Dear Board of Directors and Chief Executive Officer:
This letter describes the NCUA’s supervisory priorities for 2020, and will help you prepare for your next NCUA examination. It also addresses the NCUA’s efforts to continue to modernize the examination program.
All qualifying credit unions will continue to be scheduled under the extended examination cycle.1 Examiners will continue to use the streamlined Small Credit Union Exam Program procedures for most credit unions with assets under $50 million. For all other credit unions, examiners will conduct risk-focused examinations, which concentrate on areas of highest risk, new products and services, and compliance with applicable laws and regulations.
The NCUA remains committed to protecting America’s federally insured credit unions, and their more than 119 million members. I encourage you to review this letter and to contact your NCUA examiner or regional office if you have any questions.
The NCUA’s primary areas of supervisory focus for 2020 are discussed below.2
Bank Secrecy Act (BSA)/Anti-Money Laundering (AML) continues to be a priority. NCUA examiners conduct a BSA/AML review during every examination and take appropriate action, when necessary, to ensure credit unions meet their obligations.
The NCUA meets regularly with senior policy makers in the U.S. Department of the Treasury, the Financial Crimes Enforcement Network and the federal banking agencies to improve the transparency, efficiency, and effectiveness of our regulation and supervision of BSA/AML. Some key accomplishments to date include an October 2018 joint statement (opens new window) addressing improved efficiency through shared resources and collaborative relationships, a December 2018 joint statement (opens new window) encouraging depository institutions to explore innovative approaches to meet their BSA/AML compliance obligations, and a July 2019 joint statement (opens new window) on risk-focused BSA/AML supervision.
An ongoing area of emphasis for examinations will be the customer due diligence and beneficial ownership requirements that became effective May 11, 2018. The NCUA will continue to communicate with credit unions, engage with law enforcement, and collaborate with the other banking regulators on several initiatives, including:
- Updates to the FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual (opens new window) (You will be leaving NCUA.gov and accessing a non-NCUA website. We encourage you to read the NCUA's exit link policies. (opens new page).) ;
- Updates to enforcement guidelines;
- Issuing guidance regarding politically exposed persons; and
- Providing clarifications and ways to improve Suspicious Activity Report (SAR) and Currency Transaction Report (CTR) filings.
In addition, the NCUA will continue to focus on proper filing of SARs and CTRs. Filing timely and informative SARs and CTRs provides law enforcement, intelligence, and counter-terrorism officials with vital information. These officials regularly use this information to successfully identify and thwart illicit and terrorist activities, and to prosecute and convict the guilty parties. Credit union efforts in this area are helping to fight crime and keep America safe.
Consumer Financial Protection
Credit unions have a long history of strong member service. Consumer financial protection is a vital element of member service. Therefore, NCUA examines for compliance with applicable consumer financial protection regulations during every examination. The scope of each examination’s consumer compliance reviews are largely risk-focused, based on each credit union’s compliance record, products and services provided, and any new or emerging concerns.
In addition, each year the NCUA identifies several specific consumer financial protection regulations that are required to be reviewed at all examinations when applicable to the credit union. These regulations are rotated each year to ensure broad coverage over a multi-year period. The NCUA selects the specific priorities for a given calendar year by analyzing trends in violations identified through examinations, member complaints, recent changes to regulatory requirements, and time since a regulation was last required to be reviewed.
In 2020, NCUA examiners are required, at a minimum, to review compliance with the following consumer protection requirements:
- Electronic Fund Transfer Act (Regulation E). Examiners will evaluate Electronic Fund Transfer (EFT) policies and procedures and review initial account disclosures. Examiners will also review compliance with Regulation E’s error resolution procedures for when consumers assert an error.
- Fair Credit Reporting Act (FCRA). Examiners will review credit reporting policies and procedures. If applicable, examiners will also review the accuracy of reporting to credit bureaus, particularly the date of first delinquency.
- Gramm-Leach-Bliley (Privacy Act). Examiners will continue to assess compliance with Gramm-Leach-Bliley to evaluate credit union protection of non-public personal information about consumers.
- Small dollar lending (including Payday Alternative Lending). Examiners will test for compliance with NCUA Payday Alternative Lending (PALs) rules and interest rate cap. In addition, examiners will determine whether a credit union’s short-term, small-dollar loan programs that are not PALs comply with regulatory requirements.
- Truth in Lending Act (Regulation Z). Examiners will evaluate credit union practices concerning annual percentage rates and late charges. These reviews will assess how credit unions apply loan payments to principal, interest, fees and other charges, and whether the application is consistent with the written agreement and disclosures. Examiners will also review whether credit unions appropriately levy late fees. They will also test whether credit unions are accurately disclosing finance charges and annual percentage rates.
- Military Lending Act (MLA) and Servicemembers Civil Relief Act (SCRA). MLA and SCRA have been a supervisory priority since 2017 and will remain so for 2020. For credit unions that have not received a recent review, examiners will review credit union compliance with the MLA and SCRA.
Reviewing the credit risk management of credit unions is a fundamental part of the supervisory process. In 2020, NCUA examiners will place emphasis on the review of the credit union’s loan underwriting standards and procedures. In particular, examiners will verify if credit unions properly analyzed the ability of borrowers to meet debt service requirements without undue reliance on the value of any collateral.
In addition, examiners will continue to review concentration risk exposure during each examination. In 2020, the NCUA is implementing enhanced examination procedures, including supervisor concurrence and additional quality controls, for credit unions with very high concentrations in specific loan types.3
For more information, see NCUA Letter to Credit Unions 10-CU-03, Concentration Risk.
Current Expected Credit Losses
Although the Financial Accounting Standards Board granted a one-year delay (to January 2023) for credit unions to comply with its new current expected credit losses (CECL) standard, examiners will continue to discuss with credit union management their plans to implement CECL.4
For more information, see the April 2019 Interagency Frequently Asked Questions on the New
Accounting Standard on Financial Instruments - Credit Losses.
Cyber-attacks continue to pose a threat to the financial system. Advances in technology and the increased use of mobile technology for financial transactions means more opportunity for cybersecurity threats.
In 2018, the NCUA began using the Automated Cybersecurity Examination Tool (ACET) to assess credit unions’ cybersecurity maturity.5 The NCUA collaborated with the Department of Homeland Security and the Idaho National Laboratory to create an updated client/server version of the ACET that is being fully deployed in 2020. Credit unions will be able to complete self- assessments through access to the new ACET on NCUA’s website in early 2020.
The NCUA began the cybersecurity maturity assessments for credit unions with assets of $1 billion or greater in 2018, followed by institutions with assets between $1 billion and
$250 million in 2019. In 2020, the NCUA will continue completing these assessments for credit unions with assets over $250 million, and begin completing assessments for credit unions with assets over $100 million.
The initial maturity assessment cycle will be completed in 2021. Starting in 2022, the agency will refresh the maturity assessments following the same asset size schedule discussed above, resulting in a refresh cycle of once every four years.
In addition to the ACET, the NCUA will be piloting new procedures in 2020 to evaluate critical security controls during examinations between maturity assessments. The critical security controls reviews will be scaled to the size and risk profile of the institution.
The NCUA will also be increasing stakeholder outreach in 2020 to provide education and promote awareness on cybersecurity issues. These outreach activities will promote collaboration and solicit industry feedback on the challenges and opportunities associated with cybersecurity.
For more information, visit the NCUA’s Cybersecurity Resources website.
The United Kingdom’s Financial Conduct Authority has announced that it cannot guarantee LIBOR’s availability beyond the end of 2021. LIBOR is a reference rate commonly used in setting the interest rate for many adjustable- or variable-rate financial products.
Credit unions both offer and own, and are counterparties to, LIBOR-based products and contracts. Examples include loans, investments, derivatives, deposits, and borrowings. These may be subject to increased legal, financial, and operational risks once this reference rate is no longer available.
Planning for LIBOR cessation is an important operational and safety and soundness consideration for credit unions with material exposures. Credit unions need to proactively transition away from instruments using LIBOR as a reference rate.
Examiners will assess credit unions’ exposure and planning related to the discontinuance of LIBOR. The scope of the review will cover:
- Identification of all LIBOR-related transactions including both on- and off-balance sheet exposures (number of transactions and balance amounts); and
- Planning, governance, senior executive engagement, budgeting, accounting, and addressment of other impacts related to the transition and discontinuance of LIBOR.
On average, credit union balance sheets continue to exhibit lower levels of on-balance-sheet liquidity due, in part, to strong loan growth trends. In addition, financial innovations and new market participants may increase competition for traditional, low-cost deposits. For 2020 examinations, examiners will review credit union liquidity management and planning. In particular, for credit unions with low levels of on-balance sheet liquidity, examiners will assess liquidity management by evaluating:
- The potential effects of changing interest rates on the market value of assets and borrowing capacity;
- Scenario analysis for liquidity risk modeling, including possible member share migrations (for example, shifts from core deposits into more rate-sensitive accounts). Also, scenario analysis for changes in cash flow projections for an appropriate range of relevant factors (for example, changing prepayment speeds); and
- The appropriateness of contingency funding plans to address any potential liquidity shortfalls.
Resources and guidance on liquidity risk can be found in the NCUA’s Examiner's Guide.
In 2019, the NCUA began piloting a new user portal, NCUA Connect. NCUA Connect is a secure, common entry point for authorized users to access NCUA applications. This year, NCUA Connect will be made available to all credit unions and state regulators.
The NCUA has conducted a limited launch of the agency’s new examination platform, the Modern Examination and Risk Identification Tool (MERIT). MERIT will be released to all examination staff in the second half of 2020.
Unlike our legacy examination platform (AIRES), credit unions will also be users of MERIT and will have the ability to perform certain activities in the tool, such as:
- Transferring documents and files needed for the examination securely;
- Providing status updates and requesting due date changes on corrective actions; and
- Accessing completed examination reports securely.
For more information, see NCUA.gov, NCUA Connect & MERIT.
In addition, the NCUA’s Enterprise Solution Modernization program has several other initiatives underway to improve and modernize legacy agency systems, such as CUOnline (the Profile and Call Report). Modernization of the NCUA’s systems will improve the quality of the examination program and lead to less onsite presence overall.
For more information, see NCUA.gov, Examination Modernization Initiatives.
In July 2019, the NCUA Board approved a final rule amending Part 722 that increased the appraisal threshold for commercial real estate transactions from $250,000 to $1 million. Effective October 22, 2019, commercial real estate transactions below $1 million do not require appraisals conducted by certified appraisers; instead, credit unions may choose to conduct a written estimate of market value or obtain an appraisal by a state-licensed appraiser.
Commercial real estate transactions valued at $1 million and greater are still required to obtain appraisals conducted by certified appraisers. The final rule increases the standards for the qualifications and independence of individuals conducting written estimates of market value.
Private Flood Insurance Rule
In February 2019, the NCUA Board and the other banking agencies finalized the private flood insurance rule. The private flood insurance rule relies on two main provisions regarding credit union acceptance of flood insurance policies that are not issued by the National Flood Insurance Program (that is, from private providers).
Credit unions must accept certain flood insurance policies from private providers under Part 760. For other policies from private providers, credit unions have the option to accept the insurance if the policy meets certain criteria. For more information, see the NCUA Regulatory Alert, 19-RA-01, Flood Insurance Alternatives.
In October 2019, the NCUA Board approved a final rule amending Section 701.32 regarding public unit and nonmember shares. Effective January 29, 2020, federally insured credit unions generally can accept public unit and nonmember shares in an amount up to 50 percent of the credit union’s amount of paid-in and unimpaired capital and surplus, less any public unit or nonmember shares, or $3 million, whichever is greater.
A credit union must develop and make available for examination a plan for the use of funds if its public unit and nonmember shares, combined with its borrowings, exceeds 70 percent of paid-in and unimpaired capital and surplus.
On December 20, 2018, President Trump signed into law the Agriculture Improvement Act of 2018. With the signing of this Act, hemp is no longer a controlled substance at the federal level. Hemp may be produced lawfully under the United States Department of Agriculture’s October 31, 2019, interim final rule establishing the U.S. Domestic Hemp Production Program. This rule outlines provisions for the USDA to approve plans submitted by states and Indian tribes for the domestic production of hemp. It also establishes a federal plan for producers in states or territories of Indian tribes that do not have their own USDA-approved plan.6
Many credit unions have a long and successful history of providing services to the agriculture sector. Credit unions may provide the customary range of financial services for business accounts, including loans, to lawfully operating hemp-related businesses within their fields of membership. Hemp provides new opportunities for communities with an economic base involving agriculture. The NCUA encourages credit unions to thoughtfully consider whether they are able to safely and properly serve hemp-related businesses.
The NCUA will be issuing additional guidance on this subject soon. For 2020, NCUA examiners will be collecting data through the examination process concerning the types of services credit unions are providing to hemp-related businesses.
For more information, see NCUA Regulatory Alert, 19-RA-02, Serving Hemp Businesses, and the USDA’s website. (opens new window) (You will be leaving NCUA.gov and accessing a non-NCUA website. We encourage you to read the NCUA's exit link policies. (opens new page).)
In September 2019, the NCUA Board approved a final rule amending part 715 to provide additional flexibility to federally insured credit unions regarding financial statement audits. These amendments go into effect January 6, 2020.7 The NCUA has issued a new guide to assist supervisory committees in conducting other supervisory committee audits.
I look forward to continuing to advance how the agency regulates and supervises credit unions, adopting innovations and incorporating efficiencies while ensuring a safe and sound credit union system.
Rodney E. Hood
2 If applicable to the activities of the credit union, these priorities apply to NCUA’s examination of federal credit unions and, where relevant, to NCUA insurance reviews of federally insured, state-chartered credit unions.
3 Specific loan types include participation loans, commercial loans, indirect loans, and residential real estate loans.
4 For more information, see FASB Accounting Standards Update (ASU) No. 2016-13, Topic 326, Financial Instruments – Credit Losses.
5 ACET is based on the Federal Financial Institution Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT).
6 The interim final rule governs the production of hemp under the 2018 Farm Bill. The interim final rule does not affect industrial hemp that was or is being cultivated under the 2014 Farm Bill programs. That industrial hemp remains subject to the requirements of the 2014 Farm Bill.
7 For engagement letters signed before January 6, 2020, credit unions should follow the previous Supervisory Committee Guide. For multi-year (contract) engagement letters signed before January 6, 2020, the engagement for the year ending December 31, 2019, would also follow the previous Supervisory Committee Guide; future years would require either an addendum or a new letter to comply with the amended regulation.