# Flagstar Bank

Flagstar Bank is an American commercial bank headquartered in Troy, Michigan. A wholly owned subsidiary of Flagstar Financial, Flagstar is one of the largest residential mortgage servicers in the United States, and ranked among the largest banks in the United States prior to its acquisition in 2022.

## History

First Security Savings Bank was founded as a federal savings bank in 1987. The chairman of the bank was Thomas J. Hammond. The initial branch focused on funding regional retail and wholesale mortgage operations. A bank holding company, FSSB Holding Corporation was established in 1993. The following year, the company acquired Security Savings Bank, based in Jackson, Michigan. Two years later in 1996, the company adopted its current name, Flagstar Bank.
In 1997, the company became a public company via an initial public offering. It moved its stock listing from the NASDAQ to the New York Stock Exchange in 2001.
During the 2007–2008 financial crisis, the company raised $1.6 billion in new capital with investments from MP Thrift Investments L.P., the Troubled Asset Relief Program (TARP), and public offerings. The bank repaid all of the funds it received under TARP in August 2016.
Flagstar effected 1:10 reverse stock splits in 2010 and 2012 to maintain its New York Stock Exchange listing. The U.S. Department of Treasury sold its preferred stock of Flagstar to private investors in 2013.
In May 2013, Flagstar paid a $110 million settlement to MBIA. In June 2013, Flagstar reached a $105 million settlement with Assured Guaranty related to its RMBS. Flagstar paid a $93.5-million settlement to Fannie Mae in November 2011, and $8.9 million to Freddie Mac regarding its RMBS mortgage repurchase obligations in December 2013. In September 2014, Flagstar agreed to pay $37.5 million to the Consumer Financial Protection Bureau.
In 2013, the company sold a $1.3 billion commercial loan portfolio to CIT Group. Flagstar Bank was the jersey sponsor of the Detroit Pistons of the National Basketball Association for the 2017-18 NBA Season.
In 2018, the bank acquired 8 branches in San Bernardino County, California from Desert Community Bank. The company also acquired a mortgage warehouse loan portfolio from Santander Bank. During that same year, Flagstar also acquired 52 Wells Fargo branches in Indiana, Michigan, and Ohio, as well as four in Wisconsin. However, numerous issues plagued Flagstar during the transfer, several of which were caused by its main website experiencing technical glitches. Flagstar waived fees, added staff and published an email address where customers could send concerns to alleviate issues. The bank said most issues were resolved by the end of the week.
In 2019, the company initiated a dividend.

### Merger

On April 26, 2021, New York Community Bancorp, Inc. (NYCB) announced the acquisition of Flagstar in an all stock strategic merger. The acquisition was completed on December 1, 2022.
In March 2023, New York Community Bancorp's Flagstar Bank took on nearly all of Signature Bank's deposits. Signature Bank was closed by regulators on March 12, 2023. Signature Bank's closure became the third largest bank failure in U.S. history. The agreement did not include about $4 billion linked to Signature's crypto business, which the FDIC said it intended to deal with directly. The 40 former branches of Signature Bank operated under Flagstar Bank as of Monday, March 20, 2023. "Depositors of Signature Bridge Bank, N.A., other than depositors related to the digital banking business, will automatically become depositors of the assuming institution," the FDIC said in a statement. The FDIC said Flagstar would also buy some of Signature's loan portfolios.

### Community

In 2016, Flagstar Bank announced plans for a $10 million, 5-year economic development program for Pontiac, Michigan. The initiative is aimed at helping revitalize the Oakland County city. The program includes $5 million for home mortgages including a customized home loan product for Pontiac residents, $2.5 million for small businesses and start-ups, $1.5 million for the previously announced naming rights of the Flagstar Strand Theatre for the Performing Arts along with an investment of $1 million for financial literacy in the community.

### Management

Thomas J. Hammond, founder of Flagstar, served as chairman of Flagstar Bank and Flagstar Bancorp. Mark Hammond became president of the bank in 1995 and CEO in 2002.
In 2009, former CEO of Sovereign Bancorp Joseph P. Campanelli was named chairman, president, and CEO of Flagstar Bank and Flagstar Bancorp.
In 2012, Michael J. Tierney, previously executive vice president and managing director of personal financial services at Flagstar, became president and CEO of the organizations. John D. Lewis, former vice chairman and director of Comerica, was named chairman. Alessandro P. DiNello became president, CEO and director of the organizations in 2013.

## Controversy

On February 24, 2012, the United States Department of Justice filed a complaint in the United States District Court for the Southern District of New York against the bank, alleging that it had improperly approved thousands of residential home mortgage loans for government insurance. In February 2013, a U.S. District court in Manhattan found that the bank had materially breached contracts specifying the quality and characteristics of loans to be packaged into the securities.

## Flagstar fined $3.5M for ‘misleading’ after 2021 cyberattack

The bank “negligently made” materially misleading statements after a hack that resulted in the theft of 1.5 million customers’ personally identifying information. Flagstar Bank must pay $3.5 million to the Securities and Exchange Commission for making allegedly misleading statements about a 2021 cyberattack, the agency said this week. After a hacker gained access to Flagstar’s Citrix environment in late 2021 and stole personally identifying information of 1.5 million customers, Flagstar “negligently made” materially misleading statements on its website and in financial filings, according to the SEC. In its 2021 Form 10-K filed March 1, 2022, Flagstar said cyberattacks “may interrupt our business or compromise the sensitive data of our customers,” but the bank did not disclose that it had already experienced such attacks that resulted in a customer data leak and interruptions to its mortgage origination business, according to the SEC order. The commission also found that in a June 17, 2022, notice to customers and an August 9, 2022, securities filing, the bank made misleading statements regarding the scope of the Citrix breach. Flagstar also failed to maintain disclosure controls and procedures that would have ensured the bank was ready with all relevant information to make required disclosures. Flagstar Bank must pay $3.5 million to the Securities and Exchange Commission for making allegedly misleading statements about a 2021 cyberattack, the agency said this week. After a hacker gained access to Flagstar’s Citrix environment in late 2021 and stole personally identifying information of 1.5 million customers, Flagstar “negligently made” materially misleading statements on its website and in financial filings, according to the SEC.
In its 2021 Form 10-K filed March 1, 2022, Flagstar said cyberattacks “may interrupt our business or compromise the sensitive data of our customers,” but the bank did not disclose that it had already experienced such attacks that resulted in a customer data leak and interruptions to its mortgage origination business, according to the SEC order.
The commission also found that in a June 17, 2022, notice to customers and an August 9, 2022, securities filing, the bank made misleading statements regarding the scope of the Citrix breach.
Flagstar also failed to maintain disclosure controls and procedures that would have ensured the bank was ready with all relevant information to make required disclosures. Flagstar neither admitted nor denied the commission’s allegations, but it consented to the $3.5 million penalty and a cease-and-desist order barring it from making misleading statements in the future.
“We are pleased to have resolved the SEC matter. We remain committed to our compliance and regulatory obligations,” a Flagstar spokesperson said in an emailed statement.
The cyberattack was the bank’s second of 2021, after bad actors took advantage of a flaw in Accellion’s File Transfer Appliance software, which Flagstar was using to protect sensitive information.
Flagstar also fell victim to the 2023 breach of file transfer system MOVEIt, which affected about 837,390 Flagstar customers and more than 2,000 organizations.