Compliance Blog

On January 7, 2020 the National Credit Union Administration issued its yearly supervisory priorities. Once again, some of the priorities will look familiar to credit unions from past years. Here’s a summary of what NCUA will focus on in upcoming exams.

Bank Secrecy Act

BSA has been on NCUA’s supervisory priorities for several years and there is no sign of this changing anytime soon. Specifically, NCUA will be looking at compliance with the customer due diligence and beneficial ownership requirements that became effective in 2018 as well as credit unions’ Suspicious Activity Report (SAR) and Currency Transaction Report (CTR) filings.

NCUA has a webpage dedicated to BSA resources. Past NAFCU Compliance Blog posts on BSA can be found here. If you are a NAFCU member and have not subscribed to our quarterly BSA Blast publication, you can update your subscription preferences here.

Information Systems and Assurance (Cybersecurity)

Similar to BSA, cybersecurity has also been a supervisory priority for many years and will likely continue to remain so. This year, NCUA will continue using the Automated Cybersecurity Examination Tool (ACET), which is based on the Federal Financial Institutions Examination Council’s (FFIEC) Cybersecurity Assessment Tool (CAT). Sometime in “early 2020,” credit unions will have access to the ACET for conducting self-assessments. NCUA has been using the ACET for credit unions with over $1 billion in assets since 2018, and last year began using the tool for credit unions with over $250 million in assets. In 2020, the ACET will be used for credit unions with over $100 million in assets.

Once NCUA has conducted an initial assessment, examiners will refresh cybersecurity maturity assessments “once every four years.” The agency is also piloting new procedures in 2020 to “evaluate critical security controls during examinations between maturity assessments” that are scaled to the credit union’s size and risk profile. Credit unions can also expect NCUA to increase stakeholder outreach this year to “provide education and promote awareness on cybersecurity issues.”

NCUA’s resources on cybersecurity can be found here. NAFCU resources are available here.

CECL

In a repeat from 2019, NCUA will also continue to evaluate credit unions’ efforts to prepare for the implementation of the Current Expected Credit Losses (CECL) accounting standard. NAFCU maintains that credit unions should not be subject to CECL, and continues to share concerns about CECL’s negative impacts to the Financial Accounting Standards Board (FASB). In 2019, the deadline for CECL was delayed to 2023, and NAFCU continues to push for more guidance and relief for credit unions. NCUA has also indicated the agency has the authority to phase-in the effects of CECL on credit union net worth ratios.

A set of frequently asked questions on CECL issued jointly by NCUA and banking regulators in April 2019 can be found here. NAFCU’s CECL FAQs are available here.

Consumer Compliance

NCUA also highlighted several consumer protection regulations as priorities for 2020. Some of these are repeated from past years, including:

• Regulation E, including initial account disclosures and error resolution policies and procedures;
• Military Lending Act and Servicemembers Civil Relief Act, which has been a supervisory priority since 2017 so “for credit unions that have not received a recent review,” examiners will check MLA and SCRA compliance.

New this year are the following:

• Fair Credit Reporting Act, specifically credit reporting policies and procedures as well as accuracy of reporting to credit reporting agencies, “particularly the date of first delinquency”;
• Gramm-Leach-Bliley and Regulation P, assessing how credit unions are protecting consumers’ nonpublic personal information;
• Truth in Lending Act/Regulation Z, with a focus on annual percentage rates, late charges, how credit unions are applying loan payments, and whether applications are consistent with written agreements and disclosures; and
• Small dollar loans, including whether a credit union’s payday alternative loans (PALs) comply with the interest rate cap and if other small dollar loans comply with regulatory requirements.

Other Priorities

In terms of other key risks, NCUA will continuing reviewing how credit unions manage credit risk with an “emphasis on…loan underwriting standards and procedures.” This will also include a review of concentration risk, particularly where there is a very high concentration in participation loans, commercial loans, indirect loans, or residential real estate loans.

Liquidity risk also remains on the supervisory priorities this year, and where a CU has low levels of on-balance sheet liquidity, NCUA will evaluate: the potential effects of changing interest rates; scenario analysis for liquidity risk modeling and changes in cash flow projections; and the appropriateness of contingency funding plans.

Finally, the discontinuation of the London Inter-Bank Offered Rate (LIBOR) is also on NCUA’s radar this year. Some of you may recall that time bankers were caught manipulating this benchmark. LIBOR is based on a lending market that “is no longer sufficiently active” which makes the index less reliable.  As a result, the United Kingdom regulator that has overseen LIBOR stated it can no longer guarantee its sustainability beyond 2021. Because credit unions may offer products based on LIBOR, or be parties to agreements including loans, investments, or deposits that are based on LIBOR, NCUA is assessing credit unions’ “exposure and planning related to the discontinuance of LIBOR.” The CFPB published a blog on the end of LIBOR in October 2019. The New York Department of Financial Services also released guidance in late 2019 on this topic. Some may find this piece published by the Securities Exchange Commission somewhat helpful.

This year’s Letter to Credit Unions is a bit different as it also pivots away from supervisory priorities to provide a little information on other exam issues. This includes pointing credit unions to some basic information about NCUA’s transition to its Modern Examination Risk Identification Tool or MERIT, which will replace the current AIRES platform starting in late 2020. NCUA also highlighted recent statutory and regulatory updates for credit unions, noting these have been incorporated into the examination program. This includes: commercial real estate appraisals; private flood insurance; public unit and nonmember shares; serving hemp businesses; and the supervisory committee audits rule. Relative to supervisory committee audits, NCUA published a minimum procedures guide on January 8, 2020 which can be found here.

NAFCU members can expect a more detailed overview of the 2020 supervisory priorities and a round-up of related resources in an upcoming edition of our NAFCU Compliance Monitor publication. Click “My Account” on our home page to review your subscriptions and make sure you are receiving our compliance publications and resources.