| Internet-Draft | OMP FHFA Housing Finance Profile | April 2026 |
| Adebayo, et al. | Expires 7 October 2026 | [Page] |
This document defines a domain profile of the Operating Model Protocol (OMP) for AI and machine learning (ML) systems deployed in US housing finance contexts subject to the Federal Housing Finance Agency (FHFA) Bulletin 2025-16 (effective March 3, 2026), which establishes a comprehensive AI governance framework for Fannie Mae, Freddie Mac, and the Federal Home Loan Banks (the GSEs), requiring transparency, accountability, and ethical stewardship for AI/ML systems used in housing finance decisions.¶
The profile -- designated HomeMark -- specifies how OMP's deterministic routing invariant, Watchtower enforcement framework, and three-layer cryptographic integrity architecture satisfy the AI governance evidence requirements of FHFA Bulletin 2025-16, including per-decision accountability, named individual responsibility, model risk governance documentation, fair lending evidence, and representation and warranty compliance for mortgage origination, credit decisioning, property valuation, and loan servicing.¶
The OMP core specification is defined in the Operating Model Protocol Internet-Draft (draft-veridom-omp).¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 7 October 2026.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
AI and machine learning systems are now foundational to US housing finance operations: in automated underwriting systems (AUS) for mortgage origination, automated valuation models (AVMs) for property assessment, loss mitigation decisioning in loan servicing, and loan acquisition models in the secondary market. The GSEs operate at national scale -- Fannie Mae and Freddie Mac collectively support the majority of US mortgage originations -- meaning that AI/ML governance failures have systemic implications for housing access, fair lending, and financial stability.¶
FHFA Bulletin 2025-16 [FHFA-2025-16] (effective March 3, 2026) establishes four governance pillars: transparency (GSEs must explain AI/ML decisions to regulators, counterparties, and borrowers at the individual loan level); accountability (named individuals must bear documented responsibility for AI/ML outcomes at scale); ethical stewardship (AI/ML systems must not produce discriminatory outcomes inconsistent with the GSEs' statutory mission); and model risk governance (AI/ML systems must be subject to rigorous MRM frameworks including decision-level reconstructability).¶
These requirements converge on a per-decision accountability problem that OMP [I-D.veridom-omp] is specifically designed to address: for any individual mortgage credit decision, property valuation, or servicing action influenced by AI/ML, the entity must demonstrate what the AI/ML recommended, what data it used, which named individual bore accountability, and whether the record has remained intact.¶
This document defines the HomeMark profile: the domain-specific instantiation of OMP for FHFA-regulated housing finance AI/ML deployments. HomeMark denotes that every AI/ML-assisted housing finance decision is cryptographically marked against the entity's FHFA Bulletin 2025-16 obligations, producing a tamper-evident accountability record at the loan level.¶
Related OMP domain profiles include the Employment ADS profile [I-D.veridom-omp-employ] and the EU AI Act Article 12 profile [I-D.veridom-omp-euaia]. Audit Trace payloads are canonicalized per [RFC8785]. The OMP specification is also archived at [ZENODO-OMP].¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] [RFC8174].¶
This document uses the terminology defined in [I-D.veridom-omp]. In addition:¶
FHFA Bulletin 2025-16 requires transparency (individual loan-level documentation explaining AI/ML decisions, contemporaneous not retrospective), accountability (named Responsible Individuals with documented responsibility for AI/ML system governance and decision outcomes), ethical stewardship (per-decision fair lending monitoring and disparate impact assessment), and model risk governance (decision- level reconstructability, ongoing performance monitoring, and human oversight at defined thresholds).¶
GSE MRG frameworks, informed by Bulletin 2025-16 and SR 11-7 [SR-11-7], require decision- level reconstructability (for any loan-level decision, the entity must reconstruct the model's input data, version, and output consistent with the specific loan record); ongoing monitoring for performance degradation, distributional shift, and fair lending risk; and human oversight documentation at defined thresholds.¶
The GSEs operate under ECOA and the Fair Housing Act, prohibiting both intentional discrimination and AI/ML practices producing unjustified disparate impact. FHFA Bulletin 2025-16 requires GSEs to assess and document disparate impact in AI/ML- assisted housing finance decisions. The per-decision HomeMark Audit Trace provides the loan-level evidence fair lending examinations require: what the AI/ML recommended, what data it used, whether a fair lending flag was triggered, and what human oversight was applied.¶
Where an AI/ML system contributed to loan origination or eligibility determination, the seller's R&W obligations require the ability to demonstrate that the AI/ML operated correctly and consistently with applicable guidelines at origination. HomeMark Audit Traces generated at origination provide this loan-level evidence: the RFC 3161 [RFC3161] timestamp proves the AI/ML recommendation was generated at origination (not reconstructed retrospectively), the interaction_hash proves input data integrity, and the ai_ml_system_version documents which AUS version was in effect.¶
FHFA has broad examination authority over GSEs and their counterparties. FHFA examiners may request AI/ML decision process documentation, model risk governance evidence, and fair lending monitoring data at the individual loan level. The HomeMark FHFA Examination Package is designed to satisfy examiner requests within the 30-second production capability specified in this profile.¶
FHFA Bulletin 2025-16, GSE MRG frameworks, ECOA/FHA obligations, and the R&W framework converge on a structure mapping to OMP's three routing states: AI/ML decisions where the RI reviewed the recommendation and bears documented accountability correspond to ASSISTED; decisions where a Fair Lending Flag triggered, confidence fell below the housing finance floor, or a model governance concern was detected correspond to ESCALATED; fully autonomous AUS-eligible transactions are permitted under AUTONOMOUS subject to Section 4.1 constraints, but HomeMark Audit Traces MUST be generated even for AUTONOMOUS routing.¶
The Named Accountable Officer under this profile is the Responsible Individual: the named person who bears documented accountability for the AI/ML-assisted housing finance decision. Required fields:¶
ri_employee_id: stable identifier consistent throughout the relevant loan warranty period;¶
ri_role: role in the AI/ML governance or decision chain (e.g., "underwriter", "credit_officer", "AUS_governance_lead");¶
ri_review_timestamp: ISO 8601 UTC of the RI's review action;¶
ri_decision: one of PROCEED_WITH_AI_RECOMMENDATION, PROCEED_MODIFIED, OVERRIDE, DENY_APPLICATION, APPROVE_APPLICATION, REFER_TO_MANUAL_UNDERWRITING;¶
ri_decision_basis: REQUIRED for all values other than PROCEED_WITH_AI_RECOMMENDATION.¶
Trigger: Composite Confidence Score falls below the housing finance decision floor. For AUS: a Refer or Refer with Caution recommendation signals the loan is outside AUS approval parameters.¶
Action: FORCE_ASSISTED. RI reviews the AI/ML recommendation before any credit action. Loan file MUST reflect the RI's documented review.¶
Rationale: FHFA Bulletin 2025-16 requires human oversight of AI/ML decisions below defined confidence thresholds. An AUS Refer recommendation is itself a signal that human underwriting review is required.¶
Trigger: AI/ML recommendation involves a borrower demographic profile, geographic area, or loan characteristic identified in the entity's fair lending analysis as requiring heightened review for potential disparate impact under ECOA or the Fair Housing Act.¶
Action: FORCE_ASSISTED for standard heightened review. HARD_BLOCK where the AI/ML recommendation conflicts with a pre-identified fair lending risk pattern in the entity's corrective action plan.¶
Rationale: ECOA and the Fair Housing Act prohibit disparate impact in mortgage credit decisioning. WT-FHFA-02 ensures loan applications in identified heightened-review categories receive documented human oversight, sealed in the Audit Trace for FHFA examination.¶
Trigger: Ongoing HomeMark Audit Trace monitoring identifies that the AI/ML recommendation falls within a demographic or geographic segment exhibiting an approval rate or pricing disparity above the entity's configured fair lending alert threshold.¶
Action: FORCE_ASSISTED. fair_lending_flag set to true. RI review and decision basis REQUIRED.¶
Rationale: Continuous per-decision fair lending monitoring enables entities to identify emerging disparate impact before it reaches the threshold of a CFPB or FHFA examination finding. WT-FHFA-03 converts a periodic audit obligation into a continuous per-decision flag.¶
Trigger: Property or loan characteristics match a known validation limitation of the AVM or AUS model (e.g., property type with limited comparable sales data; geographic market where the AUS was not validated; loan product feature outside the validated operating envelope).¶
Action: FORCE_ASSISTED. HomeMark Audit Trace records the specific training limitation triggered and the RI's disposition.¶
Rationale: GSE model risk governance frameworks require entities to document model limitations and ensure decisions outside the validated envelope receive human review. WT-FHFA-04 gives this requirement structural enforcement at the per-decision level.¶
Trigger: AI/ML recommendation deviates from expected operating parameters suggesting model degradation, distributional shift, or data quality failure.¶
Action: FORCE_ESCALATED plus model performance anomaly alert to the entity's model risk governance team.¶
Rationale: AI/ML models in housing finance can experience distributional shift as housing market conditions evolve. Early detection prevents systematic portfolio-level impact from a degraded model operating at scale.¶
Trigger: For loans destined for GSE sale: the AI/ML recommendation or loan data presents a characteristic requiring specific verification for GSE representation and warranty compliance (e.g., loan type requiring additional documentation; data field outside AUS verified input range; characteristic identified in recent GSE quality control findings as a common R&W breach source).¶
Action: FORCE_ASSISTED. RI verifies eligibility before the loan proceeds to GSE sale. HomeMark Audit Trace records eligibility verification and RI confirmation.¶
Rationale: GSE R&W obligations require originators to represent that AUS input data was accurate. WT-FHFA-06 creates a sealed per-loan eligibility verification record supporting R&W compliance and providing evidence in any subsequent repurchase demand.¶
The following fields are REQUIRED under the HomeMark profile, in addition to core fields in [I-D.veridom-omp] Section 7:¶
ri_employee_id: string, REQUIRED for Consequential Housing Finance Decisions.¶
ri_role: string, REQUIRED.¶
ri_review_timestamp: string, ISO 8601 UTC, REQUIRED for ASSISTED and ESCALATED.¶
ri_decision: string, REQUIRED for ASSISTED and ESCALATED. One of: PROCEED_WITH_AI_RECOMMENDATION, PROCEED_MODIFIED, OVERRIDE, DENY_APPLICATION, APPROVE_APPLICATION, REFER_TO_MANUAL_UNDERWRITING.¶
ri_decision_basis: string, OPTIONAL for PROCEED_WITH_AI_RECOMMENDATION; REQUIRED for all other values.¶
loan_identifier: string, REQUIRED. Unique loan number or mortgage ID, enabling per-loan audit trail retrieval for FHFA examination, R&W review, and fair lending investigation.¶
ai_ml_system_id: string, REQUIRED. Identifier of the AI/ML system (e.g., "DU_v11.0", "LPA_v5.2").¶
ai_ml_system_version: string, REQUIRED. Version in effect at time of interaction. Critical for model risk governance and R&W compliance.¶
ai_ml_recommendation: string, REQUIRED. The AI/ML output: for AUS, one of "approve_eligible", "refer", "refer_with_caution", "ineligible"; for AVM, the estimated value and confidence interval; for servicing, the recommended loss mitigation option.¶
fair_lending_flag: boolean, REQUIRED. True if WT-FHFA-02 or WT-FHFA-03 triggered.¶
fair_lending_basis: string, REQUIRED if fair_lending_flag is true. The demographic or geographic basis for the flag.¶
housing_decision_category: string, REQUIRED. One of: "mortgage_origination", "automated_valuation", "loan_servicing", "loss_mitigation", "secondary_market_acquisition".¶
rw_eligibility_verified: boolean, REQUIRED for loans destined for GSE sale. True if WT-FHFA-06 evaluated and confirmed R&W eligibility.¶
fhfa_bulletin_version: string, REQUIRED. Set to "FHFA-2025-16" for deployments under Bulletin 2025-16.¶
profile_version: string, REQUIRED. MUST be "VERIDOM-HOMEMARK-v1.0".¶
The GSE R&W framework creates a retrospective evidence requirement: years after origination, lenders may face repurchase demands requiring demonstration that AI/ML was used correctly. HomeMark Audit Traces provide three specific R&W properties: contemporaneity (RFC 3161 timestamp proves the Audit Trace was generated at origination, not retrospectively); input data integrity (interaction_hash proves the AUS input data has not been altered); and AI/ML system version documentation (ai_ml_system_id and ai_ml_system_version prove which AUS version was in effect at origination).¶
Lenders delivering loans to GSEs SHOULD generate HomeMark Audit Traces for all AUS-assisted originations and retain them for the full R&W warranty period (typically seven years from the note date or loan payoff, whichever is later).¶
The HomeMark profile generates per-loan fair lending evidence (each Audit Trace contains fair_lending_flag and fair_lending_basis) and aggregate fair lending evidence (the Audit Trace stream can be aggregated to compute approval rates by demographic segment, disparate impact ratios, and pricing disparities for FHFA Bulletin 2025-16 monitoring and HMDA analysis).¶
The Fair Lending Evidence Package for a defined loan portfolio MUST contain: all sealed HomeMark Audit Traces organised by housing_decision_category and ai_ml_system_id; aggregate approval rate data by fair lending segment; disparate impact ratio calculations; count and disposition of WT-FHFA-02 and WT-FHFA-03 triggers; chain integrity proof (SHA-256 Merkle root); and RFC 3161 TimeStampToken verification from the OMP Reference Validator [OMP-OPEN-CORE]. FHFA examiners can verify completeness and integrity without relying on the entity's reconstructed data.¶
Implementations of this profile MUST satisfy the following two-property invariant:¶
An entity satisfying the HomeMark Invariant can demonstrate, for any Consequential Housing Finance Decision: the AI/ML recommendation and input data; the AI/ML system identity and version; the RI's identity and review timestamp; the RI's decision and independent basis; the Fair Lending Flag status; R&W eligibility verification where applicable; and that the record has not been altered since sealing. This satisfies the transparency, accountability, and model risk governance requirements of FHFA Bulletin 2025-16, the fair lending examination evidence standards of ECOA and the Fair Housing Act, and the R&W compliance evidence standards of the GSE selling and servicing frameworks.¶
The security considerations of [I-D.veridom-omp] apply in full.¶
Borrower data sensitivity: HomeMark Audit Traces contain borrower PII and financial data subject to GLBA privacy requirements. Operators MUST implement GLBA-compliant safeguards. Fair lending demographic data used in WT-FHFA-02 and WT-FHFA-03 MUST be segregated from credit decision data consistent with ECOA's prohibition on using protected characteristics in credit decisions.¶
AI/ML system version integrity: The ai_ml_system_version field is a critical R&W and model risk governance element. Operators MUST implement controls ensuring the version recorded matches the AUS or AVM version actually in effect at decision time. Version misrepresentation is a material R&W compliance issue.¶
Loan identifier uniqueness: The loan_identifier field MUST be globally unique within the operator's deployment. Duplicate identifiers would create ambiguity in per-loan evidence retrieval and undermine R&W compliance documentation.¶
RI identity integrity: ri_employee_id MUST reflect the individual who actually reviewed or was accountable for the AI/ML-assisted decision. Operators MUST implement technical controls preventing RI identity assignment without the relevant individual's authenticated action.¶
This document has no IANA actions.¶