Pre-Proposal_Conference_-_DU100R-15-R-0001_-_FBO_-_FINAL_-_Amend_2.pdf

U.S. Department of Housing and Urban Development

Notes Servicing

Where does MNSB fall in the process?

INSURANCE

OPERATIONS

NOTES

SERVICING

CLAIMS

1 2 3

Our role is to service HUD-Held

Mortgages:

• Conventional Notes

• Mark-to-Market Notes in support of the Recapitalization

Division

• Healthcare Notes

• Risk Share

Our Customers:

• Internal (HUD Field Offices, Office of MF Asset

Management Portfolio Oversight, Office of

Recapitalization, Office of Healthcare Programs, Office of Asset Sales, Office of General Counsel, Multifamily Accounting) plus various entities inside and outside of the HUD environment

• External (Banks/Lenders/Borrowers)

• Contractors

Our Business:

1. New Note Set-Up & Review

2. Billing and Collections of HUD-Held Notes

3. Escrow Management of HUD-Held Notes

4. Process Note Terminations

New Note Set-up Process

Types of New Notes:

• New Assignments: Prior Insured Notes which defaulted and became claims

• Partial Payment of Claims (PPC’s): Notes which are partially paid claims

• Restructured Notes: Notes with terms and conditions restructured by Office of Recapitalization

New Note Set-up Process

(continued)

Procedure:

1. A New Note comes from MF Claim Branch.

2. MNSB reviews the New Assignment and sets up the note in the contractors servicing system .

3. Final Settlement is made by MF Claims.

4. MNSB reviews for accuracy and makes adjustment to note based on Final Settlement.

Servicing/Billing of HUD-Held Notes

1. Preparation and mailing of monthly billing statements.

2. Collection and application of payments

3. Escrow disbursements (Reserve for Replacement and Residual

Receipts).

Note: The current Notes Servicing Contractor uses a proprietary system to perform these tasks. All Offerors attempting to bid on this proposal must have a system readily available.

Escrow Management of HUD-Held Notes

Types of Escrows:

1. Reserve for Replacement

2. Residual Receipts

3. Hazard Insurance

4. Tax Escrow

Maintenance:

1. Billing and Collection of monthly/annual escrow amounts.

2. Annual Property tax payments made to local taxing authority

3. Hazard Insurance paid to insurance provider.

4. Reserve for Replacement and Residual Receipt reimbursements made per field office.

Investments:

Excess escrow funds can be invested, at the owners request, in T-bills or the Minority

Banking Program.

Minority Bank Investment Program

• Minority Bank Investment Program was started in 1992

• Purpose was to invest R4R funds in the program with banks located throughout the country

• The Minority Bank Solicitation is an offer to do business with small banks.

• The last Solicitation was completed in 2000

• Solicitations were sent to banks from a list provided by Treasury

• Once the solicitation responses were received, a review was performed on each package

• Eleven (11) banks were chosen to participate

• Currently, we have funds invested in eight (8) banks

• These banks provide higher interest points than T-Bills

• Each bank can manage $240,000 per note as regulated by FDIC

• Currently there are $33 million reserve for replacement escrows invested in the Minority

Bank Program

TERMINATIONS

Types of Terminations:

1. Prepayments

2. Payment in Full via Cash Flow

3. Maturity

4. Restructure

5. Asset (Note) Sales

Terminations (continued)

Procedure:

1. Termination request comes to MNSB.

2. Approval request is forwarded to Program Office (OAMPO, Recap, OHP)

3. Once approved, funds are collected from the owner.

4. After note is paid-in-full, the Satisfaction Process Begins

5. Release documents are prepared by the Office of General Counsel.

6. MNSB ensures compliance with Program Office’s Terms &

Conditions.

7. MNSB executes Satisfaction of Mortgage and Program Office executes Release of Regulatory Agreement

8. Remaining escrows are released to the owner.

9. Legal documents and releases are sent to the owner

Other Functions of the MNSB

1. Participation in Asset Sales

• Coordination with MF Asset Sales Office

• Provide servicing information for due diligence packages

• Calculating and preparing closing payment notices.

• Collection of bid money.

2. Bankruptcies

• Coordination with Department of Justice to facilitate bankruptcies

• Collection of bankruptcies settlement

3. Foreclosures

• Coordination with Foreclosure Commissioner

• Disbursement of Foreclosure Expenses

4. Track, file, and maintain Universal Commercial Code (UCC) agreements on all notes

5. Credit reporting to credit bureaus (Delinquencies)

New Assignments: 26/$85 Million

Terminations: 135/$235 Million

Reserve Disbursements: 415/$8.4 Million

2,300 Notes

2,040 Notes are Current

244 Notes are Delinquent

$ 2.7 Billion in Assets

*All values are approximations.

Curtail above-market rent payments for FHA-insured multifamily properties with expiring Section 8 (HAP) contracts

Reduce rents to area market levels

Restructured Debt through Partial Payment of claim

(PPC)

Properties have one or more Cash-Flow Notes

Approximately 130 properties from the Demonstration

Program

Established prior to the permanent M2M program.

Contain one or more loans in first to fourth lien position

Loan Docs are not standard format

Reviews Owner’s Annual Financial Statement (AFS), Maximizes the value of M2M and Demo Notes by ensuring HUD receives the correct surplus cash payment

Identifies significant variances, makes necessary adjustments, and computes the surplus cash due

Sends SCA computation to Notes Servicer for Billing

Accounting

Accounting processes are integrated within all of the activities described within Tasks 2 - 5.

The Contractor shall provide full service accounts payable and accounts receivable accounting functions utilizing:

o FEDGAAP, oUSSGL CHART OF ACCOUNTS oCredit Reform ACT OF 1990

For accounting for all HUD-Held Notes , including servicing the unique characteristics of the M2M/DEMO notes and Property

Disposition.

Generate and record detailed accounting transactions for foreclosure expenses related to Mortgagee-in-

Possession (MIP) and HUD-owned properties as well as obligations and disbursements

Maintain Note assets inventory

Prepare Claims to Notes reconciliation

Process New Note Assignments

Contract Funding Obligations and funding

Authorized taxes

Releases from Reserves (include Investment deposits)

Foreclosure costs

Operating expenses

Collections are received daily, by the Servicing and Contractor, for the mortgage payment due on the accounts. The type of collections are as follows:

lockbox payments (cash remittances) internal transfers

557 transfers

1081 transfers subsidy payments tax refunds interest earned on invested funds.

Mortgage payments are applied by the Servicing and Contractor into Contractor’s system in accordance with Federal Regulations and the standard FHA mortgage documents.

• NOTES

SERVICING

• PROPERTY

DISPOSITION

CONTRACTOR'S

SYSTEM

• NOTES AND

PROPERTY

ACCOUNTING

TRANSACTIONS

• LOAD

• SUMMARIZE

• CROSSWALK

• BUILD JE

FILE LOAD

INTERFACE PROCESS

• FHASL

PEOPLESOFT

FHASL/FHA

SUBSIDIARY LEDGER

Close Property Disposition ledger 1 business day prior to the

Multifamily Loan Servicing closing.

Both note servicing and property disposition ledgers shall be closed by the 3rd business day of each month.

The Contractor shall interface with FHASL by providing automated data files to complete the month end close processes prior to the normal 2nd and 3rd business day schedule, respectively when preceded by a Federal Holiday.

COLLECTION INFORMATION REPOSITORY (CIR)

https://www.fiscal.treasury.gov/

PAY.GOV

https://www.pay.gov/

NON-TREASURY DISBURSEMENT OFFICE(NTDO)

https://www.fms.treas.gov/ntdo/index.jsp https://www.fiscal.treasury.gov/ https://www.fiscal.treasury.gov/ https://www.fiscal.treasury.gov/ https://www.pay.gov/ https://www.fms.treas.gov/ntdo/index.jsp

0 – Roll-up balance

1 – Original Establishment

2 – Re-establishment of prior Write-offs

3 – Re-establishment for Cancelled or NSF Checks

4 – Reclassification – Increase

5 – Liquidation – collection, disbursement etc.

6 – Off-Sets against receivables, payables etc.

7 – Write-off

8 - Reclassification – Decrease

Technical Considerations

IT Security Policy and Procedures

FISMA – NIST – FIPS 199

FedRAMP and NIST SP 800-145

RMF

Security Assessment & Authorization

Privacy Act

Annual Security Compliance

SSAE 16

Interfaces

IT Security Policy and Procedures

HUD’s IT security policy (Handbook 2400.25 REV 4, August 2014) and IT security procedures are designed to:

• preserve the confidentiality, integrity, availability, and value of assets

• ensure the continued delivery of services

• establish the appropriate focus and standards for acceptable security practices

• respond to security issues associated with contemporary technologies and risks

• identify relevant security roles and responsibilities

• provide a comprehensive view of information security considerations

• ensure compliance with applicable federal security laws, policies, and regulations

Applications, services, and platforms used by Business Service Providers

(BSPs) are required to comply with all HUD and federal security requirements.

Policy and Procedures (continued)

HUD’s policies are based on federal security regulations and highlight HUD’s goals and requirements for protecting its information and information system assets.

• HUD policy applies to all HUD employees, contractors, and service providers and requires compliance with day-to-day provisions of HUD policy.

• HUD procedures are to be used by all HUD employees and contractors who either use or are responsible for any system component.

HUD’s Information Technology Security Policy link:

http://portal.hud.gov/hudportal/documents/huddoc?id=240025CIOH.pdf

HUD’s Information Technology Security Procedures link:

http://hudatwork.hud.gov/HUD/cio/doc/itsectemp/itsecproced4

FISMA

The Federal Information Security Management Act of 2002 (FISMA) requires

Federal agencies to develop, document, and implement an information security program and defines the framework for managing information security that must be followed for information systems.

The framework includes:

• Categorization of Information and Information system according risk level

• Security Controls

• Risk Assessment

• System Security Plan

• Certification and Accreditation

• Continuous Monitoring

FISMA link: http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

NIST

The National Institute of Standards and Technology’s (NIST) Computer

Security Division (CSD) provides standards, guidelines, recommendations, background information and overviews in the following NIST technical series:

• Federal Information Processing Standards (FIPS): security standards

• NIST Special Publications (SPs): security guidelines, recommendations and reference materials. These include SP 800 subseries (computer security), SP

1800 subseries (NIST Cybersecurity Practice Guides) and selected SP 500-series (information technology) publications directly relevant to computer/cyber/information security

• NIST Interagency or Internal Reports (NISTIRs): documentation that supports and provides background information for FIPS and SPs

• Information Technology Laboratory (ITL) Bulletins: monthly overviews of

NIST's security publications, programs, and projects.

NIST Publications link: http://csrc.nist.gov/publications/index.html http://csrc.nist.gov/publications/PubsFIPS.html http://csrc.nist.gov/publications/PubsFIPS.html http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsNISTIRs.html http://csrc.nist.gov/publications/PubsNISTIRs.html http://csrc.nist.gov/publications/PubsITLSB.html http://csrc.nist.gov/publications/PubsITLSB.html http://csrc.nist.gov/publications/index.html http://csrc.nist.gov/publications/index.html

FIPS 199

Federal Information Processing Standard Publication 199 (FIPS 199), Standards for Security Categorization of Federal Information and Information

Systems, is the mandatory standard for categorizing the sensitivity associated with federal information and information systems.

FIPS 199 distinguishes among low, moderate, and high sensitivity categories and deals explicitly with integrity, availability, and confidentiality as security goals.

Categories correspond to the different degrees of potential impact a security incident may have on a department’s mission, assets, legal responsibilities, functions, or individuals.

FIPS link: http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

FedRAMP

The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud-based services. FedRAMP uses a “do once, use many times” framework that intends to save costs, time, and staff required to conduct redundant Agency security assessments and process monitoring reports.

FedRAMP link: https://www.fedramp.gov/about-us/about/

FedRAMP-compliant Cloud Service Providers (CSPs) link:

https://www.fedramp.gov/marketplace/compliant-systems/ https://www.fedramp.gov/about-us/about/ https://www.fedramp.gov/about-us/about/ https://www.fedramp.gov/about-us/about/ https://www.fedramp.gov/marketplace/compliant-systems/

NIST SP 800-145

The NIST Definition of Cloud Computing:

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.

If the Service Provider’s business application meets all five essential characteristics, it must be hosted on a FedRAMP-approved CSP.

Link: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf

NIST SP 800-145 (continued)

Essential characteristics:

• On-demand self-service

• Broad network access

• Resource pooling

• Rapid elasticity

• Measured service

Service models:

• Software as a Service (SaaS)

• Platform as a Service (PaaS)

• Infrastructure as a Service (IaaS)

Deployment models:

• Private cloud

• Community cloud

• Public cloud

• Hybrid cloud

Risk Management Framework

The NIST Risk Management Framework (RMF) is a collection of guidance documents organized into a framework. NIST devised the RMF as a standard way for federal organizations to select, assess and monitor the appropriate security controls for information systems and subsequently to identify any risks to the information and the organization.

Steps associated with implementing NIST’s RMF within HUD:

• Categorize the Information System

• Select the Security Controls

• Implement Security Controls

• Assess Security Controls

• Authorize the Information System

• Continuously Monitor Security Controls

Security Assessment & Authorization

HUD’s Security Assessment and Authorization (SA&A) and Continuous

Monitoring Guide, April 2014, purposes are:

• to establish the HUD Department-wide processes, procedures and standards for the implementation of the NIST RMF that will support the initial security authorization, reauthorization, and Continuous Monitoring (CM) of security of the HUD information systems.

• to outline the process and standards to be used, by the HUD OCIO, to perform oversight and compliance of the Program Offices implementation of this guidance.

Privacy Act Compliance

The Service Provider’s business application must “meet privacy policies regarding the protection, dissemination, and disclosure of information.”

HUD’s Chief Privacy Officer must review program Privacy Threshold Analysis

(PTA), Privacy Impact Assessment (PIA), and System of Records Notice

(SORN), and provide approval as appropriate.

HUD’s Chief Privacy Officer is responsible for the HUD Privacy Policy and its compliance.

Annual Security Compliance

The Service Provider’s business application must update all IT security documentation annually and have that information reviewed and approved by the Government.

This includes Self-Assessments of Security Controls identified by the OCIO, Privacy Impact Assessment (PIA), and System of Records Notice (SORN), System Security Plan, Contingency Plan and Contingency Plan Testing, Risk

Assessment, Business Impact Analysis, Configuration Management Plan, SSAE 16 independent attestation audit, and e-Authentication Risk Assessment.

SSAE 16

Statement on Standards for Attestation Engagements No. 16

Reporting on Controls at a Service Organization

The Service Provider must engage an independent auditor to prepare an annual audit that conforms to the Statement on Standards for Attestation Engagements

No. 16 (SSAE 16), Reporting on Controls at a Service Organization published by the American Institute of Certified Public Accountants (AICPA).

The auditors shall conduct a Service Organizations Control (SOC) 1, Type 2

SSAE 16 audit.

Link: http://ssae16.com/SSAE16_overview.html http://ssae16.com/SSAE16_overview.html http://ssae16.com/SSAE16_overview.html

Interfaces

The Service Provider’s application must comply with all federal IT and

Cybersecurity requirements and must ensure that Personally Identifiable

Information (PII) is not compromised.

The major interfaces represent data flows between the Service Provider’s application and:

• FHA-SL

• Treasury

• Internal HUD applications

Files must be transmitted through secure connections and operate under HUD’s

Enterprise Architecture.

Thank You!