LENDERS COMPLIANCE GROUP®

AARMR | ABA | ACAMS | ALTA | ARMCP | IAPP | IIA | MBA | MERSCORP | MISMO | NAMB

MORTGAGE FAQs is published by LENDERS COMPLIANCE GROUP®, the country's first full-service mortgage risk management firm in the United States, devoted to offering a full suite of services in residential mortgage banking to banks and nonbanks, independent mortgage professionals, and mortgage servicers. We also provide state-of-the-art mortgage quality control auditing and loan analytics.

Our Compliance Matters® audio series is presented by Jonathan Foxx, PhD, MBA, Chairman & Managing Director.

Showing posts with label Safety & Soundness. Show all posts
Showing posts with label Safety & Soundness. Show all posts

Wednesday, February 4, 2026

Freddie Mac Deadline: March 3, 2026 – AI Governance Framework

YOUR COMPLIANCE QUESTION 

We are using your AI Policy Program. Upon receipt, we had it reviewed by our AI committee to determine whether it complies with Freddie's requirements for establishing a comprehensive AI governance framework for AI and Machine Learning. 

I am pleased to report that your AI Policy Program received the committee's approval. It met our checklist based on Freddie's requirements. 

As a Freddie Mac Seller/Servicer, we want to know what the effect would be on us if we had relationship partners that are not in compliance with the AI governance framework.   

What restrictions will Freddie Mac impose on us if our relationship partners do not comply with their AI requirements as of March 3, 2026? 

Signed,

An Anxious Compliance Manager 

OUR COMPLIANCE SOLUTION 

AI POLICY PROGRAM FOR MORTGAGE BANKING™ 

Our AI Policy Program aligns with Freddie Mac's AI governance requirements for the Freddie Mac Seller/Servicer (or "Lender"). Our well-constructed AI Policy Program is a proactive means designed to avoid and mitigate risks associated with Artificial Intelligence and Machine Learning. Responsible AI practices can help align AI system design, development, and use with applicable legal and regulatory guidelines. 

Our AI Policy Program consists of the following policies: 

1.      Artificial Intelligence Governance Policy

2.      Artificial Intelligence Use Policy

3.      Artificial Intelligence Workplace Policy

4.      Artificial Intelligence Credit Underwriting Policy

5.      Artificial Intelligence Do & Do Not Policy

6.      Artificial Intelligence Ethics Policy

7.      Artificial Intelligence Vendor Management Policy 

Discount offer available until March 3, 2026! 

Contact us for the presentation and pricing. 

OUR RESPONSE TO YOUR QUESTION 

Thank you for using our AI Policy Program. Since its release on October 30, 2025, it has been in considerable demand. 

Our AI Policy Program for Mortgage Banking™, which meets Freddie Mac's AI Governance Framework ("AI Framework"), is the first to provide a set of AI policies dedicated to mortgage banking. 

We had been tracking the GSE formulation of AI requirements for several months. 

On March 11, 2025, Freddie released a formal AI/ML governance framework in its Seller/Servicer Guide ("Guide"), introducing a comprehensive AI Framework for Sellers and Servicers that requires formal policies for the use of artificial intelligence ("AI") and machine learning ("ML"). This update mandated that any AI/ML used in the origination or servicing of Freddie Mac-eligible loans be governed by strict policies. 

On December 3, 2025, Bulletin 2025-16 was issued, clarifying timelines and expectations and stating that AI is no longer optional. In effect, Freddie asserted that implementation is a mission-critical, governed enterprise function. 

The compliance effective date is March 3, 2026. 

After considerable review, research, and drafting, we issued our AI Policy Program on October 30, 2025, thirty-four days before Freddie issued Bulletin 2025-16 on December 3, 2025, and Bulletin 2025-17 issued on December 10, 2025. 

On December 10, 2025, Freddie issued Bulletin 2025-17, which introduced revisions to AI Tools relating to servicing, information security, and Seller/Servicer insurance, with most changes effective on March 3, 2026. 

In the context of the AI Framework, "AI Tools" are any artificial intelligence or machine learning tools used in the loan lifecycle. 

BULLETINS 

Bulletin 2025-16 solidifies the compliance effective date of March 3, 2026, requires Lenders to have a comprehensive governance framework for AI/ML Tools used in loan origination or servicing, and, effective January 1, 2026, Lenders must ensure executive oversight, document AI use cases, ensure fairness, mitigate bias, and manage vendor risk.

Thursday, October 2, 2025

Quality Control: Threat of Downsizing

QUESTION 

I am the manager of our quality control department. We do our own quality control and use an outside auditor. We originate high production and have multiple channels. And we are in 30 states. Our CEO told me that he wants to downsize my department and also pull production audits from the outside auditor. He says our defect ratios show we are doing well and don’t need to maintain quality control to the same extent. 

I tried to tell him that he is seeing the positive effect of quality control, and that downsizing it and removing the outside auditor will cause the defect ratio to worsen. If anything, he should be maintaining or even increasing my staff and external auditor because our production is rapidly increasing. Frankly, I couldn’t change his mind. 

So, I am appealing to you. Our CEO passes your articles out at almost every management meeting. He uses them as ways to encourage discussion. I want him to read your reply. I have been reading your articles for years, and I am familiar with your stance on maintaining a strong quality control department. 

How does mortgage quality control protect the lender? 

SOLUTIONS 

Quality Control Audits 

QC Tune-up 

ANSWER 

Your question comes as a surprise to me, since compliance in general and quality control in particular should be the very last departments to be downsized. If there are mitigating circumstances for the cutback, such as a substantial drop in production or a change in the company's configuration, then I suppose reducing quality control may be warranted. But, even then, it must be done carefully, slowly, judiciously, and with full awareness of any impact on investor due diligence and contractual requirements. 

Lenders Compliance Group offers quality control auditing. But, unlike most quality control companies that veered into mortgage compliance, morphing into a compliance firm, we began as a compliance firm and subsequently established a fully staffed quality control affiliate, carefully managed by an executive director, experienced personnel, compliance professionals, and attorneys. LCG Quality Control, our quality control auditing group, oversees the entire audit process, from the smallest to the largest production, and delivers reports in accordance with GSE and portfolio guidelines, pursuant to timing requirements. We know whereof we speak when it comes to quality control.  

MORE THAN JUST DEFECT RATIOS

Quality Control is far more than just maintaining defect ratios. Wherever you got that impression, get rid of it. You are putting your mortgage company at considerable risk, a risk that is so high that your company will likely implode in a matter of days if you fail to maintain the necessary departmental and auditing staff levels. Cut elsewhere, but do not cut the operational needs of quality control! 

Mortgage quality control (“QC”) protects lenders by mitigating financial risk through the identification and correction of process errors, ensuring compliance with regulations, and maintaining the quality of loan portfolios. This, in turn, prevents costly buybacks from investors, such as the GSEs, and reduces the likelihood of loan defaults. 

Indeed, QC is a component of the Second Line of Defense; in fact, its exact placement depends on the financial institution's structure, as QC functions can also be embedded within the First Line of Defense. The Second Line of Defense typically comprises risk management and compliance functions that provide oversight, develop policies, and monitor activities to ensure adherence to regulations and internal standards. Therefore, when a QC function is established within or aligned with these oversight departments, it serves as a "second-line control." 

QC is crucial for identifying and preventing errors; the specific placement of the QC function determines whether it serves as a First or Second Line of Defense. Regardless of its placement, QC plays a detective role in identifying issues after they occur and provides an early warning mechanism to management, thereby strengthening the overall control structure. 

Consider how quality control impacts the following risk categories. 

RISK MITIGATION 

Let’s start with mitigating risk. Two specific areas that QC impacts are default rates and loan buybacks. QC confirms that loans adhere to federal, state, local, and investor regulations (for instance, Fannie Mae guidelines), thereby avoiding penalties, legal issues, and breaches of contract.

Tuesday, December 17, 2024

Policy and Procedure links to Change Management

QUESTION 

We need an overhaul of our policies and procedures. Our company merged with another company, and our policies are different in many ways, from the text itself to the format. It is tough enough to have the merging of two cultures, we are now banging into one another over what policy applies and what procedures to follow. 

As the Compliance Officer and General Counsel, I am involved in harmonizing these documents, and the task is almost overwhelming. Every project impacts our policies. We have had to update our Change Management policy five times in the last six months just to adapt to the merging of documents. 

What I need is some kind of checklist that I can get stakeholders to agree to or at least accept by consensus. I consulted with experts in policy development, but it was frustrating. If they knew the regulatory requirements, they disagreed on the text, and if they knew the formatting requirements, they disagreed on the best format. They seem oblivious to the implications of Change Management. 

A member of our Board of Directors referred me to you. She believes you can help resolve these issues. So, I'm writing you for guidance. I also want to schedule a call with you to discuss your services. 

Can you help us understand how our policies and procedures are linked to our Change Management requirements? 

SOLUTIONS 

·       Customized Compliance Library

·       Policies Tune-up®

·       CMS Tune-up®

RESPONSE 

There are a few aspects to your circumstances. Not only do you mention the issue of merging policies and procedures resulting from a merger and the impact on projects, but you also note how many times you have had to update your Change Management requirements because of this debacle. We have handled and resolved matters such as yours many times. Your situation often happens. 

Many clients come to us for our customized compliance library. Since you are new to our services, it is worth knowing that we pioneered the effective drafting and implementation of a compliance library. So, you have come to the right place! I'm sure we can help! 

Let's start with Change Management. What is it? Essentially, it is the governing methodology that provides an infrastructure to support and sustain change throughout multiple phases in your financial institution while focusing on achieving a set of defined and desired business results. 

There is a good reason why you mention Change Management. That is because your policies and procedures are an intrinsic part of it. 

To clarify, a financial institution is under pressure from regulators, borrowers, shareholders, and investors to improve its business continuously. These pressures lead to companies initiating a wide range of company projects, including small, targeted updates, process enhancements, large, complex system implementations, and major business process re-engineering initiatives. Thus, an institution's ability to standardize its process and project management practices mitigates the risk of project failures and maximizes the value delivered to its organizational processes. 

Therefore, you have hit on the two primary purposes of Change Management: 

·       Process Management, and

·       Project Management. 

I am going to offer a way to think about Process Management and Project Management and how they link to Change Management. Merged policies and procedures will be given their due consideration. 

BUILDING A CHANGE MANAGEMENT FRAMEWORK 

Before understanding the operational framework of Change Management, its two primary purposes, and its derivative structures, such as policies and procedures, you must determine:

1. Define and describe what changes will be implemented.

2. How to coordinate the input from stakeholders.

3. What will constitute a formal change plan.

4. The resources and data that will be used and available.

5. The overall communication strategy at all operational levels.

6. A review of budget risks associated with change. 

CHANGE MANAGEMENT METHODOLOGY 

As the company's Compliance Officer, it would be your responsibility to establish controls to ensure a viable Change Management methodology is applied consistently between individuals and work groups. 

I recommend that your methodology contain the following guidelines. 

·     Determination of business ownership and governance responsibilities.

·     An impact analysis prior to the implementation of process changes.

·     Communication of new or revised processes to impacted business units or areas.

·     A process that ensures policies, procedures, and processes are updated to reflect remediated control deficiencies.

·     A procedure for approving new or revised processes.

·     A procedure for managing and introducing process revisions.

·     The identification of training needs based on creating or updating policies and procedures.

·     The validation of new or revised policies and procedures prior to implementation. 

PROCESS MANAGEMENT 

Once the Change Management framework is completed, you can move on to interfacing them with Process Management and Project Management.

The primary purpose of process management is to group specific operational components for implementing interlocking institutional bases and contributing to an institution's activities. This means, in theory and practice, the setting up of the requirements needed to effectuate change throughout the company. 

Our reviews of Process Management have shown that there are at least eight structures needed for executing efficient institutional activities. This is a list that we use to ensure the stability of Process Management.

 

1.     There should be a centralized repository for all policies and procedures. In our work, we keep our clients' Masters in an encrypted, secure extranet.

 

2.     A dedicated group that oversees changes related to processes, systems, and policies. You must have a point person or persons involved in oversight. The contact information should be in writing and ratified by the board and/or management.

 

3.     Policies, procedures, and support documents are "mission-critical" key processes. They must be continually evaluated and updated with current revisions.

 

4.     All policies, procedures, and support documents should evaluated for completeness and accuracy. Inactive, dormant, and inoperative policies should be formally retired. Abeyant and suspended policies should be mothballed.

 

5.     Quality assurance reviews should be conducted periodically to ensure the actual performance of employee work processes is consistent with process flows and descriptions.

 

6.     The oversight team should draft a change management manual or tool to manage and track process updates. The board or management must ratify the manual.

 

7.     A standardized template should be modeled for policies and procedures throughout the organization.


8.     Be sure that the appropriate staff responsible for change management processes is well-trained or has the necessary skills to perform these functions.

PROJECT MANAGEMENT 

There are many ways and means to build project management structures. We have project managers who are credentialed in this task; however, you can create basic elements that interface with the Change Management framework. 

You don't need to be overwhelmed by this undertaking. Everything can be accomplished gradually so long as you have a logistical approach. A generic outline of project management should contain at least the following components: 

·       A project management manual or tool to track and manage projects.

·       Referenced policies, procedures, and systems affected by a project.

·       Project management tracking reports.

·       Centralization of project activities in an oversight group.

·       Training of relevant staff for project participation and management.

·       Periodic project tracking reports are communicated to stakeholders.

·       Updates to the inventory of projects subject to tracking. 

I also recommend that your project management methodology include: 

·       Communication of project goals and status.

·       Milestone reviews and approvals.

·       Identification and mitigation of project risk.

·       Identifying stakeholders, including their operational relevance.

·       Documenting procedures for change control documentation.

·       An escalation process for projects where there are tracking errors.

·       Log of activities with a column for remediation information and implementation. 


Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 
Lenders Compliance Group

Thursday, May 2, 2024

Business Continuity Plan: Insufficient Recovery

QUESTION 

According to the bank examiner, our Business Continuity Plan does not provide “sufficient recovery and resolution planning requirements” to manage stresses caused by system failures during a disaster. The problem is that they did not give us guidelines to determine what constitutes sufficient recovery procedures. 

As a result, I am not sure we will satisfy their expectations. I have had our compliance department and lawyers come up with an outline of procedures, but they keep giving me scenarios, and I am not convinced that just listing scenarios is the way to go. I am our company’s founder and president. I will tell you we have never had a catastrophic system failure caused by a disaster. That’s not to say it can’t happen. And I get it! We need to be ready at all times. 

But I don’t want to go out with only scenarios. I am concerned that this approach is not comprehensive, and, more to the point, I think it will annoy the examiner. I need something that the whole company can integrate into operations. 

I hope you can provide a management approach I can implement in all our departments and divisions. Each department will then work to comply with management’s requirements. I will ask our compliance people to ensure companywide oversight of those requirements. 

What are some steps, an outline, toward managing business continuity during disasters? 

COMPLIANCE SOLUTION 

Business Continuity and Disaster Recovery Plan 

BCP Tune-up

ANSWER 

A credible Business Continuity Plan[i] must consider market and companywide stresses and idiosyncratic risks that can imperil the continuity of a financial institution’s critical operations and core business lines. Indeed, proper planning can reduce the adverse broader impact on the financial system. 

With our BCP Tune-up, we have reviewed the Business Continuity Plans of many companies, So, I believe we have a unique perspective on regulatory expectations. Many clients use the BCP Tune-up as a self-assessment tool. Self-assessment is an essential Best Practice encouraged by most banking departments. Our review is cost-effective and we provide a report that describes current risks as well as recommendations that help to meet regulatory scrutiny.

Business continuity is inherently linked to disaster recovery. Your company must develop the ability to prepare for, adapt to, and withstand or recover from disruptions. Disruptions may result from external events like natural disasters, malicious actors, pandemics, global conflicts, or weak internal systems, controls, or risk management. Adapting is essential. For instance, we revised our Business Continuity Plan during the pandemic to add an entire section for Pandemic and Epidemic Response. 

Obviously, disruptions may impede the provision of services, such as payments and clearing and settlement, or adversely impact systems or corrupt data. 

However, the current focus of many banking departments is on exploring baseline “operational resilience” requirements with respect to critical operations, including third-party service providers. 

Such baseline requirements often include the following: 

·       Establishing clear definitions for identifying critical activities and core business lines. 

·       Defining tolerances for disruption, such as caused by cyber-attacks.[ii] 

·       Requiring testing and validation of “resilience” capabilities. 

·       Incorporating third-party risk management expectations.[iii] 

·       Stipulating clear communication expectations among stakeholders and counterparties. 

·       Addressing expectations for critical service providers, emphasizing governance and risk management expectations. 

A company subject to recovery or resolution planning requirements can leverage the information I’m providing in an outline form. You can send it to your departments and divisions for feedback and implementation. In my view, the outline conforms to existing regulations and guidance, the results of which should promote sound business continuity management.[iv] 

In your question, you mentioned the term “recovery” was used by the bank examiner. I use that term, in accordance with regulatory guidance, to refer to the restoration of clearing and settlement activities after a wide-scale disruption. I use the term “resumption” to refer to the capacity to accept and process new transactions and payments after a wide-scale disruption.[v] 

I make no claim that the following nine practices are comprehensive. However, the outline may be considered “sufficient” for deriving an overall plan for business continuity and disaster recovery. 

Business Continuity Management 

1)    Business Impact Analysis 

The company’s business continuity management incorporates business impact analysis,[vi] testing, training, awareness programs, and communication and crisis management policies. 

2)    Contingency 

The company periodically reviews its business continuity plan to ensure contingency strategies remain consistent with current operations, risks and threats, its tolerance for disruption, and recovery priorities.[vii] Containment strategies must align with existing guidance for a company that performs payment, clearing, and settlement activities in critical financial markets.[viii] 

3)    Testing 

The company tests business continuity plans, reviews the execution of tests, and improves plans by incorporating lessons learned. Business continuity tests and exercises incorporate dependencies of critical operations and core business lines on third parties. The company participates in disaster recovery and business continuity testing with third parties associated with critical operations and core business lines. 

4)    Scenarios 

The company confirms that functional testing procedures for assessing the ability of a company’s IT systems to deliver minimum service capacity to critical operations and core business lines are consistent with its business continuity objectives. Business continuity management incorporates scenarios where service capacity and business continuity objectives cannot be met. 

5)    Personnel 

The company identifies and manages the availability of personnel essential to executing its critical operations and core business lines.[ix] The company has (an) alternate site(s) that has sufficient resources (including personnel), technology capabilities, and functionality to execute the company’s critical operations and core business lines in the event of a disruption.[x] The alternate site(s) is (are) located at a sufficient geographical distance from the primary site and has (have) a distinct risk profile. 

6)    Remote Access 

Business continuity management includes remote access contingencies that allow personnel to continue delivering the company’s critical operations and core business lines during the disrupting event.[xi] The management of contingencies prioritizes critical operations and core business lines and provides personnel with adequate connectivity, communication, collaboration tools, essential technology resources, and access to network systems. These contingencies incorporate transitioning personnel back to normal operations following the resolution of a disruption.[xii] 

7)    Training 

The company trains essential personnel responsible for executing critical operations and core business lines and performing backup roles should a disruption occur. The company implements an operational resilience training and awareness program to evaluate the effectiveness of personnel-related business continuity arrangements, and the program is continually improved as shortcomings are identified. 

8)    Implementation 

The company’s recovery or resolution planning is integrated into its governance and operating processes and is part of business-as-usual activities, including companywide risk management processes. To ensure sufficient implementation, recovery or resolution planning is understood as complementary to, and linked with, existing risk management and business continuity management processes. 

9)    Interconnections 

The company harvests and leverages information in its recovery or resolution plans to identify options to respond to a wide range of severe but plausible internal and external stress scenarios. The company similarly leverages the identification of interconnections and interdependencies among critical operations and core business lines affiliates, subsidiaries, and third parties. 

While sound practices prioritize business continuity and disaster recovery of critical operations and core business lines of a financial institution and its material entities,[xiii] it also should identify and address the resilience of other operations, services, and functions for which a disrupting event could have a significant adverse impact on the company or its customers.

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 
Lenders Compliance Group
_______________________________

[i] For more information, consider the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook, which includes the booklet Business Continuity Management (November 2019). This booklet describes principles and practices for IT and operations to ensure safety and soundness, consumer financial protection, and compliance with applicable laws and regulations.
[ii] In 2021, the federal banking agencies adopted the Computer-Security Incident Notification Rule to bolster cyber defenses.
[iii] The federal banking agencies have issued interagency guidance on third-party risk management, building off of the Office of the Comptroller of the Currency’s (OCC) longstanding guidance on the topic.
[iv] Guidance includes SR letter 03-9 and OCC Bulletin 2003-14 Interagency White Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (April 8, 2003), which outline practices for geographic diversity and resiliency of data centers and operations, as well as recovery and resumption time objectives and related testing standards for firms that perform payment, clearing, and settlement activities in critical financial markets.
[v] Idem
[vi] Op. cit. i, Section III.A. Business Impact Analysis of the FFIEC Information Technology Examination Handbook booklet Business Continuity Management describes the business impact analysis process.
[vii] Ibid, Section II.A. Board and Senior Management Responsibilities
[viii] Op. cit. iv
[ix] Op. cit. i, Section IV.A.4 Personnel
[x] Op. cit. i, Section V.C Facilities and Infrastructure
[xi] Operational risk management and independent internal (or external) audit functions should also consider remote access and any other related conditions.
[xii] Op. cit. ix
[xiii] For purposes of this article, I define a material entity as one that is significant to the activities of an identified critical operation or core business line or is financially or operationally significant to the company's recovery from a disrupting event.

Thursday, February 22, 2024

Evaluating Character and Fitness

QUESTION 

We are a lender in the northwest. We have a Code of Ethics that was accepted by our banking department. Recently, they did an audit. In the exit interview, they said we should have a hiring and employment policy that screens for character and fitness. 

Our Compliance Manager asked who should be screened, and the auditor said we should screen for loan and senior officers, managers, and directors. We do this, but it’s not formal enough for them. They want a set of procedures and criteria. 

In researching procedures, we found that some banking departments have broad statements but not many procedures, and others have pretty rigorous ones. We’re leaning toward the rigorous approach since we are licensed in several states and plan to expand into more states this year. 

What are some procedures and criteria to use for determining character and fitness? 

ANSWER 

Character and fitness, taken together, form an evaluation in many professional fields. Many people don’t know this, but such criteria are a central pillar of ethics in the legal profession. Just because somebody is admitted into law school doesn’t mean the state bar has to admit them into legal practice. It is up to them to prove to the state bar that they possess the requisite character and fitness to be a member of the bar. Evaluation may be based, among other things, on such issues as alcohol and substance abuse problems, previous disbarment or suspension, mental health issues, civil legal actions, misdemeanor and felony convictions, academic misconduct, and straight-out lack of honest candor and full disclosure. 

In financial services such as mortgage banking, character and fitness failures can disrupt safety and soundness requirements, increase the significant risks resulting from contact with the public, and degrade a financial institution’s operational and financial structure. This is why the evaluation is meant to be applied not only to loan officers but also to owners, directors, senior officers, and managers. Indeed, character and fitness assessment should be a mainstay of virtually all employees directly or indirectly involved in the loan flow process. Many banking departments already screen for character and fitness of individual licensees in their licensing and renewal processes. 

We have had clients that merged or were acquired. In each instance, our guidance has been the same: upon consummation of the transaction, each affected individual should be screened in the onboarding review. The continuing or surviving entity should not rely on previous vetting or due diligence. Each such entity is responsible for fully vetting its affected individuals in the onboarding and ongoing relationship of the individual with the institution. 

Screening procedures should have ways, means, and methods to denote sensitive issues, warning signs, and other indicia of character and fitness. If there are concerns, the affected individual should not be permitted to commence, carry out, or continue fulfilling the responsibilities of their position, at least until such time as an enhanced review has resolved any perceived risk-based issues. 

Remedial efforts are required if a review vets through to materially adverse findings. Possible remedies include removing an individual from a position, revising the individual’s responsibilities, terminating the individual’s employment, or not hiring the individual in the first place. Where materially adverse findings are established, the banking department should be notified. Due to materially adverse findings, removal from a position, revising position responsibilities, terminating employment or not hiring, and notifying the banking department, should be undertaken with the advice of legal counsel. 

There are many tools to evaluate character and fitness. There is one that I find particularly well-conceived. It is provided by New York State’s Department of Financial Services (DFS). The DFS has long had an examination methodology that embraces a financial institution’s program to assess character and fitness.[i] It is entitled Suggested Questions to Facilitate Initial and Ongoing Assessment of Designated Persons’ Character and Fitness.[ii] I emphasize the word “suggested” because each institution must ratify policies and procedures that are appropriate to its risk profile and complexity as well as consistent with state and, where applicable, federal law. 

The DFS lists twenty questions. Our experience is that many more questions could be asked. These, however, are essential and basic. The questions are not minimum requirements, prescriptive, or meant to be comprehensive. 

We provide a free Character and Fitness Checklist. 

Get the free Character and Fitness Checklist. 

Suggested Questions to Evaluate Character and Fitness[iii] 

1.     Acknowledge that you have reviewed and understood the following policies of the company and provide evidence of any documented exceptions to compliance with certain specified policies in a separate attachment. 

2.     For ongoing assessment, to the best of your knowledge, have you complied with all above-listed policies [during [year(s)], and made all disclosures required, including seeking exceptions from these policies as appropriate, and being granted such exceptions? 

3.     During [year(s)], have you been charged with, indicted for, or convicted of a crime and/or pleaded nolo contendere in any criminal matter (including, but not limited to, driving under the influence, reckless driving, and/or disorderly conduct)? 

4.     Have you or any financial institution with which you are or were associated been sanctioned and/or censured in any way by a banking or securities regulator during [year(s)], including any regulatory sanction, consent order, enforcement order, supervisory agreement, civil monetary penalty, or other administrative penalties? 

5.     Have you been the subject of any professional disciplinary actions, denied a license, and/or had a license suspended or revoked during [year(s)] (i.e., a governmental or professional licensing organization), excepting banking and securities regulators referenced in Question 4? 

6.     Please describe in a separate attachment any civil litigation, investigation, or sanction – including but not limited to any regulatory sanction, consent order/agreement, enforcement order/agreement, or other administrative findings or penalties – in which you have, to your knowledge, been named or have otherwise become involved in your professional capacity, or which have been initiated against a prior employer in connection with your responsibilities in that position, in the preceding ten (10) years. 

7.     Have you ever been dismissed or asked to resign from past employment, including a less-than-honorable discharge from military service? 

8.     Have you been involved in certain filings where the filing was denied, disapproved, withdrawn, or otherwise returned without favorable action by a federal or state regulatory authority or a self-regulatory organization? 

9.     Has anyone in your immediate family or an individual in your household worked for the institution or an affiliate in [year(s)]? If so, please state their name and their relationship to you. “Immediate family” means the individual’s children, parents, siblings, spouse, or partner. 

10.  Have you or an immediate family member started or continued an outside business relationship with an auditor of the institution during [year(s)]? 

11.  Please describe in a separate attachment all indebtedness to the institution or an affiliate that you have incurred [during the past year / since your previous report] (excluding indebtedness associated with a general-purpose credit card) and the balance outstanding of all such indebtedness to the institution or an affiliate at the end of [year]. 

12.  Please describe in a separate attachment any lobbying activities in which you have been engaged in your personal capacity during [year(s)] and whether you were registered as a lobbyist in any jurisdiction during [year(s)]. 

13.  Please describe in a separate attachment any litigation (unless described above) or bankruptcy proceedings of which you have been a part during [year(s)] and provide copies of all relevant documents. 

14.  Do you owe outstanding child support in connection with any unemancipated child(ren)? 

15.  Please describe in a separate attachment all settlements of litigation (threatened or actual) brought against you in your personal or professional capacity during [year(s)] and provide copies of all relevant documents. 

16.  Have you or any company with which you are associated or were associated during [year(s)]:

o   Filed a petition under any chapter of the Bankruptcy Code or had an involuntary bankruptcy petition filed against you or the company?

o   Defaulted on a loan or financial obligation of any sort, whether as obligor, cosigner, or guarantor?

o   Forfeited property in full or partial satisfaction of any financial obligation?

o   Had any liens or other judgments filed against you?

o   Had wages or income garnished for any reason?

o   Failed or refused to pay any outstanding judgments? 

17.  Have you filed/paid all of your required income and other taxes for [year(s)]? 

18.  Please list in a separate attachment all companies (whether publicly traded or not) and any organizations (including not-for-profit and/or charitable) of which you have been a member of the board of directors or an executive officer during [year(s)]. 

19.  Have you been a senior officer or a board member at a financial institution that filed for reorganization or bankruptcy; became subject to a receivership or conservatorship proceeding; became subject to a resolution or liquidation proceeding; had its license, charter, or registration surrendered or revoked; received financial assistance from a federal or state agency or instrumentality (i.e., FDIC); merged with or been acquired by an institution that received financial assistance from a federal or state agency or instrumentality in connection with the transaction; or otherwise failed or ended business operations? 

20.  Please disclose all compensation received during [year(s)] beyond the amounts paid to you as compensation by the institution. 

Character and fitness can be tested and monitored, whether you think so or not. A risk-based approach should also be proportionate to an institution’s risk profile. Risk-based testing means a layered evaluation attuned to ongoing assessments, monitoring frequency, and continuity. 

We provide a free Character and Fitness Checklist. 

Get the free Character and Fitness Checklist. 

Jonathan Foxx, Ph.D., MBA
Chairman & Managing Director 
Lenders Compliance Group

[i] See New York Banking Law § 599-e et seq.

[ii] Suggested Questions to Facilitate Initial and Ongoing Assessment of Designated Persons’ Character and Fitness, Appendix, Industry Letter: Guidance on Assessment of the Character and Fitness of Directors, Senior Officers, and Managers, January 22, 2024, Department of Financial Services, New York State

[iii] Ibid. Condensed and edited for the sake of brevity.