The long awaited credit risk retention rules for securitization are out. The big question--whether the qualified residential mortgage or QRM exemption would be narrower than the CFPB's qualified mortgage or QM safe harbor to the Ability to Repay requirement for mortgages is no. QRM=QM. The short version is that the rule doesn't require meaningful credit risk retention where it counts, and imposes significant market-shaping safe-harbor requirements where skin in the game isn't so important.
The basic rule is that 5% credit risk must be retained, unhedged, by the securitization sponsor, either as a pro rata vertical slice of the deal or as a horizontal slice equal to 5% of the fair market value of the deal as of the closing date. But there are lots of exceptions: CMBS B-pieces suffice, Ginnie Maes, Fannie/Freddie (as long as they have "capital support form the United States" (they can still qualify with the QRM exception and other exceptions for multi-family even without US capital support), etc. Commercial loans, commercial mortgages, and auto loans all have their own QRM-type safe harbors.
In fact, as far as I can tell from a quick perusal of the rule, there is only a meaningful credit risk retention requirement without exemptions for (1) credit card securitization, (2) non-pass-through CDOs, and (3) auto and equipment leases and less common sorts of securitizations. Everything else has either a blanket safe harbor or a safe harbor provided that the underlying assets meet certain requirements.