Indirect Lending and Appropriate Due Diligence

Dear Board of Directors:

This letter details the risk management practices that are appropriate and necessary to soundly manage an indirect lending program.

What Is Indirect Lending?
Indirect lending relationships exist in different forms. The most typical form is an arrangement where a credit union contracts with a merchant to originate loans at the point of sale, such as an auto dealer.¹

Other indirect lending relationships allow a third-party vendor such as a Credit Union Service Organization (CUSO) or other outside party to perform activities related to indirect lending: including underwriting, servicing, repossession, or insurance processing.

Regardless of the type of indirect lending relationship established, no credit union should delegate loan approval authority to a third party. Every credit union has the responsibility to perform its own due diligence, establish effective controls and monitoring systems to mitigate the risks to the credit union’s earnings and net worth.

What Are the Risks?
Rapid growth in an indirect lending product line can lead to a material shift in a credit union’s balance sheet composition.

While there are benefits to a well-run indirect lending program, an improperly managed or loosely controlled program can quickly lead to unintended risk exposure. This can increase credit risk, liquidity risk, transaction risk, compliance risk, and reputation risk.

Watching for Red Flags
NCUA examiners are reviewing Call Reports for increasing amounts of repossessed autos or increasing indirect lending delinquency and loan losses. In addition to those obvious danger signs, examiners are also looking for other warning signs or "red flags" that may require a credit union to slow down indirect lending. Examples of key red flags include, but are not limited to: 

•  A high concentration of indirect loans to total loans or net worth without adequate controls in place;
•  Incentive programs tying loan officer bonuses to indirect loan volume;
•  Inadequate analysis of overall indirect loan portfolio performance; 
•  High instances of first payment default, payment deferment, and account re-aging;
•  Frequent refinancing of past due interest, repairs, and add-on expenses (GAP Insurance);² 
•  Insufficient loan documentation; or 
•  Poor dealer management including reliance on the dealer to obtain credit reports; accepting loan payments from dealers; dealer-created down payments through dealer incentives, inflated or fraudulent trade-in or purchase price; or continuous overdrafts in dealer reserve accounts.

If an examiner sees any of these red flags in your credit union, the examiner may contact your credit union or conduct on-site supervision to assess the indirect lending vendor due diligence program and red flags – even if a regular exam is not scheduled.

Effective Ongoing Due Diligence
All loan programs have unique risks. Indirect lending is no exception. A comprehensive, effective, and ongoing due diligence program is necessary to mitigate the risks associated with indirect lending. The elements of a sound due diligence program³ include: 

• A planning process which assesses the risk of the vendor relationships both initially and ongoing;
• Comprehensive written policies addressing all facets of the indirect lending program including underwriting and monitoring; 
• A review process to assess the vendor’s financial and operational risks;
• A process to periodically assess the legal agreements and needs for each program;⁴ and 
• A risk management process to control the risk associated with the vendor relationship.

Successful Planning Process
The planning process lays the foundation for a successful indirect lending program. The planning process should, at a minimum:

• Establish the credit union’s short and long-term goals for the indirect lending program;
• Establish portfolio limitations in terms of net worth, and in aggregation with other lending products;
• Determine the level of lending and collection staff sufficient to operate and monitor the program;
• Perform periodic risk-reward or cost-benefit analysis to determine if the net return to the credit union is sufficient for the risk;
• Consider the indirect lending program’s impact on asset liability management and liquidity risk management programs; and
• Establish an exit strategy in the event of an unexpected or unplanned increase in the program risk profile.

Consistent Underwriting Standards
Successful lending programs rely on well developed policies and practices. The credit union’s indirect loan policy should clearly establish specific underwriting standards and clear requirements for the loans the credit union will accept from vendors.
Indirect lending standards should be consistent with the credit union’s direct (internal) loan underwriting standards. The standards should be reviewed at least annually or more often if risk levels increase or if negative trends begin to surface.
Exceptions to the indirect loan policy should be infrequent. All exceptions should be approved by credit union personnel responsible for administering the indirect lending program and reported to the board of directors for their review.

Clear Vendor Policies
Vendors are one of the most critical components of a successful indirect lending program. Their financial health, demonstrated performance, and reputation are major factors in a successful indirect lending program. Vendors include any CUSO or third party used to facilitate indirect lending, as well as automobile dealerships.
Credit union officials should establish clear policies governing the selection of vendors, as well as conditions requiring removal of vendors from the indirect lending program.

Financial and Operational Review Process
Credit unions need to complete, and periodically update, a comprehensive financial and operational review of each indirect lending program.

The financial and operational review should, at a minimum, include:

• A clear understanding of the vendor’s business plan and marketing strategy;
• The identification of any vendor-related parties involved in the relationship (affiliates, business partners, etc.);
• A review of the financial condition of the vendor and any third-party affiliates through financial statements and business credit reports from a recognized credit reporting agency;
• An understanding of how cash flow moves between all parties involved in the transaction;
• A clear understanding of the vendor’s expectation of the credit union and the credit union’s expectation of the vendor; and
• An investigation of the vendor’s history with indirect lending (request references from other indirect lending partners).
   

Credit unions should have a clear understanding of the operational structure of the vendor and identify the individual(s) at the vendor responsible for administering the program, addressing loan underwriting issues, cash flows and contract issues.

Credit unions are responsible for obtaining information on automobile dealerships or other point-of-sale vendors whether they work directly or through CUSOs and third parties to service these relationships. It is critical for credit unions to define the risks of each type of relationship and develop sound operational controls and procedures to manage the risk.

Formalized Contracts and Written Agreements
All agreements between the credit union and the vendor should be formalized in a written contract. Written contracts should address at a minimum:

• Dealer compensation;
• Credit criteria;
• Documentation standards;
• Dealer reserves (a dealer reserve account is controlled by the credit union and provides for charging back non-performing loans to the dealer under certain circumstances);
• Dispute resolution; and
• Exit clauses.

The contract should be reviewed by legal counsel with the specialization necessary to provide a written opinion on indirect lending contracts. The legal counsel should be completely independent of the vendor, be hired directly by the credit union either internally or externally, and represent only the credit union’s interests.

Effective Risk Management
An effective risk management program can result in changes to the indirect lending program which would reduce risk exposure, identify and mitigate the risk of fraudulent activity, or result in executing the exit clause of the contract.

The most effective method of evaluating the performance of a vendor is through an analysis of the vendor’s static loan pool data.⁵ The credit union’s indirect lending policy should establish the information which is contained on the static loan pool data report. The static loan pool data report should provide sufficient information to determine, at a minimum: delinquency rates, default rates, current and cumulative losses, prepayments, and rates of return for each vendor.

Credit unions should regularly test for compliance with the contract terms by comparing delinquency, loan losses, and rates of return to previous results and budget levels. These statistics and those from the static loan pool analysis should be compiled for each vendor and the overall program. Credit unions should implement changes based on the analysis of the program and individual vendors participating in the program.

Preventing and Detecting Fraud
Fraud prevention and detection procedures should be incorporated into the credit union’s oversight program. Fraud prevention relies on strong internal controls and accurate, timely, and relevant information. Strong internal controls include but are not limited to:

• Staffing sufficient to allow for segregation of duties – one person should not be responsible for loan approval, reporting, reconciliations, and collection. If staffing levels do not allow for proper segregation of duties, other compensating internal controls may be necessary;
• Safeguards to restrict inappropriate access to data;
• Knowledge of credit union policies – staff should receive training at least annually and when policies change;
• Procedures to ensure limited exceptions to the established policies – exceptions should be infrequent and approved by appropriate personnel;
• Quality control processes to ensure the credit union receives perfected liens, proof of insurance, and other necessary documentation, in addition to verifying the completeness, accuracy and validity of loan deals; and
• Internal audit functions that include testing loans from each vendor through direct member communication.

Conclusion
An improperly planned or loosely managed indirect lending program can lead to unintended changes in the risk profile and financial performance of your credit union. NCUA has seen seemingly healthy credit unions fail in a matter of months due to indirect lending programs that spun out of control.

Guidance to federally insured credit unions on specialized lending, due diligence, and managing third-party relationships are incorporated in this letter by reference. Your credit union will be expected to follow all of this guidance when building or reviewing an indirect lending program.

If you have any questions or concerns, please contact your NCUA Regional Office or State Supervisory Authority.