By James Brody
New GSE rules are pushing mortgage lenders to conduct deeper audits of vendor AI systems beyond traditional SOC 2 reviews
The mortgage banking industry has now entered a procurement environment in which a vendor’s SOC 2 Type II report is necessary but no longer sufficient. Freddie Mac’s Bulletin 2025-16, amending Guide §§ 1302.2 and 1302.8, has been live since March 3, 2026. Fannie Mae’s Lender Letter LL-2026-04, issued April 8, 2026, takes effect August 6, 2026, 120 days from publication. Both reach the same operational result by different architectural routes.
