FNMA and FHLMC Annual Audit Requirements for Seller-Servicers
Mortgage servicers must coordinate multiple audit tracks simultaneously to maintain GSE eligibility.
Mortgage banking audit and compliance services for independent mortgage bankers must cover all three as well as the year-end opinion. To keep GSE eligibility, planning must bring these tracks together and include any extra assurance work that servicing contracts, vendors, or HUD programs require.
Why GSE eligibility depends on more than a single annual audit
Loss of GSE approval is the central risk. Fannie Mae’s Selling Guide allows failure to provide required financial information on time to be treated as a breach of the Lender Contract, with sanctions, suspension, or termination of seller-servicer status among the possible consequences. A missed submission is therefore more than an administrative lapse.
Freddie Mac’s Single-Family Seller/Servicer Guide establishes a parallel framework, including an Annual Certification Report affirming access to and compliance with the Guide. Freddie Mac also retains the right to audit a seller-servicer at any time and select the mortgages it reviews. Both GSEs feed the reports they receive into surveillance systems that keep track of financial condition at all times. What does that mean for the compliance calendar? Currency in one track cannot compensate for a gap in another.
What the audited financial statement submission requires and when it is due
The annual audited financial statement, or AFS, is due within 90 days after fiscal year-end. It must be prepared under GAAP and accompanied by an independent public accountant’s opinion. Fannie Mae Selling Guide A4-1-02 specifies the required components, which are the balance sheet, income statement, statement of retained earnings, statement of additional paid-in capital, and statement of changes in financial position. The filing must also include prior-year data for comparison and all related notes.
When the seller-servicer’s statements are consolidated with a parent or holding company, the filing must provide enough detail for Fannie Mae to isolate and review the seller-servicer’s data separately. HUD-approved mortgagees that are not supervised depositories may send Fannie Mae their HUD annual audit in place of separate financial statements. That exception offers a planning efficiency for eligible lenders, but it is not a general exemption for every consolidated group or every seller-servicer with HUD exposure.
Net worth, liquidity, and capital thresholds that must hold every day of the year
Seller-servicers must maintain qualifying adjusted net worth, liquidity, and capital ratios at all times, with requirements tied to the size and composition of the servicing portfolio. The annual audit captures only a snapshot. A satisfactory year-end position does not establish that the same institution will meet its obligations throughout the following year.
The minimum Adjusted Net Worth structure begins with a $2.5 million base for depository and non-depository seller-servicers. Add-ons scale with Residential First Lien Mortgage Servicing unpaid principal balance, or UPB, with separate calculations for Fannie Mae/Freddie Mac servicing and Ginnie Mae servicing. The Ginnie Mae rate is higher. Non-depositories also face a minimum Adjusted Net Worth to total assets ratio, making leverage a compliance variable as well as a business decision.
Portfolio growth, a servicing acquisition, or a capital distribution can change the relationship between available capital and required thresholds after the audit is complete. Could an institution pass its year-end audit and subsequently fall out of compliance? Yes, because the standing financial tests do not pause until the next filing provides visibility into the change.
Quarterly and monthly reporting obligations that sit on top of the annual filing
Mortgage banker seller-servicers must submit the Mortgage Bankers’ Financial Reporting Form, or MBFRF, quarterly to Fannie Mae, Freddie Mac, and Ginnie Mae. That cycle runs independently of the annual AFS.
Beginning in May 2024, Fannie Mae requires large non-depository seller-servicers to submit a subset of MBFRF fields monthly. The size trigger is defined by combined residential first lien mortgage servicing UPB plus other servicing UPB. This adds a further reporting layer for institutions within that category. They must manage monthly data submissions, quarterly MBFRF filings, and the annual AFS concurrently. Freddie Mac’s Annual Certification Report follows its own calendar, so dual-approved seller-servicers also have to accommodate deadlines across both GSE frameworks.
Internal audit governance requirements and why structural independence is non-negotiable
An external accountant’s opinion does not satisfy the internal audit governance track. The seller-servicer must maintain an internal audit function that is structurally independent of every key function it reviews, with reporting lines directly to senior management and/or the board of directors. Independence is a condition of the organizational structure. Reporting through the management of a business unit under review would violate that requirement, even if the audit work itself appeared rigorous.
The scope also extends beyond financial controls. Internal audit and management control procedures must evaluate and monitor the overall quality of loan production and servicing, with the audit process independent of the key functions in both. This makes operational quality part of the eligibility framework. For smaller seller-servicers, the practical question is whether co-sourcing or outsourcing can provide the required function. The GSE guides allow both, with the same rules for independence and reporting lines.
How the USAP attestation engagement fits into a servicer's annual compliance package
The MBA’s Uniform Single Attestation Program for Mortgage Bankers, or USAP, adds an annual servicing attestation outside the three GSE-imposed tracks. An independent CPA performs the engagement under attestation standards and reports on compliance with minimum servicing standards. Investors, warehouse and counterparty lenders, and state servicing regulators impose these obligations. For many active servicers, however, the contractual requirement is effectively unavoidable.
The scope follows the handling of servicing funds. It covers custodial accounts maintained at a federally insured depository institution in trust for the applicable investor, proper segregation of custodial funds, and monthly reconciliation of custodial and escrow bank accounts to servicing records. Those reconciliations are typically required within 45 days after the cutoff date. Accurate and timely payment posting, timely investor remittance, and documentation supporting the servicer’s compliance assertions complete the core scope.
Because the authority varies, the lesson for planning is to inventory counterparty agreements to identify applicable obligations and report recipients. The controlling requirement may come from an investor agreement, an agency guide, or an applicable state statute. Timing then needs to follow those obligations. In practice, the USAP report is bundled with the AFS for investors and counterparties, making coordination with the 90-day AFS deadline through a single engagement team important.
What SOC 1 reports provide that internal governance requirements alone cannot
Outsourcing changes where controls operate. When a service organization does work that affects the seller-servicer’s Internal Control over Financial Reporting, the external auditor needs assurance over that organization’s controls. A SOC 1 report under SSAE 18, AT-C Section 320, provides that mechanism.
For mortgage servicing, the expected control objectives cover accuracy in loan boarding and setup, the processing and application of payments, and the administration of escrow. Escrow coverage includes analysis compliant with federal real estate settlement requirements and timely tax and insurance disbursements. Investor reporting and remittance, together with default and loss-mitigation accounting, are also within the expected scope.
GSEs and institutional investors require and expect SOC 1 Type II coverage of operating effectiveness over a period of months, with Type I providing a point-in-time snapshot. A seller-servicer outsourcing loan servicing, escrow processing, or investor reporting must therefore obtain and review the vendor’s Type II report. The vendor’s own representations do not supply equivalent assurance.
Where SOC 2 fits and why it is no longer sufficient on its own for vendors in the GSE ecosystem
SOC 2 addresses operational and security controls rather than the controls over financial reporting addressed by SOC 1. Its coverage includes security, availability, processing integrity, confidentiality, and privacy. SOC 2 Type II has become a de facto market requirement for technology, data-service, outsourcing, and IT providers serving GSE-approved entities.
SOC 2 was not designed to show whether model cards are complete or to establish training-data provenance or fair-lending testing methodology and results by protected class. Those are questions a GSE may ask a seller-servicer using AI in underwriting or servicing. Can assurance over security controls also establish whether an AI-assisted decision has been tested for fair-lending risk? Not on its own, because those questions call for different evidence.
Fannie Mae’s Selling Guide Announcement SEL-2025-01 introduced new and updated cybersecurity requirements on Feb. 5, 2025, covering information security, incident management, and business resiliency. Vendor oversight is moving toward closer checks, including AI-specific reviews that go beyond what SOC 2 has traditionally covered. This limits what a seller-servicer can reasonably treat the SOC 2 report as answering.
How AIUC-1 is developing as the assurance standard for AI used in mortgage workflows
AIUC-1 is an emerging reference standard for AI agent safety, security, and reliability, developed with a consortium of enterprise security leaders. It operationalizes frameworks including ISO 42001, the NIST AI RMF, the EU AI Act, MITRE ATLAS, and the OWASP Top 10 for LLM Applications. Its six principles are security, safety, reliability, accountability, data and privacy, and societal impact.
The assurance design combines a SOC 2 report for foundational data protection and controls with AIUC-1 certification covering AI agent risk. Under that design, both must be renewed each year, and AIUC-1 also requires technical retesting each quarter. For mortgage workflows, the connection is direct. Training-data provenance, model fairness testing, and decision accountability are relevant to GSE fair-lending and counterparty oversight of AI used in underwriting, pricing, or default management.
That relevance does not establish a current GSE mandate. AIUC-1 is directionally important, but an emerging assurance standard and an enforceable eligibility requirement are different things. To be ready as procurement standards change and expectations become terms in contracts, a seller-servicer needs evidence from its vendors that can answer AI-specific inquiries. Treating SOC 2 as complete AI assurance leaves those inquiries unresolved.
Special considerations for seller-servicers active in HUD Section 232 and multifamily housing
HUD Section 232 and multifamily exposure introduces a sector-specific layer. Borrowers must submit annual audited financial statements within 90 days of fiscal year close under 24 CFR 5.801 and 200.36 guidelines. Property operators must send in quarterly financial statements within 60 calendar days of quarter-end. Operator certification statements may rely on operator certification without an audit. If the operator is also the borrower, however, that option does not eliminate the borrower’s annual audited financial statement obligation.
Under the HUD Consolidated Audit Guide, the entity must have both a financial statement audit and a compliance audit of its major HUD programs. The financial statement audit follows GAAS and GAGAS, and the compliance audit follows the handbook’s rules, which add to those standards. HUD’s July 23, 2026 memorandum reinforces this existing framework and reminds owners and agents to confirm that auditors follow it and specifically address fraud risks. It does not create a new requirement.
This is where the earlier substitution exception becomes useful. HUD-approved mortgagees that are not supervised depositories may use their HUD annual audit for the Fannie Mae AFS filing. Coordinating an engagement around both frameworks can therefore reduce separate filing work, but the borrower and operator obligations still require their own attention.
How the three tracks interact and what breaks down when one is managed in isolation
Internal audit evaluates processes that the USAP engagement also tests and whose financial effects appear in the AFS. Managing these as isolated workstreams invites inconsistencies between what each engagement surfaces. Completion alone is not a sufficient test.
Timing makes those inconsistencies harder to resolve. An AFS delivered at the edge of its deadline leaves little room to reconcile the USAP attestation, quarterly MBFRF, and Annual Certification before counterparties review submissions. Fannie Mae’s surveillance also cross-references reports, so a materially different financial picture in the quarterly MBFRF can generate a flag even when both it and the prior AFS are individually accurate.
For buyers selecting a CPA firm, the relevant criterion is mortgage banking experience that spans these obligations and can coordinate them, including HUD work where applicable. That is more useful than evaluating the year-end opinion in isolation. An experienced mortgage banking auditor can help align the engagements and reporting calendars, but the governing principle remains organizational. The compliance map works only when the seller-servicer treats it as a single annual program with coordinated planning.
