An Executive Breakdown of Interest Rate Trends, Market Signals, and Forecast Drivers

Entering 2026, the U.S. mortgage landscape is in a transition phase characterized by modestly lower interest rates, cautious market optimism, and structural shifts in affordability dynamics. After peaking well above 7% in 2023–2024, interest rates have moderated, and several major forecasters now expect rates to stay in the mid-to-low 6% range throughout the year.

Current Snapshot

As of early January, the average 30-year fixed mortgage rate hovers near 6.2%, only slightly above its 52-week low. Rates have stabilized after trending downward in late 2025, with adjustable-rate products showing even larger year-over-year declines.

This rate environment represents a tangible improvement from the higher cost of capital seen in recent years—but remains elevated compared with the ultra-low benchmarks of the pandemic decade.

What Forecasters Are Predicting

Industry research suggests rates could continue to gradually ease through 2026:

a) Fannie Mae forecasts rates dropping below 6% by mid-year and finishing 2026 near 5.8%.

b) Fannie Mae forecasts rates dropping below 6% by mid-year and finishing 2026 near 5.8%.

c) MBA forecasts still emphasize rates in the 6%+ range but concede downward momentum as inflation eases.

The takeaway for mortgage professionals and borrowers is that the market appears poised for stabilization, rather than dramatic rate swings.

Drivers Behind the Forecast

The principal forces shaping this outlook include:

a) Federal Reserve Policy: With inflation pressures easing, the Fed’s pivot toward less restrictive policy supports a lower long-term cost of borrowing.

b) Bond Market Dynamics: Mortgage rates correlate closely with long-term Treasury yields. Even modest confidence shifts in bond markets can influence mortgage pricing.

c) Economic Growth and Jobs: Moderate job growth keeps demand stable without exacerbating inflation, creating a conducive environment for marginal rate improvements.

Implications for Buyers and Lenders

For buyers, this environment suggests:

a) Improved affordability compared with the elevated cost structure of 2023–2025.

b) Improved affordability compared with the elevated cost structure of 2023–2025.

For lenders, the outlook underscores:

a) Opportunity in refinance volumes as rates dip into the low-6% territory.

b) Portfolio risk management, as rate expectations shift and credit risk dynamics evolve.

Regional and Segment Variability

While national averages provide a general framework, regional market conditions remain heterogeneous. High-growth metros with strong labor demand may see elevated pricing pressure, while less congested markets could adjust more quickly to affordability improvements.

Conclusion

The 2026 mortgage rate landscape suggests a steady rather than seismic shift, offering potential relief for borrowers and dynamic volumes for lenders. With rates potentially dipping below 6%, professionals should focus on education, timing strategies, and portfolio readiness to capitalize on this evolving environment.

The housing market is entering what economists are calling “The Great Housing Reset”—a prolonged, structural rebalancing rather than a dramatic correction. While this shift brings cautious optimism, it also introduces a critical risk: those who misread the reset as a reason to wait may quietly lose money, opportunity, and strategic positioning.

According to Redfin’s 2026 outlook, affordability will improve for the first time in years—not because prices are falling, but because income growth is finally expected to outpace home-price growth. This marks the beginning of a slow normalization process that will unfold over several years. The key takeaway is clear: the reset rewards early, informed action—not delay.

Mortgage Rates Will Ease—but Not Enough to Justify Waiting

Redfin projects the average 30-year fixed mortgage rate will settle around 6.3% in 2026, down modestly from 2025 levels. While rates may dip below 6% briefly, structural inflation risk and bond-market dynamics will prevent sustained declines.

This creates a dangerous misconception among borrowers: the belief that materially better rates are right around the corner. In reality, incremental rate improvements may already be outweighed by rising prices, insurance premiums, and lost equity. Waiting for a psychological rate threshold could result in higher total borrowing costs—even if rates edge down slightly.

From a financial standpoint, the risk is not locking too early; it is waiting too long and absorbing opportunity cost month after month.

Affordability Is Improving—But Only for Those Who Can Act

Home prices are expected to rise just 1% year over year in 2026, a sharp contrast to the rapid appreciation of recent years. At the same time, wages are projected to grow faster than prices for the first time since the post-Great Recession period.

This combination improves affordability on paper—but not universally. For many Gen Z buyers and young families, costs remain prohibitive, forcing tradeoffs such as delaying homeownership, sharing housing, or moving back with family.

The financial risk here is structural: buyers who wait for affordability to fully “return” may miss the narrow window where wages, rates, and inventory briefly align. History shows that once demand returns in force, competition—and pricing pressure—follows.

Home Sales Will Rise, Quietly Repricing Risk

Redfin expects existing home sales to increase 3% in 2026, driven by a stronger spring season and slightly improved financing conditions. While this is not a surge, it signals renewed market liquidity.

For buyers, this means more competition than the stagnation of recent years. For sellers and lenders, it means pricing power begins to stabilize. Those waiting for a buyer’s market may find it never truly materializes.

Markets do not need to overheat to create financial loss—they only need to move forward while some participants stand still.

Renters Face a Different Kind of Financial Pressure

Rent growth is expected to rise 2–3% nationally as apartment supply slows and demand increases. More households are renting longer because buying remains expensive, pushing competition into the rental market.

For renters delaying homeownership, this creates a compounding loss: rising rents with no equity accumulation. Over time, this erodes the ability to save for a down payment and increases long-term housing costs—often permanently.

Policy Help Is Coming—but Slowly

Housing affordability has become a bipartisan political priority, with proposals ranging from zoning reform to manufactured housing expansion. While these initiatives may improve supply over time, they will not deliver immediate relief.

The reality, as Redfin notes, is that affordability normalization will take approximately five years. Those waiting for policy to “fix” housing costs may find themselves priced out of the recovery phase.

Refinance and Remodel: A Missed Opportunity for the Unprepared

Redfin forecasts refinance volume to increase more than 30% in 2026, driven by homeowners eager to escape higher-rate loans. At the same time, strong home equity positions are fueling renovation activity as homeowners choose to improve rather than move.

For borrowers who fail to act—or lenders unprepared to execute efficiently—this represents missed financial relief and lost revenue in a tightening margin environment.

Strategic Takeaway

The Great Housing Reset is not a reset button—it is a slow recalibration. Those who interpret it as a signal to wait risk losing equity, affordability, and strategic leverage. In 2026, the greatest financial losses will not come from market crashes, but from missed windows of opportunity. The winners will be those who understand that normalization favors preparation, decisiveness, and disciplined execution—not hesitation.

In a significant policy development with direct operational consequences for lenders, the Federal Housing Administration (FHA) announced that it is officially waiving the requirement to provide Form HUD-92900-B, “Important Notice to Homebuyers.” The notice, communicated through an FHA INFO release, marks the end of a disclosure obligation that has been in place—with various revisions—since 1992.

Effective November 19, 2025, the waiver applies to all cases not yet endorsed, and its implications extend across origination workflows, disclosure management, loan processing, and quality control protocols.

This unexpected move reflects the administration’s broader push to modernize documentation, streamline compliance burdens and improve borrower experience across FHA programs. For lenders, it creates both immediate process updates and longer-term considerations about document governance and QC alignment.

A 33-Year Requirement Retired

Under the previous requirements outlined in the Single Family Housing Policy Handbook 4000.1, lenders were obligated to:

a) Provide the form to borrowers at application,

b) Obtain the borrower’s signature,

c) Furnish the borrower with a copy, and

d) Retain a signed version in the FHA case binder.

For decades, Form HUD-92900-B served as a standardized disclosure intended to inform borrowers of program expectations and operational considerations related to FHA financing. However, over time, its content became increasingly outdated and, in some areas, duplicative of other federal disclosures.

The FHA’s decision to waive the requirement signifies a recognition that the form no longer contributes meaningful value to borrower understanding or loan integrity.

FHA’s Rationale: Redundant, Outdated and Misaligned With Current Policy

In announcing the waiver, the FHA emphasized its objective to reduce administrative burden and eliminate inefficiencies caused by maintaining an obsolete disclosure.

Key factors include:

a) Outdated policy references:
The form still includes references to mortgage insurance premium refunds and discount policies that have long been discontinued.

b) Duplicative content already covered by federal statutes:
The form reiterates disclosures already mandated through TILA, RESPA, and other regulations, creating unnecessary overlap.

c) No added value to borrower understanding:
FHA concluded that retaining the form only creates noise in the disclosure process without improving borrower protection or clarity.

The agency noted that the change should enable faster processing, reduced document-handling requirements and a more streamlined borrower-facing experience. Importantly, FHA reaffirmed that all other statutory and regulatory disclosure requirements remain fully in effect.

Regulatory Authority Behind the Waiver

While eliminating a form that has been required for more than three decades may appear sweeping, the FHA has clear legal authority to enact such waivers.

Under the Department of Housing and Urban Development Reform Act of 1989 (42 U.S.C. 3535(q)), coupled with its enabling regulations at 24 C.F.R. § 5.110, the Secretary of HUD may waive specific FHA requirements without engaging in the full notice-and-comment rulemaking process.

This regulatory flexibility allows FHA to adapt more quickly to operational realities and remove barriers that no longer support program goals.

Industry Response and Transition Timeline

The industry is already adjusting to the change. DocMagic announced it will officially remove Form HUD-92900-B from FHA application and initial disclosure packages beginning December 4, 2025. This brief transition period allows lenders to update:

a) Internal workflows,

b) LOS configurations,

c) Document libraries,

d) QC checklists, and

e) FHA case binder protocols.

Because the waiver applies immediately to cases not yet endorsed, lenders must ensure alignment between their current disclosure practices and their technology systems, which may still generate the form until automated updates take effect.

Implications for Lenders, Compliance Teams and QC Operations

Although retiring a single disclosure form may seem minor, the operational touchpoints are extensive. Lenders should proactively evaluate the following:

a) Document and Disclosure Governance

QC teams should update policies and procedures, removing HUD-92900-B from pre-fund and post-closing audit artifacts. Any automated document-tracking rules must be revised to avoid false defect findings.

b) LOS and Document Provider Configuration

As third-party document providers transition, lenders should confirm that “Important Notice to Homebuyers” no longer populates FHA packages. Dual-tracking during the transition period may create inconsistencies if not monitored.

c) Staff Training and Borrower Communication

Front-end and processing staff must be briefed to avoid requesting or expecting a signature on a now-discontinued form. Clear internal communication prevents operational friction.4. FHA Case Binder Requirements

Since the form no longer needs to be retained, lenders must ensure binder checklists reflect the updated policy. Failure to align could introduce unnecessary suspense items.

d) Borrower Experience Optimization

The removal of duplicative disclosures supports a more streamlined application experience—an opportunity for lenders to further refine digital workflows and reduce friction in borrower onboarding.

A Meaningful Step Toward Modernizing FHA Processes

The retirement of Form HUD-92900-B demonstrates the FHA’s willingness to remove legacy requirements that no longer contribute to borrower protection or program integrity. For lenders, the update represents both administrative relief and a reminder of the importance of agile compliance infrastructure.

As more policy updates emerge in 2026, maintaining clear governance around documentation, QC processes and system configuration will remain essential to ensuring compliant, efficient FHA lending operations.

The U.S. mortgage ecosystem is entering a period of elevated fraud risk, driven by shifting borrower behavior, volatile market dynamics and an evolving regulatory landscape. New analysis from Cotality’s National Mortgage Application Fraud Risk Index indicates that third-quarter mortgage fraud exposure is rising in key segments—and the macro environment surrounding oversight agencies adds another layer of uncertainty.

For lenders, compliance leaders and QC executives, the latest data signals a need for heightened vigilance and operational recalibration.

Fraud Risk Climbs, Especially in Investor Applications

According to Cotality, approximately 1 in every 118 mortgage applications in Q3 showed signs of potential fraud. While this reflects an 8% increase year over year, the report also noted a modest quarter-over-quarter improvement. Still, the broader trendline points to sustained pressure.

Cotality highlighted a particularly sharp rise in risk alerts related to declining home prices, which grew by 400% year over year—an indication that falling valuations are incentivizing misrepresentation.

The most consequential insight may be the surge in undisclosed real estate debt, a trend fueled largely by the growth in investor activity. With nearly a third of home sales in the first half of the year involving investor-buyers, Cotality observed that many investors are juggling multiple mortgages across multiple lenders, in some cases refinancing them simultaneously.

This dynamic creates opportunity for undisclosed liabilities and layered risk—especially when lenders do not have visibility into parallel applications.

Loan-Level Fraud Patterns Signal Expanding Vulnerabilities

Cotality tracks six categories of mortgage fraud, and undisclosed real estate debt was the only category to rise annually. However, sub-indicators related to income, identity and occupancy fraud also trended upward.

The highest-risk application types were:

a) Investment properties: 1 in 45 applications flagged

b) Multifamily loans: 1 in 26 applications flagged

Both segments grew their share of total mortgage applications year over year, with investor-buyer share rising from 7.3% to 10%, and multifamily applications climbing from 1.1% to 1.8%.

This shift in mix—toward segments with higher baseline fraud risk—amplifies exposure for lenders who may be understaffed or under-optimized in fraud prevention infrastructure.

Unlike consumer complaint-based fraud indicators, Cotality’s methodology reviews millions of loan applications algorithmically, flagging behavioral and data-integrity anomalies at the file level. This helps surface emerging fraud patterns before they become headline losses.

Geographic Hotspots Reflect Uneven Market Stress

Certain states showed significantly higher fraud-risk acceleration:

a) Ohio: +55%

b) Delaware: +41%

c) Kansas: +35%

d) Vermont: +35%

e) Oklahoma: +33%

While not all regions experienced broad deterioration, the data suggests concentrated pockets of vulnerability where economic conditions and property-value trends are shifting more rapidly.

Oversight Disruption at the Federal Level Complicates the Landscape

Overlaying the rise in fraud risk is an unprecedented development: the active unwinding of the Consumer Financial Protection Bureau (CFPB) under Acting Director Russell Vought. In recent public statements, Vought reiterated his intent to shut down the agency, leaving only a small number of political appointees and essential personnel in place.

The CFPB, established through the Dodd-Frank Act in 2011, has historically played a critical role in standardizing mortgage-fraud enforcement across states and federal partners—including the FHA, VA, Fannie Mae and Freddie Mac. Its dissolution introduces several challenges:

a) Reduced harmonization of enforcement standards

b) Delayed rulemaking cycles

c) Greater reliance on state regulators with varied authority

d) Intensified GSE-led enforcement

Legal developments are accelerating this shift. The Department of Justice recently issued a legal opinion suggesting the Federal Reserve may not be able to lawfully fund the CFPB going forward. By early 2026, the bureau may be unable to meet its statutory funding needs.

This regulatory uncertainty is unfolding precisely as mortgage fraud complexity grows, aided by technology-enabled identity manipulation and multilayered borrower profiles.

Industry Responses Highlight Rising Operational Pressure

Industry attorneys and compliance leaders acknowledge heightened enforcement activity from GSEs in 2025, including more frequent lender approvals being revoked and additional placement of firms and individuals on exclusionary lists.

There is also a growing industry emphasis on tightening guardrails around occupancy fraud, particularly in business-purpose lending—an area experiencing strong deal flow and investor participation.

As Timothy Ofak of Weiner Brodsky Kider notes, undetected borrower fraud has downstream implications, including repurchase demands and indemnification obligations. The financial exposure can be substantial, especially for lenders without rigorous QC and data-validation systems.

State regulators, meanwhile, continue to monitor lender-side compliance, though jurisdictional limits prevent them from policing consumer-side fraud. While the loss of CFPB partnership is viewed as “unfortunate,” many state agencies report they are continuing operations without material disruption.

Strategic Takeaways for Lenders and QC Leaders

With fraud risk rising—especially in investor and multifamily segments—lenders should prioritize:

a) Strengthened income, identity and occupancy validation protocols

b) Cross-lender visibility strategies, including advanced data-matching solutions

c) Enhanced file-level audit routines across pre-funding and post-closing

d) Scenario planning for heightened repurchase and indemnification activity

e) Active monitoring of state-level enforcement shifts as federal oversight evolves

The intersection of elevated investor activity, rising undisclosed-debt patterns and regulatory transition marks a critical moment for lenders to reinforce their fraud-risk posture.

The third quarter delivered a notable shift in mortgage performance trends—one that deserves the attention of every lender, servicer, and risk-management leader. New data from the Mortgage Bankers Association (MBA) reveals that overall delinquency levels continue to inch upward, with the government-backed segment—particularly FHA loans—showing the most pronounced stress. While the headline numbers may seem modest, the underlying dynamics point to operational and portfolio-management considerations that will shape the early months of 2025.

Below is a closer look at the drivers behind the uptick, the indicators that matter most, and the operational implications for lenders navigating an increasingly complex credit landscape.

A Measured Rise in Delinquencies, But a Clear Trendline

MBA’s Q3 National Delinquency Survey found that delinquencies across one- to four-unit residential properties climbed to nearly 4%, a slight but meaningful increase from the previous quarter. Foreclosure starts also nudged higher, rising three basis points to 0.20%.

While these incremental changes do not point to widespread distress, they do reflect a continuation of the slow upward trajectory observed throughout the year. More importantly, they underscore that the credit environment is gradually tightening—especially for borrowers facing affordability pressure.

But the standout trend lies within the FHA portfolio.

FHA Borrowers Experience Disproportionate Stress

The most significant movement came from the serious delinquency rate among FHA loans, which rose 50 basis points compared to the same period last year. Serious delinquencies—measured as loans 90 days or more past due—serve as a critical predictor of near-term servicing workload, loss-mitigation demand, and long-term default risk.

According to the MBA’s vice president of industry analysis, Marina Walsh, the causes behind this deterioration are both structural and economic:

a) Labor market softening is impacting wage stability for lower-income borrowers.

b) Rising homeowner costs—including taxes, insurance, and general expenses—are compressing household budgets.

c) Increased personal debt obligations are eroding borrower resilience.

d) Moderating home prices may limit borrowers’ ability to sell or refinance as an exit strategy.

These factors collectively widen the vulnerability gap for FHA borrowers, who typically have thinner financial cushions and rely more heavily on stable employment conditions. The net result: early signals of stress that warrant lender attention before they materialize into servicing bottlenecks.

End of Pandemic-Era Loss-Mitigation Tools Creates New Uncertainty

Another major variable shaping this quarter’s performance is the transition away from COVID-19 loss-mitigation frameworks. While these tools provided outsized support during the pandemic, their expiration means distressed borrowers now face a more traditional—and often more demanding—process.

Beginning October 1, the FHA extended the partial claim window from just a few months to 24 months, significantly altering the timeline for modification options. This regulatory shift is expected to influence delinquency patterns in the quarters ahead, as borrowers and servicers adjust to the expanded window and evolving pathways for reinstatement.

MBA has already signaled that this change may materially impact future FHA data, as borrowers with lingering financial pressures face new decision points about modification, repayment, and long-term affordability.

Operational Implications for Lenders and QC Leaders

The uptick in delinquencies—especially at the serious stage—suggests several operational priorities for lenders heading into 2025:

a) Strengthened Pre-Funding and Post-Closing QC Routines

As affordability stress increases, QC teams should ensure borrower income, employment, and layered-risk factors are validated with heightened rigor. Early defects in verification can magnify downstream losses.

b) Enhanced Servicing Oversight and Borrower Outreach

For lenders retaining servicing, early borrower-engagement strategies and proactive outreach programs become essential to mitigating delinquency progression.

c) Greater Scenario-Planning Around FHA Portfolio Sensitivity

Given the concentration of stress in the FHA segment, lenders with meaningful exposure should evaluate their risk posture around default forecasts and servicing capacity.

d) Preparedness for Increased Modification and Loss-Mitigation Demand

The extended partial-claim window may delay resolution timelines, requiring stronger documentation, tracking, and QC controls to support compliant execution.

The Bottom Line

The third quarter’s data does not signal an immediate crisis—but it does underscore a shift toward more fragile borrower performance, particularly within FHA programs. For lenders, the message is clear: operational discipline, rigorous QC practices, and proactive risk monitoring will be essential differentiators in navigating the next phase of the credit cycle.

As the industry heads into 2025, a forward-looking, compliance-aligned approach will help ensure portfolios remain resilient while delivering a sustainable borrower experience.

In mid-October 2025, the Consumer Financial Protection Bureau (CFPB) announced an extension to the compliance deadlines for the Small Business Lending Rule, also known as the 1071 Rule. The decision offers temporary relief to lenders navigating operational and data-collection challenges, but it does not diminish the ultimate compliance expectations. Regulators have made it clear that the delay is a grace period, not a rollback.

Understanding the 1071 Rule

The 1071 Rule, established under Section 1071 of the Dodd-Frank Act, requires financial institutions to collect and report detailed data on small business credit applications, including demographic information about business owners. The purpose is to enhance transparency, uncover disparities in lending, and strengthen fair-lending oversight—objectives that mirror the Home Mortgage Disclosure Act (HMDA) framework long applied in the mortgage sector.

While the rule primarily targets small-business lending, its impact extends to mortgage lenders that operate diversified portfolios or manage mixed-purpose loans. Institutions involved in commercial or business-purpose transactions, or those working with fintech vendors and correspondents, may find portions of their operations subject to 1071 reporting. Ignoring the rule’s implications could expose compliance vulnerabilities across multiple product lines.

Why the Delay Matters

The CFPB’s decision to extend the compliance timeline came after industry feedback citing implementation hurdles and litigation delays. However, the Bureau was explicit in its warning—this is not an exemption. The extra time should be used to strengthen internal systems, governance structures, and vendor readiness to ensure full compliance when enforcement begins.

The financial risk of noncompliance remains high. Institutions that fail to meet reporting obligations could face penalties, enforcement actions, and reputational damage once the public data disclosures begin. Because the reported information will be accessible to consumers, regulators, and advocacy groups, any disparities or inaccuracies in lending patterns could quickly attract unwanted scrutiny.

The Broader Impact on Mortgage Operations

Mortgage lenders may view 1071 as a distant concern, but the rule’s implications reach further than many expect. Institutions offering small-business or investor loans through affiliates, or utilizing shared technology infrastructure across product lines, will need to reconcile data management practices. Systems that process both consumer and business-purpose loans must be equipped to capture and segregate the new reporting fields required under 1071.

Additionally, the rule underscores a growing regulatory convergence between commercial and mortgage lending. Data transparency, fair-lending analytics, and automated reporting will increasingly define compliance readiness. For lenders with legacy systems or fragmented data environments, this is a critical wake-up call to modernize infrastructure before the rule goes into full effect.

Data Governance and Compliance Accountability

One of the most significant operational shifts introduced by 1071 is the elevation of data governance as a compliance cornerstone. Institutions will need to assign clear ownership for data accuracy, fair-lending monitoring, and regulatory reporting. This will require closer collaboration between compliance, IT, operations, and risk management teams—departments that have traditionally functioned independently.

The rule also introduces heightened expectations for recordkeeping and audit readiness. Regulators will not only examine the reported data but also the internal processes that produced it. Lenders must document how demographic information is collected, stored, and verified, as well as how privacy obligations are upheld. Institutions that cannot demonstrate strong governance controls risk being viewed as noncompliant, even if data submissions appear complete.

Preparing for the Next Phase

With deadlines extended, proactive institutions have a strategic advantage. The most forward-thinking lenders are already conducting readiness assessments, mapping data fields to 1071 requirements, and engaging third-party technology providers to enhance reporting capabilities. Legal and compliance teams are updating fair-lending policies and reviewing governance structures to align with CFPB expectations.

Investing in automation and analytics now will not only ensure compliance but also create efficiencies that strengthen an organization’s competitive position. A robust data infrastructure enables better decision-making, improves audit transparency, and reduces long-term regulatory exposure.

A Warning, Not a Reprieve

The CFPB’s extension of the 1071 Rule deadlines offers breathing room—but only for those who use it wisely. Once enforcement begins, regulators will expect precision, not progress. Institutions that delay preparation may find themselves scrambling under pressure, while early adopters will be positioned as compliant and credible market leaders.

In the current climate, where compliance lapses can rapidly erode borrower and investor confidence, readiness is not optional—it is essential. The real cost of delay is not in the time lost but in the opportunity missed to build resilient, data-driven compliance programs that safeguard the institution’s reputation and financial stability. The 1071 Rule may not be a mortgage regulation in name, but for lenders across the spectrum, it represents a broader truth: transparency is now the price of trust.

In an era when data breaches and cyberattacks are headline news, Fannie Mae has elevated its expectations for cybersecurity across its partner ecosystem. On August 12, 2025, the Fannie Mae Information Security and Business Resiliency Supplement (the “Supplement”) takes effect for single-family sellers and servicers (among others), demanding significantly stricter controls, incident reporting timelines, and governance procedures.

This is not merely a technical update — it is a compliance obligation with real financial, reputational, and eligibility risk for lenders, servicers, vendors, and technology partners.

What’s Changing and Who’s Impacted

Fannie Mae’s updated Supplement applies to multiple categories of business counterparties:

a) Single-family sellers and servicers

b) Multifamily lenders

c) Technology service providers (with a later deadline)

d) Document custodians

The deadlines vary by category. For single-family sellers and servicers (and multifamily lenders), full implementation is required by August 12, 2025. Technology service providers and document custodians have subsequent deadlines.

Under the new rules, business partners must meet enhanced requirements across information security controls, incident notification, business continuity and resiliency planning, among other domains.

Why This Matters — And What’s at Stake

Eligibility Risk
Non-compliance isn’t theoretical. Firms that serve as sellers or servicers on Fannie Mae-approved channels risk jeopardizing their ability to originate or service loans under Fannie Mae’s programs. Access to systems, contracts, or product pipelines could be curtailed if controls aren’t aligned.

Incident Reporting & Timeliness
Perhaps the single most dramatic change is the requirement to report cybersecurity incidents within 36 hours of identification. That includes unauthorized access, data loss, ransomware, denial-of-service attacks, or business-email compromise that impacts confidential information.

Missing that reporting window—or lacking timely communication with Fannie Mae—could lead to operational restrictions or even suspension of system access, depending on the severity and the response.

Vendor / Supply-Chain Risk Exposure
The Supplement makes it clear that firms must uphold similar information-security and business continuity obligations not only internally, but across their third-party service providers (supply-chain / vendor risk).

That means oversight of subcontracted vendors, cloud providers, custodial services, or technology partners must align with Fannie Mae’s standards — or risk non-compliance via “weak links.”

Operational Resilience
The business-resiliency component emphasizes continuity planning, incident-response procedures, and resiliency testing. It’s not sufficient to have basic policies on paper — firms must prove that they can recover, continue critical servicing/origination activities, and protect borrower data in the event of a disruption or cyber event.

All told, the new Supplement shifts cybersecurity and resilience from an IT concern into a core compliance, governance, and risk-management concern for mortgage organizations and their partners.

What You Should Do — Next Steps for Mortgage Providers

To avoid fines, system access limitations, or reputational damage, stakeholders must act now. Here are recommended steps:

a) Gap Assessment & Audit
Immediately perform a comprehensive gap assessment of your existing Information Security Program, Incident Management procedures, Business Continuity Plan (BCP), and vendor oversight. Map your controls against the Supplement’s requirements to identify deficiencies.

b) Executive Oversight & Attestation
The Supplement implies senior-level accountability. Ensure that your governance structure includes a designated executive owner for InfoSec and business resiliency. Document attestations or board-level committee approvals as needed.

c) Incident-Response Procedures & Training
Update or develop your incident-response playbooks to reflect the new 36-hour reporting requirement. Train your staff and vendors on timely identification, escalation, and notification protocols.

d) Vendor & Contract Review
Review your agreements with third-party vendors, custodians, and technology partners. Confirm they meet the Supplement’s security-control and resiliency expectations. Amend contracts to include required obligations, audit rights, or compliance attestations.

e) Test & Document Resiliency Plans
Conduct tabletop exercises, disaster-recovery testing or fail-over drills. Document your results, remediation steps, and continuous improvement plan. Maintain records ready for audit or governance review.

f) Monitor & Report Progress
Establish internal dashboards or compliance-tracking metrics to monitor your progress toward full implementation ahead of the August 2025 deadline (or applicable deadline for your category). Escalate to senior leadership regularly.

“Cyber Risk Becomes Mortgage Risk: Fannie Mae’s New InfoSec Mandate”

In an era when data breaches and cyberattacks are headline news, Fannie Mae has elevated its expectations for cybersecurity across its partner ecosystem. On August 12, 2025, the Fannie Mae Information Security and Business Resiliency Supplement (the “Supplement”) takes effect for single-family sellers and servicers (among others), demanding significantly stricter controls, incident reporting timelines, and governance procedures.

This is not merely a technical update — it is a compliance obligation with real financial, reputational, and eligibility risk for lenders, servicers, vendors, and technology partners.

What’s Changing and Who’s Impacted

Fannie Mae’s updated Supplement applies to multiple categories of business counterparties:

a) Single-family sellers and servicers

b) Multifamily lenders

c) Technology service providers (with a later deadline)

d) Document custodians

The deadlines vary by category. For single-family sellers and servicers (and multifamily lenders), full implementation is required by August 12, 2025. Technology service providers and document custodians have subsequent deadlines.

Under the new rules, business partners must meet enhanced requirements across information security controls, incident notification, business continuity and resiliency planning, among other domains.

Why This Matters — And What’s at Stake

Eligibility Risk
Non-compliance isn’t theoretical. Firms that serve as sellers or servicers on Fannie Mae-approved channels risk jeopardizing their ability to originate or service loans under Fannie Mae’s programs. Access to systems, contracts, or product pipelines could be curtailed if controls aren’t aligned.

Incident Reporting & Timeliness
Perhaps the single most dramatic change is the requirement to report cybersecurity incidents within 36 hours of identification. That includes unauthorized access, data loss, ransomware, denial-of-service attacks, or business-email compromise that impacts confidential information.

Missing that reporting window—or lacking timely communication with Fannie Mae—could lead to operational restrictions or even suspension of system access, depending on the severity and the response.

Vendor / Supply-Chain Risk Exposure
The Supplement makes it clear that firms must uphold similar information-security and business continuity obligations not only internally, but across their third-party service providers (supply-chain / vendor risk).

That means oversight of subcontracted vendors, cloud providers, custodial services, or technology partners must align with Fannie Mae’s standards — or risk non-compliance via “weak links.”

Operational Resilience
The business-resiliency component emphasizes continuity planning, incident-response procedures, and resiliency testing. It’s not sufficient to have basic policies on paper — firms must prove that they can recover, continue critical servicing/origination activities, and protect borrower data in the event of a disruption or cyber event.

All told, the new Supplement shifts cybersecurity and resilience from an IT concern into a core compliance, governance, and risk-management concern for mortgage organizations and their partners.

What You Should Do — Next Steps for Mortgage Providers

To avoid fines, system access limitations, or reputational damage, stakeholders must act now. Here are recommended steps:

a) Gap Assessment & Audit
Immediately perform a comprehensive gap assessment of your existing Information Security Program, Incident Management procedures, Business Continuity Plan (BCP), and vendor oversight. Map your controls against the Supplement’s requirements to identify deficiencies.

b) Executive Oversight & Attestation
The Supplement implies senior-level accountability. Ensure that your governance structure includes a designated executive owner for InfoSec and business resiliency. Document attestations or board-level committee approvals as needed.

c) Incident-Response Procedures & Training
Update or develop your incident-response playbooks to reflect the new 36-hour reporting requirement. Train your staff and vendors on timely identification, escalation, and notification protocols.

d) Vendor & Contract Review
Review your agreements with third-party vendors, custodians, and technology partners. Confirm they meet the Supplement’s security-control and resiliency expectations. Amend contracts to include required obligations, audit rights, or compliance attestations.

f) Test & Document Resiliency Plans
Conduct tabletop exercises, disaster-recovery testing or fail-over drills. Document your results, remediation steps, and continuous improvement plan. Maintain records ready for audit or governance review.

g) Monitor & Report Progress
Establish internal dashboards or compliance-tracking metrics to monitor your progress toward full implementation ahead of the August 2025 deadline (or applicable deadline for your category). Escalate to senior leadership regularly.

Bottom Line:
Fannie Mae’s new Information Security & Business Resiliency Supplement is more than a security upgrade — it’s a compliance mandate. Cyber risk now sits squarely at the center of mortgage-lending partner eligibility. Firms that don’t treat information security and resiliency as strategic risk are at risk of losing access to Fannie Mae pipelines, facing operational interruptions, or worse, suffering avoidable reputational damage. Treat this as a priority project today — not tomorrow.

In a move shaking the mortgage community, Fannie Mae has filed a federal lawsuit against several home-warranty firms — Warranty Global Group, US Home Guard, Superior Home Protection, and Oasis Home Protection — accusing them of misusing its name and misleading borrowers.

The case, filed in the Northern District of Ohio, centers on allegations that these companies conducted a nationwide direct-mail campaign implying their home-warranty products were affiliated with Fannie Mae. Mailers used the trademarked term “Fannie Mae Mortgage®” and labels such as “Official Business” and “Immediate Response Required,” designed to imitate official communications.

Fannie Mae asserts that borrowers were deceived into believing these offers were legitimate and required. Some even contacted the institution directly, concerned they might be missing a mortgage-related obligation. According to the filing, the campaign began around July 2023 and continues today.

This misuse, Fannie Mae argues, has eroded borrower trust and damaged the integrity of its brand — a brand synonymous with housing stability and secondary-market confidence. Beyond seeking damages, Fannie Mae wants all misleading materials destroyed and the deceptive practices permanently halted.

Why This Matters for Lenders and Servicers

While this lawsuit targets warranty providers, its implications reach deep into the mortgage ecosystem. In a market already fraught with compliance scrutiny, this case illustrates how third-party actions can create liability and reputational fallout for financial institutions — even if they aren’t directly involved.

Mortgage companies frequently engage vendors for marketing, servicing, or ancillary products. Yet when oversight lapses, these relationships can expose lenders to potential regulatory risk under UDAP (Unfair, Deceptive, or Abusive Acts and Practices) standards.

Moreover, this case may prompt broader enforcement discussions around consumer protection and the marketing of mortgage-adjacent products. When brand misuse convinces borrowers to spend money on unnecessary or unauthorized services, regulators take notice — and litigation like this sets a precedent.

The Compliance Lesson: Guard Your Brand and Your Borrowers

This legal battle underscores a simple truth: in mortgage finance, trust is the ultimate currency. Borrowers rely on recognizable brands — Fannie Mae, Freddie Mac, or their lender’s own — as symbols of credibility. Any erosion of that trust impacts not only the consumer but the market’s perception of mortgage reliability.

To mitigate similar risks, compliance teams should:

a) Audit all third-party communications — Verify that vendors or partners aren’t using institutional logos, references, or suggestive phrasing implying endorsement.

b) Implement pre-approval protocols — No borrower-facing material should leave a partner’s system without formal sign-off from your compliance or legal department.

c) Enhance borrower education — Communicate clearly what legitimate correspondence from your organization or GSE partners looks like. Proactive borrower awareness can reduce exposure to scams.

d) Reinforce contractual language — Update vendor agreements to explicitly prohibit brand or name usage without written authorization.

The reputational stakes are high. Even perceived association with deceptive advertising can tarnish an organization’s credibility — a costly blow in an environment where borrower confidence is already fragile.

Broader Industry Implications

At a macro level, the lawsuit arrives amid heightened concerns over consumer deception and data privacy in mortgage communications. The proliferation of digital marketing tools has made it easier than ever for bad actors to blur the lines between official and third-party outreach.

Should the court side with Fannie Mae, the verdict could reshape expectations for brand governance across the industry. We may see tighter regulatory coordination between agencies like the CFPB and FTC, and stricter enforcement of fair-marketing standards.

Mortgage lenders, servicers, and investors must remain vigilant. Even a single unauthorized logo or phrase can expose borrowers to confusion — and institutions to reputational loss.

Bottom line: Fannie Mae’s lawsuit is more than a legal dispute — it’s a warning shot for the entire mortgage ecosystem. As borrowers grow wary of fine print and false urgency, maintaining transparency and safeguarding brand integrity are no longer optional. They are compliance imperatives.

Credit scoring has long been the foundation of mortgage underwriting. Today, that foundation is being reshaped. The Federal Housing Finance Agency (FHFA) has approved the use of VantageScore 4.0 for mortgages sold to Fannie Mae and Freddie Mac, while FICO has launched a direct licensing model that bypasses traditional credit bureaus. These changes have profound implications for lenders.

The Changing Credit Scoring Landscape

Historically, FICO has dominated mortgage credit scoring, with the three major credit bureaus acting as intermediaries. Now, the FHFA’s approval of VantageScore 4.0 introduces greater competition, while FICO’s decision to license directly to lenders is disrupting long-standing distribution models.

For lenders, this dual shift means more choice—but also more complexity in validating models, recalibrating risk policies, and ensuring fair treatment of borrowers.

Implications for Lenders

Model Validation: Lenders must back-test their existing FICO-based policies against VantageScore 4.0 to assess performance.

Operational Adjustments: Systems, overlays, and pricing tools may require reconfiguration to support multiple scoring models.

Consumer Impact: VantageScore claims to provide credit access to millions of previously unscored borrowers. Lenders must prepare for a broader applicant pool and potential shifts in approval rates.

Cost Dynamics: FICO’s direct licensing could reduce costs, but lenders must evaluate contract structures carefully to ensure long-term value.

Best Practices for Transition

Dual-Track Scoring During Transition
Maintain both FICO and VantageScore infrastructures while validating outcomes. Avoid reliance on a single score until performance is proven.

Policy Revalidation
Reassess overlays, credit thresholds, and risk tolerances in light of new scoring methodologies.

Cross-Functional Collaboration
Involve compliance, credit risk, operations, and IT teams in the transition to ensure seamless implementation.

Clear Borrower Communication
Transparency with borrowers about scoring methodologies can help mitigate confusion and build trust.

Looking Ahead

The credit scoring shake-up signals a broader trend: greater competition, innovation, and transparency in consumer credit evaluation. For lenders, the opportunity lies in embracing these changes to expand access to credit while safeguarding risk.

Conclusion

The introduction of VantageScore 4.0 and FICO’s licensing shift are more than technical adjustments—they represent a structural transformation of mortgage credit risk management. Lenders that proactively adapt will not only remain compliant but also position themselves to capture new market opportunities and strengthen borrower relationships.

Artificial intelligence and automated underwriting are transforming the mortgage industry. They promise faster approvals, reduced costs, and enhanced borrower experiences. Yet, with this innovation comes heightened compliance scrutiny—particularly around fair lending. Regulators are making it clear: efficiency cannot come at the expense of equity.

The Regulatory Backdrop

The Consumer Financial Protection Bureau (CFPB) and state regulators have sharpened their focus on algorithmic bias. At the same time, new rules governing automated valuation models (AVMs) took effect in October 2025, underscoring the demand for transparency and fairness in automated decision-making. These developments signal that fair lending compliance will be one of the defining issues of the decade.

Risks of Algorithmic Underwriting

While AI and machine learning models can outperform traditional credit decisioning in speed and consistency, they also carry hidden risks:

Bias in Training Data: Historical datasets may inadvertently replicate discriminatory lending practices.

Lack of Explainability: “Black box” models make it difficult for lenders to explain why a decision was made—an issue in both compliance and consumer trust.

Auditability Challenges: Without clear governance, it can be impossible to prove compliance during an examination.

Best Practices for Compliance and Innovation

Algorithmic Fairness Assessments
Regularly test models for disparate impact across protected classes. Document findings and corrective measures.

Maintain Human Oversight
Ensure that critical underwriting decisions involve human review, especially for borderline cases.

Model Governance Framework
Establish policies for version control, independent validation, and drift monitoring. All models should undergo rigorous pre-implementation review.

Transparent Documentation
Keep comprehensive records of model design, training data, and testing methodologies. Transparency is critical for satisfying examiner inquiries.

Balancing Efficiency with Responsibility

Forward-thinking lenders are finding ways to harness AI while minimizing compliance risk. Some are adopting hybrid approaches—using AI for efficiency while retaining human oversight for fairness. Others are investing in explainable AI models that provide interpretable outputs, making compliance easier to demonstrate.

Conclusion

The future of mortgage lending is undeniably digital. But innovation must be anchored in responsibility. By embedding fair lending principles into every stage of AI adoption, lenders can achieve the dual objectives of operational efficiency and regulatory compliance. Those who succeed will not only avoid costly penalties but also build enduring trust with borrowers and regulators alike.