Compliance Update with Amy K

NCUA – COVID-19 Reg Relief Extension
In case you missed it, at the end of 2021 the National Credit Union Administration announced the extension of certain COVID-19 regulatory relief provisions.
The provisions relate to the temporary raising the maximum aggregate amount of loan participations that a FICU may purchase from a single originating lender to the greater of $5,000,000 or 200 percent of the FICU’s net worth. Also, temporary suspension of limitations on the eligible obligations that a federal credit union (FCU) may purchase and hold. Finally, tolling the required timeframes for the occupancy or disposition of properties not being used for FCU business or that have been abandoned.
These temporary modifications will remain effective until Dec. 31, 2022. 
 
Letter to Credit Union – Digital Assets
The NCUA also issued a Letter to Credit Union 21-CU-16 at the end of 2021 regarding relationships with third parties that provide services related to digital assets. The NCUA does not prohibit Federally Insured Credit Unions (FICUs) from partnering with third-party providers of digital asset services that leverage evolving technologies.
As explained by the NCUA, “a FICU’s relationship with third parties offering these services and related technologies will be evaluated by the NCUA in the same manner as all other third-party relationships. This includes a FICU exercising sound judgment and conducting the necessary due diligence, risk assessment, and planning when choosing to introduce or bring together an outside vendor with its members. FICUs should establish effective risk measurement, monitoring, and control practices for such third-party arrangements.”
Credit unions exploring relationships with these third parties should review this letter carefully as it provides additional guidance on due diligence, policy and agreement requirements, and advertising, among other items that credit unions should be mindful of.
 
 FinCEN Enforcement Action
The Financial Crimes Enforcement Network (FinCEN) announced a $8 million civil money penalty against a Texas bank at the end of 2021, which can be found here.
In this particular case, the bank utilized an enterprise-wide automated Anti-money Money Laundering (AML) monitoring system that reviewed transactions and generated alerts of possible suspicious activity (“case alerts”) based on predetermined criteria; thereafter, case alerts were to be sent to an AML analyst to review the activity. One of the main issues, is that the bank understaffed its AML compliance office. As explained in the enforcement action, “the Bank retained six to eight BSA staff, including a BSA Officer and several BSA analysts, of which three reviewed case alerts on a regular basis and provided quality control review for one another. Those three BSA analysts each reviewed an average of 100 case alerts per day, which meant that BSA analysts often did not review supporting documents (cash deposit slips, wire transcripts, check images, etc.), although all of this information was readily available. This understaffing and failure to allocate sufficient resources further exacerbated the other failures identified below.”
With regard to Customer Due Diligence (CDD), the bank had implemented a CDD program which included assigning its customers a risk rating score based on a variety of risk factors, which it obtained through questionnaires for businesses and individuals. However, FinCEN found that the CDD questionnaires were often not updated when circumstances warranted and therefore at times lacked critical information. Where CDD questionnaires were flagged as incomplete, AML staff were instructed to obtain additional information from customer account officers rather than from the customers themselves.
As noted above, the bank’s automated AML monitoring system generated a substantial number of case alerts on potentially suspicious activity. The enforcement action notes, that “to reduce the number of case alerts AML staff had to review, the BSA Officer applied exemptions for customers whose activity was thought to be “well-known,” including those individuals later arrested for or convicted of financial crimes, which resulted in lowering the case alerts generated for those customers.”
FinCEN also found a failure to file at least 17 Suspicious Activity Reports.
The enforcement action goes on to describe three customers in more detail on which the bank failed to appropriate monitor and/or file SARs on.


NCUA – Automated Cybersecurity Evaluation Toolbox
A reminder to check out NCUA’s Automated Cybersecurity Evaluation Toolbox (ACET) which is a no-cost, downloadable application developed to be a cybersecurity resource for credit unions. The Toolbox assists institutions of all sizes and complexity to determine and measure their information and cybersecurity preparedness against several industry standards and best practice.
The NCUA issued Letter to Credit Union 21-CU-15, which includes FAQs regarding the toolbox in addition to a video that provides an overview of the entire process.
Find the ACET and other assessment tools here.
 
CU Policy Pro Updates
The below updates were made to 14 CU Policy Pro model policies. All documents related to this update can be found in the Resources area of CU PolicyPro (under Content Update Archives > December 2021).
Policy 2214 – Health Savings Accounts. Each year the IRS changes the contribution limits that can be made to health savings accounts for both individual and family plans. Those changes for 2022 are reflected in the policy revisions.
Policy 3165 - Loan Workouts and Nonaccrual Standards. This policy was revised to incorporate the contents of Model Policy 7616 – Loan Extensions. Information in both policies was duplicative and in order to provide more precise content for credit unions, this policy was revised and Policy 7616 will be retired. Note: prior to deleting a policy we recommend searching your CU Policies Manual for any references to the policy being deleted and update as needed.
Policy 3170 -Troubled Debt Restructure. This policy was revised to incorporate additional language regarding capitalization of interest for loan modifications when the borrower has the ability to repay the debt, effective on July 30, 2021 (previously prohibited). Policy 3165 was already amended with this content, but additional language was also added to this policy to reflect that change. (FCU only)
Policy 5400 – Capital Management. This policy was updated for credit unions that are under $500 million in assets to utilize and customize.  These credit unions are not deemed to be “complex” under the NCUA’s Risk Based Capital rule that became effective on January 1, 2022.  (Required for credit unions under $500 million)
Policy 5401 – Capital Management for Complex Credit Unions **New Policy** This policy was updated using Model Policy 5400 – Capital Management as a template, for credit unions that are over $500 million in assets and deemed to be “complex” under the NCUA’s Risk Based Capital rule that becomes effective on January 1, 2022.  There are two Key Fields in this policy which should be defined. Note: We are providing both a redlined version so users can see how Policy 5400 was adjusted to create this policy, as well as a “New” policy version with no redlines. (Required for CU’s over $500 million)
Policy 6400 – Subordinated Debt and Procedure 6400.1 – Subordinated Debt Procedure **New Policy and Procedure** This policy was created in response to the NCUA Subordinated Debt Rule that became final effective on January 1, 2022.  A corresponding model procedure was also created for credit unions that are pursuing the issuance/investment in subordinated debt. (Required if offered)
Policy 7210 – Credit Cards. Each year the CFPB adjusts the safe harbor fees for a first violation penalty fee and subsequent violations for credit cards.  For 2022, the thresholds will be $30 and $41, respectively.  Policy 7210 was updated accordingly.
Policy 7330 – Residential Real Estate Loans. This policy was revised to adjust the asset-based threshold for determining if a credit union is a small creditor under the rules. 
Policy 7350 – Ability to Repay. Policy 7350 was revised to comply with the annual changes made to the points and fee thresholds to determine if a mortgage is considered a qualified mortgage under the rules, based on the Consumer Price Index. These changes became effective on January 1, 2022. Changes were also made to reflect the price-based thresholds for the general qualified mortgage definition, that becomes mandatory for compliance on October 1, 2022. The Qualified Mortgage Cure Provision was also removed based on the January 10, 2021 expiration.
Policy 7351 – Small Creditor Ability to Repay. Similar to Policy 7350, this policy was also revised to comply with the annual changes made to the points and fee thresholds based on the Consumer Price Index and the asset-based threshold for determining if a credit union is a small creditor under the rules. The Qualified Mortgage Cure Provision was also removed based on the January 10, 2021 expiration.
Policy 7362 – Temporary Policy for Loan Modifications and Reporting COVID-19. Policy 7362 was revised to incorporate the most recent guidance from the NCUA on COVID-19 relief extensions.
Policy 7370 – HOEPA Rule Requirement. The thresholds for determining if a loan is covered under HOEPA were also adjusted for January 1, 2022 and these amounts were updated in the policy accordingly.
Policy 7616 – Loan Extensions **DELETED** Since loan extensions are a type of loan workout, this policy is being retired and incorporated into model policy 3165 – Loan Workouts and Nonaccrual Standards.  While some of the applicable key fields will be maintained, the content was duplicative and results in a more comprehensive policy with the combination.
Policy 7700 – Loan Review and Classification **New Policy** This is a new policy being created through revisions to existing Policy 7600 (Loan Review and Classification) to comply with the new requirements under CECL. References have been changed and this policy should be adopted when credit unions are ready to adopt the new 7715 – Allowance for Credit Losses policy in compliance with CECL (effective for credit unions on January 1, 2023). There is one Key Field in this policy which should be defined. Note: We are providing both a redlined version so users can see how Policy 7600 was adjusted to create this policy, as well as a “New” policy version with no redlines. (Required on effective date)
Policy 7715 – Allowance for Credit Losses **New Policy**
**7715.1 Allowance for Credit Losses Methodology *NEW*
This is a new policy being created through revisions to the existing Policy 7615 (Allowance for Loan Lease and Losses) to comply with the new requirements under CECL.  While we expect this policy (and its corresponding methodology) to continue to evolve, we wanted to provide a model and support for those credit unions hoping to start preparations for transition (effective for credit unions on January 1, 2023). Note: We are providing both a redlined version so users can see how Policy 7615 was adjusted to create this policy, as well as a “New” policy version with no redlines. (Required on effective date)
Policy 9120 – Fair Debt Collection Practices Act. This policy had a minor update to provided clarification on the components deemed to be harassment or abuse related to telephone conversations.  Credit unions are encouraged to adopt this revision if it helps provide clarity to credit union employees. (Recommended)
Policy 9200 – Home Mortgage Disclosure Act. This policy was updated to reflect the annual threshold change to determine asset size coverage for the rule, which has increased to $48 million. Credit unions below this asset size will not be required to report HMDA data. In addition, effective on January 1, 2022 the open-end threshold for reporting loans is being reduced from 500 to 200.
Policy 9220 – Home Ownership and Equity Protection Act. Similar to the changes made to Policy 7370, this policy was also revised to adjust the thresholds for determining if a loan is covered under HOEPA, effective January 1, 2022.
Policy 9420 – Regulation D – Monetary Control Act. Even though the reserves requirements are still set at zero, the reserve requirements thresholds amounts are updated each year. These changes are now reflected within the policy.
 
DakCU members may contact Amy Kleinschmit at [email protected] with any compliance related questions.