Credit Union Exam Solutions Presents With Flying Colors

NCUA EXAM PRIORITIES
Mark: [00:00:00] Hello, I'm Mark Treichel and you are listening to With Flying Colors, the podcast where I interview subject matter experts to provide credit union leaders with tips on how you can achieve success with NCUA and pass your exam With Flying Colors. On today's episode, we're going to be discussing NCUA's examination priorities that were issued recently in a letter to credit unions.
NCUA does this every year in January, and it tells credit unions what direction NCUA is going for the exam program. I've got two great guests today that will be discussing this with me first. I'd like to introduce Todd Miller and second we'll be Steve Farr. Todd, if you could give everybody here a few words about your background at NCUA just in case they never interacted with you while you were there at NCUA.
Todd: Good morning, mark. And thank you. Thanks for having [00:01:00] me. I was with U for 31 years. The last 10 years, I was a director for special actions and the decade before that, I was a regional capital markets specialist and enjoyed my time with NCUA and going to enjoy spending some time with you here.
Mark: great. Todd and Steve far. Please also introduce yourself before we kick it off.
Steve: Yeah, good morning guys. Yeah, I like todos within CA over 30 years. Did the work through, up through the ranks from examiner to problem case officer. And then work the last 15 or so years in the central office, working on items like the reserves for the and writing policies, including the risk-based capital, which I spent a great deal of time on and that we get to discuss later today.
Yeah, look forward to this discussion.
Mark: Very good. And as I tell, when I have client calls, I mentioned that I know who the NCUA best and brightest are and that when they retire, I approached them and [00:02:00] asked them if they'd like to assist me with assisting credit unions. And I worked, I've known Todd and Steve for 30, 25 to 30 years.
Each of them, I work closely with them on different projects at different stages of my career. They're great resources for me, and they're great resources for credit unions as well. . Mark Twain once said that history may not repeat itself, but it certainly does rhyme.
And why do I say that? Three of the topics that are in the priorities letter have been repeated at least six years. Those are cybersecurity bank, secrecy act and consumer compliance also. Credit risk management of some sort or another has been repeated with different verbiage. So four of these 11 priorities show up every year.
There's a handful of them that have showing up for the first time and we will touch on that. So with that what we're going to do here is walk through each priority and see if Todd and Steve have [00:03:00] any flavor to add to the topic. And it's possible that with the length of the letter, that we may break this into two podcasts so that it doesn't get too long for the listener.
All right. So first up is credit risk management, which is listed first in NCUA priority. We're going to go through them in order of the letter. And if it's listed first it's because it's the most important in NCUA's eyes, they order it in this manner for that reason. So credit risk management either of you have any thoughts on the topic of credit risk.
Todd: We'll speak to this one, mark. I think it's interesting credit risk is always, probably going to be on this letter in some shape or form, just because it's the biggest risk on a credit unions balance sheet. Typically some things in the lighter that kind of stand out to me is, they mentioned they want appropriate practices for every loan program on the credit use balance sheet.
In prior years they [00:04:00] singled out concentrations. They've singled out commercial lending here. It's more we want to know about, they want credit unions to know about every aspect of every one of their loan programs. Think it's important that credit unions have. Good tools to assess how pride at risk is migrating in their portfolio, especially after the loan has been made.
They mentioned some COVID related issues in the letter. And when COVID came out and CYA sent the waddle letters, they were focused on credit unions, helping their members. At the same time, they want to know you did that was appropriate. Internal controls, who you've helped, how you help them.
It's been in the best interest of the member and the credit union. Now you haven't done that with. internal controls. But it's important for every party to know what's going on with the credit risk in their portfolio, to know how their members' profiles are changing, how collateral values might be changing.
So they can just assess is their [00:05:00] overall risk increasing or decreasing over time. And I think a lot of this will just tie back to capital, which they'll talk about later. And we can mention in some other topics is, it's all part of this whole thing. Do you have enough capital to offset the risks on your balance sheet?
Mark:
Very good Todd. And I'm going to highlight one thing you said it's listed first because it's a material part of your balance sheet?
Loans are the biggest part of the credit union portfolio. That is the main thing. That's how you best serve your members, but it's also the most material asset because it's the most material asset. It creates potentially the most risk for the insurance bond. Therefore, that explains why NCUA puts this first. So second in order here is information security or cybersecurity, any thoughts on information security, cybersecurity .
Todd: This is another one that's been on every supervisory priority letter for, I don't know, at least [00:06:00] the last five or six years. I think credit unions can expect it to see. It there for the next five or six years to it'll probably never drop off the list, just given what's going on in society, in our reliance on technology.
One of the things that I find interesting in a letter, as I mentioned, that they're piloting new exam procedures that has budget implications for the agency. Agency is really trying to create exam procedures that their everyday examiner can use to assess risk and credit unions. They're trying to avoid hiring even more information security officers, and there's a lot of them already.
But they're trying to get this down to where it's not a specialty where our regular examiners can assess this risk. So they're trying to turn the vocabulary and that whole process into something that the average examiner can understand. We'll see whether they're successful with that over time.
And then it will be interesting for credit unions to maybe give you some feedback on what these new exempt procedures look like. They do mention the asset maturity [00:07:00] assessment for credit unions that haven't done that for two or three years. It's maybe a good sell pass to just see where you're at on that whole maturity structure.
And how mature is your program, your risk management program, your security resiliency of your system. So that's always a good thing to go through yourself just to give yourself a heads up, but what might be coming when you do get an information system, officer are an examiner digging into your information security.
Mark: Very good information system, officer, a regional information system officer, if you will, or what NCUA likes to call with their acronyms is RISO R I S O they may be adding a few of those, which we might get to a little bit later. Also, I guess I'll highlight that in the letter, they have a link on several of these topics while the letter, if you printed it off, might be about six pages.
There are several links and in the category of cybersecurity, they do have a link to ensue. Excuse me, NCUA [00:08:00] is cyber security resource page, and also in the show notes for this podcast, I will have a link to the. Actual letter on NCUA's website next up the third topic and a topic showing up in the priority letters for the very first time.
So it's here for the first time and it's listed third. So that says that it's a priority, a high priority, and that is payment systems. Any thoughts on payment systems?
Todd: I think it's interesting to see this here for the first time. By some way of background over the last three, four years with NCUA, I retired and last year in 2021, but there's this been this ongoing debate. Does the agency need to have payments system specialists? And it's interesting that the payment system thing shows up here for the first time.
There's a lot going on with payment systems. There are so many payment platforms out there. There's apple [00:09:00] pay there's, PayPal's got their eye systems. There's Venmo where people are using to transfer money. It's interesting. My son bought a car last year and he had to pay for it over two days via Venmo, because you can only transfer 10,000 a day to one person over Venmo.
I didn't even know what it was til he told me about it. Then. All those systems require interaction with the creating systems and then strategic risk wise, people are starting to pay for and use cryptocurrencies and that kind of bypasses the financial system entirely. So there's strategic implications with it.
But within NCUA, there's always been payment expertise and specialists in the corporate program. They've always been there and now the ones program. But the haven't had this expertise in the natural person party, and I think there's a couple of things going on here. One, I think NCUA is probably trying to get its hands around.
How big is this payment systems world and what does their risk look like? And I think that's part of having this as a priority on here. [00:10:00] As I expect, they're going to be gathering a lot of data just to see this credit is even have a good risk assessment over their payment systems and all the different platforms that may be interacting with their system to their knowledge or without their knowledge, even in some cases.
So this is a new one. I think NCUA is trying to get their hands around it. There's practical risks related to it everyday and longterm there's strategic risks involving the whole industry when it comes to payment systems.
Mark: Todd all great thoughts. And you and I were on a client call, I believe yesterday. And we were talking about crypto. We were talking about payment systems. and some of the things you just said here, we discussed there and that triggered me. So this letter is one of my favorites, the supervisory priority letter, that NCUA issues, one of my other things.
I actually was deeply involved with is the staff budget, which comes out in October or November and is usually about a hundred pages, which talks about new [00:11:00] initiatives in the budget and how much they might cost. So yesterday I went to that document and it reminded me that the last time it's fully looked at the number of specialists they had in each category and what categories they had was in 2018.
And I had assigned that to a regional director, Keith Martin and one's director Scott Hunt. And we made a significant increase in the number of specialists that year. NCUA has recalibrated again, and they are adding several specialists into their budget. And one of those categories, which was not a specialty before is the regional electronic payments specialists or reps, R E P S.
And they indicate here in the. That they could add up to 11 of these across the country. So that's nearly four in each of the three regions. Again, showing that This is something that they're going to take a look at, and I think Todd you said something that NCUA wants to try and get their hands around what this risk [00:12:00] might be.
I think you're spot on there. That's why they have this elevated so high. All right. The next in order number four is BSA or bank secrecy act compliance. Any thoughts relative to bank secrecy act.
Todd: This is Todd again I'll take this one as well. This is another one where there's several links in the letter and it's probably worth clicking on the links. I actually clicked on a couple of them within the ladder. They mentioned some rule changes. A couple of different acts of Congress.
FinCEN is writing other rules to go with those acts. They boiled down to a couple of things they want even more emphasis on knowing your customer with respect to especially the limited liability company is incorporations. That's a big emphasis out of it. I did click on the links fins in itself, issues of priorities letter, and it looks [00:13:00] very similar to the prior two things we just talked about.
Vincent's priorities are information security and payment systems this year. And it's interesting that those find their way to NCUA way's letter as well. But this is one compliance is a big deal for credit unions. This is one they probably should have their compliance officers click the links, read the attached information bank secrecy act.
It's an interesting acronym. I had an old employee wants. Tell me the whole thing is to make sure there's no secrets on how payments are flowing through the system. But I think this will always be an emphasis on their How money flows for bad characters, be they terrorists drug Lords or whatever.
The government's always going to be trying to get their hands around that and diminish it to the extent possible. So I don't think we will ever see a priority letter that doesn't have bank secrecy listed on it just because it's important to so many government agencies outside of NCUA, just a big deal to the [00:14:00] law enforcement world.
Steve: Yeah, I just, this is Steve. I have one thing to add on that when I had a few credit unions that got behind or lacks in their bank secrecy requirements, and it is expensive and time consuming to fix that. And that is part of your risk management, because if you get behind and get in trouble, it was one of the other federal agencies you're going to have to hire expertise and it is expensive and it takes time.
So the best thing to do as it is to avoid that.
Todd: Like Steve was the director of special actions. You deal with a lot of trouble. Let's just say, I know more than a few that have paid, very large fines, the FinCEN for even innocent mistakes that they've admitted to when they still get assessed, pretty significant penalties.

And like Steve said, the time and dollars is gone back and fix fixing.
Mark: If you're going do it do it right. That makes sense in a lot of arenas, but in BSA, [00:15:00] that should be what you're always thinking. And indeed it can be expensive. All great points. And. The three of us spent a lot of time in special actions in as directors and problem case officers.
We did get the opportunity to see some of the most challenging cases that NCUA has seen on different topics, which is one of the things that makes chatting with you guys about this really enjoyable. So next up, all the next topic is a topic that we've already recorded a separate podcast on Steve and I have, which reminds me to say that many of these topics we will do drill down separate podcasts on.
So we just want to do the highlights here relative to this letter to credit unions, but the next topic is capital adequacy and risk based capital rule implementation. Steve, I know you have some thoughts on this since we chatted about it for about 45 minutes the other day.
Steve: Yeah, [00:16:00] as you see, I'm always happy to talk about capital. The thing that protects the insurance fund and protects the credit unions from failure. So let's first, let us talk about the risk-based capital rule implementation. This is another topic near and dear to my heart. I started working on. The changes to the risk-based capital or rule in 2014, that rule was approved and 2015.
And it just finally with a few other adjustments went into effect on January 1st. So what a long incubation period. So hopefully credit unions are ready for it and understand it. I should say they should not have a lot of fear of it because it really only applies to, less than 700 of the credit unions that are over 500 million in assets that have to take a look at it.
Then they have the two options that credit unions can you choose the complex credit union leverage ratio, which basically is the net worth ratio of, they have to have a higher [00:17:00] level of that at 9% to, to where they don't have to compute the risk based capital requirement or schedule. On the new call report.
So having that option, but I do think the risk-based capital major has a great value to them. The risk weights that were assigned to the assets are meaningful, and we're not just drawn out of a hat. They closely correlate to the risks that you would see in a normal portfolio of that type of loans. The other thing NCUA was able to play in there is a higher capital requirement.
If you get a concentration of assets say in commercial loans. So I think that was a unique prospect of it. So if your credit union is going to do that, and you choose the complex credit union leverage ratio. I would say don't be afraid. And you probably do want to be aware of what your risk-based capital measure is because it's just one more indicator of your capital adequacy.
So let's talk about capital [00:18:00] adequacy. Every credit union needs to evaluate that because the regulatory capital requirements, the net worth ratio and these new ones, they establish minimums. And so credit unions usually have a capital goal that they're shooting for. They should know why they've established a certain capital measure that they think is adequate with them and be able to engage their examiner in a meaningful discussion as to how they identified that ratio and how they measure it and their needs based on changes in their balance sheet or changes in their operating environment that are occurring.
And certainly if you're interested in merger and acquisition activity, That would play a role in there. You'd probably want to at least increase your capital ratio in anticipation of opportunities that come down the line. And much more of that is covered in our podcast on that the ensuite gets the way they were concerned about the capital ratio is it has [00:19:00] declined because of the share growth that's occurred.
The last couple of years share growth of over 20% in 2020 and 13% this year has resulted in the combined net worth ratio for the industry is going from 11.3% at the end of 2018 to 10.2, 3%. So net worth has declined on the whole but so that's why, of course, NCO always be looking at this, but individual institutions.
It's your job to, to know on and decide what type of, how much capital you think you need to.
Mark: Great comments, Steven. And while they'll they always look at it, obviously capitals the C and camel, the camel rating. This is actually the first time they've actually put it into the priority letters, which was driven by the new rule that they want to educate credit unions and everything. But when you combine that with the statistics that you just cited with a 200 basis point [00:20:00] drop, essentially over a three-year period for reasons that credit unions perhaps couldn't control, but it is what it is, the capital has dropped.
So it's going to.
have more attention during the exam. They may be a little bit nicer about it because it, because of it coming in during the pandemic, and that it's might not be in a risk asset because you're putting it in investments, but it's something that will certainly get some attention. And we know that because it's here in the priority letter. Very good. All right. So topic number six. On our letter is loan loss reserving. Any thoughts on loan loss reserves, which by the way, was previously discussed in previous letters, referencing the allowance, and then also a reference to the current expected credit losses or Cecil. So the allowance is always something that's there.
They've deemphasized Cecil this year and just focused on loan loss [00:21:00] reserves Foxx on loan loss reserving as it relates to the priorities.
Todd: I think it's interesting that they throw the words out loan loss reserving instead of Cecil, when Cecil. Going to go into effect on January one next year. It's been delayed a couple of times. I'm going to be honest with you. This is just my personal opinion, mark. Cecil was on this priority list way back in 2019.
NCUA has punted the ball on this. We've spent the ensuing years providing virtually almost no training to examiners. There's been very little guidance to the credit union industry regarding it. I think NCUA has spent political resources with basmati to get it delayed as long as they could.
But here we are. Cecil is coming into effect for most credit in January one of next year. I would just say if you're a credit union. You need to be talking to your CPAs. Hopefully [00:22:00] you've been talking to your CPAs for a couple years. It's going to be pretty challenging. The models you need to calculate.
Year allowance under Cecil are going to be a little bit more complex than what you've used in the past. A small number of banks have implemented Cecil already. Most of those are the publicly traded larger banks. But I think in general, for many credit unions, they're going to see their allowance go up a little bit.
There might be a railroad and they'll see their allowance go up a lot, but allowance numbers are probably going to get higher, which kind of ties back to this whole capital thing too. There's going to be impacts to capital on it. So I would just say for the credit unions, Spend some time with your CPAs, make sure you get your policies and procedures ready for Cecil.
Your examiners will be having lots of discussions about that. Their level of knowledge might be not as great as you would expect at this point in time. There'll be playing catch up this year.
Mark: And I mentioned that the [00:23:00] letter has many links to it in different topics and on the loan loss reserving topic, it's certainly on its face, looks like it has the most number of links. There's a link to the inter-agency statement on loan modifications. There's four links to Fazoli's website. And then there's two links to NCUA letter to credit unions on frequently asked questions relative to credit losses.
So definitely understand why. Th the priorities and Todd, you said it well that this is going to be something that you should already be ahead of the curve on and SUA I'm expecting, we'll be putting just-in-time training in place before 2023 rolls around. And again, this is something that they're looking at quite closely, especially with the unknown of what happens whenever this pandemic ends what that does to the estate of the economy and the [00:24:00] state of loan portfolios.
All right. So we will do one more topic before we break with episode one of two on the exam priorities and that would be number seven on the list, which is consumer financial protection thoughts on consumer financial protection.
Todd: . Consumer financial protection is always on this list every single year. I'll give you all a little background on how NCUA views this many of the credit and managers have probably figured it out. And think they know, and I'll just confirm that you actually do know what's going on each year.
NCUA is examination and insurance. They pick a number of regulations consumer protection rights. There's a plethora of them out there, but they will pick three or four each year to emphasize. And it's not that they ignore the other ones. They don't. If they see something, they'll say something to you, but for the most part, they don't dig [00:25:00] deeply into every single consumer protection reg every year they pick a small number of them each year.
It's intended to be about the same amount of exam time. As a prior year, you can argue whether that's true or not. I think some things go up and down but they do these on a rotational basis. And the nice thing about them when they issue a supervisory letter, like this is the agency is very transparent.
They're telling the industry, these are the specific consumer regs we're going to look at this year. So your own compliance people ahead of that can maybe dig into those and make sure your policies procedures are all up to date with respect to these specific consumer rakes. Hopefully we have credit lines, health systems to keep current with all of them, but at least in this case, the agency is very transparent.
Here's the ones we're going to look at this year and the list will be different.
Mark: Good summary, Todd. And I will add to that, that when he and I office of examination of [00:26:00] insurance comes out with the proposed list, which then gets signed by the board chairman that the office of consumer financial protection and the office of examination of insurance together, come up with that list based on things that they have may have found in their fair lending exams from the previous year.
So I had that thought and then also I will add. That the service members, civil relief act, which is on the list this year. That's one that, that when I was at NCUA at times, was raised actually by Congress because members complained saying, Hey, I wasn't treated fairly relative to this. And so there were a handful of Congress members who would reach out to make sure that NCUA put that on their list or at least ask them to consider it.
And it's obviously the purpose of that act is superb. And so I like the fact that it's on there, but so do other people and they raise it and it NCUA has its attention on it quite frequently. All right. So before I wrap up anything else [00:27:00] either of you would like to add in summary of what we've chatted about so far.
Todd: I will just throw out one thing just related to some of the things we talked about. You have this focus on credit risk and capital adequacy and loan loss reserves. When you read between the lines, these are all pointing to an expectation that credit unions are assessing their capital position relative to the risk on their balance sheet.
And we can talk a little bit more about that when we get to the second part of this podcast. But I think informally NCUA is raising expectations for credit unions on assessing their own capital position. And is that adequate for the risks on their balance sheet?
Mark: Great points
Todd: My takeaway.
Mark: now. That's a good place to wrap.
If you think
of Questions please reach out and send me your thoughts and your questions, [00:28:00] and we can address them potentially with another podcast. And I will give you my contact information momentarily.
If you'd also like to talk about how I and Steve and Todd, and some of my other experts could assist you so that you achieve the best possible exam results. You can reach me at cuexamsolutions@marktreichel.com or via my website at www.Marktreichel.com. All right. Part two will be coming out soon and that's it for today.
I'm Mark Treichel and I hope you join me again next time for with flying colors.