Record Retention, 62879-62886 [E6-18034]

Download as PDF rmajette on PROD1PC67 with RULES1 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations FinCEN no later than 30 calendar days from the date the suspicious activity is initially detected, unless there is no identified suspect on the date of detection. If no suspect is identified on the date of detection, a credit union may use an additional 30 calendar days to identify a suspect before filing a SAR. In no case may a credit union take more than 60 days from the date it initially detects a reportable transaction to file a SAR. In situations involving violations requiring immediate attention, such as ongoing money laundering schemes, a credit union must immediately notify, by telephone, an appropriate law enforcement authority and its supervisory authority, in addition to filing a SAR. (ii) Content. A credit union must complete, fully and accurately, SAR form TDF 90–22.47, Suspicious Activity Report (also known as NCUA Form 2362) in accordance with the form’s instructions and 31 CFR Part 103.18. A copy of the SAR form may be obtained from the credit union resources section of NCUA’s Web site, http:// www.ncua.gov, or the regulatory section of FinCEN’s Web site, http:// www.fincen.gov. These sites include other useful guidance on SARs, for example, forms and filing instructions, Frequently Asked Questions, and the FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual. (iii) Compliance. Failure to file a SAR as required by the form’s instructions and 31 CFR Part 103.18 may subject the credit union, its officials, employees, and agents to the assessment of civil money penalties or other administrative actions. (3) Retention of Records. A credit union must maintain a copy of any SAR that it files and the original or business record equivalent of all supporting documentation to the report for a period of five years from the date of the report. Supporting documentation must be identified and maintained by the credit union as such. Supporting documentation is considered a part of the filed report even though it should not be actually filed with the submitted report. A credit union must make all supporting documentation available to appropriate law enforcement authorities and its regulatory supervisory authority upon request. (4) Notification to board of directors. (i) Generally. The management of the credit union must promptly notify its board of directors, or a committee designated by the board of directors to receive such notice, of any SAR filed. (ii) Suspect is a director or committee member. If a credit union files a SAR and the suspect is a director or member VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 of a committee designated by the board of directors to receive notice of SAR filings, the credit union may not notify the suspect, pursuant to 31 U.S.C. 5318(g)(2), but must notify the remaining directors, or designated committee members, who are not suspects. (5) Confidentiality of reports. SARs are confidential. Any credit union, including its officials, employees, and agents, subpoenaed or otherwise requested to disclose a SAR or the information in a SAR must decline to produce the SAR or to provide any information that would disclose that a SAR was prepared or filed, citing this part, applicable law, for example, 31 U.S.C. 5318(g), or both, and notify NCUA of the request. A credit union must make the filed report and all supporting documentation available to appropriate law enforcement authorities and its regulatory supervisory authority upon request. (6) Safe Harbor. Any credit union, including its officials, employees, and agents, that makes a report of suspected or known criminal violations and suspicious activities to law enforcement and financial institution supervisory authorities, including supporting documentation, are protected from liability for any disclosure in the report, or for failure to disclose the existence of the report, or both, to the full extent provided by 31 U.S.C. 5318(g)(3). This protection applies if the report is filed pursuant to this part or is filed on a voluntary basis. [FR Doc. E6–17838 Filed 10–26–06; 8:45 am] BILLING CODE 7535–01–P DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT Office of Federal Housing Enterprise Oversight 12 CFR Part 1732 RIN 2550–AA34 Office of Federal Housing Enterprise Oversight, HUD. ACTION: Final regulation. AGENCY: SUMMARY: The Office of Federal Housing Enterprise Oversight (OFHEO) is issuing a final regulation that sets forth record retention requirements with respect to the record management programs of the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation consistent with the safety and soundness responsibilities of Frm 00005 Fmt 4700 OFHEO under the Federal Housing Enterprises Financial Safety and Soundness Act of 1992. The effective date of this regulation is October 27, 2006. DATES: Tina Dion, Associate General Counsel, telephone (202) 414–3838 (not a toll-free number); Office of Federal Housing Enterprise Oversight, Fourth Floor, 1700 G Street, NW., Washington, DC 20552. The telephone number for the Telecommunications Device for the Deaf is (800) 877–8339. FOR FURTHER INFORMATION CONTACT: SUPPLEMENTARY INFORMATION: I. Background A. Introduction Title XIII of the Housing and Community Development Act of 1992, Public Law 102–550, titled the ‘‘Federal Housing Enterprises Financial Safety and Soundness Act of 1992’’ (Act) (12 U.S.C. 4501 et seq.), established OFHEO as an independent office within the Department of Housing and Urban Development. OFHEO is statutorily mandated to ensure that the Federal National Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac) (collectively, the Enterprises) are capitalized adequately and operate in a safe and sound manner and in compliance with applicable laws, rules, and regulations. The Act provides that the Director of OFHEO (the Director) is authorized to make such determinations, take such actions, and perform such functions as the Director determines are necessary regarding his supervisory authorities, which include examinations of the Enterprises.1 Under the Act, the Director is authorized to conduct on-site examinations of the Enterprises each year, and any other examinations that the Director determines are necessary to ensure their safety and soundness.2 B. Record Retention and Safe and Sound Operations Record Retention PO 00000 62879 Sfmt 4700 OFHEO recognizes that the effectiveness of the examination process is dependent upon the prompt production of complete and accurate records. OFHEO, through the supervisory process, must have access to the records of an Enterprise that are necessary to determine the financial condition of the Enterprise or the details or the purpose of any transaction that 1 12 2 12 E:\FR\FM\27OCR1.SGM U.S.C. 4513(b)(2). U.S.C. 4517(a) and (b). 27OCR1 62880 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations may have a material effect on the financial condition of the Enterprise.3 Retention of such records not only facilitates the examination process, but also allows an Enterprise to manage more effectively its business and detect improper behavior that might cause financial damage to the corporation. Additionally, such records serve as documentation for an Enterprise in any controversy over its business activities or transactions. The importance of sound record retention policies and procedures by regulated institutions also has been recognized by Congress and other federal regulators. Adequate record retention by the institutions has been determined to have a high degree of usefulness in criminal, tax, and regulatory investigations or proceedings, and has been identified as a requisite component of an institution’s operation and management on a safety and soundness basis.4 In addition to facilitating the oversight and enforcement of federal banking laws, adequate record retention has been recognized by Congress as being essential to the oversight and enforcement of the federal securities laws. For example, as mandated by section 802 of the Sarbanes-Oxley Act,5 the U.S. Securities and Exchange Commission adopted rules requiring accounting firms to retain for seven years certain records relevant to their audits and reviews of issuers’ financial statements. Records to be retained include an accounting firm’s workpapers and certain other documents that contain conclusions, opinions, analyses, or financial data related to the audit or review.6 Record Retention Regulation On June 1, 2006, OFHEO published for comment a proposed regulation, at 71 FR 31121, which sets forth proposed safety and soundness requirements with respect to the Enterprises’ record retention programs. The 60-day comment period ended on July 31, 2006. All comments received have been made available to the public in the OFHEO Public Reading Room and have been posted on the OFHEO Web site at http://www.OFHEO.gov. II. Comments Received Comments were received from Freddie Mac and Fannie Mae. Both Enterprises commented in support of the general approach under the proposed regulation. Each Enterprise also provided comments, many of which were technical in nature, on specific provisions of the proposal. All comments were taken into consideration. A discussion of the comments as they related to the proposed sections of the regulation follows. A. § 1732.1 rmajette on PROD1PC67 with RULES1 B. § 1732.2 3 12 U.S.C. 4632(c). e.g., 12 U.S.C. 1829b, and the Guidelines and Interagency Standards for Safety and Soundness at 12 CFR part 30, Appendix A, II, B. 5 Pub. L. 107–204, 116 Stat. 745 (2002). 6 17 CFR part 210. See Release Nos. 33–8180; 34– 47241; IC–2591; FR–66; File No. S7–46–02. 4 See, VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 Purpose and Scope Proposed § 1732.1 states that the purpose of the regulation is to set forth minimum requirements in connection with the record retention program of each Enterprise, and that the requirements are intended to ensure that complete and accurate records of an Enterprise are readily accessible by OFHEO for examination and other supervisory purposes. Both Enterprises made technical comments regarding § 1732.1 with respect to the requirement to provide OFHEO with ready access to records. The Enterprises noted the dynamic nature of records management and the evolving nature of information technology. Freddie Mac commented that the methods of accessing hard copies of documents in off-site storage, electronic documents resident on a Local Area Network, and information in legacy databases, active databases, email, and voicemail are quite different. Freddie Mac also noted that the level of management controls and ready access to records is not the same for records created and maintained years ago as that of records created and maintained today. Moreover, Freddie Mac commented that many of the records are subject to specific legal rights of the Enterprise or of individuals that cannot be disregarded. For these reasons, both Enterprises requested clarification that access to their records under the regulation is intended to mean ‘‘reasonable’’ access. OFHEO understands that all records are not equally accessible. For purposes of clarification, OFHEO has added language to § 1732.1, as well as §§ 1732.6(a)(2)(iii) and 1732.7(d), which clarifies that the sections’ accessibility requirements are intended to be by reasonable means, consistent with the nature and availability of the records and existing information technology. Definitions Active Record As proposed, the term ‘‘active record’’ would be defined under § 1732.2(b) to mean a document that is necessary to conduct the current business of an office PO 00000 Frm 00006 Fmt 4700 Sfmt 4700 or business unit of an Enterprise and, therefore, is readily available for consultation and reference. The Enterprises made technical comments on this definition, as well as the definitions for the terms ‘‘inactive record’’ and ‘‘vital records,’’ requesting that the terms be amended by substituting the word ‘‘record’’ or ‘‘records’’ for ‘‘document’’ or documents,’’ as appropriate. Each Enterprise stated that such amendments would more fully incorporate what is intended by the proposal, i.e., its definition of ‘‘record,’’ and would be consistent with best practices.7 OFHEO agrees with the recommended technical changes and has revised the definitions in § 1732.2(b), (h), and (m) accordingly in the final regulation. Employee As proposed, the definition of the term ‘‘employee’’ would be defined in § 1732.2(e) to mean any officer or employee of an Enterprise, any conservator appointed by OFHEO, or any agent or independent contractor acting on behalf of an Enterprise. Both Enterprises commented that including independent contractors and agents in the definition was significant because such individuals would be subject to several provisions of the proposed regulations, i.e., the training requirements under § 1732.6(b); the record hold notifications under § 1732.7(b); the reporting requirements of potential investigations under § 1732.7(b)(3), and the definition of ‘‘record’’ under § 1732.2(j)(3). Fannie Mae stated that extending the regulation’s general reach in this way would create obligations with regard to parties and documents beyond an Enterprise’s control, would generate considerable burden and expense for the Enterprise without yielding commensurate gains with respect to improved operations or supervision, and would increase litigation risk by exposing the Enterprise to potential liability for the actions (or non-actions) of third parties or individuals outside the Enterprise’s control. Both Enterprises requested that OFHEO not include agents and independent contractors within the general definition of the term ‘‘employee.’’ Rather, they recommended that, to the extent that any section of the regulation is intended to apply to agents 7 In their comments on best practices in the field of records management, both Enterprises referred to the guidelines and standards of the following organizations: The Sedona Conference (2005), the American National Standards Institute/Association of Records Managers and Administrators, and the International Organization for Standardization. E:\FR\FM\27OCR1.SGM 27OCR1 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations or independent contractors, OFHEO amend the section to include specific language making it apply to agents or independent contractors, tailored to what would be appropriate under the circumstances. In response to the comments, OFHEO has deleted the phrase ‘‘or any agent or independent contractor acting on behalf of an Enterprise’’ from § 1732.2(e), and has added specific language for coverage of agents or independent contractors as appropriate in other sections of the final regulation, as noted below. rmajette on PROD1PC67 with RULES1 Inactive Record As proposed, the term ‘‘inactive record’’ would be defined in § 1732.2(h) to mean a document that is seldom used but must be retained by an Enterprise for legislative, fiscal, legal, archival, historical, or vital records purposes. In its technical comment, Fannie Mae requested that the words ‘‘legislative’’ and ‘‘archival’’ be deleted from the definition. Fannie Mae stated that the words do not appear to add anything substantive to the other qualifying terms, and that the proposal provides no elaboration as to what these words are intended to capture that is not otherwise covered. Fannie Mae noted that, as an industry practice, records generally are defined for record retention purposes as having operational, vital record, legal or regulatory, fiscal, and historical value. OFHEO concurs with Fannie Mae’s technical comment and has revised the definition of ‘‘inactive record’’ accordingly in the final regulation. Also, as noted above, the word ‘‘record’’ has been substituted for the word ‘‘document.’’ Record As proposed, the definition of the term ‘‘record’’ in § 1732.2(j) would mean: Any document whether generated internally or received from outside sources by an Enterprise or employee in connection with Enterprise business, regardless of the following: (1) Form or format, including hard copy documents (e.g., files, logs, and reports) and electronic documents (e.g., e-mail, databases, spreadsheets, PowerPoint presentations, electronic reporting systems, electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), and voicemail records; (2) where the document is stored or located, including network servers, desktop or laptop computers and handheld computers, other wireless devices with text messaging capabilities, and on-site or off-site at a storage facility; (3) whether the document is maintained or used on Enterprise-owned equipment, or personal or home computer systems VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 of an employee; or (4) whether the document is active or inactive. Fannie Mae recommended that the proposed regulation use the definition of the term ‘‘record’’ provided in Internal Organization for Standards, ISO 15849–1 § 3.15. That standard provides that a record ‘‘is information created, received, and maintained as evidence and information by an organization or person, in the pursuance of legal obligations or in the transaction of business.’’ Freddie Mac, also referencing industry standards, requested that the word ‘‘information’’ be used in the definition, rather than ‘‘document.’’ Freddie Mac requested another technical change that would modify the definition by inserting the term ‘‘maintained’’ between the word ‘‘employee’’ and the phrase ‘‘in connection with.’’ Both Enterprises explained that the recommended revisions better reflect the corporate practices and supervisory concerns. OFHEO agrees with the technical changes recommended by Freddie Mac and has revised the definition of the term ‘‘record’’ in § 1732.2(j) to read ‘‘any information whether generated internally or received from outside sources or employee maintained in connection with Enterprise business * * *’’ Conforming changes have also been made to subsections (2), (3), and (4) accordingly. OFHEO does not agree to make use of the entire ISO definition for the definition of the term ‘‘records,’’ as recommended by Fannie Mae, because other elements of the ISO definition are encompassed in § 1732.2 under the definition of the terms ‘‘active record’’ and ‘‘vital records.’’ In addition, the language of the definition in § 1732.2(j), namely ‘‘whether generated internally or received from outside sources’’ is necessary to ensure that records are appropriately retained even if they have not been generated or created by the Enterprise. Record Retention Schedule As proposed, the definition of the term ‘‘record retention schedule’’ would be defined in § 1732.2(k) to mean ‘‘a form that details the categories of records an Enterprise is required to store and their corresponding record retention periods. The record retention schedule includes reproductions, as well as all media, including microfilm and machine-readable computer records, for each record category.’’ Fannie Mae commented that the inclusion of the term ‘‘reproductions’’ in the definition would be inconsistent with the standard industry approach, which does not require retention of PO 00000 Frm 00007 Fmt 4700 Sfmt 4700 62881 copies because of the burden and expense of such retention. OFHEO understands that retention of all reproductions or copies of records would be burdensome and expensive. Reproductions would be listed in a record retention schedule only if the original of the official record is not available. Accordingly, OFHEO has revised the second sentence of the proposed definition to read: ‘‘The record retention schedule includes all media, such as microfilm and machine-readable computer records, for each record category. Reproductions are also included for each record category if the original of the official record is not available.’’ Fannie Mae also commented that the record retention schedule is envisioned as a ‘‘form.’’ Fannie Mae also requested a technical change to the definition, i.e., substitution of the word ‘‘schedule’’ for the term ‘‘form,’’ to be consistent with the standard industry approach. OFHEO agrees and has changed the term ‘‘form’’ to ‘‘schedule’’ in the definition of the term ‘‘record retention schedule’’ in the final regulation. Record Period As proposed, the definition of the term ‘‘Retention period’’ would be defined in § 1732.2(l) to mean the length of time that records must be kept before they are destroyed. Records not authorized for destruction would have a retention period of ‘‘permanent.’’ Fannie Mae made a technical comment that the definition is ambiguous, and requested that the definition be changed to state that: ‘‘Records not provided with a ‘retention period’ must be retained, unless scheduled for destruction.’’ OFHEO has determined that the definition, as proposed, is clear and, therefore, has not made the technical change. Vital Records As proposed, the term ‘‘vital records’’ would be defined in § 1732.2(m) to mean documents that are needed to meet operational responsibilities of an Enterprise under emergency or disaster conditions (emergency operating records) or to protect the legal and financial rights of an Enterprise and those affected by Enterprise activities. Emergency operating records would be defined to mean the type of vital records essential to the continued functioning or reconstitution of an Enterprise during and after an emergency. Moreover, a vital record would be further defined to include a record that could be both an emergency operating record and a legal and financial rights record. E:\FR\FM\27OCR1.SGM 27OCR1 62882 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations rmajette on PROD1PC67 with RULES1 Fannie Mae commented that the definition includes documents ‘‘needed * * * to protect the legal and financial rights of * * * those affected by Enterprise activities.’’ Fannie Mae stated that the company is very concerned about the possible impact of this language, as it arguably could be read to create new, unpredictable obligations to third parties, and thus potential legal risk. To allay such concerns and to be consistent with industry best practices, Fannie Mae requested that the words ‘‘those affected by Enterprise activities’’ be substituted with the phrase ‘‘its employees, creditors, customers and holders of its securities.’’ In response to the comment, OFHEO has determined to delete the words ‘‘those affected by Enterprise activities’’ from the definition of the term ‘‘vital records’’ in the final regulation. Also, as noted above, the word ‘‘records’’ has been substituted for the word ‘‘documents.’’ C. Section 1732.5 Establishment and Evaluation of Record Retention Program Section 1732.5(a) of the proposed regulation would require each Enterprise to establish and maintain a written record retention program and provide a copy of such program to the Examiner-in-Charge (EIC) of the Enterprise within 120 days of the regulation’s effective date, and annually thereafter, and whenever a significant revision to the program has been made. Fannie Mae advised in its comments that the company will be prepared to submit a written plan within 120 days of the effective date on the understanding that the EIC will advise if the planned program is acceptable before investments are made in order to avoid costly changes and unnecessary delays. For the build-out process, Fannie Mae further advised that the company anticipates using one or more pilots to test and improve its proposed policy, approach and technology. Freddie Mac stated that the company expects to include in its initial report to OFHEO a snapshot of its current records retention program, including any additional enhancements that are implemented by the date of that report, together with a description of planned enhancements (both short-term and long-term) to that program. That first report will reflect that Freddie Mac has a records management program in place that encompasses records retention, but that the company is continuing to develop and strengthen its program. Freddie Mac noted that with OFHEO feedback on both its record retention program, and on planned enhancements, the corporation can align VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 the records retention program with the expectations of OFHEO under the final regulation. OFHEO understands that both Enterprises are in the process of developing and upgrading their records management systems to comport with changing technology and the requirements of the final regulation. To that end, OFHEO encourages an Enterprise to submit relevant materials to and confer with its EIC as needed to ensure that its record retention program is compliant. D. Section 1732.6 Minimum Requirements of Record Retention Program Requirements Section 1732.6(a)(2)(iii) of the proposed regulation would require that the record retention program established and maintained by an Enterprise be reasonably designed to assure that the format of retained records and the retention period permit ready access by the Enterprise, and, upon request, by the examination and other staff of OFHEO. As noted above, in response to technical comments received on § 1732.1, OFHEO has revised subsection (a)(2)(iii) of § 1732.6 in the final regulation to clarify the accessibility requirement to mean access by reasonable means, consistent with the nature and availability of the records and existing information technology. Additionally, Freddie Mac made a technical comment requesting that OFHEO revise this subsection (and § 1732.7(d), which addresses access to and retrieval of records during a record hold) to include at the end the phrase ‘‘subject to applicable legal rights.’’ OFHEO has determined that it is not necessary to add the requested phrase to either subsection because the record retention requirements of the regulation are imposed for purposes of supervisory access by OFHEO to Enterprise records and do not result in a waiver of existing rights. Section 1732.6(a)(5) of the proposed regulation would require that the record retention program established and maintained by an Enterprise include an accurate, current, and comprehensive record retention schedule that lists records by major categories, subcategories, record type, and retention period, which retention period is appropriate to the specific record and consistent with applicable legal, regulatory, fiscal, and administrative requirements. Fannie Mae commented that the term ‘‘administrative’’ is ambiguous. Fannie Mae stated that, if the term is intended to reference administrative requirements of OFHEO, the term ‘‘regulatory’’ PO 00000 Frm 00008 Fmt 4700 Sfmt 4700 already captures these requirements, so the term ‘‘administrative’’ should be deleted. If, however, what is intended to be captured are the Enterprises’ business needs, the term ‘‘operational’’ or ‘‘business’’ should be substituted for the term ‘‘administrative.’’ OFHEO notes that the term ‘‘administrative’’ refers to requirements that are internal to a company, i.e., the Enterprise. Therefore, the term is not duplicative of the term ‘‘regulatory.’’ However, for purposes of clarification, OFHEO has determined to revise § 1732.6(a)(5) in the final regulation by substituting the terms ‘‘operational and business’’ for the term ‘‘administrative.’’ Training Section 1732.6(b) of the proposed regulation would require that an Enterprise’s record retention program provide for training of and notice to all employees on a periodic basis on their record retention responsibilities, including instruction regarding penalties provided by law for the unlawful removal or destruction of records. The Enterprises commented that this provision should be modified to include specific language tailored to requirements appropriate for independent contractors and agents. In its technical comment, Freddie Mac requested that OFHEO modify the proposal to provide that the training provision applies only to actual employees of an Enterprise, and that the Enterprise also takes reasonable steps to ensure that agents or independent contractors who are involved with creating or maintaining Enterprise records receive notice and/or training regarding record retention responsibilities in a manner appropriate to their engagement. Fannie Mae requested amending the proposed section to include specific language making training for agents or independent contractors consistent with their roles and responsibilities. As noted above in response to comments on § 1732.2(e), OFHEO has added specific language for coverage of agents or independent contractors to several sections of the final regulation. With respect to § 1732.6, a second sentence has been added to subsection (b) that reads as follows: ‘‘The record retention program also shall provide for training for the agents or independent contractors of an Enterprise, as appropriate, consistent with their respective roles and responsibilities to the Enterprise.’’ E:\FR\FM\27OCR1.SGM 27OCR1 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations E. Section 1732.7 Record Hold rmajette on PROD1PC67 with RULES1 Definition Section 1732.7(a) of the proposed regulation would define the term ‘‘record hold’’ to mean a requirement, an order, or a directive from an Enterprise or OFHEO that the Enterprise is to retain records relating to a particular issue in connection with an actual or a potential OFHEO examination, investigation, enforcement proceeding, or litigation. Both Enterprises expressed concern that criteria for a record hold is stated in terms of a ‘‘potential’’ investigation, enforcement proceeding or litigation. Fannie Mae commented that virtually everything that an Enterprise does raises some ‘‘potential’’ for litigation, and virtually every question that OFHEO asks raises some ‘‘potential’’ for an OFHEO investigation. Fannie Mae stated that the overly broad and ambiguous standard would needlessly create an onerous burden both on the Enterprises and OFHEO. Fannie Mae requested that the word ‘‘likely’’ be substituted for the word ‘‘potential.’’ Freddie Mac made the technical comment that the term ‘‘potential’’ requires or suggests that an Enterprise or employee is obligated and accountable to accurately guess when a matter could possibly give rise to an OFHEO examination, investigation, enforcement proceeding or litigation, resulting in an impossible standard with which to comply in practice. Freddie Mac requested that subsection (a) of § 1732.7 be modified to require that an Enterprise receive notice from OFHEO. To address these comments, OFHEO has amended subsection (a) of § 1732.7 in the final regulation to clarify that the record retention requirements of a record hold result upon receipt by the Enterprise of notice from OFHEO. As amended, subsection (a) reads as follows: ‘‘For purposes of this part, the term ‘record hold’ means a requirement, an order, or a directive from an Enterprise or OFHEO that the Enterprise is to retain records relating to a particular issue in connection with an actual or a potential OFHEO examination, investigation, enforcement proceeding, or litigation of which the Enterprise has received notice from OFHEO.’’ As a result of the amendment, OFHEO has determined that it is not necessary to substitute the word ‘‘likely’’ for the word ‘‘potential.’’ Notification by an Enterprise Section 1732.7(b)(1) of the proposed regulation would require that the record retention program of an Enterprise ‘‘[a]ddress how all employees will VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 receive prompt notification of a record hold; * * *.’’ Fannie Mae stated that it understands that this provision requires only that the program provide the mechanism by which all relevant employees will be notified of a record hold, and does not require that all employees in fact be made aware of each and every record hold issued. Otherwise, Fannie Mae stated the result would be a great deal of cost, confusion and unnecessary effort, as the vast majority of Enterprise employees would have nothing germane to a particular hold. Moreover, Fannie Mae stated that industry best practice is not to notify each employee at a company of every records hold, but rather to notify only those employees who are likely to have records covered by the records hold. To that end, Fannie Mae requested that the subsection be modified by deleting the words ‘‘all employees’’ and substituting the phrase ‘‘the Enterprise will determine which employees, agents and independent contractors need to and.’’ OFHEO understands that not all employees of an Enterprise may fall within the scope of the notification requirements of § 1732.7(b)(1) in light of the nature of their responsibilities and activities. To clarify that understanding, OFHEO has deleted the word ‘‘all’’ before the word ‘‘employees’’ in the final regulation. Additionally, as noted above, because agents or independent contractors of the Enterprise have been deleted from the definition of the term ‘‘employees,’’ specific language has been added to the subsection to cover agents or independent contractors, as appropriate. As amended, § 1732.7(b)(1) reads as follows in the final regulation: ‘‘The record retention program of an Enterprise shall: (1) Address how employees and, as appropriate, how agents or independent contractors consistent with their respective roles and responsibilities to the Enterprise, will receive prompt notification of a record hold;’’. Section 1732.7(b)(3) of the proposed regulation would require that the record retention program of an Enterprise ‘‘[p]rovide that any employee who is aware of a potential investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee shall notify immediately the legal department of the Enterprise and shall retain any records that may be relevant in any way to such investigation, enforcement proceeding, or litigation.’’ Similar to comments made on other sections, both Enterprises expressed concerns regarding the scope of coverage for the notification requirements of § 1732.7(b)(3) and PO 00000 Frm 00009 Fmt 4700 Sfmt 4700 62883 criteria for determining a ‘‘potential’’ investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee. The concerns expressed have been addressed by OFHEO. As noted above in its response to comments received on § 1732.2(e), OFHEO has deleted coverage of agents or independent contractors acting on behalf of an Enterprise from the definition of the term ‘‘employee,’’ and their coverage is limited to certain sections of the final regulation as appropriate. OFHEO also amended subsection (a) of § 1732.7 in the final regulation to clarify that the record retention requirements of a record hold result upon receipt by an Enterprise of notice from OFHEO. To further allay any concerns, OFHEO has amended § 1732.7(b)(3) by replacing the words ‘‘aware of’’ with ‘‘has received notice of’’ and also by inserting the phrase ‘‘ , or otherwise has actual knowledge that an issue is subject to such an enforcement proceeding or litigation,’’ before the words ‘‘shall notify.’’ Thus, OFHEO would provide written notice to an Enterprise of its intent to conduct an investigation some time in the future, thereby providing notice of a ‘‘potential investigation.’’ Also, consistent with other sections discussed above, language has been added to the subsection to require that agents and independent contractors receive notice of a record hold to the extent appropriate in light of the nature of their engagement. Specifically, § 1732.7(b)(3) of the final regulation provides that the record retention program of an Enterprise shall ‘‘provide that any employee and, as appropriate, any agent or independent contractor consistent with his or her respective role and responsibility to the Enterprise, who has received notice of a potential investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee, or otherwise has actual knowledge that an issue is subject to such an investigation, enforcement proceeding or litigation, shall notify immediately the legal department of the Enterprise and shall retain any records that may be relevant in any way to such investigation, enforcement proceeding, or litigation.’’ It is noted that OFHEO also has revised subsection (b)(1) of § 1732.7, which requires prompt notification of a record hold, to include, as appropriate, coverage of agents and independent contractors consistent with their roles and responsibilities. E:\FR\FM\27OCR1.SGM 27OCR1 62884 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations rmajette on PROD1PC67 with RULES1 F. Section 1732.10 Supervisory Action Section 1732.10(a) of the proposed regulation would provide that failure by an Enterprise to comply with this part may subject the Enterprise or the board members, officers, or employees thereof to supervisory action by OFHEO under the Act, including but not limited to cease-and-desist proceedings, temporary cease-and-desist proceedings, and civil money penalties. Both Enterprises commented on compliance with the proposed section. Fannie Mae noted the necessary complexities of developing a comprehensive record retention scheme and suggested that, consistent with the approach of federal banking regulators, OFHEO establish a specific system for the submission of Enterprise remediation plans (over perhaps a thirty-day period) with regard to any deficiencies regarding compliance with § 1732.10(a). Fannie Mae stated that such a system would provide a routine, efficient framework for the resolution of issues that do not merit formal enforcement action, without foreclosing the ability to take more formal action, as OFHEO deemed appropriate. Freddie Mac commented that in light of the lack of bright lines as to precisely what is required for full compliance with the regulation, the rapidly changing best practices in the records management field, and the time required to develop and implement enhancements to records management programs, it would be appropriate for OFHEO to first consider using feedback, followed by a request for a remediation plan, prior to considering formal enforcement actions, in instances where OFHEO believes an Enterprise acting in good faith is not in full compliance with the regulation. Thus, Freddie Mac requested that § 1732.10(a) be revised to require appropriate supervisory notification before noncompliance would subject the Enterprise to a supervisory action by OFHEO. OFHEO understands that both Enterprises are in the process of developing and upgrading their records management systems to comport with changing technology. To that end, both during the 120-day implementation period and afterwards, OFHEO encourages each Enterprise to submit relevant materials to and confer with its EIC as needed to ensure that its record retention program is compliant. III. Final Regulation Except with respect to the technical and clarifying revisions of the proposed language as described above, OFHEO VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 has determined to issue the regulation as proposed. Regulatory Impact Executive Order 12866, Regulatory Planning and Review This regulation does not result in an annual effect on the economy of $100 million or more or a major increase in costs or prices for consumers, individual industries, Federal, State, or local government agencies, or geographic regions; or have significant adverse effects on competition, employment, investment, productivity, innovation, or on the ability of United States-based enterprises to compete with foreign-based enterprises in domestic or foreign markets. Accordingly, no regulatory impact assessment is required. Nevertheless, this regulation was submitted to the Office of Management and Budget for review under other provisions of Executive Order 12866 as a significant regulatory action. Regulatory Flexibility Act The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires that a regulation that has a significant economic impact on a substantial number of small entities, small businesses, or small organizations must include an initial regulatory flexibility analysis describing the regulation’s impact on small entities. Such an analysis need not be undertaken if the agency has certified that the regulation will not have a significant economic impact on a substantial number of small entities (5 U.S.C. 605(b)). OFHEO has considered the impact of the regulation under the Regulatory Flexibility Act. The General Counsel of OFHEO certifies that the regulation, as herein adopted, is not likely to have a significant economic impact on a substantial number of small business entities because the regulation is applicable only to the Enterprises which are not small entities for purposes of the Regulatory Flexibility Act. Executive Order 13132, Federalism Executive Order 13132 requires that Executive departments and agencies identify regulatory actions that have significant federalism implications. A regulation has federalism implications if it has substantial direct effects on the States, on the relationship or distribution of power between the Federal Government and the States, or on the distribution of power and responsibilities among various levels of Government. The Enterprises are federally chartered corporations PO 00000 Frm 00010 Fmt 4700 Sfmt 4700 supervised by OFHEO. This regulation sets forth minimum record retention requirements with which the Enterprises must comply for Federal supervisory purposes and address the safety and soundness authorities of the agency. This regulation does not affect in any manner the powers and authorities of any State with respect to the Enterprises or alter the distribution of power and responsibilities between State and Federal levels of government. Therefore, OFHEO has determined that this final regulation has no federalism implications that warrant the preparation of a Federalism Assessment in accordance with Executive Order 13132. List of Subjects in 12 CFR Part 1732 Government-Sponsored Enterprises, Reporting and recordkeeping requirements, Records. Accordingly, for the reasons stated in the preamble, OFHEO adds part 1732 to subchapter C of 12 CFR chapter XVII to read as follows: I Subchapter C—Safety and Soundness PART 1732—RECORD RETENTION Subpart A—General Sec. 1732.1 Purpose and scope. 1732.2 Definitions. 1732.3–4 [Reserved] Subpart B—Record Retention Program 1732.5 Establishment and evaluation of record retention program. 1732.6 Minimum requirements of record retention program. 1732.7 Record hold. 1732.8–1732.9 [Reserved] Subpart C—Supervisory Action 1732.10 Supervisory action. Authority: 12 U.S.C. 4513(a), 4513(b)(1), 4513(b)(5), 4514, 4631, 4632, and 4632. Subpart A—General § 1732.1 Purpose and scope. In furtherance of the safety and soundness authorities of OFHEO, this part sets forth minimum requirements in connection with the record retention program of each Enterprise. The requirements are intended to ensure that complete and accurate records of an Enterprise are readily accessible by OFHEO for examination and other supervisory purposes. Such access shall be by reasonable means, consistent with the nature and availability of the records and existing information technology. § 1732.2 Definitions. For purposes of this part, the term: E:\FR\FM\27OCR1.SGM 27OCR1 rmajette on PROD1PC67 with RULES1 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations (a) Act means the Federal Housing Enterprises Financial Safety and Soundness Act of 1992, Title XIII of the Housing and Community Development Act of 1992, Public Law 102–550, section 1301, Oct. 28, 1992, 106 Stat. 3672, 3941 through 4012 (1993) (12 U.S.C. 4501 et seq.). (b) Active record means a record that is necessary to conduct the current business of an office or business unit of an Enterprise and, therefore, is readily available for consultation and reference. (c) Director means the Director of OFHEO, or his or her designee. (d) Electronic record means a record created, generated, communicated, or stored by electronic means. (e) Employee means any officer or employee of an Enterprise or any conservator appointed by OFHEO. (f) Enterprise means the Federal National Mortgage Association or the Federal Home Loan Mortgage Corporation; and the term ‘‘Enterprises’’ means, collectively, the Federal National Mortgage Association and the Federal Home Loan Mortgage Corporation. (g) E-mail means electronic mail, which is a method of communication in which: (1) Usually, text is transmitted (but sometimes also graphics and/or audio information); (2) Operations include sending, storing, processing, and receiving information; (3) Users are allowed to communicate under specified conditions; and (4) Messages are held in storage until called for by the addressee, including any attachment of separate electronic files. (h) Inactive record means a record that is seldom used but must be retained by an Enterprise for fiscal, legal, historical, or vital records purposes. (i) OFHEO means the Office of Federal Housing Enterprise Oversight. (j) Record means any information whether generated internally or received from outside sources by an Enterprise or employee maintained in connection with Enterprise business, regardless of the following: (1) Form or format, including hard copy documents (e.g., files, logs, and reports) and electronic documents (e.g., e-mail, databases, spreadsheets, PowerPoint presentations, electronic reporting systems, electronic tapes and back-up tapes, optical discs, CD–ROMS, and DVDs), and voicemail records; (2) Where the information is stored or located, including network servers, desktop or laptop computers and handheld computers, other wireless devices with text messaging capabilities, VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 and on-site or off-site at a storage facility; (3) Whether the information is maintained or used on Enterpriseowned equipment, or personal or home computer systems of an employee; or (4) Whether the information is active or inactive. (k) Record retention schedule means a schedule that details the categories of records an Enterprise is required to retain and the corresponding retention periods. The record retention schedule includes all media, such as microfilm and machine-readable computer records, for each record category. Reproductions are also included for each record category if the original of the official record is not available. (l) Retention period means the length of time that records must be kept before they are destroyed. Records not authorized for destruction have a retention period of ‘‘permanent.’’ (m) Vital records means records that are needed to meet operational responsibilities of an Enterprise under emergency or disaster conditions (emergency operating records) or to protect the legal and financial rights of an Enterprise. Emergency operating records are the type of vital records essential to the continued functioning or reconstitution of an Enterprise during and after an emergency. A vital record may be both an emergency operating record and a legal and financial rights record. §§ 1732.3–1732.4 [Reserved] Subpart B—Record Retention Program § 1732.5 Establishment and evaluation of record retention program. (a) Establishment. An Enterprise shall establish and maintain a written record retention program and provide a copy of such program to the OFHEO Examinerin-Charge of the Enterprise within 120 days of the effective date of this part, and annually thereafter, and whenever a significant revision to the program has been made. (b) Evaluation. Management of the Enterprise shall evaluate in writing the adequacy and effectiveness of the record retention program at least every three years and provide a copy of the evaluation to the board of directors and the OFHEO Examiner-in-Charge of the Enterprise. § 1732.6 Minimum requirements of record retention program. (a) Requirements. The record retention program established and maintained by an Enterprise under § 1732.5 shall: PO 00000 Frm 00011 Fmt 4700 Sfmt 4700 62885 (1) Be reasonably designed to assure that retained records are complete and accurate; (2) Be reasonably designed to assure that the format of retained records and the retention period— (i) Are adequate to support litigation and the administrative, business, external and internal audit functions of the Enterprise; (ii) Comply with requirements of applicable laws and regulations; and (iii) Permit ready access by the Enterprise and, upon request, by the examination and other staff of OFHEO by reasonable means, consistent with the nature and availability of the records and existing information technology; (3) Assign in writing the authorities and responsibilities for record retention activities; (4) Include policies and procedures concerning record holds, consistent with § 1732.7; (5) Include an accurate, current, and comprehensive record retention schedule that lists records by major categories, subcategories, record type, and retention period, which retention period is appropriate to the specific record and consistent with applicable legal, regulatory, fiscal, and operational and business requirements; (6) Include adequate security and internal controls to protect records from unauthorized access and data alteration; and (7) Provide for adequate back-up and recovery of electronic records. (b) Training. The record retention program shall provide for training of and notice to all employees on a periodic basis on their record retention responsibilities, including instruction regarding penalties provided by law for the unlawful removal or destruction of records. The record retention program also shall provide for training for the agents or independent contractors of an Enterprise, as appropriate, consistent with their respective roles and responsibilities to the Enterprise. § 1732.7 Record hold. (a) Definition. For purposes of this part, the term ‘‘record hold’’ means a requirement, an order, or a directive from an Enterprise or OFHEO that the Enterprise is to retain records relating to a particular issue in connection with an actual or a potential OFHEO examination, investigation, enforcement proceeding, or litigation of which the Enterprise has received notice from OFHEO. (b) Notification by Enterprise. The record retention program of an Enterprise shall: (1) Address how employees and, as appropriate, how agents or independent E:\FR\FM\27OCR1.SGM 27OCR1 62886 Federal Register / Vol. 71, No. 208 / Friday, October 27, 2006 / Rules and Regulations contractors consistent with their respective roles and responsibilities to the Enterprise, will receive prompt notification of a record hold; (2) Designate an individual to communicate specific requirements and instructions, including, when necessary, the instruction to cease immediately any otherwise permissible destruction of records; and, (3) Provide that any employee and, as appropriate, any agent or independent contractor consistent with his or her respective role and responsibility to the Enterprise, who has received notice of a potential investigation, enforcement proceeding, or litigation by OFHEO involving the Enterprise or an employee, or otherwise has actual knowledge that an issue is subject to such an investigation, enforcement proceeding or litigation, shall notify immediately the legal department of the Enterprise and shall retain any records that may be relevant in any way to such investigation, enforcement proceeding, or litigation. (c) Method of record retention. The record retention program of an Enterprise shall address the method by which the Enterprise will retain records during a record hold. Specifically, the program shall describe the method for the continued preservation of electronic records, including e-mails, and the conversion of records from paper to electronic format as well as any alternative storage method. (d) Access to and retrieval of records. The record retention program of an Enterprise shall ensure access to and retrieval of records by the Enterprise and access, upon request, by OFHEO, during a record hold. Such access shall be by reasonable means, consistent with the nature and availability of the records and existing information technology. §§ 1732.8–1732.9 [Reserved] Subpart C—Supervisory Action rmajette on PROD1PC67 with RULES1 § 1732.10 Supervisory action. (a) Supervisory action. Failure by an Enterprise to comply with this part may subject the Enterprise or the board members, officers, or employees thereof to supervisory action by OFHEO under the Act, including but not limited to cease-and-desist proceedings, temporary cease-and-desist proceedings, and civil money penalties. (b) No limitation of authority. This part does not limit or restrict the authority of OFHEO to act under its safety and soundness mandate, in accordance with the Act. Such authority includes, but is not limited to, conducting examinations, requiring VerDate Aug<31>2005 14:48 Oct 26, 2006 Jkt 211001 reports and disclosures, and enforcing compliance with applicable laws, rules, and regulations. Dated: October 23, 2006. James B. Lockhart, III, Director, Office of Federal Housing Enterprise Oversight. [FR Doc. E6–18034 Filed 10–26–06; 8:45 am] BILLING CODE 4220–01–P FOR FURTHER INFORMATION CONTACT: Patrick Gillespie, Aerospace Engineer, Cabin Safety and Environmental Systems Branch, ANM–150S, FAA, Seattle Aircraft Certification Office, 1601 Lind Avenue, SW., Renton, Washington 98057–3356; telephone (425) 917–6429; fax (425) 917–6590. SUPPLEMENTARY INFORMATION: Examining the Docket DEPARTMENT OF TRANSPORTATION Federal Aviation Administration 14 CFR Part 39 [Docket No. FAA–2005–21968; Directorate Identifier 2005–NM–077–AD; Amendment 39–14798; AD 2006–22–01] RIN 2120–AA64 Airworthiness Directives; Boeing Model 757–200, –200CB, and –300 Series Airplanes Federal Aviation Administration (FAA), Department of Transportation (DOT). ACTION: Final rule. AGENCY: SUMMARY: The FAA is adopting a new airworthiness directive (AD) for certain Boeing Model 757–200, –200CB, and –300 series airplanes. This AD requires repetitive detailed inspections for proper functioning of the girt bar leaf springs for the escape slides to ensure the leaf springs retain the sliders and the required 0.37-inch minimum engagement between the sliders and floor fittings is achieved at passenger doors 1, 2, and 4, and corrective actions if necessary. This AD results from a report that the escape slides failed to deploy correctly during an operator’s tests of the escape slides. We are issuing this AD to prevent escape slides from disengaging from the airplane during deployment or in use, which could result in injuries to passengers or flightcrew. DATES: This AD becomes effective December 1, 2006. The Director of the Federal Register approved the incorporation by reference of certain publications listed in the AD as of December 1, 2006. ADDRESSES: You may examine the AD docket on the Internet at http:// dms.dot.gov or in person at the Docket Management Facility, U.S. Department of Transportation, 400 Seventh Street, SW., Nassif Building, Room PL–401, Washington, DC. Contact Boeing Commercial Airplanes, P.O. Box 3707, Seattle, Washington 98124–2207, for service information identified in this AD. PO 00000 Frm 00012 Fmt 4700 Sfmt 4700 You may examine the AD docket on the Internet at http://dms.dot.gov or in person at the Docket Management Facility office between 9 a.m. and 5 p.m., Monday through Friday, except Federal holidays. The Docket Management Facility office (telephone (800) 647–5227) is located on the plaza level of the Nassif Building at the street address stated in the ADDRESSES section. Discussion The FAA issued a supplemental notice of proposed rulemaking (NPRM) to amend 14 CFR part 39 to include an AD that would apply to certain Boeing Model 757–200, –200CB, and –300 series airplanes. That supplemental NPRM was published in the Federal Register on May 19, 2006 (71 FR 29092). That supplemental NPRM proposed to require repetitive detailed inspections for proper functioning of the girt bar leaf springs for the escape slides to ensure the leaf springs retain the sliders and the required 0.37-inch minimum engagement between the sliders and floor fittings is achieved at passenger doors 1, 2, and 4, and corrective actions if necessary. Comments We provided the public the opportunity to participate in the development of this AD. We have considered the comments received. Support for the Supplemental NPRM Boeing supports the contents of the supplemental NPRM. Request To Clarify Prohibition for Bending Girt Bar One commenter, a private citizen, states that it is unclear what to do if the subject girt bar retention leaf springs are bent before the effective date of the AD. The commenter states that it is virtually impossible to determine if such springs were bent before. Therefore, the commenter requests that we clarify paragraphs (f) and (g) of the supplemental NPRM if the intent is to prohibit bending of the spring in the future. The commenter suggests that we revise the final rule to add the following words to paragraphs (f) and (g): ‘‘* * * E:\FR\FM\27OCR1.SGM 27OCR1

Agencies

[Federal Register Volume 71, Number 208 (Friday, October 27, 2006)]
[Rules and Regulations]
[Pages 62879-62886]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E6-18034]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

Office of Federal Housing Enterprise Oversight

12 CFR Part 1732

RIN 2550-AA34


Record Retention

AGENCY: Office of Federal Housing Enterprise Oversight, HUD.

ACTION: Final regulation.

-----------------------------------------------------------------------

SUMMARY: The Office of Federal Housing Enterprise Oversight (OFHEO) is 
issuing a final regulation that sets forth record retention 
requirements with respect to the record management programs of the 
Federal National Mortgage Association and the Federal Home Loan 
Mortgage Corporation consistent with the safety and soundness 
responsibilities of OFHEO under the Federal Housing Enterprises 
Financial Safety and Soundness Act of 1992.

DATES: The effective date of this regulation is October 27, 2006.

FOR FURTHER INFORMATION CONTACT: Tina Dion, Associate General Counsel, 
telephone (202) 414-3838 (not a toll-free number); Office of Federal 
Housing Enterprise Oversight, Fourth Floor, 1700 G Street, NW., 
Washington, DC 20552. The telephone number for the Telecommunications 
Device for the Deaf is (800) 877-8339.

SUPPLEMENTARY INFORMATION:

I. Background

A. Introduction

    Title XIII of the Housing and Community Development Act of 1992, 
Public Law 102-550, titled the ``Federal Housing Enterprises Financial 
Safety and Soundness Act of 1992'' (Act) (12 U.S.C. 4501 et seq.), 
established OFHEO as an independent office within the Department of 
Housing and Urban Development. OFHEO is statutorily mandated to ensure 
that the Federal National Mortgage Association (Fannie Mae) and the 
Federal Home Loan Mortgage Corporation (Freddie Mac) (collectively, the 
Enterprises) are capitalized adequately and operate in a safe and sound 
manner and in compliance with applicable laws, rules, and regulations.
    The Act provides that the Director of OFHEO (the Director) is 
authorized to make such determinations, take such actions, and perform 
such functions as the Director determines are necessary regarding his 
supervisory authorities, which include examinations of the 
Enterprises.\1\ Under the Act, the Director is authorized to conduct 
on-site examinations of the Enterprises each year, and any other 
examinations that the Director determines are necessary to ensure their 
safety and soundness.\2\
---------------------------------------------------------------------------

    \1\ 12 U.S.C. 4513(b)(2).
    \2\ 12 U.S.C. 4517(a) and (b).
---------------------------------------------------------------------------

B. Record Retention and Safe and Sound Operations

    OFHEO recognizes that the effectiveness of the examination process 
is dependent upon the prompt production of complete and accurate 
records. OFHEO, through the supervisory process, must have access to 
the records of an Enterprise that are necessary to determine the 
financial condition of the Enterprise or the details or the purpose of 
any transaction that

[[Page 62880]]

may have a material effect on the financial condition of the 
Enterprise.\3\
---------------------------------------------------------------------------

    \3\ 12 U.S.C. 4632(c).
---------------------------------------------------------------------------

    Retention of such records not only facilitates the examination 
process, but also allows an Enterprise to manage more effectively its 
business and detect improper behavior that might cause financial damage 
to the corporation. Additionally, such records serve as documentation 
for an Enterprise in any controversy over its business activities or 
transactions.
    The importance of sound record retention policies and procedures by 
regulated institutions also has been recognized by Congress and other 
federal regulators. Adequate record retention by the institutions has 
been determined to have a high degree of usefulness in criminal, tax, 
and regulatory investigations or proceedings, and has been identified 
as a requisite component of an institution's operation and management 
on a safety and soundness basis.\4\
---------------------------------------------------------------------------

    \4\ See, e.g., 12 U.S.C. 1829b, and the Guidelines and 
Interagency Standards for Safety and Soundness at 12 CFR part 30, 
Appendix A, II, B.
---------------------------------------------------------------------------

    In addition to facilitating the oversight and enforcement of 
federal banking laws, adequate record retention has been recognized by 
Congress as being essential to the oversight and enforcement of the 
federal securities laws. For example, as mandated by section 802 of the 
Sarbanes-Oxley Act,\5\ the U.S. Securities and Exchange Commission 
adopted rules requiring accounting firms to retain for seven years 
certain records relevant to their audits and reviews of issuers' 
financial statements. Records to be retained include an accounting 
firm's workpapers and certain other documents that contain conclusions, 
opinions, analyses, or financial data related to the audit or 
review.\6\
---------------------------------------------------------------------------

    \5\ Pub. L. 107-204, 116 Stat. 745 (2002).
    \6\ 17 CFR part 210. See Release Nos. 33-8180; 34-47241; IC-
2591; FR-66; File No. S7-46-02.
---------------------------------------------------------------------------

Record Retention Regulation
    On June 1, 2006, OFHEO published for comment a proposed regulation, 
at 71 FR 31121, which sets forth proposed safety and soundness 
requirements with respect to the Enterprises' record retention 
programs. The 60-day comment period ended on July 31, 2006. All 
comments received have been made available to the public in the OFHEO 
Public Reading Room and have been posted on the OFHEO Web site at 
http://www.OFHEO.gov.

II. Comments Received

    Comments were received from Freddie Mac and Fannie Mae. Both 
Enterprises commented in support of the general approach under the 
proposed regulation. Each Enterprise also provided comments, many of 
which were technical in nature, on specific provisions of the proposal. 
All comments were taken into consideration. A discussion of the 
comments as they related to the proposed sections of the regulation 
follows.

A. Sec.  1732.1 Purpose and Scope

    Proposed Sec.  1732.1 states that the purpose of the regulation is 
to set forth minimum requirements in connection with the record 
retention program of each Enterprise, and that the requirements are 
intended to ensure that complete and accurate records of an Enterprise 
are readily accessible by OFHEO for examination and other supervisory 
purposes.
    Both Enterprises made technical comments regarding Sec.  1732.1 
with respect to the requirement to provide OFHEO with ready access to 
records. The Enterprises noted the dynamic nature of records management 
and the evolving nature of information technology. Freddie Mac 
commented that the methods of accessing hard copies of documents in 
off-site storage, electronic documents resident on a Local Area 
Network, and information in legacy databases, active databases, e-mail, 
and voicemail are quite different. Freddie Mac also noted that the 
level of management controls and ready access to records is not the 
same for records created and maintained years ago as that of records 
created and maintained today. Moreover, Freddie Mac commented that many 
of the records are subject to specific legal rights of the Enterprise 
or of individuals that cannot be disregarded. For these reasons, both 
Enterprises requested clarification that access to their records under 
the regulation is intended to mean ``reasonable'' access.
    OFHEO understands that all records are not equally accessible. For 
purposes of clarification, OFHEO has added language to Sec.  1732.1, as 
well as Sec. Sec.  1732.6(a)(2)(iii) and 1732.7(d), which clarifies 
that the sections' accessibility requirements are intended to be by 
reasonable means, consistent with the nature and availability of the 
records and existing information technology.

B. Sec.  1732.2 Definitions

Active Record
    As proposed, the term ``active record'' would be defined under 
Sec.  1732.2(b) to mean a document that is necessary to conduct the 
current business of an office or business unit of an Enterprise and, 
therefore, is readily available for consultation and reference.
    The Enterprises made technical comments on this definition, as well 
as the definitions for the terms ``inactive record'' and ``vital 
records,'' requesting that the terms be amended by substituting the 
word ``record'' or ``records'' for ``document'' or documents,'' as 
appropriate. Each Enterprise stated that such amendments would more 
fully incorporate what is intended by the proposal, i.e., its 
definition of ``record,'' and would be consistent with best 
practices.\7\
---------------------------------------------------------------------------

    \7\ In their comments on best practices in the field of records 
management, both Enterprises referred to the guidelines and 
standards of the following organizations: The Sedona Conference 
(2005), the American National Standards Institute/Association of 
Records Managers and Administrators, and the International 
Organization for Standardization.
---------------------------------------------------------------------------

    OFHEO agrees with the recommended technical changes and has revised 
the definitions in Sec.  1732.2(b), (h), and (m) accordingly in the 
final regulation.
Employee
    As proposed, the definition of the term ``employee'' would be 
defined in Sec.  1732.2(e) to mean any officer or employee of an 
Enterprise, any conservator appointed by OFHEO, or any agent or 
independent contractor acting on behalf of an Enterprise. Both 
Enterprises commented that including independent contractors and agents 
in the definition was significant because such individuals would be 
subject to several provisions of the proposed regulations, i.e., the 
training requirements under Sec.  1732.6(b); the record hold 
notifications under Sec.  1732.7(b); the reporting requirements of 
potential investigations under Sec.  1732.7(b)(3), and the definition 
of ``record'' under Sec.  1732.2(j)(3).
    Fannie Mae stated that extending the regulation's general reach in 
this way would create obligations with regard to parties and documents 
beyond an Enterprise's control, would generate considerable burden and 
expense for the Enterprise without yielding commensurate gains with 
respect to improved operations or supervision, and would increase 
litigation risk by exposing the Enterprise to potential liability for 
the actions (or non-actions) of third parties or individuals outside 
the Enterprise's control.
    Both Enterprises requested that OFHEO not include agents and 
independent contractors within the general definition of the term 
``employee.'' Rather, they recommended that, to the extent that any 
section of the regulation is intended to apply to agents

[[Page 62881]]

or independent contractors, OFHEO amend the section to include specific 
language making it apply to agents or independent contractors, tailored 
to what would be appropriate under the circumstances.
    In response to the comments, OFHEO has deleted the phrase ``or any 
agent or independent contractor acting on behalf of an Enterprise'' 
from Sec.  1732.2(e), and has added specific language for coverage of 
agents or independent contractors as appropriate in other sections of 
the final regulation, as noted below.
Inactive Record
    As proposed, the term ``inactive record'' would be defined in Sec.  
1732.2(h) to mean a document that is seldom used but must be retained 
by an Enterprise for legislative, fiscal, legal, archival, historical, 
or vital records purposes.
    In its technical comment, Fannie Mae requested that the words 
``legislative'' and ``archival'' be deleted from the definition. Fannie 
Mae stated that the words do not appear to add anything substantive to 
the other qualifying terms, and that the proposal provides no 
elaboration as to what these words are intended to capture that is not 
otherwise covered. Fannie Mae noted that, as an industry practice, 
records generally are defined for record retention purposes as having 
operational, vital record, legal or regulatory, fiscal, and historical 
value.
    OFHEO concurs with Fannie Mae's technical comment and has revised 
the definition of ``inactive record'' accordingly in the final 
regulation. Also, as noted above, the word ``record'' has been 
substituted for the word ``document.''
Record
    As proposed, the definition of the term ``record'' in Sec.  
1732.2(j) would mean: Any document whether generated internally or 
received from outside sources by an Enterprise or employee in 
connection with Enterprise business, regardless of the following: (1) 
Form or format, including hard copy documents (e.g., files, logs, and 
reports) and electronic documents (e.g., e-mail, databases, 
spreadsheets, PowerPoint presentations, electronic reporting systems, 
electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), 
and voicemail records; (2) where the document is stored or located, 
including network servers, desktop or laptop computers and handheld 
computers, other wireless devices with text messaging capabilities, and 
on-site or off-site at a storage facility; (3) whether the document is 
maintained or used on Enterprise-owned equipment, or personal or home 
computer systems of an employee; or (4) whether the document is active 
or inactive.
    Fannie Mae recommended that the proposed regulation use the 
definition of the term ``record'' provided in Internal Organization for 
Standards, ISO 15849-1 Sec.  3.15. That standard provides that a record 
``is information created, received, and maintained as evidence and 
information by an organization or person, in the pursuance of legal 
obligations or in the transaction of business.'' Freddie Mac, also 
referencing industry standards, requested that the word ``information'' 
be used in the definition, rather than ``document.'' Freddie Mac 
requested another technical change that would modify the definition by 
inserting the term ``maintained'' between the word ``employee'' and the 
phrase ``in connection with.'' Both Enterprises explained that the 
recommended revisions better reflect the corporate practices and 
supervisory concerns.
    OFHEO agrees with the technical changes recommended by Freddie Mac 
and has revised the definition of the term ``record'' in Sec.  
1732.2(j) to read ``any information whether generated internally or 
received from outside sources or employee maintained in connection with 
Enterprise business * * *'' Conforming changes have also been made to 
subsections (2), (3), and (4) accordingly.
    OFHEO does not agree to make use of the entire ISO definition for 
the definition of the term ``records,'' as recommended by Fannie Mae, 
because other elements of the ISO definition are encompassed in Sec.  
1732.2 under the definition of the terms ``active record'' and ``vital 
records.'' In addition, the language of the definition in Sec.  
1732.2(j), namely ``whether generated internally or received from 
outside sources'' is necessary to ensure that records are appropriately 
retained even if they have not been generated or created by the 
Enterprise.
Record Retention Schedule
    As proposed, the definition of the term ``record retention 
schedule'' would be defined in Sec.  1732.2(k) to mean ``a form that 
details the categories of records an Enterprise is required to store 
and their corresponding record retention periods. The record retention 
schedule includes reproductions, as well as all media, including 
microfilm and machine-readable computer records, for each record 
category.''
    Fannie Mae commented that the inclusion of the term 
``reproductions'' in the definition would be inconsistent with the 
standard industry approach, which does not require retention of copies 
because of the burden and expense of such retention. OFHEO understands 
that retention of all reproductions or copies of records would be 
burdensome and expensive. Reproductions would be listed in a record 
retention schedule only if the original of the official record is not 
available. Accordingly, OFHEO has revised the second sentence of the 
proposed definition to read: ``The record retention schedule includes 
all media, such as microfilm and machine-readable computer records, for 
each record category. Reproductions are also included for each record 
category if the original of the official record is not available.''
    Fannie Mae also commented that the record retention schedule is 
envisioned as a ``form.'' Fannie Mae also requested a technical change 
to the definition, i.e., substitution of the word ``schedule'' for the 
term ``form,'' to be consistent with the standard industry approach. 
OFHEO agrees and has changed the term ``form'' to ``schedule'' in the 
definition of the term ``record retention schedule'' in the final 
regulation.
Record Period
    As proposed, the definition of the term ``Retention period'' would 
be defined in Sec.  1732.2(l) to mean the length of time that records 
must be kept before they are destroyed. Records not authorized for 
destruction would have a retention period of ``permanent.''
    Fannie Mae made a technical comment that the definition is 
ambiguous, and requested that the definition be changed to state that: 
``Records not provided with a `retention period' must be retained, 
unless scheduled for destruction.''
    OFHEO has determined that the definition, as proposed, is clear 
and, therefore, has not made the technical change.
Vital Records
    As proposed, the term ``vital records'' would be defined in Sec.  
1732.2(m) to mean documents that are needed to meet operational 
responsibilities of an Enterprise under emergency or disaster 
conditions (emergency operating records) or to protect the legal and 
financial rights of an Enterprise and those affected by Enterprise 
activities. Emergency operating records would be defined to mean the 
type of vital records essential to the continued functioning or 
reconstitution of an Enterprise during and after an emergency. 
Moreover, a vital record would be further defined to include a record 
that could be both an emergency operating record and a legal and 
financial rights record.

[[Page 62882]]

    Fannie Mae commented that the definition includes documents 
``needed * * * to protect the legal and financial rights of * * * those 
affected by Enterprise activities.'' Fannie Mae stated that the company 
is very concerned about the possible impact of this language, as it 
arguably could be read to create new, unpredictable obligations to 
third parties, and thus potential legal risk. To allay such concerns 
and to be consistent with industry best practices, Fannie Mae requested 
that the words ``those affected by Enterprise activities'' be 
substituted with the phrase ``its employees, creditors, customers and 
holders of its securities.''
    In response to the comment, OFHEO has determined to delete the 
words ``those affected by Enterprise activities'' from the definition 
of the term ``vital records'' in the final regulation. Also, as noted 
above, the word ``records'' has been substituted for the word 
``documents.''

C. Section 1732.5 Establishment and Evaluation of Record Retention 
Program

    Section 1732.5(a) of the proposed regulation would require each 
Enterprise to establish and maintain a written record retention program 
and provide a copy of such program to the Examiner-in-Charge (EIC) of 
the Enterprise within 120 days of the regulation's effective date, and 
annually thereafter, and whenever a significant revision to the program 
has been made.
    Fannie Mae advised in its comments that the company will be 
prepared to submit a written plan within 120 days of the effective date 
on the understanding that the EIC will advise if the planned program is 
acceptable before investments are made in order to avoid costly changes 
and unnecessary delays. For the build-out process, Fannie Mae further 
advised that the company anticipates using one or more pilots to test 
and improve its proposed policy, approach and technology.
    Freddie Mac stated that the company expects to include in its 
initial report to OFHEO a snapshot of its current records retention 
program, including any additional enhancements that are implemented by 
the date of that report, together with a description of planned 
enhancements (both short-term and long-term) to that program. That 
first report will reflect that Freddie Mac has a records management 
program in place that encompasses records retention, but that the 
company is continuing to develop and strengthen its program. Freddie 
Mac noted that with OFHEO feedback on both its record retention 
program, and on planned enhancements, the corporation can align the 
records retention program with the expectations of OFHEO under the 
final regulation.
    OFHEO understands that both Enterprises are in the process of 
developing and upgrading their records management systems to comport 
with changing technology and the requirements of the final regulation. 
To that end, OFHEO encourages an Enterprise to submit relevant 
materials to and confer with its EIC as needed to ensure that its 
record retention program is compliant.

D. Section 1732.6 Minimum Requirements of Record Retention Program 
Requirements

    Section 1732.6(a)(2)(iii) of the proposed regulation would require 
that the record retention program established and maintained by an 
Enterprise be reasonably designed to assure that the format of retained 
records and the retention period permit ready access by the Enterprise, 
and, upon request, by the examination and other staff of OFHEO.
    As noted above, in response to technical comments received on Sec.  
1732.1, OFHEO has revised subsection (a)(2)(iii) of Sec.  1732.6 in the 
final regulation to clarify the accessibility requirement to mean 
access by reasonable means, consistent with the nature and availability 
of the records and existing information technology.
    Additionally, Freddie Mac made a technical comment requesting that 
OFHEO revise this subsection (and Sec.  1732.7(d), which addresses 
access to and retrieval of records during a record hold) to include at 
the end the phrase ``subject to applicable legal rights.''
    OFHEO has determined that it is not necessary to add the requested 
phrase to either subsection because the record retention requirements 
of the regulation are imposed for purposes of supervisory access by 
OFHEO to Enterprise records and do not result in a waiver of existing 
rights.
    Section 1732.6(a)(5) of the proposed regulation would require that 
the record retention program established and maintained by an 
Enterprise include an accurate, current, and comprehensive record 
retention schedule that lists records by major categories, 
subcategories, record type, and retention period, which retention 
period is appropriate to the specific record and consistent with 
applicable legal, regulatory, fiscal, and administrative requirements.
    Fannie Mae commented that the term ``administrative'' is ambiguous. 
Fannie Mae stated that, if the term is intended to reference 
administrative requirements of OFHEO, the term ``regulatory'' already 
captures these requirements, so the term ``administrative'' should be 
deleted. If, however, what is intended to be captured are the 
Enterprises' business needs, the term ``operational'' or ``business'' 
should be substituted for the term ``administrative.''
    OFHEO notes that the term ``administrative'' refers to requirements 
that are internal to a company, i.e., the Enterprise. Therefore, the 
term is not duplicative of the term ``regulatory.'' However, for 
purposes of clarification, OFHEO has determined to revise Sec.  
1732.6(a)(5) in the final regulation by substituting the terms 
``operational and business'' for the term ``administrative.''
Training
    Section 1732.6(b) of the proposed regulation would require that an 
Enterprise's record retention program provide for training of and 
notice to all employees on a periodic basis on their record retention 
responsibilities, including instruction regarding penalties provided by 
law for the unlawful removal or destruction of records.
    The Enterprises commented that this provision should be modified to 
include specific language tailored to requirements appropriate for 
independent contractors and agents. In its technical comment, Freddie 
Mac requested that OFHEO modify the proposal to provide that the 
training provision applies only to actual employees of an Enterprise, 
and that the Enterprise also takes reasonable steps to ensure that 
agents or independent contractors who are involved with creating or 
maintaining Enterprise records receive notice and/or training regarding 
record retention responsibilities in a manner appropriate to their 
engagement. Fannie Mae requested amending the proposed section to 
include specific language making training for agents or independent 
contractors consistent with their roles and responsibilities.
    As noted above in response to comments on Sec.  1732.2(e), OFHEO 
has added specific language for coverage of agents or independent 
contractors to several sections of the final regulation. With respect 
to Sec.  1732.6, a second sentence has been added to subsection (b) 
that reads as follows: ``The record retention program also shall 
provide for training for the agents or independent contractors of an 
Enterprise, as appropriate, consistent with their respective roles and 
responsibilities to the Enterprise.''

[[Page 62883]]

E. Section 1732.7 Record Hold

Definition
    Section 1732.7(a) of the proposed regulation would define the term 
``record hold'' to mean a requirement, an order, or a directive from an 
Enterprise or OFHEO that the Enterprise is to retain records relating 
to a particular issue in connection with an actual or a potential OFHEO 
examination, investigation, enforcement proceeding, or litigation.
    Both Enterprises expressed concern that criteria for a record hold 
is stated in terms of a ``potential'' investigation, enforcement 
proceeding or litigation. Fannie Mae commented that virtually 
everything that an Enterprise does raises some ``potential'' for 
litigation, and virtually every question that OFHEO asks raises some 
``potential'' for an OFHEO investigation. Fannie Mae stated that the 
overly broad and ambiguous standard would needlessly create an onerous 
burden both on the Enterprises and OFHEO. Fannie Mae requested that the 
word ``likely'' be substituted for the word ``potential.''
    Freddie Mac made the technical comment that the term ``potential'' 
requires or suggests that an Enterprise or employee is obligated and 
accountable to accurately guess when a matter could possibly give rise 
to an OFHEO examination, investigation, enforcement proceeding or 
litigation, resulting in an impossible standard with which to comply in 
practice. Freddie Mac requested that subsection (a) of Sec.  1732.7 be 
modified to require that an Enterprise receive notice from OFHEO.
    To address these comments, OFHEO has amended subsection (a) of 
Sec.  1732.7 in the final regulation to clarify that the record 
retention requirements of a record hold result upon receipt by the 
Enterprise of notice from OFHEO. As amended, subsection (a) reads as 
follows: ``For purposes of this part, the term `record hold' means a 
requirement, an order, or a directive from an Enterprise or OFHEO that 
the Enterprise is to retain records relating to a particular issue in 
connection with an actual or a potential OFHEO examination, 
investigation, enforcement proceeding, or litigation of which the 
Enterprise has received notice from OFHEO.'' As a result of the 
amendment, OFHEO has determined that it is not necessary to substitute 
the word ``likely'' for the word ``potential.''
Notification by an Enterprise
    Section 1732.7(b)(1) of the proposed regulation would require that 
the record retention program of an Enterprise ``[a]ddress how all 
employees will receive prompt notification of a record hold; * * *.'' 
Fannie Mae stated that it understands that this provision requires only 
that the program provide the mechanism by which all relevant employees 
will be notified of a record hold, and does not require that all 
employees in fact be made aware of each and every record hold issued. 
Otherwise, Fannie Mae stated the result would be a great deal of cost, 
confusion and unnecessary effort, as the vast majority of Enterprise 
employees would have nothing germane to a particular hold. Moreover, 
Fannie Mae stated that industry best practice is not to notify each 
employee at a company of every records hold, but rather to notify only 
those employees who are likely to have records covered by the records 
hold. To that end, Fannie Mae requested that the subsection be modified 
by deleting the words ``all employees'' and substituting the phrase 
``the Enterprise will determine which employees, agents and independent 
contractors need to and.''
    OFHEO understands that not all employees of an Enterprise may fall 
within the scope of the notification requirements of Sec.  1732.7(b)(1) 
in light of the nature of their responsibilities and activities. To 
clarify that understanding, OFHEO has deleted the word ``all'' before 
the word ``employees'' in the final regulation. Additionally, as noted 
above, because agents or independent contractors of the Enterprise have 
been deleted from the definition of the term ``employees,'' specific 
language has been added to the subsection to cover agents or 
independent contractors, as appropriate. As amended, Sec.  1732.7(b)(1) 
reads as follows in the final regulation: ``The record retention 
program of an Enterprise shall: (1) Address how employees and, as 
appropriate, how agents or independent contractors consistent with 
their respective roles and responsibilities to the Enterprise, will 
receive prompt notification of a record hold;''.
    Section 1732.7(b)(3) of the proposed regulation would require that 
the record retention program of an Enterprise ``[p]rovide that any 
employee who is aware of a potential investigation, enforcement 
proceeding, or litigation by OFHEO involving the Enterprise or an 
employee shall notify immediately the legal department of the 
Enterprise and shall retain any records that may be relevant in any way 
to such investigation, enforcement proceeding, or litigation.''
    Similar to comments made on other sections, both Enterprises 
expressed concerns regarding the scope of coverage for the notification 
requirements of Sec.  1732.7(b)(3) and criteria for determining a 
``potential'' investigation, enforcement proceeding, or litigation by 
OFHEO involving the Enterprise or an employee.
    The concerns expressed have been addressed by OFHEO. As noted above 
in its response to comments received on Sec.  1732.2(e), OFHEO has 
deleted coverage of agents or independent contractors acting on behalf 
of an Enterprise from the definition of the term ``employee,'' and 
their coverage is limited to certain sections of the final regulation 
as appropriate. OFHEO also amended subsection (a) of Sec.  1732.7 in 
the final regulation to clarify that the record retention requirements 
of a record hold result upon receipt by an Enterprise of notice from 
OFHEO.
    To further allay any concerns, OFHEO has amended Sec.  1732.7(b)(3) 
by replacing the words ``aware of'' with ``has received notice of'' and 
also by inserting the phrase `` , or otherwise has actual knowledge 
that an issue is subject to such an enforcement proceeding or 
litigation,'' before the words ``shall notify.'' Thus, OFHEO would 
provide written notice to an Enterprise of its intent to conduct an 
investigation some time in the future, thereby providing notice of a 
``potential investigation.'' Also, consistent with other sections 
discussed above, language has been added to the subsection to require 
that agents and independent contractors receive notice of a record hold 
to the extent appropriate in light of the nature of their engagement.
    Specifically, Sec.  1732.7(b)(3) of the final regulation provides 
that the record retention program of an Enterprise shall ``provide that 
any employee and, as appropriate, any agent or independent contractor 
consistent with his or her respective role and responsibility to the 
Enterprise, who has received notice of a potential investigation, 
enforcement proceeding, or litigation by OFHEO involving the Enterprise 
or an employee, or otherwise has actual knowledge that an issue is 
subject to such an investigation, enforcement proceeding or litigation, 
shall notify immediately the legal department of the Enterprise and 
shall retain any records that may be relevant in any way to such 
investigation, enforcement proceeding, or litigation.''
    It is noted that OFHEO also has revised subsection (b)(1) of Sec.  
1732.7, which requires prompt notification of a record hold, to 
include, as appropriate, coverage of agents and independent contractors 
consistent with their roles and responsibilities.

[[Page 62884]]

F. Section 1732.10 Supervisory Action

    Section 1732.10(a) of the proposed regulation would provide that 
failure by an Enterprise to comply with this part may subject the 
Enterprise or the board members, officers, or employees thereof to 
supervisory action by OFHEO under the Act, including but not limited to 
cease-and-desist proceedings, temporary cease-and-desist proceedings, 
and civil money penalties.
    Both Enterprises commented on compliance with the proposed section. 
Fannie Mae noted the necessary complexities of developing a 
comprehensive record retention scheme and suggested that, consistent 
with the approach of federal banking regulators, OFHEO establish a 
specific system for the submission of Enterprise remediation plans 
(over perhaps a thirty-day period) with regard to any deficiencies 
regarding compliance with Sec.  1732.10(a). Fannie Mae stated that such 
a system would provide a routine, efficient framework for the 
resolution of issues that do not merit formal enforcement action, 
without foreclosing the ability to take more formal action, as OFHEO 
deemed appropriate.
    Freddie Mac commented that in light of the lack of bright lines as 
to precisely what is required for full compliance with the regulation, 
the rapidly changing best practices in the records management field, 
and the time required to develop and implement enhancements to records 
management programs, it would be appropriate for OFHEO to first 
consider using feedback, followed by a request for a remediation plan, 
prior to considering formal enforcement actions, in instances where 
OFHEO believes an Enterprise acting in good faith is not in full 
compliance with the regulation. Thus, Freddie Mac requested that Sec.  
1732.10(a) be revised to require appropriate supervisory notification 
before noncompliance would subject the Enterprise to a supervisory 
action by OFHEO.
    OFHEO understands that both Enterprises are in the process of 
developing and upgrading their records management systems to comport 
with changing technology. To that end, both during the 120-day 
implementation period and afterwards, OFHEO encourages each Enterprise 
to submit relevant materials to and confer with its EIC as needed to 
ensure that its record retention program is compliant.

III. Final Regulation

    Except with respect to the technical and clarifying revisions of 
the proposed language as described above, OFHEO has determined to issue 
the regulation as proposed.

Regulatory Impact

Executive Order 12866, Regulatory Planning and Review
    This regulation does not result in an annual effect on the economy 
of $100 million or more or a major increase in costs or prices for 
consumers, individual industries, Federal, State, or local government 
agencies, or geographic regions; or have significant adverse effects on 
competition, employment, investment, productivity, innovation, or on 
the ability of United States-based enterprises to compete with foreign-
based enterprises in domestic or foreign markets. Accordingly, no 
regulatory impact assessment is required. Nevertheless, this regulation 
was submitted to the Office of Management and Budget for review under 
other provisions of Executive Order 12866 as a significant regulatory 
action.
Regulatory Flexibility Act
    The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) requires that 
a regulation that has a significant economic impact on a substantial 
number of small entities, small businesses, or small organizations must 
include an initial regulatory flexibility analysis describing the 
regulation's impact on small entities. Such an analysis need not be 
undertaken if the agency has certified that the regulation will not 
have a significant economic impact on a substantial number of small 
entities (5 U.S.C. 605(b)). OFHEO has considered the impact of the 
regulation under the Regulatory Flexibility Act. The General Counsel of 
OFHEO certifies that the regulation, as herein adopted, is not likely 
to have a significant economic impact on a substantial number of small 
business entities because the regulation is applicable only to the 
Enterprises which are not small entities for purposes of the Regulatory 
Flexibility Act.
Executive Order 13132, Federalism
    Executive Order 13132 requires that Executive departments and 
agencies identify regulatory actions that have significant federalism 
implications. A regulation has federalism implications if it has 
substantial direct effects on the States, on the relationship or 
distribution of power between the Federal Government and the States, or 
on the distribution of power and responsibilities among various levels 
of Government. The Enterprises are federally chartered corporations 
supervised by OFHEO. This regulation sets forth minimum record 
retention requirements with which the Enterprises must comply for 
Federal supervisory purposes and address the safety and soundness 
authorities of the agency. This regulation does not affect in any 
manner the powers and authorities of any State with respect to the 
Enterprises or alter the distribution of power and responsibilities 
between State and Federal levels of government. Therefore, OFHEO has 
determined that this final regulation has no federalism implications 
that warrant the preparation of a Federalism Assessment in accordance 
with Executive Order 13132.

List of Subjects in 12 CFR Part 1732

    Government-Sponsored Enterprises, Reporting and recordkeeping 
requirements, Records.

0
Accordingly, for the reasons stated in the preamble, OFHEO adds part 
1732 to subchapter C of 12 CFR chapter XVII to read as follows:

Subchapter C--Safety and Soundness

PART 1732--RECORD RETENTION

Subpart A--General
Sec.
1732.1 Purpose and scope.
1732.2 Definitions.
1732.3-4 [Reserved]
Subpart B--Record Retention Program
1732.5 Establishment and evaluation of record retention program.
1732.6 Minimum requirements of record retention program.
1732.7 Record hold.
1732.8-1732.9 [Reserved]
Subpart C--Supervisory Action
1732.10 Supervisory action.

    Authority: 12 U.S.C. 4513(a), 4513(b)(1), 4513(b)(5), 4514, 
4631, 4632, and 4632.

Subpart A--General


Sec.  1732.1  Purpose and scope.

    In furtherance of the safety and soundness authorities of OFHEO, 
this part sets forth minimum requirements in connection with the record 
retention program of each Enterprise. The requirements are intended to 
ensure that complete and accurate records of an Enterprise are readily 
accessible by OFHEO for examination and other supervisory purposes. 
Such access shall be by reasonable means, consistent with the nature 
and availability of the records and existing information technology.


Sec.  1732.2  Definitions.

    For purposes of this part, the term:

[[Page 62885]]

    (a) Act means the Federal Housing Enterprises Financial Safety and 
Soundness Act of 1992, Title XIII of the Housing and Community 
Development Act of 1992, Public Law 102-550, section 1301, Oct. 28, 
1992, 106 Stat. 3672, 3941 through 4012 (1993) (12 U.S.C. 4501 et 
seq.).
    (b) Active record means a record that is necessary to conduct the 
current business of an office or business unit of an Enterprise and, 
therefore, is readily available for consultation and reference.
    (c) Director means the Director of OFHEO, or his or her designee.
    (d) Electronic record means a record created, generated, 
communicated, or stored by electronic means.
    (e) Employee means any officer or employee of an Enterprise or any 
conservator appointed by OFHEO.
    (f) Enterprise means the Federal National Mortgage Association or 
the Federal Home Loan Mortgage Corporation; and the term 
``Enterprises'' means, collectively, the Federal National Mortgage 
Association and the Federal Home Loan Mortgage Corporation.
    (g) E-mail means electronic mail, which is a method of 
communication in which:
    (1) Usually, text is transmitted (but sometimes also graphics and/
or audio information);
    (2) Operations include sending, storing, processing, and receiving 
information;
    (3) Users are allowed to communicate under specified conditions; 
and
    (4) Messages are held in storage until called for by the addressee, 
including any attachment of separate electronic files.
    (h) Inactive record means a record that is seldom used but must be 
retained by an Enterprise for fiscal, legal, historical, or vital 
records purposes.
    (i) OFHEO means the Office of Federal Housing Enterprise Oversight.
    (j) Record means any information whether generated internally or 
received from outside sources by an Enterprise or employee maintained 
in connection with Enterprise business, regardless of the following:
    (1) Form or format, including hard copy documents (e.g., files, 
logs, and reports) and electronic documents (e.g., e-mail, databases, 
spreadsheets, PowerPoint presentations, electronic reporting systems, 
electronic tapes and back-up tapes, optical discs, CD-ROMS, and DVDs), 
and voicemail records;
    (2) Where the information is stored or located, including network 
servers, desktop or laptop computers and handheld computers, other 
wireless devices with text messaging capabilities, and on-site or off-
site at a storage facility;
    (3) Whether the information is maintained or used on Enterprise-
owned equipment, or personal or home computer systems of an employee; 
or
    (4) Whether the information is active or inactive.
    (k) Record retention schedule means a schedule that details the 
categories of records an Enterprise is required to retain and the 
corresponding retention periods. The record retention schedule includes 
all media, such as microfilm and machine-readable computer records, for 
each record category. Reproductions are also included for each record 
category if the original of the official record is not available.
    (l) Retention period means the length of time that records must be 
kept before they are destroyed. Records not authorized for destruction 
have a retention period of ``permanent.''
    (m) Vital records means records that are needed to meet operational 
responsibilities of an Enterprise under emergency or disaster 
conditions (emergency operating records) or to protect the legal and 
financial rights of an Enterprise. Emergency operating records are the 
type of vital records essential to the continued functioning or 
reconstitution of an Enterprise during and after an emergency. A vital 
record may be both an emergency operating record and a legal and 
financial rights record.


Sec. Sec.  1732.3-1732.4  [Reserved]

Subpart B--Record Retention Program


Sec.  1732.5  Establishment and evaluation of record retention program.

    (a) Establishment. An Enterprise shall establish and maintain a 
written record retention program and provide a copy of such program to 
the OFHEO Examiner-in-Charge of the Enterprise within 120 days of the 
effective date of this part, and annually thereafter, and whenever a 
significant revision to the program has been made.
    (b) Evaluation. Management of the Enterprise shall evaluate in 
writing the adequacy and effectiveness of the record retention program 
at least every three years and provide a copy of the evaluation to the 
board of directors and the OFHEO Examiner-in-Charge of the Enterprise.


Sec.  1732.6  Minimum requirements of record retention program.

    (a) Requirements. The record retention program established and 
maintained by an Enterprise under Sec.  1732.5 shall:
    (1) Be reasonably designed to assure that retained records are 
complete and accurate;
    (2) Be reasonably designed to assure that the format of retained 
records and the retention period--
    (i) Are adequate to support litigation and the administrative, 
business, external and internal audit functions of the Enterprise;
    (ii) Comply with requirements of applicable laws and regulations; 
and
    (iii) Permit ready access by the Enterprise and, upon request, by 
the examination and other staff of OFHEO by reasonable means, 
consistent with the nature and availability of the records and existing 
information technology;
    (3) Assign in writing the authorities and responsibilities for 
record retention activities;
    (4) Include policies and procedures concerning record holds, 
consistent with Sec.  1732.7;
    (5) Include an accurate, current, and comprehensive record 
retention schedule that lists records by major categories, 
subcategories, record type, and retention period, which retention 
period is appropriate to the specific record and consistent with 
applicable legal, regulatory, fiscal, and operational and business 
requirements;
    (6) Include adequate security and internal controls to protect 
records from unauthorized access and data alteration; and
    (7) Provide for adequate back-up and recovery of electronic 
records.
    (b) Training. The record retention program shall provide for 
training of and notice to all employees on a periodic basis on their 
record retention responsibilities, including instruction regarding 
penalties provided by law for the unlawful removal or destruction of 
records. The record retention program also shall provide for training 
for the agents or independent contractors of an Enterprise, as 
appropriate, consistent with their respective roles and 
responsibilities to the Enterprise.


Sec.  1732.7  Record hold.

    (a) Definition. For purposes of this part, the term ``record hold'' 
means a requirement, an order, or a directive from an Enterprise or 
OFHEO that the Enterprise is to retain records relating to a particular 
issue in connection with an actual or a potential OFHEO examination, 
investigation, enforcement proceeding, or litigation of which the 
Enterprise has received notice from OFHEO.
    (b) Notification by Enterprise. The record retention program of an 
Enterprise shall:
    (1) Address how employees and, as appropriate, how agents or 
independent

[[Page 62886]]

contractors consistent with their respective roles and responsibilities 
to the Enterprise, will receive prompt notification of a record hold;
    (2) Designate an individual to communicate specific requirements 
and instructions, including, when necessary, the instruction to cease 
immediately any otherwise permissible destruction of records; and,
    (3) Provide that any employee and, as appropriate, any agent or 
independent contractor consistent with his or her respective role and 
responsibility to the Enterprise, who has received notice of a 
potential investigation, enforcement proceeding, or litigation by OFHEO 
involving the Enterprise or an employee, or otherwise has actual 
knowledge that an issue is subject to such an investigation, 
enforcement proceeding or litigation, shall notify immediately the 
legal department of the Enterprise and shall retain any records that 
may be relevant in any way to such investigation, enforcement 
proceeding, or litigation.
    (c) Method of record retention. The record retention program of an 
Enterprise shall address the method by which the Enterprise will retain 
records during a record hold. Specifically, the program shall describe 
the method for the continued preservation of electronic records, 
including e-mails, and the conversion of records from paper to 
electronic format as well as any alternative storage method.
    (d) Access to and retrieval of records. The record retention 
program of an Enterprise shall ensure access to and retrieval of 
records by the Enterprise and access, upon request, by OFHEO, during a 
record hold. Such access shall be by reasonable means, consistent with 
the nature and availability of the records and existing information 
technology.


Sec. Sec.  1732.8-1732.9  [Reserved]

Subpart C--Supervisory Action


Sec.  1732.10  Supervisory action.

    (a) Supervisory action. Failure by an Enterprise to comply with 
this part may subject the Enterprise or the board members, officers, or 
employees thereof to supervisory action by OFHEO under the Act, 
including but not limited to cease-and-desist proceedings, temporary 
cease-and-desist proceedings, and civil money penalties.
    (b) No limitation of authority. This part does not limit or 
restrict the authority of OFHEO to act under its safety and soundness 
mandate, in accordance with the Act. Such authority includes, but is 
not limited to, conducting examinations, requiring reports and 
disclosures, and enforcing compliance with applicable laws, rules, and 
regulations.

    Dated: October 23, 2006.
James B. Lockhart, III,
Director, Office of Federal Housing Enterprise Oversight.
 [FR Doc. E6-18034 Filed 10-26-06; 8:45 am]
BILLING CODE 4220-01-P