Vendor Due Diligence

Service Organization Control Reports

Service Organization Control (SOC) reports are internal control reports on the services provided by a service organization. The provisions of auditing standard AU 324, Service Organizations, are not intended to apply to situations in which the services provided are limited to executing client organization transactions that are specifically authorized by the client (Section 324.03). Since the services provided by FHLB Des Moines are executed based upon authorizations from our customers, FHLB Des Moines does not fall under the definition of a service provider in this instance. As such, a SOC report in accordance with Statements on Standards for Attestation Engagements (SSAE) No. 18, Reporting on Controls at a Service Organization, is not prepared for services provided by FHLB Des Moines. Please note, however, that as described more fully below, FHLB Des Moines has established and maintains systems to safeguard our assets, and to ensure the reliability, completeness and timely reporting of financial and management information provided to the Board and outside parties.

Profile of FHLB Des Moines

We encourage members to perform their own analysis regarding the safety and soundness of the FHLB Des Moines, and provide the following for your consideration:

  • We are a cooperatively held Government-Sponsored Enterprise regulated by the Federal Housing Finance Agency (FHFA)
  • All of our advances to members are fully collateralized, as required by FHFA regulations
  • We are an SEC registrant, and as such, all of our financial statements are public record (
  • We are analyzed and rated by Standard and Poor’s and Moody’s
  • We are audited by independent auditors: PricewaterhouseCoopers

Requesting Documentation

To obtain copies of FHLB Des Moines’ Insurance Certificate and Information Security Program Summary, please fill out the form below. For any additional questions, please contact

All fields marked with * are required.

The next question is only required for Third-party requests