Inflation, Tariffs, and Mortgage Lending

QUESTION 

I am the CFO of a mid-sized mortgage lender. We originate mortgages in 36 states. I am concerned about the impact that inflation has on mortgage banking. The tariffs are gradually driving up inflation, and economists predict a significant rise over time. 

I am concerned about being prepared for inflation's effects on mortgage lending. I'm sure we can prepare for inflation. But my question is about the impact and the signs to look for. Thank you for considering this question. 

What is the impact of inflation and tariffs on mortgage rates? 

OUR COMPLIANCE SOLUTION 

Secondary Tune-up

Our Secondary Tune-up helps to determine which aspects of a financial institution's Secondary Market program may be considered inadequate or defective. It is a mini-audit, targeted at Secondary Market activity, that reviews strengths and weaknesses. The purpose of this review is to provide information that will enable an organization to develop effective guidelines. At the heart of setting mortgage product pricing and rates amid intense competition is managing changes in expectations across the primary and secondary markets. Request Information 

ANSWER TO YOUR QUESTION

You ask a good question. Often, mortgage originators focus on interest rates, and with good reason. Inflation indirectly increases mortgage rates by prompting central banks to raise interest rates to slow the economy, which in turn leads to higher monthly payments for new and adjustable-rate mortgages (ARMs). 

When rates rise, homebuyer affordability declines, and while fixed-rate borrowers are protected from future hikes, their new loans will have higher initial costs. For existing homeowners, high inflation can impact their decision to refinance, while low inflation may encourage them to lock in lower rates. 

I think you are correct to tie tariffs to interest rates. Tariffs can negatively affect mortgage lending by raising interest rates and increasing monthly payments, thereby reducing housing affordability. This is because tariffs can increase inflation, prompting central banks to raise interest rates, and can also cause market instability and reduce demand for U.S. debt, further pushing Treasury yields and mortgage rates upward. Additionally, tariffs on construction materials raise home prices and can lead to more volatile application volumes and tighter underwriting standards for lenders. 

CREDIT MARKETS 

While many people monitor equity indices, I keep an eye on credit markets. In my view, the credit indices tell me what is really happening in the economy. Credit is a crucial component of the financial system, influencing everything from individual finances to broader economic trends and serving as an indicator of economic health. So, while others look at stocks and other equity instruments, I look at the primary, secondary, public, and private credit markets. 

Prevailing interest rates are a key indicator of the health of the credit market. The level of investor demand also signals market conditions. And, the difference in interest rates between different types of bonds, like government bonds versus corporate bonds, can indicate economic risk. A widening spread can signal that investors are viewing corporate bonds as riskier, possibly foreshadowing a recession. 

So, let's dig deeper into the impact of inflation on mortgage banking. 

INFLATION 

When inflation is high, the Federal Reserve may increase its benchmark interest rate to cool the economy. This directly leads to higher interest rates on new mortgages and can increase the monthly payments on existing ARMs. Higher interest rates and home prices make mortgages more expensive, reducing a borrower's purchasing power and forcing them to buy smaller or less expensive homes. High inflation might prompt some borrowers to take out an ARM with the expectation that rates will fall, enabling them to refinance later. 

A fixed-rate mortgage offers some protection. Once a fixed-rate mortgage is secured, the interest rate will not change, even if inflation continues to rise. In a high-inflation environment, a fixed-rate mortgage taken out at a lower rate becomes more valuable compared to new mortgages with higher rates. 

Thus, refinancing becomes prevalent. If inflation is high and rates are rising, homeowners with existing fixed-rate mortgages may be hesitant to refinance, as new loans will have higher rates.

And when inflation is low and interest rates are lower, more homeowners may look to refinance their existing mortgages to lock in a better rate.

What to Expect from a Fannie MORA audit?

Request Article 

Request MORA Tune-up® Information 

QUESTION 

Last month, you answered a question about doing an internal audit in advance of Fannie’s MORA audit. We did not pay much attention to it because (A) we never had a MORA audit, and (B) we did not expect a MORA audit anytime soon. Then, all hell broke loose! 

Yesterday, we got a letter from Fannie Mae telling us that they will be scheduling a date for an on-site audit. They are requesting policies, procedures, and many other documents. There are due dates. This review makes a state banking exam look like child’s play. But I’m a QC manager, so I don’t have the whole picture of our risks. However, I do know one thing: we are not ready for this MORA audit. 

The CEO called a team meeting in the conference room. Our compliance manager is in charge, and everyone reports to her. I got your name at the meeting because she said we are going to use you to do a MORA Tune-up®. I just wish they would have done this sooner. 

What I need – and I think they need it too – is some idea of what we can expect from the MORA exam. I hope you don’t wait to reply. The compliance manager and others in management read your articles. They pass them around to us all the time. Please tell us what to expect about the MORA process. 

What is the audit process of a Fannie MORA audit? 

SOLUTION 

MORA Tune-up® 

RESPONSE 

If you want a copy of this article, please contact us here. 

We realize your question is urgent. Accordingly, we are prioritizing a response. You only have a few weeks to get ready for the MORA audit, the purpose of which is for Fannie Mae to evaluate your company’s compliance with Fannie guidelines as well as assess the operational risks. 

For those who don’t know, Mortgage Origination Risk Assessment (MORA) is a Fannie Mae review of a Fannie Seller/Servicer. It is intended to be a collaborative engagement led by the review team with the active participation of your organization.[i]

Getting our MORA Tune-up® engaged is one of several readiness activities you must undertake as soon as possible. Ours is the pioneer of the Compliance Tune-up, a unique review that provides a risk assessment and self-evaluation to satisfy the Second Line of Defense. I am grateful that your compliance manager chose Lenders Compliance Group. Nevertheless, to all our subscribers, please know that a few compliance and law firms offer to prepare you for the MORA review. Pick one you trust and get it done! 

There are seven phases in the MORA review process, and I will outline them for you. My outline will give you a high-level view. You should not delay! 

Here are the seven phases of a MORA review: 

Phase 1: Selecting the Organization 

Phase 2: Confirmation and Engagement 

Phase 3: Document Request and Receipt 

Phase 4: Process Evaluation 

Phase 5: Interviews 

Phase 6: Final Assessment 

Phase 7: Remediation 

I am going to provide a brief overview of each phase. However, numerous contingencies can affect the process and outcome. Take this review as a deep dive, one that will make your company stronger and its relationship with Fannie more durable. It is not too late to get started immediately. 

PHASE 1: SELECTING THE ORGANIZATION 

Fannie Mae selects organizations for a review using risk-based inclusion criteria and provides advance notice to the organization prior to scheduling the review. A member of the review team begins the process by compiling the organization’s pertinent contact information to start the review before moving to Phase 2. 

We are often asked if there is a way to predict whether and when the selection takes place. The short answer is No. The best answer is Soon. In other words, always be prepared.

PHASE 2: Confirmation and Engagement 

There are obviously two parts to this phase: the first part involves confirmation, and the second part involves scheduling. These two parts are interfaced. What happens is your point person – in your case, the compliance manager – will discuss Fannie’s BAMS team, that is, its Business Account Management Solutions team, to discuss some basics. The MORA team is independent of the BAMS team. This is a sort of Question and Answer format where the BAMS team gathers the following information:

Policy and Procedure links to Change Management

QUESTION 

We need an overhaul of our policies and procedures. Our company merged with another company, and our policies are different in many ways, from the text itself to the format. It is tough enough to have the merging of two cultures, we are now banging into one another over what policy applies and what procedures to follow. 

As the Compliance Officer and General Counsel, I am involved in harmonizing these documents, and the task is almost overwhelming. Every project impacts our policies. We have had to update our Change Management policy five times in the last six months just to adapt to the merging of documents. 

What I need is some kind of checklist that I can get stakeholders to agree to or at least accept by consensus. I consulted with experts in policy development, but it was frustrating. If they knew the regulatory requirements, they disagreed on the text, and if they knew the formatting requirements, they disagreed on the best format. They seem oblivious to the implications of Change Management. 

A member of our Board of Directors referred me to you. She believes you can help resolve these issues. So, I'm writing you for guidance. I also want to schedule a call with you to discuss your services. 

Can you help us understand how our policies and procedures are linked to our Change Management requirements? 

SOLUTIONS 

·       Customized Compliance Library

·       Policies Tune-up®

·       CMS Tune-up®

RESPONSE 

There are a few aspects to your circumstances. Not only do you mention the issue of merging policies and procedures resulting from a merger and the impact on projects, but you also note how many times you have had to update your Change Management requirements because of this debacle. We have handled and resolved matters such as yours many times. Your situation often happens. 

Many clients come to us for our customized compliance library. Since you are new to our services, it is worth knowing that we pioneered the effective drafting and implementation of a compliance library. So, you have come to the right place! I'm sure we can help! 

Let's start with Change Management. What is it? Essentially, it is the governing methodology that provides an infrastructure to support and sustain change throughout multiple phases in your financial institution while focusing on achieving a set of defined and desired business results. 

There is a good reason why you mention Change Management. That is because your policies and procedures are an intrinsic part of it. 

To clarify, a financial institution is under pressure from regulators, borrowers, shareholders, and investors to improve its business continuously. These pressures lead to companies initiating a wide range of company projects, including small, targeted updates, process enhancements, large, complex system implementations, and major business process re-engineering initiatives. Thus, an institution's ability to standardize its process and project management practices mitigates the risk of project failures and maximizes the value delivered to its organizational processes. 

Therefore, you have hit on the two primary purposes of Change Management: 

·       Process Management, and

·       Project Management. 

I am going to offer a way to think about Process Management and Project Management and how they link to Change Management. Merged policies and procedures will be given their due consideration. 

BUILDING A CHANGE MANAGEMENT FRAMEWORK 

Before understanding the operational framework of Change Management, its two primary purposes, and its derivative structures, such as policies and procedures, you must determine:

1. Define and describe what changes will be implemented.

2. How to coordinate the input from stakeholders.

3. What will constitute a formal change plan.

4. The resources and data that will be used and available.

5. The overall communication strategy at all operational levels.

6. A review of budget risks associated with change. 

CHANGE MANAGEMENT METHODOLOGY 

As the company's Compliance Officer, it would be your responsibility to establish controls to ensure a viable Change Management methodology is applied consistently between individuals and work groups. 

I recommend that your methodology contain the following guidelines. 

·     Determination of business ownership and governance responsibilities.

·     An impact analysis prior to the implementation of process changes.

·     Communication of new or revised processes to impacted business units or areas.

·     A process that ensures policies, procedures, and processes are updated to reflect remediated control deficiencies.

·     A procedure for approving new or revised processes.

·     A procedure for managing and introducing process revisions.

·     The identification of training needs based on creating or updating policies and procedures.

·     The validation of new or revised policies and procedures prior to implementation. 

PROCESS MANAGEMENT 

Once the Change Management framework is completed, you can move on to interfacing them with Process Management and Project Management.

The primary purpose of process management is to group specific operational components for implementing interlocking institutional bases and contributing to an institution's activities. This means, in theory and practice, the setting up of the requirements needed to effectuate change throughout the company. 

Our reviews of Process Management have shown that there are at least eight structures needed for executing efficient institutional activities. This is a list that we use to ensure the stability of Process Management.

 

1.     There should be a centralized repository for all policies and procedures. In our work, we keep our clients' Masters in an encrypted, secure extranet.

 

2.     A dedicated group that oversees changes related to processes, systems, and policies. You must have a point person or persons involved in oversight. The contact information should be in writing and ratified by the board and/or management.

 

3.     Policies, procedures, and support documents are "mission-critical" key processes. They must be continually evaluated and updated with current revisions.

 

4.     All policies, procedures, and support documents should evaluated for completeness and accuracy. Inactive, dormant, and inoperative policies should be formally retired. Abeyant and suspended policies should be mothballed.

 

5.     Quality assurance reviews should be conducted periodically to ensure the actual performance of employee work processes is consistent with process flows and descriptions.

 

6.     The oversight team should draft a change management manual or tool to manage and track process updates. The board or management must ratify the manual.

 

7.     A standardized template should be modeled for policies and procedures throughout the organization.

8.     Be sure that the appropriate staff responsible for change management processes is well-trained or has the necessary skills to perform these functions.

PROJECT MANAGEMENT 

There are many ways and means to build project management structures. We have project managers who are credentialed in this task; however, you can create basic elements that interface with the Change Management framework. 

You don't need to be overwhelmed by this undertaking. Everything can be accomplished gradually so long as you have a logistical approach. A generic outline of project management should contain at least the following components: 

·       A project management manual or tool to track and manage projects.

·       Referenced policies, procedures, and systems affected by a project.

·       Project management tracking reports.

·       Centralization of project activities in an oversight group.

·       Training of relevant staff for project participation and management.

·       Periodic project tracking reports are communicated to stakeholders.

·       Updates to the inventory of projects subject to tracking. 

I also recommend that your project management methodology include: 

·       Communication of project goals and status.

·       Milestone reviews and approvals.

·       Identification and mitigation of project risk.

·       Identifying stakeholders, including their operational relevance.

·       Documenting procedures for change control documentation.

·       An escalation process for projects where there are tracking errors.

·       Log of activities with a column for remediation information and implementation. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

Housing Prices, Mortgage Rates, and Morale

QUESTION 

Since the election, our staff has seen a drop in morale. As the CEO, I felt it important to call a companywide Zoom meeting to discuss it. I asked our Chief Compliance Officer and Director of Human Resources to be on the call. During the call, we asked for participation in a survey, which showed quite a divide among staff, especially on how they see the future of mortgage banking and the country. 

Overall, the call was a good idea. People felt less intimidated to share their views, but a lot of people held back. Afterward, I received many emails from employees who thought they were not safe to express themselves. The throughline of these emails was that they feared reprisals from people who held political views opposite to theirs. 

The two big areas of disagreement began over what will happen to housing prices and the future of mortgage rates. There were arguments about whether the new administration's policies would cause a decline in housing prices and an increase in mortgage rates. The differences expanded and became intimidating.

This is the first time I've encountered such a situation. I am concerned about how this will affect our customer, departmental, and vendor relationships. Now, I know you're not a psychologist. We did an HR Tune-up a couple of years ago, and we had an excellent risk score, but this situation is unusual. I don't think it's an HR issue. We also had you do a CMS Tune-up for our compliance management review. However, this situation seems more like an internal risk. I am concerned about the attitude we bring to mortgage banking relationships. Maybe you could offer some feedback. 

I have read your column for years. Members of my firm read your newsletter. I want to post your reply to our company employee page. I have scheduled a call with you this December to discuss new Compliance Tune-up engagements. In the meantime, I urge you to let us know how you view the situation. 

What can I tell our employees about the future of housing prices and mortgage rates? 

What should I do about the harassment and intimidation issues that are messing with our morale? 

SOLUTION 

Compliance Tune-up 

ANSWER 

Since the election, I have received an enormous number of emails from clients, non-clients, subscribers, news organizations, colleagues, academics, and even a few retired regulators. As you correctly surmised, our firm only provides guidance based on our expertise in residential mortgage banking. We are not forecasters bent on prognosticating future events. We immerse ourselves in legal and regulatory compliance, conduct audits and due diligence reviews, and prepare our clients for regulatory changes. 

Given the outpouring of interest, we are considering offering a webinar on the impact of the election outcome on mortgage banking. If you think this is a webinar you would attend, please let me know here. I welcome your input. 

A recurring concern in the emails was the extent to which the new administration will undo regulations and consumer protections. The punditry has been out in full force. I will offer some educated guesses, but they are just guesses. I'll offer some feedback on the new administration's policies with respect to their potential impact on housing prices and mortgage rates. Given your concerns about the morale issues, I will conclude with a few words about mitigating a hostile work environment.

Housing Prices 

Reducing or terminating certain regulations might have a positive effect on housing markets. The theory is that less regulation usually leads to more active markets. 

I have spoken to a few builders – one of them is a national builder – who believe they will do better in the forthcoming plans to reduce regulations. That said, it seems to me that the supply of homes will still run short of some expectations and depends on the variable of an expanding economy, which generally causes home prices (and rents) to increase. 

However, some builders tell me that they expect tax incentives. When I pushed them on this theory, they said to me that increased housing inventory leads to lower home prices – the old supply and demand concept. I noted that the supply/demand ratio has its challenges, too, because lower home prices can, and often are, offset by increases in home buying costs caused by tariffs, which might increase costs, notwithstanding higher mortgage rates. 

For instance, the Trump tariffs imposed on Canadian lumber shipped into the U.S. were continued under the Biden administration. That drove up the average cost of a newly built home by about $14,000, according to a 2022 estimate by the National Association of Home Builders.[i] 

Maybe there will be further development of "opportunity zones,"[ii] which induce companies (or individuals) to invest in certain low-income areas in exchange for specific tax benefits (i.e., deferring capital-gains taxes). There will likely be the continuation of the Low-Income Tax Credit, which is a federal program ratified in 1986 that provides tax credits to housing developers in exchange for building affordable rental housing. 

Other factors that drive up the cost of housing are lot costs, uncertainty regarding the cost and availability of building materials, appraisal concerns, and survey timing. Federal, state, and local regulations also play a role in slowing the growth of the housing sector. How these factors get priced into the housing market will affect housing growth and supply. Notwithstanding the current market, which has pending home sales at their highest level since March, mortgage rates have been higher since early October.[iii] 

I do think it is appropriate to factor in the potential for a severe shortage of labor. The shortage is now at 52%. Previously, it was at 58% in 2023 and a record high of 77% in 2021.[iv] The problem of labor shortage worsens because 3,000,000 immigrant workers[v] account for 26% of the construction workforce.[vi] That's a record high![vii] The problem is the proposed plans for mass deportations of immigrants could have a substantial adverse impact on the house-building industry. 

There is a growing consensus among economists that deporting undocumented immigrants will further erode construction labor. As one well-known economist, Chief Economist Lisa Sturtevant of Bright MLS recently said:

"…the "mass deportation proposal would have a chilling effect on the construction industry, shrinking the already constrained labor force and stalling badly needed new housing construction." … "At the same time, proposed tariffs will increase building costs."[viii] 

In my conversations with builders and lenders, the response I get is that native-born construction workers will take the place of the immigrants. Well, I'm not so sure. According to one study, native-born workers are reluctant to join the construction industry. Their total count remains below the boom levels of the mid-2000s by over half a million.[ix] In fact, one in three craftsmen comes from outside the U.S. 

Mortgage Rates 

I'm not a prophet, but it doesn't take prophecy to figure out the short-term trajectory of mortgage rates, given the new administration's proposed plans. It seems to me that mortgage rates will remain high for now. I watch the credit markets closely, and I've noted the 10-year Treasury note has risen considerably recently, ostensibly, I suppose, in anticipation of a Trump win; but, remember, the 10-year pulls the 30-year mortgage rate along with it. Treasury yields usually increase when investors expect inflation to increase. In other words, investors are signaling an expectation of rising inflation. 

Here's an age-old formula: higher economic growth can lead to higher inflation, and higher inflation can lead to higher interest rates. 

Bond yields are rising because investors must be expecting the proposed fiscal policies to expand the federal deficit, meaning the downward direction of inflation will likely turn upward. Put another way, mortgage rates will be higher in the short term because investors are signaling that the budget deficit will not improve, notwithstanding the Fed cutting short-term interest rates. Therefore, unless inflationary pressures subside, it seems unlikely that the Fed will not make deeper interest rate cuts, which will keep mortgage rates high. 

During the campaign, Mr. Trump said mortgage rates would come down to 3% or lower.[x] My conjecture can be summed up in the following legal terminology: "Not going to happen!" Or, perhaps it could, if and only if there is a sharp economic downturn. I'm not into major economic crashes or some other kind of nasty economic downturn as a means to bring down mortgage rates. I hope you feel the same way! 

Here's another age-old formula: macroeconomic and microeconomic events determine mortgage rates, but presidents have no power to reduce mortgage rates. None. Not even a little bit! 

Given the foregoing observations, in the long term, it may be that home buying will peter down, not bubble up. 

Several of Trump's plans to impose tariffs could lead to higher mortgage rates through the end of this year. Let us not forget that the federal deficit will impact mortgage rates. I read that the president-elect says he will "charge" tariffs on several countries. Of course, tariffs are a tax paid by American consumers. So, it is the American consumer who is being "charged." Tariffs are import or export taxes added to the cost of goods and passed on to the American consumer. They are highly inflationary. And they often trigger retaliatory tariffs, thereby agitating and increasing the inflationary debacle. 

Here's a final age-old formula: taxing American consumers through tariffs, reducing construction labor supply (already severely depleted), implementing tax promises[xi] (i.e., expanding the 2017 tax cuts), increasing the deficit, may lead to a rise in inflation, higher housing prices, and elevated mortgage rates. 

Morale 

I would like you to consider a few final words regarding your observations that participating employees felt they "were not safe to express themselves" because "they feared reprisals from people who held political views opposite to theirs." I do not want to gloss over this fear, as it has a deleterious impact on the sales and operational processes and could even lead to a hostile work environment. You may face legal liability if you do not correct the issue immediately. If an employee is telling you they feel intimidated or afraid, that may be a sign of a hostile work environment. 

Such an environment is where an employee experiences unwelcome conduct, usually severe and pervasive, expressed through offensive behavior, harassment, and discrimination that is severe enough to impact their ability to do their jobs. The fallout on company morale, consumer relations, operations, legal and regulatory risk, and public sentiment can adversely affect a company's risk structure. 

When we have done HR Tune-up audits, we occasionally find hostile work environments overtly or covertly taking shape through such conduct as public humiliation or belittlement, unwanted sexual advances or attention, physical threats or intimidation, subjective abuse of the victim, bullying, and jokes and comments related to someone's beliefs and protected characteristics. You should not think that having a company call puts an end to such problems. They rarely do. 

So, here's my advice, take it or leave it. I think you should publish a Code of Ethics and Conduct, which must be consistent with state and federal law, that sets forth your policy concerning zero tolerance for a hostile work environment. If you want, we offer a strong Code of Ethics and Conduct. 

The Code should include procedures to mitigate the risk. The procedures should include the following:

 

1.   Maintaining a detailed record of the harassing behavior, including dates, times, witnesses, and specific details of what happened.

 

2.   Informing a supervisor, HR department, or appropriate authority about the behavior.

 

3.   Bringing in an employment attorney if the offending issue is not addressed adequately. 

You have already made a good start by opening the dialogue and recognizing the challenge. Now, you need to ensure that the fears and feelings of intimidation do not create a hostile work environment. Taking prompt action to prevent and promptly correct any harassment[xii] can lead to a safe workspace, boost morale, and potentially avoid liability. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group

---

[i] Since Pandemic Onset, Lumber Products Have Added $14K to House Price, $51 to Rent, Emrath, July 14, 2022, Paul, National Association of Home Builders, https://eyeonhousing.org/2022/07/since-pandemic-onset-lumber-products-have-added-14k-to-house-price-51-to-rent/ 

[ii] See Tax Cuts and Jobs Act of 2017 (TCJA)

[iii] Pending home sales hit seven-month high, McAlinden, Fergal, November 27, 2024, Mortgage Professional (MP), Key Media  https://www.mpamag.com/us/mortgage-industry/market-updates/pending-home-sales-hit-seven-month-high/515737

[iv] Labor Shortages Ease, But Remain Worse Than in the Last Boom, Emrath, Paul, February 23, 2024, National Association of Home Builders, https://eyeonhousing.org/2024/02/labor-shortages-ease-but-remain-worse-than-in-the-last-boom/

[v] Immigrant Share in Construction Sets New Record, Siniavskaia, Natalia, November 20, 2024, National Association of Home Builders, https://eyeonhousing.org/2024/11/immigrant-share-in-construction-sets-new-record/. “In 2023, 11.9 million workers, including both self-employed and temporarily unemployed, comprised the construction workforce. Out of these, 8.9 million were native-born, and 3 million were foreign-born, the highest number of immigrant workers in construction ever recorded by the American Community Survey.”

[vi] The Role of the Recent Immigrant Surge in Housing Costs, Frost, Riordan, October 29, 2024, Joint Center for Housing Studies, Harvard University, https://www.jchs.harvard.edu/blog/role-recent-immigrant-surge-housing-costs

[vii] Op. cit v

[viii] 5 ways Trump's next presidency could affect the U.S. economy — and your money, Picchi, Aimee, November 7, 2024, CBS News, https://www.cbsnews.com/news/trump-election-impact-on-economy-taxes-inflation-your-money/

[ix] Op. cit. v

[x] Trump’s First Broken Promise Will Be 3% Mortgage Rates, Levin, Jonathan, November 6, 2024, Bloomberg, https://www.bloomberg.com/opinion/articles/2024-11-06/trump-s-first-broken-promise-will-be-3-mortgage-rates-election-2024

[xi] What Trump's return to the White House could mean for the economy and taxes, Pettypiece, Shannon, November 6, 2024, NBC News, https://www.nbcnews.com/politics/2024-election/trumps-return-white-house-mean-economy-taxes-rcna177690. "Economists at the University of Pennsylvania estimate Trump’s tax and spending plans would increase the deficit by $4.1 trillion when accounting for the effects they would have on the wider economy."

[xii] Harassment, U.S. Equal Employment Opportunity Commission, https://www.eeoc.gov/harassment

Regulatory Mandate: Third-Party Risk Management

QUESTION 

I am the Compliance Manager of a bank. We have a mortgage banking platform. I handle our legal and regulatory compliance. Our new Chief Risk Officer wants to review our Third-Party Risk Management policy and procedures. The problem is that we do not have such a policy and procedures. 

We have vendor management procedures, which our regulator has accepted. Like me, the CRO is an attorney but he can’t fathom how we could have functioned for so long without this policy, irrespective of the regulator’s evaluation. I respect his view, and he has discussed case law and regulatory requirements with me. But, the fact is, we simply have never created a comprehensive policy just for third-party risk management. 

I understand now that a policy for Third-Party Risk Management is an essential requirement that must be drafted and ratified by our Board. The policy must extend to other banks and nonbanks with which we do business. We need some guidance in drafting this policy. The CRO follows your articles, and he asked me to write to you. I have subscribed and encouraged our staff to subscribe. 

What are some key features of a policy focused on Third-Party Risk Management? 

COMPLIANCE SOLUTION 

TPRM Tune-up®

Third-Party Risk Management

Policy and Procedures 

ANSWER 

Thank you for subscribing, and I appreciate your Chief Risk Officer reading our articles. We have been publishing these articles for many years, and it is humbling when our subscribers express their gratitude. 

Our research of public enforcement actions shows that approximately 25% of them - that’s one in four enforcement actions! - against banks and nonbanks have specifically noted deficiencies in how the target institution managed third-party service provider risks. 

If any financial institution does not have a Third-Party Risk Management policy and procedures, it is surely currying legal and regulatory risk. Your CRO is correct! 

One other point before I proceed. When a company official tells me that their regulator has never mentioned a particular regulatory violation, though it is a regulatory violation, and thus they intimate that what they’re doing must be ‘acceptable to the regulator,’ the alarms go off. If an institution wants to wait for a regulator to find its policies skimpy, defective, sketchy, inadequate, incomplete, fragmentary, insufficient, and deficient, it will find itself in the midst of a very unpleasant, belated attempt at remediation and possibly even an administrative action. 

And remember to implement the procedures and monitor the implementation. A bank examiner will not only review the policy but also determine if the procedures are implemented. 

_____________________________________________________________ 

TPRM Tune-up® 

When we conduct our TPRM Tune-up®, which is a review of a company’s third-party risk management structure, we work with a set of audit tools that help us evaluate regulatory compliance, offer recommendations, and provide a risk rating. The TPRM Tune-up® is often in demand because third-party risk management is central to safety and soundness criteria. Contact us here, and we’ll send you the presentation.  

_____________________________________________________________ 

Board and Management Responsibility 

Financial institutions are still ultimately responsible for managing their third-party service provider relationships, activities, and associated risks. They must ultimately ensure that all of their operations, in-house or outsourced, are conducted safely and soundly and in compliance with applicable legal and regulatory requirements, including consumer protection and financial crimes laws and regulations, just as if the institution were performing the activities itself. 

Regulators look to the company’s Board of Directors as ultimately responsible for providing oversight for third-party risk management and holding management accountable for its role. Management is responsible for developing and implementing third-party risk management policies, procedures, and practices commensurate with the institution’s risk appetite and the level of risk and complexity of its third-party relationships. Internal controls, independent reviews, and documentation are critical components. 

Third-Party Risk Management POLICY 

There are essential requirements for a Third-Party Risk Management policy (“TPRM Policy”). 

The TPRM policy has four principal requirements, which I will outline below. It will be up to you to draft the policy language. Each requirement can have its section and subsections. I will offer some guidance to help with your considerations. 

The four TRPM Policy requirements can be elucidated as follows: 

1.       Risk Management 

2.       Third-Party Relationship Life Cycle 

3.       Governance 

4.       Appendix 

TPRM Policy Sections 

1. Risk Management 

Not all third-party relationships present the same level of risk. Indeed, not all such relationships require the same level of oversight. However, a financial institution should apply rigorous risk management practices throughout the third-party relationship life cycle for third parties that support higher-risk activities, including critical activities. 

An institution may adjust and update its third-party risk-management practices commensurate with its size, complexity, and risk profile by periodically analyzing the risks associated with each third-party relationship. It is important to involve knowledgeable and skilled staff in each stage of the risk management life cycle. 

Therefore, your company would apply risk management practices in different stages of the third-party relationship life cycle. For instance, an important initial step is identifying third-party relationships that support higher-risk activities, including critical activities. 

Generally, to determine if an activity is higher risk, a company would assess various factors, such as if the third party has access to sensitive data (including customer data), processes transactions, or provides essential technology and business services. 

2. Third-Party Relationship Life Cycle 

Effective third-party risk management generally follows a continuous life cycle for third-party relationships. There are five stages of the TPRM life cycle, all responsive to governance in terms of  Oversight and Accountability, Independent Reviews, and Documentation and Reporting. 

Here is an outline of the five stages of the TPRM life cycle. 

Stage 1: Planning 

Careful planning enables a community bank to consider potential risks in the proposed third-party relationship. Managing third-party relationships allows the company to evaluate the extent of risk management resources and practices for effective oversight of the proposed third-party relationship throughout the subsequent stages of the third-party relationship life cycle. 

Stage 2: Due Diligence (Selecting the Third Party) 

Due diligence is the process by which a company assesses, prior to entering into a third-party relationship, a particular third party’s ability to, among other things, perform the activity as expected, adhere to company policies, comply with all applicable laws and regulations, and conduct the activity in a safe and sound manner.

 

The guidelines to develop in the policy is a clear definition of effective due diligence. We define effective due diligence as assistance with the selection of capable and reliable third parties to perform activities for, through, or on behalf of the company. If the company cannot obtain desired due diligence information from the third party, it will have to consider alternative information, details, controls, and monitoring; otherwise, it should consider abandoning the use of the third party.

 

Conducting due diligence on third parties before selecting and entering into third-party relationships is an important part of sound risk management. It provides management with the information needed about potential third parties to determine if a relationship would help achieve an organization’s strategic and financial goals. The due diligence process also provides the banking organization with the information needed to evaluate whether it can appropriately identify, monitor, and control risks associated with the particular third-party relationship. 

Stage 3: Contract Negotiation

 

Before entering into a contractual relationship with a third party, an institution should consider contract provisions that meet its business objectives, regulatory obligations, and risk management policies and procedures. If a company has limited negotiating power, management needs to understand any resulting limitations and consequent risks. It comes down to risk tolerance, such as whether the contract can still meet the company’s needs, whether the contract would result in increased risk to the company, and whether residual risks are acceptable.

Stage 4: Monitoring 

Monitoring cannot be overemphasized when managing third-party risk. A company’s ongoing monitoring of the third party’s performance enables management to determine if the third party is performing as required for the duration of the contract. Our clients use the results of monitoring to use the derived information to adapt and refine their risk management practices.

 

There are three aspects of this stage in the life cycle, whereby monitoring:

 

1)   Confirms the quality and sustainability of a third party’s controls and ability to meet contractual obligations;

2)   Escalates significant issues or concerns (i.e., material or repeat audit findings, deterioration in financial condition, security breaches, data loss, service interruptions, compliance lapses, or other indicators of increased risk; and

3)   Responds to such significant issues or concerns when and where identified. 

Stage 5: Termination 

Ending a relationship with a third party occurs for a variety of reasons, such as expiration or breach of the contract, the third party’s failure to comply with applicable laws or regulations, or a desire to seek an alternate third party, bringing the activity in-house, or discontinuing the activity. It is important for management to terminate relationships efficiently, whether the activities are transitioned to another third party, brought in-house, or discontinued. 

3. Governance 

As I noted above, the life cycle is governed by tripartite activities: Oversight and Accountability, Independent Reviews, and Documentation and Reporting. Here are some tips for each activity. 

(A) Oversight and Accountability

 

The Board of Directors has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The management is responsible for developing and implementing third-party risk management policies, procedures, and practices commensurate with the company’s risk appetite and the level of risk and complexity of its third-party relationships.

 

(B) Independent Review

 

The company must conduct periodic independent reviews to assess the adequacy of its third-party risk management processes. An institution may use the results of independent reviews to determine whether and how to adjust its third-party risk management process, including its policies, reporting, resources, expertise, and controls.

 

(C) Documentation and Reporting

 

Documentation and reporting, key elements that assist those within or outside the company who conduct control activities, will vary among financial institutions depending on the risk and complexity of their third-party relationships.

4. Appendix 

Consider including an appendix that lists resources. The resources do not have to be comprehensive. Keep adding to the Appendix as you come across resources that help to manage third-party risk management. Of course, there are Acts, regulations, and rules. However, other sources of information may be available, particularly on specific topics.

The use of third parties, especially those using new technologies, may present elevated risks to a financial institution and its customers, including operational, compliance, and strategic risks. Importantly, the use of third parties does not diminish or remove the institution's responsibilities to ensure that activities are performed in a safe and sound manner and in compliance with applicable laws and regulations.

Request Information: TPRM Tune-up®.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 

Lenders Compliance Group