Investor Owned Residential Loans: Risk Assessment

QUESTION

We are a mid-sized mortgage lender focused on investor-owned 1-4 family residential properties. Our underwriting and procedures are risk-based. In the last few years, we have grown considerably. I came on two years ago as the compliance manager. 

Last year, I retained a law firm to handle an audit to evaluate our procedures and overall risk-based audit program. In the end, I do not feel they did not consider important areas, such as underwriting standards, portfolio monitoring, capital treatment, and several qualitative factors. The audit objectives were not clearly defined. 

I am looking for some guidelines and remedies. If we have to do another audit, we do not want to spend as much money as we spent previously. Our policies and procedures are good, but I want more depth, especially because we are scaling up quickly. 

What audit objects and procedures should I consider in a risk assessment? 

ANSWER

There are lenders in the country whose sole or primary loan product involves financing investor-owned, 1-4 family residential properties. Our firm has such clients, and we work closely with them on their specific compliance needs. Most of them have risk-based programs that set up audit objectives and procedures. 

I suggest you contact us to discuss our IORR Tune-up®. The acronym “IORR” stands for “Investor Owned Residential Real Estate.” The intended purpose of the IORR Tune-up® is to promote consistent risk management practices for residential properties where the primary repayment source for the loan is rental income. The fee is probably a fraction of the cost you spent previously. The IORR Tune-up® will likely tell you the information you sought and does it in 60 days. 

For information about the IORR Tune-up®, Contact Us Here.

Lenders are authorized to make loans to investors to purchase or refinance 1-4 family residential real estate (“RRE”) properties for rental to others. Many lenders manage IORR financing like owner-occupied 1-4 family residential loans. However, the credit risk presented by IORR lending is more similar to that associated with loans for income-producing commercial real estate. Because of this similarity, regulators expect lenders to use the same types of credit risk management practices for IORR used for commercial real estate lending. (For banks, this expectation does not change the regulatory capital, regulatory reporting, or HOLA requirements for IORR.[i]) 

Your review should include at least the following audit objectives: 

·    Evaluate whether loan underwriting standards incorporate risks related to IORR loans. 

·    Understand methods for setting loan identification and portfolio monitoring expectations. 

·    Determine whether ALLL[ii] estimation procedures incorporate IORR loan risks and related qualitative factor adjustments, if applicable. 

·    Evaluate the adequacy of internal risk assessment and rating systems to monitor IORR credit risks effectively. 

·    Evaluate continued compliance with regulatory reporting, HOLA[iii], and risk-based capital treatment, if applicable. 

We spend considerable time keeping our clients aware of the federal and state laws and regulations relating to IORR transactions, especially the regulations that implement consumer protection laws, including ECOA, the Fair Housing Act, the Fair Credit Reporting Act, the Home Mortgage Disclosure Act, RESPA, HOEPA, TILA, and the Bank Secrecy Act. Management’s lending processes and origination platforms should ensure compliance with all applicable laws and regulations and provides timely and accurate disclosures to mortgage applicants. Mortgage loan originators and the lender’s staff must be diligent in safeguarding applicants’ and borrowers’ confidential information. 

Lenders and loan officers should provide sufficient information to customers so they fully understand material terms, costs, and risks of the loan products offered. Communication with customers, including advertisements, oral statements, and promotional materials, should provide clear and balanced information about the relative benefits and risks of mortgage loan products. 

Lenders Compliance Group has identified eighteen categories and questions that act as criteria for audit procedures. I will list them, so you can get a sense of how to build a due diligence assessment. The drill-down analysis is extensive. 

1.   Evaluate the institution’s credit risk management expectations for IORR loans. 

Know the risks! IORR has distinct and very different risks involved from traditional 1- to 4-family lending, such as the loans generally being repaid by rent and possibly some of the investor’s personal income, the investor possibly owning multiple properties, vacancies leading to lower revenue, and increased credit risk. 

Thus, it is essential to ensure appropriate policies and procedures suitable for the risks specific to IORR lending. These policies and processes should cover loan underwriting standards; loan identification and portfolio monitoring expectations; allowance for loan and lease losses (“ALLL”) methodologies, if applicable; and internal risk assessment and rating systems. 

2.   Identify if regulatory reporting, HOLA, and risk-based capital treatment are carried out properly.[iv] 

3.   Determine if IORR loans have been classified as residential or commercial. (If they are classified as residential, are they effectively managed as commercial loans?) 

4.   Does the institution exercise prudent underwriting due diligence similar to that required for commercial real estate loans? 

5.   Has an income producing property analysis been conducted? 

6.   Determine if loan structuring documents incorporate commercial-type provisions. 

7.   Are credit and administration issues being handled in a manner consistent with commercial real estate loans? 

8.   Is commercial real estate amortization guidance being followed? What guidelines are used? 

9.   Is guidance on multiple properties being followed? 

10.  Are subordination, non-disturbance, and attornment agreements obtained to cover the following issues? 

11.   Is subrogation considered in the loan agreement? 

12.  Are commercial vs. residential title issues adequately addressed? 

13.  Are loan identification and portfolio monitoring expectations adequately addressed? 

14.  Do internal risk assessment and rating systems include special consideration for IORR loans? 

15.  Does loan monitoring consider critical IORR loan issues, such as higher overall costs, smaller loan size, competition pricing like residential loans, appraisal timing, and environmental testing? 

16.  Have the IORR loans been factored into allowance for loan and lease losses considerations, if applicable? 

17.  Have IORR regulatory exam issues been adequately addressed, such as improper classification, risk rating reviews, LO monitoring, appraisal requirements, and borrower types? 

18.  Have secondary market issues been adequately addressed?

Banking Exams: Meeting the Regulator’s Expectations

QUESTION
At this time, we are handling five banking examinations. The most we’ve handled at one time was seven exams. 

We are stretched to the limit in working on them. We are in all the states, but this demand on us is daunting, to say the least. 

Over time we put together a process flow for dealing with examinations, which has worked out well, as far as it goes. But we keep having to tweak it because some examiners keep changing their processes. 

We need help in creating more procedural descriptions based on the regulator’s point of view. Our interest is in meeting the regulator’s expectations. 

What are the typical expectations of banking department examiners? 

ANSWER
You ask a very important question. Any financial institution that is not prepared procedurally for a banking examination exposes itself to potentially adverse findings. If you are dealing with multiple exams at one time, the task of handling them all effectively is really tough if you don’t have actionable procedures. The exposure climbs if you are not cognizant of the examiner’s expectations. 

My firm provides readiness support and hands-on involvement in banking examinations. One feature we often encounter is a client’s lack of procedures in being responsive to bank audits. In effect, many companies seem to be passively waiting for regulatory scrutiny rather than being proactively getting ready for it. Although they do not really know what to expect, they also do not seem to understand what the examiner expects! 

I am going to answer your question with a generalized overview. Each financial institution varies in terms of its size, complexity, and risk profile. Each company’s procedures will reflect its business structure and risk tolerance. It is possible to provide some insight into the kind of procedures you should develop in light of a regulator’s expectations. Too often, though, companies provide procedures based on what they believe should be done without really understanding the regulatory review process. 

In determining risk, regulatory agencies usually review or perform the following tasks: 

·    Develop a compliance risk profile for the financial institution, considering its organization structure, business lines, operations, and past supervisory performance. 

·    Determine the level of a company’s compliance management system (CMS), including determining management’s level of knowledge and attitude toward compliance, management’s responsiveness to current issues, the company’s compliance organization structure, management information systems, policies and procedures, training, and monitoring and audit programs.

•    Test transactions based on risks and management’s efforts and responses.

•    Validate an institution’s HMDA data and conduct a fair lending review. 

As a matter of act, the FDIC uses a tool as its first step, the Assessment of Risk of Consumer Harm (ARCH). Other agencies and several state banking departments use a similar assessment for scoping a compliance examination in their pre-examination planning. 

There is a logic behind the pre-examination plans: managing the examination based on risk factors tends to reduce the overall on-site requirement and identifies areas requiring more supervisory attention. 

A central focus is a company’s compliance management system (CMS) because it enables examiners to identify causes of compliance deficiencies and suggest appropriate corrective action. If you have not used our CMS Tune-up support, you should get it done as soon as possible. It is cost-effective, hands-on, and quick. You need to know your firm’s compliance strengths and weaknesses in your compliance management system. So, contact us! 

The following is a generic and categorical outline of a mortgage lenders’ banking examination from a regulator’s point of view. 

Request Letter

Before arriving at the bank, the regulator will issue a request letter for information, specific responses to be sent to the examiner-in-charge before the on-site review, and other responses for review on site. The request letter may ask that the following material be gathered and made available: 

·     Work papers of all compliance audits performed since the last examination, including the audit reports issued, documentation of corrective action taken, and the response from management 

·     Copies of bank compliance policies and procedures 

·     Fair lending information 

·     HMDA-LAR (if applicable) 

·     Minutes of the compliance officer, committee, or board meetings regarding compliance issues 

·     Printouts or electronic files of loans and related files 

·     Tracking documentation, such as logs, pricing, and so forth 

·     Copies of compliance forms and disclosures 

·     Résumés of all compliance personnel 

The company’s chairman of the board or president usually receives this request letter and passes the information on to the compliance officer, who is then responsible for seeing that all of the information is compiled for the examiners and that key personnel responsible for these items are aware of the examiners’ arrival date. 

When the bank examiners arrive, they should be given adequate accommodations for their time at the company. A private room, such as a conference room, with Internet connectivity, is preferred. The information requested by the examiners should be made available immediately. The compliance officer should answer any questions examiners may have regarding the audit work papers, the company’s HMDA data, its public comment file, or any other requested compliance information. 

The following sections focus on each of the items the regulator may examine as outlined in the request letter. 

Audit Procedures Work Papers 

Examiners usually review the work papers of the company’s compliance auditor to determine what steps were followed in the audit of a particular area or regulation. If the auditor has thoroughly documented the results of an internal audit and kept detailed work papers, the examiner may review those work papers and not perform any additional procedures or testing. 

Policies and Procedures 

The examiners will review copies of the compliance policies and procedures in conjunction with the audit work papers and any compliance audit reports to determine if they are being followed. For instance, a company may have several policies regarding loan approvals. These policies may include the type of employment, length of employment, length of residence, credit history, and any other factors used to evaluate creditworthiness. The examiners may review loan approvals and denials to ensure that all customers are being treated equally based on the loan policies and procedures. Note the importance of a company following its own policies and procedures! 

Required Reporting 

In addition to the policies and procedures, its fair housing information and the HMDA data (if applicable) will be reviewed to make sure that the financial institution is not discriminating against any group of people with respect to home loan transactions. These transactions include home purchase loans, home improvement loans, and refinance loans. If the mortgage lender is also a department, division, or subsidiary of a bank that files CRA data, the HMDA information also will be analyzed in conjunction with that CRA data. 

Community Reinvestment Act (if applicable) 

Under the CRA, banks are strongly urged to take an active role in meeting the credit needs of their communities, not to exclude low- to moderate-income families. Examiners carefully review the HMDA report in connection with the CRA data. Bank examiners review a bank’s CRA program and internal documentation on the role it has taken in complying with the CRA as well as the bank’s CRA public comment file. Irrespective of the apparent compliance with Regulation C, the regulation that implements HMDA data collection and filing, if examiners feel that the bank is not meeting the requirements of the Community Reinvestment Act, they can impose stiff penalties, including ceasing any branching or merging by a bank. 

Compliance Management System 

A company’s compliance management system (CMS) comprises mainly three areas: board and management oversight, compliance program, and compliance audit. When your CMS is working well, and all parties are actively involved in the compliance system, the company’s compliance risks will be limited and the program strong. Examiners prioritize this central focus of a company’s risk profile. 

If you want to information about our CMS Tune-up, please let us know! 

Management and Board Involvement 

Regulators are now taking a “top-down” approach in their reviews, so examiners will focus on the amount of management and board involvement in the company’s compliance management system. I strongly urge management and the board to take an active role in compliance. Document the involvement. Management committee minutes and board minutes should reflect that management and the board: 

·     Demonstrate compliance expectations to employees. 

·     Adopt clear compliance policy statements. 

·     Appoint a compliance officer with authority and accountability. 

·     Allocate adequate resources in all areas. 

·     Review periodic audits. 

·     Discuss compliance activities, actions, strengths, and weaknesses in their meetings. 

Printouts, Online Access, Digital Reviews 

Printouts or electronic files of all loans are usually requested for a specified period. Examiners will need access to such information and documentation. They can also request additional information concerning selected items from the reports to choose an audit sample for further review. 

Compliance Forms and Disclosures 

Regulators review numerous forms and disclosures. These forms are sometimes developed internally or purchased from an outside vendor. The regulator will review all of the compliance forms used by the company to ensure that they satisfy applicable regulatory requirements. 

The compliance officer should review these forms and disclosures before submitting them to a regulator in order to ensure that they comply with the company’s policies and the latest regulatory requirements. Personnel should not change disclosure or reporting forms before the compliance officer has a chance to approve the changes. This procedure will minimize the regulatory examiner’s discovery of incorrect or inadequate disclosure.

Mortgage Companies and Credit Unions: New CRA Law

QUESTION
We are a credit union located in Illinois. Recently, we have become involved in developing CRA initiatives for the first time. Non-bank mortgage companies in Illinois are also affected. We have had numerous conversations with mortgage companies in our area about it. This is happening because Illinois has passed a law that requires us to collect and report CRA data.

Here’s a news article on the law: “Illinois Will Now Grade Credit Unions and Mortgage Companies on Their Commitment to Fair Lending.”

A few quotes from this article give you an idea of what I’m referring to.

“But now, for the first time in Illinois, mortgage companies and certain credit unions are subject to standards for community reinvestment just like banks.” …

 

“Only a few other states have their own CRA laws. Generally, state CRA laws and regulations hew closely to federal reinvestment policies and standards, but provide an extra layer of oversight.” …

 

“Meanwhile, Federal Reserve Chairperson Jerome Powell recently voiced his support for expanding the federal CRA to all institutions that make consumer loans.” … 

So, our question is, can you give us some preparatory notes to consider in drafting policies and procedures for the CRA requirements? 

ANSWER
We have clients in Illinois, and we’ve been tracking this legislation since its inception. Consequently, our clients have been getting gradually ramped up in advance of the law being passed. In the last month especially, we have been retained by state credit unions and non-bank mortgage lenders in Illinois to prepare them for the Illinois Community Reinvestment Act (ILCRA) requirements, as outlined in the subject legislation.

What action can you take?

We have subject matter experts and are fully staffed to help you. 

Don’t try to go it alone if you haven’t had substantial experience in Community Reinvestment Act requirements. 

Please notify others similarly situated to contact us HERE. We’ll respond promptly.

What is the new law about?

The federal CRA was passed to address concerns with financial institutions that accepted deposits from their local communities and failed to make loans in the same communities. Under the Illinois provision, the ILCRA does not just pertain to depository institutions. It requires regulators to examine financial institutions for ILCRA compliance and consider their local lending records when they seek approval to open new offices, relocate offices, merge or consolidate, acquire other institutions, or expand their authority. Your HMDA filing is still mandated, so the HMDA and ILCRA filings must be consistently corroborative of each other.

The ILCRA law you referred to was signed into law and became effective on March 23, 2021. It is called the Illinois Community Reinvestment Act (“ILCRA”).[i] The ILCRA requires continuing community investment obligations on covered financial institutions, which include non-depository mortgage lenders.

Take note, the ILCRA does not require financial institutions to undertake any particular activities or make risky loans. The law provides for considerable flexibility in meeting the credit needs of local communities within the bounds of safety and soundness.

The ILCRA applies to covered financial institutions, which include Illinois charted depositories (banks and credit unions), and entities licensed under the Illinois Residential Mortgage License Act of 1987 (ILRMLA), which lent or originated 50 or more residential mortgage loans in the previous calendar year.

How about definitions?

It is worth noting that the ILCRA does not define the terms “lent” or “originated,” and the scope of these terms is currently unclear. I suggest you review these definitions with us in the context of your institution’s loan products. However, how these terms will be defined are significant to some ILRMLA licensees because the ILRMLA license covers entities performing various mortgage market activities, for instance, mortgage brokers, lenders, services, and secondary market purchasers. Having said that, while it’s likely that these terms would cover brokers and lenders, it is somewhat unclear whether these terms also cover servicers and secondary market purchasers unless the terms “originated” or “lent” are defined to include mortgage loan modifications and purchasing mortgage loans.

What are performance tests?

Regulators are required to evaluate each financial institution’s actual performance in meeting the credit needs of its entire community, including low- and moderate-income neighborhoods. Generally, the regulator applies the lending, investment, and service tests to evaluate ILCRA compliance, the first test – the lending test – is the most important for the purposes of sketching out brief response because it focuses on your mortgage lending efforts. 

·        The lending test measures your lending activities by assessing the home mortgage loan originations and purchases, small business and small farm loans, community development loans, and, when appropriate, consumer loans. 

·        The investment test evaluates the extent to which you meet community needs through qualified investments. 

·        The service test reviews the availability and responsiveness of your systems for delivering retail banking and community development services. 

Are there checklists and worksheets?

There are some basic checklists and worksheets that you will want to include in your ILCRA policies and procedures, among which are review sheets for: 

1.       Branch Openings

2.       Public File Audits

3.       Service Activities

4.       Community Development Loans 

How do you meet a community’s financial needs?

The ILCRA expects you to meet the financial services needs of the communities where your institution has offices, branches, and other facilities are maintained. And that means taking into consideration the products and services offered via mobile and other digital channels. Additionally, your institution should help meet the financial services needs of deposit-based assessment areas, including areas contiguous thereto, low-income and moderate-income neighborhoods, and areas where there is a lack of access to safe and affordable banking and lending services. However, these obligations are imposed in a manner consistent with your institution's safe and sound operation.

Let’s drill down a little. Please keep in mind that this is a very complex area of regulatory compliance, so please keep this a high-level overview.

How will you be evaluated?

The Illinois Department of Financial and Professional Regulation (“IDFPR”) will assess the records of each institution that is subject to the ILCRA obligations. To conduct such compliance assessment, the IDFPR will set forth rules which must cover the assessment of the following factors: 

·        Activities to ascertain the financial services needs of the community, including communication with community members regarding the financial services provided; 

·        Extent of marketing to make members of the community aware of the financial services offered; 

·        Origination of mortgage loans, including, but not limited to, home improvement and rehabilitation loans, and other efforts to assist existing low-income and moderate-income residents to be able to remain in affordable housing in their neighborhoods; 

·        For small business lenders, the origination of loans to businesses with gross annual revenues of $1,000,000 or less, particularly those in low-income and moderate-income neighborhoods; 

·        Participation, including investments, in community development and redevelopment programs, small business technical assistance programs, minority-owned depository institutions, community development financial institutions, and mutually-owned financial institutions; 

·        Efforts working with delinquent customers to facilitate a resolution of the delinquency; 

·        Origination of loans that show an undue concentration and a systematic pattern of lending resulting in the loss of affordable housing units; 

·        Evidence of discriminatory and prohibited practices; and 

·        Other factors or requirements as in the judgment of the IDFPR reasonably bear upon the extent to which an institution meets the financial services needs of its entire community, including responsiveness to community needs as reflected by public comments.

What is in the assessment report?

Your institution will get a written report of the examination, parts of which will be made public. It will provide information no less than that provided under the Federal Community Reinvestment Act. You will have an opportunity to review and comment on the report of the examination. The public will have an opportunity for inspection and comments on the public-facing part of the report. The ILCRA requires covered institutions to provide a public notice in the public lobby of each of its offices, if any, and on its website. The public notice has a specific, public declaration language.

The ILCRA report of examination must include the following components: 

·        The assessment factors utilized to determine the institution’s descriptive rating; 

·        The IDFPR’s conclusions for each such assessment factor; 

·        A discussion of the facts supporting such conclusions; 

·        The institution’s descriptive rating and the basis therefor; and, 

·        A summary of public comments.

Is there a compliance rating?

Concerning the compliance rating, there are four such ratings, as follows: 

1.       Outstanding record of performance in meeting its community financial services needs; 

2.       Satisfactory record of performance in meeting its community financial services needs; 

3.       Needs to improve record of performance in meeting its community financial services needs; or, 

4.       Substantial noncompliance in meeting its community financial services needs.

The effect of the compliance rating will cause your company (viz., including parent and subsidiary) when you apply for: 

·        Establishment of a branch, office, or other facility; 

·        The relocation of a main office, branch, office, or other facility; 

·        A license renewal; 

·        Change in control; and, 

·        Mergers or acquisitions.

Importantly, that means dispositively that your record of compliance with the ILCRA obligations may be the basis for the denial of the foregoing applications.

Even non-depository mortgage lenders are covered?

Of course, non-depository mortgage lenders traditionally were not subject to community reinvestment obligations because, unlike banks, they did not make loans using depositors’ money; that is, non-depository mortgage lenders use their own private funds to provide financial services, and for this reason, historically, they were not required to “reinvest” depositors money back in the communities in which they operated. But the ILCRA has changed this standard: it imposes a new community investment (rather than the federal, generic “reinvestment”) obligation on non-depository mortgage lenders.

How will this affect your budget?

As I see it, the ILCRA will most likely result in additional costs related to compliance and examinations, especially for non-depository mortgage lenders. For them, it’s all entirely new. But a can of worms can be opened because of the ILCRA. It may lead to additional fair lending enforcement action against institutions as a result of ILCRA examinations. At this point, much will also depend on how the IDFPR defines assessment areas for ILCRA compliance – leading to a requirement for the institution to conduct marketing and outreach in areas that they did not cover or operate in before.

Will non-depository mortgage lenders ever be exempt?

Non-depository mortgage lenders will need to ramp up appropriately and promptly, as they are certainly going to be included, even though there has been an attempt to remove Illinois charted depositories (i.e., banks and credit unions) from the covered financial institutions. To which I submit: removal of banks and credit unions – don’t count on that happening!

After the passage of the ILCRA, on February 19, 2021, to wit, after the Illinois legislature passed the ILCRA, but before it became law, new legislation was proposed,[ii] which would remove Illinois charted depositories from the definitions of a covered financial institution under the ILCRA.

In any event, if this bill becomes law, it would still leave non-depository mortgage lenders subject to the ILCRA obligations. And, I expect this type of legislation to become law in many states soon.

I suggest that you notify covered institutions to contact us HERE. We’re ready to help.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director

Lenders Compliance Group

---

[i] Illinois Community Reinvestment Act (“ILCRA”), Senate Bill No. 1608, Public Act 101-0657, Article 35, was signed into law on March 23, 2021
[ii] House Bill No. 3694

Fair Housing Exclusions

QUESTION

A church in our area owns a residential building consisting of rentals and condominiums. It does not allow its housing to be rented by or sold to anybody who is not a member of their church. Isn’t that a housing violation?

ANSWER

The Fair Housing Act is the federal Act that, among other things, prohibits discrimination on the basis of various protected categories, such as on the basis of religion, with respect to the sale, rental, or advertising of dwellings, provision of services of facilities in connection with the sale or rental of a dwelling, and availability of residential real estate-related transactions (i.e., mortgage loans, appraisals, and so forth). 

[24 CFR §§ 100.5, 100.50, 100.110]

A dwelling is any building, structure, or portion thereof that is occupied as, or designed or intended for occupancy as, a residence by one or more families, and any vacant land that is offered for sale or lease for the construction for the construction or location thereon of any such building, structure, or portion thereof. [24 CFR § 100.20]

The Act does not prohibit a religious organization, association or society, or any non-profit organization operated, supervised, or controlled by or in conjunction with a religious organization, association or society, from limiting the sale, rental or occupancy of dwellings that it owns or operates for other than a commercial purpose to persons of the same religion, or from giving preference to such persons, unless membership in such religion is restricted because of race, color or national origin.

[24 CFR § 100.10(a)(1)]

Jonathan Foxx

President & Managing Director

Lenders Compliance Group