Skip to main content
Search the Guide:

A3-4-01, Confidentiality of Information (02/05/2025)

Introduction
This topic contains the following:

General Requirements

A seller/servicer often obtains confidential information about borrowers, security property, Fannie Mae technologies, products or services and Fannie Mae’s business when performing underwriting, origination, selling, servicing, or other activities under the Lender Contract or when previewing technologies, products or services (“Confidential Information”).

Confidential Information includes nonpublic personal information (NPI) and all of the following:

  • information relating to

    • technical specifications;

    • product development strategy and activity;

    • pricing and financial information;

    • designs;

    • unpublished patent applications;

    • inventions;

    • improvements;

    • writings and other works of authorship;

    • trade secrets;

    • drawings;

    • models;

    • software (including source code and object code), algorithms, and flow charts; and

    • other documentation;

  • all other confidential, proprietary, or trade secret information which a reasonable person would recognize as such, or which is specifically designated as confidential; and

  • any compilation or summary of the foregoing when disclosed by or on behalf of Fannie Mae to the seller/servicer.

The following table describes Fannie Mae’s requirements related to Confidential Information.

✓ The seller/servicer must...
  Take appropriate steps to ensure the security, integrity, and confidentiality of Confidential Information.
  Comply with all relevant applicable laws and regulations, including laws protecting borrower privacy.
 

Not disclose Confidential Information to third parties, without Fannie Mae’s prior written approval, except on a need-to-know basis to the seller/servicer’s partners, affiliates, officers, employees, directors, contractors, counsels, agents, or representatives, provided they are subject to confidentiality obligations at least as stringent as those set forth in this topic.

Note: These restrictions do not apply to the extent the seller/servicer is required to disclose the Confidential Information by applicable law, provided that the seller/servicer

  • uses all reasonable efforts to give Fannie Mae notice at least ten business days prior to such disclosure; and

  • discloses only that portion of the Confidential Information that the seller/servicer’s legal counsel determines is legally required to be furnished, and request that the information remain confidential.

The requirement to provide Fannie Mae notice is waived if the seller/servicer

  • is required by law to disclose in confidence Confidential Information in response to requests from a governmental agency, regulator, or self-regulatory authority that has authority to regulate or oversee the seller/servicer’s business (including bank examiners, securities examiners, and regulators’ inspector general offices); and

  • formally requests that the information be treated in confidence and exempt from the Freedom of Information Act (FOIA) and other open records laws requests.
 

Not use Confidential Information in any way that could be viewed as

  • a conflict of interest

  • a breach of confidentiality or privacy, or

  • the gaining of an unfair advantage from the seller/servicer’s relationship with Fannie Mae.
 

Employ methods for securely disposing or destroying Confidential Information.

Implement commercially reasonable measures meeting or exceeding industry standards to ensure the security, integrity, and confidentiality of Confidential Information which, at a minimum must meet the requirements outlined in the Supplement.
  Promptly notify Fannie Mae in accordance with the requirements in the Supplement.

The seller/servicer must have the borrower’s authorization to disclose borrower NPI, unless permitted by applicable law, and may disclose information about a borrower’s payment history to a third party if the borrower submits written authorization. The information disclosed must be accurate, complete, and easily understandable.

Fannie Mae may seek immediate equitable relief to enjoin any unauthorized use or disclosure of Confidential Information, in addition to all other rights and remedies it may have at law or otherwise.

Information Security Program

The seller/servicer must implement an Information Security Program that at a minimum, meets the requirements in the Supplement for the Information Security Program requirements.

Loan Quality, Loan Performance Data and NPI

Fannie Mae may at times share loan quality and loan performance data and other NPI with the seller/servicer in compliance with permitted purposes outlined in the Gramm-Leach-Bliley Act and other applicable privacy laws. The seller/servicer must use such data only for those limited permitted purposes.

Feedback on New Products, Product Upgrade, or New Service Offering

The seller/servicer may provide feedback in connection with a new product, product upgrade, or new service offering yet to be released by Fannie Mae in the marketplace. The feedback may include comments and recommendations. When the seller/servicer provides feedback, it grants Fannie Mae an unlimited, worldwide, perpetual, and irrevocable license under the seller/servicer’s intellectual property rights, without duty to account, to disclose, incorporate, practice, deploy, or adapt such feedback.

Specific Transactions or Dealings

For specific transactions or dealings, the seller/servicer and Fannie Mae may enter into a separate written confidentiality agreement. This separate agreement will control in case of conflict with the provisions of this topic. In addition, the seller/servicer and Fannie Mae may also agree in a separate written agreement that the confidentiality obligations set forth in this topic will apply to Fannie Mae.

Fannie Mae Obligations

Fannie Mae will not disclose confidential information received from a seller/servicer in furtherance of this Guide to a third party, except as required or permitted by law.

Exclusions from Confidential Information

The obligations in this topic do not apply to information that

  • is or becomes public through no fault of the seller/servicer,

  • was previously known or is disclosed to the seller/servicer free of any obligation to keep it confidential, or

  • is independently developed by the seller/servicer without reference or access to the Confidential Information.

Recent Related Announcements

The table below provides references to recently issued Announcements that are related to this topic.

Announcements Issue Date
Announcement SEL-2025-01 February 05, 2025

 

Ask Poli

Have questions?

Get answers to your policy and guide questions, straight from the source.

Get Started