Fannie Mae and Freddie Mac Seller-Servicer Audit Requirements for Independent Mortgage Bankers
Mortgage banking audit and compliance services for independent mortgage bankers must cover financial reporting, capital adequacy, internal controls, and AI/ML governance, with a separate HUD track where applicable. To keep Fannie Mae and Freddie Mac seller-servicer eligibility, firms must meet these obligations throughout the year as well as obtain an annual audit opinion. This article maps the requirements, their deadlines, and the evidence needed to support them.
What seller-servicer eligibility actually requires of IMBs
Seller-servicer eligibility is a revocable status. Fannie Mae's Selling Guide, section A4-1-01, requires financial adequacy, internal controls, and timely reporting as conditions of the relationship. Failure to provide required information can constitute a breach of the Lender Contract. The obligation therefore extends beyond the quality of loans sold or serviced to the firm's ability to demonstrate compliance.
Freddie Mac's Multifamily Seller/Servicer Guide, current as of 10/20/2026, reserves the right to audit a seller/servicer at any time to verify compliance with the Purchase and Servicing Documents. That right gives ongoing surveillance contractual force. A breach can lead to sanctions or to the suspension or termination of selling and servicing agreements. The central distinction is between approval to enter the relationship and the evidence required to remain in it.
The annual audited financial statement: what must be in it and when it is due
The annual audited financial statement, or AFS, establishes the financial-reporting baseline. The Selling Guide requires financial statements that follow GAAP, compare with the prior year, and come with an independent CPA's opinion. Required components include the balance sheet, income statement, statement of retained earnings, statement of additional paid-in capital, statement of changes in financial position, and all related notes. The requirement applies regardless of loan volume or firm size.
The Selling Guide, section A4-1-02, requires submission within 90 days after the seller/servicer's fiscal year ends. A late or missing submission can be a potential breach on its own, even if the statements show no weakness. Independence is a separate requirement of the engagement. Internal accounting staff or a related-party firm cannot do the audit that provides the required independent opinion. A complete filing therefore depends on its contents, its preparation and examination, and its delivery date.
Capital and net worth minimums that the financial statements must demonstrate
The audited statements provide evidence for the financial-adequacy test, but a clean opinion does not establish that the seller/servicer meets every required threshold. FHFA establishes minimum net worth, minimum capital ratio, and minimum liquidity requirements for Fannie Mae and Freddie Mac seller/servicers.
To find the minimum net worth, the formula adds 25 basis points of total GSE residential first-lien mortgage servicing unpaid principal balance to a base amount stated in thousands. As the servicing book grows, the required minimum net worth grows with it, making year-round financial monitoring necessary. The Selling Guide identifies sanctions, suspension, or termination of selling and servicing agreements among the responses available to secondary market investors and/or state regulators when requirements are not met.
Internal audit and management control requirements under the Selling Guide
The Selling Guide, section A4-1, requires internal audit and management control procedures that check and track the quality of loan production and servicing as a whole. These procedures must be independent of all key functions they review.
As a structural requirement, the audit function must report directly to senior management and/or the board of directors. If the firm's size makes full separation impossible, it can get an exception, but the audit plan must explain why and describe the compensating controls. The organization therefore needs an ongoing, appropriately independent review function.
How Freddie Mac's Bulletin 2025-16 and Fannie Mae's LL-2026-04 extend audit scope into AI and machine learning
Freddie Mac's Guide Bulletin 2025-16, issued December 3, 2025, amended the Single-Family Seller/Servicer Guide to establish AI/ML governance requirements in Section 1302.8, effective March 3, 2026. Fannie Mae's Lender Letter LL-2026-04, issued April 2026, set out its framework, which takes effect August 6, 2026, with both frameworks establishing eligibility conditions. Both require firms to write down and keep up their governance for AI/ML used in origination or servicing, whether they build it themselves or get it from a vendor. Neither confines its reach to underwriting.
The letter takes a principles-based approach, requiring written policies covering development, implementation, use, and maintenance, a method for measuring and managing associated risks, and review at least annually. Freddie Mac's framework is more operationally prescriptive. It requires specific controls, regular internal and external audits to identify vulnerabilities or policy deviations, and audits addressing compliance with NIST 800-53 and ISO 27001. It also expressly imposes an AI-related indemnification obligation that the letter does not explicitly impose.
For firms working with both GSEs, the practical rule is to build to Freddie Mac's stricter standard, which will generally satisfy Fannie Mae's requirements as well. On request, firms must promptly provide the types of AI/ML used, their purpose and manner of use, safeguards, and other required information. This extends the existing breach and sanctions framework into technology governance without creating an annual AI filing as its substitute.
What the AI governance program must contain to withstand a GSE request
Written AI/ML governance policy defines what counts as AI/ML, assigns ownership, states risk tolerance, and describes development, deployment, monitoring, and retirement. It also records the date and outcome of the annual review. A complete inventory catalogs each internal and vendor-supplied use case, its business purpose, production version, deployment date, and upstream and downstream dependencies. Evidence must match the system actually in use. These components must therefore be documented, anchored to the relevant version, and testable.
Under Fannie Mae's guidance, governance for vendors and subcontractors must provide at least as much protection as the firm uses internally. Freddie Mac reaches the same result through Section 1302.8 and its third-party risk controls in Section 1302.2. Ongoing monitoring addresses bias and performance degradation. FHFA Advisory Bulletin 2022-02, revised May 2025, addresses data drift and performance degradation as concerns, although it does not use the specific term “model drift.” An internal and external audit cadence addresses Freddie Mac's regular audit obligations, including assessment against NIST 800-53 and ISO 27001.
Freddie Mac requires policy approval at the level of CIO, CTO, CISO, or CRO at minimum, while Fannie Mae expects senior leadership oversight within enterprise risk management. Disclosure readiness organizes the evidence for production on short notice. The letter's provision for “such other information as Fannie Mae may require” means readiness cannot be limited to a fixed presentation prepared once a year.
Why SOC 2 alone no longer satisfies vendor AI diligence under the new GSE frameworks
A vendor's SOC 2 Type II report remains necessary, but it does not complete AI diligence. The AICPA Trust Services Criteria address security, availability, processing integrity, confidentiality, and privacy. They do not address model card completeness or training-data provenance. Nor do they address fair-lending testing methodology and results by protected class, whether outputs support an adverse action notice compliant with fair-lending law, or notification protocols when a vendor retrains a model. These are concrete gaps in evidence a GSE may request.
AICPA TQA Section 9561, released September 11, 2026, confirms that AI does not create a separate SOC examination model or new criteria. Whether AI belongs in a SOC 1 or SOC 2 report depends on its use and its effect on services, systems, risks, and controls already in scope. The examiner must still use judgment to decide what is in scope. AI that decides who gets access, processes data, or produces outputs that others rely on can affect risks in the trust services categories that apply. The practical response for IMBs is to conduct or commission AI-specific vendor audits covering governance, model lifecycle, fair-lending review, vendor change control, and audit access.
Emerging AI assurance standards that close the gap: ISO 42001, MISMO, and AIUC-1
ISO/IEC 42001 provides an international AI management system standard and is emerging as a procurement discriminator in financial services. Mortgage-specific implementation guidance is still developing. MISMO has launched an AI Governance Certification for mortgage technology providers, assessing each use case by consumer impact, compliance exposure, influence over decisions, and operational risk. These approaches add AI-specific assurance to SOC 2 or ISO 27001.
The AICPA and the Artificial Intelligence Underwriting Company announced a joint assurance offering on October 19, 2026, combining a SOC 2 report and AIUC-1 certification in one CPA-led engagement. The offering is in pilot, with a full launch expected in early 2027 and multiple CPA firms already delivering the joint certification. AIUC-1 was developed with Orrick, Stanford, MITRE, and the Cloud Security Alliance. Its technical tests cover data protection, operational boundaries, attack resistance, and error prevention.
AIUC-1 controls map to MITRE ATLAS, ISO 42001, the EU AI Act, the NIST AI Risk Management Framework, and the OWASP Top 10 for LLM Applications, with published crosswalks to all five. The cadence differs from annual assurance alone. Both SOC 2 and AIUC-1 require annual renewal, while AIUC-1 adds quarterly technical retesting.
HUD Section 232 and the parallel audit universe for IMBs with healthcare or multifamily portfolios
HUD Section 232 introduces a separate compliance track for IMBs with applicable healthcare portfolios. Its property criteria differ from general multifamily eligibility criteria. Properties that qualify include licensed nursing homes, assisted living facilities, intermediate care facilities, and board and care facilities. They must offer continuous care, be state-licensed, and accommodate 20 or more patients requiring continuous or skilled nursing care. For acquisition or rehabilitation financing, they must have been completed or substantially rehabilitated at least three years before the Firm Commitment application.
Establishing audit deliverables and reporting deadlines for properties within the program's reach requires a distinct HUD compliance assessment. A GSE financial-statement deadline cannot be assumed to establish when HUD reporting is due, and a GSE examination does not by itself demonstrate knowledge of the HUD regulatory environment. For IMBs with these portfolios, specialized audit capability includes understanding the applicable HUD audit and financial-reporting obligations as well as both GSE frameworks.
Building the audit calendar: sequencing every deadline across the full compliance map
The working calendar starts with the AFS submission due within 90 days of fiscal year end and coordinates quarterly net worth certifications with financial monitoring. Fannie Mae's AI/ML policy must be reviewed at least once a year. Freddie Mac's regular internal and external AI/ML audits require a planned cadence, but “regular” is not a specified annual deadline. Where the joint certification is adopted, annual SOC 2 and AIUC-1 renewal must be coordinated with quarterly technical retesting.
The implementation dates establish when the AI obligations begin. Freddie Mac's framework became effective March 3, 2026, and Fannie Mae's became effective August 6, 2026. Ongoing monitoring and prompt disclosure readiness operate between scheduled reviews. Applicable HUD reporting adds its own track, whose deadlines must be established separately.
For an IMB selecting a CPA firm, the relevant criteria are experience with GSE seller-servicer examinations, SOC engagements, AI governance assurance, and HUD Section 232 where applicable. A specialized audit partner can help coordinate these overlapping cycles, while the firm maintains the evidence and controls throughout the year. The compliance map becomes useful only when translated into a calendar that is maintained continuously.
