital requirements by 9% for global systemically important banks (G-SIBs). Banks with assets between $100 billion and $250 billion are mostly excluded, except for recognizing unrealized gains and losses on certain securities, leading to a 3-4% increase in capital needs long-term. Non-G-SIBs face about a 0.5% rise.
- For mortgages, the re-proposal lowers capital requirements for loans up to 90% loan-to-value but keeps them the same for loans over 90%. It also aims to reduce risk weights for specific mortgage activities to avoid restricting business.
The new guidelines of the re-proposal address the need for banking stability without requiring excessive capital. Some of the special interest groups that raised concern about the impact on IMB’s are more in line with the intent of the re-proposal. Comments are currently being collected, with no finalized timeline for completion.
Amended safeguards to security breaches
Following the U.S. Securities and Exchange Commission (SEC) final rule on cybersecurity risk management, strategy, governance and incident disclosure by public companies issued on July 26, 2023, the Federal Trade Commission (FTC) issued an amendment on Oct. 27, 2023, requiring non-bank financial institutions to report certain data breaches and security issues. The FTC’s safeguards rules require non-bank financial institutions to administer and maintain a security protocol to safeguard consumer information. The amendment requires these institutions to notify the FTC if there is a security breach involving data of at least 500 customers where unencrypted information has been obtained without the approval of the customer. Non-bank financial institutions should provide the notification as soon as the impact is known, but within 30 days of the incident.
Although many public companies have prepared for the SEC's final rule on disclosing material cyber incidents, the recent FTC amendment imposes additional reporting requirements for non-public, non-bank IMBs. These institutions may not have developed similar reporting processes as their public counterparts. These requirements take effect on May 13, 2024.
Following SEC and FTC enhanced reporting on breaches and security issues, Ginnie Mae issued its own cybersecurity incident reporting guidelines under APM 24-02 on March 4, 2024. Issuers must notify Ginnie Mae of cybersecurity incidents within 48 hours of detection. This requires maintaining an effective program for handling potential incidents. Notifications must include the date and time of the incident, known details and the party responsible for follow-up. An incident is defined as any unauthorized access, use, disclosure, alteration, transfer or destruction of confidential or non-public personal information that may impact the issuer's obligations under the guaranty agreement. The requirements also apply to Issuers who subservice portfolios for others.
On May 23, 2024, under Mortgagee Letter 2024-10, the FHA mandated reporting a cybersecurity incident to the Department of Housing and Urban Development (HUD) within 12 hours of detection. Issuers must have an effective program for handling incidents promptly. The report must include the mortgagee's name and ID, incident date, cause, description, impact on sensitive information and affiliated companies, status of the cyber response and a contact for follow-up. An incident is defined as any event jeopardizing the confidentiality, integrity, or availability of information or systems, or violating security policies, affecting the mortgagee's ability to meet FHA obligations.
With a number of new guidelines becoming effective, originators should understand the implications that these guidelines will have on their organization. Originators should consult with their subject matter experts to fully address the impact of adoption.
