Federal Deposit Insurance Corporation
Office of Inspector General
Federal Deposit Insurance Corporation - Office of Inspector General

FDIC’s Implementation of Consumer Protection Rules Regarding Ability to Repay Mortgages and Compensation for Loan Originators

This is the accessible text file for FDIC OIG report number EVAL-18-001 entitled 'FDIC’s Implementation of Consumer Protection Rules Regarding Ability to Repay Mortgages and Compensation for Loan Originators'.

This text file was formatted by the FDIC OIG to be accessible to users with visual impairments.

We have maintained the structural and data integrity of the original printed product in this text file to the extent possbile. Accessibility features, such as descriptions of tables, footnotes, and the text of the Corporation’s comments, are provided but may not exactly duplicate the presentation or format of the printed version.

The portable document format (PDF) file also posted on our Web site is an exact electronic replica of the printed version.

FDIC’s Implementation of Consumer Protection Rules Regarding Ability to Repay Mortgages and Compensation for Loan Originators

Report No. EVAL-18-001

December 2017

Executive Summary

Why We Did The Evaluation

A contributing cause of the 2008-2011 financial crisis involved financial institutions that promoted mortgage loans with predatory characteristics to borrowers who could not afford to repay the loans. The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) amended existing consumer financial laws to help ensure that financial institutions offer loans suitable to a consumer’s financial situation and the consumer understands a loan’s repayment terms. We initiated this evaluation because of the importance of consumer protection requirements in the Dodd-Frank Act and the Division of Depositor and Consumer Protection’s (DCP) responsibility for implementing the final rules.

Our objective was to assess the FDIC’s implementation of selected consumer protection rules. We focused on two rules that placed new requirements on the banking industry to (1) determine if a consumer has a reasonable ability to repay a mortgage loan and (2) limit loan originator compensation and subject loan originators to new requirements.

We reviewed a judgmental sample of 12 DCP compliance examinations completed in 2016 to assess DCP’s coverage of these rules and related workpaper documentation.

Background

In the wake of the 2008-2011 financial crisis, Congress passed the Dodd-Frank Act, which, among other things, amended the Truth in Lending Act and other consumer financial laws. The Dodd-Frank Act also established the Consumer Financial Protection Bureau (CFPB) and granted it authority to conduct rulemaking with respect to federal consumer financial laws. The CFPB implemented these amendments through a number of final rules. The FDIC and the other banking regulators were responsible for implementing the rules in their supervision programs. The following two rules relate to loan suitability and took effect on January 10, 2014:

Ability-to-Repay and Qualified Mortgage Standards under the Truth in Lending Act (Regulation Z) (herein referred to as the ATR/QM rule). This rule directed most mortgage lenders (lenders) to make a reasonable and good-faith determination, at or before loan consummation, that a consumer would have a reasonable ability to repay a residential mortgage loan according to its terms. Some lenders and loan programs are exempt from this requirement.

Loan Originator Compensation Requirements under the Truth in Lending Act (Regulation Z) (herein referred to as the Loan Originator rule). This rule placed limits on loan originator compensation and imposed new requirements on loan originators.

Evaluation Results

We found that DCP took steps to implement the ATR/QM and Loan Originator rules. DCP incorporated these rules into its examination program, trained its examiners, and communicated regulatory changes to FDIC-supervised institutions.

DCP also tracks financial institution violations of the rules and reasons for those violations. In this regard, we identified regional variances in the number of rule violations in relation to the number of banks examined. However, we could not assess the significance of the variances because DCP did not track how many institutions were subject to the rules and how frequently examiners elected to test compliance with the rules. DCP management should track such information to (1) better understand the impact the rules have on FDIC-supervised institutions, (2) put the frequency of examination findings and violations into context, (3) determine to what extent examiners are reviewing or electing to not review compliance with the rules, and (4) assess institution compliance and examination coverage trends by FDIC regional office.

We also found that examination workpapers needed improvement based on our sample of 12 examinations. Examiners did not consistently document why they excluded compliance testing for the ATR/QM and Loan Originator rules. Further, in some instances, examiners’ workpapers were incomplete, filled out incorrectly, or not stored in accordance with DCP policy, which would preclude someone independent of the examination team from fully understanding examination findings and conclusions, based on the workpapers alone.

Recommendations We made four recommendations to DCP to strengthen its compliance examination process. We recommended that DCP (1) research potential reasons for the regional variances in the number of rule violations by banks in the FDIC’s six regional offices, (2) track the aggregate number of FDIC-supervised institutions in each region that are subject to the rules, (3) track how often examiners test for compliance with the rules, and (4) take steps to improve workpaper documentation and retention. DCP concurred with our recommendations and proposed corrective actions to be completed by June 30, 2018.

[End of Executive Summary]

Table of Contents

Background

Evaluation Results

DCP Incorporated the ATR/QM and Loan Originator Rules Into Its Examination Program and Other Guidance

DCP Trained Its Examiners on the New Rules

DCP Communicated Regulatory Changes to FDIC-Supervised Institutions

DCP Tracks Rule Violations But Should Enhance Its Program Monitoring Efforts

Recommendations 1 - 3

DCP Examination Workpapers Need Improvement

Recommendation 4

Corporation Comments and OIG Evaluation

Appendices

1. Objective, Scope, and Methodology

2. Sample of 12 DCP Examinations Reviewed by the OIG

3. Glossary of Terms

4. Acronyms and Abbreviations

5. Corporation Comments

6. Summary of the Corporation’s Corrective Actions

Tables

1. Qualified and Non-Qualified Mortgages

2. Mandatory Training for DCP Examiners

3. DCP Outreach to Financial Institutions

4. 2016 Violations by Region for the ATR/QM and Loan Originator Rules

Figure: DCP’s Compliance Examination Process

[End of Table of Contents]

[FDIC letterhead, Federal Deposit Insurance Corporation, Office of Inspector General Office of Program Audits and Evaluations, 3501 Fairfax Drive, Arlington, VA 22226]

MEMORANDUM TO: Mark Pearce, Director, Division of Depositor and Consumer Protection /Signed/ FROM: E. Marshall Gentry, Assistant Inspector General for Program Audits and Evaluations

SUBJECT: FDIC’s Implementation of Consumer Protection Rules Regarding Ability to Repay Mortgages and Compensation for Loan

A contributing cause of the 2008-2011 financial crisis1 involved financial institutions’ promotion of mortgage loans with predatory lending characteristics to borrowers who could not afford to repay the loans. These risky loans generated higher profit margins than safer, traditional loans, and loan originators were incentivized to market these loans. The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act)2 established the Consumer Financial Protection Bureau (CFPB) and amended existing consumer financial laws to help ensure that financial institutions offer loans suitable to a consumer’s financial situation and the consumer understands a loan’s repayment terms. The CFPB implemented these amendments through a number of final rules that placed new requirements on the banking industry. We initiated this evaluation because of the importance of consumer protection requirements in the Dodd-Frank Act and the FDIC’s Division of Depositor and Consumer Protection’s (DCP) responsibility for implementing the final rules.

Our objective was to assess the FDIC’s implementation of selected consumer protection rules. We focused on two rules that placed new requirements on the banking industry by (1) directing most mortgage lenders (lenders) to determine if a consumer has a reasonable ability to repay a mortgage loan or other consumer credit transaction secured by a dwelling3 and (2) limiting loan originator compensation and subjecting loan originators to new requirements.

To address our objective, we assessed how DCP:

-incorporated these rules into its examination programs and other guidance;

-trained its examiners with respect to these rules; -communicated regulatory changes to FDIC-supervised institutions; and

-monitored implementation of these rules in its examination programs.

Footnote 1: Certain terms are underlined when first used in this report and defined in Appendix 3, Glossary of Terms. [End of footnote] Footnote 2: Public Law 111-203, enacted July 21, 2010. [End of footnote]

Footnote 3: Some lenders and loan programs are exempt from this requirement. See 12 Code of Federal Regulations (C.F.R.) 1026.43(a)(3)(iv) to (vi) for exceptions. [End of footnote]



We reviewed a judgmental sample of 12 DCP compliance examinations completed in 2016 and related workpaper documentation to assess DCP’s coverage of these rules. We interviewed DCP examiners, Regional Directors, and CFPB officials to better understand DCP’s process for implementing the rules.

We evaluated DCP’s program efforts in relation to the Government Accountability Office’s (GAO) Standards for Internal Control in the Federal Government (GAO Internal Control Standards), which provides managers with a framework and criteria for designing, implementing, and operating an effective internal control system. Appendix 1 of this report includes additional details on our objective, scope, and methodology.

Background

In the wake of the 2008-2011 financial crisis, Congress passed the Dodd-Frank Act, which, among other things, amended the Truth in Lending Act (Regulation Z)4 and other consumer financial laws. The Dodd-Frank Act also established the CFPB and granted it authority to conduct rulemaking with respect to federal consumer financial laws. The CFPB implemented these amendments through a number of final rules. The FDIC and other banking regulators were responsible for implementing the rules in their supervision programs. The following two rules relate to loan suitability and took effect on January 10, 2014: Ability-to-Repay and Qualified Mortgage Standards under the Truth in Lending Act (Regulation Z) (herein referred to as the ATR/QM rule).

Loan Originator Compensation Requirements under the Truth in Lending Act (Regulation Z) (herein referred to as the Loan Originator rule).

ATR/QM rule. This rule directed most lenders to make a reasonable and good-faith determination, at or before loan consummation, that a consumer would have a reasonable ability to repay a residential mortgage loan according to its terms. Lenders can comply with this rule by offering a qualified mortgage (QM) to a borrower or demonstrating that a borrower has the ability to repay a non-qualified mortgage.

The ATR/QM rule specified several types of qualified mortgages, referred to as General Qualified Mortgages and Other Qualified Mortgages.5 The rule also specified Non-Qualified Mortgages and required lenders to verify and document compliance with eight specific abilityto- repay (ATR) criteria when making Non-Qualified Mortgage loans. These criteria for non- qualified mortgages include a lender’s assessment of a borrower’s (1) income and assets, (2) employment status, (3) mortgage obligations, (4) other debts, (5) alimony, (6) child support, (7) credit history, and (8) residual income.

Footnote 4 Regulation Z, 12 C.F.R., Part 226. Footnote

Footnote 5 The ATR/QM rule identifies five types of qualified mortgages—General Qualified Mortgages and four additional categories, which this report refers to as Other Qualified Mortgages. Footnote

The federal banking regulators have explained that a lender’s business decision to offer qualified or non-qualified mortgages does not, on its own, raise supervisory concerns. Key attributes pertaining to qualified and non-qualified mortgages are explained in Table 1.

Table 1: Qualified and Non-Qualified Mortgages

column 1, General Qualified Mortgages

Regular periodic payments.

Limited to 30 years. Typically limits points and fees to 3 percent of the total loan amount. Requires lenders to comply with sound underwriting practices, such as verifying a borrower’s income and debts in accordance with specified criteria in Appendix Q to Regulation Z. Borrower’s debt-to-income (DTI) ratio is limited to 43 percent.

Prohibits interest-only loans, negative amortization loans, and balloon payments. Generally presumed to meet the ATR criteria.

column 2, Other Qualified Mortgages Meet some but not all of the General Qualified Mortgage requirements.

Mortgages made by small creditors that are applicable to rural and underserved areas. These mortgages may have balloon payments. Mortgages made by any creditors that are eligible for purchase or guarantee by a government-sponsored enterprise (GSE)* and that are eligible to be insured or guaranteed by certain federal agencies. Lenders are not required to underwrite loans in accordance with Appendix Q to Regulation Z. A borrower’s DTI may exceed 43 percent. Generally presumed to meet the ATR criteria.

column 3, Non-Qualified Mortgages

Interest-only loans.

Negative amortization loans.

Non-GSE loans originated by lenders that are not small creditors that cause a borrower’s DTI to exceed 43 percent.

Lenders must verify and document compliance with the eight ATR criteria.

Source: Generated by the Office of Inspector General (OIG) based on information in the ATR/QM rule and information from DCP management.

[End Table 1]

The GSEs include Fannie Mae and Freddie Mac. To be eligible for purchase by a GSE, a lender and the loans originated by the lender must meet certain criteria prescribed by the GSE. These criteria help ensure the caliber of the lender and the loans.

Loan Originator rule. This rule placed limits on loan originator compensation and imposed new requirements on loan originators.

Following the 2008-2011 financial crisis, regulators and lawmakers expressed significant concerns about incentives and compensation that loan originators received to steer consumers into more expensive loans. As such, this rule restricted lenders from allowing certain compensation practices. Prior to the crisis, loan originators were permitted to receive compensation or bonuses in connection with specific mortgage terms such as interest rates and fees. However the Loan Originator rule prohibited lenders from allowing such compensation practices.

The rule also expanded upon the Secure and Fair Enforcement for Mortgage Licensing Act of 2008 (SAFE Act) by imposing additional requirements on loan originators.6 Loan Originators are required to meet certain qualification standards in accordance with state and federal law. Lenders must also perform criminal background checks and obtain credit reports on their loan originators. The rule also:

Required lenders to develop written policies and procedures to ensure compliance with key requirements;

Required lenders to include the loan originator’s name and unique identification number on loan documentation;

Prohibited certain clauses in mortgage documents requiring mandatory arbitration or waivers of certain consumer rights; and

Prohibited lenders from financing credit insurance (e.g., credit life insurance), with certain exceptions when a consumer credit transaction is secured by a dwelling.

DCP’s Compliance Examination Process. DCP examiners assess bank compliance with the ATR/QM and Loan Originator rules along with a number of other consumer financial laws during periodic compliance examinations. Examiners use DCP’s Consumer Harm Risk Matrix (CHRM) as a resource to assist with examination planning and scoping. DCP management assigns, within CHRM, a risk level of “high,” “moderate,” or “low” to the various consumer financial law provisions based on their potential risk of consumer harm. DCP examiners consider these risk ratings and relevant internal controls when planning and scoping compliance examinations. Based on the quality of an institution’s internal controls and compliance management system, examiners conclude which areas require additional evaluation and testing.

DCP management assigned the ATR/QM, Loan Originator, and SAFE Act rules risk levels of high, moderate, and low respectively. The figure below provides an overview of DCP’s compliance examination process.

Footnote 6: The SAFE Act (Public Law 110-289) preceded the Loan Originator rule and required loan originators to be licensed and registered in accordance with national standards. [End of footnote]

Figure: DCP’s Compliance Examination Process

(flow chart)

(Rectangle shape: Examiners request documentation from and interview bank management to better understand the bank's products, services, and market.)

(Rectangle shape: Examiners review documentation, identify inherent risks, and consider risk levels in CHRM. )

(Rectangle shape: Examiners assess bank's internal controls to mitigate inherent risks.)

(Rectangle shape: Decision Point:  Examiners provide a reason for not examining any areas with inherent risks.)

(Rectangle shape: Examiners rate the remaining risks as low, moderate, or high and propose examination coverage.)

(Rectangle shape: The Field Office Supervisor reviews and approves the examination scope.)

(Rectangle shape: Examiners assess the bank in accordance with the approved examination scope.)

(Rectangle shape: Examiners document examination results {the results of compliance testing, instances of noncompliance, and violations} in workpapers.)

(Rectangle shape: Examiners prepare the draft examination report for review and approval by the Review Examiner.)

(Rectangle shape: Review Examiner ensures all instances of noncompliance and violations are sufficiently supported.)

(Rectangle shape: Report of examination is approved by regional office and sent to the financial institution.)

Source: OIG-generated based on an analysis of DCP examination information.

[End of figure]

Evaluation Results

We found that DCP took steps to implement the ATR/QM and Loan Originator rules. DCP incorporated these rules into its examination program, trained its examiners, and communicated regulatory changes to FDIC-supervised institutions.

While DCP tracked examination findings and bank violations of the rules, DCP should enhance its monitoring efforts by researching the reasons for regional variances in complying with the rules. DCP should also track how many institutions are subject to the rules and how frequently examiners review compliance with the rules. We also found that DCP’s workpapers needed improvement in some instances.

DCP Incorporated the ATR/QM and Loan Originator Rules into Its Examination Program and Other Guidance

The GAO Internal Control Standards identify control activities as one of the components of an effective internal control system. Control activities include policies and procedures that enforce management’s directives.

Beginning in 2013, DCP coordinated with the CFPB and other federal banking regulators to develop written guidance for its examiners to assess compliance with the ATR/QM and Loan Originator rules. DCP comprehensively updated its compliance examination manual to incorporate DCP management’s expectations for assessing compliance with the ATR/QM and Loan Originator rules. DCP issued memoranda to Regional Directors and job aids that provided specific guidance on performing examination functions. DCP developed worksheets and job aids to facilitate its ATR/QM and Loan Originator compensation rule review:

For the ATR/QM rule, DCP developed standardized electronic workpapers, including a mandatory loan analysis worksheet. The worksheet guides examiners through the requirements for a qualified mortgage. If a loan is not a qualified mortgage, the worksheet guides examiners through the eight ATR criteria. For the Loan Originator rule, DCP developed job aids, including a process flow document with decision points to assist examiners in analyzing compensation agreement terms and a document for assessing loan originator qualifications. DCP also updated a mandatory workpaper for assessing compliance with the SAFE Act. Examiners are required to document their work and conclusions in a narrative summary.

These guidance documents help to ensure examiners adequately and consistently assess compliance and document their findings.

DCP Trained Its Examiners on the New Rules

The GAO Internal Control Standards provide that management should recruit, develop, and retain competent personnel to achieve the entity’s objectives. This includes providing training to enable individuals to develop competencies appropriate for key roles and tailoring training based on the needs of the role.

In 2012, in anticipation of the numerous regulatory changes resulting from the Dodd-Frank Act, DCP developed a formal training and development program for its staff, in collaboration with the FDIC’s Corporate University and with input from the CFPB and other banking agencies. A significant focus of DCP’s training efforts pertained to the ATR/QM and Loan Originator rules.

In 2013, DCP administered mandatory training for its staff, covering the ATR/QM and Loan Originator rules. DCP Headquarters personnel spearheaded the training with significant input and assistance from the regional offices. DCP Headquarters provided intensive training to certain DCP commissioned examiners from each region, who subsequently trained other DCP personnel. Each regional office held training sessions at various locations throughout their regions. A summary of DCP’s mandatory training is provided in Table 2.

Table 2: Mandatory Training for DCP Examiners

Heading: Training Topic, Date, Summary

row 1 Training Topic: 2013 Comprehensive Examiner Training on CFPB Mortgage Rules - Date: 2013 - Summary: In-person 3-day course taught by commissioned DCP examiners who attended a “Train-the-Trainer” course in Washington Headquarters and subsequently trained other DCP examiners. Each region held sessions at various locations. Areas of focus included: effective dates, covered transactions, exemptions, ATR factors and related determinants, DTI thresholds, safe harbors, rebuttable presumptions, General Qualified Mortgage criteria, Appendix Q to Regulation Z, small creditors, and points and fees calculations.

row 2 Training Topic: ATR/QM Awareness Training - Date: 2013* - Summary: A 37-minute online course with a detailed summary of the rule’s contents and requirements. Loan Originator Rule Awareness Training 2013* A 14-minute online course with a detailed summary of the rule’s contents and requirements.

Source: OIG-generated based on analysis of DCP training initiatives.

[End Table 2]

These online courses were still available to FDIC employees at the time of our fieldwork. DCP also coordinated with the CFPB and other banking agencies. DCP officials and officials from these agencies participated in annual conferences and gave presentations on the ATR/QM and Loan Originator rules.

We reviewed DCP’s training materials for the ATR/QM and Loan Originator rules and found the information to be comprehensive and understandable. DCP provided its examiners with (1) a binder of materials pertaining to the rules, such as relevant policies and procedures, key requirements, case scenarios, and rule interpretations; (2) detailed summaries of the rules describing their scope, applicability, and effective dates, and major changes from prior rules; and

(3) frequently asked questions and answers about the rules, which DCP updated regularly. DCP examiners provided positive feedback about the ATR/QM and Loan Originator training. Examiners we interviewed also noted that it would be helpful if DCP provided: (1) periodic refresher courses on key elements of the rules and (2) case scenarios to further illustrate when an institution is subject to the Loan Originator rule and examples of bonuses or other payments that institutions are not permitted to pay loan officers.

DCP’s efforts to train examination staff helps ensure that staff receive timely and consistent information, materials, and support to perform their duties.

DCP Communicated Regulatory Changes to FDIC-Supervised Institutions

The GAO Internal Control Standards provide that management should communicate to external parties information that is necessary to achieve the entity’s objectives and select appropriate methods of such communication.

Beginning in 2012, before the ATR/QM and Loan Originator rules went into effect, DCP held outreach events and provided technical assistance to institutions pertaining to anticipated changes as a result of the ATR/QM and Loan Originator rules. DCP communicated regulatory guidance to FDIC-supervised institutions through several mediums, such as:

Issuing Financial Institution Letters (FIL) describing pertinent requirements and expectations;7

Footnote 7: FILs are discussed in more detail in Appendix 1. [End of footnote]

Posting outreach events, rulemakings, and guidance to financial institutions on the FDIC’s regulatory calendar, which is available on the FDIC’s website;

Hosting in-person outreach events and conference calls with financial institutions (known as national banker calls) to describe pertinent requirements and answer questions; and

Posting technical assistance videos describing expectations for financial institutions on the FDIC’s website, including nine videos related to the ATR/QM rule and five videos related to the Loan Originator rule, at the time of our fieldwork.8

Footnote 8: At the time of our fieldwork, these videos were available on the FDIC’s public website at: https://www.fdic.gov/regulations/resources/director/technical/atr.html and https://www.fdic.gov/regulations/resources/director/technical/lo.html. [End of footnote]

Table 3 shows key outreach efforts pertaining to the ATR/QM and Loan Originator rules.

Table 3: DCP Outreach to Financial Institutions

Heading: Outreach Event Topic, Date, Summary

National Banker Calls

row 1 Outreach Event Topic: CFPB’s Significant MortgagevRelated Proposals ; Date: September 27, 2012 - Summary: DCP described mortgage origination standards, appraisals for higher-risk mortgages, new appraisal requirements, and mortgage loan servicing guidelines.

row 2 Outreach Event Topic: CFPB’s Significant Mortgage Related Proposals ; Date: October 10, 2012 - Summary: DCP explained qualified mortgages and the eight ATR criteria.

row 3 Outreach Event Topic: ATR/QM and Loan Originator Rules (among other topics) ; Date: May 2, 2013 - Summary: DCP provided an overview of key ATR/QM requirements, information about qualified mortgages, and certain prohibitions designed to protect consumers.

row 4 Outreach Event Topic: Common Questions and Answers Pertaining to the ATR/QM and Loan; Originator Rules ; Date: October 22, 2014 - Summary: DCP provided answers to bankers’ common questions about implementing the ATR/QM and Loan Originator rules.

row 5 Outreach Event Topic: Early Examination Observations Pertaining to Compliance with the CFPB’s Mortgage Rules ; Date: May 21, 2015 - Summary: DCP shared observations and insights noted by examiners during initial examinations regarding bank implementation of CFPB’s mortgage rules.

Technical Assistance Videos on FDIC’s Public Website

row 6 Outreach Event Topic: ATR/QM Rule - Date: November 2014 and updated in 2016* Summary: Guidance to FDIC-supervised institutions on how to comply with the ATR/QM rule.

row 7 Outreach Event Topic: Loan Originator Compensation Rule - Date: January 2015* Summary: Guidance to FDIC-supervised institutions on how to comply with the Loan Originator rule.

Regional Outreach

row 8 Outreach Event Topic: Regional Office Quarterly Newsletters - Date: Various Summary: The newsletters discussed new and emerging topics, included hypothetical situations to help financial institutions understand and comply with key requirements, announced upcoming outreach events, and provided links to pertinent resource materials.

row 9 Outreach Event Topic: Various events to discuss expectations of FDIC-supervised institutions and answer questions - Date: 2013 and 2014 - Summary: DCP officials from the regional offices hosted and presented at various outreach events in their regions, including banker roundtables, state trade associations, local meetings of compliance professionals, and regulatory panels.

[End Table 3]

Source: OIG-generated based on analysis of DCP outreach initiatives.

This guidance was still available to FDIC employees at the time of our fieldwork. DCP communications with FDIC institutions help to ensure that banks understand how to implement the rules and DCP’s expectations for complying with the rules.

DCP Tracks Rule Violations But Should Enhance Its Program Monitoring Efforts

The GAO Internal Control Standards provide that management should establish and operate monitoring activities to align controls with changing objectives, environments, laws, resources, and risks and to assess the quality of performance over time.

DCP maintained regular contact with the CFPB and other federal and state banking regulators to stay abreast of new requirements, facilitate consistent implementation of the rules, discuss areas of confusion regarding the rules, and share viewpoints on effective monitoring practices. DCP also reached out to CFPB for guidance on how to interpret certain rule provisions.

Tracking Rule Violations. DCP used an automated system to track examination findings and generate management reports showing violations of specific rules. DCP stated that these reports are used to identify violation trends and to discuss and compare significant compliance findings with other financial regulators.

In 2016, DCP initiated consumer compliance examinations of 1,295 institutions and identified a total of 314 violations, as shown in Table 4. The violations primarily related to:

Lenders not documenting completion of the ATR steps, Lenders not having required policies and procedures, Loan originators receiving prohibited bonuses or compensation, and Loan originators not being identified on loan documentation.

We identified regional variances in the number of violations related to the ATR/QM and Loan Originator rules in relation to the number of banks examined.

Table 4: 2016 Violations by Region for the ATR/QM and Loan Originator Rules

row 1 Region: Atlanta ; Number of Compliance Examinations Initiated in 2016: 174 ; Percent of Compliance Examinations Initiated in 2016: 13%; Number of ATR/QM Rule Violations: 7; Percent of ATR/QM Rule Violations: 10%; Number of Loan Originator Rule Violations: 26; Percent of Loan Originator Rule Violations: 11%; Number of Combined Violations: 33; Percent of Combined Violations: 11%

row 2 Region: Chicago; Number of Compliance Examinations Initiated in 2016: 277; Percent of Compliance Examinations Initiated in 2016: 21%; Number of ATR/QM Rule Violations: 12; Percent of ATR/QM Rule Violations: 17%; Number of Loan Originator Rule Violations: 69; Percent of Loan Originator Rule Violations: 28%; Number of Combined Violations: 81; Percent of Combined Violations: 26%

row 3 Region: Dallas; Number of Compliance Examinations Initiated in 2016: 242; Percent of Compliance Examinations Initiated in 2016: 19%; Number of ATR/QM Rule Violations: 2; Percent of ATR/QM Rule Violations: 3%; Number of Loan Originator Rule Violations: 14; Percent of Loan Originator Rule Violations: 6%; Number of Combined Violations: 16; Percent of Combined Violations: 5%

row 4 Region: Kansas City; Number of Compliance Examinations Initiated in 2016: 347; Percent of Compliance Examinations Initiated in 2016: 27%; Number of ATR/QM Rule Violations: 47; Percent of ATR/QM Rule Violations: 67%; Number of Loan Originator Rule Violations: 120; Percent of Loan Originator Rule Violations: 49%; Number of Combined Violations: 167; Percent of Combined Violations: 53%

row 5 Region: New York; Number of Compliance Examinations Initiated in 2016: 145; Percent of Compliance Examinations Initiated in 2016: 11%; Number of ATR/QM Rule Violations: 2; Percent of ATR/QM Rule Violations: 3%; Number of Loan Originator Rule Violations: 10; Percent of Loan Originator Rule Violations: 4%; Number of Combined Violations: 12; Percent of Combined Violations: 4%

row 6 Region: San Francisco; Number of Compliance Examinations Initiated in 2016: 110; Percent of Compliance Examinations Initiated in 2016: 8%; Number of ATR/QM Rule Violations: 0; Percent of ATR/QM Rule Violations: 0%; Number of Loan Originator Rule Violations: 5; Percent of Loan Originator Rule Violations: 2%; Number of Combined Violations: 5; Percent of Combined Violations: 2%

row 7 Total; Number of Compliance Examinations Initiated in 2016: 1,295; Percent of Compliance Examinations Initiated in 2016: 99%*; Number of ATR/QM Rule Violations: 70; Percent of ATR/QM Rule Violations: 100%; Number of Loan Originator Rule Violations: 244; Percent of Loan Originator Rule Violations: 100%; Number of Combined Violations: 314; Percent of Combined Violations: 101%*

Source: OIG-compiled based on DCP management reports.

[End Table 4]

Percentages calculated by dividing regional amounts by the total amount in each column. Percentages may not total 100 due to rounding. As shown in Table 4, the percentage of violations in the Atlanta and Chicago regions approximated the percentage of examinations initiated during 2016 in the two regions. For example, the Atlanta region accounted for 13 percent of the compliance examinations initiated in 2016 and 11 percent of the combined ATR/QM and Loan Originator violations. Similarly, the Chicago region accounted for 21 percent of the examinations initiated and 26 percent of the combined violations.

By contrast, the Kansas City region had the highest percentage of combined violations (53 percent) but only initiated 27 percent of the total examinations. This proportion of violations was nearly double that of examinations initiated.

Meanwhile, there were three regions where the percentage of examinations initiated were approximately three to four times the proportion of violations noted. The Dallas region initiated 19 percent of the examinations, but only accounted for 5 percent of the institutions with violations. Similarly, the New York and San Francisco regions had a lower percentage of violations (4 and 2 percent, respectively) in relation to examinations initiated in 2016 (11 and 8 percent, respectively).

DCP management could not readily explain these regional variances. According to FDIC guidance, compliance examinations are risk-focused and examiners have discretion regarding what procedures they perform. Therefore, examiners may elect not to test a bank’s compliance if they conclude operational risks are mitigated. DCP indicated that regional variances could be due to examiners not always including compliance testing with the ATR/QM and Loan Originator rules in their examination scope or because some regions had fewer banks originating mortgage loans.

Tracking Rule Applicability and Examination Testing. DCP management could better assess the significance of the regional variances by tracking how many institutions are subject to the rules and how frequently examiners elected to test compliance with the rules. Tracking information about the aggregate number of institutions in each region that are subject to the rules could provide important information about the impact of the rules on FDIC-supervised institutions. For example, such information may inform DCP whether banks stopped making mortgage loans as a result of regulatory burden associated with the rules. Tracking information on the number of times that examiners tested institution compliance with the rules would allow DCP management to gauge to what extent examiners elected to review, or not review, compliance with the rules and whether the frequency of coverage is consistent with DCP management’s expectations.

Collectively, tracking such information would help DCP to (1) better understand the impact the rules are having on FDIC-supervised institutions, (2) put the frequency of examination findings and violations into context, (3) determine to what extent examiners are reviewing or electing to not review compliance with the rules, and (4) assess institution compliance and examination coverage trends by FDIC regional office.

Without aggregate regional information about rule applicability and examination coverage, it is difficult to know to what extent FDIC-supervised institutions complied with these rules, the significance of variations in compliance by region, and how the rules have impacted FDIC- supervised institutions. With aggregate regional information, DCP officials may be able to better understand the underlying reasons for the variations.

Recommendations

We recommend that the Director, DCP:

1. Examine the reasons for the regional variances in the number of violations in connection with the ATR/QM and Loan Originator rules and take appropriate action.

2. Track, in the aggregate and by region, the number of FDIC-supervised institutions subject to the ATR/QM and Loan Originator rules.

3. Track, in the aggregate and by region, how often examiners assess institution compliance with the ATR/QM and Loan Originator rules.

DCP Examination Workpapers Need Improvement

The GAO Internal Control Standards require appropriate documentation of internal controls and all transactions and other significant events in a manner that allows the documentation to be readily available for examination.

DCP requires examiners to document certain information in workpapers and maintain, in specified systems, mandatory and other workpapers that support their findings and conclusions.9 We reviewed DCP’s workpapers related to the 12 compliance examinations in our sample and identified exceptions, which are explained below and in Appendix 2.

DCP examiners are required to examine areas that pose inherent risks to banks or document reasons for excluding these areas from testing. Examination workpapers did not consistently document why examiners excluded compliance testing for these rules. Specifically, examiners did not document why they excluded ATR/QM compliance and SAFE Act testing from three (25 percent) and eight (67 percent) examinations, respectively.

In all instances, DCP examiners informed us these areas were excluded because they determined the corresponding inherent risks were appropriately mitigated. However, DCP management stated that the examiners and/or supervisors forgot to document their rationale for excluding these areas from testing. DCP management agreed that the workpaper documentation should have explained examiners’ rationale for excluding these areas.

DCP examiners are required to complete a mandatory worksheet documenting their review of each sampled loan for compliance with the ATR/QM rule. We sampled worksheets that examiners used to assess compliance with the ATR/QM rule for 22 loans and found that 14 worksheets (64 percent) were incomplete or not completed correctly. As a result, we could not conclude from the worksheets alone, if examiners performed testing as required. DCP management explained the level of testing performed and provided additional documentation. Nevertheless, the examiners’ conclusions should have been self-evident from the worksheets.

DCP examiners are required to maintain workpapers supporting their findings and conclusions. Workpapers in connection with 4 of 12 examinations documented violations or potential violations pertaining to the Loan Originator rule. In one of these four instances, the workpapers noted a violation that was not reflected in the report of examination. The workpapers noted that the subject bank did not have a formal written policy describing how it would comply with the Loan Originator rule, although the bank’s practices complied with the rule’s requirements. DCP officials informed us that the violation did not warrant inclusion in the report of examination because the bank was complying with the rule and the violation presented a low level of consumer harm. Nevertheless, the workpapers should have discussed the rationale for not including this finding in the report of examination.

Footnote

9 These systems include RADD (Regional Automated Document Distribution and Imaging System) and SOURCE (System of Uniform Reporting of Compliance and CRA Examinations).

[End Footnote] DCP examiners are required to store workpapers supporting their findings and conclusions in RADD or SOURCE. The 12 compliance examinations yielded 36 mandatory workpapers in support of examiners’ findings and conclusions. Of the 36 workpapers, 3 (8 percent) were not in the required system. DCP officials noted that the workpapers were not stored appropriately primarily due to oversights, and DCP added the workpapers to the appropriate system subsequent to our inquiries.

We also interviewed 12 examiners associated with our sampled examinations. These examiners provided positive feedback about DCP’s implementation of the ATR/QM and Loan Originator rules and also identified potential areas for improving DCP’s workpapers. We communicated these suggestions to DCP management during our fieldwork. Several examiner suggestions could address workpaper deficiencies that we observed. For example, examiners suggested that DCP:

Issue additional guidance such as a checklist similar to the ATR/QM worksheet to assist examiners in assessing compliance with loan compensation requirements of the Loan Originator rule. Our testing results showed inconsistencies in the level of detail and documentation of work performed to support examiner conclusions regarding this rule.

Implement intuitive programming of a mandatory ATR/QM electronic loan analysis worksheet to better ensure examiners properly fill out the worksheet. Our testing showed that workpapers were often incomplete or not completed correctly, which supports this examiner suggestion for improvement.

Without adequate workpaper documentation, DCP supervisors, managers, and subsequent examination teams may not readily understand the examination team’s work, findings and conclusions, or reasons for not performing certain procedures. Documentation is also important to support future inquiries about an examination.

Recommendation

We recommend that the Director, DCP:

4. Take steps to ensure DCP examiners accurately complete and retain mandatory and other relevant examination workpapers to support their findings and conclusions. Corporation Comments and OIG Evaluation

DCP provided a written response dated November 29, 2017, to a draft of this report. The response is presented in its entirety in Appendix 5. DCP concurred with the report’s four recommendations, proposed actions to address the recommendations, and plans to implement the recommendations by June 30, 2018. These recommendations will remain open until the planned actions are completed. Appendix 6 contains a summary of the Corporation’s corrective actions.

Appendix 1

Objective, Scope, and Methodology

Objective and Scope

The objective of our evaluation was to assess the FDIC’s implementation of selected consumer protection rules. Our evaluation focused on the ATR/QM and Loan Originator rules.

To address our objective, we reviewed DCP’s processes for:

incorporating these rules into its examination programs and other guidance,

training its examiners with respect to these rules,

communicating regulatory changes to FDIC-supervised institutions, and

monitoring implementation of these rules in its examination programs.

We also reviewed a judgmental sample of 12 DCP compliance examinations completed in 2016 to assess DCP’s coverage of these rules. DCP staff in the Atlanta, Dallas, and San Francisco regional offices completed these examinations.

Methodology

During the evaluation we:

Reviewed relevant criteria, including the following: Dodd-Frank Act, Titles X and XIV.

ATR/QM and Loan Originator rules and amendments to these rules. DCP’s Compliance Manual. Regional Director memoranda, policy guidance, and job aids. The following FILs: FIL-20-2012: FDIC Statement on CFPB Bulletin 2012-02: Payments to Loan Originators Based on Mortgage Transaction Terms or Conditions under Regulation Z (April 17, 2012); FIL-51-2012: FDIC Regulatory Calendar: FDIC Announces Official Launch of Regulatory Calendar for Community Banks (December 10, 2012); FIL-9-2014: Interagency Consumer Compliance Examination Procedures for Mortgage Rules Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) (February 25, 2014); FIL-27-2015: Interagency Consumer Compliance Examination Procedures for Truth in Lending Act (Regulation Z) and Real Estate Settlement Procedures Act (Regulation X) Mortgage Rules (June 30, 2015); and FIL-56-2016: Ability-to-Repay and Qualified Mortgage Rule Videos Updated (August 17, 2016). Reviewed relevant background materials and related work, including a DCP internal review and the following OIG review: Coordination of Responsibilities Among the Consumer Financial Protection Bureau and the Prudential Regulators—Limited Scope Review (Report No. EVAL-15-004), June 2015.

Reviewed the FDIC’s progress in meeting a 2014 performance goal pertaining to the implementation of consumer protection rules and concluded the FDIC achieved this goal.

Obtained a walkthrough of and documented DCP’s consumer compliance examination process.

Identified relevant information systems that DCP used to plan examinations and store workpapers and other documentation.

Interviewed DCP officials in Headquarters and the Atlanta, Dallas, and San Francisco regional offices and CFPB officials to gain a better understanding of the FDIC’s implementation of the ATR/QM and Loan Originator rules.

Assessed relevant internal control standards in GAO’s Standards for Internal Control in the Federal Government.

We conducted this evaluation from October 2016 through July 2017 in accordance with the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation.

Sampling

To assess examination coverage of the ATR/QM and Loan Originator rules, we obtained the total number of DCP compliance examinations completed in 2016 pertaining to institutions with assets of $10 billion or less, which comprised 1,286 examinations.10 We also obtained information about each institution, including its asset size, mortgage lending concentrations, regional office, location, and examination rating.

We judgmentally selected 12 DCP compliance examinations completed by the Atlanta, Dallas, and San Francisco regional offices. We selected Atlanta due to the significant number of problem financial institutions that were resolved during the 2008-2011 financial crisis, Dallas because of its geographic location, and San Francisco because of its overall large volume of mortgage lending in 2016. In selecting our sample, we also considered examination ratings, whether DCP examiners assessed the institutions for compliance with the ATR/QM and Loan Originator rules, and information obtained from DCP examiners. We structured our sample to include institutions where examiners performed compliance testing and institutions for which examiners elected not to perform compliance testing. The results of a judgmental sample cannot be projected to the overall population.

10 We selected this threshold because the Dodd-Frank Act transferred the primary consumer compliance examination and enforcement authority from the federal banking regulators to the CFPB for insured depository institutions with more than $10 billion in assets. For insured depository institutions with $10 billion or less in assets, the federal banking regulators (including the FDIC) retained the primary consumer compliance examination and enforcement authority.

[End Appendix 1]

Appendix 2

Sample of 12 DCP Examinations Reviewed by the OIG

heading Region, Financial Institution, Asset Size as of 9/30/16 (rounded), Loans Secured by 14 Family Properties as a Percentage of Total Loans and Leases Did the examination include coverage of the rules or document reason for not covering the rules?, ATR QM Rule, Loan Originator Rule:*, LO Comp., SAFE Act

ATR/QM Worksheet Not Completed Correctly

Examination Findings Conclusions Documented in Workpapers?

Workpapers Not Located in Appropriate System (RADD/SOURCE)

row 1 Atlanta, Institution 1, $6 billion, 30%, Yes, Yes, Yes, 0 / 3

row 2 Atlanta, Institution 2, $2 billion, 69%, Yes, No - Justified, No - Justified, 2 / 2 Yes 0 / 3

row 3 Atlanta, Institution 3, $2 billion, 27%, No, Yes, No, 0 / 0, ‐‐‐‐‐ , 0 / 1

row 4 Atlanta, Institution 4, $6 billion, 7%, Yes, Yes, No, 0 / 3, No 0 / 4

row 5 Dallas, Institution 5 $50 million 23% No – Justified No ‐ Justified No ‐ Justified 0 / 0 ‐‐‐‐‐ 0 / 1

row 6 Dallas, Institution 6 $1 billion 26% Yes No ‐ Justified No 2 / 3 ‐‐‐‐‐ 0 / 4

row 7 Dallas, Institution 7 $2 billion 30% Yes No ‐ Justified No 2 / 3 ‐‐‐‐‐ 0 / 4

row 8 Dallas, Institution 8 $2 billion 23% Yes Yes No 3 / 3 ‐‐‐‐‐ 0 / 4

row 9 San Francisco, Institution 9, $10 billion, 11%, Yes, Yes, No, 2 / 2, Yes, 2 / 3

row 10 San Francisco, Institution 10, $4 billion, 40%, No, No ‐ Justified, No, 0 / 0, ‐‐‐‐‐, 0 / 1

row 11 San Francisco, Institution 11, $9 billion, 16%, Yes, Yes, Yes, 3 / 3, Yes, 1 / 5

row 12 San Francisco, Institution 12, $4 billion, 15%, No, Yes, No, 0 / 0, ‐‐‐‐‐, 0 / 1

row 13 Exceptions, ‐‐‐‐‐, ‐‐‐‐‐, 3 / 12 (25%), 0 / 12 (0%), 8 / 12 (67%), 14 / 22 (64%), 1 / 4 (25%), 3 / 36 (8%)

Source: OIG-generated based on September 30, 2016 Quarterly Reports of Condition and OIG review of DCP’s examination workpapers. *The Loan Originator rule includes coverage related to loan originator compensation (LO Comp.) and the SAFE Act.

[End Appendix 2]

Appendix 3

Glossary of Terms

2008-2011 Financial Crisis

The 2008-2011 financial crisis is considered by many economists to be the worst financial crisis since the Great Depression of the 1930s. It resulted in the threat of total collapse of large financial institutions, national government assistance to financial institutions, and downturns in stock markets around the world. Also associated with the crisis were large declines in employment, household wealth, and other economic indicators. Studies suggest that losses associated with this crisis based on lost output (value of goods and services not produced) could range from a few trillion dollars to over $10 trillion.

Appendix Q to Regulation Z

This appendix—Standards for Determining Monthly Debt and Income— explains the requirements for determining a borrower’s monthly debt and income levels. Creditors that make General QMs are required to comply with Appendix Q (see 12 C.F.R. 1026.43(e)(2)(v) and (vi)). Creditors that make other qualified mortgages are not required to comply with Appendix Q. Underwriting criteria may be less stringent when creditors are not required to comply with Appendix Q.

Balloon Payment

A payment that is more than two times the loan’s average monthly payment. Most balloon loans require one large payment at the end of the loan term.

Corporate University

The FDIC’s training and employee development unit, which provides technical training, soft skills training, and a leadership development curriculum to FDIC employees.

Credit Insurance

A type of life insurance policy purchased by a borrower that pays off one or more existing debts in the event of a death or certain other events.

Debt-to-Income (DTI) Ratio

A consumer’s monthly debt payments divided by his or her gross monthly income. This ratio measures a borrower’s ability to manage monthly payments and repay debts.

Dwelling

A residential structure that contains one to four units, whether or not the structure is attached to real property. For the purposes of section 1026.43, a dwelling includes any real property to which the residential structure is attached that also secures the covered transaction.

Higher-Priced Mortgage Loan

A consumer credit transaction secured by the consumer’s principal dwelling with an annual percentage rate that exceeds the average prime offer rate for a comparable transaction, as of the date the interest rate is set, by 1.5 or more percentage points for loans secured by a first lien on the dwelling, or by 3.5 or more percentage points for loans secured by a subordinate lien on the dwelling.

Interest-Only Loan

A loan with scheduled payments that requires the borrower to only pay interest for a specified amount of time. Once the interest-only period ends, the borrower may: Pay off the loan balance all at once; Refinance the loan, if refinancing is available; or Make monthly payments that are higher than the interest-only payments.

Loan Originator

Generally includes an individual or entity that performs loan origination activities for compensation. Loan origination activities include offering credit terms to borrowers, assisting borrowers in applying for a loan, negotiating credit terms, and extending credit to borrowers. The rule excludes certain individuals from the definition of loan originator, including certain employees of manufactured home retailers; servicers; seller financers; real estate brokers; management, clerical, and administrative staff; and loan processors, underwriters, and closers.

Loan Originator Compensation (LO Comp.)

Generally includes salaries, commissions, and any financial or similar incentives paid to loan originators.

Negative Amortization Loan

A loan whose principal balance increases, despite a borrower making required minimum payments. The principal increases because the borrower’s minimum payments do not cover the accrued interest and the unpaid interest is added to the principal balance.

Non-Qualified Mortgage

A mortgage that does not meet the criteria to be classified as a qualified mortgage. If a lender makes a non-qualified mortgage, the lender must demonstrate compliance with the eight ATR criteria in order to comply with the ATR/QM rule. It is not a violation of the ATR/QM rule for a lender to make a non-qualified mortgage if the lender demonstrates compliance with the eight ATR criteria.

Predatory Lending

Any lending practice that imposes unfair or abusive loan terms on a borrower. It is also any practice that convinces a borrower to accept unfair terms through deceptive, coercive, exploitative, or unscrupulous actions for a loan that a borrower doesn’t need, doesn’t want, or can’t afford.

Qualified Mortgage

A mortgage that is generally presumed to meet the ATR criteria.

Rebuttable Presumption

A provision in the ATR/QM rule that gives a consumer claiming a violation of the rule an opportunity to provide evidence that the creditor did not make a reasonable and good faith determination of the consumer’s ability to repay the loan. Specifically, a consumer may claim that the creditor’s loan calculation did not allow for sufficient residual income for the borrower to meet living and other expenses of which the creditor was aware. The burden to prove this claim is with the consumer. This presumption only applies to higher-priced mortgage loans.

Regional Automated Document Distribution and Imaging System (RADD)

An FDIC system that RMS and DCP staff use to store documents related to their examinations of financial institutions such as bank correspondence, legal documents, information on violations, enforcement actions, and business records.

Safe Harbor

A presumption in the ATR/QM rule that a creditor complied with the ATR criteria simply because the subject loan met the Qualified Mortgage standards and was not a higher-priced loan. The ATR/QM rule also refers to this term as a conclusive presumption of compliance.

Secure and Fair Enforcement for Mortgage Licensing Act of 2008 (SAFE Act)

The SAFE Act was passed on July 30, 2008 and requires mortgage loan originators to be licensed and registered in accordance with national standards. The SAFE Act is designed to enhance consumer protection and reduce fraud.

Small Creditor

A financial institution with total assets of less than $2 billion, adjusted annually for inflation that, along with its affiliates, originated no more than 2,000 first-lien covered transactions in the preceding calendar year. The $2 billion threshold includes the assets of affiliates that regularly extend covered transactions secured by first liens.

System of Uniform Reporting of Compliance and CRA Examinations (SOURCE)

DCP’s system of record for all compliance and Community Reinvestment Act (CRA) examination activities. SOURCE stores DCP’s compliance and CRA examination reports and examination data.

Truth in Lending Act

A federal law enacted in 1968 designed to (1) promote the informed use of consumer credit by requiring disclosures about credit terms and costs and (2) standardize the manner in which borrowing costs are calculated and disclosed.

[End Appendix 3]

Appendix 4

Acronyms and Abbreviations

ATR - Ability-to-Repay

ATR/QM - Ability-to-Repay/Qualified Mortgage

CFPB - Consumer Financial Protection Bureau

C.F.R. - Code of Federal Regulations

CHRM - Consumer Harm Risk Matrix

CRA - Community Reinvestment Act

DCP - Division of Depositor and Consumer Protection Dodd-Frank Act - Dodd-Frank Wall Street Reform and Consumer Protection Act

DTI - Ratio Debt-to-Income Ratio

FDIC - Federal Deposit Insurance Corporation

FIL - Financial Institution Letter

GSE - Government-Sponsored Enterprise

LO Comp. - Loan Originator Compensation

OIG - Office of Inspector General

QM - Qualified Mortgage

RADD - Regional Automated Document Distribution and Imaging System

SAFE - Act The Secure and Fair Enforcement for Mortgage Licensing Act of 2008

SOURCE - System of Uniform Reporting of Compliance and CRA Examinations

[End Appendix 4]

Appendix 5

[FDIC letterhead, FDIC logo, Federal Deposit Insurance Corporation, Division of Depositor and Consumer Protection, 550 17th Street, NW, Washington, D.C. 20429-9990]

November 29, 2017

MEMORANDUM TO: E. Marshall Gentry, Assistant Inspector General for Program Audits and Evaluations

FROM: Mark Pearce, Director /Signed/

SUBJECT: Draft Audit Report Entitled: Evaluation of the FDIC’s Implementation of Consumer Protection Rules Regarding Ability to Repay Mortgages and Compensation for Loan Originators (Report) (Assignment No. 2016-043)

The Division of Depositor and Consumer Protection (DCP) appreciates the work performed by staff in the Office of Inspector General (OIG) in connection with the subject audit, along with the recommendations and observations made to enhance and strengthen our examination process. This memo provides our response to each of the recommendations covered in the above captioned Report.

As indicated in the Report, DCP has taken a number of steps to implement these two significant mortgage rulemakings. DCP coordinated with the CFPB and other federal regulators in developing written guidance and comprehensively updating the Compliance Examination Manual and other existing materials to incorporate changes required by the rules. DCP also developed a variety of new training materials, including worksheets and job aides, to assist with the examiner “learning curve” and ensure staff was prepared for the changes. OIG auditors characterized the training materials as “comprehensive and understandable”. Also noted in the Report are the many efforts of DCP to communicate the regulatory changes to FDIC-supervised institutions, including the development of technical assistance videos targeted to community bankers. The responses and actions provided below will further assist DCP in ensuring that financial institutions are consistently treating customers fairly and operating in compliance with all governing laws.

RECOMMENDATION 1: Examine the reasons for the regional variances in the number of violations in connection with the ATR/QM and Loan Originator rules and take appropriate action.

RESPONSE: DCP concurs with this recommendation. There may be a variety of factors at play that would result in the variations identified in the Report. As noted in the Report, the percentage of institutions offering mortgage loans may differ among Regions. Also, compliance examinations are generally conducted on a three-year cycle which could result in differences in the number of institutions offering mortgage loans that are examined during the period reviewed by the OIG. In addition to these basic differences, the FDIC utilizes a risk-based approach to consumer compliance examinations, which invests examiners with the authority to make informed judgments about which products should be reviewed at a particular examination based on the risk profile of the institution and the controls put in place to mitigate risks. Finally, the FDIC issued guidance in FIL-9-2014 to communicate the approach that examiners would take in the initial examination for compliance with these rules, which focused examiner efforts on the overall efforts of the institution to develop and implement a program that ensured compliance. A deeper review of these factors and others may provide insights that will assist DCP in future rulemaking implementation efforts.

ACTION: By June 30, 2018, DCP will conduct a review of its available information to assess the primary factors or causes of the Regional variation. This information will be analyzed and discussed with Regional Management.

RECOMMENDATION 2: Track, in the aggregate and by region, the number of FDIC-supervised institutions subject to the ATR/QM and Loan Originator rules.

RESPONSE: DCP concurs with this recommendation. All supervised institutions are covered by the ATR/QM and Loan Originator rules; however, depending upon the size and profile of the institution and its engagement in the mortgage market, the application of provisions of the mortgage rules may vary by institutions. Under the FDIC’s consumer compliance examination approach, examiners begin each examination with the premise that all institutions are subject to the ATR/QM and Loan Originator rules. Through the pre-examination and risk-scoping process, examiners determine and document the appropriate depth and breadth of the mortgage lending review, if any. To avoid any additional or undue information collection burden on the industry, DCP will review existing systems to identify appropriate fields of data or proxies that can be used to gather information that could be useful in deepening DCP’s understanding of supervised institutions’ engagement in the mortgage business and how the mortgage rules may apply to them.

ACTION: Refer to Action in response to Recommendation 3 as we will coordinate the tracking of both the number of institutions examined that were subject to the rules along with the number of institutions where the rules were reviewed.

RECOMMENDATION 3: Track, in the aggregate and by region, how often examiners assess institution compliance with the ATR/QM and Loan Originator rules.

RESPONSE: DCP concurs with this recommendation. During the FDIC’s pre-exam scoping process for consumer compliance examinations, examiners identify specific areas of review, or PSMs (products, services, markets) as they compile the memorandum documenting the scope of the examination. A query of the PSMs and related comments can be performed to determine if and how mortgage lending has been included within the scope of the examination. In response to Recommendation 2 above, we will query the system to determine which examined institutions were subject to the rule at the time. The results of both queries will allow DCP on a periodic basis (e.g. annually) to identify variances or anomalies in DCP’s supervision program that merit additional review.

ACTION: By June 30, 2018, DCP will identify the appropriate data fields in our existing systems and query them for the information called for in this recommendation. DCP will develop a reporting schedule to query this information on a periodic basis.

RECOMMENDATION 4: Take steps to ensure DCP examiners accurately complete and retain mandatory and other relevant examination workpapers to support their findings and conclusions.

RESPONSE: DCP concurs with this recommendation. As noted elsewhere, the FDIC’s consumer compliance examination program invests significant responsibility in examiners to utilize professional judgment to identify and evaluate risk. In recent years, DCP has implemented standardized workpapers to ensure consistency of examination review and improve the documentation of examiner judgment. DCP’s primary strategy is to utilize technology and standardized practices to enable examiners to document judgments consistently. DCP has a Standardized Workpaper Oversight Committee (SWOC) with representation from each of the Regions to monitor changes to rules, policies and procedures to ensure that workpapers are updated appropriately and instructions are provided. The importance of following workpaper instructions needs to be communicated clearly and consistently and monitored.

ACTION: By June 30, 2018, DCP will ensure that all Regional Management provide a reminder to examination staff of the importance in completing workpapers accurately and will direct the Regions to include a review of workpapers in their Regional internal control reviews.

[End Appendix 5]

Appendix 6

Summary of the Corporation’s Corrective Actions

This table presents the corrective actions taken or planned by the Corporation in response to the recommendations in the report and the status of the recommendations as of the report issuance date.

Heading Rec. No., Corrective Action: Taken or Planned, Expected Completion Date, Monetary Benefits, Resolved:a Yes or No , Open or Closedb

Row 1 - Rec. No. 1, Corrective Action: Taken or Planned: DCP will conduct a review of its available information to assess the primary factors or causes of the regional variations noted in Table 4 of this report. DCP Headquarters will analyze and discuss the information with DCP regional management., Expected Completion Date: June 30, 2018, Monetary Benefits: No, Resolved:a Yes or No: Yes, Open or Closedb: Open

Row 2 Rec. No.: 2, Corrective Action: Taken or Planned: DCP will identify the appropriate data fields in its existing systems and query the data on a periodic basis to obtain the number of FDIC-supervised institutions subject to the ATR/QM and Loan Originator rules., Expected Completion Date: June 30, 2018, Monetary Benefits: No, Resolved:a Yes or No: Yes, Open or Closedb: Open

Row 3 Rec. No.: 3, Corrective Action: Taken or Planned: DCP will identify the appropriate data fields in its existing systems and query the data on a periodic basis to determine how often examiners assess institution compliance with the ATR/QM and Loan Originator rules., Expected Completion Date: June 30, 2018, Monetary Benefits: No, Resolved:a Yes or No: Yes, Open or Closedb: Open

Row 4 Rec. No.: 4, Corrective Action: Taken or Planned: DCP will ensure that its regional managers remind examination staff about the importance of accurately completing workpapers and include a workpaper review in their regional internal control reviews., Expected Completion Date: June 30, 2018, Monetary Benefits: No, Resolved:a Yes or No: Yes, Open or Closedb: Open

Footnote

a Resolved

(1) Management concurs with the recommendation, and the planned, ongoing, and completed corrective action is consistent with the recommendation.

(2) Management does not concur with the recommendation, but alternative action meets the intent of the recommendation. (3) Management agrees to the OIG monetary benefits, or a different amount, or no ($0) amount. Monetary benefits are considered resolved as long as management provides an amount.

b Recommendations will be closed when the OIG confirms that corrective actions have been completed and are responsive.

[End Footnote]

[End Appendix 6]

[End of report]

Print Print
Close