Joint Trades Letter to FHA Expressing Appreciation for Modifying Cyber Incident Reporting Requirement from 12 hours to 36 hours

On September 30, the Federal Housing Administration (FHA) posted a draft Mortgagee Letter (ML), Revised Cyber Incident Reporting Requirements, on its Single Family Housing Drafting Table (Drafting Table) for review and feedback. This draft ML provides updated requirements for when FHA-approved mortgagees must notify the Department of Housing and Urban Development (HUD) when a reportable cyber incident occurs. This draft ML provides a clearer definition of what constitutes a cyber incident and requires FHA-approved mortgagees to notify HUD as soon as possible — but no later than 36 hours — after determining that a reportable cyber incident has occurred. These updated reporting requirements harmonize FHA with existing standards established by the federal banking agencies. When finalized and the revised ML is published, the updated guidance will supersede the previous guidance in ML 2024-10, dated May 23, 2024. Interested stakeholders are encouraged to review the draft ML and provide feedback through October 30, 2024.

The ABA joined BPI/BITS and Housing Policy Council in requesting that the Federal Housing Administration's (FHA) rescind its Mortgagee Letter 2024-10 which established a 12 hour incident notification requirement. Leaders from the joint trades also met with officials from FHA and US Housing and Urban Development (HUD) and submitted recommended changes to the policy along with our rationale. Furthermore, the ABA, BPI/BITS and HPC send another comment letter to Ginnie Mae in response to its incident notification requirements. Separately, several congressional leaders of House Financial Services Committee sent a letter to HUD officials in early September raising concerns about these cyber incident notification requirements given that they are not harmonized with other incident notification requirements and requesting that the requirements be rescinded. 

The American Bankers Association, Bank Policy Institute, and the Housing Policy Council greatly appreciate the Federal Housing Administration’s (FHA) revised draft mortgagee letter establishing cyber incident reporting requirements for FHA approved mortgagees.

Download to read the full joint letter.