Credit Union Exam Solutions Presents With Flying Colors

Microphone Array (Intelr Smart Sound Technology for Digital Microphones):
Hey everyone, this is Mark Treichel with

another episode of With Flying Colors.

This is part two of me chatting with
Steve Farr and Todd Miller of my team.

Last week we tackled half
of the priority letter.

This week we tackle the other half, which
includes consumer financial protection,

Bank Secrecy Act, cybersecurity,
support for small credit unions, and

minority depository institutions.

And stick around to the end where we talk
about the timeliness or lack thereof of

examination reports, an issue that Vice
Chairman Kyle Hauptmann of the NCUA Board

talked about at the January board meeting.

We have some thoughts relative to that
and the thoughts on the importance of

communication during the exam process.

All right, here we go.

First up will be Consumer Financial
Protection and part two of NCUA's

Supervisory Priority Letter.

Mark Treichel: Next up on NC ways
list is consumer financial protection

number three, which was number six.

Number six in 2023 and number
seven in 2022, so it keeps

moving up on the priority list.

Consumer financial protection.

What are your thoughts relative
to what NCOA has said here in

its supervisory priority plan?

Steve Farrar: I think you can look at
NCUA's budget and see right there what the

priority on that is, because the resources
that are going to be put into that let's

see the proposed 2024 budget includes 13
additional regional consumer compliance

specialists and an increase in examination
time for consumer financial protection.

11 examiners to increase the
agency's review of financial

protection and fair lending laws.

Regulations, especially at institutions
with greater consumer impact or

indications of potential violation.

So it's really upfront resources
are going to be put into there.

Now, as you as credit unions,
it's those types of exams

start taking up your resources.

But you need to make sure that your shot
saw is sharpened on that because the it's

even starting at the top and that the
administration is thinking to tap what

they call tamp down junk fees and that's
why they've come out with a kind of a

proposal to do something about NSF fees
on against the really large institutions.

So that focus starts very high
and is shared by the board.

Mark Treichel: Very well said.

Very well said.

Todd, your thoughts on it?

Todd Miller: They told us for
a couple of years that this

is the direction we're going.

The junk fees were mentioned very
early on in the Biden administration.

Was it the year before last where NCUA
was starting to gather up survey data?

On what people were doing with their
overdraft programs that kind of

tells you they were looking at doing
something along the lines of this,

when they say, okay, we're going to
start gathering up survey data on it.

They never really said what they did
with that survey data they gathered.

But, I think we're
starting to see that here.

There's going to be a focus
on, those overdraft programs.

I don't necessarily see
this as a bad thing.

It's probably a good thing.

Some of this consumer protection
stuff the credit and political

organizations that can fight with NCUA
about how large that budget becomes.

Because it is the credit union's money
and at the end of the day, the more credit

unions do to make sure they're handling
things properly, the greater chance you

have of NCUA dialing that budget back.

So.

It's back to doing the right thing
and paying attention to your own

and we've seen it in clients where
they're finding things, especially

within direct loan programs or that
third party vendors getting an A.

P.

R.

wrong or something.

And so they're looking at that.

Especially these third party relationships
where you have a third party that's

filling out all these disclosures for
you, credit unions really pay attention

to that and make sure you have good
quality control on that because we

definitely see examiners looking at.

That whole fair lending and disclosure
piece with third parties, especially

we've seen it in the last year.

And so this is just a
continuation of that.

Yeah,

Mark Treichel: very, very much so.

And I'll be doing a separate
podcast with Joe Goldberg on

consumer financial protection,
another one of our team members.

And I've got another.

Another company that does
some of this that I'm going

to be doing a podcast on soon.

But, yeah, the budget when
you put money on something,

you can see the numbers go up.

That is a telltale sign.

And it's been very clear in Chairman
Harper statements that this is

the direction he wants to go.

He even said.

In the January board meeting, which I
referenced in a previous podcast, that

he wants to put consumer protection on
equal footing with safety and soundness.

Now, that's an attention grabbing
statement, equal footing.

If the budget was equal, there'd
be rioting in the streets.

Because the amount of the budget would
essentially almost have to double because

NCUA's focus on that and money spent on
that when you do, 24 fare lending exams,

and then you want to increase it to 30,
and then you want to increase it to 60,

and you compare that to the thousands of
safety and soundness type exams they do.

Equal footing is a lofty goal, but it
also puts it up in the bright lights.

He's making a state of a political
statement when he makes that

statement that, hey, this isn't
going away while I'm chairman, we're

going to keep putting more into it.

And when you look at what they
put into the budget, when It was

two Republicans that voted on
the budget with one Democrat.

And since that point in time, Rodney
Hood is gone and Tanya Otsuka has joined.

And at her first board meeting,
she talks about redlining and

the issues that are out there.

And they, they didn't mention Navy
federal credit union, but they

alluded to Navy federal credit
union because Navy had a very bad.

Story in CNN, which triggered the
banking committees, both sides, the Dems

and the Republicans to write to CFPB
saying, Hey, we want you to look at this.

And, oh, by the way, Tanya Otsuka
came from Sherrod Brown staff

at the banking committee and was
there when all that was going on.

And in her 1st public statement,
she says, I'm going to be watching

consumer compliance, and it's
going to be 1 of my priorities.

And then link it back.

Like you guys said to the Biden
administration appointed by

side to the banking committee.

Dot your I's, cross your T's, spend a
little bit more money on this credit

unions because the emphasis will go up.

So 2025, I guess where I was going,
2025 budget will be the first one with

two Democrats in charge in 10 years.

And you can expect to see more growth
in that arena based on what they find.

This year.

All right, so we've hit credit risk,
liquidity risk, consumer financial

protection, and interest rate risk.

Number four on the list, and this
is always present, is information

security or cyber security risk.

Which was number five in
2023, and it was number two.

It rose all the way to number two in 2022.

So here we sit with it in fourth place.

But this is one of those I call perpetual.

There's occasional priorities like
fraud there's and there's perpetual

priorities like cyber security.

And I know both of you had backgrounds
in this way back, but it's not you're,

it's not your niche right now, but what
are your thoughts relative to cyber

security information security guys?

Steve Farrar: Once again, you can look
at the comments in the budget and from

the budget comments, and they pointed out
that has 30 regional information security

specialist for exams and supervision.

So the resources are there for to
even be helpful in this process, which

is what we really hope for hope for
there and that they will become a

resource to you as problems come up.

But it's definitely an operational risk.

Geopolitical events continue to increase
the likelihood of cyber attacks.

The industry's software infrastructure
remains somewhat vulnerable

to cyber attacks, including
ransomware attacks and threats

from third party service providers.

So the risk is real.

The expense of fixing something
when it goes wrong is, is very

real and can have material impact.

And it seems like from this.

The recent stuff in there that
this requirement for these timely

notifications and identification
and notifying is a big part of

Todd Miller: this letter.

The notification is interesting because
we just had a client You know, they got

wrote up for not notifying the agency
of an ATM skimming event, because ATM

and CUA determined that was an event
where members information was stolen.

So, while I haven't went back and
read the reg obviously they're

putting a very broad interpretation
on events that require notification.

So credit unions might dig into that.

It could almost become a full
time job for a large credit union.

The other thing that out there is the
whole artificial intelligence, and

while that can become a very powerful
tool for credit unions to save expenses

in the future, it's also wide open
three barn doors for something that

could create opportunities for fraud
and phishing tax and everything else.

Mark's little temporary podcast where he
used AI to create it with his own voice.

So just tell you how vulnerable
institutions are to that

technology in the future.

It's going to be pretty significant.

Yeah,

Mark Treichel: and Todd, you're referring
to a short podcast I did saying this is

not Mark Treichel, this voice is created
by AI, and it sounds like me, a little

bit more monotone than normal, but it
sounds like me, and you guys and my

wife could tell that it's not me, but if
you're hearing me for the first time, or

you haven't heard me in a while, you say
that kind of sounds like Mark, and there

are other AI tools out there that that
are, it's only going to get harder and

harder in that arena and there's the costs
associated with this for credit union.

So you've got the consumer
compliance costs going up.

You've got costs in this, that you
got to dot your I's and press your T.

And oh, by the way, the fence painted you
into a corner based on your balance sheet

and and your NEV is hurting a little bit,
but we're not going to count your income.

We're not going to let you
consider income simulation.

It's a challenging time right now to be.

A CEO to be a board member
to be a credit union.

But Todd, as you've said,
they're weathering the storm real

well, which says an awful lot.

Well guys, let's see.

Next up bank secrecy act.

Anything relative to that?

Again, this is a perpetual it's there.

It's the safety of the country is
terrorism, et cetera, et cetera.

But any thoughts on bank secrecy
act being here on the priority

Todd Miller: letter?

It's always going to be there.

And we mentioned AI and
some of these new frauds.

They just create your whole
challenge for Bank Secrecy Act.

It just got bigger.

I have not really paid attention
to, what kind of numbers of SAR

reports get filed with FinCenter,
even in an individual credit union.

But this almost has to be growing.

And You see some of the fraud and
suspicious activity stuff that

always goes up when people have
less money and are challenged and

they're being challenged right now.

And once again, we have a fact where
inflation is faster than income growth

and for certain segments of society.

It's creating problems for them.

And that creates more incidences
of fraud for our credit union.

So I'm just another sideline of all
the other stuff that's going on with

liquidity and interest rate risk.

That puts more pressure on
fraudulent activity too.

The BSA stuff just has
to get better and better.

And, the challenges for credit unions
is, they all use software to manage this.

And, the false positives, it
just takes a lot of time and

money to keep up with this.

It's not fun stuff, but it's hugely
important and requires a lot of

resources of our institutions.

And like you said, it's on here
every year, and I think it will

continue to be on here every year.

It's never going away.

That's right.

The examiners are going to continue to
look at it, and it seems like they dig

into it a little bit deeper all the time.

Yeah, and

Steve Farrar: once again, the budget
points out resources going in their

proposed 2024 budget supports the 2nd
phase in this effort on BSA by adding 27

new regional examination staff, including
specialists and supervisory positions.

These special, so the
resources are going in there.

Some of the other comments I've read
from other regulators they're concerned

about how nested some of these 3rd party
That you end up working with can be, and

then you end up actually responsible for
something that's way down the line and a

little bit difficult for you to identify,
but you're still responsible for it.

So that certainly is always an issue
suspicious activity report data

trends reflected significant increase
in SAR filings related to fraud.

The numbers are up, but the
focus has been increased too.

And like Todd says.

When you have people that are in need of
the need is there for funds and there's

no other way that they see to get it
and the opportunity they think is there.

They're going to try and
take advantage of it.

Yeah, that's

Mark Treichel: the part of
the fraud triangle, right?

The opportunity and the need and I
can't remember the 3rd leg of that

stool is, but all great points.

So last on the letter, support
for small credit unions and

minority depository institutions.

I know that, when we started
back in the day, there were

what, 15, 16, 000 credit unions.

Probably they're down to about 4800 now.

So two thirds of those charters are gone.

Most of them small.

Any thoughts relative to the reference
here to small credit unions and

minority depository institutions?

Todd Miller: NCOA puts resources to it.

I think they've got
several events laid out.

I read something the other day, the
biggest piece of this, and it might

have been something Todd Harper
said, a lot of this is succession

planning, these small credit unions.

They have to find their own unique
niches, and it takes unique people to

position them to operate in those niches.

And, in the general economy,
everything's getting more expensive.

It's getting more challenging
for small credit unions.

Probably our definition of what a
small credit union is needs to change

and get that asset level up higher.

As the Director of Special Actions and
even when Steve and I were problem case

officers, you spend a lot of time in these
smaller cruddies trying to preserve them.

Oftentimes you can't.

And like I said, you get that key
person that retires and leaves,

and a lot of times the smaller
cruddies tend to fall apart.

It's always going to be
a continuous challenge.

The industry points to these
small credit unions as a

reason for their tax exemption.

It's just gonna, all the challenges
large credit unions face, the small

credit unions face them squared.

Yep,

Mark Treichel: times 10.

Yep, exactly.

Steve, any thoughts?

Steve Farrar: No, I think Todd summed

Todd Miller: it up for

Mark Treichel: really well.

Okay.

Very good.

And Todd, you referenced succession
planning and there is a letter

to credit unions out there.

There was a proposed rule that came out
early on and Chairman Harper's reign

as chair didn't have a 2nd vote for it.

Because the other two Republicans felt it
should be dealt with in a letter format.

And now that he has a second vote, one
of my other predictions is first half

of 2024, there will, that proposed rule
will be made finalized on succession

planning, but it's really creates some
principles that credit unions should

probably already be doing and that
are already out there in the letter.

And by the way, it only applies to federal
credit unions, but that's a prediction of.

Of a new theoretically regulatory burden
that I think will be out there, but I

think, well, I, I wouldn't regulate it.

I think the letter's okay.

They're going to formalize
it into a regulation is my

prediction relative to that.

All right this has been a great a
great discussion on all these topics.

Any final thoughts here on the
letter or anything else before

we, we wrap up this episode.

Todd Miller: Kind of one thing and it's
actually on some of Steve's notes and this

is hold the timeliness of exam reports and
something I see that kind of bothered me

a little bit is we'll see a credit union.

They'll have an effective date.

They don't get an exam for
6 months, and then they get.

30 days to correct a really large problem.

And it makes you wonder, it's hard for
boards to determine, what's the real

sense of urgency here when it takes you
six months to talk to us about it, but

then you want us to fix it in 30 days.

There needs to be some, I, I can't
speak to you inside of NCUA why all of

a sudden it's taken five, six months to
get exam reports issued to some of these

credit unions, but we're seeing that and
some of the things that they're asking

credit unions to do are important, and
it hurts the industry when you don't get

it to them timely and get them working
on it as well, and we're just seeing

that Amongst the people that hire us
anyway, it just seems like it's taken

longer and longer for them to get exam.

It's almost where they're in and
doing the starting a follow up before

they even get the first report.

Very

Mark Treichel: well said.

And, at the last NCWA board meeting at
the annual performance plan, Kyle Houtman

highlighted the fact that the exam survey,
talk about the exam survey being blind.

And that they have a goal
of achieving certain things.

And part of that goal is that they're
going to 90 percent of the time.

Start and complete their exams on time.

So what does that tell you?

They needed to establish a goal
to get to 90%, meaning they're

somewhere less than 90 percent
either on starting or completing.

And we've seen both right?

I think they're.

quite a ways from 90 percent if
our sample is anything close to

normal, because it's time after time.

And actually, Kyle Huffman said something.

Board member Huffman said something
to the effect that we are constantly

being told by credit unions.

That you haven't given me my
report and you're already coming

back in and that's just not right.

And part of it may be the secondary
review process, which was much needed.

It was into it was the only agency
that didn't have a higher level

and maybe with the pandemic things
getting completed took longer.

But it's clear it's good.

That's probably my favorite thing in
the annual performance report, because,

as they've all said, what gets measured
gets done and they're measuring it now

and they're paying attention to it now.

But think about back in the
days, when we were KCL, those

are directors of special actions.

Code four, code five.

You had to have an exam within 120
days and it had to be uploaded.

Period.

Period.

No exceptions.

Period.

Code three, six months.

And then they, they stretched the exam
process and they went from end date to end

date to measuring it by, start date to end
date, which gave them some flexibility.

And it's just got, in my opinion,
muddled and it wasn't being measured

and other things were happening.

And it's taught them a
little bit by surprise.

So I'm thrilled that they got it in there.

But just had a conversation
before we recorded this.

When got ready, you can just
have their joint conference.

When do you think we'll get?

Do you think we'll get our report?

By X.

And I said, well, you should, but based
on what I'm seeing, you might wanna a add

at least 30 and maybe 60 days to that.

And, and like you said, Todd,
and then, oh, by the way, we'll

give it to you six months later.

And we've, we, when we told you you
needed to do it, it was two months ago,

it took us so long, we'll give you to
the middle of next month to get it done.

Todd Miller: That just shouldn't fly.

I wonder if some of this is merit
because the whole time I was a

supervisor there was always a monthly
report on exams outstanding and you

know how many days it had been from
when they start to when they finished.

We always had a number to where you
wanted to limit that time outstanding.

That used to be part of the monthly
report package Supervisors got and

RDS used to pay attention to it.

Mark Treichel: They're
paying attention to it.

They're paying attention to it now.

But you're right, somewhere along the way.

And as I've said in other,
podcasts, if everything's a

priority, nothing's a priority when
you're trying to do everything.

Some of the back to basics, we
talked about getting back to basics.

Completion of the exam report is about
as basic as you can get, and I'm glad

to see they're highlighting it so.

Yeah,

Steve Farrar: always just 1
more thing and it always comes

down to that communications.

And what you can control if you're
a credit union is what you're doing.

You can't necessarily control
how the examiners get back to it.

But if you're doing all the right
efforts to make yourself available to

be engaged with the examiners, let them
know your door is open and you might

start having to document, here's, the
outreaches that we did and no and lack

of responses do what you can control
because you can't necessarily control what

comes back from your examiner But make
sure that your end is really well done.

Mark Treichel: That's a
great place to wrap guys.

As always this is my favorite podcast
of the year and I appreciate your time

and your thoughtful comments as it
relates to the letter and listeners,

I want to thank you for listening.

This is Mark Treichel signing off with
another episode of With Flying Colors.

I hope you'll listen again soon.