Privacy Discussion Attachment

Vol. 79

Wednesday,

No. 185

September 24, 2014

Part II

Securities and Exchange Commission

tkelley on DSK3SPTVN1PROD with RULES2

17 CFR Parts 229, 230, 232, et al.
Asset-Backed Securities Disclosure and Registration; Final Rule

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

PO 00000

Frm 00001

Fmt 4717

Sfmt 4717

E:\FR\FM\24SER2.SGM

24SER2

57184

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations
FOR FURTHER INFORMATION CONTACT:

SECURITIES AND EXCHANGE
COMMISSION
17 CFR Parts 229, 230, 232, 239, 240,
243, and 249
[Release Nos. 33–9638; 34–72982; File No.
S7–08–10]
RIN 3235–AK37

Asset-Backed Securities Disclosure
and Registration
Securities and Exchange
Commission.
ACTION: Final rule.
AGENCY:

We are adopting significant
revisions to Regulation AB and other
rules governing the offering process,
disclosure, and reporting for assetbacked securities (‘‘ABS’’). The final
rules require that, with some
exceptions, prospectuses for public
offerings under the Securities Act of
1933 (‘‘Securities Act’’) and ongoing
reports under the Securities Exchange
Act of 1934 (‘‘Exchange Act’’) of assetbacked securities backed by real estate
related assets, auto related assets, or
backed by debt securities, including
resecuritizations, contain specified
asset-level information about each of the
assets in the pool. The asset-level
information is required to be provided
according to specified standards and in
a tagged data format using eXtensible
Markup Language (‘‘XML’’). We also are
adopting rules to revise filing deadlines
for ABS offerings to provide investors
with more time to consider transactionspecific information, including
information about the pool assets. We
are also adopting new registration forms
tailored to ABS offerings. The final rules
also repeal the credit ratings references
in shelf eligibility criteria for ABS
issuers and establish new shelf
eligibility criteria.
DATES: Effective Date: November 24,
2014.
Compliance Dates:
Offerings on Forms SF–1 and SF–3:
Registrants must comply with new
rules, forms, and disclosures no later
than November 23, 2015.
Asset level Disclosures: Offerings of
asset-backed securities backed by
residential mortgages, commercial
mortgages, auto loans, auto leases, and
debt securities (including
resecuritizations) must comply with
asset-level disclosure requirements no
later than November 23, 2016.
Forms 10–D and 10–K: Any Form 10–
D or Form 10–K that is filed after
November 23, 2015 must comply with
new rules and disclosures, except assetlevel disclosures.

tkelley on DSK3SPTVN1PROD with RULES2

SUMMARY:

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

Rolaine S. Bancroft, Senior Special
Counsel, Michelle M. Stasny, Special
Counsel, M. Hughes Bates, AttorneyAdvisor, or Kayla Florio, AttorneyAdvisor, in the Office of Structured
Finance at (202) 551–3850, Division of
Corporation Finance, U.S. Securities
and Exchange Commission, 100 F Street
NE., Washington, DC 20549–3628.
SUPPLEMENTARY INFORMATION: We are
adopting amendments to Items 512 1
and 601 2 of Regulation S–K; 3 Items
1100, 1101, 1102, 1103, 1104, 1105,
1108, 1109, 1110, 1111, 1112, 1113,
1114, 1119, 1121, and 1122 4 of
Regulation AB 5 (a subpart of Regulation
S–K); Rules 139a, 167, 190, 193, 401,
405, 415, 424, 430B, 430C, 433, 456, and
457,6 and Forms S–1 and S–3 7 under
the Securities Act of 1933 (Securities
Act); 8 Rules 11, 101, 201, 202, and 305 9
of Regulation S–T; 10 and Rules 3a68–
1a, 3a68–1b, 15c2–8, 15d–22, 15Ga–1,
and 17g–7 11 and Forms 8–K, 10–K, and
10–D 12 under the Securities Exchange
Act of 1934; 13 and Rule 103 14 of
Regulation FD.15 We also are adding
new Items 1124 and 1125 16 to
Regulation AB, and Rule 430D,17 Form
SF–1,18 Form SF–3,19 and Form ABS–
EE 20 under the Securities Act.
Table of Contents
I. Executive Summary
A. Background
B. Problems in the ABS Markets
C. Summary of Final Rules
1. Asset-Level Disclosure
1 17

CFR 229.512.
CFR 229.601.
3 17 CFR 229.10 et al.
4 17 CFR 229.1100, 17 CFR 229.1101, 17 CFR
229.1102, 17 CFR 229.1103, 17 CFR 229.1104, 17
CFR 229.1105, 17 CFR 229.1108, 17 CFR 229.1109,
17 CFR 229.1110, 17 CFR 229.1111, 17 CFR
229.1112, 17 CFR 229.1113, 17 CFR 229.1114, 17
CFR 229.1119, 117 CFR 229.1121, and 17 CFR
229.1122.
5 17 CFR 229.1100 through 17 CFR 229.1124.
6 17 CFR 230.139a, 17 CFR 230.167, 17 CFR
230.190, 17 CFR 230.193, 17 CFR 230.401, 17 CFR
230.405, 17 CFR 230.415, 17 CFR 230.424, 17 CFR
230.430B, 17 CFR 230.430C, 17 CFR 230.433, 17
CFR 230.456, and 17 CFR 230.457.
7 17 CFR 239.11 and 17 CFR 239.13.
8 15 U.S.C. 77a et seq.
9 17 CFR 232.11, 17 CFR 232.101, 17 CFR
232.201, 17 CFR 232.202, and 17 CFR 232.305.
10 17 CFR 232.10 et seq.
11 17 CFR 240.3a68–1a, 17 CFR 240.3a68–1b, 17
CFR 240.15c2–8, 17 CFR 240.15d–22, 17 CFR
240.15Ga–1, and 17 CFR 240.17g–7.
12 17 CFR 249.308, 17 CFR 249.310, and 17 CFR
249.312.
13 15 U.S.C. 78a et seq.
14 17 CFR 243.103.
15 17 CFR 243.100 et seq.
16 17 CFR 229.1124 and 17 CFR 229.1125.
17 17 CFR 230.430D.
18 17 CFR 239.44.
19 17 CFR 239.45.
20 17 CFR 249.1500.
2 17

PO 00000

Frm 00002

Fmt 4701

Sfmt 4700

2. Other Disclosure Requirements
3. Securities Act Registration
(a) Certification
(b) Asset Review Provision
(c) Dispute Resolution
(d) Investor Communication
(e) Other Shelf Offering Provisions
4. Other Changes to ABS Rules
5. Proposed Rules Not Being Adopted at
This Time
II. Economic Overview
A. Market Overview and Economic
Baseline
B. Economic Motivations
C. Potential Effects on the ABS Market
D. Potential Market Participants’ Responses
III. Asset-Level Disclosure
A. Asset-Level Disclosure Requirement
1. Background and Economic Baseline for
the Asset-Level Disclosure Requirement
(a) Proposed Rule
(b) Comments on Proposed Rule
(c) Final Rule and Economic Analysis of
the Final Rule
2. Specific Asset-Level Data Points in
Schedule AL
(a) Disclosure Requirements for All Asset
Classes and Economic Analysis of These
Requirements
(b) Asset Specific Disclosure Requirements
and Economic Analysis of These
Requirements
(1) Residential Mortgage-Backed Securities
(2) Commercial Mortgage-Backed
Securities
(3) Automobile Loan or Lease ABS
(4) Debt Security ABS
(5) Resecuritizations
3. Asset-Level Data and Individual Privacy
Concerns
(a) Proposed Rule
(b) Comments on Proposed Rule
(c) Final Rule and Economic Analysis of
the Final Rule
4. Requirements Under Section 7(c) of the
Securities Act
(a) Section 7(c)(2)(B)—Data Necessary for
Investor Due Diligence
(b) Section 7(c)(2)(B)(i)—Unique Identifiers
Relating to Loan Brokers and Originators
(c) Section 7(c)(2)(B)(ii)—Broker
Compensations and Section
7(c)(2)(B)(iii)—Risk Retention by
Originator and the Securitizer of the
Assets
B. Asset-Level Filing Requirements
1. The Timing of the Asset-Level
Disclosure Requirements
(a) Timing of Offering Disclosures
(1) Proposed Rule
(2) Comments on Proposed Rule
(3) Final Rule and Economic Analysis of
the Final Rule
(b) Timing of Periodic Disclosures
(1) Proposed Rule
(2) Comments on Proposed Rule
(3) Final Rule and Economic Analysis of
the Final Rule
2. The Scope of New Schedule AL
(a) Proposed Rule
(1) Offering Disclosures
(2) Periodic Disclosures
(b) Comments on Proposed Rule
(c) Final Rule and Economic Analysis of
the Final Rule
3. XML and the Asset Data File

E:\FR\FM\24SER2.SGM

24SER2

tkelley on DSK3SPTVN1PROD with RULES2

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations
performance information, how the
underlying securities were acquired,
and whether and when the underlying
securities experienced any trigger events
or rating downgrades.
The final requirement to provide
asset-level data in the prospectus and in
periodic reports will require that issuers
provide more information to investors
about resecuritizations than previously
required. The asset-level disclosures
about the ABS in the asset pool will
provide investors, at a minimum, with
the basic characteristics of a
resecuritization. Further, by requiring
disclosure of the SEC file number and
CIK number for ABS being
resecuritized, it will be easier for
investors to locate more information
about each resecuritized ABS. Public
access to such information, including,
when applicable, access to information
about the assets underlying the ABS
being resecuritized, should reduce
investors’ burden to obtain this
information, and reduce their need to
rely on credit ratings because investors
will have access to the information in
order to conduct their own independent
analysis. In turn, this will allow for a
more effective and efficient analysis of
the offering and should help foster more
efficient capital formation.
We do not agree with a commenter’s
view that there is a limited correlation
between loan performance and bond
performance and, as a result, there is
little benefit from investors receiving
asset-level data about the assets
underlying the ABS being resecuritized.
Specifically, the commenter believed
that the asset-level data about the
underlying ABS would not be useful
because only certain classes of an ABS
are resecuritized, and the loans backing
a particular class are typically
supported by the entire underlying loan
pool, and therefore do not correlate to
any specific classes of ABS. We disagree
and believe that to determine the
performance of any particular
resecuritization, an understanding of
each loan in the underlying loan pool is
necessary in order to analyze how the
underlying loans impact the cash flows
to the resecuritization.
In addition, with respect to the
availability of information, Section
942(a) of the Dodd-Frank Act eliminated
the automatic suspension of the duty to
file under Section 15(d) of the Exchange
Act for ABS issuers and granted the
Commission the authority to issue rules
providing for the suspension or
termination of such duty.543 As a result,
543 See Suspension of the Duty to File Reports for
Classes of Asset-Backed Securities Under Section
15(d) of the Securities Exchange Act of 1934,

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

ABS issuers with Exchange Act Section
15(d) reporting obligations will be
required to report asset-level
information, thereby easing concerns
that the asset-level information for
residential mortgages, commercial
mortgages, auto loans, auto leases, or
debt securities underlying the ABS in
the resecuritization would not be
available on an ongoing basis.
With respect to the cost and burden
to provide the disclosures and concerns
about securities law liability for
information obtained from third parties,
we believe the existing ability to
reference third party information, in
part, addresses these concerns. As is the
case today, issuers may satisfy their
disclosure requirements by referencing
third-party reports if certain conditions
are met.544 New Forms SF–1 and SF–3
require that the asset-level information
be filed on Form ABS–EE and
incorporated into the prospectus.545
Similarly, revised Form 10–D requires
incorporation by reference to Form
ABS–EE.546 If the underlying ABS is of
a third-party, we will permit issuers to
reference the third-party’s filings of
asset-level data provided that they
otherwise meet the existing third-party
referencing conditions. Consequently,
reports of all third parties, not only
those that are significant obligors, may
be referenced. Because issuers are not
incorporating third-party filings by
reference, but instead merely
referencing these filings, we believe we
have addressed concerns about issuers’
filing burdens and securities law
liability for asset-level information filed
by third parties.
While some commenters raised
concerns about the cost to implement
such requirements, commenters did not
provide any quantitative cost estimates
to comply with this requirement.
Implementation of this requirement,
even if a registrant can reference thirdparty filings, will require system reprogramming and technological
investment. In addition, registrants will
incur a nominal cost to provide data
about the securities being resecuritized.
In general, the data about the securities,
which track the debt security ABS
Release No. 34–65148 (Aug. 17, 2011) [76 FR
52549].
544 See Item 1100(c)(2) of Regulation AB [17 CFR
229.1100(c)(2)]. In many instances, the issuer of the
ABS being resecuritized would be considered a
significant obligor as defined in Item 1101(k) of
Regulation AB. If so, issuers may reference
information about the significant obligors located in
third-party reports as set forth in Item 1100(c)(2).
545 See Section III.B.5 New Form ABS–EE,
General Instruction IV and Item 10 of Form SF–1
and General Instruction IV and Item 10 of Form SF–
3.
546 See Item 1A of Form 10–D.

PO 00000

Frm 00049

Fmt 4701

Sfmt 4700

57231

requirements, should include data
already readily available to issuers,
especially since the requirements
primarily include basic characteristics
of the security, such as the title of the
security, payment frequency, and
whether it is callable. Registrants will
incur a nominal cost to provide this data
in the format requested. If asset-level
data is required for the assets
underlying the securities being
resecuritized, registrants will, to the
extent they cannot otherwise
incorporate by reference or reference
third-party filings, incur costs to obtain
the data required about the assets
underlying the securities being
resecuritized or to convert data available
to them into the required format. These
costs were discussed earlier in the
release in the context of complying with
asset-level disclosure for RMBS, CMBS
and Auto ABS. We believe such costs
are appropriate because investors
should receive information about the
securities that will allow them to
conduct their own independent
analysis. In addition to the items noted
above that mitigate cost concerns, we
also believe the extended timeframe for
compliance of 24 months lowers the
overall burden placed on registrants and
market participants and should provide
ample time for registrants and market
participants to assess the availability of
the asset-level information required for
resecuritizations and to put the
information in the format required.
3. Asset-Level Data and Individual
Privacy Concerns
(a) Proposed Rule
As we noted in the 2010 ABS
Proposing Release and the 2011 ABS ReProposing Release and as the staff noted
in the 2014 Staff Memorandum, we are
sensitive to the possibility that certain
asset-level disclosures may raise
concerns about the underlying obligor’s
personal privacy. In particular, we
noted that asset-level data points
requiring disclosures about the
geographic location of the obligor or the
collateralized property, credit scores,
income and debt may raise privacy
concerns. We also noted, however, that
information about credit scores,
employment status and income would
permit investors to perform better risk
and return analysis of the underlying
assets and therefore of the ABS.
In light of privacy concerns, we did
not propose to require issuers to
disclose an obligor’s name, address or
other identifying information, such as

E:\FR\FM\24SER2.SGM

24SER2

57232

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

the zip code of the property.547 We also
proposed ranges, or categories of coded
responses, instead of requiring
disclosure of an exact credit score 548 or
income or debt amounts in order to
prevent the identification of specific
information about an individual.549
The 2014 Staff Memorandum
summarized the comments received
related to potential privacy concerns
and outlined an approach to address
these concerns that would require
issuers to make asset-level information
available to investors and potential
investors through an issuer-sponsored
Web site rather than having issuers file
on EDGAR and make all of the
information, including potentially
sensitive information, publicly
available. Under the Web site approach,
issuers could take steps to address
potential privacy concerns associated
with asset-level disclosures, including
through restricting Web site access to
potentially sensitive information. The
Web site approach also would require
issuers to file a copy of the information
disclosed on a Web site with the
Commission in a non-public filing to
preserve the information and to enable
the Commission to have a record of all
asset-level information provided to
investors. The prospectus would need to
disclose the Web site address for the
information, and the issuer would have
to incorporate the Web site information
by reference into the prospectus. In
addition, issuers would be required to
file asset-level information that does not
raise potential privacy concerns on
EDGAR in order to provide the public
with access to some asset-level
information.

tkelley on DSK3SPTVN1PROD with RULES2

(b) Comments on Proposed Rule
In response to the 2010 ABS Proposal,
several commenters noted that the assetlevel requirements would raise privacy
concerns.550 These commenters
547 We proposed to require the broader geographic
delineations of MSAs in lieu of the narrower
geographic delineation of zip codes.
548 For asset-level data points that require
disclosure of obligor credit scores, we proposed
coded responses that represent ranges of credit
scores (e.g., 500–549, 550–599, etc.). The ranges
were based on the ranges that some issuers used in
pool-level disclosure.
549 For monthly income and debt ranges, we
developed the ranges based on a review of
statistical reporting by other governmental agencies
(e.g., $1,000–$1,499, $1500–$1,999, etc.). See the
2010 ABS Proposing Release at 23357.
550 See, e.g., letters from ABA I, CU, MBA I
(suggesting that the use of Metropolitan Statistical
Areas or Divisions in lieu of zip code would not
mask the location of particular properties), VABSS
I, and WPF I (also suggesting that the proposed
asset-level disclosures would not mask the location
of particular properties and additionally that they
may provide information useful in the reidentification process). In general, these

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

suggested that, while the proposed
asset-level disclosures would not
include direct identifiers, if the
responses to certain asset-level data
requirements are combined with other
publicly available sources of
information about consumers it could
permit the identity of obligors in ABS
pools to be uncovered or ‘‘reidentified.’’ 551 A number of
commenters noted that, if an obligor
was identified through this process,
then the obligor’s personal financial
status could be determined.552 The
commenters noted that if obligors are reidentified, then information about an
obligor’s credit score, monthly income
and monthly debt would be available to
the general public through the EDGAR
filing. Commenters also noted that if
personal information was linked to an
individual through the asset-level
disclosures this may conflict with 553 or
undermine 554 the consumer privacy
protections provided by federal and
foreign laws restricting the release of
individual information and increase the
potential for identity theft and fraud.555
commenters were concerned that it may be possible
to identify an individual obligor by matching assetlevel data about the underlying property or asset
with data available through other public or private
sources about assets and their owners.
551 See, e.g., letter from WPF I (suggesting that
attempts to mask the location of particular
properties and the identity of borrowers are not
workable because there is too much information
about mortgages available that would allow the
location of a particular property to be found).
552 See, e.g., letters from ABA I, AFSA I,
American Resort Development Association dated
July 22, 2010 submitted in response to the 2010
ABS Proposing Release, ASF II, CDIA, CNH I, CU,
Anita B. Carr dated May 12, 2010 submitted in
response to the 2010 ABS Proposing Release, Daniel
Edstrom dated May 12, 2010 submitted in response
to the 2010 ABS Proposing Release, Epicurus, ELFA
I, FSR, MBA I, National Association of Federal
Credit Unions dated Aug. 2, 2010 submitted in
response to the 2010 ABS Proposing Release,
Navistar, SIFMA I, SLSA, TYI, VABSS I, Vantage
Score Solutions LLC dated Aug. 2, 2010 submitted
in response to the 2010 ABS Proposing Release
(‘‘Vantage I’’), and WPF I.
553 See, e.g., letters from ABA I (stating that the
asset-level disclosures would potentially result in
release to the public of detailed non-public personal
financial information (as defined in Title V of the
Gramm-Leach-Bliley Act (‘‘GLBA’’)) as well as
consumer report information (as defined in FCRA),
CDIA (suggesting that certain data may fall under
the protections of FCRA, GLBA, or both), Epicurus,
TYI (suggesting that if the disclosures could be used
to identify a borrower in a European-based ABS,
this may violate European privacy laws), and WPF
I.
554 See letter from WPF I (suggesting that if data
that may fall under the scope of FCRA is posted on
EDGAR and subsequently linked to an individual,
the data may become public and, therefore, the
transfer of this information to others may
contravene FCRA restrictions).
555 See letters from CDIA, VABSS II, and WPF I
(suggesting that the cost of identity theft would not
only fall on borrowers, but also on asset holders
and, therefore, investors would demand higher
returns to protect against those losses).

PO 00000

Frm 00050

Fmt 4701

Sfmt 4700

Most commenters did not support the
use of coded ranges, noting it would not
address privacy concerns 556 and would
not further the Commission’s objective
of improving disclosure for ABS
investors. Two commenters noted that
using coded ranges would not mitigate
privacy concerns because the ranges are
so narrowly defined they would identify
the actual score or dollar amount of
income.557 Other commenters believed
that the use of ranges for disclosures,
such as credit scores and income, or
requiring a broader geographic identifier
for the property, such as MSAs, would
greatly reduce the utility of the
information.558 Commenters also noted
that disclosure of data that relates to the
credit risk of the obligor, such as an
obligor’s exact credit score, income, or
employment history, would strengthen
investors’ risk analysis of ABS involving
consumer assets.559 Commenters also
suggested that exact income and credit
scores are necessary to appropriately
price the securities 560 and verify issuer
disclosures.561
We received few suggestions for
alternative approaches to balancing
individual privacy concerns and the
needs of investors to have access to
detailed financial information about
obligors. Commenters suggested we
work with other federal agencies to
evaluate whether the proposed assetlevel information was in fact
anonymized 562 and to assess whether
the required asset-level disclosures
would subject issuers to liability under
556 But see letters from CDIA (noting that the
proposed ranges or categories may provide some
privacy protection) and ASF II (expressed views of
loan-level investors only) (suggesting the use of
range-based reporting for certain credit sensitive
fields may also provide a solution to privacy
concerns).
557 See letters from CDIA and MBA I.
558 See letters from ASF I (expressed views of
investors only), Beached Consultancy (suggesting
that the metropolitan area is too broad to be useful,
and, therefore, a ‘‘3-digit zip code’’ should be
permitted), and Wells Fargo I.
559 See letters from ASF I (requesting disclosure
of exact credit score and noting that requiring
ranges would be a step back in terms of
transparency), Interactive (noting that asset-level
granularity is essential for robust evaluation of loss,
default and prepayment risk associated with
RMBS), Prudential I (suggesting that ranges of FICO
score bands are not sufficient to appreciate the
linkages between collateral characteristics), and
Wells Fargo I (expressing concern that restricting
information available to investors could result in
substantially lower pricing for new residential
mortgage backed securities offerings). See also
SIFMA I (expressed views of investors only)
(recommending 25-point buckets for credits scores
rather than the 50-point buckets as proposed).
560 See, e.g., letters from ASF I, Prudential I, and
Wells Fargo I.
561 See letter from ASF I (expressed views of
investors only) (suggesting that exact income allows
them to double check the issuer’s DTI calculations).
562 See letters from ABA I and ASF I.

E:\FR\FM\24SER2.SGM

24SER2

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations
the federal privacy laws.563 Many
commenters that supported groupedaccount disclosures rather than assetlevel disclosures indicated that grouped
disclosures also could address privacy
concerns with asset-level disclosures.564
Other commenters suggested addressing
privacy concerns by changing the
disclosure format, such as by requiring
that disclosure be presented in ratios
rather than dollar amounts,565 requiring
a default propensity percentage in lieu
of a credit score,566 or only requiring
narrative disclosure.567
We also received suggestions that we
should restrict access to or impose
conditions on the use of sensitive data.
For instance, a commenter suggested
that we establish a central ‘‘registration
system’’ where access to sensitive data
is only made to persons who have
independently established their
identities as investors, rating agencies,
data providers, investment banks or
other categories of users while
forbidding others to use the data or
include the data in commercially
distributed databases.568 Another
commenter suggested that the
Commission consider restricting access
to registered users who acknowledge the
potentially sensitive nature of the data
and agree to maintain its
confidentiality.569 This commenter
suggested that requiring users to
identify themselves and accept
appropriate terms of use would provide
a deterrent to those who might attempt
to abuse personal financial data and
permit identification of such users
should any abuse occur. Another
commenter suggested establishing rules
applicable to the posting, use and
dissemination of potentially sensitive
data disclosed on EDGAR, including
penalties for violation of the rules.570
In light of the comments received
raising individual privacy concerns and
the requirements of new Section 7(c) of
the Securities Act, we requested
additional comment on privacy
generally in the 2011 ABS Re-Proposing
Release.571 We received limited
563 See

letter from ABA I.
e.g., letters from ASF II (expressed views
of issuers and a portion of investors only) and
VABSS II.
565 See letter from CU (suggesting that liquid cash
reserves be expressed as a ratio relative to the
borrower’s debt).
566 See letter from Vantage I (describing default
propensity as the chance that a consumer will
become 90 or more days late on a debt that he or
she owes expressed as a percentage).
567 See letter from ABAASA I.
568 See letter from VABSS II.
569 See letter from CDIA.
570 See letter from Epicurus.
571 For instance, we asked how asset-level data
could be required, both initially and on an ongoing

tkelley on DSK3SPTVN1PROD with RULES2

564 See,

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

additional feedback on how to address
the potential privacy issues surrounding
the proposed asset-level disclosures.
Commenters again stated that the assetlevel requirements, as proposed, would
raise privacy concerns.572 One
commenter suggested that the
Commission could address privacy
concerns by not requiring the disclosure
of social security numbers, only
requiring MSA information about the
property instead of a property’s full
address, and replacing borrower name
with an ID number.573 Other
commenters stated or reiterated that for
some asset classes a grouped-account or
pool-level disclosure format may
mitigate privacy concerns.574 One
commenter repeated the suggestions
that it provided in previous comment
letters that the Commission could
establish and manage (or have a thirdparty manage) a central ‘‘registration
system’’ that could provide restricted
access.575
On February 25, 2014, we re-opened
the comment period to permit interested
persons to comment on the Web site
approach described in the 2014 Staff
Memorandum. Only a few commenters
indicated support for the Web site
approach.576 Most commenters
basis, to implement Section 7(c) effectively, while
also addressing privacy concerns. We asked which
particular data elements could be revised or
eliminated for each particular asset class in a
manner that would address privacy concerns, while
still enabling an investor to independently perform
due diligence. We also requested comment on
whether it would be appropriate to require issuers
to provide an obligor’s credit score and income on
a grouped basis in a format similar to the proposal
for credit cards in the 2010 ABS Proposing Release.
572 See, e.g., letter from Mortgage Bankers
Association dated Oct. 4, 2011 submitted in
response to the 2011 ABS Re-Proposing Release
(‘‘MBA III’’) (reiterating that several of the data
points proposed could allow someone to identify
the obligor and that ‘‘the income and credit score
ranges do not mitigate privacy issues because the
suggested ranges are so narrowly defined that they
virtually identify the actual score or dollar amount
of income’’).
573 See letter from MetLife II.
574 See letters from Sallie Mae, Inc. (SLM
Corporation) dated Oct. 4, 2011 submitted in
response to the 2011 ABS Re-Proposing Release
(‘‘Sallie Mae II’’) (suggesting that ‘‘data presented on
a grouped basis should address all privacy
concerns’’), VABSS III (again suggesting that a
grouped data approach minimizes, but does not
eliminate, privacy concerns), and VABSS IV (stating
that they believe a grouped data approach is the
best way to provide additional information to
investors while addressing obligor privacy and
competitive concerns).
575 See letters from VABSS III (suggesting that it
would not be an ‘‘overwhelming process to
establish and maintain a restricted-access system’’
and that Section 7(c) does not require that data that
raises privacy concerns be made publicly available)
and VABSS IV.
576 See letters from AFR (noting the advantages of
the Web site approach include the disclosure of
more granular data and the ability to restrict the
data to those who agree to accept legal liability for

PO 00000

Frm 00051

Fmt 4701

Sfmt 4700

57233

generally opposed the Web site
approach as a means to address privacy
concerns,577 and some commenters also
noted that the Web site approach creates
or shifts legal and reputational risks to
issuers.578 Commenters expressed
concern about whether the Web site
approach could result in issuer liability
under applicable privacy laws.579
Several commenters were specifically
concerned that the Web site approach
might create a risk that the issuer could
be considered a ‘‘consumer reporting
agency’’ under the FCRA and thus
subject to its rules and regulations.580
One commenter noted that the FCRA
would not be relevant most of the time
because the type of information
contemplated by the Web site approach
would be beyond the reach of the FCRA
while also noting that privacy laws do
not protect most consumer data,
including the proposed asset-level data,
regardless of how it may be
disseminated.581 A number of
privacy violations), CII (stating, however, that the
restrictions placed on accessing the Web site should
not be any more restrictive than user accounts and
confidentiality agreements and that issuers should
provide, instead of coded ranges, specific credit
scores, income, and debt), A. Schwartz (stating that
the Web site approach places the liability for errors
in the asset-level data on issuers and preserves the
privacy interests of borrowers), and World Privacy
Forum dated Apr. 18, 2014 submitted in response
to the 2014 Re-Opening Release (‘‘WPF II’’)
(suggesting, however, that the Commission rather
than issuers be responsible for maintaining the
data).
577 See, e.g., letters from ABA III, AFSA II, Capital
One II, Deutsche Bank dated Mar. 28, 2014
submitted in response to the 2014 Re-Opening
Release (‘‘Deutsche Bank’’), MBA IV (with respect
to RMBS), SIFMA/FSR I-dealers and sponsors, and
Treasurer Group.
578 See, e.g., letters from AFSA II (also suggesting
that the Web site approach did not conform to the
White House’s Consumer Privacy Bill of Rights
because the Web site approach does not specify
requirements to provide control or choice to
consumers on the sharing of their data with others),
Deutsche Bank, MBA IV (also stating that the Web
site approach shifts operational risks to issuers),
and SFIG II.
579 See, e.g., letters from AFSA II, CCMR,
Deutsche Bank, Lewtan (suggesting that there is
uncertainty surrounding FCRA liability for issuers,
investors, and all deal parties who touch data
originally obtained in the process of underwriting
a loan to the consumer), MBA IV, SFIG II (also
noting that issuers may be subject to restrictions
under state laws), SIFMA/FSR I-dealers and
sponsors, and Wells Fargo III. See also letters from
ELFA II (noting that the dissemination of asset-level
data under the Web site approach or through
EDGAR would create legal and reputational risks),
and Treasurer Group (noting the requirements of
Canada’s privacy laws).
580 See letters from ABA III, CCMR, Lewtan,
SIFMA/FSR I-dealers and sponsors, SFIG II, and
Wells Fargo III (noting, for example, that if an issuer
is considered a consumer reporting agency, among
other things, it will have a duty to update and
correct information about the consumer and failure
to comply with these duties could subject the issuer
to consumer actions and CFPB enforcement).
581 See letter from WPF II.

E:\FR\FM\24SER2.SGM

24SER2

57234

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

tkelley on DSK3SPTVN1PROD with RULES2

commenters requested that the
Commission obtain an authoritative
interpretation or some other form of
guidance from the CFPB to clarify issuer
liability under the privacy laws when an
issuer provides asset-level data before
moving forward.582 A few commenters
suggested that under the Web site
approach data could still be widely
distributed,583 and two commenters
stated that taking steps to reduce the
ability to re-identify a person would be
more appropriate than limiting access to
sensitive data.584 Some other general
concerns about the Web site approach
included: the costs and burdens of the
Web site approach; 585 the possibility of
data breaches and the impacts from data
breaches; 586 potential negative market
impacts; 587 and the possibility that
inconsistencies in technical standards
between Web sites may make the Web
sites difficult to use.588
Some commenters disagreed with the
description in the 2014 Staff
Memorandum of how issuer Web sites
582 See, e.g., letters from SIFMA/FSR II-dealers
and sponsors, Wells Fargo III, MBA IV (with respect
to RMBS), and SFIG II (noting concerns that the
CFPB has not affirmed past FTC guidance on the
transfer of information incident to the transfer of an
asset in a securitization and stating that while it
strongly believed that an issuer would not become
a consumer reporting agency under FCRA by
disclosing asset-level information, the CFPB needs
to provide a rule or authoritative interpretation that
the data posted in accordance with the Web site
approach would not be a consumer report and that
the issuer would not become a consumer reporting
agency). See also letter from CCMR (requesting that
the Commission, CFPB and Federal Trade
Commission (FTC) provide assurance that misuse of
disclosures made under the Web site approach
would not render the issuer liable for privacy law
violations).
583 See, e.g., letters from ABA III (stating that in
the case of registered offerings ABS may be sold to
any person, including individuals, without
restriction, resulting in a potentially unlimited pool
of investors and potential investors), Capital One II,
and SFIG II.
584 See letters from ABA III and Treasurer Group.
These comments are discussed in more detail
below.
585 See letters from AFSA II, ELFA II, Lewtan,
MBA IV (with respect to RMBS) (suggesting that the
costs would include improving security protocols
and designing controls to minimize sharing of the
information once a party accesses the Web site),
SFIG II, SIFMA/FSR I-dealers and sponsors
(objecting to a requirement that issuers file nonsensitive data on EDGAR because it is redundant,
imposes unnecessary costs and is incomplete since
certain fields would be omitted), and Wells Fargo
III.
586 See, e.g., letters from ABA III, AFSA II, ELFA
II, Lewtan, MBA IV (with respect to RMBS), and
Wells Fargo III.
587 See, e.g., letters from ELFA II (expressing
concern that issuers may leave the ABS capital
markets due to cost and liability concerns) and
Lewtan (noting that issuers and investors may leave
the market or move to the Rule 144A market
because they cannot get comfortable with the risks
associated with FCRA, while acknowledging that
similar risks exist in the Rule 144A market).
588 See letter from AFR.

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

were being used at the time the 2014
Staff Memorandum was released.589 For
instance, one commenter noted that
while Web sites were being used at that
time to provide information to investors,
the information is not the same as what
the Commission had proposed to
require and does not raise the same
privacy concerns.590 Another
commenter noted that current
disclosure of asset-level information
through Web sites is available only to a
limited number of known institutional
investors.591
Several commenters stated that
additional information was necessary to
fully assess the potential implications of
the Web site approach. For instance,
commenters requested clarity on the
scope of asset-level disclosures that the
Commission is considering adopting,
what data would be disclosed on
EDGAR and on the Web site, what type
of restrictions on access would be
reasonable and what information is
‘‘necessary’’ for investor due
diligence.592 Another commenter sought
information about whether the
Commission is still considering assetlevel disclosures for certain non-RMBS
asset classes.593 Five commenters urged
the Commission to re-open the 2010
ABS Proposal and the 2011 ABS ReProposal, in general, to permit further
consideration of the concerns
surrounding asset-level disclosures.594
A number of commenters responded
to the 2014 Re-Opening Release by
589 See

letters from ABA III, AFSA II, and SFIG

II.
590 See letter from AFSA II. See also letter from
ABA III (noting that the amount of information
proposed for release under the Web site approach
exceeds the amount of information typically made
available through Web sites).
591 See letter from SFIG II.
592 See, e.g., letters from ABA III, Deutsche Bank,
Lewtan (noting that they did not comment on data
point requirements due to the brief comment period
and uncertainty about which aspects of the 2010
ABS Proposals remain under consideration),
SIFMA/FSR I-dealers and sponsors (requesting
clarity on whether any of the asset-level data may
be considered ‘‘material’’ under the securities laws
and whether disclosure of asset-level data as
proposed complies with privacy laws), and Wells
Fargo III (requesting clarification of which data
points would require specific values in order to
evaluate privacy issues).
593 See letter from SIFMA/FSR I-dealers and
sponsors.
594 See letters from Capital One II, ELFA II (asking
the Commission to reconsider requirements for
equipment ABS), SFIG II (noting uncertainty as to
whether ranges or specific values will be required
for sensitive data points and whether the rules will
apply to the Rule 144A market), SIFMA/FSR Idealers and sponsors (suggesting that any reproposal should include definitive, coordinated
federal guidance about compliance with privacy
laws, whether the disclosure requirements will
apply to the Rule 144A market, which asset classes
will be subject to the disclosure requirements and
assurances about whether the data can be reidentified), and Wells Fargo III.

PO 00000

Frm 00052

Fmt 4701

Sfmt 4700

commenting generally on privacy
concerns. Several commenters reiterated
the re-identification concerns that were
raised in response to the 2010 ABS
Proposing Release and the 2011 ABS ReProposing Release.595 Commenters again
suggested that obligors may suffer harm
if personal data is used to re-identify
them.596 Several commenters noted that
the asset-level requirements, as
proposed in 2010, contain a variety of
highly sensitive personal information
that consumers would not expect to be
available to the general public, such as
information about debt, income,
bankruptcies, foreclosures, job losses,
and even whether the consumer has
experienced marital difficulties.597 One
commenter raised particular concern
with disclosure of actual income as such
data is highly desirable to the consumer
data industry but hard to obtain.598 One
commenter requested that the
Commission provide assurance that the
data required to be filed on EDGAR
could not be reasonably linked to an
individual consumer.599 Some
commenters expressed concern that the
proposed requirements could result in
the disclosure of ‘‘Personally
Identifiable Information’’ or ‘‘PII,’’
which could result in legal liability or
reputational damage.600 In addition, a
few commenters identified various laws
that may apply to the asset-level
disclosures, including non-privacy
related laws.601 Another commenter
noted, however, that the availability of
potentially sensitive obligor data is not
new to the market.602 Another
commenter believed criminal actors
595 See, e.g., letters from ABA III, Capital One II,
Deutsche Bank, SFIG II (noting that whether an
obligor underlying a foreign loan can be reidentified through the proposed asset-level data
will depend on the jurisdiction), SIFMA/FSR Idealers and sponsors, Treasurer Group (suggesting
that the final requirements not include geographic
identifiers or other individual identifiers that can
identify a borrower), and WPF II.
596 See, e.g., letters from ABA III, SFIG II, and
SIFMA I (expressed view of issuers and sponsors
only).
597 See, e.g., letters from Deutsche Bank, SIFMA/
FSR I-dealers and sponsors, and Wells Fargo III.
598 See letter from WPF II.
599 See letter from SIFMA/FSR I-dealers and
sponsors.
600 See letter from SIFMA/FSR I-dealers and
sponsors (questioning whether some or all of the
asset-level information could be considered PII
under federal and state laws). See also letters from
ABA III and MBA IV (with respect to RMBS).
601 See letters from ABA III (noting questions
about the application of the GLBA, FCRA and
Freedom of Information Act (‘‘FOIA’’)), and SIFMA/
FSR-dealers and sponsors (noting questions about
the application of GLBA and the Fair Debt
Collections Practices Act, and whether the
information would be subject to FOIA).
602 See letter from Lewtan (noting that they
collect and disseminate ABS-related data, including
asset-level data).

E:\FR\FM\24SER2.SGM

24SER2

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

tkelley on DSK3SPTVN1PROD with RULES2

would prefer to obtain access to other
databases containing information more
conducive to identity theft, such as
social security numbers and date of
birth, neither of which would be
required by the Commission.603
Many commenters expressed
particular concern with the disclosure
of a property’s geographic location
because it, along with other data points,
can be used with other public databases
to match a property with a specific
borrower.604 Commenters’
recommendations to revise the
geographic data point varied. One
commenter recommended that the
Commission limit disclosure of the zip
code to only the first two digits.605
Another commenter, without providing
a specific recommendation, believed
that any geographic data point must be
sufficiently broad to ensure that there is
no risk of re-identification.606 One
commenter reiterated its support for
aggregation of geographic location.607 In
contrast, another commenter noted its
opposition to the 2010 ABS Proposal to
require only MSA because it would
compromise the utility of the data for
investors.608
Several commenters suggested various
alternatives and modifications to the
Web site approach. Three commenters
suggested aggregating the asset-level
data.609 These commenters, however,
did not specify what they meant by
‘‘aggregated.’’ 610 Another commenter
603 See letter from AFR. Despite its belief that the
Web site approach would not create a new target
for criminal actors, AFR recommended that the
Commission not adopt such an approach because:
(i) Issuers could inappropriately discriminate in
providing access to the restricted Web site; (ii) there
is a potential that not all issuers would have the
technical capacity to implement appropriate
privacy controls; and (iii) if the design of the data
is left to issuers, standardization of the data format
would not be possible, making it more difficult to
use.
604 See letters from ABA III, ELFA II, Lewtan,
SIFMA/FSR I-dealers and sponsors, SFIG II,
Treasurer Group, and Wells Fargo III.
605 See letter from ABA III (noting that the
Department of Health and Human Services, as part
of its efforts to keep consumers’ health information
anonymous, has limited disclosure of zip codes to
the first three digits, and also noting that the
European Securities and Market Authority has
created draft templates for asset-level disclosure,
including for RMBS, in which it requires only the
first two or three digits of the postal code).
606 See letter from Treasurer Group.
607 See letter from CFA Institute dated Apr. 28,
2014 submitted in response to the 2014 Re-Opening
Release.
608 See letter from AFR.
609 See letters from ABA III, Lewtan (noting that
aggregation would significantly reduce the risk of
re-identification and data security breaches, but
data security concerns related to internal operations
would remain), and MBA IV (with respect to
RMBS).
610 For example, they did not specify whether
they were referring to pool-level data, grouped-

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

suggested development of a system that
permits investors to conduct analysis
and produce models without providing
access to asset-level information.611 One
commenter said the requirements
should mirror the disclosures that the
GSEs make with respect to RMBS and
that issuers should have the discretion
not to disclose sensitive information.612
Others suggested that issuers should
have the flexibility to modify the
disclosures and decide the method of
delivery to address privacy concerns.613
Another commenter agreed that the
better approach would be to modify the
disclosure requirements such that the
data increases transparency while still
respecting the privacy of borrowers’
information, but did not specify how
those disclosures should be made
available to investors.614 Several
commenters suggested that we adopt
mechanisms or controls to restrict
access to asset-level information filed
with the Commission to investors and
potential investors.615
Another commenter suggested a
central repository or ‘‘aggregated data
warehouse’’ to house the asset-level data
because such an approach would
simplify enforcement of access policies,
ensure consistent data formats and
lower incentives to exclude certain
users.616 Similarly, another commenter
account data similar to the disclosures proposed for
credit card ABS in the 2010 ABS Proposal, less
granular loan-level information or some other form
of data aggregation.
611 See letter from Treasurer Group.
612 See letter from MBA IV (with respect to
RMBS).
613 See, e.g., letters from ABA III (suggesting that
if the Commission adopts the Web site approach,
then issuers should be able to aggregate, group or
anonymize the data, as needed, to comply with the
privacy laws or be allowed to omit data under
Securities Act Rule 409, and also suggesting that
issuers should have the flexibility to determine the
method of delivery of the disclosure) and SIFMA/
FSR II-dealers and sponsors (suggesting that issuers
be allowed to withhold, aggregate, or otherwise
modify the asset level disclosures in order to
comply with legal and regulatory obligations,
reduce re-identification risk or otherwise protect
consumer privacy, or to limit disclosure of
information that is not material to an investment
decision).
614 See letter from Capital One II.
615 See letters from CDIA (suggesting that the
Commission require parties that want to access the
data on EDGAR register to use the data,
acknowledge the sensitive nature of the data, and
agree to maintain its confidentiality), Epicurus
(suggesting that the Commission establish rules
applicable to the posting, use and dissemination of
potentially sensitive data disclosed on EDGAR,
including penalties for violation of the rules), WPF
I, and WPF II.
616 See letter from AFR (suggesting either a single
data warehouse managed by a federal agency (e.g.,
the Commission, the Federal Reserve (similar to the
Bank of England model), or the Office of Financial
Research) or a non-profit data warehouse owned
and managed by private sector entities under
Commission oversight (similar to the European Data
Warehouse).

PO 00000

Frm 00053

Fmt 4701

Sfmt 4700

57235

suggested that issuers disclose all assetlevel data to a consumer reporting
agency administered repository, along
with a unique identification number for
each asset, which would allow investors
to access all the asset-level data for
these assets.617 Another commenter also
suggested that credit bureaus, instead of
issuers, should provide credit related
information.618 One commenter
outlined revisions to the Web site
approach that it believed are necessary
if such an approach is adopted,
including a data chain of custody,
privacy and security rules and public
disclosure of each issuer’s privacy and
security policies.619
(c) Final Rule and Economic Analysis of
the Final Rule
After considering the comments
received related to privacy concerns and
on the Web site approach, and our
obligations under Section 7(c) of the
Securities Act,620 we are adopting new
rules to require that issuers file assetlevel disclosures on EDGAR both at the
time of the offering and on an ongoing
basis in periodic reports. We are
revising the required disclosures
contained in the proposal to address the
risk of parties being able to re-identify
obligors and the associated privacy
concerns. Specifically, as discussed
below, we are modifying or omitting
certain asset-level disclosures relating to
RMBS and Auto ABS to reduce both the
amount of potentially sensitive data
about the underlying obligors and the
potential risk that the obligors could be
re-identified. In addition, in response to
commenters’ suggestions, we have
sought and obtained guidance from the
CFPB on the application of the FCRA to
the required disclosures. As discussed
617 See letter from SIFMA/FSR II-dealers and
sponsors (noting that this approach would apply to
all ABS asset classes and also noting certain
developmental challenges, such as identifying a
consumer reporting agency willing to act as a
repository and application of FCRA). See also SFIG
II (stating that issuers should have the option to use
third party agents (which may be a consumer
reporting agency or a central Web site data
aggregator) to make the data available and control
access, but also noting that such an approach still
raises privacy law concerns and concerns about
who pays for the third-party service).
618 See letter from ABA III.
619 See letter from WPF II. The commenter also
outlined the elements of an appropriate data use
agreement, such as disclosure restrictions,
standards to qualify recipients, and providing
consumers a private right of action for those who
misuse the data.
620 As noted above, Section 7(c) of the Securities
Act requires that we adopt rules to require ABS
issuers to disclose asset-level information if the data
is necessary for investors to independently perform
due diligence.

E:\FR\FM\24SER2.SGM

24SER2

57236

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

tkelley on DSK3SPTVN1PROD with RULES2

below, the CFPB has issued a letter 621
to the Commission stating that the
FCRA will not apply to asset-level
disclosures where the Commission
determines that disclosure of certain
asset-level information is ‘‘necessary for
investors to independently perform due
diligence,’’ in accordance with Section
7(c). We believe these steps implement
the statutory mandate of Section 7(c)
and will provide investors with the
asset-level information they need while
reducing concerns about potential reidentification risk associated with
disclosing consumers’ personal and
financial information.
While we have considered the Web
site approach described in the 2014
Staff Memorandum, as discussed below,
we are not adopting this approach due
to concerns about the practical
difficulties and unintended
consequences of limiting access to only
investors and potential investors.622
Commenters also indicated that the Web
site approach could negatively affect the
ability of investors and the broader ABS
market to have adequate access to the
data.623
We continue to believe that the
disclosure of data that relates to the
credit risk of the obligor, such as an
obligor’s credit score, income, or
employment history, would strengthen
investors’ risk analysis of ABS involving
consumer assets.624 We believe these
disclosures, combined with other assetlevel disclosures, such as the terms and
performance of the underlying loan and
information about the property, will
enable investors to conduct their own
due diligence for ABS involving
consumer assets, and thus facilitate
capital formation in the ABS market.
Consequently, it is critically important
that the manner in which such
information is disseminated enables all
investors to receive access to the
required asset-level disclosures. The
ability of other market participants,
such as analysts and academics, to
access this information may also benefit
621 See letter from the Consumer Financial
Protection Bureau dated August 26, 2014.
622 See, e.g., letters from ABA III (noting concern
that without guidance as to who is a potential
investor issuers may apply their own bias filters to
public offerings, such as limiting public offerings to
only institutional investors), AFR (expressing
concern that if issuers are given the ability to limit
access to asset-level data they may use this ability
to discriminate between investors by, for example,
giving investors with more market power
preferential access to the data), CCMR, MBA IV, and
SFIG II.
623 See, e.g., letters from ABA III, Moody’s II, and
R&R.
624 See footnotes 559, 560 and 561 (discussing
commenters’ views on the importance of receiving
granular data about obligors, such as exact income
and credit scores).

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

the market by encouraging a broader
range of commentary and analysis with
respect to ABS.625
Although we did not propose to
require that an obligor’s name, address,
or other identifying information be
disclosed, we are sensitive to the
possibility that an obligor in an asset
pool could be identified (now or in the
future) due to the availability of the
required disclosures (coupled with the
XML requirement), the amount of data
about obligors that is publicly available
through other sources, and information
about real estate transactions and other
types of transactions that is available or
that may become available in the future.
In the event the obligor was reidentified, the information that would
have been required by the proposal,
even in ranges, might reveal information
about the obligor’s financial condition.
This issue is especially pronounced
for securitizations backed by residential
mortgages, as an obligor could
potentially be re-identified using a
combination of asset-level disclosures
and real estate transaction data that is
routinely disclosed by certain local
governments.626 Commenters noted that
property address, sales price, and
closing date are typically disclosed by
local governments and could be used to
link the asset-level disclosures to an
individual.627 If a specific mortgage is
re-identified, sensitive financial data
about an obligor (e.g., credit score, DTI,
and payment history) could potentially
be connected to the obligor.
In light of this concern, we are
revising the proposed data set for RMBS
as follows.628 First, we are modifying
the required geographic identifier from
MSA, as proposed, to a 2-digit zip
code.629 Several commenters

emphasized the importance of
geography in assessing the reidentification risk for RMBS asset-level
disclosure.630 We believe that, because
publicly available information like
property records is typically sorted and
searchable by geography, requiring
issuers to identify assets by a broader
geographic area should decrease the
ability to re-identify individual obligors.
In considering how to broaden the
geographic area, we considered both the
specific recommendations of
commenters as well as current
disclosure practices, including those of
the GSEs and Ginnie Mae.631 As noted
above, one commenter specifically
recommended that we require
disclosure of either a 2-digit or 3-digit
zip code.632 There are currently less
than 99 distinct 2-digit zip codes and
approximately 900 distinct 3-digit zip
codes.633 By contrast, our proposal
would have required disclosure of MSA,
which represents approximately 960
unique geographic areas. We understand
that Ginnie Mae currently discloses
state (60 distinct areas, including
Washington, DC and U.S. territories and
associated states).634 Depending on the
data set, Fannie Mae and Freddie Mac
disclose MSA, 3-digit zip code or
state.635 After considering the various
alternatives, we are adopting a 2-digit
zip code. In reaching this conclusion,
we considered that a 3-digit zip code
would not significantly reduce the reidentification risk relative to the
proposal’s use of MSA and that use of
state may be too broad of an area to be
useful to RMBS investors.636
To further reduce the risk of reidentification, we are also omitting
several data points that, while

625 See letters from ABA III, Moody’s I, Moody’s
II, M. Joffe, and R&R.
626 These issues potentially exist but are less
pronounced for Auto ABS. We are not aware of any
public databases of auto loan and lease records
made available by local governments. It is possible
that these types of databases could be available
from other sources for a fee. After the time of
purchase, an obligor may move and register the
automobile in a different state. In contrast, the
property that is collateral for a mortgage is
connected to a permanent address and therefore
could be matched more easily with publicly
available information from land records.
627 See, e.g., letters from ABA III, CU, SIFMA/FSR
I-dealers and sponsors, SFIG II, and Treasurer
Group.
628 Although the changes discussed relate to
RMBS data points, we also indicate, where relevant,
corresponding changes we have made to the data
points for Auto ABS that address privacy concerns.
629 See new Item 1(d)(1) of Schedule AL. For Auto
ABS, at the suggestion of commenters, we are
modifying the geographic identifier of the obligor to
state. See new Items 3(e)(7) and 4(e)(7). See also
letters from ASF II (expressed views of loan-level
investors only) and VABSS IV. We are not adopting
proposed data points that would have disclosed the

geographic location of the dealership. See proposed
Items 4(b)(1) and 5(b)(1) of Schedule L.
630 See letters from ABA III, ELFA II, Lewtan,
SIFMA/FSR I-dealers and sponsors, SFIG II,
Treasurer Group, and Wells Fargo III.
631 See letter from MBA IV (with respect to
RMBS).
632 See letter from ABA III.
633 See the U.S. Postal Service Web site for a list
of 3-digit zip codes, http://pe.usps.com/text/
LabelingLists/L002.htm.
634 See Ginnie Mae’s MBS Loan-Level Disclosure
File available at http://www.ginniemae.gov/doing_
business_with_ginniemae/investor_resources/mbs_
disclosure_data/Lists/LayoutsAndSamples/
Attachments/105/mbsloanlevel_layout.pdf.
635 See Fannie Mae’s Loan-Level Disclosure File
available at http://www.fanniemae.com/resources/
file/mbs/pdf/filelayout-lld.pdf and Loan
Performance Data Disclosure File available at
https://loanperformancedata.fanniemae.com/
lppub-docs/lppub_file_layout.pdf. See also Freddie
Mac’s Loan-Level Disclosure requirements available
at http://www.freddiemac.com/mbs/docs/fs_lld.pdf
and Single Family Loan-Level Dataset General User
Guide available at http://www.freddiemac.com/
news/finance/pdf/user_guide.pdf.
636 See also footnote 670 and accompanying text.

PO 00000

Frm 00054

Fmt 4701

Sfmt 4700

E:\FR\FM\24SER2.SGM

24SER2

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

tkelley on DSK3SPTVN1PROD with RULES2

potentially useful to investors, could
increase the ability to identify
underlying obligors. Specifically, we are
omitting the unique broker identifier
data point 637 as well as the sales
price,638 origination date, and first
payment date 639 data points. In
addition, we are omitting some
information about an obligor’s
bankruptcy and foreclosure history,640
although, if an obligor had experienced
a past bankruptcy or foreclosure, we
would expect that those events would
have been considered in generating a
637 See proposed Item 2(a)(11) of Schedule L. For
RMBS, we are adopting a data point that indicates
whether or not a broker originated or was involved
in the origination of the loan as well as a data point
that discloses the National Mortgage License
System registration number for the company that
originated the loan. These data points will allow
investors to compare loans by particular originators
and across originators. Investors will also be able
to compare loans where a broker was used.
Together, these data points will provide investors
with information they need to perform due
diligence and make informed investment decisions.
See new Items 1(c)(24) and 1(c)(26) of Schedule AL.
These data points were not proposed and are not
relevant for Auto ABS.
638 See proposed Item 2(b)(3) of Schedule L. We
are also omitting the original property valuation
data points because we believe they could provide
a close approximation of sales price, and thus could
have raised the same re-identification concern as
sales price. See also proposed Items 2(b)(5), 2(b)(6),
2(b)(7), 2(b)(8), and 2(b)(9) of Schedule L. For
RMBS, we believe that certain other data points we
are adopting, such as Original loan amount and
Original loan-to-value, will provide investors with
information they need to perform due diligence and
make informed investment decisions. See new
Items 1(c)(3) and 1(d)(11) of Schedule AL. For Auto
ABS, we are adopting data points that capture the
vehicle value, as these values are already made
publicly available from sources such as the Kelly
Blue Book. See new Items 3(d)(7), 3(d)(8), 4(d)(6)
and 4(d)(7) of Schedule AL.
639 See proposed Items 1(a)(5) and 1(a)(14)of
Schedule L. See also letters from ABA III, Lewtan,
MBA I, and SFIG II. We believe that certain other
data points we are adopting, such as Original loan
maturity date, Original amortization term and
Remaining term to maturity, will provide investors
with information they need to perform due
diligence and make informed investment decisions.
See new Items 1(c)(4), 1(c)(5) and 1(g)(2) of
Schedule AL. Because the same publicly available
property records are not available for auto loans and
leases, we are adopting data points that capture the
month and year of origination and the original first
payment date for Auto ABS. See new Items 3(c)(2),
3(c)(10), 4(c)(2), and 4(c)(10) of Schedule AL.
640 See proposed Items 2(c)(24) and 2(c)(25) of
Schedule L and proposed Items 2(c)(1), 2(c)(2),
2(c)(3), 2(c)(4), 2(c)(5), 2(c)(6), 2(c)(7), 2(c)(8), 2(h),
2(k)(2), 2(k)(3), 2(k)(4), 2(k)(5), 2(k)(7), 2(k)(8),
2(k)(11), 2(k)(12), 2(k)(13), and 2(m)(3) of Schedule
L–D. While commenters did not specifically note
that these data points would pose re-identification
risk, we received letters about the sensitivity of the
data. See, e.g., letters from Deutsche Bank, MBA IV,
and SIFMA/FSR I-dealers and sponsors. RMBS
issuers will, however, be required to provide
information about an asset in the pool that is
subject to a foreclosure, or if the reason for nonpayment by an obligor is due to bankruptcy. See
new Items 1(g)(33), 1(r)(1), 1(r)(2), 1(r)(3), 1(r)(4),
1(r)(5), 1(v)(1) and 1(v)(2) of Schedule AL. These
data points were not proposed and are not relevant
for Auto ABS.

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

credit score. As noted above, the final
rules require disclosure of an exact
credit score.
Another step that we are taking to
address commenters’ concerns about reidentification risk is to omit the
proposed income and debt data points.
While we believe that income and debt
information would strengthen an
investor’s risk analysis of ABS involving
consumer assets,641 we are not requiring
them based on concerns about the
sensitive nature of this information and
increased re-identification risk posed by
this information.642 As discussed in
Section III.A.2.b)(1) Residential
Mortgage-Backed Securities, however,
we are requiring DTI ratios.643 These are
key calculations used to assess an
obligor’s ability to repay the loan that,
we believe, will permit investors to
perform due diligence in the absence of
specific debt and income data points.
We also are revising 644 or
removing 645 certain other proposed data
points to further mitigate reidentification risk concerns since the
responses to these items will be made
available to the public through
EDGAR.646 We do not believe these
proposed requirements necessarily
would have increased re-identification
risk alone, but we have concluded that
these data points, if adopted as
proposed, could disclose sensitive
obligor data without providing
additional information necessary for
investor due diligence.
Finally, in response to commenters’
suggestions, we have obtained guidance
641 Investor members of one commenter noted
that this information is useful for verifying DTI
calculations. See letter from ASF I.
642 See letters from VABSS IV, Wells Fargo III,
and WPF II.
643 See Section III.A.2.b)(3) Automobile Loan or
Lease ABS above for a discussion of the paymentto-income ratio data points that are being adopted
in lieu of proposed data points that would have
collected obligor or lessee income information.
There were no data points proposed for Auto ABS
that would have collected obligor or lessee debt
information.
644 See, e.g., proposed Item 2(l)(13) Eviction start
date of Schedule L–D (revised to new Item 1(s)(8)
Eviction indicator of Schedule AL). Similar data
points were not proposed for Auto ABS.
645 See, e.g., proposed Items 2(c)(13) Liquid/cash
reserves, 2(c)(14) Number of mortgages properties,
2(c)(18) Percentage of down payment from obligor
own funds, 2(c)(20) Self-employment flag; 2(c)(21)
Current other monthly payment, 2(d)(6) Mortgage
insurance certificate number, 2(a)(1) Non-pay
reason, and 2(l)(14) Eviction end date of Schedule
L–D. Similar data points were not proposed for
Auto ABS.
646 These changes involved modifying the
possible responses, such as removing certain
responses from the coded list of possible responses.
For example, in new Item 1(c)(1) Original loan
purpose of Schedule AL, which was proposed as
Item 2(a)(1) of Schedule L, we are removing certain
possible responses from the enumerated list of
codes due to privacy concerns.

PO 00000

Frm 00055

Fmt 4701

Sfmt 4700

57237

from the CFPB on the application of the
FCRA to the proposed disclosure
requirements.647 In a letter issued to the
Commission dated August 26, 2014, the
CFPB stated that the FCRA will not
apply to asset-level disclosures that
exclude direct identifiers where the
Commission determines that disclosure
of such information is ‘‘necessary for
investors to independently perform due
diligence.’’ 648 Specifically, the CFPB
letter confirms that (i) issuers and the
Commission would not become
consumer reporting agencies by
obtaining and disseminating asset level
information, and (ii) no violation of
Section 604(f) of the FCRA 649 would
occur if issuers or the Commission
obtain or disseminate any information
that is a consumer report (such as a
credit score), in each case if the
Commission determines that disclosure
of the information is necessary for
investors to independently perform due
diligence and that the information
should be filed with the Commission
and disclosed on EDGAR to best fulfill
a Congressional mandate. As noted
above, we have revised or eliminated
certain asset-level data points that
implicate consumer privacy concerns
where we determined that doing so
would not compromise investors’ ability
to perform due diligence on the
underlying assets. We believe the assetlevel data points that we are requiring
about underlying obligors for ABS
involving consumers assets are
necessary for investors to perform due
diligence, as required by Section 7(c).
After taking these steps and after careful
consideration of alternative means of
disseminating such information, we
have determined that having the
information filed with the Commission
and disclosed on EDGAR is the most
effective means of ensuring that
investors have access to asset-level data.
As discussed above, we have taken
significant steps to reduce the reidentification risk associated with
providing certain asset-level data while
adhering to the statutory mandate in
Section 7(c) to require disclosure of
such information to the extent necessary
647 Commenters also raised concerns about the
applicability of other federal and state privacy laws
and analogous foreign laws. We do not believe the
final rules are likely to implicate these other laws
for a variety of reasons, including that they do not
require disclosure of direct identifiers (PII) and
because certain of these laws provide an exemption
for the disclosure of information in order to comply
with federal, state or local laws and other
applicable legal requirements. More generally, we
believe the changes we are adopting to help address
privacy concerns should help to mitigate concerns
about the applicability of other privacy laws.
648 See Section 7(c) of the Securities Act [15
U.S.C. 77g(c)].
649 15 U.S.C. 1681b(f).

E:\FR\FM\24SER2.SGM

24SER2

57238

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

tkelley on DSK3SPTVN1PROD with RULES2

for investors to independently perform
due diligence. We do recognize,
however, that the final rules do not
completely eliminate the risk of obligor
re-identification 650 and there may be
costs associated with providing certain
sensitive information required by the
final rules. These costs may include
costs to issuers of consulting with
privacy experts to understand the
impact of providing these disclosures.
We also recognize that some issuers and
investors may move to unregistered
offerings, which may affect capital
formation.651 Alternatively, the
increased costs may be passed on to the
underlying obligors in the form of a
higher cost to borrowers (e.g., interest
rates or fees).
Re-identification risk can also
increase the cost of capital due to
obligor preferences. If an obligor is
particularly sensitive to the possibility
of re-identification, the obligor may
prefer to transact with originators that
offer additional methods for preserving
anonymity, which could increase that
obligor’s cost of or access to capital. For
example, if a loan agreement gives an
obligor the ability to opt out of
disclosure, thereby prohibiting the
ability to securitize the loan where
asset-level information would be
disclosed, originators may pass costs on
to the obligor. Originators could also
bear some increased costs if, as a result
of being unable to securitize the loan or
sell it to the GSEs, the originator would
hold the asset on its balance sheet, thus
limiting its ability to redeploy capital to
more productive or efficient uses. In
addition, the risk of re-identification
could limit an obligor’s access to capital
if the obligor is unable to obtain
assurances, even at a higher cost, that
his or her loan would not be securitized
650 In this regard we note that there is continuing
debate about the ability to fully anonymize or ‘‘deidentify’’ a data set and whether it is possible to
have any confidence that re-identification risk can
be totally mitigated. See, e.g., Paul Ohm, ‘‘Broken
Promises of Privacy: Responding to the Surprising
Failure of Anonymization,’’ 57 UCLA L. Rev. 1701
(2010); Arvind Narayana and Vitaly Shmatikov,
‘‘Myths and Fallacies of ‘Personally Identifiable
Information,’’’ 53 Comm. ACM 24, 26 n.7 (2010)
(‘‘The emergence of powerful reidentification
algorithms demonstrates not just a flaw in a specific
anonymization technique(s), but the fundamental
inadequacy of the entire privacy protection
paradigm based on ‘de-identifying’ the data.’’). But
see Jane Yakowitz, ‘‘Tragedy of the Data
Commons,’’ 25 Harv. J.L. & Tech., 1 (2011)
(expressing concern about the impact of reducing
the availability of de-identified data for medical
research purposes).
651 But see letter from Lewtan (noting that this
course is less likely, because although unregistered
offerings may provide for more customized data
delivery where an issuer has more direct control,
the issues surrounding FCRA exposure are the same
as if the securitization were made through a
registered offering).

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

in a way that gives rise to a potential
risk of re-identification. Ultimately, an
obligor’s sensitivity to re-identification
risk could lead to a reduction in the
number of loans available for
securitization. This could, in turn, lead
to a reduction in liquidity of ABS
markets and a corresponding increase in
cost of capital even for those loans that
are otherwise securitized through
registered offerings.652 In general, for
these reasons, we believe that reducing
the likelihood of obligor reidentification will reduce the impact of
these potential costs of asset-level
disclosure for the ABS market.
As discussed above, in considering
how to modify the proposed disclosures
to reduce the risk of re-identification,
we considered the specific
recommendations of commenters and
current disclosure practices. Although
we received various suggestions for
reducing re-identification risk,
commenters did not provide any data or
analysis that quantified the likelihood of
re-identification based on the proposed
disclosures or their suggested
approaches to addressing reidentification risk. Some commenters
indicated that using less precise
geographic identifiers would reduce the
risk that an obligor could be reidentified.653 Using less precise data
points for sales price and origination
date would also reduce the risk of reidentification.
To help confirm the effect of requiring
less precise information, we performed
an analysis of various modifications to
the required data points. In particular,
we have estimated the likelihood of
isolating a unique mortgage in a sample
pool of mortgage loans by considering
different levels and combinations of
precision for the geographic location of
the property, sales price, and origination
date. Our analysis examined mortgages
collected from mortgage loan servicer
providers and reported in the MBSData,
LLC, dataset, which includes asset-level
data for most of the mortgages
securitized in the private-label RMBS
market during the period from 2000 to
2012.654 Categorizing loans according to
652 See letter from SIFMA/FSR I-dealers and
sponsors (noting that increased costs would
ultimately be passed on to consumers, including an
increase in financing costs and a decrease in credit
availability).
653 See, e.g., letters from ABA III (recommending
2-digit zip code), CFA II (suggesting aggregation of
geographic location), and Treasurer Group.
654 Loan-level data is available on Fannie Mae
and Freddie Mac Web sites; however, we did not
incorporate this data into our analysis because we
believe that historically the characteristics of loans
purchased and securitized by GSEs have been
somewhat different from the characteristics of loans
securitized through private-label RMBS. We do not

PO 00000

Frm 00056

Fmt 4701

Sfmt 4700

their uniqueness is the first step
someone could take to re-identify an
obligor. Each of the 19.3 million
mortgages reported during this period
were sorted according to uniqueness of
three loan characteristics—geographic
location, sales price, and origination
date—which could potentially link the
mortgage to another publicly available
dataset that contains obligors’
identities.655 We assume that loans that
have unique values for these three
variables, when compared to all other
loans in the MBSData dataset, have an
elevated potential for obligor reidentification. We note, however, that
our analysis is not an actual measure of
re-identification risk. Importantly, in
order to actually re-identify an obligor,
a unique mortgage must also be matched
with publicly available data sources,
such as from local government real
estate transaction ledgers and tax
records that contain information on
property addresses, sales prices, and
origination dates.656 We have not
attempted to quantify the likelihood that
a unique mortgage, once isolated, can be
matched with publicly available data
sources. Instead, we have focused our
analysis on this first step of the reidentification process, which is to
isolate a unique mortgage.
To provide a basis for comparison, we
first considered the likelihood of
identifying a unique loan using a 5-digit
zip code for the property location, the
exact sales price and the exact
origination date. Approximately 76% of
the 19.3 million loans analyzed are
unique when these three characteristics
are compared across all mortgages in the
database. That is, these loans could be
distinguished from all other loans with
respect to geography, imputed sales
price, and origination date, and they
were originated in states for which there
expect that incorporating the GSE data would
significantly reduce the likelihood of finding
records with unique characteristics among
properties bought with mortgages securitized
through private-label RMBS.
655 Because the required asset-level disclosures do
not include sales price, in our analysis, we have
imputed it from the reported loan amount and LTV
ratio and rounded to the nearest $100. Although the
origination date is not required to be disclosed, it
can be approximated in many cases using other
required data points, such as Original loan maturity
date, Original amortization term and Remaining
term to maturity. See new Items 1(c)(4), 1(c)(5) and
1(g)(2).
656 We have not analyzed re-identification
techniques using commercially available datasets
(e.g., datasets from consumer reporting agencies)
because even though using such data may be more
effective in re-identification, providers of such
datasets usually charge a fee and impose
restrictions on their usage, such as, access controls
and user identity verification.

E:\FR\FM\24SER2.SGM

24SER2

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

tkelley on DSK3SPTVN1PROD with RULES2

is no prohibition on public disclosure of
the property sales price.657
We next considered the likelihood of
identifying a unique loan using the
required disclosures in the final rules.
As discussed above, we are modifying
the required geographic identifier from
MSA, as proposed, to a 2-digit zip code
and are requiring securitizers to report
only the original amortization term, and
remaining term to maturity, from which
year and month of origination can be
approximated, but not the precise
origination or sales date.658 Based on
the historical data and the same method
described above of determining
uniqueness, we estimate that by
requiring 2-digit zip code, imputed sales
price, and the month and year of
origination, less than 20% of mortgages
in the sample pool could be unique in
their characteristics. This is also
significantly lower than the almost 30%
likelihood of isolating a unique loan
determined based on the required
disclosure items in the 2010 ABS
Proposal.659
These estimates, however, do not
fully reflect the difficulty of actually reidentifying an underlying obligor.660 As
noted above, the loan would have to be
matched to a record in the relevant
public database of real estate
transactions. As noted, some counties
within states do not release property
sale values. Even in those jurisdictions
that do make property sale information
publicly available, matching the loans to
a particular property record might be
challenging to do because the
jurisdiction providing the information
might not offer access in a way that
would make the information easily
accessible or in convenient format. For
example, knowing the 5-digit zip code
of the unique property would not
necessarily be helpful in a jurisdiction
657 Some states (or counties within states)
consider the property sales value to be private and
confidential information and therefore do not
release these numbers publicly. These states
include: Alaska, Idaho, Indiana, Kansas, Louisiana,
Maine, Mississippi, Missouri, Montana, New
Mexico, North Dakota, Texas, Utah and Wyoming.
The analysis does not account for non-disclosure
counties that lie within a state that allows for
disclosure.
658 As discussed below, this change should not
materially impact an investor’s ability to price
RMBS tranches, but will significantly lower the
probability that a mortgage is unique in its
characteristics.
659 As noted above, the proposal would have
required a geographic identifier of MSA, exact sales
price and the month and year of origination.
660 This technique is based on historical data and
may not necessarily reflect future re-identification
likelihoods. Also, in the future, securitizers that are
conscious of privacy implications may avoid
securitizing loans that have high risk of being
identified (i.e., loans that are unique in their
characteristics).

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

that requires a street name in order to
search and view records. Hence, in
some cases it may be too burdensome to
find the matching loan even if that
information is publicly available,
particularly if such search is part of a
large scale matching effort (i.e., for
commercial purposes). We also note that
public property databases contain, in
addition to property transactions with
mortgages securitized through privatelabel RMBS, property transactions
without using borrowed funds, property
transactions with mortgages that are
never securitized, or property
transactions with mortgages that are
securitized through GSEs. The addition
of these other transactions only
compounds the burden of matching a
particular loan with a particular
property record.
Although the approach that we are
adopting does not eliminate the
possibility of obligor re-identification,
we believe it strikes the appropriate
balance between privacy and
transparency. Some obligors may still be
particularly sensitive to the possibility
of re-identification and may seek
originators that offer additional methods
of preserving their anonymity. We do
not, however, anticipate that this will
have an adverse effect on the
functioning of the private-label RMBS
market or the cost of capital to the
originators of mortgages and their
obligors because of the relatively low
likelihood of re-identification associated
with the revised data points. Moreover,
as noted above, asset-level information
has been provided by issuers and thirdparty data providers for private-label
RMBS (although not standardized), as
well as by the GSEs and Ginnie Mae,661
and this availability has not led to
market disruption or adverse effects on
cost of capital for obligors. We believe
that there will be significant benefits to
RMBS investors by having access to
obligor-specific financial information in
their evaluation of the potential default
risk of the securitized assets, thus
improving their ability to price
registered RMBS tranches. This
information also will allow investors to
better understand, analyze and track the
performance of RMBS, and, in turn, will
allow for more accurate ongoing pricing
and increase market efficiency.662
We acknowledge that further
modification of certain data points
could further reduce the risk of obligor
re-identification. For example, several
661 See Section III.A.1 Background and Economic
Baseline for the Asset-Level Disclosure
Requirement.
662 This would also apply to other asset classes
where obligor-specific financial information may be
disclosed, such as Auto ABS.

PO 00000

Frm 00057

Fmt 4701

Sfmt 4700

57239

commenters emphasized the importance
of geographic location in potentially reidentifying an underlying obligor.663
Based on our analysis, eliminating a
geographic identifier reduces the
likelihood of isolating a unique
mortgage in the sample pool to less than
2%. We considered whether further
modification to certain data points will
reduce transparency of critical data
points for ABS investors. As we discuss
below, we believe that a geographic
location identifier is critical to pricing
RMBS and is therefore necessary for
investors to perform due diligence.
To confirm our view, and the views
of commenters,664 that certain data
points are critical for ABS investment
decisions, we analyzed the potential
pricing impact of various data points on
RMBS transactions. Our analysis
indicates that, for RMBS, certain
characteristics and loan term features,
such as geographic location, are key
determinants of expected performance
of underlying mortgage loans as
measured by the historical rate of
serious delinquency (‘‘SDQ’’).665 We
used a model to predict the presence or
absence of SDQ within a historical
dataset of private-label securitized
loans.666 We found that, by a wide
margin, the following four data points
make the largest contribution to
explaining SDQ: 667 the year of
663 See, e.g., letters from ABA III, SIFMA/FSR
2014 I-dealers and sponsors, SFIG II, and Treasurer
Group.
664 See, e.g., letters from ABA III (recommending
that the Commission consider using 2-digit zip
code), ASF I (supporting exact credit score), and
Mass. Atty. Gen. (noting that the DTI ratio and LTV
are important metrics in an investor’s assessment of
risk of loss).
665 SDQ is defined as a loan having ever been 90
days late, foreclosed, or real estate owned.
666 We used a binomial logistic predictive model
that is also referred to as a logit regression.
Binomial logistic regression deals with situations in
which the observed outcome for a dependent
variable can have only two possible types (for
purposes of this analysis—presence or absence of a
serious delinquency). Logistic regression is used to
predict the odds of being a case based on the value
of the independent variables (i.e., the predictors).
We estimate the regression model with commonly
used predictive factors identified by the industry
and the academic literature, such as combined LTV
ratio, credit score, and DTI ratio and analyze the
effects of various loan characteristics observable at
origination on the ability of a researcher to forecast
serious delinquency. For more details and
references, see footnote 82, the White-Bauguess
Study, Section V. Logit Regression Analysis (for the
description of the model) and Appendix B (for
variable definitions and references to studies
supporting the variables choice). The analysis is
based on a sample of 2,456,548 mortgages from
2000–2009 included in the MBSData dataset that
have complete information for all variables of
interest, in particular, DTI information.
667 The model uses a goodness-of-fit measure
(pseudo-R2) to describe how well an SDQ can be
modeled with given predictive variables. Higher R2

E:\FR\FM\24SER2.SGM

Continued

24SER2

57240

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations

tkelley on DSK3SPTVN1PROD with RULES2

origination, the LTV ratio, the
geographic location of the property as
measured by 2-digit zip code, and the
obligor’s credit score (FICO score was
reported in the dataset). Our analysis
shows that the year of origination
provides the greatest contribution to the
measure of how well these factors
explain the likelihood of serious
delinquency.668 LTV, geographic
location of the property and FICO score
provide the next greatest contribution to
explaining the likelihood of serious
delinquency and have a similar
magnitude in overall contribution.669
Eliminating any of these three variables
from the final disclosure requirements
significantly and negatively affects the
predictive ability of the model. On the
other hand, in the instances we studied,
providing a geographic location that
represents a smaller area or the exact
origination date only marginally
improves the model’s predictive
ability,670 but it could significantly
increase the possibility of obligor reidentification.
Another approach we considered,
although not specifically suggested by
commenters, was an approach that
rounds the loan amount, other loan
balance-related data points, and
monthly performance data points to
further hinder potential obligor rerepresents higher predictive ability of a model in
forecasting SDQ of mortgages. We consequently
eliminate each individual factor from predictive
regression and record its impact on the reduction
in the goodness-of-fit measure. Higher reduction
represents higher contribution of a factor to
predictive ability of the full model. The R2 that we
find here is in line with R2 found in academic
studies that perform similar analyses. See id.
668 We believe this primarily is due to the fact
that the year of loan origination served as a proxy
for unobservable factors like the quality of
underwriting standards during the years
immediately preceding the financial crisis when
serious delinquency rate was higher, and a large
portion of the loans in the sample were originated
during that time. The importance of the origination
year is smaller for sub-samples that do not include
loans originated in 2006–2007.
669 Origination year contributed 5% to the
goodness-of-fit measure. LTV, 2-digit zip code, and
the obligor’s credit score contributed about 1.5%
each. All other 12 data points we considered made
a comparatively smaller contribution to the
predictive ability of the model (1.5% combined),
but are still important in predicting SDQ. These 12
data points include: Interest rate on the loan, DTI,
indicators whether a loan had full documentation,
had prepayment penalty provisions, was interestonly, had a balloon payment, had negative
amortization, was a first lien, was long term, had
a teaser rate, had private mortgage insurance, and
whether the property was owner-occupied.
670 The analysis indicated that the goodness-of-fit
of the complete model (i.e., the model that includes
all predictive variables considered in this study)
would increase from 15.5% to 15.7% if an MSA is
used instead of a 2-digit zip code, and to 16.0% if
a 3-digit zip code is used instead of a 2-digit zip
code.

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

identification.671 The rounding of loan
amount would result in an imputed
sales price that may be sufficiently
different from the true sales price so as
to lessen the possibility of a match to
other publicly accessible real estate
datasets. Rounding the loan balance to
the nearest $1,000 results in the
reduction of the likelihood of isolating
a unique mortgage in the MBSData
dataset to 11%. It would, however,
come at a loss of precision in the cash
flow variables that we believe is
necessary for investors.672 As noted
above, such precision is key to
investors’ ability to analyze and track
the performance of various parties
involved in RMBS transactions.
We considered several alternative
approaches to disseminating asset-level
data as potential means to address
privacy concerns, including the Web
site approach.673 Most commenters were
generally opposed to the Web site
approach as the appropriate means to
address privacy concerns.674 For
example, commenters raised concerns
about the difficulty in determining who
would be a potential investor and thus
should have access to asset-level
data; 675 the liability for failing to
disclose all material information to
investors in the event a potential
investor was denied access to asset-level
data; 676 the need for guidance on what
controls are necessary to address
671 To be effective in reducing the probability of
isolating a loan that is unique with respect to
location, imputed sales price, and origination date,
rounding loan amount (and other loan balance
related variables like most recent appraised value,
sales price, paid-in-full amount, etc.) to the nearest
$1,000 ($10,000) must be accompanied by rounding
monthly payment performance related variables
approximately to the nearest $10 ($100).
672 See letter from Prudential III (noting that loanlevel data (e.g., current asset balance, next interest
rate, current delinquency status, remaining term to
maturity) will allow investors to better estimate the
timing of the principal and interest cash flows of
the collateral pool, which will in turn allow
investors to better estimate the cash flow of the
securitization and be more confident in their risk/
reward consideration of the security).
673 See the 2014 Re-Opening Release and the 2014
Staff Memorandum.
674 See letters from ABA III, AFSA II, Capital One
II, Deutsche Bank, MBA IV (with respect to RMBS),
SIFMA/FSR I-dealers and sponsors, and Treasurer
Group.
675 See, e.g., letters from ABA III (noting concern
that without guidance as to who is a potential
investor, issuers may apply their own bias filters to
public offerings, such as limiting public offerings to
only institutional investors), CCMR, MBA IV, and
SFIG II.
676 For example, issuers have expressed concern
about possible claims for failure to disclose material
information by a potential investor who is denied
access to the Web site or refuses to agree to the
terms of access but nonetheless purchases the
security. See, e.g., letters from ABA III, CCMR,
ELFA II, SIFMA/FSR II-dealers and sponsors, and
SFIG II.

PO 00000

Frm 00058

Fmt 4701

Sfmt 4700

privacy; 677 and access to the data by
other market participants.678 Given
these concerns and our belief that it is
critically important that investors
receive access to asset-level information,
we are not adopting the Web site
approach. We believe the final assetlevel requirements, which have been
modified from the proposal to address
privacy concerns, provide investors
with information they need to perform
due diligence and make informed
investment decisions, and therefore, we
are requiring the asset-level information
to be filed on EDGAR where it will be
readily available to and accessible by
investors. For similar reasons, we do not
think it would be appropriate to restrict
access to such information on EDGAR.
Commenters suggested a central
repository or ‘‘aggregated data
warehouse’’ to house the asset-level data
because such an approach would
simplify enforcement of access policies,
ensure consistent data formats and
lower incentives to exclude certain
users.679 Similarly, another commenter
suggested that issuers disclose all assetlevel data to a consumer reporting
agency administered repository, along
with a unique identification number for
each asset, which would allow investors
to access all the asset-level data for
these assets.680 Another commenter also
677 Some commenters noted that in order to
determine whether a user should be granted access
it would need to screen parties, conduct reviews of
these parties’ data protection controls, and obtain
appropriate disclosure agreements, among other
controls. See letters from MBA IV (noting, for
example, that issuers would be faced with the
burden of determining how to control the spread of
the information once a credentialed entity accesses
the Web site), SIFMA/FSR I-dealers and sponsors
(noting that issuers would generally not be
equipped to verify any prospective user’s identity
or credentials or be able to enforce compliance with
the terms of access), SFIG II (noting that investors
do not want the liability risk that may be imposed
with the access restrictions), and Wells Fargo III.
678 See, e.g., letters from ABA III, Moody’s II, and
R&R.
679 See letters from AFR (suggesting either a
single data warehouse managed by a federal agency
(e.g., the Commission, the Federal Reserve (similar
to the Bank of England model), or the Office of
Financial Research) or a non-profit data warehouse
owned and managed by private sector entities
under Commission oversight (similar to the
European Data Warehouse) and VABSS II
(recommending, as one option to address privacy
concerns, to establish a central ‘‘registration
system’’ managed by the Commission or a third
party that would permit access to sensitive assetlevel data only to persons who had established their
identities as investors, rating agencies, data
providers, investment banks or other permitted
categories of users).
680 See letter from SIFMA/FSR II-dealers and
sponsors (noting that this approach would apply to
all ABS asset classes and also noting certain
developmental challenges, such as identifying a
consumer reporting agency willing to act as a
repository, and application of FCRA). See also SFIG
II (stating that issuers should have the option to use

E:\FR\FM\24SER2.SGM

24SER2

Federal Register / Vol. 79, No. 185 / Wednesday, September 24, 2014 / Rules and Regulations
suggested that credit bureaus, instead of
issuers, should provide credit-related
information.681 While these suggestions
have the potential to address privacy
concerns, as noted by one commenter,
they are not currently in use, would
require further development, and would
depend upon the willing participation
of certain third parties in order to
function as a viable means of
disseminating asset-level data.682
4. Requirements Under Section 7(c) of
the Securities Act
As we note elsewhere, subsequent to
the 2010 ABS Proposing Release,
Congress adopted the Dodd-Frank Act.
Section 942(b) of the Dodd-Frank Act
added Section 7(c) to the Securities Act
which requires the Commission to adopt
regulations requiring an issuer of ABS to
disclose, for each tranche or class of
security, information regarding the
assets backing that security. It specifies,
in part, that in adopting regulations, the
Commission shall require issuers of
asset-backed securities, at a minimum,
to disclose asset-level or loan-level data,
if such data are necessary for investors
to independently perform due diligence
including—data having unique
identifiers relating to loan brokers or
originators; the nature and extent of the
compensation of the broker or originator
of the assets backing the security; and
the amount of risk retention by the
originator and the securitizer of such
assets.683
In the 2011 ABS Re-Proposing
Release, we requested comment as to
whether our 2010 ABS Proposals
implemented Section 7(c) effectively
and whether any changes or additions to
the proposals would better implement
Section 7(c). We discuss below the
comments we received in response to
the requests for comment regarding the
requirements of Section 7(c).

tkelley on DSK3SPTVN1PROD with RULES2

(a) Section 7(c)(2)(B)—Data Necessary
for Investor Due Diligence
Section 7(c)(2)(B) states, in part, that
we require issuers of asset-backed
securities, at a minimum, to disclose
asset-level or loan-level data, if such
data are necessary to independently
perform due diligence. We requested
comment in the 2011 ABS Re-Proposing
Release whether the 2010 ABS Proposal
third party agents (which may be a consumer
reporting agency or a central Web site data
aggregator) to make the data available and control
access, but also noting that such an approach still
raises privacy law concerns and concerns about
who pays for the third-party service).
681 See letter from ABA III.
682 See letter from SIFMA/FSR II-dealers and
sponsors.
683 See Section 7(c)(2) of the Securities Act, as
added by Section 942(b) of the Dodd-Frank Act.

VerDate Sep<11>2014

18:55 Sep 23, 2014

Jkt 232001

implements Section 7(c) effectively. In
response, two investors supported
requiring asset-level disclosures for all
asset types, except for credit cards.684
The investor membership of one trade
association suggested that the disclosure
of relevant asset-level data is necessary
for well-functioning markets 685 and
another commenter suggested that the
2010 ABS proposals would successfully
implement Section 7(c) of the Securities
Act.686 Two other commenters,
however, questioned whether borrower
data proposed in the 2010 ABS
proposals was ‘‘necessary’’ for investors
to perform their own due-diligence.687
These commenters, however, did not
specifically identify the asset-level
disclosures that are necessary for
investors to independently perform due
diligence.
We are adopting asset-level
requirements for RMBS, CMBS, Auto
ABS, debt security ABS, and
resecuritizations. We prioritized these
asset classes for various reasons that we
discuss above.688 Our decision to adopt
these requirements is based on our
belief that investors should have access
to robust information concerning the
pool assets that provides them the
ability to independently perform due
diligence. We continue to consider the
appropriate disclosures for other asset
classes. We believe the data points we
are adopting fulfill, for those asset types,
the Section 7(c) requirement that we
adopt asset-level disclosures that are
necessary for investors to independently
perform due diligence. To the extent
issuers believe additional data is
needed, we encourage them to provide
such additional disclosures in an Asset
Related Document.689
(b) Section 7(c)(2)(B)(i)—Unique
Identifiers Relating to Loan Brokers and
Originators
Section 7(c)(2)(B)(i) requires the
Commission to require disclosure of
asset-level or loan-level data, including,
but not limited to, data having unique
identifiers relating to loan brokers or
originators if such data are necessary for
investors to independently perform due
684 See

letters from MetLife II and Prudential II.
letter from SIFMA II-investors (stating that
well-functioning markets require the disclosure of
as much relevant asset-level data as is reasonably
available).
686 See letter from Chris Barnard dated Aug. 22,
2011 submitted in response to the 2011 ABS ReProposing Release (‘‘C. Barnard’’).
687 See letters from ABA III and MBA IV.
688 See Section III.A.1 Background and Economic
Baseline for the Asset-Level Disclosure
Requirement.
689 See Section III.B.4 Asset Related Documents
for further discussion on how to provide such
additional disclosures.
685 See

PO 00000

Frm 00059

Fmt 4701

Sfmt 4700

57241

diligence. In the 2010 ABS Proposing
Release, we proposed to require issuers
to provide the originator’s name for all
asset types and, if the asset is a
residential mortgage, the MERS
number 690 for the originator, if
available. We also proposed requiring
RMBS issuers to provide the National
Mortgage License System registration
number required by the Secure and Fair
Enforcement for Mortgage Licensing Act
of 2008, otherwise known as the NMLS
number, for the loan originators and
company that originated the loan.691
In the 2011 ABS Re-proposing
Release, we stated our belief that the
proposal to require NMLS numbers
would implement the requirements of
Section 7(c) with respect to mortgages
by requiring a numerical identifier for a
loan broker.692 We requested comment
on whether unique identifiers for loan
brokers and/or originators were
necessary to permit investors to
independently perform due diligence
for asset classes other than RMBS or
CMBS and, if so, whether there is a
unique system of identifiers for brokers
and originators for other asset classes.693
We did not receive any comments
suggesting this requirement would not
satisfy the requirements of Section 7(c),
although one commenter opposed
requiring an NMLS identifier (for
RMBS) because disclosure should focus
on the collateral and its performance
and an NMLS identifier does not
provide investors with information they
can use to value the assets.694
For RMBS, we are adopting the
requirement that issuers provide for
ABS backed by residential mortgages
the NMLS number of the loan originator
company. As noted above, we are not
adopting the requirement that issuers
provide a unique broker identifier, (i.e.,
the NMLS number of the specific loan
originator) because we are concerned
this disclosure may increase reidentification risk.695 Even though we
690 MERS has developed a unique numbering
system and reporting packages to capture and report
data at different times during the life of the
underlying residential or commercial loan.
691 The NMLS numbers for the originator and the
company refer to the individual and company
taking the loan application, which would include
loan brokers and the company that the broker works
for. We noted in the 2011 ABS Re-Proposing
Release that we were unaware of any other unique
identifying systems used for the purpose of
identifying brokers or originators of other asset
types, across all asset types or within an asset type.
692 See the 2011 ABS Re-Proposing Release at
47965–66.
693 See the 2011 ABS Re-Proposing Release at
47966.
694 See letter from MBA III.
695 See Section III.A.3 Asset-Level Data and
Individual Privacy Concerns.

E:\FR\FM\24SER2.SGM

24SER2