Page 1710
b. Operational Compliance (06/23/2026)
The Mortgagee must ensure that its QC Plan provides for the following required reviews.
i. Personnel
(A) Training [Text was deleted in this section.]
(1) Standard
The Mortgagee must train all staff involved in FHA Loan Administration and QC processes to ensure that staff know all current FHA requirements for the FHA Loan Administration practices for which the Mortgagee is responsible.
(2) Required Documentation
The Mortgagee must maintain a list of all training provided to staff. For each training, the Mortgagee must include a summary of the content covered.
Page 1711
V. QUALITY CONTROL, OVERSIGHT, AND COMPLIANCE A. Quality Control of Lenders and Mortgagees
2. Institutional Quality Control Program Requirements
(B) Restricted Participation
(1) Standard
The Mortgagee must confirm it verified, through each of the following systems, that the designated employees and/or Affiliates listed below were permitted to participate in FHA programs. If any of the designated employees and/or Affiliates are found to be ineligible, they are restricted from participating in FHA programs.
Checks to verify employee eligibility must be conducted at least semiannually.
(a) Excluded Parties List
The Mortgagee must verify employee eligibility for all officers, partners, directors, principals, managers, supervisors, loan processors, loan underwriters, loan originators, and all other employees and Affiliates participating in U.S. Department of Housing and Urban Development (HUD) programs for or on behalf of the Mortgagee, using the System for Award Management (SAM) Excluded Parties List.
(b) Limited Denial of Participation
The Mortgagee must verify employee eligibility for all officers, partners, directors, principals, managers, supervisors, loan processors, loan underwriters, loan originators, and all other employees and Affiliates participating in HUD programs for or on behalf of the Mortgagee, using the Limited Denial of Participation (LDP) List.
(c) National Mortgage Licensing System and Registry
The Mortgagee must verify that all employees and Affiliates participating in HUD programs for or on behalf of the Mortgagee are registered with the National Mortgage Licensing System and Registry (NMLS), unless excluded from NMLS requirements by law or regulation.
(2) Required Documentation
Mortgagees must maintain documentation that supports each employee’s eligibility.
ii. Affiliate Quality Control Reviews
(A) Standard
The Mortgagee must perform QC reviews of its Affiliates in the same manner and under the same conditions as required for the Mortgagee’s own operations. At a minimum, Affiliate monitoring must include a periodic (semiannual at a minimum)
Page 1712
V. QUALITY CONTROL, OVERSIGHT, AND COMPLIANCE A. Quality Control of Lenders and Mortgagees
2. Institutional Quality Control Program Requirements
reverification of the Affiliate’s compliance with all applicable laws related to licensing, qualification, eligibility, or approval to originate or subservice Mortgages.
(B) Required Documentation
The Mortgagee must document the methodology used to review Affiliates, the results of each review, and any corrective actions taken as a result of review Findings. The procedures used to review and monitor a Mortgagee’s Affiliates must be included in the Mortgagee’s QC Plan.
iii. Fair Housing and Fair Lending
The Mortgagee must verify that its operations comply with applicable state and federal fair lending laws, including the following:
• Fair Housing Act (42 U.S.C. § 3601 et seq.)
• ECOA (15 U.S.C § 1691 et seq.)
• Federal Truth in Lending Act (15 U.S.C. § 1601 et seq.)
(A) Denied Mortgage Applications
(1) Standard
The Mortgagee must review a random statistical sample of denied applications within 90 Days from the end of the month in which the decision was made. Reviews must be conducted on a monthly basis and ensure that:
• the reasons given for denial were valid;
• each denial has the concurrence of an officer, senior staff person, or underwriter with sufficient approval authority, or a committee chaired by an officer, senior staff person, or underwriter with sufficient approval authority;
• the requirements of the ECOA are met and documented in each file; and
• no civil rights violations were committed in the denial of the application.
Where possible discrimination is noted, the Mortgagee must take immediate corrective action to ensure its operations comply with applicable state and federal fair lending laws.
(2) Required Documentation
The Mortgagee must document the methodology used to review denied applications, the results of each review, and any corrective actions taken as a result of review Findings. The procedures used to review denied applications must be included in the Mortgagee’s QC Plan.
Page 1713
V. QUALITY CONTROL, OVERSIGHT, AND COMPLIANCE A. Quality Control of Lenders and Mortgagees
2. Institutional Quality Control Program Requirements
(B) Fair Housing Poster and Equal Housing Opportunity Logo
(1) Standard
The Mortgagee must verify that a fair housing poster is prominently displayed in the Mortgagee’s home office and any branch offices that deal with Borrowers and the general public. The Mortgagee must verify that the equal housing opportunity logo is prominently displayed on all documents, including both hard copy and electronic documents, distributed by the Mortgagee to the public.
(2) Required Documentation
The Mortgagee must confirm that a fair housing poster is prominently displayed in the Mortgagee’s offices. The Mortgagee must be able to demonstrate that all documents distributed by the Mortgagee to the public contain the equal housing opportunity logo.
(C) Fair Housing or Discrimination Violations
(1) Standard
Potential fair housing violations or instances of discrimination must be reported to HUD’s Office of Fair Housing and Equal Opportunity (FHEO) immediately.
(2) Required Documentation
Fair housing violations and complaints may be reported online using the HUD Form 903 Online Complaint, contacting HUD’s local FHEO Regional Office or by calling the Fair Housing Complaint Hotline at 1-800-669-9777.
iv. Escrow Funds
(A) Standard
The Mortgagee must verify that escrow funds received from Borrowers were used only for the purpose for which they were received, and are in compliance with all Consumer Financial Protection Bureau (CFPB) escrow requirements.
(B) Required Documentation
The Mortgagee must retain the results of each review and any corrective actions taken as a result of review Findings.
Page 1714
V. QUALITY CONTROL, OVERSIGHT, AND COMPLIANCE A. Quality Control of Lenders and Mortgagees
2. Institutional Quality Control Program Requirements
v. Mortgage Insurance Premiums
(A) Standard
The Mortgagee must verify that FHA Mortgage Insurance Premiums (MIP) were remitted to FHA within the required time period or, if not, that the remittance included Late Charges and interest penalties. Mortgagees must address any pattern of late submissions and promptly take corrective measures.
(B) Required Documentation
The Mortgagee must retain the results of each review and any corrective actions taken as a result of review Findings.
vi. Timely and Accurate Submission for Insurance
(A) Standard
The Mortgagee must verify that Mortgages are being submitted to FHA for insurance within the required time frames. See Case Binder Submission – Direct Endorsement Non-lender Insurance, Post-closing and Insurance for Property Improvement Loan Program and Post-closing and Endorsement for Manufactured Home Loan Program.
(B) Required Documentation
The Mortgagee must retain the results of each review and any corrective actions taken as a result of review Findings.
vii. Advertising
(A) Standard
The Mortgagee must review all advertisements generated by the Mortgagee or on its behalf to verify compliance with HUD/FHA advertising requirements. See Advertising. The Mortgagee must take prompt corrective action upon discovering any violation of advertising requirements described in this Handbook 4000.1.
(B) Required Documentation
The Mortgagee must retain copies of any Advertising Device the Mortgagee produces, or that is produced on the Mortgagee’s behalf, that is related to FHA programs. The Mortgagee must retain samples of the advertising reviewed, the results of each review, and any corrective actions taken as a result of review Findings.
Page 1715
V. QUALITY CONTROL, OVERSIGHT, AND COMPLIANCE A. Quality Control of Lenders and Mortgagees
2. Institutional Quality Control Program Requirements
viii. Reportable Cyber Incident
(A) Definition
A Cyber Incident is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.
A Reportable Cyber Incident is a Cyber Incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the FHA-approved Mortgagee’s ability to meet its operational obligations for originating or servicing FHA-insured Mortgages.
(B) Standard
An FHA-approved Mortgagee that has experienced a Reportable Cyber Incident must report the Cyber Incident to HUD’s FHA Resource Center at answers@hud.gov and HUD’s Security Operations Center at cirt@hud.gov as soon as possible and no later than 36 hours after the Mortgagee has determined that a Reportable Cyber Incident has occurred.
(C) Required Documentation
Cyber Incidents reported to HUD’s FHA Resource Center at answers@hud.gov and HUD’s Security Operations Center at cirt@hud.gov must include the following information:
(1) Mortgagee Name
(2) Mortgagee ID
(3) name, email address, and phone number of the Mortgagee’s point of contact
for coordinating follow-up activities
(4) description of the Cyber Incident, including the following, if known:
• date of Cyber Incident
• cause of Cyber Incident
• impact to Personally Identifiable Information
• impact to login credentials
• impact to Information Technology (IT) system architecture
• list of any impacted subsidiary or parent companies
(5) description of the current status of the Mortgagee’s Cyber Incident response,
including whether law enforcement has been notified.