Fannie Mae and Freddie Mac Seller Servicer Audit Requirements

Mortgage banking audit and compliance services for independent mortgage bankers must cover an annual financial statement audit and several other duties. Fannie Mae and Freddie Mac seller/servicer eligibility depends on financial reporting, servicing compliance, information security, and AI/ML governance. The right CPA firm understands how these requirements interlock and plans the work around both filing deadlines and ongoing oversight.

What it means to be an approved GSE seller/servicer and why the audit obligations follow from that status

Seller/servicer approval establishes an ongoing contractual relationship with the GSEs. Sellers that have approval may sell loans into the secondary market, and servicers that have approval may service GSE-backed loans. Those permissions depend on continued compliance with the applicable policies and guidelines. If a lender loses approval, it may be unable to sell loans, may have to repurchase them, and may face other limits on its business. A lapse therefore risks both a fine and a breach of contract.

The relationship also gives the GSEs a direct oversight role. Freddie Mac’s Single-Family Seller/Servicer Guide requires seller/servicers to conduct operations according to its policies and guidelines. Ready Capital’s 10-K states that Freddie Mac performed an audit during 2025, after which ReadyCap Commercial and Ready Capital Affordable received an overall assessment of “Satisfactory”.

The annual audited financial statement and how Fannie Mae requires it to be prepared

Fannie Mae requires the annual audited financial statement within 90 days after fiscal year-end. It must be prepared under GAAP, include an independent public accountant’s opinion, and be comparative with the prior year. The full statement package must include the balance sheet, income statement, retained earnings, additional paid-in capital, changes in financial position, and all related notes.

Independence governs how the review is structured. Fannie Mae’s Selling Guide requires the audit function to report directly to senior management and/or the board of directors, without sharing reporting lines with any area it reviews. Pease Bell is among the mortgage banking specialists that build this safeguard into the engagement structure.

The financial thresholds give that review contractual weight. Adjusted Net Worth must be at least $2.5 million, plus amounts tied to residential first lien mortgage servicing UPB serviced for Fannie Mae and Freddie Mac and for Ginnie Mae. The minimum capital ratio must be greater than 6% Adjusted Net Worth to Total Assets. A material decline in adjusted net worth, declining profitability, or a default under various obligations can entitle Fannie Mae to declare a breach of the Lender Contract.

Quarterly and monthly financial reporting obligations layered on top of the annual audit

Fannie Mae requires the Mortgage Bankers’ Financial Reporting Form, Form 1002, from mortgage bankers, subsidiaries of federally supervised depository institutions, housing finance agencies, and REITs. It is due within 30 days of each calendar quarter-end, with 60 days allowed for the December 31 quarter. The CEO, CFO, or equivalent must certify it.

Large non-depository seller/servicers must also send in the Mortgage Bankers’ Financial Reporting Short Form, Form 1002A. This monthly form is due within 30 days of month-end and also requires certification by the CEO, CFO, or equivalent. Certification creates personal accountability for interim accuracy, while missed windows or uncertified submissions can create a breach-triggering compliance gap. Coordinating preparation and sign-off therefore requires the operational discipline that mortgage banking advisers, including Pease Bell, help lenders bring to their reporting calendars.

The USAP attestation and the servicing-compliance layer beside the financial statement audit

A financial statement opinion does not answer whether a servicer complied with minimum servicing standards. The Uniform Single Attestation Program, or USAP, addresses that separate question through an annual independent CPA engagement under attestation standards. The Mortgage Bankers Association sets the minimum servicing standards that it covers. Its scope includes custodial accounts, escrow reconciliation, payment posting, and fund remittance.

The engagements serve different purposes: a financial statement audit opines on GAAP fairness, while a USAP engagement attests to servicing compliance. Both usually follow the same annual cycle and come together in the yearly compliance package, which can make their different roles harder to see. Delivering only one leaves that package incomplete even if its findings are clean. For regional firms with dedicated mortgage banking practices, such as Pease Bell, understanding the relationship between financial audit findings and servicing-compliance work is part of the specialization.

SOC 2 Type 2 and Freddie Mac’s 2027 information security deadline for large servicers

Freddie Mac Bulletin 2025-13, issued October 1, 2025, introduced a SOC 2 Type 2 examination requirement effective January 1, 2027. Seller/servicers whose servicing portfolio equals or exceeds $150 billion annually must complete the examination under AICPA standards. Those below the threshold are encouraged, but not required, to do so. The operative Trust Services Criteria cover security, availability, processing integrity, confidentiality, and privacy.

A Type 2 examination assesses controls over a defined observation period, typically 6–12 months. Consequently, a servicer that waits until late 2026 to begin may not be able to produce a compliant report by January 1, 2027. Planning must account for both the period being examined and report delivery. Treating this as an IT project detached from the compliance calendar misses that constraint.

Freddie Mac Bulletin 2026-4, issued April 1, 2026, updated software and application requirements effective July 1, 2026. It also set May 11, 2026 as the effective date for business impact analysis requirements introduced in Bulletin 2026-1.

Why SOC 2 alone is no longer enough for the new GSE AI/ML mandates

SOC 2’s principles can apply to controls around AI/ML systems, whether they are built in-house or are part of vendor products. But that does not make a SOC 2 report complete evidence of AI governance. Its organizational control focus does not address model card completeness, training-data provenance, or fair-lending testing methodology and results by protected class. Nor does it establish whether vendor output supports an adverse action notice compliant with fair-lending requirements under 12 C.F.R. § 1002.9 or whether retraining triggers vendor change notification.

That boundary matters because the GSEs may now request evidence in those areas. Freddie Mac also explicitly addresses data poisoning and adversarial inputs, threats SOC 2 was not designed to assess. SOC 2 remains necessary where required, but it is insufficient as the entire vendor evidence package.

The CFPB’s removal of disparate impact from Regulation B, effective July 21, 2026, does not eliminate theories available under the Fair Housing Act, GSE contracts, and state fair lending regimes. ISO/IEC 42001 is emerging as a procurement discriminator, but mortgage-specific implementation guidance is still developing. The gap calls for additional assurance alongside existing security controls.

Fannie Mae LL-2026-04 and Freddie Mac Bulletin 2025-16 and what their AI/ML frameworks require

Fannie Mae issued Lender Letter LL-2026-04 on April 8, 2026, and it takes effect on August 6, 2026. It requires written policies covering AI/ML development, implementation, use, and maintenance, with designated owners responsible for implementation, maintenance, and review at least annually. Policies must reach the staff they apply to, follow the law and regulation that apply, and fit the institution’s risk tolerance. Lenders must also meet their information security duties.

Fannie Mae extends governance to vendors and subcontractors through a standard that must be “no less protective” than its internal requirements. On request, lenders must disclose AI/ML types, purpose and manner of use, safeguards, and “such other information as Fannie Mae may require”. That last provision makes the completeness of vendor files especially important. A lender needs to obtain the evidence as well as have a policy.

Freddie Mac issued Guide Bulletin 2025-16 on December 3, 2025, and it takes effect on March 3, 2026. It requires active assessment for data poisoning and adversarial inputs, regular internal and external audits against NIST 800-53 and ISO/IEC 27001, and ongoing monitoring for performance degradation, bias, and security issues. It also requires segregation of duties, documented accountability and communication lines, and senior management approval including, at a minimum, the CIO, CTO, CISO, or chief risk officer. Lenders must promptly disclose the AI/ML they use in Freddie Mac activity, including why and how they use it.

Freddie Mac’s broad indemnification obligation adds legal consequences beyond disclosure. Sellers and servicers must hold it harmless from losses or liability arising from their AI/ML use. Both frameworks also require attention beyond deployment, because model drift can introduce bias or other compliance problems over time. FHFA Advisory Bulletin 2022-02, revised May 2025, flagged that risk. Lenders that sell to both GSEs must meet the requirements of both frameworks.

AIUC-1 and the emerging AI assurance infrastructure lenders and auditors need to understand

AIUC-1 is an emerging assurance standard. The Artificial Intelligence Underwriting Company launched it in mid-2025 after development with more than 100 Fortune 500 CISOs. Its 51 requirements and 130 controls cover six risk pillars that deal with how AI agents fail in production. It adds to SOC 2 and broader organizational controls.

Schellman became AIUC-1’s first accredited auditor. KPMG LLP became the first Big Four firm with AIUC-1 certified AI capability. Pease Bell’s AIUC-1 assurance work connects emerging AI assurance with mortgage lenders’ and servicers’ GSE obligations.

Other frameworks are developing at the same time. On February 19, 2026, the U.S. Department of the Treasury released its Financial Services AI Risk Management Framework, which is voluntary and has 230 control objectives across seven risk domains. Banks still use OCC Bulletin 2023-17 as a reference for third-party risk management. Read with the GSE requirements, these frameworks point toward documented governance, model lifecycle, fair-lending review, vendor change control, and audit access.

An AI-specific vendor audit calibrated to GSE obligations must translate those concepts into testable evidence. Its scope must cover AI inventory and version control, model cards, training-data provenance, fair-lending testing by protected class, adverse action notice support, and retraining notification protocols. Documentation must be current and anchored to the model version reviewed. Waiting for assurance standards to mature does not suspend the lender’s contractual duties.

How HUD 232, multifamily housing, and skilled nursing facility audits interact with GSE requirements

Lenders that work in both HUD-insured and GSE markets have more duties, though these depend on which entity files the reports. HUD Section 232 insures residential care facilities, including nursing homes, intermediate care facilities, board and care homes, and assisted living facilities. HUD’s Office of Residential Care Facilities administers it under 24 CFR Part 232. Under 24 CFR 5.801, entities that have Section 232-insured mortgages must send in annual financial statements within 90 calendar days of fiscal-year-end and prepare them under GAAP as further defined by HUD.

Quarterly operator statements are due within 60 calendar days of quarter-end, or 90 days for the fiscal year-end quarter. They may be operator-certified unless the operator is also the borrower, when a full audit is required. The HUD audit contains both a financial statement audit and a compliance audit of major HUD programs, performed under GAAS and GAGAS. HUD may also require more frequent or audited statements case by case.

Freddie Mac multifamily Optigo seller/servicers face additional scrutiny of capitalization, profitability, and funding sources, with periodic financial reviews at Freddie Mac’s discretion. Lenders that work in these markets must choose an auditor whose work covers the regulatory agreements and ORCF requirements that apply, as well as GSE rules. Pease Bell’s HUD 232 audit and skilled nursing facility accounting work is one example of that specialized coverage. The more specialized the loan type, the more specialized the audit knowledge must be.

How to find a CPA firm that can coordinate the full seller/servicer compliance calendar

Lenders need a firm that can plan the work for all their duties together and keep the engagements connected. Named criteria include mortgage banking accounting expertise, GSE reporting knowledge, USAP capability, SOC examination experience, and current AI assurance competence. HUD and multifamily activity add program-specific requirements. Structural independence must run through the work.

The annual plan must cover annual financial statements and USAP, with separate cycles to prepare and certify Forms 1002 and 1002A. SOC 2 requires advance observation-period planning. AI governance requires ongoing monitoring and evidence ready for a disclosure request.

A specialized adviser can connect these demands without confusing their purposes. Pease Bell’s mortgage banking audit and compliance practice provides coordinated oversight of the GSE requirement set through a year-round relationship, including SOC examinations and emerging assurance standards. Staying in good standing depends on understanding how the obligations interlock and maintaining the evidence each one requires.