On January 18, 2022, the National Credit Union Administration (NCUA) issued Letter to Credit Unions 22-CU-02, which sets out the agency’s supervisory priorities for the year. The Letter notes that, in 2021, the NCUA trained all NCUA and state regulator users on the Modern Examination and Risk Identification Tool (MERIT), and this year, credit unions may use the platform and its related systems during their examinations.
In other examination news, the NCUA finalized the rule adding the “S” component (for Market Sensitivity) to the CAMEL rating system in October 2021. It also redefined the “L” component. This updated the CAMEL rating system to CAMELS, providing more transparency in the ratings to distinguish between liquidity risk (“L” component) and sensitivity to market risk (“S” component). The final rule became effective for examinations starting on or after April 1, 2022.
In addition to overall safety and soundness and compliance with all other relevant regulations, the eleven areas of primary focus for the NCUA this year are: credit risk management, information security (cybersecurity), payment systems, Bank Secrecy Act Compliance and Anti-Money Laundering/Countering the Financing of Terrorism, capital adequacy and risk-based capital rule implementation, loan loss reserving, consumer financial protection, loan participations, fraud, London Inter-Bank Offered Rate (LIBOR) transition, and interest rate risk.
Credit Risk Management
The NCUA continues to focus on credit union’s credit risk management and mitigation efforts. Credit unions’ risk management practices should be appropriate for the nature and level of complexity for all lending programs and activity. The NCUA expects credit unions to maintain safe and sound lending practices and to comply with all relevant consumer financial protection laws, including those regarding disclosures and reporting. Chapter 10 of the NCUA’s Examiner’s Guide provides a helpful outline of what examiners will be looking for.
Information Security (Cybersecurity)
The NCUA notes that “cybersecurity risks remain a significant threat to the financial system. The likelihood of threats adversely affecting credit unions and their members continues to rise” due to concerns such as “ransomware, third-party/supply chain risks, and business e-mail compromises.” To that end, the NCUA continues to update its information security examination procedures and review information security practices. The NCUA’s Cybersecurity Resources webpage includes many helpful resources on this topic, including the Automated Cybersecurity Evaluation Toolbox (ACET) application, which allows credit unions to self-assess and measure their cybersecurity preparedness.
Due to the rapidly evolving payments landscape, the NCUA will focus on the growing area of complexity and risk of payment products, services, and operations. These swift changes have the potential to increase the risk of fraud, illicit use, and breaches of data security, prompting the NCUA to increase its focus in the area.
Bank Secrecy Act Compliance and Anti-Money Laundering/Countering the Financing of Terrorism
As in recent years, BSA/AML compliance continues to be a focus of the NCUA, as well as other federal regulators. There are BSA and AML/CFT components included in every examination. Pursuant to the Anti-Money Laundering Act of 2020 and the Corporate Transparency Act which amended the BSA, there will be various new requirements for credit unions to follow, including updating their risk-based BSA and AML/CFT policies, procedures, and processes. The new requirements will be rolled out in stages throughout this year, and the FFIEC’s Bank Secrecy Act/Anti-Money Laundering Examination Manual will be updated to reflect these changes.
Capital Adequacy and Risk Based Capital Rule Implementation
The NCUA issued a final risk-based capital rule, which took effect on January 1, 2022. The rule outlines the risk-based capital requirements that complex credit unions are now subject to. As a result, changes were made to the quarterly Call Report, which complex credit unions will start utilizing for the March 31, 2022, reporting period. The NCUA notes that “examiners will review the accuracy of complex credit unions’ reporting for the new data elements required in the risk-based capital scheduled of the Call Report.” Credit unions may find it helpful to review NCUA’s FAQs on the rule.
Loan Loss Reserving
Credit unions with $10 million or more in assets are required to implement the Financial Accounting Standards Board’s (FASB) Accounting Standards Update No. 2016-13, Topic 326 by January 1, 2023, for loan loss reserving, otherwise known as the current expected credit losses methodology (CECL).
Consumer Financial Protection
For 2022, in addition to general risk-focused consumer compliance reviews that are completed, the NCUA has identified various consumer financial protection areas for examiners to focus on, including protections implemented during the COVID-19 pandemic, fair lending, the Servicemembers Civil Relief Act, the Fair Credit Reporting Act, and overdraft programs.
This year, the NCUA will continue to review safe-and-sound practices for managing loan participation portfolios. The NCUA recognizes that these portfolios may be serviced by outside entities, and will evaluate accordingly to verify that “credit unions have evaluated the risk in the loan participation transactions and how that risk fits within the tolerance levels established by the credit union’s board.” The NCUA will also look at transactional-level details, and credit unions’ reconcilement procedures.
Based on the “offsite posture” due to the COVID-19 pandemic over the last two years, the risk for fraud has significantly increased. The NCUA plans to review the efforts of credit unions to prevent and detect fraud, which includes establishing and implementing strong internal controls and keeping certain duties clearly separated. The NCUA’s Fraud Prevention Resources webpage provides a great deal of information on deterring, detecting, responding to, and reporting fraud.
London Inter-Bank Offered Rate (LIBOR) Transition
Pursuant to the winding down of the LIBOR, the NCUA will ensure that credit unions limit their LIBOR exposure and have established adequate fallback language in their contracts. The NCUA’s Letter to Credit Unions 21-CU-03 encouraged the transition away from the LIBOR no later than December 31, 2021 and included a Supervisory Letter on evaluating LIBOR transition plans.
Interest Rate Risk
Lastly, the NCUA will review credit unions’ interest rate risk during this year’s examinations. The NCUA noted that “if credit unions invested surplus funds in long duration assets, this could result in greater sensitivity to market risk, and therefore increased interest rate risk.” The agency recommends that credit unions continue to model and manage interest rate risk carefully and use wide-ranging scenarios and assumptions. Examinations can be an arduous process, and to the extent possible, NAFCU is here to help with questions, tips, and resources. One such resource is the NAFCU Exam Fairness Guide, which may be useful to credit unions amid an especially tricky examination.
Rebecca Tetreau is regulatory compliance counsel for NAFCU.