2020 Supervisory Priorities

Dear Board of Directors and Chief Executive Officer:

This letter describes the NCUA’s supervisory priorities for 2020, and will help you prepare for your next NCUA examination. It also addresses the NCUA’s efforts to continue to modernize the examination program.

All qualifying credit unions will continue to be scheduled under the extended examination cycle.¹ Examiners will continue to use the streamlined Small Credit Union Exam Program procedures for most credit unions with assets under $50 million. For all other credit unions, examiners will conduct risk-focused examinations, which concentrate on areas of highest risk, new products and services, and compliance with applicable laws and regulations.

The NCUA remains committed to protecting America’s federally insured credit unions, and their more than 119 million members. I encourage you to review this letter and to contact your NCUA examiner or regional office if you have any questions.

SUPERVISORY PRIORITIES

The NCUA’s primary areas of supervisory focus for 2020 are discussed below.²

Bank Secrecy Act Compliance/Anti-Money Laundering

Bank Secrecy Act (BSA)/Anti-Money Laundering (AML) continues to be a priority. NCUA examiners conduct a BSA/AML review during every examination and take appropriate action, when necessary, to ensure credit unions meet their obligations.

The NCUA meets regularly with senior policy makers in the U.S. Department of the Treasury, the Financial Crimes Enforcement Network and the federal banking agencies to improve the transparency, efficiency, and effectiveness of our regulation and supervision of BSA/AML. Some key accomplishments to date include an October 2018 joint statement addressing improved efficiency through shared resources and collaborative relationships, a December 2018 joint statement encouraging depository institutions to explore innovative approaches to meet their BSA/AML compliance obligations, and a July 2019 joint statement on risk-focused BSA/AML supervision.

An ongoing area of emphasis for examinations will be the customer due diligence and beneficial ownership requirements that became effective May 11, 2018. The NCUA will continue to communicate with credit unions, engage with law enforcement, and collaborate with the other banking regulators on several initiatives, including:

• Updates to the FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual;
• Updates to enforcement guidelines;
• Issuing guidance regarding politically exposed persons; and
• Providing clarifications and ways to improve Suspicious Activity Report (SAR) and Currency Transaction Report (CTR) filings.

In addition, the NCUA will continue to focus on proper filing of SARs and CTRs. Filing timely and informative SARs and CTRs provides law enforcement, intelligence, and counter-terrorism officials with vital information. These officials regularly use this information to successfully identify and thwart illicit and terrorist activities, and to prosecute and convict the guilty parties. Credit union efforts in this area are helping to fight crime and keep America safe.

For additional resources, visit the NCUA’s Bank Secrecy Act Resources.

Consumer Financial Protection

Credit unions have a long history of strong member service. Consumer financial protection is a vital element of member service. Therefore, NCUA examines for compliance with applicable consumer financial protection regulations during every examination. The scope of each examination’s consumer compliance reviews are largely risk-focused, based on each credit union’s compliance record, products and services provided, and any new or emerging concerns.

In addition, each year the NCUA identifies several specific consumer financial protection regulations that are required to be reviewed at all examinations when applicable to the credit union. These regulations are rotated each year to ensure broad coverage over a multi-year period. The NCUA selects the specific priorities for a given calendar year by analyzing trends in violations identified through examinations, member complaints, recent changes to regulatory requirements, and time since a regulation was last required to be reviewed.

In 2020, NCUA examiners are required, at a minimum, to review compliance with the following consumer protection requirements:

• Electronic Fund Transfer Act (Regulation E). Examiners will evaluate Electronic Fund Transfer (EFT) policies and procedures and review initial account disclosures. Examiners will also review compliance with Regulation E’s error resolution procedures for when consumers assert an error.
• Fair Credit Reporting Act (FCRA). Examiners will review credit reporting policies and procedures. If applicable, examiners will also review the accuracy of reporting to credit bureaus, particularly the date of first delinquency.
• Gramm-Leach-Bliley (Privacy Act). Examiners will continue to assess compliance with Gramm-Leach-Bliley to evaluate credit union protection of non-public personal information about consumers.
• Small dollar lending (including Payday Alternative Lending). Examiners will test for compliance with NCUA Payday Alternative Lending (PALs) rules and interest rate cap. In addition, examiners will determine whether a credit union’s short-term, small-dollar loan programs that are not PALs comply with regulatory requirements.
• Truth in Lending Act (Regulation Z). Examiners will evaluate credit union practices concerning annual percentage rates and late charges. These reviews will assess how credit unions apply loan payments to principal, interest, fees and other charges, and whether the application is consistent with the written agreement and disclosures. Examiners will also review whether credit unions appropriately levy late fees. They will also test whether credit unions are accurately disclosing finance charges and annual percentage rates.
• Military Lending Act (MLA) and Servicemembers Civil Relief Act (SCRA). MLA and SCRA have been a supervisory priority since 2017 and will remain so for 2020. For credit unions that have not received a recent review, examiners will review credit union compliance with the MLA and SCRA.

For additional consumer compliance tools and resources, visit the NCUA’s ConsumerCompliance Regulatory Resources website.

Credit Risk

Reviewing the credit risk management of credit unions is a fundamental part of the supervisory process. In 2020, NCUA examiners will place emphasis on the review of the credit union’s loan underwriting standards and procedures. In particular, examiners will verify if credit unions properly analyzed the ability of borrowers to meet debt service requirements without undue reliance on the value of any collateral.

In addition, examiners will continue to review concentration risk exposure during each examination. In 2020, the NCUA is implementing enhanced examination procedures, including supervisor concurrence and additional quality controls, for credit unions with very high concentrations in specific loan types.³

For more information, see NCUA Letter to Credit Unions 10-CU-03, Concentration Risk.

Current Expected Credit Losses

Although the Financial Accounting Standards Board granted a one-year delay (to January 2023) for credit unions to comply with its new current expected credit losses (CECL) standard, examiners will continue to discuss with credit union management their plans to implement CECL.⁴

For more information, see the April 2019 Interagency Frequently Asked Questions on the New

Accounting Standard on Financial Instruments - Credit Losses.

Information Systems and Assurance (Cybersecurity)

Cyber-attacks continue to pose a threat to the financial system. Advances in technology and the increased use of mobile technology for financial transactions means more opportunity for cybersecurity threats.

In 2018, the NCUA began using the Automated Cybersecurity Examination Tool (ACET) to assess credit unions’ cybersecurity maturity.⁵ The NCUA collaborated with the Department of Homeland Security and the Idaho National Laboratory to create an updated client/server version of the ACET that is being fully deployed in 2020. Credit unions will be able to complete self- assessments through access to the new ACET on NCUA’s website in early 2020.

The NCUA began the cybersecurity maturity assessments for credit unions with assets of $1 billion or greater in 2018, followed by institutions with assets between $1 billion and

$250 million in 2019. In 2020, the NCUA will continue completing these assessments for credit unions with assets over $250 million, and begin completing assessments for credit unions with assets over $100 million.

The initial maturity assessment cycle will be completed in 2021. Starting in 2022, the agency will refresh the maturity assessments following the same asset size schedule discussed above, resulting in a refresh cycle of once every four years.

In addition to the ACET, the NCUA will be piloting new procedures in 2020 to evaluate critical security controls during examinations between maturity assessments. The critical security controls reviews will be scaled to the size and risk profile of the institution.

The NCUA will also be increasing stakeholder outreach in 2020 to provide education and promote awareness on cybersecurity issues. These outreach activities will promote collaboration and solicit industry feedback on the challenges and opportunities associated with cybersecurity.

For more information, visit the NCUA’s Cybersecurity Resources website.

LIBOR Cessation Planning

The United Kingdom’s Financial Conduct Authority has announced that it cannot guarantee LIBOR’s availability beyond the end of 2021. LIBOR is a reference rate commonly used in setting the interest rate for many adjustable- or variable-rate financial products.

Credit unions both offer and own, and are counterparties to, LIBOR-based products and contracts. Examples include loans, investments, derivatives, deposits, and borrowings. These may be subject to increased legal, financial, and operational risks once this reference rate is no longer available.

Planning for LIBOR cessation is an important operational and safety and soundness consideration for credit unions with material exposures. Credit unions need to proactively transition away from instruments using LIBOR as a reference rate.

Examiners will assess credit unions’ exposure and planning related to the discontinuance of LIBOR. The scope of the review will cover:

• Identification of all LIBOR-related transactions including both on- and off-balance sheet exposures (number of transactions and balance amounts); and
• Planning, governance, senior executive engagement, budgeting, accounting, and addressment of other impacts related to the transition and discontinuance of LIBOR.

Liquidity Risk

On average, credit union balance sheets continue to exhibit lower levels of on-balance-sheet liquidity due, in part, to strong loan growth trends. In addition, financial innovations and new market participants may increase competition for traditional, low-cost deposits. For 2020 examinations, examiners will review credit union liquidity management and planning. In particular, for credit unions with low levels of on-balance sheet liquidity, examiners will assess liquidity management by evaluating:

• The potential effects of changing interest rates on the market value of assets and borrowing capacity;
• Scenario analysis for liquidity risk modeling, including possible member share migrations (for example, shifts from core deposits into more rate-sensitive accounts). Also, scenario analysis for changes in cash flow projections for an appropriate range of relevant factors (for example, changing prepayment speeds); and
• The appropriateness of contingency funding plans to address any potential liquidity shortfalls.

Resources and guidance on liquidity risk can be found in the NCUA’s Examiner's Guide.

MODERNIZATION UPDATES

NCUA Connect

In 2019, the NCUA began piloting a new user portal, NCUA Connect. NCUA Connect is a secure, common entry point for authorized users to access NCUA applications. This year, NCUA Connect will be made available to all credit unions and state regulators.

MERIT

The NCUA has conducted a limited launch of the agency’s new examination platform, the Modern Examination and Risk Identification Tool (MERIT). MERIT will be released to all examination staff in the second half of 2020.

Unlike our legacy examination platform (AIRES), credit unions will also be users of MERIT and will have the ability to perform certain activities in the tool, such as:

• Transferring documents and files needed for the examination securely;
• Providing status updates and requesting due date changes on corrective actions; and
• Accessing completed examination reports securely.

For more information, see NCUA.gov, NCUA Connect & MERIT.

Other Modernization Initiatives

In addition, the NCUA’s Enterprise Solution Modernization program has several other initiatives underway to improve and modernize legacy agency systems, such as CUOnline (the Profile and Call Report). Modernization of the NCUA’s systems will improve the quality of the examination program and lead to less onsite presence overall.

For more information, see NCUA.gov, Examination Modernization Initiatives.

STATUTORY AND REGULATORY UPDATES

There have been recent changes to laws and regulations applicable to credit unions. The examination program has been updated to reflect these changes.

Commercial Real Estate Appraisal Rule

In July 2019, the NCUA Board approved a final rule amending Part 722 that increased the appraisal threshold for commercial real estate transactions from $250,000 to $1 million. Effective October 22, 2019, commercial real estate transactions below $1 million do not require appraisals conducted by certified appraisers; instead, credit unions may choose to conduct a written estimate of market value or obtain an appraisal by a state-licensed appraiser.

Commercial real estate transactions valued at $1 million and greater are still required to obtain appraisals conducted by certified appraisers. The final rule increases the standards for the qualifications and independence of individuals conducting written estimates of market value.

Private Flood Insurance Rule

In February 2019, the NCUA Board and the other banking agencies finalized the private flood insurance rule. The private flood insurance rule relies on two main provisions regarding credit union acceptance of flood insurance policies that are not issued by the National Flood Insurance Program (that is, from private providers).

Credit unions must accept certain flood insurance policies from private providers under Part 760. For other policies from private providers, credit unions have the option to accept the insurance if the policy meets certain criteria. For more information, see the NCUA Regulatory Alert, 19-RA-01, Flood Insurance Alternatives.

Public Unit and Nonmember Shares Rule

In October 2019, the NCUA Board approved a final rule amending Section 701.32 regarding public unit and nonmember shares. Effective January 29, 2020, federally insured credit unions generally can accept public unit and nonmember shares in an amount up to 50 percent of the credit union’s amount of paid-in and unimpaired capital and surplus, less any public unit or nonmember shares, or $3 million, whichever is greater.