Ginnie Mae - New Cybersecurity Incident Notification Requirements:
On March 4, 2024, Ginnie Mae issued
All Participant Memorandum (APM) 24-02 to impose a new cybersecurity incident notification requirement. Ginnie Mae has also amended its Mortgage-Backed Securities Guide to reflect this new requirement.
Effective immediately, all Issuers, including sub-servicers, of Ginnie Mae Mortgage-Backed Securities (Issuers) are required to notify Ginnie Mae within 48 hours of detection that a “Significant Cybersecurity Incident” may have occurred. Issuers must provide email notification to Ginnie Mae with the following information:
- the date/time of the incident,
- a summary of the incident based on what is known at the time of notification, and
- designated point(s) of contact who will be responsible for coordinating any follow-up activities on behalf of the notifying party.
For purposes of this reporting obligation, a “Significant Cybersecurity Incident” is “an event that actually or potentially jeopardizes, without lawful authority, the confidentiality, integrity of information or an information system; or constitutes a violation of imminent threat of violation of security policies, security procedures, or acceptable use policies or has the potential to directly or indirectly impact the issuer’s ability to meet its obligations under the terms of the Guaranty Agreement.”
Once Ginnie Mae receives notification, it may contact the designated point of contact at the Issuer to obtain further information and establish the appropriate level of engagement needed, depending on the scope and nature of the incident.
Fannie Mae Servicing Guide Update:
Fannie Mae sent out an email on March 13, 2024 regarding their most recent servicing guide announcement and an update to a previously issued Lender Letter.
The servicing guide announcement includes updates to the current Loan Modification Agreement template, incorporating additional instructions in response to New York’s Foreclosure Abuse Prevention Act, and adjustments to the instructional provision related to MERS.
The Lender Letter outlines changes to the reporting due date for summary reporting mortgage loans, expands the transaction type 96 (LAR) format, and modifies P&I remittance requirements for summary reporting A/A remittance type mortgage loans.
For more detailed information, please refer to the links provided below:
Servicing Guide Announcement: Link
Lender Letter: Link