HUD REAC Financial Statement Submission Rules
Every obligation in this framework traces back to a single regulatory anchor: 24 CFR Part 5, Subpart H, which codifies the Uniform Financial Reporting Standards. The UFRS rule is not internal HUD guidance or a policy preference. It is binding federal regulation, and that distinction matters considerably when someone is deciding how carefully to read it.
Three core requirements attach to all covered financial statements: preparation under Generally Accepted Accounting Principles as further defined by HUD's supplementary guidance, electronic submission through HUD-designated systems, and conformance to the form and substance HUD prescribes. The third requirement is where the standard actually bites. HUD's supplementary guidance layers HUD-specific definitions onto standard GAAP, and those additions carry equal legal force. A practitioner who knows GAAP cold but hasn't read the supplementary guidance closely is working from an incomplete picture, and the submissions reflect it.
The regulation has been amended multiple times, most recently in 2024 at 89 FR 30276 (April 23, 2024) and 89 FR 38290 (May 7, 2024). Older print copies of the CFR reflect superseded text. The only reliable source is the current eCFR, pulled fresh before each filing cycle. That sounds obvious until you are working from a PDF someone saved in 2021 and hasn't questioned since.
GAAP enforcement is not a background condition. REAC has actively enforced GAAP-based financial statements since the standard became effective for all financial statements reviewed after October 31, 2004. For public housing agencies specifically, the rule requires accrual-basis reporting in FASS under full accrual accounting standards; cash-basis accounting is prohibited. Smaller PHAs run into this deficiency more than larger ones, and the problem traces upstream, almost without exception, to a CPA engagement letter signed before anyone read the regulation.
REAC itself is not an audit body. It is the centralized receiving and assessment infrastructure. Enforcement runs through separate HUD channels, and knowing who actually holds enforcement authority matters when a deficiency notice arrives and someone needs to know who can act on it.
Which entities are required to file
The regulatory text at 24 CFR 5.801 defines the covered universe deliberately and broadly. Public housing agencies are covered regardless of program type, portfolio size, or total funding. Whether a PHA operates only public housing units, only Section 8 programs, or some combination, the obligation exists. Portfolio size changes nothing.
Owners and managers of multifamily properties with HUD-insured or HUD-assisted mortgages are similarly covered. The operative trigger is participation in HUD-funded affordable housing programs, whether through a regulatory agreement, a Housing Assistance Payment contract, a use agreement, a charter, or a project-based rental assistance agreement. Beyond those primary categories, the regulation also captures HUD-approved Title I and Title II supervised, nonsupervised, and investing lenders and investing mortgagees; operators of projects with mortgages insured or held by HUD under Section 232 (nursing homes, intermediate care facilities, and board and care homes); Ginnie Mae issuers carrying any remaining principal balance at the end of an audit period; and FHA-approved lenders that originated or serviced loans during the audit period.
Over 26,000 Multifamily Housing and Office of Residential Care Facilities participants are required to submit annually. The compliance infrastructure was built at scale because the covered universe is large, and it functions accordingly.
If your entity has any contractual relationship with HUD, treat yourself as a covered entity until you have confirmed otherwise by reading 24 CFR 5.801 directly. Coverage conclusions inherited from prior counsel or prior ownership have a way of being wrong at the worst possible moment.
The two submission systems: FASS-PHA for public housing and FASSUB for multifamily
Platform selection is not discretionary. Entity type determines the system.
Public housing agencies submit through FASS-PHA, the Financial Management Assessment System for Public Housing Agencies. Multifamily entities submit through FASSUB, the Financial Assessment Subsystem, governed by the FASSUB Industry User Guide, version 7.4.0.0, with selected documents revised as of January 18, 2024. Both systems are web-based and accessed through HUD's secure systems portal.
FASSUB's verification mechanism is worth understanding before you are sitting in front of the system under a deadline. Before a draft submission template can be created, FASSUB cross-checks critical data fields against HUD's Integrated Real Estate Management System database: the reporting period, the mortgagor type, and the tax identification number. If any of those fields contain inaccurate data, the system will not permit the submission to proceed. Correcting inaccurate data that slips through requires the filing to be archived and resubmitted correctly.
An entity that submits with the wrong reporting period data has not filed a compliant submission, regardless of how clean the underlying financial statements are. A system-accepted upload is not the same thing as a validated filing, and conflating the two creates problems that surface months later, when the filing window is long closed and everyone has moved on.
What a complete submission must contain
The core components required across both submission types include audited financial statements when the audit threshold has been met, supplemental schedules, surplus cash computations, footnotes and certifications, and internal control and compliance reports. Familiar territory for experienced preparers. Two elements, however, generate deficiencies with enough frequency that they deserve more than a line on a checklist.
First, FASSUB audited submissions must include a CPA attestation comparing the electronic submission with the hard copy audit report. This is a distinct requirement, separate from uploading the audit itself. The attestation verifies consistency between what the auditor signed and what was entered into the electronic system. It gets treated as a formality. It is not.
Second, the absence of an auditor's opinion does not reduce the GAAP requirement. Owner-certified submissions still require full GAAP presentation, including a complete set of notes to the financial statements. This surprises smaller owners who qualify for owner certification: they correctly identify that they do not need an audit, then incorrectly conclude their reporting obligations are substantially lighter. The accounting standard is the same. Only the assurance layer changes.
Both points compound against the same underlying issue. Completeness of financial content and accuracy of system-facing data fields are concurrent requirements, not sequential ones. A submission that is financially complete but carries an incorrect reporting period in the system data is defective.
When the audit requirement applies and when owner certification is permitted instead
For profit-motivated multifamily projects, an audit is required under Uniform Guidance standards when annual expenditures or HUD-insured and HUD-guaranteed loan balances reach $500,000 or more. For nonprofit multifamily projects, the threshold is $1,000,000 or more in annual expenditures for fiscal years beginning on or after October 1, 2024; for fiscal years beginning before that date, the nonprofit threshold was $750,000, per analysis current through March 2026. Ginnie Mae issuers carrying any remaining principal balance at period end require an audit regardless of expenditure level. FHA-approved lenders that originated or serviced loans during the audit period are subject to the audit requirement independently of expenditure thresholds.
Owner certification is permitted under HUD Notice H 2013-23, issued August 8, 2013, for profit-motivated and limited distribution owners receiving less than $500,000 in federal financial assistance. When submitting through FASSUB, the system prompts the owner to certify threshold eligibility and cross-checks HUD databases to verify. Owner-certified submissions omit the auditor's opinion and the auditor's reports on compliance and internal controls. Full GAAP presentation, including notes, remains required.
The 2013 notice estimated this pathway applied to approximately 2,174 financial submissions and would save qualifying owners between $2,000 and $10,000 per year. Whether those figures hold under current conditions is a reasonable question; the more durable point is that the threshold determination carries real downstream consequences for both cost and submission content. It warrants a fresh check against current program-specific guidance each cycle, not reliance on what held true two filing cycles ago.
Filing deadlines by entity and program type
PHAs operate under a two-submission structure. The unaudited submission is due no later than two months after the end of the PHA's fiscal year. The audited submission, where required, is due no later than nine months after fiscal year-end. Both deadlines attach to fiscal year-end. A PHA with a non-standard fiscal year cannot borrow deadlines designed for a December calendar.
For multifamily entities, 24 CFR 5.801(c)(2) sets the general rule: financial information is due annually no later than 90 days after the end of the fiscal year of the reporting period. Program-specific deadlines refine this further. For-profit multifamily project audits and Ginnie Mae project audits run 90 days from fiscal year-end. Hospital projects are generally due 120 days after fiscal year-end. FHA project audits generally follow the 90-day rule.
The framing of the multifamily deadline as "four months from calendar year-end" circulates widely. It is accurate only for entities with a December fiscal year-end. Applied to anyone else, it is a misreading of a generalization. Every deadline should be traced back to the regulatory citation itself, not to a paraphrase in a third-party summary.
What happens to a submission after it is filed
Filing is not the end of the process. FASS-MF conducts an electronic financial assessment of each annual financial statement upon submission, and the resulting REAC score determines what happens next.
The system flags two categories of deficiencies: auditor findings, which the independent auditor identified in the audit report itself, and system check findings, which FASS-MF's automated checks generate independently. Clean submissions, where neither compliance flags nor auditor findings are present, are automatically closed and a No Condition letter is sent to the project owner's coordinator by email. Retain that letter; it is the documented confirmation that the submission cycle is closed.
Defective submissions follow a different path. If issues are identified, whether incomplete notes, material errors, or misstatements, the submission is archived and the entity has 41 days to correct and resubmit. Forty-one days sounds like adequate runway until you factor in re-engaging the CPA, correcting the underlying work, and moving the resubmission through the platform. The time compresses.
HUD's Quality Assurance Operations Division conducts quality control reviews of independent public accounting firms through its Quality Assurance of IPA Firms program, treating IPA audits as HUD's first line of defense in assessing the financial condition of PHAs, tribally designated housing entities, and multifamily ownership entities. Reviews are required at least once every six years, or at an interval determined by OMB, and results must be made public.
One allocation of responsibility the UFRS rule states explicitly: the PHA, not its fee accountant or auditor, is responsible for timely and accurate submission. The auditor assists with formatting and certifies the comparison of the hard copy and electronic submission. The obligation sits with the entity.
Late filing consequences, the grace period, and how extensions work
The grace period has a specific sequence, and misreading that sequence creates enforcement exposure that didn't need to exist.
Submissions filed within the first 10 days after the deadline, absent a repeat-offender history, incur no negative consequences. On the 11th day, an automated email goes to the owner's Secure System coordinator notifying them the submission is overdue and that a noncompliance flag has been entered into HUD's Active Partners Performance System (APPS). The flag is removed once the submission is filed. The same email advises that if the submission is not received within the next 30 days, HUD will refer the matter to the Departmental Enforcement Center, and civil money penalties may follow.
The sequence is precise: a 10-day window, then notification and flagging on day 11, then 30 days before DEC referral. Treating the deadline as the start of the grace period rather than the end of the compliance window is a misreading, and it carries real consequences.
Extension requests must be filed electronically through the REAC website. Extensions are granted rarely. The Departmental Enforcement Center has no authority to grant them; that authority belongs to REAC exclusively. Knowing this before contacting the wrong office saves time and credibility.
Civil money penalties, commonly referred to as CMPs, operate under 24 CFR Part 30 and are adjusted annually for inflation. The 2025 amounts were updated effective July 14, 2025, per the Federal Register of June 12, 2025. Two constraints govern penalties that sometimes surface too late in the process: project funds cannot be used to pay them, and paying a penalty does not extinguish the filing obligation. The submission is still required after the penalty is assessed.
Filing obligations when ownership of a property changes
A property sale does not pause or transfer the filing obligation. It bifurcates it.
The seller is responsible for an annual financial statement covering the period from the beginning of the seller's fiscal year through the day before the deed was signed. That date is the operative trigger; it defines the boundary of the seller's reporting period and should be documented precisely. The buyer's obligation begins from the date of the deed forward, running through the end of the new owner's fiscal year.
Both filings are subject to standard submission requirements: GAAP presentation, the applicable audit threshold analysis, the correct platform, and all applicable certification requirements. A change of ownership creates two separate obligations in place of one. It does not create an exemption from any underlying standard.
Here is where I have seen transactions go sideways. A seller leaves closing with a filing obligation covering a partial year, no ongoing access to the property's financial records, and no contractual right to the buyer's cooperation. By the time the annual financial statement is due, the records needed to prepare it are sitting in a system the seller can no longer log into. The fix is straightforward: address records access and cooperation obligations in the purchase agreement, before closing, when the buyer still needs something from you. The alternative is discovering the gap during audit preparation, which is a remarkably unpleasant way to learn a lesson that was entirely avoidable.
