NCUA Issues Mid-Year Update to Credit Union Supervisory Priorities Amid COVID-19

2020 has been a year of transformation, challenge, and opportunity. Credit unions have seen their members suffer from the financial fall-out of COVID-19 and have had to adjust their own strategic priorities accordingly. Traditional business models of serving members face-to-face in branches had to change to remote support options, and in many cases, credit unions had to come up with more creative operations and financial products in order to meet members’ evolving circumstances.

COVID-19 also caused the National Credit Union Administration (NCUA) to reflect on the new and uncertain environment facing credit unions. They issued a rare mid-year update to their annual Supervisory Priorities in light of COVID-19 and the constantly changing environment. The revised priorities indicate the NCUA’s focus on how they will assess credit unions’ ability to withstand safety and security issues in a COVID-19 environment. Credit unions with assets of more than $50 million can expect ongoing NCUA examinations to concentrate on these revised Supervisory Priorities as well as new products and services and compliance with applicable laws and regulations.

The revised NCUA supervisory priorities are (and in no particular order):

• Bank Secrecy Act Compliance and Anti-Money Laundering
• CARES Act
• Consumer Financial Protection
• Credit Risk Management
• Cybersecurity
• LIBOR Transition Planning
• Liquidity Risk
• Serving Hemp-Related Businesses
• Modernization Updates to NCUA Connect and MERIT

Bank Secrecy Act Compliance

Money laundering is always a priority, so it’s no surprise that this continues to be a top area of emphasis. Credit unions can expect that the NCUA will conduct anti-money laundering reviews as part of every examination. Customer due diligence and beneficial ownership requirements as of May 18, 2018 will remain top of mind. Underscoring the importance of compliance in this area is that NCUA collaborates with the U.S. Treasury Department, the Financial Crimes Enforcement Network (FinCEN), and other federal banking agencies to oversee anti-money laundering initiatives.

Credit unions should remain diligent about promptly adhering to compliance requirements regarding SARs, CTRs, and reviews of bi-weekly 314(a) information requests from FinCEN even as new challenges occur as some compliance officers work remotely.

CARES Act

Because the CARES Act included so many regulatory changes and updates at such a fast pace, NCUA is including it as one of the top supervisory priorities to ensure that credit unions adhere to and comply with its provisions. NCUA will look for credit unions to make a good faith effort to comply with the CARES Act. Areas of the CARES Act that directly affect credit unions included expanded access to liquidity, changes to loan modification reporting and categorization requirements, foreclosure moratoriums, mortgage forbearance, and of course the Paycheck Protection Program.

We recommend keeping detailed records of all analysis and impact as a result of COVID and any changes that occurred.  Even if changes have been minimal, showing the effort your credit union has done is very important.

Consumer Financial Protection

This priority is essentially the same as what the NCUA released in January 2020 but remains high in importance due to consumers’ increased risk for financial fraud. Mid-year updates to consumer compliance reflect COVID-19 and include regulatory changes to the Electronic Fund Transfer Act (Regulation E) and the Truth in Lending Act (Regulation Z). Credit unions should be prepared for the NCUA to examine how they have amended their practices in order to remain compliant with these regulations.

Credit Risk Management

NCUA will examine any new credit union policies or strategies designed to help borrowers impacted by COVID-19. These include any programs credit unions now offer that have been authorized through the CARES Act. Credit union leaders need to be prepared for an examination of their controls, reporting, and tracking processes. Also in line with credit risk management, the NCUA will evaluate credit unions’ financial stability and capital position.

A bit of good news here though: NCUA is no longer assessing a credit union’s implementation of the current expected credit losses (CECL) standard until further notice.

Cybersecurity

Cybersecurity was a supervisory priority in January 2020 so its inclusion in the mid-year update was not a surprise. However, given the rise in remote working arrangements and the ways in which credit unions had to shift their operations, cybersecurity is an evolving concern. As a result of persistent cyber-attacks and financial threats in a remote environment, NCUA is shifting its priority from performing cybersecurity maturity assessments to evaluating critical security controls.

Of particular note here is a new NCUA service offering called Information Technology Risk Examination solution for Credit Unions, or InTREx-CU. This is a pilot program that hopes to bring together IT and Cybersecurity examination procedures from several collaborating agencies. Its purpose is to identify gaps in IT security and fix possible high-risk areas through early detection.

LIBOR Transition Planning

Recall the March 2020 statement from the UK that after December 31, 2021, LIBOR may not be published anymore. Credit unions need to prepare for increased legal, financial, and operational risks for LIBOR-based products. The goal is to transition away from these products to alternative reference rates. NCUA will continue to assess credit unions’ transition planning in this area in the months ahead.

Liquidity Risk

Countless consumers and businesses have been exposed to extreme financial stress due to COVID-19. While credit unions went into the pandemic in relatively healthy financial positions, the effect of loan delinquencies, forbearance, credit losses, and loan modifications have had an understandably adverse reaction on some credit unions’ balance sheets. To that end, credit unions should be prepared for NCUA examinations that assess their cash flow analysis and forecasting, liquidity position, liquidity risk modeling, possible side effects of low interest rates and poor credit quality, and contingency planning.

Serving Hemp-Related Businesses

Recognizing financial institutions’ role in legalized marijuana businesses, NCUA issued guidance in June 2020 to credit unions that are considering or currently are servicing legal hemp-related businesses. The FAQ document can be accessed here.

Modernization Updates

Last but not least, NCUA’s mid-year Supervisory Priorities indicated a continued need to focus on a new user portal and examination tool. NCUA Connect and Modern Examination and Risk Identification Tool (MERIT), respectively, have been delayed due to COVID-19. MERIT will continue on a pilot basis throughout 2020 and 2021 and NCUA Connect will be implemented in the second half of 2021.

Conclusion

NCUA’s mid-year Supervisory Priorities update underscores the need for credit unions to remain vigilant and proactive in complying with changing rules and regulations. In these unprecedented times, it is important to continue to ensure that borrowers are up to date on the changing regulations and disclosures and that employees understand new policies, rules, and service offerings in the context of NCUA examination priorities.

Credit union leaders that have questions about implementing or overseeing any piece of regulatory or legal change can reach out to JJ Edmunds, CPA, CIA, CISA, MSA, Audit and Assurance Manager on PBMares’ Credit Union Team.