NATIONAL CREDIT UNION ADMINISTRATION Priorities for 2016

Supervisory Priorities for 2016

NATIONAL CREDIT UNION ADMINISTRATION
1775 Duke Street, Alexandria, VA 22314

DATE:	January 2016	LETTER No.:	16-CU-01
TO:	Federally Insured Credit Unions
SUBJ:	Supervisory Priorities for 2016

Page Content

Dear Board of Directors and Chief Executive Officer:

     This letter is intended to assist you in preparing for your next NCUA examination.  NCUA field staff will continue to use the streamlined small credit union exam program procedures for credit unions with assets up to $50 million and CAMEL ratings of 1, 2, or 3.  For all other credit unions, field staff will conduct risk-focused examinations, which concentrate on the areas of highest risk, new products and services, and compliance with federal regulations.

     Below are NCUA’s top areas of supervisory focus that are broadly applicable for credit unions in 2016.

Cybersecurity Assessment

     Cybersecurity threats continue to represent significant potential operational risks to financial institutions.  Cyberattacks are expected to increase in frequency and severity as worldwide interconnectedness grows and the capabilities to conduct cyberattacks become more sophisticated and easier for criminals or terrorists to obtain.  As in 2014 and 2015, NCUA will continue to carefully evaluate credit unions’ cybersecurity risk management.  

     In June 2015, NCUA released a Cybersecurity Assessment Tool jointly with the other member agencies of the Federal Financial Institutions Examination Council (FFIEC).  The tool provides a structured methodology for credit unions to manage information security and protect member information more effectively. 

The tool is designed to enhance cybersecurity oversight and management capabilities, and to identify any gaps in an institution’s risk-management practices.  Credit unions can use this tool to enhance their cybersecurity preparedness. 

     NCUA encourages all credit unions to use the FFIEC tool to manage cybersecurity risks.  NCUA also plans to begin incorporating the Cybersecurity Assessment Tool into our examination process in the second half of 2016.

     Throughout 2016, NCUA will continue to foster and facilitate sharing of best practices to strengthen credit unions’ existing cybersecurity programs.  For additional cybersecurity resources, please visit the Cybersecurity Resources Page on NCUA’s website.

Response Programs for Unauthorized Access to Member Information

     Incident response procedures are a key part of a credit union’s information security program.  In 2016 examinations, NCUA field staff will be reviewing credit unions’ incident response programs. 

     Appendix B to Part 748 of NCUA rules and regulations, Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice, outlines the minimum components of an incident response program that federally insured credit unions need to develop and implement.  An incident response program is needed to address unauthorized access to, or use of, member information that could result in substantial harm or inconvenience to a member. 

Bank Secrecy Act Compliance

NCUA remains vigilant in ensuring the credit union system is not used to launder money or finance criminal or terrorist activity.  All federally insured credit unions must perform certain recordkeeping and meet reporting requirements to detect this type of activity as required by the Bank Secrecy Act.  

     NCUA field staff are required to review credit unions’ compliance with the Bank Secrecy Act and to complete the related examination questionnaire at every examination.  In 2016, NCUA field staff will focus on credit unions’ relationships with money services businesses, also known as MSBs. 

     Credit unions can provide services to an MSB while meeting BSA requirements, but should be aware of the unique risk exposure MSBs can present and the corresponding need for commensurate expertise and monitoring systems.  In 2014, NCUA issued guidance to field staff and credit unions on Identifying and Mitigating Risks of Money Service Businesses.  The guidance describes the steps credit unions should take to mitigate any money-laundering risks posed by MSBs.

     If your credit union provides services to an MSB, field staff will verify that you meet the following minimum expectations established by NCUA and federal banking agencies:

• Perform customer identification program procedures;
• Ensure each MSB is registered with the Financial Crimes Enforcement Network (FinCEN) and is in compliance with state and local licensing requirements; and
• Conduct a BSA/anti-money laundering risk assessment to document the level of risk associated with each MSB account and determine whether greater due diligence is necessary.

For compliance information and additional resources, see the Bank Secrecy Act page on NCUA’s website.

Interest Rate Risk

     Interest rate risk (IRR) remains a key supervisory focus as interest rates have begun to rise.  Rising rates may prove challenging for those credit unions that hold high concentrations of long-term assets funded with short-term liabilities.

     NCUA is in the process of updating interest rate risk management supervisory guidance, which will be published in 2016.  As part of this effort, NCUA field staff will transition to the updated IRR examination procedures over the course of 2016.  The new procedures will improve the efficiency of reviews by focusing field staff resources on those credit unions with elevated levels of IRR and streamlining related exam procedures.

     Field staff will receive specialized training on evaluating IRR at the national exam program training in April 2016 and throughout the remainder of the year during regularly scheduled group meetings and other customary training venues.  Field staff will evaluate credit unions’ compliance with NCUA’s interest rate risk rule, which requires federally insured credit unions with more than $50 million in assets to develop and adopt a written policy on IRR management, and establish a program to identify, measure, monitor, and control IRR.  

Credit union officials should be prepared to provide NCUA field staff with documentation supporting the credit union’s ability to successfully manage their IRR through changing market conditions, including rising rate environments.

     For the IRR rule and guidance, see 12 CFR Part 741, Requirements for Insurance and Appendix B to Part 741, Guidance for an Interest Rate Risk Policy and an Effective Program.

TILA-RESPA Integrated Disclosure Rule

     Credit unions that have accepted applications for real estate loans on or after October 3, 2015 (except for home equity lines of credit, reverse mortgages, and commercial loans) are required to comply with the TILA-RESPA integrated disclosure rule, which the Consumer Financial Protection Bureau adopted to help consumers better understand mortgage transactions.¹ 

The CFPB rule requires loan originators to provide consumers with two disclosures: 

Loan Estimate Disclosure – Combines the Truth in Lending Act disclosure and the Good Faith Estimate.  The loan estimate disclosure must be delivered or placed in the mail no later than the third business day after receiving a consumer’s mortgage application. 

Closing Disclosure – Combines the final TILA disclosure and the HUD-1 Settlement Statement.  The closing disclosure must be provided to the consumer at least three business days before the consummation of a mortgage.

     The TILA-RESPA integrated disclosure rule also imposes record retention requirements and restricts mortgage originators from imposing certain fees, providing estimates, or requiring consumers to verify information before providing a loan estimate to a consumer.  Field staff will be reviewing credit unions’ compliance with the relevant provisions.

For additional information, please visit the Consumer Compliance Regulatory Resources page on NCUA’s website.

CUSO Reporting

     Regulatory requirements associated with NCUA’s CUSO rule became effective June 30, 2014.²  One of the primary changes to the rule requires all federally insured credit unions that invest in or lend to a CUSO to enter into a written agreement requiring the CUSO to submit annual reports directly to NCUA and the state supervisory authority, if applicable.

     CUSOs will start providing their annual reports through the CUSO Registry in 2016.³  Once the deadline for CUSOs to register with NCUA has passed, field staff will check to ensure any CUSO a credit union has loaned to or invested in has registered with NCUA.  

More information on the CUSO Registry is forthcoming in a separate Letter to Federally Insured Credit Unions.

Conclusion

     NCUA remains committed to protecting the safety and soundness of America’s federally insured credit unions and their more than 102 million members.  Our examiners worked successfully with thousands of credit unions in 2015 to significantly reduce losses to the National Credit Union Share Insurance Fund.

Signature SC

​Sincerely,

Debbie Matz
Chairman