Freddie Mac Single-Family Seller/Servicer Guide Section 1302.3 — Business continuity planning

Freddie Mac Single-Family Seller/Servicer Guide Section 1302.3 — Business continuity planning

1302.3: Business continuity planning (03/11/25) This section contains requirements related to: ■ Business continuity plans (BCPs) ■ Review of BCPs ■ Additional policies and procedures to support the BCP ■ BCP education and training (a) BCPs A Seller/Servicer must have a written BCP in place to support its ongoing ability to proactively identify potential threats to, and prevent interruption of, its business operations, including without limitation in the event of: ■ A natural, climate or manmade disaster Or ■ Other event which may cause or causes disruption to Seller/Servicer’s business operations, processes or access to Freddie Mac confidential information, Protected Information and Systems (as defined in Section 2401.1(b)), Mortgage files, data and records Example: The BCP should be operative to maintain business operations in the event of loss of personnel, facilities, third party or access to and use of technology, regardless of the cause of disruption. A Seller/Servicer must be able to maintain and restore any such information it is required to retain in accordance with its Purchase Documents, including without limitation, any information that it is required to retain pursuant to Chapter 1302, following Freddie Mac’s termination of Seller/Servicer’s right to sell and/or service Mortgages. Freddie Mac Single-Family Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-59 (b) Review of BCPs The BCP must be reviewed and updated by the Seller/Servicer at least annually. More frequent assessments may be warranted by material changes to: ■ The environment, including without limitation, the critical personnel responsible for BCP processes and functions, facilities, Related Third Parties and technical infrastructure; ■ The volume of Mortgages originated and sold to Freddie Mac or serviced on behalf of Freddie Mac; or ■ Business operations or systems occur Upon request by Freddie Mac, including in the event of material changes to the conditions described above, Seller/Servicer shall promptly conduct additional assessments and share the results with Freddie Mac. (c) Additional policies and procedures to support the BCP With respect to the BCP requirements set forth in Chapter 1302, the Seller/Servicer must: ■ Establish, maintain and implement policies and procedures which support the BCP. The BCP and related policies and procedures must: ❑ Be approved by the Chief Risk Officer (or the equivalent thereof) and in accordance with Seller/Servicer’s corporate governance ❑ Address response, restoration and repair of actual, known disruptions, as well as prevention of potential disruptions; and ❑ Be reviewed and updated not less than annually ■ Not less than annually, conduct: ❑ A formal risk and threat assessment of the organization ❑ More frequent assessments may be warranted by material changes to: ■ The environment, including without limitation, the critical personnel responsible for BCP processes and functions, facilities, Related Third Parties and technical infrastructure ■ The volume of Mortgages originated and sold to Freddie Mac or serviced on behalf of Freddie Mac; or Freddie Mac Single-Family Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-60 ■ Business operations or systems ❑ Upon request by Freddie Mac, including in the event of material changes to the conditions described above, Seller/Servicer shall promptly conduct additional assessments and share the results with Freddie Mac ❑ Testing of the BCP, including recovery of predefined critical business functions, which at a minimum shall include a stated test objective, scope/success measures, dependency type (People, Facility, Third-Party, Technology), process/functions, assumptions and constraints, identified participants, test environment and test results and associated remediation actions, as applicable ❑ A business disruption impact analysis of the organization (d) BCP education and training Seller/Servicer BCP education and training requirements include: ■ Seller/Servicer must provide BCP training to all employees, contractors and third parties who have responsibility or oversight of BCP functions ■ The training must be current in substance and reflect up-to-date continuity threats and recovery strategies which are consistent with industry best practices ■ At a minimum, the training must provide details on roles and responsibilities for all users in executing the BCP and in protecting Freddie Mac confidential information, Protected Information and Systems Any documents, plans or policies, including without limitation the BCP, referenced in this section shall be provided by Seller/Servicer to Freddie Mac upon request. 1302.3: Business continuity planning (Future effective date 05/11/26) This section contains requirements related to: ■ Business continuity plans (BCPs) ■ Review of BCPs ■ Additional policies and procedures to support the BCP ■ BCP education and training Freddie Mac Single-Family Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-61 (a) BCPs A Seller/Servicer must have a written BCP in place to support its ongoing ability to proactively identify potential threats to, and prevent interruption of, its business operations, including without limitation in the event of: ■ A natural, climate or manmade disaster Or ■ Other event which may cause or causes disruption to Seller/Servicer’s business operations, processes or access to Freddie Mac confidential information, Protected Information and Systems (as defined in Section 2401.1(b)), Mortgage files, data and records Example: The BCP should be operative to maintain business operations in the event of loss of personnel, facilities, third party or access to and use of technology, regardless of the cause of disruption. A Seller/Servicer must be able to maintain and restore any such information it is required to retain in accordance with its Purchase Documents, including without limitation, any information that it is required to retain pursuant to Chapter 1302, following Freddie Mac’s termination of Seller/Servicer’s right to sell and/or service Mortgages. The BCP should include activation and escalation criteria, roles and responsibilities, recovery strategies and procedures for all applicable loss scenarios (i.e., personnel, systems, facilities, and third parties) regardless of cause, and relevant contact information (b) Review of BCPs The BCP must be reviewed and updated by the Seller/Servicer at least annually. More frequent assessments may be warranted by material changes to: ■ The environment, including without limitation, the critical personnel responsible for BCP processes and functions, facilities, Related Third Parties and technical infrastructure; ■ The volume of Mortgages originated and sold to Freddie Mac or serviced on behalf of Freddie Mac; or ■ Business operations or systems occur Freddie Mac Single-Family Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-62 Upon request by Freddie Mac, including in the event of material changes to the conditions described above, Seller/Servicer shall promptly conduct additional assessments and share the results with Freddie Mac. (c) Additional policies and procedures to support the BCP With respect to the BCP requirements set forth in Chapter 1302, the Seller/Servicer must: ■ Establish, maintain and implement policies and procedures which support the BCP. The BCP and related policies and procedures must: ❑ Be approved by the Chief Risk Officer (or the equivalent thereof) and in accordance with Seller/Servicer’s corporate governance ❑ Address response, restoration and repair of actual, known disruptions, as well as prevention of potential disruptions; and ❑ Be reviewed and updated not less than annually ■ Not less than annually, conduct: ❑ A formal risk and threat assessment of the organization ❑ More frequent assessments may be warranted by material changes to: ■ The environment, including without limitation, the critical personnel responsible for BCP processes and functions, facilities, Related Third Parties and technical infrastructure ■ The volume of Mortgages originated and sold to Freddie Mac or serviced on behalf of Freddie Mac; or ■ Business operations or systems ❑ Upon request by Freddie Mac, including in the event of material changes to the conditions described above, Seller/Servicer shall promptly conduct additional assessments and share the results with Freddie Mac ❑ Testing of the BCP, including recovery of predefined critical business functions, which at a minimum shall include a stated test objective, scope/success measures, dependency type (People, Facility, Third-Party, Technology), process/functions, assumptions and constraints, identified participants, test environment and test results and associated remediation actions, as applicable ❑ A business impact analysis (BIA) of the organization’s critical processes. At a minimum, the BIA shall specify critical systems, Freddie Mac Critical Data, key Freddie Mac Single-Family Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-63 locations, key resources (employees), third parties, single points of failure, recovery time objectives, recovery point objectives and maximum acceptable outages. ■ Implement and maintain business continuity metrics and controls to track and/or determine any need for changes to the BCP (d) BCP education and training Seller/Servicer BCP education and training requirements include: ■ Seller/Servicer must provide BCP training to all employees, contractors and third parties who have responsibility or oversight of BCP functions ■ The training must be current in substance and reflect up-to-date continuity threats and recovery strategies which are consistent with industry best practices ■ At a minimum, the training must provide details on roles and responsibilities for all users in executing the BCP and in protecting Freddie Mac confidential information, Protected Information and Systems Any documents, plans or policies, including without limitation the BCP, referenced in this section shall be provided by Seller/Servicer to Freddie Mac upon request.

Source: Freddie Mac Single-Family Seller/Servicer Guide Section 1302.3 — Business continuity planning · source URL · snapshot 5869ee9e606cd4ae