(a) Purpose. This subpart F establishes risk-based capital requirements for spread risk and provides methods for the Enterprises to calculate their measure for spread risk.

(b) Applicability. This subpart applies to each Enterprise.

(c) Reservation of authority. Subject to applicable provisions of the Safety and Soundness Act:

(1) FHFA may require an Enterprise to hold an amount of capital greater than otherwise required under this subpart if FHFA determines that the Enterprise's capital requirement for spread risk as calculated under this subpart is not commensurate with the spread risk of the Enterprise's covered positions.

(2) If FHFA determines that the risk-based capital requirement calculated under this subpart by the Enterprise for one or more covered positions or portfolios of covered positions is not commensurate with the risks associated with those positions or portfolios, FHFA may require the Enterprise to assign a different risk-based capital requirement to the positions or portfolios that more accurately reflects the risk of the positions or portfolios.

(3) In addition to calculating risk-based capital requirements for specific positions or portfolios under this subpart, the Enterprise must also calculate risk-based capital requirements for covered positions under subpart D or subpart E of this part, as appropriate.

(4) Nothing in this subpart limits the authority of FHFA under any other provision of law or regulation to take supervisory or enforcement action, including action to address unsafe or unsound practices or conditions, deficient capital levels, or violations of law.

(a) Terms set forth in § 1240.2 and used in this subpart have the definitions assigned in § 1240.2.

(b) For the purposes of this subpart, the following terms are defined as follows:

Backtesting means the comparison of an Enterprise's internal estimates with actual outcomes during a sample period not used in model development. For purposes of this subpart, backtesting is one form of out-of-sample testing.

Covered position means, any asset that has more than de minimis spread risk (other than any intangible asset, such as any servicing asset), including:

(i) Any NPL, RPL, reverse mortgage loan, or other mortgage exposure that, in any case, does not secure an MBS guaranteed by the Enterprise;

(ii) Any MBS guaranteed by an Enterprise, MBS guaranteed by Ginnie Mae, reverse mortgage security, PLS, commercial MBS, CRT exposure, or other securitization exposure, regardless of whether the position is held by the Enterprise for the purpose of short-term resale or with the intent of benefiting from actual or expected short-term price movements, or to lock in arbitrage profits; and

(iii) Any other trading asset or trading liability (whether on- or off-balance sheet). 1

Market risk means the risk of loss on a position that could result from movements in market prices, including spread risk.

Private label security (PLS) means any MBS that is collateralized by a pool or pools of single-family mortgage exposures and that is not guaranteed by an Enterprise or by Ginnie Mae.

Reverse mortgage means a mortgage loan secured by a residential property in which a homeowner relinquishes equity in their home in exchange for regular payments.

Reverse mortgage security means a security collateralized by reverse mortgages.

Spread risk means the risk of loss on a position that could result from a change in the bid or offer price of such position relative to a risk free or funding benchmark, including when due to a change in perceptions of performance or liquidity of the position.

(a) Management of covered positions—(1) Active management. An Enterprise must have clearly defined policies and procedures for actively managing all covered positions. At a minimum, these policies and procedures must require:

(i) Marking covered positions to market or to model on a daily basis;

(ii) Daily assessment of the Enterprise's ability to hedge position and portfolio risks, and of the extent of market liquidity;

(iii) Establishment and daily monitoring of limits on covered positions by a risk control unit independent of the business unit;

(iv) Routine monitoring by senior management of information described in paragraphs (a)(1)(i) through (iii) of this section;

(v) At least annual reassessment of established limits on positions by senior management; and

(vi) At least annual assessments by qualified personnel of the quality of market inputs to the valuation process, the soundness of key assumptions, the reliability of parameter estimation in pricing models, and the stability and accuracy of model calibration under alternative market scenarios.

(2) Valuation of covered positions. The Enterprise must have a process for prudent valuation of its covered positions that includes policies and procedures on the valuation of positions, marking positions to market or to model, independent price verification, and valuation adjustments or reserves. The valuation process must consider, as appropriate, unearned credit spreads, close-out costs, early termination costs, investing and funding costs, liquidity, and model risk.

(b) Requirements for internal models. (1) A risk control unit independent of the business unit must approve any internal model to calculate its risk-based capital requirement under this subpart.

(2) An Enterprise must meet all of the requirements of this section on an ongoing basis. The Enterprise must promptly notify FHFA when:

(i) The Enterprise plans to extend the use of a model to an additional business line or product type;

(ii) The Enterprise makes any change to an internal model that would result in a material change in the Enterprise's risk-weighted asset amount for a portfolio of covered positions; or

(iii) The Enterprise makes any material change to its modeling assumptions.

(3) FHFA may determine an appropriate capital requirement for the covered positions to which a model would apply, if FHFA determines that the model no longer complies with this subpart or fails to reflect accurately the risks of the Enterprise's covered positions.

(4) The Enterprise must periodically, but no less frequently than annually, review its internal models in light of developments in financial markets and modeling technologies, and enhance those models as appropriate to ensure that they continue to meet the Enterprise's standards for model approval and employ risk measurement methodologies that are most appropriate for the Enterprise's covered positions.

(5) The Enterprise must incorporate its internal models into its risk management process and integrate the internal models used for calculating its market risk measure into its daily risk management process.

(6) The level of sophistication of an Enterprise's internal models must be commensurate with the complexity and amount of its covered positions. An Enterprise's internal models may use any of the generally accepted approaches, including variance-covariance models, historical simulations, or Monte Carlo simulations, to measure market risk.

(7) The Enterprise's internal models must properly measure all the material risks in the covered positions to which they are applied.

(8) The Enterprise's internal models must conservatively assess the risks arising from less liquid positions and positions with limited price transparency under realistic market scenarios.

(9) The Enterprise must have a rigorous and well-defined process for re-estimating, re-evaluating, and updating its internal models to ensure continued applicability and relevance.

(c) Control, oversight, and validation mechanisms. (1) The Enterprise must have a risk control unit that reports directly to senior management and is independent from the business units.

(2) The Enterprise must validate its internal models initially and on an ongoing basis. The Enterprise's validation process must be independent of the internal models' development, implementation, and operation, or the validation process must be subjected to an independent review of its adequacy and effectiveness. Validation must include:

(i) An evaluation of the conceptual soundness of (including developmental evidence supporting) the internal models;

(ii) An ongoing monitoring process that includes verification of processes and the comparison of the Enterprise's model outputs with relevant internal and external data sources or estimation techniques; and

(iii) An outcomes analysis process that includes backtesting.

(3) The Enterprise must stress test the market risk of its covered positions at a frequency appropriate to each portfolio, and in no case less frequently than quarterly. The stress tests must take into account concentration risk (including concentrations in single issuers, industries, sectors, or markets), illiquidity under stressed market conditions, and risks arising from the Enterprise's trading activities that may not be adequately captured in its internal models.

(4) The Enterprise must have an internal audit function independent of business-line management that at least annually assesses the effectiveness of the controls supporting the Enterprise's market risk measurement systems, including the activities of the business units and independent risk control unit, compliance with policies and procedures, and calculation of the Enterprise's measures for spread risk under this subpart. At least annually, the internal audit function must report its findings to the Enterprise's board of directors (or a committee thereof).

(d) Internal assessment of capital adequacy. The Enterprise must have a rigorous process for assessing its overall capital adequacy in relation to its market risk.

(e) Documentation. The Enterprise must adequately document all material aspects of its internal models, management and valuation of covered positions, control, oversight, validation and review processes and results, and internal assessment of capital adequacy.

(a) General requirement—(1) In general. An Enterprise must calculate its standardized measure for spread risk by following the steps described in paragraph (a)(2) of this section. An Enterprise also must calculate an advanced measure for spread risk by following the steps in paragraph (a)(2) of this section.

(2) Measure for spread risk. An Enterprise must calculate the standardized measure for spread risk, which equals the sum of the spread risk capital requirements of all covered positions using one or more of its internal models except as contemplated by paragraphs (b) or (c) of this section. An Enterprise also must calculate the advanced measure for spread risk, which equals the sum of the spread risk capital requirements of all covered positions calculated using one or more of its internal models.

(b) Single point approach—(1) General. For purposes of the standardized measure for spread risk, the spread risk capital requirement for a covered position that is an RPL, an NPL, a reverse mortgage loan, or a reverse mortgage security is the amount equal to:

(i) The market value of the covered position; multiplied by

(ii) The applicable single point shock assumption for the covered position under paragraph (b)(2) of this section.

(2) Applicable single point shock assumption. The applicable single point shock assumption is:

(i) 0.0475 for an RPL or an NPL;

(ii) 0.0160 for a reverse mortgage loan; and

(iii) 0.0410 for a reverse mortgage security.

(c) Spread duration approach—(1) General. For purposes of the standardized measure for spread risk, the spread risk capital requirement for a covered position that is a multifamily mortgage exposure, a PLS, or an MBS guaranteed by an Enterprise or Ginnie Mae and secured by multifamily mortgage exposures is the amount equal to:

(i) The market value of the covered position; multiplied by

(ii) The spread duration of the covered position determined by the Enterprise using one or more of its internal models; multiplied by

(iii) The applicable spread shock assumption under paragraph (c)(2) of this section.

(2) Applicable spread shock assumption. The applicable spread shock is:

(i) 0.0015 for a multifamily mortgage exposure;

(ii) 0.0265 for a PLS; and

(iii) 0.0100 for an MBS guaranteed by an Enterprise or by Ginnie Mae and secured by multifamily mortgage exposures (other than IO securities guaranteed by an Enterprise or Ginnie Mae).

(a) Scope. An Enterprise must make timely public disclosures each calendar quarter, where for the purpose of these disclosure requirements timely means no later than 10 business days after an Enterprise files its corresponding Annual Report on SEC Form 10-K at the end of a fiscal year or its corresponding Quarterly Report on SEC Form 10-Q at the end of other calendar quarters. If a significant change occurs, such that the most recent reporting amounts are no longer reflective of the Enterprise's capital adequacy and risk profile, then a brief discussion of this change and its likely impact must be provided as soon as practicable thereafter. Qualitative disclosures that typically do not change each quarter may be disclosed annually, provided any material changes are disclosed as soon as practicable thereafter, and no later than the end of the next calendar quarter, where for the purpose of these disclosure requirements a material change means a change such that the omission or misstatement of which could change or influence the assessment or decision of a user relying on that information for the purpose of making investment decisions. If an Enterprise believes that disclosure of specific commercial or financial information would prejudice seriously its position by making public certain information that is either proprietary or confidential in nature, the Enterprise is not required to disclose these specific items but must disclose more general information about the subject matter of the requirement, together with the fact that, and the reason why, the specific items of information have not been disclosed.

(b) Location. The Enterprise's management may provide all of the disclosures required by this section in one place on the Enterprise's public website or may provide the disclosures in more than one public financial report or other regulatory reports, provided that the Enterprise publicly provides a summary table specifically indicating the location(s) of all such disclosures.

(c) Disclosure policy. The Enterprise must have a formal disclosure policy approved by the board of directors that addresses the Enterprise's approach for determining its market risk disclosures. The policy must address the associated internal controls and disclosure controls and procedures. The board of directors and senior management must ensure that appropriate verification of the disclosures takes place and that effective internal controls and disclosure controls and procedures are maintained. The Chief Risk Officer and the Chief Financial Officer of the Enterprise must attest that the disclosures meet the requirements of this subpart, and the board of directors and senior management are responsible for establishing and maintaining an effective internal control structure over the disclosures required by this section.

(d) Quantitative disclosures. (1) For each material portfolio of covered positions, the Enterprise must provide timely public disclosures of the following information at least quarterly:

(i) Exposure amounts for each product type included in covered positions as described in § 1240.202; and

(ii) Risk-weighted assets for each product type included in covered positions as described in § 1240.202.

(2) In addition, the Enterprise must disclose publicly the aggregate amount of on-balance sheet and off-balance sheet securitization positions by exposure type at least quarterly.

(e) Qualitative disclosures. For each material portfolio of covered positions as identified using the definitions in § 1240.202, the Enterprise must provide timely public disclosures of the following information at least annually after the end of the fourth calendar quarter, or more frequently in the event of material changes for each portfolio:

(1) The composition of material portfolios of covered positions;

(2) The Enterprise's valuation policies, procedures, and methodologies for covered positions including, for securitization positions, the methods and key assumptions used for valuing such positions, any significant changes since the last reporting period, and the impact of such change;

(3) The characteristics of the internal models used for purposes of this subpart;

(4) A description of the approaches used for validating and evaluating the accuracy of internal models and modeling processes for purposes of this subpart;

(5) For each market risk category (that is, interest rate risk, credit spread risk, equity price risk, foreign exchange risk, and commodity price risk), a description of the stress tests applied to the positions subject to the factor;

(6) The results of the comparison of the Enterprise's internal estimates for purposes of this subpart with actual outcomes during a sample period not used in model development; and

(7) A description of the Enterprise's processes for monitoring changes in the market risk of securitization positions, including how those processes differ for resecuritization positions.