Flagstar Bank: 21 Months Later, Allowance for Credit Losses Still Uncertain
Extend-and-Pretend Risk Now Elevated
Click here to get a printable PDF of today’s report.
“… These ineffective controls impact the Company’s ability to accurately disclose loan rating classifications, identify problem loans, and ultimately recognize the ACL [Allowances for Credit Losses] on loans and leases.” [clarification added]
- Flagstar Bank 10-Q filed on 06-Nov-2025
Summary & Opinion:
With long-running internal controls problems, an undisclosed SEC investigation, and the abrupt departure of an Audit Committee member after just 7 months, Flagstar is an extend-and-pretend risk now.
Key Points:
Undisclosed SEC Investigation
Festering Internal Controls Problems
Abrupt Departure of an Audit Committee Member
Public Finger Pointing Over Internal Controls
Key Players: The three individuals central to our negative Flagstar thesis previously worked together at senior levels in the Trump 45 administration. After leaving government, all three became involved with Flagstar. This report expresses no view on any of them, or their politics.
Steven Mnuchin: Treasury Secretary (2017–2021) under Trump 45. Founded Liberty Strategic Capital. A group led by Liberty reported holding 24.9% of Flagstar in a 13D filed 17‑Oct‑2025. He is Flagstar’s Lead Independent Director.
Brian Callanan: This is the Audit Committee member who left Flagstar. General Counsel at US Treasury (2019-2021) under Trump 45. He later joined Mnuchin’s Liberty Strategic Capital as General Counsel. Appointed to Flagstar’s board in Dec-2024, and later to his role on the Audit/Risk committees around Apr-2025. He resigned Thursday, 30-Oct-2025, effective that Sunday, 02-Nov-2025. He was in the role for only 7 months. Details below.
Joseph Otting: Comptroller of the Currency (2017–May 2020) under Trump 45. Appointed President/CEO of New York Community Bancorp/Flagstar Bank, effective 01-Apr-2024 and later Executive Chair on 05-Jun-2024, joining amid internal controls problems “related to internal loan review.” In our opinion, public blame‑shifting over those weaknesses now tarnishes his leadership. Details below.
The Undisclosed SEC Investigation
Since Sep-2024, we have been tracking an undisclosed SEC investigation at the former New York Community Bank. After a merger and a few name changes, it is now known as Flagstar Bank, NA, ticker FLG. This investigation was last confirmed as ongoing at the former NYCB, now Flagstar, as of 10-Sep-2025.
DI now tracks half as many undisclosed SEC investigations as we did earlier in 2025, when Trump first returned. Most were terminated – Flagstar’s remains open. Not good.
Festering Internal Controls Problems
On 29-Feb-2024, Flagstar first disclosed internal controls were not effective as of 31-Dec-2023. Per that 8-K/A, the weakness “related to internal loan review, resulting from ineffective oversight, risk assessment and monitoring activities.” At a bank.
Experts were hired, remediation efforts undertaken, disclosure language evolved. Yet, the 10-Q filed 06-Nov-2025, confirms internal controls were still not effective as of 30-Sep-2025.
DI’s Take: Loans are a bank’s core assets – It’s how they make money. Flagstar’s Q3-2025 10-Q shows Flagstar has loans/assets of 69%, or $62.7 billion in loans. Yet for 21 months since 31-Dec-2023, “material weaknesses” in “internal loan review” and “credit loss evaluation” persist.
Worse, even after the passing of 21 months since Dec-2023, Flagstar says it still can’t “ultimately recognize the ACL [Allowance for Credit Losses] on loans and leases.” For real. That is, investors don’t know if Flagstar’s stated $63 billion of loans are truly worth $63 billion, or if it’s hiding billions in losses. That’s dangerous in any macro environment, more so today.
Could you run your portfolio like this?
Abrupt Departure of an Audit Committee Member
Brian Callanan was General Counsel at Mnuchin’s Liberty Strategic Capital when appointed to Flagstar’s board in mid‑December 2024. The related 8-K explicitly said he, “was not appointed to serve on any committee of the Board of Directors in connection with his appointment as a director.” However, the Apr-2025 proxy statement revealed he’d been placed on Flagstar’s Audit and Risk Assessment Committees. While not a qualified financial expert, Liberty’s general counsel was given access to Flagstar’s most sensitive internal controls data.
Callanan resigned from Flagstar’s board 7 months later. Flagstar disclosed this 03-Nov-2025. Notably, two weeks earlier, TD Bank (TD) had put out a press release, on 16-Oct-2025, announcing he was leaving Liberty to join TD as its US General Counsel (effective 01-Dec-2025).
From the Flagstar Bank 8-K filed on 03-Nov-2025
On October 30, 2025, Brian R. Callanan notified Flagstar Bank, N.A. (the “Bank”), of his resignation as a member of the Board of Directors of the Bank, effective November 2, 2025. Such decision was not the result, in whole or in part, of any disagreement with the Bank on any matters relating to the Bank’s operations, policies or practices.
DI’s Take on the 8-K: We see no mention of his Audit/Risk committee roles while on the board. We had to look it up. The 8-K was also silent on Callanan’s ties to Liberty. More troubling is how quickly Callanan went for the exit of Flagstar. He resigned on Thursday, 30-Oct-2025, with an effective date that Sunday, 02-November – days before the next 10-Q was due.
Both Flagstar and Liberty had time to put together a smooth transition announcement. They chose not to. Instead, they let Callanan stay in his Audit Committee role at Flagstar until what appeared to be the last moment before he’d have to sign off on Flagstar’s latest 10-Q. Also consider that Callanan may have also left a lot of money on the table by leaving Liberty when he did.
Finally, we note the Liberty investor group owns 24.9% of Flagstar stock, below the 25% regulatory control threshold. Yet Mnuchin’s Lead Independent Director role and Callanan’s Liberty GC background raise questions about board independence.
Public Finger Pointing Over Internal Controls
The Flagstar Mar-2024 10-K contains unusual language that caught our attention. The disclosures had escalated into actual finger-pointing at the board – something as unusual as it is unsettling.
From the 10-K filed on 14-Mar-2024:
Our Board of Directors did not exercise sufficient oversight responsibilities.
As a reminder, Joseph Otting became CEO effective 01-Apr-2024 (announced 08-Mar-2024). This was after the above disclosure was made. From the outside, we cannot say what, if any, influence he had on the above disclosure. But Otting was fully in charge when the language changed, in Aug-2025. By this point, he was both Chairman and CEO.
From the 10-Q filed on 07-Aug-2025:
… the Board of Directors were not able to exercise sufficient oversight.
By Aug-2025, the board, of which Otting is chairman, is no longer blamed for the internal controls shortfall. The company is at fault now; of which he is CEO. That is, the corporation Otting runs failed to enable the board he chairs to exercise sufficient oversight.
DI’s Take: Rarely do disclosures assign blame for a controls problem so directly to the board — a clear governance breakdown. Combining Chairman and CEO roles magnified Otting’s exposure and tarnishes his tenure.
Prolonged control failures may mask deeper loan‑book problems. The disclosure shift from board to company-level blame coincides with Liberty’s board representation (two seats).
These people aren’t dumb bunnies — investors should think hard about what’s really going on.
– John P. Gavin, CFA, NACD.DC
See Addendum Below
Addendum
Internal Controls Problems Related to Loans
In an 8-K/A, filed 29-Feb-2024, Flagstar first disclosed Internal controls were not effective, as of 31-Dec-2023.
Per that 8-K, the internal controls problem, “related to internal loan review, resulting from ineffective oversight, risk assessment and monitoring activities.”
That same day, 29-Feb-2024, Flagstar’s 10-K was delayed over an array of accounting adjustments. The internal controls warning was repeated.
Since this first disclosure, the warnings about material weaknesses in internal controls have been repeated, most recently with the filing of the 10-Q for the quarter ended 30-Sep-2025, filed on 06-Nov-2025.
Flagstar Bank 10-Q filed on 06-Nov-2025:
Management concluded its disclosure controls and procedures were not effective as of September 30, 2025 ...
… These ineffective controls impact the Company’s ability to accurately disclose loan rating classifications, identify problem loans, and ultimately recognize the ACL [Allowances for Credit Losses] on loans and leases.
Evaluation of Disclosure Controls and Procedures
Under the supervision of our Chief Executive Officer and Chief Financial Officer, Management evaluated the effectiveness of design and operation of our disclosure controls and procedures pursuant to Rule 13a-15(b), as adopted by the SEC under the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Management concluded its disclosure controls and procedures were not effective as of September 30, 2025, due to the material weaknesses in its system of Internal Control over Financial Reporting, as described below. Notwithstanding the material weaknesses, Management evaluated its disclosure controls and procedures, and concluded the financial statements included in this report fairly present, in all material respects, Flagstar’s financial position, results of operations, capital position, and cash flows, for the periods presented, in conformity with GAAP.
Per Rules 13a-15(e) and 15d-15(e), disclosure controls and procedures are the controls and other procedures designed to ensure information required to be disclosed in the reports Flagstar files or submits under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include activities designed to ensure information required to be disclosed in the reports that Flagstar files or submits under the Exchange Act is accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, to allow timely decisions regarding required disclosure.
Material Weaknesses in Internal Control over Financial Reporting
A material weakness is a deficiency, or combination of deficiencies, in Internal Control over Financial Reporting, such that there exists a reasonable possibility a material misstatement in the annual or interim financial statements may not be prevented or detected on a timely basis. Management has previously identified the following material weaknesses in its system of Internal Control over Financial Reporting.
Risk assessment: We lacked effective periodic risk assessment processes to identify and timely respond to emerging risks in certain financial reporting processes and related internal controls, including independent Credit Review, that were responsive to changes in the business operations and regulatory and economic environments in which Flagstar operates.
Monitoring: Our recurring monitoring activities over process level control activities, including independent Credit Review, were not operating effectively.
Control activities: We did not sufficiently maintain effective control activities related to independent Credit Review processes and certain loan data reconciliations. Specifically, our independent Credit Review process controls were ineffective as Flagstar lacked the consistent application of an appropriate framework to validate that the ratings were accurate, timely, and appropriately challenged. These ineffective controls impact the Company’s ability to accurately disclose loan rating classifications, identify problem loans, and ultimately recognize the ACL on loans and leases.
As a result of these ineffective risk assessment, monitoring, and control activities, the Board of Directors were not able to exercise sufficient oversight.
These control deficiencies create a reasonable possibility that a material misstatement to the condensed consolidated financial statements may not be prevented or detected on a timely basis, and therefore we concluded that the deficiencies represent material weaknesses in our Internal Control over Financial Reporting.
Remediation Status of Reported Material Weaknesses
In early 2024, we appointed several new members to the Board of Directors with extensive experience as financial experts in our industry and backgrounds in risk management, including a new Lead Independent Director, a new Chairman of the Audit Committee and a new Chairman of the Risk Assessment Committee. The frequency of Audit Committee meetings increased substantially during 2024, with both Audit and Risk Assessment Committees dedicating sessions to evaluating credit risk in the portfolio. In addition, during 2025, we have added a combined joint session of the Risk Assessment Committee and the Audit Committee that occurs at least quarterly to discuss our ACL methodology and results.
Management has identified and has implemented, the following actions to address the material weakness in our risk assessment processes:
•Appointed a Chief Risk Officer, a Chief Credit Officer and a new Senior Director of Credit Review, all with large commercial bank credit experience.
•Enhanced the depth and breadth of our Independent Credit Review program to make the necessary changes in scoping approach, risk assessment and related processes, and elevating the overall stature of the Independent Credit Review function. We have improved the experience-level of the personnel performing credit reviews.
Management has taken the following actions to address the material weakness in our monitoring activities:
•Increased the frequency and nature of reporting from our Independent Credit Review function and First-Line Business Units to the Board’s Risk Assessment Committee in support of the Boards’ risk oversight Management has identified and has implemented the following actions to address the material weakness in our control activities:
•Expanded the use of independent credit analysis and reduced our reliance on tools and analyses prepared by First-line Business Units.
•Increased the Credit Review team’s ability and elevated its stature within the organization to independently challenge risk rating methodologies and results.
•Assessed the adequacy of staffing and resource levels and expertise within the Independent Credit Review function, considering the size, complexity, and risk profile of the loan portfolios. Management has enhanced the expertise and capacity of the Independent Credit Review function.
•Provided comprehensive risk rating process training to all employees involved in the lending and credit review processes.
•Enhanced processes to identify and assess risks associated with estimating the ACL and improving data governance processes.
•Increased credit review coverage of the portfolio. Approximately 700 borrowers representing $21.9 billion of loan balances were tested during the nine months ended September 30, 2025.
We continue to actively work to remediate the material weaknesses described above and are primarily in the sustainability and validation testing phase of remediation. We continue to assess our progress and whether any additional remediation steps or additional measures are needed to remediate the underlying causes of the material weaknesses, including the governance and oversight of our system of Internal Control over Financial Reporting.
While we believe our actions will be effective in remediating the material weaknesses, the material weaknesses will not be remediated until the remediation efforts we have taken are deemed to be sufficient through evidence of sustainability and Management concludes the remedial efforts are effective based upon validation testing.
Changes in Internal Control over Financial Reporting
Except for the actions noted above related to remediation of our material weaknesses, there have been no changes in our system of Internal Control over Financial Reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the three months ended September 30, 2025 to which this report relates, which materially affect, or are reasonably likely to materially affect, our system of Internal Control over Financial Reporting.