Compliance Update with Amy K

​Multi-factor authentication required for CUOnline; NCUA seeking climate related financial risk comments; CU PolicyPro updates; and more. 

​by Amy Kleinschmit, Chief Compliance Officer 

NCUA - CUOnline User Account Maintenance
The National Credit Union Administration (NCUA) recently sent out a reminder that user account registration is required for multi-factor authentication. The NCUA implemented Multi-Factor Authentication for the CUOnline application on April 1, 2023.

If you did not register your account yet, you would have received an email from noreply@okta.com asking you to register your account. Please note that registration emails from Okta expired after 7 days.
Failure to complete the registration may result in technical difficulties and interfere with regulatory filings. For questions or assistance with the multi-factor login, please contact technical support by email at onestop@ncua.gov or call 1.800.827.3255.

NCUA Request for Information – Climate Related Financial Risks
At their recent board meeting, the National Credit Union Administration (NCUA) issued a request for information and comment concerning climate-related financial risks, which can be found here and is open for a 60-day comment period.

This Request for Information (RFI) follows the issuances of NCUA’s Research Note – “Estimating Credit Union Exposure to Climate-Related Physical Risks.” The research note found that 25 percent of credits unions, accounting for 34 percent of system-wide assets, are headquartered in areas at relatively high or very high risk of experiencing negative effects due to natural hazards. The report further notes that credit unions that are at relatively high and very high risk of experiencing negative consequences of weather and climate-related disasters tend to be located along the coasts, particularly in California, Texas, and Florida.

The RFI was approved by a 2-1 vote. Vice Chairman Hauptman explained during his remarks on the RFI that, “I think there are some ways this can go well but also quite a few ways this effort can unintentionally windup doing harm to both the Share Insurance Fund and credit union members.” Hauptman outlined several points why he opposed the RFI, including, “Those closest to these natural disasters and changing markets are best positioned to understand and manage the risks; the history of unintended consequences of government interference in private markets; potential harm to credit union members; and all of these issues are already dealt with via existing workstreams, and the NCUA’s involvement could dull the market signals that make those workstreams function well.”

Chairman Harper asserted during his opening remarks that “the NCUA has a duty to ensure the institutions it oversees remain resilient against all material risks. Those risks include climate-related financial risks. This request for information is essential to furthering our understanding of these issues and their implications for the overall resiliency of individual credit unions, the vibrancy of the credit union system, and the strength of the National Credit Union Share Insurance Fund.” The Chairman went on to stress that, “it is worth noting that the NCUA’s request is for informational purposes only. Responses to this request for information will not be used as part of the current NCUA examination and supervision program. Moreover, my fellow Board Members and I fully agree if there were a subsequent change in agency policy and supervision related to climate financial risk, that change would be agreed upon by Board action, similar to any other policy changes we make.”

Board member Hood confirmed that, “the RFI before us today does not change any NCUA policy or supervision for climate change. Changing policy will require a future Board action.” Adding, “For instance, when it comes to ESG regulations for credit unions, including climate change, I’m cautious about stepping in with regulatory solutions and certainly I am not comfortable with suggestions that regulators should be forcing a commitment to the ESG framework at this moment in time.”

The RFI looks at two categories of climate-related financial risks, namely physical risk and transaction risk. As explained in the RFI, “Physical risk refers to harm to people and property caused by discrete, climate-related events like hurricanes, wildfires, and heatwaves, as well as longer-term, chronic phenomena, including changes in precipitation patterns, sea level rise, and higher average temperatures. Transition risk refers to stress on institutions or sectors caused by measures taken to move towards a less carbon-intensive economy. This includes responding to public policy changes, adopting new technologies, and adapting to shifts in consumer and investor preferences, which may lead to higher costs and substantial shifts in asset values. If these changes occur in a disorderly fashion, the effect on individuals, businesses, communities, and financial institutions could be sudden and disruptive.”

As explained in the RFI, “the NCUA does not have expertise in climate science… the NCUA is seeking input that would strengthen its ability to identify and assess credit unions’ current and future climate and natural disaster risk. The NCUA is also seeking input on opportunities to enhance the agency’s supervision and regulation of each regulated entity’s management of such risks.”

The RFI asks 38 questions broken down into categories of physical risk; transition risk; operations; governance; business strategies; risk management; reporting and targets; climate-related opportunities; suggestions for NCUA; and data gathering. Finally, commenters are invited to submit any questions or comments not otherwise covered in the RFI that you would like NCUA to address.

Policy Statement on Allowances for Credit Losses
The National Credit Union Administration (NCUA) recently issued Letter to Credit Unions 23-CU-04 which provides revisions to the Interagency Policy Statement on Allowances for Credit Losses. The revised Interagency Statement removes references to Troubled Debt Restructurings (TDRs) following FASB’s issuance of ASU 2022-02, Financial Instruments—Credit Losses (Topic 326): Troubled Debt Restructurings and Vintage Disclosures (ASU 2022-02). ASU 2022-02 (March 2022) eliminated the recognition and measurement accounting guidance for Troubled Debt Restructurings (TDRs) by creditors upon adoption of Topic 326.

CU PolicyPro Updates
The 2023.2 content update from CU PolicyPro has been released. In this update, 19 policies were revised (including two that required a title change), 2 additional procedures were added, and 3 policies were retired and removed as part of this content update.

In the CU PolicyPro Resources area (under Content Update Archives > April 2023) there is detailed information for each affected policy, including redlined documents showing exact text changes made to each model policy. Remember, updates are only made to the model policy. At this point the credit union will need to determine its next step:  

• Do nothing and leave your policy as is (usually only if the update does not apply to your credit union, or you are not currently using the policy); 
• Remove the policy from your CU Policies Manual and bring in the updated policy in its entirety (usually if your CU Policies Manual version has little or no customization, or if our updates were very extensive and it would be easier to start with the updated content and re-customize for your credit union); 
• Use the redlined version as a guide and manually incorporate the updates into your CU Policies Manual version (usually if the updates were very minor, or if your CU Policies Manual version is heavily customized and it would be less work to manually add the updates rather than re-customize the policy).

Be sure to check out the video tutorial reviews which reviews the best practices for each of the options above and provides tips for documenting the updates for auditing purposes. Find the video on the CU PolicyPro Support site - Training Videos page.

To highlight some of the content changes for this 2023.2 update:

Policy 1230.10 and 1230.11 – Complaint Process for Federally-Chartered/State Chartered Credit Unions. This resource has been updated to add a new definition for a “complaint.” Because there is no formal definition, credit unions have the ability to define what they deem to be a complaint. It is recommended that this key field be utilized to create a definition to provide consistency across the credit union.

Policy 2205 – Unlawful Internet Gambling. Minor changes suggested for the credit union’s documentation of how to handle when they have “actual knowledge” of a business member participating in a restricted transaction.

Policy 2611 – ACH Operations and Management. The organization of the policy was changed to move content under relevant categories. Additionally, content and clarification was added related to nested third-party senders in compliance with NACHA Operating Rules.

Policy 2615.10 – Electronic Fund Transfers. With the increase of real time payment options through The Clearing House and the Federal Reserve, this resource was updated to reflect the different avenues credit unions may pursue to route transactions. The different systems have different rules and coverage, credit unions are encouraged to reference the associated operating rules and agreements for details.

Policy 3165 – Loan Workouts, Modifications, and Nonaccrual Standards - **Title Change** Updated to comply with the FASB’s amendment to eliminate the accounting guidance for TDRs with the adoption of CECL. Credit Unions still need to determine if a loan modification is deemed to be a new loan or refinancing/restructuring under the rules. Credit unions that have implemented CECL should use this policy instead of Policy 3170 – Troubled Debt Restructure. (Required)

Policy 4120 – Information Security. Revised to comply with the amendments to Part 748 of the NCUA rules related to the cyber incident notification requirements. Please note – final rule not effective until September 1, 2023. (Required)

Policy 4125 – Incident Response. This policy was revised to comply with the amendments to Part 748 of the NCUA rules related to the cyber incident notification requirements. Please note – final rule not effective until September 1, 2023.  Additionally, updates were made to this policy to reflect situations of Corporate Account Takeover. (Required)

4125.10 – Corporate Account Takeover Procedures **NEW CONTENT** As examiner expectations increase these procedures were created to help the credit union develop more detailed processes for certain threats such as corporate account takeovers.

Policy 5200 – Liquidity Risk Management. Due to the NCUA’s 2023 Supervisory Priorities, this policy was reviewed and revised to include additional triggering events, along with some minor changes to managing stress events and liquidity measures. (Required)

Policy 5300 – Interest Rate Risk Management. Due to the NCUA’s 2023 Supervisory Priorities, this policy was reviewed and revised to additional risks, along with a few housekeeping changes for consistency. (Required)

Procedure 6400.10 Subordinated Debt. Revised to comply with the most recent NCUA amendments to the rule, which become effective on April 26, 2023.

Policy 7100 – General Lending Policy. This policy was revised to include components of Policy 7101 and Policy 7155 (both of which are being removed from CU PolicyPro). The intention of this policy is to provide a general overview of the Credit Union’s compliance with broad aspects of lending.

Policy 7200 – Consumer Loans. Updated to comply with changes to the allowance for credit losses under CECL, updates to the outdated multi-featured open-end lending plans and additional updates to other applicable and more comprehensive policies.

Policy 7302 – Real Estate Appraisals. This policy was updated to provide reference to the credit union’s role in ensuring an appraisal does not violate Fair Lending laws. As reaffirmed in the CFPB’s most recent statement of interest, the credit union can be liable for relying on an appraisal that it knows or should know to be discriminatory.
 
Policy 7315 – Commercial Real Estate Loan Workouts and Modifications - **Title Change** Updated to comply with the changes related to CECL. The Allowance for Loan and Lease Loss was updated along with corresponding treatment and reference to troubled debt restructurings.

Policy 7330 – Residential Real Estate Loans. Updated to address the risks associated with maintaining a mortgage pipeline and to acknowledge Fair Lending compliance with appraisals.

Policy 7615 - Allowance for Loan and Lease Losses. This policy was updated in more detail to provide clarity on the use, which will only be for credit unions under $10 million in assets who are not required to implement the CECL standard.

Policy 7625 - Residential Real Estate Loss Mitigation Strategies. This policy was updated to reflect more changes as a result of the new CECL standard and corresponding troubled debt restricting changes. There were also minor administrative changes.

Policy 7630 – Multi-Dimensional Loan Portfolio Analysis. This policy was updated to remove references to Troubled Debt Restructurings.

Policy 7700 – Loan Review and Classification (CECL). This policy was updated to remove references to Troubled Debt Restructurings and additional changes related to individually evaluated loans under the new CECL standard.

Policy 9600 – TCPA, JFPA, and CAN-SPAM. Based on the effective date of the changes to the Telephone Consumer Protection Act (TCPA) resulting from the TRACED Act (July 23, 2023), this policy has been updated.

9600.10 – TCPA Procedures **NEW CONTENT** Based on the effective date of the changes to the Telephone Consumer Protection Act (TCPA) resulting from the TRACED Act (July 23, 2023), the corresponding policy was updated (9600) and this resource was created to help credit unions get a jump start on creating applicable procedures to maintain an effective and compliant program. 

Retired Model Policies
Policy 7101 – Loans - **RETIRED** Much of the content of this policy is already covered in other CU PolicyPro model policies. Any content from this policy that is not already covered elsewhere has been added to Policy 7100, General Lending Policy. Therefore, this policy is being retired and removed from the model database.

Policy 7155 – Loan Quality Board Reports – **RETIRED ** Much of the content of this policy is already covered in other CU PolicyPro model policies. Any content from this policy that is not already covered elsewhere has been added to Policy 7100, General Lending Policy. Therefore, this policy is being retired and removed from the model database.

Policy 7362 – Temporary Policy for Loan Modifications and Reporting due to COVID-19 **RETIRED** This policy is being removed from CU PolicyPro because the COVID-19 concessions previously in place have all expired.  
 
As always, DakCU members may contact Amy Kleinschmit with any compliance (and now advocacy) related questions.