Update to NCUA’s 2020 Supervisory Priorities

Dear Boards of Directors and Chief Executive Officers:

This letter updates the NCUA’s 2020 supervisory priorities to reflect economic conditions that emerged in response to the COVID-19 pandemic, as well as various statutory and regulatory changes that have occurred since March 2020. With these revised priorities, the NCUA is focusing its examination activities on areas that pose elevated risk to the credit union industry and the National Credit Union Share Insurance Fund given the current environment.

The NCUA understands the challenges credit unions are facing during the COVID-19 pandemic. The agency continues to respond with updated policies, procedures and enhancements to its supervision program.¹ Given the ongoing impact of the pandemic, the NCUA will be updating the Examiner’s Guide to include additional guidance for examiners, including review procedures for assessing the safety and soundness of credit unions. Additional information on the NCUA’s response to the pandemic is available on the agency’s Coronavirus (COVID-19): Information for Federally Insured Credit Unions and Members webpage.

Examinations for those credit unions qualifying for the agency’s extended examination cycle will continue to be scheduled in accordance with the exam flexibility initiative.² The NCUA’s targeted Small Credit Union Exam Program (SCUEP) procedures will be used to examine most federal credit unions with assets under $50 million. For all other credit unions, examiners will conduct risk-focused examinations, concentrating on areas of highest risk, new products and services, and compliance with applicable laws and regulations. Credit unions experiencing elevated sensitivity and exposure to economic stressors should expect a commensurate increase in the NCUA’s supervisory activity. When scheduling examinations, the NCUA will continue to take into account any challenges a credit union is facing, such as operational challenges associated with responding to the COVID-19 pandemic or availability of key staff.

Updates to NCUA’s primary areas of supervisory focus are discussed below.³

Bank Secrecy Act Compliance/Anti-Money Laundering

NCUA Letter to Credit Unions, 20-CU-01, 2020 Supervisory Priorities, included Bank Secrecy Act (BSA)/Anti-Money Laundering (AML) as a supervisory priority. During every examination, the NCUA will continue to conduct BSA/AML reviews and will take appropriate action when necessary to ensure credit unions meet their regulatory obligations. Customer due diligence and beneficial ownership requirements that became effective May 11, 2018, will continue to be ongoing areas of emphasis.

The NCUA meets regularly with senior policymakers in the U.S. Department of the Treasury, the Financial Crimes Enforcement Network (FinCEN), and other federal banking agencies to improve the transparency, efficiency, and effectiveness of its regulation and supervision of BSA/AML. Key accomplishments by the interagency working group include:

• Joint statements addressing improved efficiency through shared resources and collaborative relationships (see NCUA Letter to Credit Unions, 18-CU-04, Sharing Bank Secrecy Act Resources, published October 2018);
• Innovative approaches to meet financial institution BSA/AML compliance obligations (see NCUA press release, Agencies Issue Joint Statement to Encourage Innovative Approaches to BSA/AML Compliance, published December 2018);
• Risk-focused BSA/AML supervision (see the July 22, 2019 Joint Statement on Risk-Focused Bank Secrecy Act/Anti-Money Laundering Supervision); and
• Updates to initial sections of the FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual published April 15, 2020.

The NCUA will continue communicating with credit unions, engaging with law enforcement, and collaborating with the other banking regulators on several initiatives associated with this supervisory priority, including:

• Publishing additional updates to the FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual;
• Establishing interagency work-streams to define AML compliance program effectiveness;
• Updating the interagency statement on enforcement of BSA/AML requirements;
• Publishing guidance regarding politically exposed persons; and
• Offering clarification and suggestions to improve Suspicious Activity Report (SAR) and Currency Transaction Report (CTR) filings.

The NCUA will also continue focusing on proper filing of SARs and CTRs, as well as reviews of bi-weekly 314(a) information requests from FinCEN. Law enforcement, intelligence, and counterterrorism officials depend on prompt reporting of any 314(a) matches and the vital information provided through timely and informative SARs and CTRs. Officials use this information regularly to identify and thwart illicit and terrorist financing activities, and to prosecute and convict guilty parties. Credit union efforts in this area help fight crime and keep America safe.

For additional resources, visit the NCUA’s Bank Secrecy Act Resources webpage.

Coronavirus Aid, Relief and Economic Security Act

President Trump signed the Coronavirus Aid, Relief and Economic Security Act (CARES Act) into law on March 27, 2020. The NCUA has added the CARES Act as a supervisory priority to reflect the importance of the provisions outlined in the Act. NCUA examiners will review credit unions’ good faith efforts to comply with the CARES Act and will take appropriate action, when necessary, to ensure credit unions meet their obligations under the new law.

Multiple CARES Act provisions directly affect credit unions, including those that:

• Provide greater access to liquidity, and improve the general financial stability of member credit unions through changes to the Central Liquidity Facility;
• Suspend the requirement to categorize certain loan modifications related to the COVID-19 pandemic as troubled debt restructurings (TDRs);⁴
• Authorize the Small Business Administration to create the Paycheck Protection Program, a loan guarantee program to assist eligible businesses;
• Change requirements for reporting loan modifications related to the COVID-19 pandemic to the credit reporting agencies;
• Prohibit foreclosures on all single family, federally backed mortgage loans between March 18, 2020 and May 17, 2020. Fannie Mae, Freddie Mac, FHA, VA and USDA subsequently extended the prohibition to June 30, 2020. The foreclosure moratorium expiration for mortgages purchased by Fannie Mae and Freddie Mac currently extends until August 31, 2020; 
• Provide up to a 360-day forbearance for borrowers with a single-family, federally backed mortgage loan that experience a financial hardship related to the COVID-19 pandemic; and
• Provide up to a 90-day forbearance for borrowers with a multifamily, federally backed mortgage loan that experience a financial hardship related to the COVID-19 pandemic.

For more information, see NCUA Letter to Credit Unions, 20-CU-07, Summary of the Coronavirus Aid, Relief, and Economic Security (CARES) Act.

Consumer Financial Protection

The COVID-19 pandemic continues to effect consumers and could result in increased consumer compliance risk in certain areas; consumer financial protection, therefore, remains an NCUA supervisory priority. The NCUA will continue to examine for compliance with applicable consumer financial protection regulations during every examination as established in the January 2020 Letter to Credit Unions, 20-CU-01, 2020 Supervisory Priorities, which included:

• Electronic Fund Transfer Act (Regulation E). Examiners will evaluate electronic fund transfer policies and procedures and review initial account disclosures as well as Regulation E’s error resolution procedures for when consumers assert an error.
• Fair Credit Reporting Act. Examiners will review credit reporting policies and procedures and the accuracy of reporting to credit bureaus, particularly the date of first delinquency.
• Gramm-Leach-Bliley (Privacy Act). Examiners will continue to evaluate credit union protection of non-public personal information about consumers.
• Small dollar lending (including payday alternative loans). Examiners will test for compliance with the NCUA Payday Alternative Lending rules and interest rate cap. Examiners will determine whether a credit union’s short-term, small-dollar loan programs that are not NCUA Payday Alternative Lending comply with regulatory requirements.
• Truth in Lending Act (Regulation Z). Examiners will evaluate credit union practices concerning annual percentage rates and late charges. This includes evaluating whether finance charges and annual percentage rates are accurately disclosed and late fees are levied appropriately.
• Military Lending Act (MLA) and Servicemembers Civil Relief Act (SCRA). The MLA and SCRA have been supervisory priorities for the NCUA since 2017. For credit unions that have not received a recent review, examiners will review credit union compliance with the MLA and SCRA.

The NCUA’s consumer compliance reviews will now also emphasize review of the following regulatory changes enacted since the start of the COVID-19 pandemic:

• Electronic Fund Transfer Act (Regulation E). Examiners will evaluate credit union practices concerning the Regulation E, Remittance Transfer Rule changes to the safe harbor threshold and disclosures of rates and costs associated with remittance transfers.
• Truth in Lending Act (Regulation Z). Examiners will also evaluate credit union practices concerning the changes made in response to the COVID-19 pandemic to the Truth in Lending-Real Estate Settlement Procedures Act (TRID) rule and Regulation Z Rescission rules that permit members to waive the waiting periods under both rules.

The scope of each examination’s consumer compliance review is largely risk-focused; based on a credit union’s compliance records, products and services provided, regulatory changes, and other emerging concerns. For additional consumer compliance tools and resources, visit the NCUA’s Consumer Compliance Regulatory Resources website.

Credit Risk Management and Allowance for Loan and Lease Losses

The NCUA’s January 2020 Letter to Credit Unions, 20-CU-01, 2020 Supervisory Priorities, prioritized review of a credit union’s loan underwriting standards and procedures, and exposure to elevated concentration risks as outlined in NCUA Letter to Credit Unions, 10-CU-03, Concentration Risk. In response to the economic impact of the COVID-19 pandemic and subsequent regulatory and statutory changes, the NCUA is shifting its emphasis to reviewing actions taken by credit unions to assist borrowers facing financial hardship. The NCUA will also review the adequacy of loan and lease losses (ALLL) accounts to address the pro-cyclical effects of economic downturns.

NCUA examiners will review credit union policies and the use of loan workout strategies, risk management practices, and new strategies implemented to assist borrowers impacted by the COVID-19 pandemic, including new programs authorized through the CARES Act. In particular, examiners will evaluate a credit union’s controls, reporting, and tracking of these programs. Examiners will also ensure credit unions have evaluated the impact of COVID-19 pandemic decisions on their capital position and financial stability.

In addition, credit unions’ risk-monitoring practices should be commensurate with the level of complexity and nature of their lending activities, provide for safe and sound lending practices, and ensure compliance with consumer protections and regulatory reporting requirements.

Further, due to the recent developments in economic conditions and the Financial Accounting Standards Board’s (FASB) decision to delay its requirement to comply with the current expected credit losses (CECL) standard until January 2023, NCUA examiners will not be assessing credit unions’ efforts to transition to the CECL standard until further notice. The NCUA encourages credit unions to continue to assess their needs and evaluate methodologies for the eventual implementation of the CECL standard.

Credit unions must still maintain an ALLL account in accordance with FASB Accounting Standards Codification (ASC) Subtopic 450-20 (loss contingencies) and/or ASC 310-10 (loan impairment). NCUA examiners will be evaluating the adequacy of credit unions’ ALLL accounts by reviewing:

• ALLL policies and procedures;
• Documentation of an ALLL reserving methodology, including modeling assumptions;
• Adherence to generally accepted accounting principles; and
• Independent reviews of credit union reserving methodology and documentation practices by the Supervisory Committee or by an internal or external auditor.

For more information, see:

• Interagency Statement on Loan Modifications and Reporting for Financial Institutions Working with Customers Affected by the Coronavirus (revised);
• NCUA Letter to Credit Unions, 20-CU-13, Working with Borrowers Affected by the COVID-19 Pandemic;
• The Credit Union Operations section on the NCUA’s Frequently Asked Questions for Federally Insured Credit Unions;
• NCUA Letter to Credit Unions, 02-CU-09, Allowance for Loan and Lease Losses; and
• NCUA Accounting Bulletin, 06-01, Interagency Advisory Addressing the ALLL Key Concepts and Requirements.

Information Systems and Assurance (Cybersecurity)

The NCUA’s January 2020 Letter to Credit Unions, 20-CU-01, 2020 Supervisory Priorities, included reviews of credit union information systems and assurance programs as a supervisory priority. Emerging cyber-attacks have become a persistent threat to the financial sector, and the likelihood of these threats adversely affecting credit unions and consumers has increased as a result of:

• Advances in financial technology;
• An increase in a remote workforce; and
• Increased use of mobile technology for financial transactions.

The NCUA has transitioned its priority from performing Automated Cybersecurity Examination Tool (ACET) cybersecurity maturity assessments, to evaluating critical security controls. The NCUA is also piloting an Information Technology Risk Examination solution for Credit Unions (InTREx-CU). InTREx-CU harmonizes the IT and Cybersecurity examination procedures shared by the Federal Deposit Insurance Corporation, the Federal Reserve System, and some state financial regulators to ensure consistent approaches are applied to community financial institutions. The InTREx-CU will be deployed to identify gaps in security safeguards, allowing examiners and credit unions to identify and remediate potential high-risk areas through the identification of critical information security program deficiencies as represented by an array of critical security controls and practices.

The NCUA has also published information for credit unions on the increased cybersecurity threats resulting from the COVID-19 pandemic and additional resources for protecting their members. For more information, visit the NCUA’s Cybersecurity Resources website and the Cybersecurity, Frauds, and Scams section on the NCUA’s Frequently Asked Questions for Federally Insured Credit Unions.

LIBOR Transition Planning

In a March 23, 2020, statement, the United Kingdom’s Financial Conduct Authority maintained its central assumption that firms cannot rely on LIBOR being published after the end of 2021.⁵ This should remain the target date for all credit unions to meet.

Credit unions offer, own, and are counterparties to LIBOR-based products and contracts, including loans, investments, derivatives, deposits, and borrowings. These may be subject to increased legal, financial, and operational risks once the reference rate is no longer available. On July 1, 2020, the FFIEC issued a Joint Statement on Managing the LIBOR Transition that highlights the risks that will result from the transition away from LIBOR and encourages supervised institutions to continue their efforts to transition to alternative reference rates.

Planning for the LIBOR transition is an important operational and safety and soundness consideration for credit unions with material exposures. Examiners will continue assessing credit unions’ exposure and planning related to a transition away from LIBOR. For credit unions with exposure to LIBOR, examiners will continue to conduct reviews using the NCUA’s LIBOR Assessment Workbook.

Liquidity Risk

The NCUA’s January 2020 Letter to Credit Unions, 20-CU-01, 2020 Supervisory Priorities, included assessments of liquidity risk management as a supervisory priority, noting that on average, credit union balance sheets generally exhibit lower levels of on-balance sheet liquidity due to strong loan growth. At that time, the NCUA was focusing liquidity reviews to address the following, in credit unions with low-levels of on-balance sheet liquidity:

• The potential effects of changing interest rates on the market value of assets and borrowing capacity;
• Scenario analysis for liquidity risk modeling, including possible member share migrations (for example, shifts from core deposits into more rate-sensitive accounts). Also, scenario analysis for changes in cash flow projections for an appropriate range of relevant factors (for example, changing prepayment speeds); and
• The appropriateness of contingency funding plans to address any potential liquidity shortfalls.

The economic impact of the COVID-19 pandemic may result in additional stress on credit union balance sheets, potentially requiring robust liquidity management over the course of 2020 and into 2021. As a result, examiners will continue to review liquidity risk management and planning in all credit unions, and will place emphasis on:

• The effects of loan payment forbearance, loan delinquencies, projected credit losses and loan modifications on liquidity and cash flow forecasting;
• Scenario analysis for changes in cash flow projections for an appropriate range of relevant factors (for example, changing prepayment speeds);
• Scenario analysis for liquidity risk modeling, including changes in share compositions and volumes;
• The potential effects of low interest rates and the decline of credit quality on the market value of assets, funding costs and borrowing capacity; and
• The adequacy of contingency funding plans to address any potential liquidity shortfalls.

For more information, and to access resources and guidance on liquidity risk, see the NCUA’s Examiner's Guide.

Serving Hemp-Related Businesses

In June 2020, the NCUA issued Letter to Credit Unions, 20-CU-19, Additional Guidance Regarding Servicing Hemp-Related Businesses, to provide information to institutions that are serving, or considering serving, legal hemp-related businesses. Such businesses may be affected by the COVID-19 pandemic. The letter outlines responses and guidance relating to some frequently asked questions. Additionally, FinCEN issued guidance on June 29, 2020, to address questions related to BSA/AML regulatory requirements for hemp-related business customers.

NCUA examiners will continue to collect data through the examination process concerning the types of services credit unions provide to hemp-related businesses.

Modernization Updates

NCUA Connect and MERIT

In September 2019, the NCUA began piloting a new user portal (NCUA Connect) and a new examination tool, the Modern Examination and Risk Identification Tool (MERIT). NCUA Connect is a secure, common entry point for authorized users to access NCUA applications. Following challenges related to the COVID-19 pandemic, the NCUA has delayed the rollout, training and launch of these applications to all examination staff until the second half of 2021. However, the agency will continue to use MERIT in 2020 and 2021 in both a pilot and limited-release capacity. Additional information about these applications is available on the NCUA website.

The NCUA remains committed to incorporating efficiencies into our supervision program to address the effects of the COVID-19 pandemic on credit unions and their members. We will continue to provide guidance as the economic impact of the pandemic evolves.

If you have any questions about the updates to the NCUA’s supervisory priorities described in this letter, please contact your NCUA regional office.