QUESTION
I am one of the underwriters for a non-delegated lender. We received a request from an investor to conduct quality control. My boss says we do not have to do quality control. His position is that, at most, we need only a limited quality control audit. I came from another non-delegated lender, and they always did QC.
He says we do not have to perform most aspects of QC audits, including credit analysis, re-verifications, credit reports, appraisal reviews, adverse action reviews, EPD issues, and GSE/FHA-VA underwriting reviews. Because we originate non-QM loans, he says QC is minimal. I read your Bulletin 2017-12, and it clearly shows that non-delegated lenders should do QC.
I would like you to discuss QC requirements for non-delegated lenders.
Does a non-delegated lender have to do quality control for non-QM loans?
OUR COMPLIANCE SOLUTIONS
We recommend the following compliance solutions for quality control support:
RESPONSE TO YOUR QUESTION
The question about a non-delegated lender having to conduct quality control seems to be one of those perennial questions that pop up from time to time. There is no mystery to the requirement. I appreciate that you have been reading our Bulletins. Anyone who wants to subscribe to our free Bulletins, please sign up!
Whether you are originating QM or non-QM loans, you should be conducting quality control audits. Fannie Mae's non-delegated quality control (QC) requirements include having a comprehensive written QC plan, a process for selecting loans for prefunding and post-closing reviews, and a system for reporting and taking corrective action.
If you're a non-delegated lender originating QM loans, the QC plan should be independent of the production process, and, among other things, you must conduct a minimum number of prefunding and post-closing QC reviews each month, based on a percentage of total loan volume.
If you're a non-delegated lender originating non-QM loans, you should have QC processes in place. Because non-QM loans do not meet the criteria for purchase by Fannie Mae or Freddie Mac, the lender assumes all the risk, making a robust QC program essential to manage the loan quality and potential defects.
Let's look somewhat broadly at the QC requirements. You must have a written QC plan that outlines your QC philosophy, objectives, and risks, with a process for selecting loans for review using random and/or discretionary methods across all products. The QC function must be independent of the production process, or, at a minimum, reviews must be conducted by personnel not involved in underwriting the specific loans subject to audit.
The QC plan for QM loans must cover both prefunding and post-closing reviews, ensuring compliance with the Fannie Mae Selling Guide, the lender contract, and applicable laws. You can check out Fannie's requirements in the Lender Quality Control Programs, Plans, and Processes section.
With respect to pre-funding, a minimum number of prefunding reviews must be completed each month, with the loan selection meeting at least the lesser of 10% of the prior month's total loans, 10% of current month projections, or 750 loans.
Regarding post-closing, loans must be selected for monthly reviews, and the entire QC cycle must be completed within 90 days of loan closing.
You must have documented procedures for reporting QC findings to management, documenting loan level findings for resolution, and taking timely corrective actions. All QC-related documentation must be retained for at least three years. An internal audit of the QC process itself should be performed annually to ensure compliance with the lender's policies and procedures. Our QC Tune-up®, a Second Line of Defense function, provides such support.
Importantly, if you are using a third party QC auditor – and most non-delegated mortgage lenders use external QC auditors – your QC plan must include a process for reviewing the auditor's work product to ensure Fannie Mae's requirements are consistently applied. You should perform a monthly review of at least 10% of the post-closing sample reviewed by the auditor to validate the accuracy of their work. This review is performed by your own staff, not the external auditor.
Non-delegated lenders that originate non-QM loans certainly must conduct quality control. The non-delegated lender is responsible for establishing and maintaining its own loan quality standards and developing processes to meet them. Every once in a while, I come across a non-delegated lender that views quality control as optional or of very limited scope. That is erroneous. It is mandatory, regardless of who underwrites, re-underwrites, or ultimately approves the loan originated by the non-delegated lender.
Investors and mortgage insurers mandate that non-delegated lenders maintain QC programs to ensure loan quality and mitigate risk. The purchasing investor conducts a full pre-purchase review, but the originating lender must still perform its own QC to catch defects early.
A strong QC program is crucial for mitigating the higher risk associated with non-QM loans, since the loans cannot be sold to the GSEs. Consider the compliance component: the lender must identify and categorize defects in the loan file and establish a methodology to measure trends against a target defect rate to ensure compliance with the loan's specific guidelines.
Any non-delegated lender that eventually wants to move to delegated status had better have the necessary staff and solid QC processes and policies in place!
There is no skirting regulatory requirements. Federal and state regulations, including Consumer Financial Protection Bureau (CFPB) rules, such as the Ability-to-Repay (ATR) rule, require all lenders to have policies and procedures in place to ensure compliance. An effective QC program is a key part of an institution's overall internal control environment.
Non-QM loans are subject to the ATR rule, even if non-QM lenders may use different, often less stringent, methods to verify a borrower's ability to repay than QM lenders do. This means lenders must still make a good faith determination that a borrower can repay the loan, but they may rely on alternative documentation, such as bank statements, profit-and-loss statements, and other documents, instead of standard W-2s and pay stubs, or allow a higher debt-to-income ratio.
Non-QM loan originations – such as bank statement loans, interest-only loans, DSCR loans, asset depletion and asset qualifier loans, foreign national loans, investment property loans, 1099 loans, low down payment jumbo loans, or any loans that are not required to meet the CFPB guidelines for QM loans – are subject to the ATR rule, a fundamental requirement for most residential mortgages secured by a dwelling, regardless of whether they are categorized as QM or non-QM.
So, non-QM lenders must conduct specific QC functions, including a written QC Plan, loan sampling, re-verifications, compliance reviews, and third-party verifications. In essence, even with underwriting handled externally, the originating entity remains ultimately responsible for the quality and compliance of the loans it originates and sells.
Mortgage quality control ensures loans comply with company standards, regulatory requirements, and investor guidelines to mitigate risk, identify and correct errors, and maintain loan quality. It involves a systematic review of loan origination, including verifying borrower income, assets, and collateral, and managing the loan's ongoing performance. In the absence of quality control, a mortgage originator faces significant legal and regulatory risks.
