Responsibilities of Boards of Directors, Corporate Practices and Corporate Governance Matters

AGENCY:

Federal Housing Finance Board; Federal Housing Finance Agency; Office of Federal Housing Enterprise Oversight.

ACTION:

Final rule.

SUMMARY:

The Federal Housing Finance Agency (FHFA) is amending its regulations by relocating and consolidating certain regulations of its predecessor agencies—the Federal Housing Finance Board (Finance Board) and Office of Federal Housing Enterprise Oversight (OFHEO)—that pertain to the responsibilities of boards of directors, corporate practices, and corporate governance matters. The OFHEO regulations addressed corporate governance matters at the Federal National Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac) (collectively, the Enterprises), while the Finance Board regulations addressed the powers and responsibilities of the boards of directors and management of the Federal Home Loan Banks (Banks). The final rule consolidates most of those regulations into a new FHFA regulation, parts of which will apply to both the Banks and the Enterprises (together, regulated entities), and parts of which will apply only to the Banks or only to the Enterprises. Most of the content of the new regulations has been derived from the regulations of the predecessor agencies, with such modifications as are necessary to apply the regulations to all of the regulated entities, to respond to issues raised by the commenters, or to clarify the regulatory text. The final rule also amends the Prudential Management and Operations Standards (Prudential Standards) provisions by designating certain introductory language—which pertains to the general responsibilities of senior management and boards of directors—as a separate Prudential Standard. The final rule also repeals a provision of the OFHEO regulations that related to minimum safety and soundness requirements for the Enterprises.

DATES:

The final rule is effective on December 21, 2015.

FOR FURTHER INFORMATION CONTACT:

Amy Bogdon, Associate Director, Division of Federal Home Loan Bank Regulation, at Amy.Bogdon@fhfa.gov or (202) 649-3320, or Neil R. Crowley, Deputy General Counsel, Office of General Counsel, at Neil.Crowley@fhfa.gov or (202) 649-3055 (not toll-free numbers), Federal Housing Finance Agency, Constitution Center, 400 7th Street SW., Washington, DC 20024. The telephone number for the Telecommunications Device for the Hearing Impaired is (800) 877-8339.

SUPPLEMENTARY INFORMATION:

I. Background

A. Proposed Rule

On January 28, 2014, FHFA published a proposed rule that would relocate, revise, and consolidate into a new FHFA regulation certain of the rules of the predecessor agencies that dealt with corporate practices and governance at the Banks and the Enterprises. The proposed rule was one phase of FHFA's ongoing project to repeal or relocate remaining OFHEO and Finance Board regulations. Both predecessor agencies had regulations addressing director responsibilities, corporate practices, and corporate governance matters. Pursuant to the Housing and Economic Recovery Act of 2008 (HERA), Public Law 110-289, 122 Stat. 2654, those regulations remain in effect until they are superseded by regulations issued by FHFA. See id. at sections 1302, 1312, 122 Stat. 2795, 2798. The intent of the proposed rule was to consolidate certain of those regulations into a new set of FHFA regulations that would address those same matters, and to repeal any predecessor regulations that were not adopted as FHFA regulations. The proposed rule was not intended to address conservatorship matters, but rather to address matters of corporate practice and governance that currently are addressed by OFHEO regulations, to which the Enterprises remain subject. The applicable regulations of the predecessor agencies addressed by this rulemaking currently are located at parts 914, 917, 1710, and 1720 of title 12 of the Code of Federal Regulations. All of the relocated portions of these regulations would be codified as a new part 1239 of the FHFA regulations.

The proposed rule included a number of provisions that would apply to all of the regulated entities because they addressed matters of general applicability, but also included other provisions that would apply only to the Banks or only to the Enterprises because they addressed topics that are unique to the particular type of entity. The substance of most of the provisions of the proposed rule was unchanged from that of the predecessor regulations, except for the provision on risk management, which was new. The proposed rule would also have carried over a Finance Board regulation on regulatory reporting and applied that provision to all of the regulated entities.

In conjunction with the relocation of the predecessor regulations, the proposed rule also would have revised certain provisions of FHFA's Prudential Standards. Specifically, the proposal would have redesignated the introductory section to the Prudential Standards—which recites general concepts of corporate governance and responsibilities of the board of directors and senior management—as a separate standard. Doing so would clarify FHFA's authority to enforce those provisions in the same manner as any of the other ten enumerated standards. Lastly, the proposal would have repealed a provision of the OFHEO regulations, 12 CFR part 1720, which had established certain safety and soundness standards for the Enterprises, because many of the matters addressed by those regulations are also addressed by the Prudential Standards or by the proposed rule.

B. Considerations of Differences Between the Banks and the Enterprises

When promulgating regulations or taking other actions that relate to the Banks, section 1313(f) of the Federal Housing Enterprises Financial Safety and Soundness Act of 1992 (Safety and Soundness Act) requires the Director of FHFA (Director) to consider the differences between the Banks and the Enterprises with respect to the Banks' cooperative ownership structure; mission of providing liquidity to members; affordable housing and community development mission; capital structure; and joint and several liability. 12 U.S.C. 4513(f). In preparing the proposed and final rules, the Director has considered those differences as they relate to the above factors and has determined that none of the statutory factors would be adversely affected by the final rule. None of the comment letters addressed this requirement.

II. Response to Comment Letters

In response to the proposed rule, FHFA received three substantive comment letters, one each from Fannie Mae and Freddie Mac, and a joint letter from the Banks. Each letter generally supported the proposed rule, but also recommended different ways in which FHFA should revise certain aspects of the rule. In response to these recommendations, FHFA has incorporated a number of revisions into the final rule. The following sections of this document describe the issues raised by the commenters, along with FHFA's responses, which are included as part of FHFA's descriptions of the particular provisions of the final rule for which the commenters had suggested revisions. For other provisions of the proposed rule about which the commenters raised no issues, FHFA has adopted them without change.

III. Final Rule

A. Overview

The organizational structure of the final rule is the same as that of the proposed rule, meaning that it includes one subpart for definitions and four subparts for the substantive provisions. Subpart A defines terms used within the final rule. Subpart B includes provisions relating to certain core corporate governance principles and applies to both the Banks and the Enterprises. Subpart C addresses codes of conduct for the entities, risk management, compliance programs, and regulatory reports, and also applies to all regulated entities. Subparts D and E include regulations from the predecessor agencies that address matters specific to the Banks (such as those relating to a Bank's member products policy) or to the Enterprises (such as those relating to the Enterprise boards), respectively. None of these provisions is intended to address conservatorship matters at the Enterprises. Instead, they are intended to address matters of corporate practice and governance for regulated entities that are not in conservatorship by replacing the existing OFHEO regulations on those same topics. The following paragraphs describe the manner in which each of the subparts of the final rule differs from those of the proposed rule and, as applicable, describes the material issues raised by the commenters and FHFA's responses to them.

B. Subpart A—General

Definitions (1239.2)

The proposed rule included seventeen defined terms, most of which were derived from the predecessor agencies' regulations and were to be incorporated into the FHFA's regulations without change. The final rule revises one of the proposed definitions, deletes two proposed definitions, and adds one new definition.

The proposed rule would have defined “executive officer” to include the chairperson and vice-chairperson of an Enterprise, along with a number of other specified senior executive positions at any Bank or Enterprise. Both Enterprises commented that defining “executive officer” to include the chairperson and vice-chairperson created a conflict with another provision of the proposed rule, 12 CFR 1239.20(a)(3), which requires the chairperson of an Enterprise to be a person other than the chief executive officer, who also must be independent, as defined by the rules of the New York Stock Exchange (NYSE). The applicable NYSE rule provides that a company's chairperson is not “independent” if the person is, or has been within the past three years, an executive officer of the company. In order to resolve this conflict, FHFA agrees with the commenters and has amended the definition of “executive officer” to delete the references to an Enterprise's chairperson and vice-chairperson.

The proposed rule had used the term “risk profile” in several places within the risk management section of the rule, but did not define that term. In considering how to define that term for the final rule, FHFA determined that a similar term—“risk appetite”—as defined by the Office of the Comptroller of the Currency in its guidelines establishing heightened standards for national banks, better described the concept that FHFA had intended with its use of the term “risk profile” in the proposed rule. Accordingly, the final rule replaces the references to “risk profile” with the new term “risk appetite” and defines that term to mean the aggregate level and types of risk the board of directors and management are willing to assume to achieve the regulated entity's strategic objectives and business plan, consistent with applicable capital, liquidity, and other regulatory requirements.

The final rule deletes the defined term “authorizing statutes” because FHFA has recently defined that term within its general definitions section, at 12 CFR 1201, which definitions apply to all of FHFA's regulations. FHFA has also deleted the definition of the Sarbanes-Oxley Act from the final rule, because that term is only used once within the regulatory text, which now refers to that act by its name, rather than the acronym.

The proposed rule defined credit risk as “the potential that a borrower or counterparty will fail to meet its financial obligations in accordance with agreed terms.” Credit risk is one of the several specified risks that the rule requires a regulated entity's risk management program to address. Freddie Mac contended that the proposed definition was both too broad and too narrow and also suggested that FHFA replace “financial obligations” with “contractual obligations.” Freddie Mac also suggested that FHFA define “credit risk” in terms of an actual failure of a counterparty to perform, i.e., as the risk that the counterparty will fail to perform. FHFA declines to accept either of those suggestions, and notes that its definition is consistent with those of other banking regulators, which also focus on the potential that a borrower or counterparty will fail to meet its obligations. FHFA also believes that using the term “contractual obligations” in the definition would make it overly broad, in that such language would include other types of contractual obligations that may not have any relevance to credit risk.

C. Subpart B—Corporate Practices and Procedures Applicable to All Regulated Entities

Subpart B of the proposed rule included three provisions that addressed certain core principles of corporate practices or governance that were to apply to both the Enterprises and the Banks. Those provisions addressed choice of law for governance and indemnification matters, duties of directors, and committees of the boards of directors. Nearly all of the content of those provisions was derived from the Finance Board or OFHEO regulations.

Choice of Law and Indemnification (1239.3)

Choice of Law

Proposed § 1239.3(a) and (b) generally would have required that a regulated entity's corporate governance and indemnification practices comply with any applicable federal law, but also would have required each regulated entity to designate in its bylaws a body of law to follow with respect to those practices. The proposed rule would have allowed a regulated entity to follow: (1) The law of the jurisdiction in which the entity maintains its principal office; (2) the Delaware General Corporation Law; or (3) the Revised Model Business Corporation Act. This choice of law provision would be new only for the Banks because the OFHEO regulations had previously imposed this requirement on the Enterprises.

The Banks expressed concern that by choosing a particular body of state law to follow they could subject themselves to the jurisdiction of those states' courts and would allow their members to assert all of the rights available to stockholders of corporations organized under those state laws. Although FHFA does not believe that its regulations would cause either of those possibilities to occur, it agrees that for the sake of clarity the final rule should be revised to state explicitly that the regulation does not create any rights in the members or other third parties and that it does not otherwise cause the regulated entities to become subject to the jurisdiction of state courts on matters of corporate governance and indemnification. In addition, FHFA has determined that it would be appropriate to allow the Banks an additional period of time within which to compare the relative merits of the three bodies of law from which they may choose. Accordingly, the final rule allows the Banks a period of 90 days after the effective date of the rule by which to designate in their bylaws their chosen body of law.

The Banks also suggested that the regulation should allow them to model their bylaw provisions after certain specific state law provisions, rather than on an entire body of state corporate law. FHFA has declined to make that revision for the final rule because it does not believe that the selective designation of various state corporate law provisions would result in an effective or uniform source of guidance for the entities.

Indemnification

The proposed rule would have required the regulated entities to indemnify their directors, officers, and employees under terms and conditions to be determined by the entities' boards of directors. Section 1239.3(c)(2) further would have required that each regulated entity adopt policies and procedures for indemnifying its personnel, which had to address how the board would make decisions on indemnification requests and what standards the board would use for indemnification requests, as well as for board investigations and review by outside counsel. These provisions were modeled on FHFA's regulations governing the Office of Finance, 12 CFR 1273.7(i)(3), and the OFHEO indemnification provisions at 12 CFR 1710.20.

The Banks' comment letter questioned FHFA's authority to subject the Banks to regulations relating to indemnification, citing a provision of the Federal Home Loan Bank Act (Bank Act), 12 U.S.C. 1427(k), which they believed committed matters of indemnification exclusively to the discretion of the Bank's board of directors. FHFA believes that the language of the proposed rule is fully consistent with the authority granted to the Banks' boards of directors by section 1427(k) because the rule largely restates and elaborates on the statutory requirement that the boards of directors are to determine the terms and conditions on which the regulated entities are to provide indemnification to their personnel.

The one aspect of the proposed rule that differed from the statute pertained to the provisions requiring the entities to adopt policies describing the manner in which they would exercise their indemnification authority. In effect, those provisions would have required the entities to commit to writing the decisions that their boards of directors make with respect to the circumstances under which they intend to provide indemnification to their officers and employees and the manner in which they will make those decisions. Requiring the entities to document the policies, procedures, and standards that the board of directors will use when considering requests for indemnification does not diminish the authority of the boards of directors to set the terms and conditions on which the entity will indemnify its personnel. In such cases, the boards would still decide the terms and conditions for indemnification, and the written policies, procedures, and standards would reflect and implement those board decisions. Requiring a regulated entity to have in place procedural safeguards, such as policies, procedures, and standards for indemnification, benefits the board of directors by helping to ensure that they make their indemnification decisions on a consistent basis, which in turn increases the likelihood that the entities will make these decisions in a safe and sound manner. FHFA has explicit authority to adopt regulations to ensure that the purposes of the Bank Act are carried out. For those reasons, FHFA has retained this requirement in the final rule.

The proposed rule also included a provision carried over from the OFHEO regulations that authorized FHFA to review an entity's indemnification policies, procedures, and practices and to limit or prohibit an entity from making indemnification payments based on FHFA's safety and soundness authority. The commenters questioned whether FHFA has the legal authority to prohibit indemnification payments based solely on its safety and soundness authority, particularly in light of a 2008 statutory amendment that explicitly authorized FHFA to prohibit indemnification payments only in cases where FHFA has initiated the action against an officer or director of a regulated entity. 12 U.S.C. 4518(e). Fannie Mae also objected to certain language in the supplementary information to the proposed rule, which described this provision as allowing FHFA to prohibit indemnification payment to “any person found to have violated any law or regulation,” as going beyond the language of the regulatory text.

To address these comments, FHFA has revised § 1239.3(c)(4) of the final rule in two respects. First, the final rule no longer asserts the authority of FHFA to limit or prohibit indemnification payments based solely on safety and soundness grounds. To the extent that FHFA deems it necessary to limit or prohibit indemnification payments by a regulated entity, it will act under the authority conferred by 12 U.S.C. 4518(e), which applies only to instances in which FHFA has initiated the underlying civil or administrative action. Second, the final rule revises the regulatory language to provide that FHFA may review a regulated entity's indemnification policies, procedures, and practices to ensure that they are consistent with law and with safety and soundness, and that they are carried out in a safe and sound manner. FHFA anticipates that this type of review could focus on issues such as whether a regulated entity has been consistent in how it acts on indemnification requests from different persons, and whether it has documented that it has made its decisions in accordance with the body of state law that the entity has chosen to follow for indemnification purposes.

Lastly, the Banks asked that FHFA clarify the circumstances in which it would exercise its statutory authority under the factors enumerated in 12 U.S.C. 4518(e)(2), which authorizes FHFA to limit or prohibit indemnification payments in connection with civil or administrative actions brought by FHFA. Because the proposed rule did not include any provisions relating to section 4518(e)(2), FHFA cannot address that provision for the first time as part of this final rule. That statutory provision is the subject of a separate rulemaking.

Duties and Responsibilities of Directors (1239.4)

Proposed § 1239.4 set forth certain duties and responsibilities of directors of a regulated entity. The text of the proposed regulation consisted mostly of provisions carried over from Finance Board regulations § 917.2, § 917.10, and, to a lesser extent, OFHEO regulation § 1710.15. This section of the proposed rule generally stated that the responsibility for managing a regulated entity is vested in the board of directors. The provision also included a list of duties for the directors, which included a duty to act with the degree of care of an ordinarily prudent person, and a duty to have a working familiarity with basic finance and accounting matters. The proposed rule also included a set of director responsibilities, which included having in place policies and procedures to relating to the board's oversight of risk management, compensation, financial reporting, and regulatory reporting. Commenters raised four questions about these provisions.

The Enterprises expressed concern about the language of the proposed rule that stated that the management of a regulated entity “shall be vested in its board of directors.” The Enterprises believed this language could be read as expanding the traditional role of corporate directors and imposing on them some responsibility for becoming involved in the day-to-day operations of the entity. As a general proposition, FHFA agrees that the role of the board is one of oversight, and that it is management who is to be responsible for the day-to-day operations of the entities. The language used in the proposed rule was derived from the Bank Act and the Finance Board regulations. In order to address the concerns raised by the Enterprises about how the rule should describe the role of the board of directors, FHFA looked to Delaware corporate law for guidance. The relevant provision of the Delaware statutes provides that “the business and affairs of every corporation organized under this chapter shall be managed by or under the direction of a board of directors.” Delaware General Corporation Law, § 141(a). FHFA believes that this language accurately describes the roles of corporate directors generally, and is consistent with the language of the Bank Act, which provides that the management of the Banks is to be “vested in” the board of directors. Accordingly, FHFA has revised § 1239.4(a) of the final rule by replacing the proposed language with language stating that the management of a regulated entity is to be “by or under the direction of” its board of directors. FHFA intends this revision to make clear that the final rule should not be construed as requiring the directors of a regulated entity to become responsible for the day-to-day operational functions of the entity.

The Enterprises also expressed concern about language of § 1239.4(b)(1) of the proposed rule relating to the directors' duty of care, which provided, in part, that a director should carry out his or her duties “with such care, including reasonable inquiry, as an ordinarily prudent person in a like position would use under similar circumstances.” Freddie Mac believed that the use of the “ordinarily prudent person” standard of care for how a director must discharge his or her duties could conflict with the body of state law that the Enterprises have chosen for corporate governance purposes, which would not use an “ordinarily prudent person” standard of care. Fannie Mae believed that the proposed language went beyond the fiduciary duties imposed on board members under Delaware law. FHFA has decided not to establish a separately defined standard of care for the directors of the regulated entities, but instead to rely on § 1239.3(b)(1) of the proposed rule, which would require each entity to designate a body of state law for its corporate governance practices. As the Enterprises noted, neither Virginia law, which Freddie Mac has designated, nor Delaware law, which Fannie Mae has designated, uses a standard of care for corporate directors that is based on an “ordinarily prudent person” concept. Indeed, both of those states, as well as all other states, have adopted some version of the business judgment rule for corporate directors. The Delaware courts have construed that state's business judgment rule as establishing a standard of gross negligence as the basis on which a corporate director could be held liable for breach of his or her duty of care to the corporation. In order to ensure that the directors of the regulated entities are not held to a standard of care different from the standard likely to be applicable to directors of other financial institutions, which could affect the availability of director candidates, FHFA is amending § 1239.4(b)(1) of the final rule by deleting the reference to an “ordinarily prudent person” and replacing it with language requiring directors of a regulated entity to exercise the degree of care that is required under the Revised Model Business Corporation Act or the other body of state law that the regulated entity has chosen to follow for its corporate governance and indemnification practices. Under the revised provision, Fannie Mae and Freddie Mac could continue to look to their chosen bodies of law, Delaware and Virginia, respectively, to determine the standard of care owed by their directors to the entities. Likewise, the Banks could look to whatever body of law they choose to govern their corporate governance practices, including the standard of care for their directors.

The proposed rule would have carried over and applied to all of the regulated entities a Finance Board provision that requires directors of Banks to “administer the affairs of the regulated entity fairly and impartially.” The Enterprises contended that that provision, which is derived from the Bank Act and reflects the cooperative structure of the Banks, was not well-suited for the Enterprises because they are not cooperatives. They also contended that the proposed provision was unnecessary because general concepts of fairness are inherent in the fiduciary duties of their directors to act in the best interest of the corporation. In response to the Enterprises' concerns, FHFA has amended the final rule so that this language will apply only to the Banks.

The proposed rule also included a provision derived from the Finance Board regulations that provided that all directors have a duty to have a “working familiarity with basic finance and accounting practices,” so that they are able to ask substantive questions of management and the auditors. The provision would allow a director to acquire that level of knowledge either prior to becoming an entity's director or within a reasonable time thereafter, such as through appropriate training. Both Fannie Mae and Freddie Mac expressed concern about this provision, believing that it could be read to require all directors to become “audit committee financial experts” and that it could effectively preclude them from recruiting directors who have specialized expertise outside of the realms of finance and accounting. FHFA does not believe that the language of the proposed rule, which uses the terms “working familiarity” and “basic finance and accounting” can reasonably be construed as being equivalent to requiring the same level of knowledge as is required to be an “audit committee financial expert.” The knowledge and experience required under the regulations of the Securities and Exchange Commission (SEC) to be deemed an “audit committee financial expert” are quite detailed and go far beyond concepts of basic finance and accounting. For example, an audit committee financial expert must have an understanding of generally accepted accounting principles and financial statements, the ability to assess the application of those principles, experience in preparing, auditing, or analyzing financial statements, an understanding of internal controls over financial reporting, and an understanding of audit committee functions. The expert also must have acquired those attributes through education and experience as a principal financial officer, principal accounting officer, controller, public accountant, or auditor, or by supervising persons performing those functions. FHFA also does not believe that requiring directors of the regulated entities to have or develop an understanding of basic concepts of finance and accounting will preclude them from recruiting persons whose expertise lies in other areas. Although FHFA has not defined the terms “working familiarity” or “basic finance and accounting practices,” they should be read in the context of the remainder of the provision, which indicates that the level of understanding has to be sufficient to allow the persons to read and understand the entity's financial statements (which the Enterprise directors already certify when filing their Form 10-K with the SEC) and to engage in a dialogue with management and the auditors about the operations and financial condition of the entity. Moreover, the Banks, which also have a minority of their directors chosen from outside of the financial services industry, have been able to recruit and retain capable directors notwithstanding this requirement, which has applied to Bank directors since 2000. Accordingly, FHFA is adopting § 1239.4(b)(3) of the final rule with no changes from the proposed rule. Lastly, Freddie Mac objected to § 1239.4(c) of the proposed rule that required the board of directors to have in place policies and procedures to address certain matters, such as risk management, compensation programs, financial reporting, and regulatory reporting. Freddie Mac suggested that FHFA revise this provision to make clear that it does not require the board of directors to establish the required policies and procedures, which can be developed by management. Because FHFA agrees that the development and implementation of procedures is a management responsibility, the final rule removes the reference to “procedures” from this section. The final rule retains, however, the requirement that the board must have in place adequate “policies” to assure its oversight of risk management, compensation, and financial reporting. As revised, this provision allows the board of directors to delegate to management the responsibility to develop, implement, and monitor compliance with the procedures used to implement board policies, but also requires the board of directors to review and approve those policies, as appropriate, as part of its responsibility to oversee management of the regulated entity.

Board Committees (1239.5)

The proposed rule would have required each regulated entity to have four specified committees of the board of directors, which are to address risk management, audit, compensation, and governance. The proposal also authorized the regulated entities to establish any other committees they deemed appropriate and prohibited the entities from combining their risk management committee or the audit committee with any other committee. The proposal further required that each committee have a formal written charter and that it meet with sufficient frequency to carry out its responsibilities.

FHFA is revising this provision of the final rule in two respects, both of which respond to comments from Freddie Mac. Apart from those revisions, FHFA is adopting this section as proposed. First, the final rule revises § 1239.5(c) to require that the full board of directors adopt a formal written charter for each committee. This replaces a provision of the proposed rule that would have allowed a committee to adopt its own charter. Second, the final rule revises § 1239.5(d) by adding language to the effect that a committee that is designed to meet only on an as-needed basis, rather than on a fixed schedule, such as an executive committee, which may meet regularly or only as necessary to address matters arising between meetings of the full board, shall meet in the manner specified in that committee's charter, rather than “regularly,” as the proposed rule had provided.

The Banks objected to the proposed rule's prohibition on combining the audit and risk committees with other committees, citing the need for flexibility in determining committee structure. While FHFA understands that the entities may need some flexibility when staffing their committees, FHFA also believes that the responsibilities of the audit committee and risk management committee are sufficiently important that each should be structured as a stand-alone committee, without any competing responsibilities.

D. Subpart C—Other Requirements Applicable to All Regulated Entities

Subpart C of the proposed rule included four other provisions that would have applied to all of the regulated entities. These provisions addressed: (1) Code of conduct; (2) risk management; (3) compliance programs; and (4) regulatory reports. The final rule revises portions of the provisions dealing with the code of conduct and risk management, which revisions are described below. FHFA is adopting the provisions relating to compliance programs and regulatory reports as proposed, and the discussion below also addresses suggested revisions to the compliance program, which FHFA has declined to adopt.

Code of Conduct and Ethics (1239.10)

Proposed § 1239.10 carried over the substance of an OFHEO regulation that required each regulated entity to establish a written code of conduct for directors, executive officers, and employees that is reasonably designed to ensure that they discharge their duties in an objective and impartial manner and that includes the standards required under section 406 of the Sarbanes-Oxley Act. Neither the OFHEO regulation nor the proposed rule described the substance of those standards, but simply incorporated them by cross-reference. The section 406 standards pertain to promoting honest and ethical conduct, accurate financial disclosures, and compliance with applicable laws. The Banks expressed two concerns about this provision of the proposed rule. First, they believed that it was unnecessary and duplicative because, as SEC registrants, they already must disclose whether they have adopted such a code of conduct. Second, they believed that the scope of the provision was too broad because it covered all employees, not just those involved with preparing the financial statements.

FHFA agrees that the scope of the proposed rule was broader than it needed to be insofar as it would have applied to employees that are not involved in the preparation of the entity's financial statements. To address these concerns about overbreadth, FHFA revised the final rule so that it imposes general requirements on all employees of a regulated entity and separately imposes other requirements on those officers that are responsible for preparing the financial statements. As part of that approach, the final rule no longer cross-references section 406 of the Sarbanes-Oxley Act, but instead incorporates the essential language of section 406 into the FHFA regulation. Accordingly, the final rule first provides that each entity must adopt a code of conduct that is reasonably designed to assure that its directors, officers, and employees discharge their duties in an objective and impartial manner and that promotes honest and ethical conduct, compliance with applicable laws and regulations, accountability for adhering to the code, and prompt internal reporting of violations of the code. Each of those elements is derived from section 406 of the Sarbanes-Oxley Act. The final rule separately provides that the code of conduct must include provisions that apply only to the entities' principal executive officer, principal financial officer, and principal accounting officer or controller. Those provisions must be reasonably designed to promote full, fair, and accurate disclosures in an entity's reports filed with the SEC and other public communications pertaining to the entity's financial condition. Those provisions also are derived from section 406, but will not apply to the officers and employees who have no role in preparing the financial statements or other disclosures.

FHFA appreciates that the Banks, as SEC registrants, are already required to disclose whether they have a code of conduct that satisfies the requirements of section 406 of the Sarbanes-Oxley Act. That requirement, however, is simply a disclosure requirement and does not require the Banks to actually adopt a code of ethics. Because FHFA believes that a code of conduct as described above is an important tool in assuring that the entities operate in a safe and sound manner, the final rule continues to require that the entities actually adopt the code of conduct. Accordingly, FHFA declines to adopt the Banks' suggestion that this matter be addressed solely through the existing disclosure mechanism.

Risk Management (1239.11)

The proposed rule contained a new risk management section that was based in large part on a recent proposal of the Federal Reserve Board relating to its supervision of large banking institutions. The proposed risk management section included little content from the regulations of the predecessor agencies, which had become somewhat dated. Among other things, proposed § 1239.11 would have required each entity to establish an enterprise-wide risk management program and specified certain requirements for that program, as well as the responsibilities of the risk committee. The proposal also would have required each entity to appoint a chief risk officer to oversee the risk management function, and specified the responsibilities of the chief risk officer. In the final rule, FHFA retained most of the content of the proposed rule, but reorganized certain provisions of the regulatory text to improve its readability. The final rule retains the three core elements of the proposed rule, which require the establishment of an enterprise-wide risk management program, the establishment of a risk committee with specified structure and responsibilities, and the establishment of a chief risk officer with specified responsibilities. FHFA also made certain revisions to the regulatory text in response to the comment letters. All of those revisions are described below.

Establishment of the Risk Management Program

Section 1239.11(a) of the proposed rule would have required the establishment of a risk management program that aligns with the entity's overall risk profile and mission objectives, while § 1239.11(c)(1) had specified several required elements for the risk management program. In the final rule, FHFA combined those provisions into a revised § 1239.11(a), which deals only with the risk management program. FHFA also revised the regulatory text, which formerly provided that the board of directors must have a risk management program “in effect at all times,” to clarify that the board must approve and periodically review the risk management program, as well as having it in effect. As noted previously, the final rule also replaces all references to the term “risk profile” with the newly defined term “risk appetite.” The final rule also makes some revisions to the provisions that specified the minimum requirements for the risk management program, principally to address concerns expressed by the commenters. The final rule now provides that the board of directors must ensure that the risk management program aligns with the entity's risk appetite, and it deletes a reference to this being a joint responsibility of the board and senior management. These provisions of the final rule are not intended to require that the board of directors actually develop or implement the risk management program, which tasks may be delegated to management, but the board is responsible for approving the program, as well as the entity's risk appetite, and ensuring that the two are consistent with each other. In the paragraphs describing the requirements of the risk management program, the final rule deletes certain references that the commenters believed could be read to impose management level responsibilities on the board or its committee. Thus, the final rule deletes from proposed § 1239.11(c)(ii), (iii), and (iv) references to “risk management practices and risk control structure,” “procedures . . . practices, risk controls,” and “control objectives,” respectively.

Establishment and Duties of the Risk Committee

Section 1239.11(b) of the proposed rule would have required the board of each regulated entity to establish a risk committee that oversees the entity's risk management practices, while § 1239.11(c) and (d) had addressed the risk committee structure and responsibilities, respectively. The final rule combines all of those provisions into a revised § 1239.11(b), which deals only with risk committee matters. FHFA also revised certain of these provisions in response to concerns of the commenters that the proposed rule could be read to assign management type responsibilities on the board of directors or the risk committee. Thus, the final rule has deleted language from proposed § 1239.11(b) that stated that the committee was “responsible for oversight of . . . risk management practices” and replaced it with language saying that the committee is to assist the board of directors in carrying out its duties to oversee the “risk management program,” rather than the “practices” of the entity.

The final rule revises certain of the provisions relating to the qualifications of the risk committee members that had been located in § 1239.11(c)(2) of the proposed rule, also in response to suggestions from the commenters. The proposed rule would have required that the committee have at least one member with “risk management expertise” that is commensurate with the business of the regulated entity, and further that the other committee members have “experience developing and applying risk management practices and procedures measuring and identifying risks.” The Banks and the Enterprises contended that such levels of expertise would likely be found only in a person who was serving, or had previously served, as a chief risk officer at a financial institution and that it would be difficult to find persons who are eligible for board positions who also have such expertise. FHFA believes that this is a valid concern and has revised the rule to require that the risk committee have at least one member with risk management “experience” rather than “expertise,” and that the other committee members have, or acquire through training, a practical understanding of risk management principles and practices. FHFA also deleted in its entirety the provision of the proposed rule that would have required risk committee members to also have had experience developing and applying risk management practices and procedures. Notwithstanding those revisions, FHFA believes that it is appropriate and reasonable to retain some language in the final rule requiring that the persons charged with assisting the board in its oversight of the risk management program have had some opportunity, either through prior experience or education or other training while on the board, to gain sufficient understanding of risk management principles to meaningfully engage with management on risk management matters.

Freddie Mac objected to the requirements in proposed § 1239.11(c)(2)(v) and (d)(1) that the risk committee fully document and maintain records of its meetings, including its risk management decisions and recommendations, and that it be responsible for documenting and overseeing the entity's risk management “policies and practices.” It believed that these requirements go beyond the existing obligation on board committees to prepare minutes of meetings. FHFA disagrees with the first of those suggestions and has retained the requirement that the committee document and maintain records of its meetings and decisions because risk management is a vital function and decisions of the risk committee and the justification for those actions need to be well documented. FHFA agrees with the second suggestion and removed from the final rule the language stating that that the committee is to be responsible for documenting and overseeing the risk management “policies and practices” of the entity because “practices” are more appropriately characterized as a management function than as a function for the risk committee. In its place, FHFA included an alternative provision, to be located in § 1239.111(b)(2)(i) of the final rule, providing that the risk committee must periodically review the entity's risk management program and make recommendations to the board of directors for any appropriate revisions to the program to ensure that the program remains aligned to the risks associated with the entity's business activities. The final rule also includes a parallel provision requiring the committee to periodically review the capabilities of, and the adequacy of the resources allocated to, the risk management program.

Chief Risk Officer

The proposed rule would require each entity to appoint a chief risk officer and described both the organizational structure of the risk management program and the responsibilities of the chief risk officer. The final rule makes some modest revisions to these provisions, stating that the chief risk officer shall “head” (rather than “oversee”) an independent risk management function and be responsible for the entity's risk management function. Both the proposed and final rules require that the head of the risk management function must be “independent.” FHFA construes that term to mean that the chief risk officer may not have dual responsibilities within the organization, such as also serving as the chief financial officer or as any other senior executive officer.

Compliance Program (1239.12)

The proposed rule would require that regulated entities establish a compliance program to be headed by a chief compliance officer and set forth criteria for the program. Proposed § 1239.12 would require the program to be reasonably designed to ensure that the regulated entity complies with applicable laws, rules, regulations, and internal controls. In addition, the proposal would require the compliance officer to report directly to the chief executive officer, to report regularly to the board of directors (or a committee thereof) on the adequacy of the entity's compliance policies and procedures, and to make recommendations to the board for any adjustments to those policies or procedures, as appropriate. The final rule adopts this provision as it was proposed.

The Banks expressed concern that these provisions were too prescriptive and believed that oversight of the compliance program need not reside solely with a single chief compliance officer, so long as the Banks have established clear lines of responsibilities for compliance matters with other executives. The Banks also objected to requiring the compliance officer to report to the chief executive and asked that the final rule allow for reporting lines to other senior executives. The Banks also suggested replacing the words “internal controls” with “policies” in the provision that requires that the compliance program ensure compliance with “laws, rules, regulations, and internal controls.” The Banks believe that internal controls themselves are designed to achieve compliance with laws, rules, regulations, and policies and therefore it did not make sense to require compliance with internal controls.

FHFA does not believe that this provision can be characterized as being overly prescriptive, as the Banks contend. The regulation is short, only three sentences, which require the establishment of a compliance program, the designation of a compliance officer, and the establishment of reporting requirements. As to the concern about reporting lines, FHFA believes that the compliance function is sufficiently important that it should be headed by a person holding an executive level position, who would be a peer of the executives taking the business risks, and who would have direct access to the CEO. Lastly, although internal controls are designed to ensure compliance with laws, regulations, and policies, this can only be achieved if the regulated entity complies with the internal control procedures themselves. Therefore, FHFA believes that it is appropriate to retain the term “internal controls” in the first sentence of the provision.

Regulatory Reports (1239.13)

Proposed § 1239.13 required each regulated entity to provide FHFA with such regulatory reports as are necessary for it to evaluate the condition of a regulated entity, or compliance with applicable law, and to do so in accordance with the forms and instructions issued by FHFA from time to time. It was derived from the Finance Board regulations at 12 CFR 914.1 and 914.2. FHFA received no comments on this provision and the final rule adopts this provision as proposed.

E. Subpart D—Enterprise Specific Requirements

Subpart D of the proposed rule included two provisions that were to apply only to the Enterprises. FHFA received no comments on these provisions from the Enterprises. Accordingly, with the exception of the one matter noted below, FHFA adopted both provisions as proposed. The first provision, § 1239.20, addresses age and term limits for Enterprise directors and requires that a majority of the directors be independent, as defined under the rules of the NYSE. It also addresses the frequency of Enterprise board meetings, quorum requirements, and voting by directors. The rule carries over these provisions from the OFHEO regulation without substantive change. Proposed § 1239.20(a)(3) included a new provision that would prohibit the chief executive officer of an Enterprise from also serving as the chairperson of the board of directors.

In the final rule, FHFA also revised the language of § 1239.20(b)(5), which requires the Enterprise boards of directors annually to review the requirements of applicable laws, rules, regulations, and guidelines. FHFA has been asked whether this provision requires a board of directors to review all laws that apply to the Enterprises or only on those that have been revised during the past year. FHFA believes that going forward this provision should be read to require that the boards of directors be kept informed of any significant changes to the applicable laws and regulations. Accordingly, the final rule revises this provision to state that at least annually the boards of the Enterprises shall be informed of any significant changes that have been made to the laws, rules, regulations, and guidelines to which the Enterprises are subject since the prior year's annual review. The second provision, § 1239.21, requires that the Enterprises pay their directors reasonable and appropriate compensation for the time required for the performance of their duties.

F. Subpart E—Bank Specific Requirements

Subpart E of the proposed rule included five provisions that were to apply only to the Banks. For three of those provisions, those relating to a Bank's member products policy (§ 1239.30), its strategic business plan (§ 1239.31), and its dividends (§ 1239.33), FHFA received no comments and the final rule adopts those provisions as proposed. The final rule deletes the proposed provision on internal controls in its entirety, for the reasons described below, and makes some modest revisions to the provision on Bank audit committees, also as described below.

Internal Control System

The proposed rule would have carried over without substantive change a Finance Board regulation dealing with Bank internal control systems. The proposed regulation set forth detailed responsibilities of senior management and the board of directors with respect to internal controls and solicited comments on whether the internal controls regulation should be expanded to apply to the Enterprises, as well as to the Banks. Freddie Mac urged FHFA not to extend the internal controls regulation to the Enterprises because they are already subject to numerous requirements related to internal controls. The Banks generally favored the adoption of a principles-based approach for the rules relating to internal controls, rather than the more prescriptive approach of the existing Finance Board regulations, and asked that FHFA revise the rule accordingly.

FHFA initially decided to adopt the Banks' suggestion and revise this provision to make it more principles-based. When making those revisions, however, FHFA determined that creating a more principles-based regulation would result in the revised regulation overlapping considerably with the provisions of FHFA's existing Prudential Standards that deal with internal controls. In order to avoid that result, and the potential confusion that having two separate provisions addressing internal controls could cause, FHFA decided a better approach would be to delete the provision on internal controls from the final rule and rely instead on the internal controls provisions of the Prudential Standards. Accordingly, the final rule does not include a separate regulation on internal controls for the Banks. In making this change, FHFA emphasizes that a strong system of internal controls is a critical first line defense for all of the regulated entities. FHFA expects that all of the regulated entities will devote the necessary resources and attention to this area.

Audit Committee (1239.32)

The proposed rule would have carried over without substantive change Finance Board regulations that required the establishment of an audit committee and established requirements for the composition, independence, charter, duties, and meetings of Bank audit committees. FHFA requested comment on whether it should adopt a single regulation addressing the audit committees for all regulated entities, whether the independence requirements for Bank audit committees should consider the amount of Bank stock or advances held by a member that has a representative on the committee, and whether Bank audit committees should have a majority of members who are not affiliated with the Bank's members. No commenters supported any of those revisions, and FHFA has not made any such changes to the final rule.

FHFA made three revisions to § 1239.32 of the final rule in response to comments from the Banks. The Banks asked that FHFA modify the requirement relating to representation on the audit committee of directors from the various types of members and of both member directors and independent directors by providing that the committee should be required have such a balance “to the extent that it is practicable to do so.” The Banks contended that the skill sets of the individual directors, particularly the member directors, will vary. As a result, there may be times when the persons whose experience is most suited to having them serve on the audit committee will not necessarily result in a committee composition that includes persons from all segments of the membership base. FHFA agrees with that statement and added the language requested by the Banks to the final rule. The Banks also asked that FHFA clarify that a reference to “independent directors” in this section refers to those directors who are not affiliated with a member institution, as defined in the Bank Act, so as not to suggest that it relates to the “independence” requirement for audit committee members. FHFA made that revision. The final rule also revises a provision that requires the audit committee to review “the policies and procedures used by senior management” by deleting the reference to “procedures” because FHFA agrees with the Banks that the development and review of particular procedures is more properly considered a management function. The final rule also makes one conforming change by revising the language of the existing rule to state that the board of directors, not the audit committee, is responsible for amending and periodically reapproving the audit committee charter. This change conforms this provision to an earlier provision of the rule that vests in the board of directors the sole authority to adopt committee charters.

G. Provisions To Be Repealed

As was proposed, the final rule will repeal several portions of the predecessor agency regulations that are not being carried over into the FHFA regulations. No commenters objected to the proposed repeal of these provisions, which included several OFHEO regulations that essentially repeated certain statutory requirements, certain provisions of the OFHEO regulations relating to the responsibilities of boards of directors that address matters now covered by the Prudential Standards, a Finance Board regulation requiring the preparation of annual budgets, and 12 CFR part 1720 of the OFHEO regulations, which established certain safety and soundness standards for the Enterprises.

Freddie Mac sought clarification as to the effect of the repeal of these provisions on specific regulatory guidance, such as the 2006 OFHEO Corporate Governance Examination Guidance. FHFA continues to evaluate the various types of guidance issued by the predecessor agencies to determine whether to retain, revise, or repeal the guidance. Those efforts are being done independently of this rulemaking. On March 26, 2015, FHFA issued Advisory Bulletin AB 2015-03, which rescinded five examination guidance documents that had been issued by OFHEO because they have been superseded by FHFA guidance, simply restated the text of regulations, or are no longer relevant or applicable in the current environment.

IV. Prudential Standards

The Prudential Standards include an introductory section, which recites general responsibilities of the boards of directors and senior management, as well as ten enumerated standards that address the topics required by statute. In the proposed rule, FHFA proposed to designate this introductory section as an additional Prudential Standard. Doing so would clarify that the introductory provisions have the same effect and could be enforced in the same manner as the ten enumerated standards. The Banks commented that this action would create some uncertainty about the role of the boards of directors because the introductory section currently includes references to the board of directors being responsible for adopting and implementing “procedures,” which the Banks contend is a management function. FHFA agrees that the development and implementation of procedures is a management responsibility, and has revised the first three paragraphs of the Prudential Standards introductory section by deleting the four references to “procedures” as responsibilities of the board of directors. FHFA received no other comments on this aspect of the proposal and the final rule otherwise adopts the final rule as proposed.

V. Paperwork Reduction Act

The final rule does not contain any information collection requirement that requires the approval of the Office of Management and Budget under the Paperwork Reduction Act (44 U.S.C. 3501 et seq.).

VI. Regulatory Flexibility Act

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires an agency to analyze a regulation's impact on small entities if the regulation is expected to have a significant economic impact on a substantial number of small entities. 5 U.S.C. 605(b). FHFA has considered the impact of this final rule and determined that it is not likely to have a significant economic impact on a substantial number of small entities because it applies only to the regulated entities, which are not small entities for purposes of the Regulatory Flexibility Act.

List of Subjects

12 CFR Part 914

• Federal Home Loan Banks
• Reporting and recordkeeping requirements

12 CFR Part 917

• Federal Home Loan Banks

12 CFR Part 1236

• Administrative practice and procedure
• Federal Home Loan Banks
• Government-Sponsored Enterprises
• Reporting and recordkeeping requirements

12 CFR Part 1239

• Administrative practice and procedure
• Federal Home Loan Banks
• Government-Sponsored Enterprises
• Reporting and recordkeeping requirements

12 CFR Part 1710

• Administrative practice and procedure
• Mortgages

12 CFR Part 1720

• Administrative practice and procedure
• Mortgages

Accordingly, for reasons stated in the Supplementary Information and under the authority of 12 U.S.C. 1426, 1427, 1432(a), 1436(a), 1440, 4511(b), 4513(a), 4513(b), and 4526, FHFA hereby amends subchapter C of chapter IX, subchapter B of chapter XII, and subchapter C of chapter XVII of title 12 of the Code of Federal Regulations as follows:

CHAPTER IX—FEDERAL HOUSING FINANCE BOARD

Subchapter C—[Removed and Reserved]

1. Subchapter C, consisting of parts 914 and 917 is removed and reserved.

CHAPTER XII—FEDERAL HOUSING FINANCE AGENCY

Subchapter B—Entity Regulations

PART 1236—PRUDENTIAL MANAGEMENT AND OPERATIONS STANDARDS

2. The authority citation for part 1236 continues to read as follows:

Authority: 12 U.S.C. 4511, 4513(a) and (f), 4513b, and 4526.

3. Amend § 1236.2 by revising the definition of “Standards” to read as follows:

4. Amend the Appendix to part 1236 as follows:

a. By redesignating the phrase “The following provisions constitute the prudential management and operations standards established pursuant to 12 U.S.C. 4513b(a).” following paragraph 10 under “Responsibilities of the Board of Directors and Senior Management” as introductory text to the appendix; and

b. By revising paragraphs 1., 2., and 3. under “Responsibilities of the Board of Directors and Senior Management” to read as follows:

Appendix to Part 1236—Prudential Management and Operations Standards

Responsibilities of the Board of Directors and Senior Management

1. With respect to the subject matter addressed by each Standard, the board of directors is responsible for adopting business strategies and policies that are appropriate for the particular subject matter. The board should review all such strategies and policies periodically. It should review and approve all major strategies and policies at least annually and make any revisions that are necessary to ensure that such strategies and policies remain consistent with the entity's overall business plan.

2. The board of directors is responsible for overseeing management of the regulated entity, which includes ensuring that management includes personnel who are appropriately trained and competent to oversee the operation of the regulated entity as it relates to the functions and requirements addressed by each Standard, and that management implements the policies set forth by the board.

3. The board of directors is responsible for remaining informed about the operations and condition of the regulated entity, including operating consistently with the Standards, and senior management's implementation of the strategies and policies established by the board of directors.

5. Part 1239 is added to subchapter C to read as follows:

PART 1239—RESPONSIBILITIES OF BOARDS OF DIRECTORS, CORPORATE PRACTICES, AND CORPORATE GOVERNANCE

Authority: 12 U.S.C. 1426, 1427, 1432(a), 1436(a), 1440, 4511(b), 4513(a), 4513(b), and 4526.

Subpart A—General

Subpart B—Corporate Practices and Procedures Applicable to All Regulated Entities

Subpart C—Other Requirements Applicable to All Regulated Entities

Subpart D—Enterprise Specific Requirements

Subpart E—Bank Specific Requirements

CHAPTER XVII—OFFICE OF FEDERAL HOUSING ENTERPRISE OVERSIGHT, DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

SUBCHAPTER C—SAFETY AND SOUNDNESS

PART 1710—[REMOVED]

6. Remove part 1710.

PART 1720—[REMOVED]

7. Remove part 1720.