SAMPLE

QU ALIT Y AS SUR A NC E BEST PR ACTI CE S Table of Contents

1 – Quality Control Program

Section Topic Page

1.1 Overview 1 – 1 1.2 Program Administration 1 – 1 1.3 Responsibilities of the QC Manager 1 – 2 1.4 Corporate Governance 1 – 3 1.5 Capabilities and Expertise 1 – 3 1.6 Defect Rate 1 – 4 1.7 Defect Rate Calculation 1 – 5 1.8 Severity Level 1 – 6 1.9 Management Response 1 – 6 1.10 Defect Tracking 1 – 8 1.11 Trending 1 – 9 1.12 Reporting 1 – 9 1.13 Disciplinary Action 1 – 10

2 – Fraud Detection

2.1 Overview 2 – 1 2.2 Employee Training 2 – 1 2.3 Requirements of FACTA, Section 114 & 315 2 – 2 2.4 Identifying Information 2 – 2 2.5 Identification of Red Flags 2 – 3 2.6 Address Discrepancies 2 – 3 2.7 Accuracy of Information from Credit Agency Reports 2 – 4 2.8 Social Security Validation 2 – 4 2.9 OFAC Check 2 – 4 2.10 Fraud Check 2 – 4 2.11 Alerts, Warnings from a Consumer Reporting Agency 2 – 5 2.12 Procedures for Mitigating Alerts from a Credit Agency 2 – 5 2.13 Presentation of Suspicious Documents 2 – 6 2.14 Presentation of Suspicious Personal Identifying Information 2 – 6 2.15 Notices Received for Suspicious Activity 2 – 7 2.16 Response to Presented Documents 2 – 7 2.17 Assessment of Risk 2 – 8 2.18 Mitigation Steps for Cleared Variance 2 – 8 2.19 Filing a Suspicious Activity Report (SAR) 2 – 9 2.20 BSA / AML Compliance 2 – 10 2.21 Fannie Mae Rule for OFAC and AML Compliance 2 – 11 2.22 Freddie Mac Rule for OFAC, AML and Other Laws 2 – 12 2.23 FLHB-MPF Rule for AML and BSA Compliance 2 – 14

Quality Assurance Best Practices Guide Table of Contents, Page 1 of 4

SAMPLE

3 – Fannie Mae Requirements

Guide Update

3.1 Fannie Mae QC Process 7/29/14 3 – 1 3.2 Requirements for QC Plan Contents 7/29/14 3 – 2 3.3 Quality Standards and Measures 7/29/14 3 – 3 3.4 QC File Review Overview 7/29/14 3 – 4 3.5 Selection of Loans for QC Review 7/29/14 3 – 5 3.6 Reporting and Remediation 7/29/14 3 – 6 3.7 QC Operations Reporting Structure and Staffing 7/29/14 3 – 6 3.8 Outsourcing of the QC File Review Process 7/29/14 3 – 7 3.9 Pre-funding Quality Control 7/29/14 3 – 8 3.10 Timing of Pre-funding Loan File Reviews 7/29/14 3 – 9 3.11 Pre-funding Loan Selection Process 7/29/14 3 – 9 3.12 Verification of Data and Documents 7/29/14 3 – 10 3.13 Pre-funding Reporting 7/29/14 3 – 10 3.14 Recommended / Required Pre-funding QC March 2014 3 – 11 3.15 Post-closing QC Loan File Review Process 7/30/13 3 – 13 3.16 Timing of Post-closing QC Review Process 7/30/13 3 – 14 3.17 Post-closing Loan Selection Process 7/30/13 3 – 15 3.18 Random Mortgage Selections and Statistical Sampling 7/30/13 3 – 15 3.19 Discretionary Mortgage Selections 7/30/13 3 – 16 3.20 Post-closing QC Review Overview 7/29/14 3 – 17 3.21 Review of Underwriting Decision and Approval Conditions 7/29/14 3 – 17 3.22 Review of DU Findings and Conditions 7/29/14 3 – 18 3.23 General Requirements for Reverifications 7/29/14 3 – 18 3.24 Use of IRS Form 4506-T in the Lender’s QC Plan 7/29/14 3 – 19 3.25 Reverification of Income, Employment and Assets 7/29/14 3 – 19 3.26 Reverification of Borrower’s Credit History 7/29/14 3 – 20 3.27 Verification of Occupancy 7/29/14 3 – 20 3.28 Verification of Data Integrity 7/30/13 3 – 21 3.29 Review of Potential Red Flag and Alert Messages 7/30/13 3 – 22 3.30 Review of Social Security Number 7/30/13 3 – 22 3.31 Appraisal Review Overview 7/29/14 3 – 23 3.32 Oversight of Appraisers 7/29/14 3 – 23 3.33 Verification of Appraisals by Field Review 7/29/14 3 – 23 3.34 Appraisal Field Review Forms 7/29/14 3 – 24 3.35 Verifications of Appraisals by Desk Review 7/29/14 3 – 24 3.36 Reporting of Appraisal Defects 7/29/14 3 – 24 3.37 Review of Transaction and Closing Documents 7/30/13 3 – 25 3.38 Lender’s Internal QC Reporting 7/29/14 3 – 26 3.39 Lender’s Responsibilities for Self-Reporting to Fannie Mae 7/29/14 3 – 27 3.40 Record Retention and Response to Fannie Mae Requests 7/29/14 3 – 27 3.41 Audit Review of the QC Process 7/29/14 3 – 27 3.42 Compliance with Laws 7/29/14 3 – 28

Quality Assurance Best Practices Guide Table of Contents, Page 2 of 4

SAMPLE

4 – Freddie Mac Requirements

4.1 Seller’s Quality Control Program 6/13/12 4 – 1 4.2 Use of Third Party Quality Control Services 12/1/11 4 – 3 4.3 Transfers of Servicing 12/1/11 4 – 3 4.4 Postclosing Sample Selection 6/13/12 4 – 4 4.5 Reverifications Made by Seller 2/14/14 4 – 6 4.6 Data Integrity Review 12/1/11 4 – 11 4.7 Documentation Review 12/1/11 4 – 12 4.8 Preclosing Quality Control Reviews 5/15/12 4 – 13 4.9 Documenting Reviews 12/1/11 4 – 15 4.10 Reporting Requirements 6/13/12 4 – 15 4.11 Retention of Quality Control Records 12/1/11 4 – 15

5 – FHA Requirements

5.1 Quality Control Program Overview 6/30/14 5 – 1 5.2 Institutional Quality Control Program Requirements 6/30/14 5 – 3 5.3 Rejected Borrower Applications 6/30/14 5 – 6 5.4 Fraud, Misrepresentation and Other Findings 6/30/14 5 – 10 5.5 Loan Level Quality Control Program Requirements 6/30/14 5 – 13 5.6 Sample Composition Standard 6/30/14 5 – 14 5.7 Loan Sample Risk Assessment 6/30/14 5 – 15 5.8 Documentation Review and Reverification 6/30/14 5 – 17

6 – VA Requirements

6.1 Elements of a Quality Control Plan 7/20/07 6 – 1 6.2 Management Response 7/20/07 6 – 2 6.3 Plan Maintenance 7/20/07 6 – 3 6.4 Review of Loans 7/20/07 6 – 4

Quality Assurance Best Practices Guide Table of Contents, Page 3 of 4

SAMPLE

7 – FHLB-MPF Requirements

7.1 PFI’s Quality Control Program 10/15/14 7 – 1 7.2 Quality Standards and Measures 10/15/14 7 – 4 7.3 Pre-Closing Quality Control Plan Requirements 10/15/14 7 – 5 7.4 Quality Control Staffing and Outsourcing 10/15/14 7 – 6 7.5 Transfers of Servicing 12/28/12 7 – 7 7.6 Sample Selection 10/18/13 7 – 8 7.7 Early Payment Default (EPD) Mortgages 10/18/13 7 – 14 7.8 High Level Concern (HLC) Mortgages 10/18/13 7 – 14 7.9 Reverifications Made by PFI 10/18/13 7 – 15 7.10 Reverifications of Employment and Income 10/18/13 7 – 15 7.11 Reverification of the Sources of Funds 10/15/14 7 – 17 7.12 Credit Report Verification 10/18/13 7 – 18 7.13 Post-Closing Review of Appraisals and Oversight 10/15/14 7 – 19 7.14 Verification of Data and Documents 10/18/13 7 – 21 7.15 Reverifications Made by a Vendor 10/18/13 7 – 24 7.16 Verification of Owner Occupancy 10/18/13 7 – 24 7.17 PFI’s Review of the Mortgage Files 10/18/13 7 – 25 7.18 Verification of Borrower Identity 10/18/13 7 – 26 7.19 Verification of Borrower’s Social Security Number 10/18/13 7 – 27 7.20 Verification of Borrower’s Individual Taxpaper ID 5/18/10 7 – 27 7.21 Origination Documents to Review 10/18/13 7 – 28 7.22 Closing Documents to Review 10/18/13 7 – 29 7.23 Documenting Reviews in the Mortgage File 10/18/13 7 – 31 7.24 PFI’s Internal Reporting Requirements 10/15/14 7 – 32 7.25 Retention of PFI’s Quality Control Records 12/28/12 7 – 35 7.26 Audit Review of the PFI’s Quality Control Process 10/18/13 7 – 35

Quality Assurance Best Practices Guide Table of Contents, Page 4 of 4

SAMPLE

1.7 Defect Rate Calculation

Reference: Fannie Mae’s Quality Control Self-Assessment guide, March 2014.

Defect Rate Tutorial

An effective way to establish loan quality targets is to model the financial exposure created at a certain defect level. The concept of "zero defects" generally will be considered challenging to achieve and we do not evaluate lenders by a zero-defect rate standard. We expect lenders to set defect rate targets as reasonably low as possible based on a formal cost-benefit analysis of meeting that target. We then expect lenders to demonstrate to them how they are managing loan quality to meet their established target.

Having a target defect rate is required for the top severity level (ineligible for delivery to Fannie Mae) and enables the lender to regularly evaluate and measure progress in meeting its loan quality standards. Lower severity levels must be defined by the lender as appropriate for its organization and different target defect rates may be established for different severity levels (if applicable).*

Calculating a defect rate is how you measure against your target defect rate. Some lenders use only a GROSS or NET calculation when determining their monthly defect rate, while others use both. The GROSS defect rate is the defect rate based on the initial findings prior to any rebuttal activity. The NET defect rate is the defect rate based on the final findings after the rebuttal activity. Understanding the root cause of the issues that were resolved during the rebuttal process may provide insight into how the defects can be prevented. If a loan has both a highest-severity level defect and a lower-severity level defect, only count the loan ONCE-in the highest severity category-in a defect rate calculation.

Calculating a Gross Defect Rate

The number of loans with a defect divided by the number of loans in the QC sample size.

This calculation should be done for your two most severe defect types (e.g. significant and Moderate)

Calculating a Net Defect Rate

The number of loans with a defect minus the number of corrected loans, divided by the number of loans in the QC sample size.

*Indicates Selling Guide Requirement

Quality Assurance Best Practices Quality Control Program Page 1 - 5

SAMPLE

1.8 Severity Level

Secondary market agencies have defined the severity level, also known as risk rating, classification or grade, for each defect. The overall risk rating is a grade that is assigned to the whole loan itself— not the individual defect. Illustrated below is an example of a risk classification grid that may be modified and adapted by the institution and in accordance with its mortgage programs and investors.

Level 1 - Minor Technical errors, omissions, incomplete or unsigned verification forms. Loan is considered acceptable to client's internal policy and acceptable to secondary market investors. Level 2 - Moderate Loan has been approved and funded without adherence to investor guidelines or underwriting conditions. Loan is considered acceptable and/or complies with client's internal policy; however, document curing may be required post-closing to maintain full compliance. Level 3 - Important Loan has been approved and funded without adherence to investor guidelines or underwriting conditions. Findings are considered non-curable and may be ineligible by agency or insurer. Level 4 - Significant Post-closing quality control indicates discrepancies related to the borrower's credit, identity, assets, income, employment or occupancy; however discrepancies are not considered fraudulent. Finding may warrant process improvement to strengthen internal or external verification and data integrity steps. Level 5 - Prohibitive Fraud or misrepresentation has been found consisting of false information, fabricated documents or suspicious activity involving the appraiser or third parties. Corrective action and disciplinary steps are required. Investor must be notified.

1.9 Management Response

Quality assurance steps must include a process for dealing with defects. Such steps are referred to as “remediation” or “deficiency curing.” Senior management should promptly initiate action to correct all deficiencies. The actions taken by management should be formally documented by citing each deficiency, identifying the cause of the deficiency, and providing management's response or actions taken. Quality Control personnel and/or management must follow up to ensure that all defects are cleared and remediation or corrective action has been completed.

Quality Assurance Best Practices Quality Control Program Page 1 - 6

SAMPLE

2.22 Freddie Mac Rule for OFAC, AML and Other Laws

Reference: Guide Chapter 6.2, Compliance with Applicable Law (10/1/14)

(a) Seller’s obligations

The Seller agrees to comply with all applicable federal, State and local laws, ordinances, regulations and orders, including the following laws and their applicable regulations:

1. Title VI of the Civil Rights Act of 1964

2. Title VIII of the Civil Rights Act of 1968, as amended

3. Section 527 of the National Housing Act

4. The Equal Credit Opportunity Act

5. The Fair Credit Reporting Act

6. All applicable laws, rules, regulations and guidance prescribed by Seller’s regulator(s), governing data privacy and/or the safeguarding of Borrower personal information, including, without limitation, the Gramm-Leach-Bliley Act

7. Executive Order 11063, Equal Opportunity in Housing, issued by the President of the United States on November 20, 1962

8. The foreign assets control regulations, 31 C.F.R. Chapter V, as amended, and any authorizing legislation or executive order relating thereto, as administered by the Office of Foreign Assets Control (OFAC) within the United States Department of the Treasury (collectively “OFAC Regulations”)

9. The Bank Secrecy Act, the Money Laundering Control Act and Title III of the USA PATRIOT Act

10. Section 5 of the Federal Trade Commission Act and similar laws that prohibit unfair or deceptive acts or practices

11. The Truth-in-Lending Act

12. The Real Estate Settlement Procedures Act

13. The Fair Debt Collections Practices Act

14. The Homeowners Protection Act of 1998

15. Judicial and professional rules of conduct governing discussions with opposing parties in litigation when represented by counsel (e.g., solicitation of delinquent Borrowers in bankruptcy or Borrowers engaged in litigation with the Servicer)

16. The U.S. Bankruptcy Code

17. The Electronic Signatures in Global and National Commerce Act, as enacted by the United States government (“E-SIGN”)

18. The Uniform Electronic Transactions Act, as enacted by the applicable State (“UETA”) unless superseded by E-SIGN

Quality Assurance Best Practices Fraud Detection Page 2 - 12

SAMPLE

3.6 Reporting and Remediation

Reference: D1-1-01: Lender Quality Control Programs, Plans, and Processes (07/29/2014)

QC reports are a critical component of the QC program. They enable management to evaluate and monitor the quality of the lender’s loan origination process and to identify specific loans and/or broad based systemic, procedural, or operational issues that need to be addressed or remedied to reduce the lender’s defect rate and improve loan quality. When trends are identified through the review process, the lender must establish an action plan for specific corrective action to be taken, including the expected resolution and the time frames for implementation.

The lender must report on the results of both prefunding and post-closing QC file reviews to senior management on no less than a monthly basis. For information on prefunding reporting requirements, see D1-2-01, Lender Prefunding Quality Control Review Process; for information on post-closing reporting requirements, see D1-3-06, Lender Post-Closing Quality Control Reporting, Record Retention, and Audit.

3.7 QC Operations Reporting Structure and Staffing Reference: D1-1-02: Lender Quality Control Staffing and Outsourcing of the QC Process (07/29/2014) To preserve the integrity of the process, all post-closing QC employees (including those related to establishing, monitoring, and enforcing procedures) must be independent of the production, underwriting, and closing departments, except in situations when the size of the lender’s organization is insufficient to support adequate resources to allow for separation of these functions. In these cases, the lender’s QC plan must include the rationale for the lack of separation as well as the controls that have been established to mitigate the potential risks associated with the lack of separation of these functions.

Lenders must establish minimum requirements for the skill set and expertise of the staff performing the QC file reviews by documenting minimum job qualifications. Lenders are responsible for ensuring that all individuals conducting QC reviews are adequately trained and have sufficient experience levels relative to the reviews being conducted, including manual underwriting and/or loans processed through any automated underwriting systems utilized by the lender. Lenders are also responsible for ensuring that the reviewers conducting more complex or specialized reviews (for example, appraisals, self-employed borrowers) have the requisite knowledge and experience to do so.

Detailed policies and procedures for the QC file review process must be provided to all employees who will be involved with the QC file reviews.

Quality Assurance Best Practices Fannie Mae Requirements Page 3 - 6

SAMPLE

4.4 Postclosing Sample Selection

Reference: Guide Chapter 48.4, Postclosing Sample Selection (06/13/12) The Seller's postclosing quality control sample must, at a minimum, consist of three sample types:

• Random

• Targeted

• Discretionary

(a) Random sample Home Mortgages in the random sample are randomly selected from the population so that every Mortgage has an equal chance of selection. Loan Prospector® Mortgages must make up a representative portion of the Seller's quality control sample. Except as provided under the last paragraph of this section, the Seller must: • Select for quality control review at least 10 percent of one of the following production

populations:

o Total annual Home Mortgage production, or

o Total annual secondary market Home Mortgage production, or

o Total annual Freddie Mac Home Mortgage production

However, any Mortgages excluded from the Seller's quality control sample selection process, as set forth in the remaining provisions of this section, are not eligible for sale to Freddie Mac.

• Schedule its sampling procedures so that every Home Mortgage within the selected

population has a chance of being selected for review within 90 days of the Note Date

• Assign to quality control personnel the authority to conduct additional reviews at their discretion

• Warrant that over the course of each 12-month period, the selected samples are representative of the full scope of the Seller's product line and production process within the selected population

Quality Assurance Best Practices Freddie Mac Requirements Page 4 - 4

SAMPLE

The full scope of the Seller's product line and origination process includes all of the following: • Home Mortgages from all product lines

• Home Mortgages from all States of operation

• Home Mortgages from each branch office

• Home Mortgages from each third-party involved in the origination process

• Home Mortgages with high-risk characteristics (for example, high loan-to-value (LTV) ratios, adjustable-rate Mortgages, 3- to 4-unit properties, Manufactured Homes, cash-out refinance Mortgages, Investment Property Mortgages and Caution Mortgages)

A Seller with a total annual production volume in excess of 5,000 Home Mortgages may substitute a statistically based sampling methodology that is of sufficient size to ensure a confidence level of 95% and a margin of error not to exceed 2% on an annual basis based on the defect rates for Mortgages recently reviewed by the Seller's quality control.

(b) Targeted sample

Each month, the Seller must select all Mortgages sold to Freddie Mac that become 60 days or more past due in the first six months following the Note Date. These Mortgages must be carefully evaluated to determine the presence of any fraud or other deficiency.

(c) Discretionary sample Mortgages in a discretionary sample are selected on a non-random basis from a specific population. As required in Sections 7.2(c) or 57.2(c), discretionary samples must be selected to evaluate the work of a particular employee or Mortgage transaction participant when there is a reason to suspect fraud. Discretionary samples should also be selected as needed in order to:

• Review the work of a new branch office, employee or third-party

originator

• Validate that a new product or offering is being originated in accordance with the Seller's policies and procedures

• Comply with a request from Freddie Mac to review loans in a specific population

Quality Assurance Best Practices Freddie Mac Requirements Page 4 - 5

SAMPLE

7.4 Quality Control Staffing and Outsourcing

Reference: PFI’s In-House Quality Control Program, Section 28.2 (10/15/14)

Requirements for Quality Control Operations Reporting Structure and Staffing

All post-Closing quality control employees (including those related to establishing, monitoring, and enforcing procedures) must be independent of the production, underwriting, and closing departments, except in situations when the size of the PFI’s organization is insufficient to support adequate resources to allow for separation of these functions. In these cases, the PFI’s quality control plan must include the rationale for the lack of separation as well as the controls that have been established to mitigate the potential risks associated with the lack of separation of these functions.

PFIs must establish minimum skill set and expertise requirements for the staff performing the pre-Closing and post-Closing quality control reviews and document these minimum job qualifications in its quality control plan. PFIs are responsible for ensuring that all individuals conducting quality control reviews are adequately trained and have sufficient experience relative to the reviews being conducted. This training and experience should cover manually underwritten mortgages and those underwritten with the assistance of DU or LP. PFIs are also responsible for ensuring that the reviewers conducting more complex or specialized reviews (for example, appraisal reviews and self-employed Borrowers) have the proper knowledge and experience to do so.

Detailed policies and procedures for the quality control review process must be provided to all employees who will be involved with the quality control reviews.

Outsourcing the Quality Control File Review Process

A PFI is permitted to utilize third-party quality control services for all or a portion of its quality control program. A PFI using such services is responsible for developing and maintaining loan quality standards and developing a quality control plan to achieve those standards. The MPF Bank holds the PFI accountable for its overall quality control program and for ensuring the quality control loan reviews comply with the MPF Program requirements, regardless of whether the work is performed by the PFI itself or by an outsourced quality control service provider. The PFI’s contract for services is not a substitute for the PFI establishing and maintaining its own quality control plan.

Quality Assurance Best Practices FHLB MPF Requirements Page 7 - 6

SAMPLE

The PFI must ensure that the quality control vendor conducts its reviews in accordance with the PFIs quality control plan. The quality control vendor must have written policies and procedures detailing its review methodologies, including selections and identification of defects and trends as well as the required reporting of any results to the PFI. The PFI must ensure that the vendor’s review staff possesses the qualifications and experience required to provide quality reviews and meaningful analysis, and that the vendor’s policies and procedures align with the PFI’s policies and procedures and meet the MPF program guidelines.

The PFI must fully incorporate the results of the vendor’s reviews into its quality control reporting and remediation processes. The PFI must have procedures to associate the appropriate severity level to the identified defects, and to implement corrective actions within the PFI’s organization, the same as it would for defects identified by the PFI’s own staff.

7.5 Transfers of Servicing

Reference: PFI’s In-House Quality Control Program, Section 28.3 (12/28/12) A PFI that acquires Servicing must include provisions in its quality control program that address the Transfer of Servicing. When Servicing is transferred, the Originating PFI must complete the quality control reviews except for reviews of High Level Concern (HLC) and Early Payment Default (EPD) loans, which the Servicing PFI must complete (see Servicing Guide Chapter 107.4.5.1 for the quality control review requirements on HLC Mortgages). To comply with this requirement the Originating PFI must either:

• Retain copies of the file documents; or • Arrange with the new Servicer to assist in the quality control reviews.

The new Servicer must be furnished records of completed quality control reviews.

Quality Assurance Best Practices FHLB MPF Requirements Page 7 - 7

SAMPLE

bankersadvisory.com

CLAconnect.com

SAMPLE