Record Retention, 62879-62886 [E6-18034]

Agencies

• Federal Housing Enterprise Oversight Office
• DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT
• Office of Federal Housing Enterprise Oversight

[Federal Register Volume 71, Number 208 (Friday, October 27, 2006)]
[Rules and Regulations]
[Pages 62879-62886]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E6-18034]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

Office of Federal Housing Enterprise Oversight

12 CFR Part 1732

RIN 2550-AA34


Record Retention

AGENCY: Office of Federal Housing Enterprise Oversight, HUD.

ACTION: Final regulation.

-----------------------------------------------------------------------

SUMMARY: The Office of Federal Housing Enterprise Oversight (OFHEO) is 
issuing a final regulation that sets forth record retention 
requirements with respect to the record management programs of the 
Federal National Mortgage Association and the Federal Home Loan 
Mortgage Corporation consistent with the safety and soundness 
responsibilities of OFHEO under the Federal Housing Enterprises 
Financial Safety and Soundness Act of 1992.

DATES: The effective date of this regulation is October 27, 2006.

FOR FURTHER INFORMATION CONTACT: Tina Dion, Associate General Counsel, 
telephone (202) 414-3838 (not a toll-free number); Office of Federal 
Housing Enterprise Oversight, Fourth Floor, 1700 G Street, NW., 
Washington, DC 20552. The telephone number for the Telecommunications 
Device for the Deaf is (800) 877-8339.

SUPPLEMENTARY INFORMATION:

I. Background

A. Introduction

    Title XIII of the Housing and Community Development Act of 1992, 
Public Law 102-550, titled the ``Federal Housing Enterprises Financial 
Safety and Soundness Act of 1992'' (Act) (12 U.S.C. 4501 et seq.), 
established OFHEO as an independent office within the Department of 
Housing and Urban Development. OFHEO is statutorily mandated to ensure 
that the Federal National Mortgage Association (Fannie Mae) and the 
Federal Home Loan Mortgage Corporation (Freddie Mac) (collectively, the 
Enterprises) are capitalized adequately and operate in a safe and sound 
manner and in compliance with applicable laws, rules, and regulations.
    The Act provides that the Director of OFHEO (the Director) is 
authorized to make such determinations, take such actions, and perform 
such functions as the Director determines are necessary regarding his 
supervisory authorities, which include examinations of the 
Enterprises.\1\ Under the Act, the Director is authorized to conduct 
on-site examinations of the Enterprises each year, and any other 
examinations that the Director determines are necessary to ensure their 
safety and soundness.\2\
---------------------------------------------------------------------------

    \1\ 12 U.S.C. 4513(b)(2).
    \2\ 12 U.S.C. 4517(a) and (b).
---------------------------------------------------------------------------

B. Record Retention and Safe and Sound Operations

    OFHEO recognizes that the effectiveness of the examination process 
is dependent upon the prompt production of complete and accurate 
records. OFHEO, through the supervisory process, must have access to 
the records of an Enterprise that are necessary to determine the 
financial condition of the Enterprise or the details or the purpose of 
any transaction that

[[Page 62880]]

may have a material effect on the financial condition of the 
Enterprise.\3\
---------------------------------------------------------------------------

    \3\ 12 U.S.C. 4632(c).
---------------------------------------------------------------------------

    Retention of such records not only facilitates the examination 
process, but also allows an Enterprise to manage more effectively its 
business and detect improper behavior that might cause financial damage 
to the corporation. Additionally, such records serve as documentation 
for an Enterprise in any controversy over its business activities or 
transactions.
    The importance of sound record retention policies and procedures by 
regulated institutions also has been recognized by Congress and other 
federal regulators. Adequate record retention by the institutions has 
been determined to have a high degree of usefulness in criminal, tax, 
and regulatory investigations or proceedings, and has been identified 
as a requisite component of an institution's operation and management 
on a safety and soundness basis.\4\
---------------------------------------------------------------------------

    \4\ See, e.g., 12 U.S.C. 1829b, and the Guidelines and 
Interagency Standards for Safety and Soundness at 12 CFR part 30, 
Appendix A, II, B.
---------------------------------------------------------------------------

    In addition to facilitating the oversight and enforcement of 
federal banking laws, adequate record retention has been recognized by 
Congress as being essential to the oversight and enforcement of the 
federal securities laws. For example, as mandated by section 802 of the 
Sarbanes-Oxley Act,\5\ the U.S. Securities and Exchange Commission 
adopted rules requiring accounting firms to retain for seven years 
certain records relevant to their audits and reviews of issuers' 
financial statements. Records to be retained include an accounting 
firm's workpapers and certain other documents that contain conclusions, 
opinions, analyses, or financial data related to the audit or 
review.\6\
---------------------------------------------------------------------------

    \5\ Pub. L. 107-204, 116 Stat. 745 (2002).
    \6\ 17 CFR part 210. See Release Nos. 33-8180; 34-47241; IC-
2591; FR-66; File No. S7-46-02.
---------------------------------------------------------------------------

Record Retention Regulation
    On June 1, 2006, OFHEO published for comment a proposed regulation, 
at 71 FR 31121, which sets forth proposed safety and soundness 
requirements with respect to the Enterprises' record retention 
programs. The 60-day comment period ended on July 31, 2006. All 
comments received have been made available to the public in the OFHEO 
Public Reading Room and have been posted on the OFHEO Web site at 
https://www.OFHEO.gov.

II. Comments Received

    Comments were received from Freddie Mac and Fannie Mae. Both 
Enterprises commented in support of the general approach under the 
proposed regulation. Each Enterprise also provided comments, many of 
which were technical in nature, on specific provisions of the proposal. 
All comments were taken into consideration. A discussion of the 
comments as they related to the proposed sections of the regulation 
follows.

A. Sec.  1732.1 Purpose and Scope

    Proposed Sec.  1732.1 states that the purpose of the regulation is 
to set forth minimum requirements in connection with the record 
retention program of each Enterprise, and that the requirements are 
intended to ensure that complete and accurate records of an Enterprise 
are readily accessible by OFHEO for examination and other supervisory 
purposes.
    Both Enterprises made technical comments regarding Sec.  1732.1 
with respect to the requirement to provide OFHEO with ready access to 
records. The Enterprises noted the dynamic nature of records management 
and the evolving nature of information technology. Freddie Mac 
commented that the methods of accessing hard copies of documents in 
off-site storage, electronic documents resident on a Local Area 
Network, and information in legacy databases, active databases, e-mail, 
and voicemail are quite different. Freddie Mac also noted that the 
level of management controls and ready access to records is not the 
same for records created and maintained years ago as that of records 
created and maintained today. Moreover, Freddie Mac commented that many 
of the records are subject to specific legal rights of the Enterprise 
or of individuals that cannot be disregarded. For these reasons, both 
Enterprises requested clarification that access to their records under 
the regulation is intended to mean ``reasonable'' access.
    OFHEO understands that all records are not equally accessible. For 
purposes of clarification, OFHEO has added language to Sec.  1732.1, as 
well as Sec. Sec.  1732.6(a)(2)(iii) and 1732.7(d), which clarifies 
that the sections' accessibility requirements are intended to be by 
reasonable means, consistent with the nature and availability of the 
records and existing information technology.

B. Sec.  1732.2 Definitions

Active Record
    As proposed, the term ``active record'' would be defined under 
Sec.  1732.2(b) to mean a document that is necessary to conduct the 
current business of an office or business unit of an Enterprise and, 
therefore, is readily available for consultation and reference.
    The Enterprises made technical comments on this definition, as well 
as the definitions for the terms ``inactive record'' and ``vital 
records,'' requesting that the terms be amended by substituting the 
word ``record'' or ``records'' for ``document'' or documents,'' as 
appropriate. Each Enterprise stated that such amendments would more 
fully incorporate what is intended by the proposal, i.e., its 
definition of ``record,'' and would be consistent with best 
practices.\7\
---------------------------------------------------------------------------

    \7\ In their comments on best practices in the field of records 
management, both Enterprises referred to the guidelines and 
standards of the following organizations: The Sedona Conference 
(2005), the American National Standards Institute/Association of 
Records Managers and Administrators, and the International 
Organization for Standardization.
---------------------------------------------------------------------------

    OFHEO agrees with the recommended technical changes and has revised 
the definitions in Sec.  1732.2(b), (h), and (m) accordingly in the 
final regulation.
Employee
    As proposed, the definition of the term ``employee'' would be 
defined in Sec.  1732.2(e) to mean any officer or employee of an 
Enterprise, any conservator appointed by OFHEO, or any agent or 
independent contractor acting on behalf of an Enterprise. Both 
Enterprises commented that including independent contractors and agents 
in the definition was significant because such individuals would be 
subject to several provisions of the proposed regulations, i.e., the 
training requirements under Sec.  1732.6(b); the record hold 
notifications under Sec.  1732.7(b); the reporting requirements of 
potential investigations under Sec.  1732.7(b)(3), and the definition 
of ``record'' under Sec.  1732.2(j)(3).
    Fannie Mae stated that extending the regulation's general reach in 
this way would create obligations with regard to parties and documents 
beyond an Enterprise's control, would generate considerable burden and 
expense for the Enterprise without yielding commensurate gains with 
respect to improved operations or supervision, and would increase 
litigation risk by exposing the Enterprise to potential liability for 
the actions (or non-actions) of third parties or individuals outside 
the Enterprise's control.
    Both Enterprises requested that OFHEO not include agents and 
independent contractors within the general definition of the term 
``employee.'' Rather, they recommended that, to the extent that any 
section of the regulation is intended to apply to agents

[[Page 62881]]

or independent contractors, OFHEO amend the section to include specific 
language making it apply to agents or independent contractors, tailored 
to what would be appropriate under the circumstances.
    In response to the comments, OFHEO has deleted the phrase ``or any 
agent or independent contractor acting on behalf of an Enterprise'' 
from Sec.  1732.2(e), and has added specific language for coverage of 
agents or independent contractors as appropriate in other sections of 
the final regulation, as noted below.
Inactive Record
    As proposed, the term ``inactive record'' would be defined in Sec.  
1732.2(h) to mean a document that is seldom used but must be retained 
by an Enterprise for legislative, fiscal, legal, archival, historical, 
or vital records purposes.
    In its technical comment, Fannie Mae requested that the words 
``legislative'' and ``archival'' be deleted from the definition. Fannie 
Mae stated that the words do not appear to add anything substantive to 
the other qualifying terms, and that the proposal provides no 
elaboration as to what these words are intended to capture that is not 
otherwise covered. Fannie Mae noted that, as an industry practice, 
records generally are defined for record retention purposes as having 
operational, vital record, legal or regulatory, fiscal, and historical 
value.
    OFHEO concurs with Fannie Mae's technical comment and has revised 
the definition of ``inactive record'' accordingly in the final 
regulation. Also, as noted above, the word ``record'' has been 
substituted for the word ``document.''
Record
    As proposed, the definition of the term ``record'' in Sec.  
1732.2(j) would mean: Any document whether generated internally or 
received from outside sources by an Enterprise or employee in 
connection with Enterprise business, regardless of the following: (1) 
Form or format, including hard copy documents (e.g., files, logs, and 
reports) and electronic documents (e.g., e-mail, databases, 
spreadsheets, PowerPoint presentations, electronic reporting systems, 
electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), 
and voicemail records; (2) where the document is stored or located, 
including network servers, desktop or laptop computers and handheld 
computers, other wireless devices with text messaging capabilities, and 
on-site or off-site at a storage facility; (3) whether the document is 
maintained or used on Enterprise-owned equipment, or personal or home 
computer systems of an employee; or (4) whether the document is active 
or inactive.
    Fannie Mae recommended that the proposed regulation use the 
definition of the term ``record'' provided in Internal Organization for 
Standards, ISO 15849-1 Sec.  3.15. That standard provides that a record 
``is information created, received, and maintained as evidence and 
information by an organization or person, in the pursuance of legal 
obligations or in the transaction of business.'' Freddie Mac, also 
referencing industry standards, requested that the word ``information'' 
be used in the definition, rather than ``document.'' Freddie Mac 
requested another technical change that would modify the definition by 
inserting the term ``maintained'' between the word ``employee'' and the 
phrase ``in connection with.'' Both Enterprises explained that the 
recommended revisions better reflect the corporate practices and 
supervisory concerns.
    OFHEO agrees with the technical changes recommended by Freddie Mac 
and has revised the definition of the term ``record'' in Sec.  
1732.2(j) to read ``any information whether generated internally or 
received from outside sources or employee maintained in connection with 
Enterprise business * * *'' Conforming changes have also been made to 
subsections (2), (3), and (4) accordingly.
    OFHEO does not agree to make use of the entire ISO definition for 
the definition of the term ``records,'' as recommended by Fannie Mae, 
because other elements of the ISO definition are encompassed in Sec.  
1732.2 under the definition of the terms ``active record'' and ``vital 
records.'' In addition, the language of the definition in Sec.  
1732.2(j), namely ``whether generated internally or received from 
outside sources'' is necessary to ensure that records are appropriately 
retained even if they have not been generated or created by the 
Enterprise.
Record Retention Schedule
    As proposed, the definition of the term ``record retention 
schedule'' would be defined in Sec.  1732.2(k) to mean ``a form that 
details the categories of records an Enterprise is required to store 
and their corresponding record retention periods. The record retention 
schedule includes reproductions, as well as all media, including 
microfilm and machine-readable computer records, for each record 
category.''
    Fannie Mae commented that the inclusion of the term 
``reproductions'' in the definition would be inconsistent with the 
standard industry approach, which does not require retention of copies 
because of the burden and expense of such retention. OFHEO understands 
that retention of all reproductions or copies of records would be 
burdensome and expensive. Reproductions would be listed in a record 
retention schedule only if the original of the official record is not 
available. Accordingly, OFHEO has revised the second sentence of the 
proposed definition to read: ``The record retention schedule includes 
all media, such as microfilm and machine-readable computer records, for 
each record category. Reproductions are also included for each record 
category if the original of the official record is not available.''
    Fannie Mae also commented that the record retention schedule is 
envisioned as a ``form.'' Fannie Mae also requested a technical change 
to the definition, i.e., substitution of the word ``schedule'' for the 
term ``form,'' to be consistent with the standard industry approach. 
OFHEO agrees and has changed the term ``form'' to ``schedule'' in the 
definition of the term ``record retention schedule'' in the final 
regulation.
Record Period
    As proposed, the definition of the term ``Retention period'' would 
be defined in Sec.  1732.2(l) to mean the length of time that records 
must be kept before they are destroyed. Records not authorized for 
destruction would have a retention period of ``permanent.''
    Fannie Mae made a technical comment that the definition is 
ambiguous, and requested that the definition be changed to state that: 
``Records not provided with a `retention period' must be retained, 
unless scheduled for destruction.''
    OFHEO has determined that the definition, as proposed, is clear 
and, therefore, has not made the technical change.
Vital Records
    As proposed, the term ``vital records'' would be defined in Sec.  
1732.2(m) to mean documents that are needed to meet operational 
responsibilities of an Enterprise under emergency or disaster 
conditions (emergency operating records) or to protect the legal and 
financial rights of an Enterprise and those affected by Enterprise 
activities. Emergency operating records would be defined to mean the 
type of vital records essential to the continued functioning or 
reconstitution of an Enterprise during and after an emergency. 
Moreover, a vital record would be further defined to include a record 
that could be both an emergency operating record and a legal and 
financial rights record.

[[Page 62882]]

    Fannie Mae commented that the definition includes documents 
``needed * * * to protect the legal and financial rights of * * * those 
affected by Enterprise activities.'' Fannie Mae stated that the company 
is very concerned about the possible impact of this language, as it 
arguably could be read to create new, unpredictable obligations to 
third parties, and thus potential legal risk. To allay such concerns 
and to be consistent with industry best practices, Fannie Mae requested 
that the words ``those affected by Enterprise activities'' be 
substituted with the phrase ``its employees, creditors, customers and 
holders of its securities.''
    In response to the comment, OFHEO has determined to delete the 
words ``those affected by Enterprise activities'' from the definition 
of the term ``vital records'' in the final regulation. Also, as noted 
above, the word ``records'' has been substituted for the word 
``documents.''

C. Section 1732.5 Establishment and Evaluation of Record Retention 
Program

    Section 1732.5(a) of the proposed regulation would require each 
Enterprise to establish and maintain a written record retention program 
and provide a copy of such program to the Examiner-in-Charge (EIC) of 
the Enterprise within 120 days of the regulation's effective date, and 
annually thereafter, and whenever a significant revision to the program 
has been made.
    Fannie Mae advised in its comments that the company will be 
prepared to submit a written plan within 120 days of the effective date 
on the understanding that the EIC will advise if the planned program is 
acceptable before investments are made in order to avoid costly changes 
and unnecessary delays. For the build-out process, Fannie Mae further 
advised that the company anticipates using one or more pilots to test 
and improve its proposed policy, approach and technology.
    Freddie Mac stated that the company expects to include in its 
initial report to OFHEO a snapshot of its current records retention 
program, including any additional enhancements that are implemented by 
the date of that report, together with a description of planned 
enhancements (both short-term and long-term) to that program. That 
first report will reflect that Freddie Mac has a records management 
program in place that encompasses records retention, but that the 
company is continuing to develop and strengthen its program. Freddie 
Mac noted that with OFHEO feedback on both its record retention 
program, and on planned enhancements, the corporation can align the 
records retention program with the expectations of OFHEO under the 
final regulation.
    OFHEO understands that both Enterprises are in the process of 
developing and upgrading their records management systems to comport 
with changing technology and the requirements of the final regulation. 
To that end, OFHEO encourages an Enterprise to submit relevant 
materials to and confer with its EIC as needed to ensure that its 
record retention program is compliant.

D. Section 1732.6 Minimum Requirements of Record Retention Program 
Requirements

    Section 1732.6(a)(2)(iii) of the proposed regulation would require 
that the record retention program established and maintained by an 
Enterprise be reasonably designed to assure that the format of retained 
records and the retention period permit ready access by the Enterprise, 
and, upon request, by the examination and other staff of OFHEO.
    As noted above, in response to technical comments received on Sec.  
1732.1, OFHEO has revised subsection (a)(2)(iii) of Sec.  1732.6 in the 
final regulation to clarify the accessibility requirement to mean 
access by reasonable means, consistent with the nature and availability 
of the records and existing information technology.
    Additionally, Freddie Mac made a technical comment requesting that 
OFHEO revise this subsection (and Sec.  1732.7(d), which addresses 
access to and retrieval of records during a record hold) to include at 
the end the phrase ``subject to applicable legal rights.''
    OFHEO has determined that it is not necessary to add the requested 
phrase to either subsection because the record retention requirements 
of the regulation are imposed for purposes of supervisory access by 
OFHEO to Enterprise records and do not result in a waiver of existing 
rights.
    Section 1732.6(a)(5) of the proposed regulation would require that 
the record retention program established and maintained by an 
Enterprise include an accurate, current, and comprehensive record 
retention schedule that lists records by major categories, 
subcategories, record type, and retention period, which retention 
period is appropriate to the specific record and consistent with 
applicable legal, regulatory, fiscal, and administrative requirements.
    Fannie Mae commented that the term ``administrative'' is ambiguous. 
Fannie Mae stated that, if the term is intended to reference 
administrative requirements of OFHEO, the term ``regulatory'' already 
captures these requirements, so the term ``administrative'' should be 
deleted. If, however, what is intended to be captured are the 
Enterprises' business needs, the term ``operational'' or ``business'' 
should be substituted for the term ``administrative.''
    OFHEO notes that the term ``administrative'' refers to requirements 
that are internal to a company, i.e., the Enterprise. Therefore, the 
term is not duplicative of the term ``regulatory.'' However, for 
purposes of clarification, OFHEO has determined to revise Sec.  
1732.6(a)(5) in the final regulation by substituting the terms 
``operational and business'' for the term ``administrative.''
Training
    Section 1732.6(b) of the proposed regulation would require that an 
Enterprise's record retention program provide for training of and 
notice to all employees on a periodic basis on their record retention 
responsibilities, including instruction regarding penalties provided by 
law for the unlawful removal or destruction of records.
    The Enterprises commented that this provision should be modified to 
include specific language tailored to requirements appropriate for 
independent contractors and agents. In its technical comment, Freddie 
Mac requested that OFHEO modify the proposal to provide that the 
training provision applies only to actual employees of an Enterprise, 
and that the Enterprise also takes reasonable steps to ensure that 
agents or independent contractors who are involved with creating or 
maintaining Enterprise records receive notice and/or training regarding 
record retention responsibilities in a manner appropriate to their 
engagement. Fannie Mae requested amending the proposed section to 
include specific language making training for agents or independent 
contractors consistent with their roles and responsibilities.
    As noted above in response to comments on Sec.  1732.2(e), OFHEO 
has added specific language for coverage of agents or independent 
contractors to several sections of the final regulation. With respect 
to Sec.  1732.6, a second sentence has been added to subsection (b) 
that reads as follows: ``The record retention program also shall 
provide for training for the agents or independent contractors of an 
Enterprise, as appropriate, consistent with their respective roles and 
responsibilities to the Enterprise.''

[[Page 62883]]

E. Section 1732.7 Record Hold

Definition
    Section 1732.7(a) of the proposed regulation would define the term 
``record hold'' to mean a requirement, an order, or a directive from an 
Enterprise or OFHEO that the Enterprise is to retain records relating 
to a particular issue in connection with an actual or a potential OFHEO 
examination, investigation, enforcement proceeding, or litigation.
    Both Enterprises expressed concern that criteria for a record hold 
is stated in terms of a ``potential'' investigation, enforcement 
proceeding or litigation. Fannie Mae commented that virtually 
everything that an Enterprise does raises some ``potential'' for 
litigation, and virtually every question that OFHEO asks raises some 
``potential'' for an OFHEO investigation. Fannie Mae stated that the 
overly broad and ambiguous standard would needlessly create an onerous 
burden both on the Enterprises and OFHEO. Fannie Mae requested that the 
word ``likely'' be substituted for the word ``potential.''
    Freddie Mac made the technical comment that the term ``potential'' 
requires or suggests that an Enterprise or employee is obligated and 
accountable to accurately guess when a matter could possibly give rise 
to an OFHEO examination, investigation, enforcement proceeding or 
litigation, resulting in an impossible standard with which to comply in 
practice. Freddie Mac requested that subsection (a) of Sec.  1732.7 be 
modified to require that an Enterprise receive notice from OFHEO.
    To address these comments, OFHEO has amended subsection (a) of 
Sec.  1732.7 in the final regulation to clarify that the record 
retention requirements of a record hold result upon receipt by the 
Enterprise of notice from OFHEO. As amended, subsection (a) reads as 
follows: ``For purposes of this part, the term `record hold' means a 
requirement, an order, or a directive from an Enterprise or OFHEO that 
the Enterprise is to retain records relating to a particular issue in 
connection with an actual or a potential OFHEO examination, 
investigation, enforcement proceeding, or litigation of which the 
Enterprise has received notice from OFHEO.'' As a result of the 
amendment, OFHEO has determined that it is not necessary to substitute 
the word ``likely'' for the word ``potential.''
Notification by an Enterprise
    Section 1732.7(b)(1) of the proposed regulation would require that 
the record retention program of an Enterprise ``[a]ddress how all 
employees will receive prompt notification of a record hold; * * *.'' 
Fannie Mae stated that it understands that this provision requires only 
that the program provide the mechanism by which all relevant employees 
will be notified of a record hold, and does not require that all 
employees in fact be made aware of each and every record hold issued. 
Otherwise, Fannie Mae stated the result would be a great deal of cost, 
confusion and unnecessary effort, as the vast majority of Enterprise 
employees would have nothing germane to a particular hold. Moreover, 
Fannie Mae stated that industry best practice is not to notify each 
employee at a company of every records hold, but rather to notify only 
those employees who are likely to have records covered by the records 
hold. To that end, Fannie Mae requested that the subsection be modified 
by deleting the words ``all employees'' and substituting the phrase 
``the Enterprise will determine which employees, agents and independent 
contractors need to and.''
    OFHEO understands that not all employees of an Enterprise may fall 
within the scope of the notification requirements of Sec.  1732.7(b)(1) 
in light of the nature of their responsibilities and activities. To 
clarify that understanding, OFHEO has deleted the word ``all'' before 
the word ``employees'' in the final regulation. Additionally, as noted 
above, because agents or independent contractors of the Enterprise have 
been deleted from the definition of the term ``employees,'' specific 
language has been added to the subsection to cover agents or 
independent contractors, as appropriate. As amended, Sec.  1732.7(b)(1) 
reads as follows in the final regulation: ``The record retention 
program of an Enterprise shall: (1) Address how employees and, as 
appropriate, how agents or independent contractors consistent with 
their respective roles and responsibilities to the Enterprise, will 
receive prompt notification of a record hold;''.
    Section 1732.7(b)(3) of the proposed regulation would require that 
the record retention program of an Enterprise ``[p]rovide that any 
employee who is aware of a potential investigation, enforcement 
proceeding, or litigation by OFHEO involving the Enterprise or an 
employee shall notify immediately the legal department of the 
Enterprise and shall retain any records that may be relevant in any way 
to such investigation, enforcement proceeding, or litigation.''
    Similar to comments made on other sections, both Enterprises 
expressed concerns regarding the scope of coverage for the notification 
requirements of Sec.  1732.7(b)(3) and criteria for determining a 
``potential'' investigation, enforcement proceeding, or litigation by 
OFHEO involving the Enterprise or an employee.
    The concerns expressed have been addressed by OFHEO. As noted above 
in its response to comments received on Sec.  1732.2(e), OFHEO has 
deleted coverage of agents or independent contractors acting on behalf 
of an Enterprise from the definition of the term ``employee,'' and 
their coverage is limited to certain sections of the final regulation 
as appropriate. OFHEO also amended subsection (a) of Sec.  1732.7 in 
the final regulation to clarify that the record retention requirements 
of a record hold result upon receipt by an Enterprise of notice from 
OFHEO.
    To further allay any concerns, OFHEO has amended Sec.  1732.7(b)(3) 
by replacing the words ``aware of'' with ``has received notice of'' and 
also by inserting the phrase `` , or otherwise has actual knowledge 
that an issue is subject to such an enforcement proceeding or 
litigation,'' before the words ``shall notify.'' Thus, OFHEO would 
provide written notice to an Enterprise of its intent to conduct an 
investigation some time in the future, thereby providing notice of a 
``potential investigation.'' Also, consistent with other sections 
discussed above, language has been added to the subsection to require 
that agents and independent contractors receive notice of a record hold 
to the extent appropriate in light of the nature of their engagement.
    Specifically, Sec.  1732.7(b)(3) of the final regulation provides 
that the record retention program of an Enterprise shall ``provide that 
any employee and, as appropriate, any agent or independent contractor 
consistent with his or her respective role and responsibility to the 
Enterprise, who has received notice of a potential investigation, 
enforcement proceeding, or litigation by OFHEO involving the Enterprise 
or an employee, or otherwise has actual knowledge that an issue is 
subject to such an investigation, enforcement proceeding or litigation, 
shall notify immediately the legal department of the Enterprise and 
shall retain any records that may be relevant in any way to such 
investigation, enforcement proceeding, or litigation.''
    It is noted that OFHEO also has revised subsection (b)(1) of Sec.  
1732.7, which requires prompt notification of a record hold, to 
include, as appropriate, coverage of agents and independent contractors 
consistent with their roles and responsibilities.

[[Page 62884]]

F. Section 1732.10 Supervisory Action

    Section 1732.10(a) of the proposed regulation would provide that 
failure by an Enterprise to comply with this part may subject the 
Enterprise or the board members, officers, or employees thereof to 
supervisory action by OFHEO under the Act, including but not limited to 
cease-and-desist proceedings, temporary cease-and-desist proceedings, 
and civil money penalties.
    Both Enterprises commented on compliance with the proposed section. 
Fannie Mae noted the necessary complexities of developing a 
comprehensive record retention scheme and suggested that, consistent 
with the approach of federal banking regulators, OFHEO establish a 
specific system for the submission of Enterprise remediation plans 
(over perhaps a thirty-day period) with regard to any deficiencies 
regarding compliance with Sec.  1732.10(a). Fannie Mae stated that such 
a system would provide a routine, efficient framework for the 
resolution of issues that do not merit formal enforcement action, 
without foreclosing the ability to take more formal action, as OFHEO 
deemed appropriate.
    Freddie Mac commented that in light of the lack of bright lines as 
to precisely what is required for full compliance with the regulation, 
the rapidly changing best practices in the records management field, 
and the time required to develop and implement enhancements to records 
management programs, it would be appropriate for OFHEO to first 
consider using feedback, followed by a request for a remediation plan, 
prior to considering formal enforcement actions, in instances where 
OFHEO believes an Enterprise acting in good faith is not in full 
compliance with the regulation. Thus, Freddie Mac requested that Sec.  
1732.10(a) be revised to require appropriate supervisory notification 
before noncompliance would subject the Enterprise to a supervisory 
action by OFHEO.
    OFHEO understands that both Enterprises are in the process of 
developing and upgrading their records management systems to comport 
with changing technology. To that end, both during the 120-day 
implementation period and afterwards, OFHEO encourages each Enterprise 
to submit relevant materials to and confer with its EIC as needed to 
ensure that its record retention program is compliant.

III. Final Regulation

    Except with respect to the technical and clarifying revisions of 
the proposed language as described above, OFHEO has determined to issue 
the regulation as proposed.

Regulatory Impact

Executive Order 12866, Regulatory Planning and Review
    This regulation does not result in an annual effect on the economy 
of $100 million or more or a major increase in costs or prices for 
consumers, individual industries, Federal, State, or local government 
agencies, or geographic regions; or have significant adverse effects on 
competition, employment, investment, productivity, innovation, or on 
the ability of United States-based enterprises to compete with foreign-
based enterprises in domestic or foreign markets. Accordingly, no 
regulatory impact assessment is required. Nevertheless, this regulation 
was submitted to the Office of Management and Budget for review under 
other provisions of Executive Order 12866 as a significant regulatory 
action.
Regulatory Flexibility Act
    The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires that 
a regulation that has a significant economic impact on a substantial 
number of small entities, small businesses, or small organizations must 
include an initial regulatory flexibility analysis describing the 
regulation's impact on small entities. Such an analysis need not be 
undertaken if the agency has certified that the regulation will not 
have a significant economic impact on a substantial number of small 
entities (5 U.S.C. 605(b)). OFHEO has considered the impact of the 
regulation under the Regulatory Flexibility Act. The General Counsel of 
OFHEO certifies that the regulation, as herein adopted, is not likely 
to have a significant economic impact on a substantial number of small 
business entities because the regulation is applicable only to the 
Enterprises which are not small entities for purposes of the Regulatory 
Flexibility Act.
Executive Order 13132, Federalism
    Executive Order 13132 requires that Executive departments and 
agencies identify regulatory actions that have significant federalism 
implications. A regulation has federalism implications if it has 
substantial direct effects on the States, on the relationship or 
distribution of power between the Federal Government and the States, or 
on the distribution of power and responsibilities among various levels 
of Government. The Enterprises are federally chartered corporations 
supervised by OFHEO. This regulation sets forth minimum record 
retention requirements with which the Enterprises must comply for 
Federal supervisory purposes and address the safety and soundness 
authorities of the agency. This regulation does not affect in any 
manner the powers and authorities of any State with respect to the 
Enterprises or alter the distribution of power and responsibilities 
between State and Federal levels of government. Therefore, OFHEO has 
determined that this final regulation has no federalism implications 
that warrant the preparation of a Federalism Assessment in accordance 
with Executive Order 13132.

List of Subjects in 12 CFR Part 1732

    Government-Sponsored Enterprises, Reporting and recordkeeping 
requirements, Records.

0
Accordingly, for the reasons stated in the preamble, OFHEO adds part 
1732 to subchapter C of 12 CFR chapter XVII to read as follows:

Subchapter C--Safety and Soundness

PART 1732--RECORD RETENTION

Subpart A--General
Sec.
1732.1 Purpose and scope.
1732.2 Definitions.
1732.3-4 [Reserved]
Subpart B--Record Retention Program
1732.5 Establishment and evaluation of record retention program.
1732.6 Minimum requirements of record retention program.
1732.7 Record hold.
1732.8-1732.9 [Reserved]
Subpart C--Supervisory Action
1732.10 Supervisory action.

    Authority: 12 U.S.C. 4513(a), 4513(b)(1), 4513(b)(5), 4514, 
4631, 4632, and 4632.

Subpart A--General


Sec.  1732.1  Purpose and scope.

    In furtherance of the safety and soundness authorities of OFHEO, 
this part sets forth minimum requirements in connection with the record 
retention program of each Enterprise. The requirements are intended to 
ensure that complete and accurate records of an Enterprise are readily 
accessible by OFHEO for examination and other supervisory purposes. 
Such access shall be by reasonable means, consistent with the nature 
and availability of the records and existing information technology.


Sec.  1732.2  Definitions.

    For purposes of this part, the term:

[[Page 62885]]

    (a) Act means the Federal Housing Enterprises Financial Safety and 
Soundness Act of 1992, Title XIII of the Housing and Community 
Development Act of 1992, Public Law 102-550, section 1301, Oct. 28, 
1992, 106 Stat. 3672, 3941 through 4012 (1993) (12 U.S.C. 4501 et 
seq.).
    (b) Active record means a record that is necessary to conduct the 
current business of an office or business unit of an Enterprise and, 
therefore, is readily available for consultation and reference.
    (c) Director means the Director of OFHEO, or his or her designee.
    (d) Electronic record means a record created, generated, 
communicated, or stored by electronic means.
    (e) Employee means any officer or employee of an Enterprise or any 
conservator appointed by OFHEO.
    (f) Enterprise means the Federal National Mortgage Association or 
the Federal Home Loan Mortgage Corporation; and the term 
``Enterprises'' means, collectively, the Federal National Mortgage 
Association and the Federal Home Loan Mortgage Corporation.
    (g) E-mail means electronic mail, which is a method of 
communication in which:
    (1) Usually, text is transmitted (but sometimes also graphics and/
or audio information);
    (2) Operations include sending, storing, processing, and receiving 
information;
    (3) Users are allowed to communicate under specified conditions; 
and
    (4) Messages are held in storage until called for by the addressee, 
including any attachment of separate electronic files.
    (h) Inactive record means a record that is seldom used but must be 
retained by an Enterprise for fiscal, legal, historical, or vital 
records purposes.
    (i) OFHEO means the Office of Federal Housing Enterprise Oversight.
    (j) Record means any information whether generated internally or 
received from outside sources by an Enterprise or employee maintained 
in connection with Enterprise business, regardless of the following:
    (1) Form or format, including hard copy documents (e.g., files, 
logs, and reports) and electronic documents (e.g., e-mail, databases, 
spreadsheets, PowerPoint presentations, electronic reporting systems, 
electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), 
and voicemail records;
    (2) Where the information is stored or located, including network 
servers, desktop or laptop computers and handheld computers, other 
wireless devices with text messaging capabilities, and on-site or off-
site at a storage facility;
    (3) Whether the information is maintained or used on Enterprise-
owned equipment, or personal or home computer systems of an employee; 
or
    (4) Whether the information is active or inactive.
    (k) Record retention schedule means a schedule that details the 
categories of records an Enterprise is required to retain and the 
corresponding retention periods. The record retention schedule includes 
all media, such as microfilm and machine-readable computer records, for 
each record category. Reproductions are also included for each record 
category if the original of the official record is not available.
    (l) Retention period means the length of time that records must be 
kept before they are destroyed. Records not authorized for destruction 
have a retention period of ``permanent.''
    (m) Vital records means records that are needed to meet operational 
responsibilities of an Enterprise under emergency or disaster 
conditions (emergency operating records) or to protect the legal and 
financial rights of an Enterprise. Emergency operating records are the 
type of vital records essential to the continued functioning or 
reconstitution of an Enterprise during and after an emergency. A vital 
record may be both an emergency operating record and a legal and 
financial rights record.


Sec. Sec.  1732.3-1732.4  [Reserved]

Subpart B--Record Retention Program


Sec.  1732.5  Establishment and evaluation of record retention program.

    (a) Establishment. An Enterprise shall establish and maintain a 
written record retention program and provide a copy of such program to 
the OFHEO Examiner-in-Charge of the Enterprise within 120 days of the 
effective date of this part, and annually thereafter, and whenever a 
significant revision to the program has been made.
    (b) Evaluation. Management of the Enterprise shall evaluate in 
writing the adequacy and effectiveness of the record retention program 
at least every three years and provide a copy of the evaluation to the 
board of directors and the OFHEO Examiner-in-Charge of the Enterprise.


Sec.  1732.6  Minimum requirements of record retention program.

    (a) Requirements. The record retention program established and 
maintained by an Enterprise under Sec.  1732.5 shall:
    (1) Be reasonably designed to assure that retained records are 
complete and accurate;
    (2) Be reasonably designed to assure that the format of retained 
records and the retention period--
    (i) Are adequate to support litigation and the administrative, 
business, external and internal audit functions of the Enterprise;
    (ii) Comply with requirements of applicable laws and regulations; 
and
    (iii) Permit ready access by the Enterprise and, upon request, by 
the examination and other staff of OFHEO by reasonable means, 
consistent with the nature and availability of the records and existing 
information technology;
    (3) Assign in writing the authorities and responsibilities for 
record retention activities;
    (4) Include policies and procedures concerning record holds, 
consistent with Sec.  1732.7;
    (5) Include an accurate, current, and comprehensive record 
retention schedule that lists records by major categories, 
subcategories, record type, and retention period, which retention 
period is appropriate to the specific record and consistent with 
applicable legal, regulatory, fiscal, and operational and business 
requirements;
    (6) Include adequate security and internal controls to protect 
records from unauthorized access and data alteration; and
    (7) Provide for adequate back-up and recovery of electronic 
records.
    (b) Training. The record retention program shall provide for 
training of and notice to all employees on a periodic basis on their 
record retention responsibilities, including instruction regarding 
penalties provided by law for the unlawful removal or destruction of 
records. The record retention program also shall provide for training 
for the agents or independent contractors of an Enterprise, as 
appropriate, consistent with their respective roles and 
responsibilities to the Enterprise.


Sec.  1732.7  Record hold.

    (a) Definition. For purposes of this part, the term ``record hold'' 
means a requirement, an order, or a directive from an Enterprise or 
OFHEO that the Enterprise is to retain records relating to a particular 
issue in connection with an actual or a potential OFHEO examination, 
investigation, enforcement proceeding, or litigation of which the 
Enterprise has received notice from OFHEO.
    (b) Notification by Enterprise. The record retention program of an 
Enterprise shall:
    (1) Address how employees and, as appropriate, how agents or 
independent

[[Page 62886]]

contractors consistent with their respective roles and responsibilities 
to the Enterprise, will receive prompt notification of a record hold;
    (2) Designate an individual to communicate specific requirements 
and instructions, including, when necessary, the instruction to cease 
immediately any otherwise permissible destruction of records; and,
    (3) Provide that any employee and, as appropriate, any agent or 
independent contractor consistent with his or her respective role and 
responsibility to the Enterprise, who has received notice of a 
potential investigation, enforcement proceeding, or litigation by OFHEO 
involving the Enterprise or an employee, or otherwise has actual 
knowledge that an issue is subject to such an investigation, 
enforcement proceeding or litigation, shall notify immediately the 
legal department of the Enterprise and shall retain any records that 
may be relevant in any way to such investigation, enforcement 
proceeding, or litigation.
    (c) Method of record retention. The record retention program of an 
Enterprise shall address the method by which the Enterprise will retain 
records during a record hold. Specifically, the program shall describe 
the method for the continued preservation of electronic records, 
including e-mails, and the conversion of records from paper to 
electronic format as well as any alternative storage method.
    (d) Access to and retrieval of records. The record retention 
program of an Enterprise shall ensure access to and retrieval of 
records by the Enterprise and access, upon request, by OFHEO, during a 
record hold. Such access shall be by reasonable means, consistent with 
the nature and availability of the records and existing information 
technology.


Sec. Sec.  1732.8-1732.9  [Reserved]

Subpart C--Supervisory Action


Sec.  1732.10  Supervisory action.

    (a) Supervisory action. Failure by an Enterprise to comply with 
this part may subject the Enterprise or the board members, officers, or 
employees thereof to supervisory action by OFHEO under the Act, 
including but not limited to cease-and-desist proceedings, temporary 
cease-and-desist proceedings, and civil money penalties.
    (b) No limitation of authority. This part does not limit or 
restrict the authority of OFHEO to act under its safety and soundness 
mandate, in accordance with the Act. Such authority includes, but is 
not limited to, conducting examinations, requiring reports and 
disclosures, and enforcing compliance with applicable laws, rules, and 
regulations.

    Dated: October 23, 2006.
James B. Lockhart, III,
Director, Office of Federal Housing Enterprise Oversight.
 [FR Doc. E6-18034 Filed 10-26-06; 8:45 am]
BILLING CODE 4220-01-P