Supervisory Focus for 2014

Dear Board of Directors and Chief Executive Officer:

This letter is intended to assist you in preparing for your NCUA examination.  Our focus will be on the areas of highest risk and on making the exam process simpler and more effective.

As credit unions have steadily recovered from the financial crisis, NCUA is now able to devote more resources to focusing on the future of the credit union industry.  In 2014, NCUA will be working to ensure that credit unions identify and mitigate forward-looking risks before they threaten the viability of credit unions and the stability of the Share Insurance Fund. 

NCUA’s primary responsibility is maintaining the safety and soundness of the credit union system.  This involves supervising credit unions and enforcing compliance with rules intended to strengthen them.  Mindful of the burdens that often accompany regulatory compliance, in 2014 we will continue our Regulatory Modernization Initiative and, in addition, are planning to streamline the exam process. 

Below are NCUA’s specific areas of supervisory focus for 2014.

Risks on the Horizon

In 2014, field staff will be looking for evidence that credit unions are managing potential risks on the balance sheet, in technology, and in new loan product portfolios.

Interest Rate Risk

Interest rate risk is the most significant risk the industry faces right now.  As rates have risen above record lows, many credit unions’ unrealized gains have swung to unrealized losses.  These unrealized losses may foreshadow the actual losses credit unions will face if continuing rate increases eventually result in more compression of net interest margins. 

It is imperative for credit unions to make the necessary adjustments to account for a rising rate environment.  Even a slow, gradual increase in rates could have significant consequences for credit unions with high concentrations in certain long-term investments and loans.  NCUA will be working to ensure credit unions are mitigating any inordinate exposure. 

Cybersecurity Threats

As credit unions adopt new technology to meet member service needs, they and their members are exposed to a growing volume and sophistication of cyber-attacks.  The global interconnectedness of today’s networks raises operational risks and exposes credit unions of all sizes to cyber-criminals and cyber-terrorists who have acquired programs to compromise data, steal identities, block transactions, and crash financial systems. 

Cybersecurity threats are no longer limited to large credit union targets.  Smaller institutions have been identified as vulnerable entry points for cyber-terrorists to infiltrate larger networks in stealth operations designed to disrupt the entire United States economy. 

NCUA field staff will evaluate credit unions’ ability to assess and mitigate cybersecurity risk and respond to cyber-attacks.  Credit unions of all sizes will be expected to implement appropriate risk mitigation controls – including vendor due diligence, strong password processes, proper patch management and network monitoring – to better prevent, detect, and recover from cyber-attacks. 

NCUA will work with a newly formed interagency working group to promote cybersecurity throughout the financial industry.

Money Services Businesses (MSBs)

Credit unions that maintain account relationships with MSBs, or are considering doing so, need to be aware of the potential risks involved – particularly with regard to money laundering.  Without proper controls, MSBs may generate transaction volume that could overwhelm a credit union and cover up illegal activities. 

Field staff will be scrutinizing credit unions’ relationships with MSBs, looking to ensure that credit unions are in compliance with Bank Secrecy Act requirements with regard to MSB member accounts. 

Private Student Lending

Private student loans are the fastest-growing product in the credit union industry.  Defaults may not appear on the books for the first four years, but these private loans are not backed by the full faith and credit of the U.S. government. 

Because of the increased risk, NCUA field staff will evaluate each credit union’s student lending plans, policies, controls, and third-party due diligence.  Credit unions offering student loans through third parties must carefully investigate the originators and any insurer as well.¹ 

New Requirements

NCUA and other regulators have issued new rules to ensure that the industry is operating in a safe and sound manner.  In 2014, NCUA examinations will assess credit unions’ compliance with the following new rules and regulations: 

Loan Participation Rule (became effective September 23, 2013)

NCUA’s revised rule protects the purchasers in loan participation arrangements, while giving credit unions the flexibility to use these products to diversify portfolios, improve earnings, generate loan growth, and manage balance sheets.²  

Field staff will expect compliance with key provisions of the new rule, including:

• A single-originator concentration limit of 100 percent of the credit union’s net worth or $5 million, whichever is greater, for purchasing credit unions.
• A 10 percent risk-retention requirement for originating federal credit unions, as required by the Federal Credit Union Act; and a 5 percent risk-retention requirement for other originating eligible organizations (including federally insured, state-chartered credit unions, unless state law requires a higher percentage).
• A limit of 15 percent on participation loans to one borrower.

Federally insured credit unions now have the ability to apply for waivers on certain key provisions of the rule, and they are encouraged to discuss waiver requests with NCUA field staff.

Ability-to-Repay and Qualified Mortgage Standards (effective date: January 10, 2014)

The Consumer Financial Protection Bureau (CFPB) passed this rule to require mortgage lenders to consider each consumer’s ability to repay a home loan before extending credit.   There are two primary provisions to the new rule:

(1) Mortgage lenders must consider eight specific factors to assess a borrower’s ability to repay a loan at origination.

(2) Loans that meet the ability-to-repay requirement and other underwriting criteria will be considered “Qualified Mortgages” (QMs) and will be subject to certain legal protections.

In the early stages of CFPB’s newly effective mortgage rules, NCUA field staff will take into account each credit union’s good-faith efforts to comply. 

Whether your credit union originates Qualified or non-Qualified Mortgages, field staff will evaluate credit risk, liquidity risk, and concentration risk.  NCUA will not subject a mortgage to safety-and-soundness criticism solely because of the loan’s status as a QM or non-QM.  However, credit unions choosing to make non-QMs will need to take into account the potential new market and legal risks.⁴

Credit Union Service Organizations (CUSO) Rule (effective date: June 30, 2014)

NCUA recently adopted the final CUSO Risk Transparency rule, which aims to alleviate potential risk to the Share Insurance Fund and the industry, while also reducing reporting requirements for credit unions.⁵   Under the rule, credit unions will be subject to the following provisions regarding CUSO relationships:

• All federally insured credit unions making loans to or investments in CUSOs must now require the CUSO to account for transactions using Generally Accepted Accounting Principles, prepare quarterly financial statements, and obtain annual audits of financial statements. 
• A federally insured, state-chartered credit union that is or would be rendered less than adequately capitalized by additional investment in a CUSO must now obtain approval from its state regulator and notify an NCUA Regional Director prior to making the investment.

The rule also imposes new requirements on CUSOs that will become operational toward the end of 2015, such as:

• All CUSOs must agree to report basic information (name, contact information, products and services, clients and investors) directly to NCUA.
• CUSOs that offer complex or high-risk services must report more detailed information, including financial statements and general customer information, directly to NCUA.

In addition, CUSO subsidiaries will be subject to the rule if the subsidiary is primarily engaged in providing products or services to credit unions or their members.

By June 30, 2014, credit unions with CUSO relationships will need to update their written agreements to address the requirements of the new rule.

Reallocating Resources

Each year, NCUA strategizes on ways to reallocate resources more efficiently and effectively.  In 2014, we will be taking several steps to streamline examinations.

Revised Exam Scope

NCUA will issue a revised exam scope policy that provides field staff with more flexibility to narrow or expand the scope of an exam, based on an evaluation of the credit union’s operations and risk level. 

The new policy will lay out specifically:

• which areas of review are required for an exam;
• which areas are recommended (but field staff have the ability to opt-out of on a case-by-case basis); and
• other areas field staff may want to consider, depending on the operations and heightened risks of a particular credit union. 

These various levels of review were identified and categorized based on NCUA’s annual industry-wide risk assessment. 

The new policy will empower field staff to better allocate their time and resources to the most relevant risk areas in each credit union.

Small Credit Union Exams

NCUA will continue to streamline exams for smaller credit unions in 2014.  Field staff will be testing targeted scopes and new procedures under the Small Credit Union Examination Program in select credit unions with $30 million or less in total assets that received a CAMEL composite rating of 1, 2, or 3 at their last exam. 

Exams under this program focus on the most pertinent areas of risk in small credit unions – lending, recordkeeping, and internal controls – and typically require less time than other exams. 

NCUA will work with field staff throughout the year to test measures to further improve exams. 

As always, NCUA welcomes your feedback on our regulatory and supervisory approaches.  I look forward to working to enhance our supervision and ensure credit unions’ success in the coming year.