Treatment of Certain COVID-19-Related Loss Mitigation Options Under the Real Estate Settlement Procedures Act

Regulatory Alert 20-RA-06 Treatment of Certain COVID-19-Related Loss Mitigation Options Under the Real Estate Settlement Procedures Act

August 2020

NCUA’s Regulatory Alert notifies credit unions of the CFPB’s interim final rule amending Regulation X (RESPA) that added a temporary exception to Subpart C to Reg X for certain COVID-19-related loss mitigation options. The rule became effective July 1, 2020.The rule allows a loan mortgage servicer to offer a borrower a loss mitigation option based on an evaluation of limited information collected from a borrower if certain criteria are met.

Reg X generally a mortgage loan servicer to exercise reasonable efforts to obtain all documents and information to complete a loss mitigation application from a borrower, and assess the borrower for all loss mitigation options available to the borrower based on the completed application. There are 2 exceptions:

• When a servicer has exercised reasonable diligence in obtaining the documents and information to complete a loss mitigation application, but a loss mitigation application remains incomplete for a significant period of time under the circumstances without further progress by a borrower to make the loss mitigation application complete
• When a servicer offers a short-term payment forbearance program or a short-term repayment plan to a borrower based upon an evaluation of an incomplete loss mitigation application.

The interim final rule adds a third temporary exception that is designed allow servicers to offer a payment deferral option offered by Fannie Mae and Freddie Mac, at the direction of the Federal Housing Finance Agency (FHFA), and a loss mitigation option for FHA insured loans.

To qualify for the 3^rd exception, a credit union must meet 3 criteria:

• Allow a borrower to delay paying all forborne principal and interest payments, and all principal and interest payments that are due and unpaid, until:
  • the mortgage loan is refinanced
  • the mortgaged property is sold
  • the term of the mortgage loan ends
  • for a mortgage insured by FHA, the mortgage insurance terminates
• Not charge or accrue interest on any amounts a borrower may delay paying through the loss mitigation option; not charge any fee in connection with the loss mitigation option; and waive all existing late charges, penalties, stop payment fees, or similar charges promptly upon a borrower’s acceptance of the loss mitigation option
• Terminate any pre-existing delinquency when a borrower accepts the loss mitigation offer

Under the interim final rule, when a borrower accepts a loss mitigation offer, a credit union is not required to comply with requirements of 1024.41(b)(1) and (2), which apply to an application a borrower submitted before the credit union made its loss mitigation offer.

Credit unions must also comply with other Regulation X requirements after a borrower accepts a loss mitigation offer. For example:

• If a mortgage loan becomes delinquent again (at any time), a credit union would have to satisfy the early intervention requirements of 1024.39
• If the borrower submitted a new loss mitigation application, the credit union would have to comply with the usual loss mitigation procedures

Small Servicer Exemption and the Prohibition on Certain Foreclosure Activities

NCUA notes that credit unions engaged in servicing mortgage loans that qualify as small servicers (they service 5k or fewer loans, all of which they or an affiliate own or originated) are not subject to the provisions of Regulation X relevant to this Regulatory Alert and are not affected by the amendment in the interim final rule. However, a small servicer is subject to the prohibition on certain foreclosure activities in Regulation X.⁵

Credit unions should read the provisions of the interim final rule and Reg X to determine the effect on their operations.

Regulatory Alert 20-RA-05 Remittance Transfers under the EFT Act

June 2020

NCUA’s Regulatory Alert provides credit unions information regarding changes to the CFPB’s Remittance Rule (Regulation E) which implements the Electronic Fund Transfer Act (EFT Act). The changes take effect July 21, 2020.

The CFPB’s new rule makes the following changes:

• The new rule increases the safe harbor threshold, and removes from coverage of the rule, credit unions and banks that provide 500 or fewer transfers annually. This is an increase from the current threshold of 100 or fewer transfers.
• Establishes 2 new permanent exceptions to the rule which allow credit unions and banks to disclose estimates of the exchange rate and covered third-party fees instead of exact amounts:
• Entities may provide an estimate of the exchange rate for transfers to a particular country if the credit union or bank made 1,000 or fewer transfers in the prior calendar year to the particular country in which the transfer recipients received funds in that country’s local currency and the credit union or bank cannot determine the exact exchange rate for that transaction.
• Credit unions and banks may estimate the 3^rd-party fee for a transfer to a designated recipient’s institution if 1) the financial institution made 500 or fewer transfers to the designated recipient’s institution in the prior calendar year; 2) at the time the disclosure must be given the credit union or bank cannot determine the exact amount of the 3^rd-party fee; and 3) the remittance is sent from the sender’s credit union account (not including pre-paid accounts).

Additional Changes

• The final rule includes a transition period for credit unions and banks that exceed the new exception thresholds.
• The final rule also adds an exception to allow a credit union or bank to estimate 3^rd-party fees when another federal statute or regulation prohibits the institution from determining the exact amount of the fee.
• The CFPB will develop improved procedures to consider requests to make changes to the exchange rate countries list.

NCUA’s Office of Consumer Financial Protection may be contacted by phone (703.518.1140) or e-mail ([email protected]).

Letter to Credit Unions 20-CU-17 Update to Offsite Examination and Supervision Approach

May 2020

NCUA is updating its supervisory approach implemented in response to the COVID-19 crisis and originally announced in March in Letter to Credit Unions 20-CU-05, Offsite Examination and Supervision Approach. Notably, NCUA’s updated approach includes a return to issuing Reports of Examination (ROE).

Conducting Work Offsite

NCUA will continue to operate with its employees and contractors working offsite and will continue its general moratorium on new on-site exam work until further notice. However, NCUA may conduct onsite work at a credit union as necessary to address serious or time-sensitive matters. NCUA noted since March 16, 2020 NCUA examiners have conducted offsite examination work at over 100 credit unions. NCUA examiners will continue to be mindful of the impact exam information requests may have on a credit union experiencing operational and staffing challenges associated with the COVID-19 pandemic. NCUA Regional offices will continue to coordinate with SSAs on supervision efforts for FISCUs.

Issuing Examination Reports

NCUA will begin issuing ROEs for the examinations NCUA examiners complete off-site. NCUA reiterated that corrective actions issued to a credit union would consider the impact of the COVID-19 pandemic on the credit union’s operations and financial condition. In announcing this change, NCUA emphasized:

• Credit unions would not be criticized for efforts to provide prudent relief for members so long as those relief efforts are conducted in a safe and sound manner. NCUA examiners WILL consider whether a credit union’s relief efforts elevate, or reduce, a credit union’s risk exposure.
• Additional risk, even if prudently undertaken, may be reflected in NCUA’s CAMEL rating of the credit union.
• TO ensure consistent application of these concepts, NCUA has instituted an enhanced internal review process for all ROEs.

For more information on the CAMEL rating system, see NCUA’s Letter to Credit Unions, 07-CU-12, CAMEL Rating System.

This amended off-site approach became effective on June 1, 2020.

Regulatory Alert 20-RA-03 CFPB Issues Interpretive Rule on Waiver of TRID and TILA Waiting Periods

May 2020

NCUA’s Regulatory Alert discussed the CFPB’s interpretive rule clarifying when consumers can elect to modify or waive certain required waiting periods for some mortgage loans under the TILA-RESPA Integrated Disclosure (TRID) rule and the Regulation Z right of rescission rule (See 12 CFR 1026.15 and 1026.23). 

Under the interpretive rule, a borrower’s need to obtain funds and not delay closing for reasons related to the COVID-19 pandemic may be a “changed circumstance” or “bona fide personal emergency” which would permit borrowers to waive waiting periods under both rules, or permit a credit union to amend some TRID documents.

NCUA encourages credit unions to inform borrowers of their ability to forego the waiting periods.

The interpretive rule also designates COVID-19 to be a permissible “changed circumstance” under the TRID rule for revising fee disclosures to reflect higher costs for the transaction (such as increased appraisal fees).

NASCUS Note:

The CFPB also issued a FAQ regarding the waiving of the timing requirement under the ECOA Valuations Rule.

Regulatory Alert 20-RA-04 CFPB Increases Reporting Thresholds Under HMDA

May 2020

NCUA’s Regulatory Alert discusses the May 12, 2020 CFPB final rule amending parts of Regulation C which implement the Home Mortgage Disclosure Act (HMDA). The final rule:

• Effective July 1, 2020 the threshold for collecting and reporting data about closed-end mortgage loans is increased from 25 to 100, for calendar year 2020. It also increases the threshold for collecting and reporting
• Effective January 2, 2022 the threshold for collecting data about open-end lines of credit is increased from 100 to 200.
• The asset size foe collection of data remains unchanged: credit unions with total assets of $47m or less of December 31, 2019, are not subject to HMDA in 2020.

 What this means for credit unions:

NOTE: This rule change only applies to HMDA. Other regulations, such as  Regulation B (requiring collection of  information regarding ethnicity, race, sex, marital status, and age when credit is sought for purchase/refinancing of a primary residence dwelling that also secures the credit.

For calendar year 2021, a credit union is not required to collect HMDA data for closed-end mortgage loans if it originated fewer than 100 closed-end mortgage loans in 2019 or 2020.

The HMDA provisions may be found in Regulation C. CFPB will not update the current version of Regulation C until the effective dates of the amendments.

Letter to Credit Unions 20-CU-14 Establishment of CLF Agent Memberships

May 2020

NCUA issued LTCU 20-CU-14 to announce that all 3,700+ credit union with assets less than $250 million may access the Central Liquidity Facility (CLF). This is because all 11 remaining corporate credit unions agreed to subscribe to CLF stock as agents for all their members with less than $250 million in assets. In addition, the corporate credit unions action has increased the CLF’s borrowing authority by over $13 billion.

NCUA’s LTCU 20-CU-08, Enhancements to the Central Liquidity Facility Membership and Borrowing Authority provided information on changes to the CLF  resulting from the (CARES) Act, including allowing corporate credit union to become agent members of the CLF for a subset of their NPCU members rather than for ALL of their NPCU members. This special “subset” membership authority sunsets on December 31, 2020.

Credit unions seeking loans from the CLF should contact their corporate credit union. The corporate credit union can process the request for the credit union on behalf of the CLF. For more information, NCUA has resources on the CLF website.

Letter to Credit Unions 20-CU-13 Working with Borrowers Affected by the COVID-19 Pandemic

April 2020

On April 7, 2020, federal regulators issued a revised interagency statement on loan modifications and reporting related to COVID-19 and the CARES Act. NCUA issued LTCU 20-CU-13 to provide guidance for credit unions working with borrowers experiencing financial hardship as a result of the COVID-19 pandemic.

Noting that credit unions need to consider appropriate strategies for each member and whether members need new funds or modifications of existing loans, NCUA emphasizes credit unions must also continue to operate in a safe and sound manner. NCUA’s guidance discusses several options for working with distressed members:

New Funds to Borrowers

• Emergency Small-Dollar, Unsecured Loans – Intended to provide rapid shot term cash flow. Typically. $5k or less, 90-dya grace period and 2-3 year maturities.
• SBA’s Paycheck Protection Program and Economic Injury Disaster Loan – Special programs offered with 100% SBA guaranteed and eligible for forgiveness of the entire loan.
• Payday Alternative Loans (PALs) I and II– NCUA PALS I and II small dollar loan programs with maximum loans of $1K or 2K respectively and 6-12 month maturities. See § 701.21(c)(7).
• Increased Revolving Credit Limits – Increasing credit lines for credit cards, home equity lines, and other revolving credit products.
• Temporary Loan Modifications
  • Credit unions should comply with federal & state consumer financial protection rules, including fair lending laws, and provide accurate disclosures for all loan modifications. NCUA notes the following:
• CARES Act Forbearance – Provides forbearance for federally backed transactions for 180 days (with an option for an additional 180 days) with no additional fees, penalties, or interest beyond contractual payments. The law also provides for a moratorium on foreclosures of these loans.
• Payment Forbearance – A credit union may allow a borrower to defer monthly payments, w/an agreement to repay missed principal & interest at a later date.
• Waiving Late Payment or Modification Fees – Waiving fees can prevent additional increases to a borrower’s debt as fees are often added to loan balances.
• Interest-only Payments – This strategy results in lower payments for a defined period while preventing negative amortization. However, borrower’s payment would increase after the interest-only period.
• Reducing the Interest Rate – Provide temporary relief by reducing the interest for a defined period.

NCUA reminds credit unions to consider the borrower’s ability to repay the debt at the end of the temporary modification period, especially if the modification will result in higher payments or a balloon payment.

• Permanent Loan Modifications
  • NCUA notes the following strategies for permanently modifying or refinancing existing loans:
• Consolidating Loans– Combining multiple loans, especially with an improved interest rate or extended amortization, could lower payments for a borrower.
• Extending the Maturity Date– While this strategy can lower payments for a borrower, credit unions should consider whether the value of any collateral would remain sufficient through the extended term.
• Reducing the Interest Rate – Reducing the interest rate can provide relief to a borrower by lowering their payment without extending the loan term.
• Forgiving Principal – This would cause a loss to the credit unions and should generally be a last-resort concession, typically used only in cases where a borrower has negative equity in the property and a financial impact analysis indicates this modification appears favorable over foreclosure action.
• Restructuring into A-B Notes – Generally only used when analysis indicates foreclosure is not a better option for the credit union, credit unions can structure an “A” note with a loan amount that meets a borrower’s ability to repay the loan and a B note to be repaid when A note repayment is completed.
•  Monitor and Report Loan Modifications
• Credit union policies should:
  • address the use of loan workout strategies and outline risk management practices clearly define borrower eligibility requirements
  • set aggregate program limits
  • establish sound controls to ensure loan workout actions are structured properly
• A credit union’s risk-monitoring practices for modified loans should:
  • be commensurate with the level of complexity and nature of its lending activities
  • maintain safe and sound lending practices
  • comply with regulatory reporting requirements

The metric for successful modifications is the performance of the loan after it has been modified. Losses should be promptly recognized. The program should include periodic reports to executives and directors on all modified loans. The periodic reports may include:

• delinquencies and charge-offs
• number & volume of modifications by loan type
• first payment defaults
• high loan-to-value and debt-to-income ratios
• credit quality
• number of times each loan has been modified
• expected loss exposure

Credit union management must comply with regulatory reporting requirements and generally accepted accounting principles, as applicable. A credit union’s decisions related to loan modifications may affect regulatory reporting, including interest accruals, troubled debt restructurings (TDRs), and credit loss estimates.

Additional Information

Credit unions seeking additional information should reference the following sources:

1. 1. NCUA Letter to Credit Unions 20-CU-02, NCUA Actions Related to COVID-19

1. NCUA Letter to Credit Unions 20-CU-06, Small Business Administration Loan Programs to Help Small Businesses and Members During the COVID-19 Pandemic
2. NCUA Letter to Credit Unions, 10-CU-07, Commercial Loan Workouts
3. NCUA Regulatory Alert 10-RA-13, Final Rule – Part 701, Short-term, Small Amount Loans
4. NCUA Letter to Credit Unions, 09-CU-19, Evaluating Residential Real Estate Mortgage Loan Modification Programs
5. NCUA Supervisory Letter 13-02, Examiner Review of Loan Workouts, Nonaccrual, and Regulatory Reporting of Troubled Debt Restructured Loans and NCUA Letter to Credit Unions, 13-CU-03, Supervisory Guidance on Troubled Debt Restructuring
6. NCUA Letter to Credit Unions, 08-CU-20, Evaluating Current Risks to Credit Unions and the attached Supervisory Letter, Evaluating Current Risks to Credit Unions
7. CFPB Guide to Coronavirus Mortgage Relief Options

Letter to Credit Unions 20-CU-12 Outreach Related to COVID-19 Impact

April 2020

NCUA issued this LTCU to notify credit unions about an NCUA outreach initiative in which NCUA examiners will be contacting credit unions between May 4 and May 18 to review a list of  32 primary questions (with some questions having follow-up sub-questions).

NASCUS note: NCUA should be working with state regulators to coordinate the information gathering. NASCUS is aware that in some cases many of these questions have already been asked by state agencies in their ongoing remote supervision efforts.

For example, NCUA’s outreach questions include information requests related to:

• Credit union operational status
• How has the credit union altered services such as drive-thru only, lobby status, and appointments?
• Questions regarding % of CU staff still working
• COVID impact on the credit union’s membership
• Credit union liquidity
• Is the credit union experiencing higher than average cash withdrawals?
• What is the daily average cash withdrawal rate?
• Deposit and ACH information
• Question related to credit union borrowings and contingency funding plans
• Performance metrics
• Percentages of real estate and auto loans in forbearance
• Percentage of unsecured loans in forbearance
• Status of commercial loan portfolio
• Participation in SBA or other programs
• Information on collections staffing

NCUA notes that the agency has also been monitoring the effect of COVID-19 on credit unions through information provided by:

• corporate credit unions
• other financial service providers
• other government agencies

Letter to Credit Unions 20-CU-11 Regulatory Treatment for Paycheck Protection Program Loans

April 2020

 NCUA issued LTCU 20-CU-11 to discuss the agency’s recently published interim final rule related to the SBA’s Paycheck Protection Program (PPP) loans and the Federal Reserve’s PPP Lending Facility (PPPLF) advances. The regulatory changes in NCUA’s interim final rule became effective on April 27, 2020. NCUA has also provided information on the PPP in LTCU 20-CU-06.

 PPP Loan Related Regulatory Changes

NCUA has made changes to its rules related how PPP loans are classified for regulatory capital and commercial underwriting purposes:

• Part 702.104 was amended to include PPP loans as low-risk assets for purposes of calculating a credit union’s risk based net worth ratio. PPP loans will receive a zero-percent risk weight.
• PPP loans have been excluded from the definition of commercial loans per 723.2 and therefore will not be subject to the enhanced underwriting and monitoring requirements for commercial loans and will not count toward the MLB cap.

 PPP Loans to Officials

Although SBA regulations generally prohibit lenders from making an SBA loan to an affiliate or an owner, the PPP loans are uniform for all borrowers, and the standard underwriting process does not apply. The SBA’s most recent interim final rule on the PPP loan program  appears to allow for loans to a business owned by a Director as long as the Director is not an employee or officer of the credit union. Federally insured state credit unions(FISCUs) must still comply with § 701.21(d)(5) concerning non-preferential treatment for loans and lines of credit to officials (applicable by reference in § 741.203).

• PPP Loans to Non-Members

The Federal Credit Union Act prohibits FCUs from originating loans to non-members. FISCUs should look to state law.

 Background: Federal Reserve System’s PPP Lending Facility

 Complete information on the PPPLF is available on the Federal Reserve’s PPPLF website. The Federal Reserve will supply liquidity to participating financial institutions through term financing backed by PPP loans. Only SBA-guaranteed PPP loans that are originated by an eligible institution may be pledged as collateral for this special lensing facility.

• Treatment PPP Loans Pledged to the PPPLF as Collateral for Calculating Net Worth

NCUA has amended § 702.2 to allow credit unions to exclude PPP loans pledged as collateral for a non-recourse loan that is provided as part of the PPPLF from the calculation of total assets for the purpose of calculating its net worth ratio.

Only PPP loans pledged to the PPPLF will be excluded from the net worth ratio calculation. Unpledged PPP loans will still be included in total assets for purposes of calculating the net worth ratio with a zero-percent risk weight for purposes of risk based net worth.

 Call Reports

Future NCUA Call Report instructions will include guidance on how to categorize PPP loans and advances obtained through the PPPLF on the Call Report.

NCUA will continue to update its own FAQs on its COVID-19 Information webpage.

NCUA Temporary Final Rule: Parts 722 & 741.203 Loan Participations FCU Eligible Obligations FCU Occupancy

Prepared by NASCUS Legislative & Regulatory Affairs Department
April 2020

 NCUA has published a Temporary Final Rule (TFR) making changes to NCUA’s loan participation rule for all federally insured credit unions (FICUs), federal credit union (FCU) eligible obligation rules, and FCU occupancy rules. NCUA is enacting these changes on a temporary basis to help FICUs remain liquid and otherwise operational during the COVID-19 crisis. Specifically, NCUA is making the following temporary changes, effective thru December 31, 2020:

• raising the maximum aggregate amount of loan participations that a FICU may purchase from a single originating lender to the greater of $5 million or 200% of the FICU’s net worth (applies to federally insured state credit unions “FISCUs” by reference in § 741.203(b))
• suspending limitations on the eligible obligations that a FCU may purchase and hold
• tolling the FCU requirement to occupy credit union owned properties not being used for FCU business

The Temporary Final Rule proposed rule may be read here. There is NO COMMENT Period. The TFR is effective from April 21, 2020 through December 31, 2020.

Summary

• Increased aggregated loan participation purchase threshold

Part 701.22(b)(5)(ii) (applied to FISCUs by reference in § 741.204) of NCUA’s rules limits the aggregate amount of loan participations that a FICU may purchase from any one originating lender to the greater of $5 million or 100% of the FICU’s net worth. NCUA promulgated the limitation to mitigate a FICU’s concentration risk. FISCUs could seek a waiver from the limitation from the NCUA RD and the state regulator.

In order to facilitate FICUs’ ability to manage the COVID-19 crisis, maintain operations, and maintain liquidity, NCUA believes it prudent to temporarily raise the cap. Under the temporary final rule, the aggregate limit below which a waiver is not required will be raised to the greater of $5 million or 200% of the FICU’s net worth.

After December 31, 2020, a FICU must return into compliance with the current limitation of the greater of $5 million or 100% of net worth by ceasing to purchase loan participations from the originating lender or requesting a waiver pursuant to the rule.

Regulatory relief for FCUs Only

 The following 2 changes made by NCUA only apply to FCUs.

• Purchase, Sale, and Pledge of FCU Eligible Obligations

Part 701.23(b) of NCUA’s rules govern an FCU’s ability to purchase, sell, or pledge all or part of an eligible obligation of its members. The rule provides that an FCU may purchase an eligible obligation from any source, provided the FCU is empowered to grant the loan or the loan is refinanced within 60 days following its purchase so that it is a loan the FCU is empowered to grant. FCUs with a composite CAMEL rating of “1” or “2” can purchase eligible obligation from any FICU without regard to the member nexus. NCUA is now expanding that exception to include composite CAMEL “3” FICUs.

• FCU Occupancy and Disposal of Acquired Premises

Part § 701.36(c) of the rules generally limits an FCU’s investments in fixed assets authorizes and provides that if an FCU acquires premises, including unimproved land or unimproved real property, it must partially occupy them ‘‘no later than six years after the date of acquisition. NCUA is temporarily tolling the regulatory mandated timeframes for an FCU to occupy premises. Any days that fall within the period commencing on April 21, 2020 and concluding at the close of December 31, 2020, shall not be counted for purposes of determining an FCU’s compliance with the regulatory time periods.

Letters to Credit Unions 20-CU-08 Enhancements to CLF Membership & Borrowing Authority

April 2020

NCUA’s LTCU 20-CU-08 provides credit unions information about changes to the Central Liquidity Facility (CLF) as a result of the passage of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The operations of the CLF are governed by Title III of the Federal Credit Union Act (FCUA) and § 725 of NCUA’s rules.

Legislative Changes to the CLF

The CARES Act made several temporary changes to Title III of the FCUA that will sunset on December 31, 2020:

• The CARES Act increased the CLF’s borrowing capacity to 16x the subscribed capital stock and surplus (retained earnings) of the CLF.
• The CARES Act temporarily provides NCUA authority to allow agents subscribe to CLF stock on behalf of a smaller subset of members rather than the existing requirement of a subscription for ALL members.
• The CARES Act changed the definition of “liquidity needs” to include the needs of any credit union: allowing corporate credit unions to borrow for their own needs.
• The CARES Act removed the prohibition against NCUA approving borrowing intended to “expand credit union portfolios,” giving NCUA more flexibility and discretion to approve loans for credit unions that have made a reasonable effort to first utilize primary sources of funding.

Regulatory Changes to the CLF

NCUA has issued an interim final rule making additional changes to the CLF. Some of the NCUA changes are temporary and some are permanent. NCUA has:

• Permanently eliminated the 6-month waiting period for a new member to receive a loan – Under the new rule, new regular and agent members can borrow as soon as they complete the new member documents and pay the required capital stock amount.
• Temporarily amended the waiting period for a credit union to terminate its CLF membership – A credit union seeking to withdraw from CLF membership anytime until December 31, 2020, may do so on 6 months written notice. Between December 31, 2020 and December 31, 2021, a credit union may withdraw immediately upon written notice. After December 31, 2021, the temporary termination provisions will expire, and a credit union could terminate its membership after 6 or 24 months under the pre-COVID existing rules.
• Permanently eased collateral requirements – Under the new rule, the amount of collateral required for an advance will be determined from the CLF’s collateral margins table, published on the NCUA’s website. The required collateral percentages vary based on different types of assets which may result in lower collateral requirements in some cases.
• Temporarily permitting an agent member to borrow for its own liquidity needs – Corporate credit unions may borrow from the CLF subject to the same creditworthiness and liquidity-need criteria as for all other members.

Complete information on the CLF is available on NCUA’s CLF webpage on the agency’s website.

NCUA Risk Alert: 20-Risk-01 Cybersecurity Considerations for Remote Work

April 2020

Common cybersecurity risks for remote workers include Malware attacks, Phishing and other social engineering attacks, and Advance Persistent Threat (APT) attacks.

NCUA issued Risk Alert 20-Risk-01 to remind credit unions of the need to ensure that employees working remotely adhere to sound cyber hygiene on their home networks, personal computing devices, and other internet-connected devices. Credit unions must exercise controls over remote work commensurate with the institution’s size and complexity and be prepared to respond to any incidents that may occur.

Preparing Employees to Prevent Security Incidents

Credit unions should be communicating with remote employees to verify that work is being done securely. To minimize the risk of a successful cyber attack on remote employees, credit union policies should address issues such as:

• Ensuring that family members or others do not use employee’s designated work device and that employees keep devices physically secure;
• Encrypting sensitive information, using strong encryption options for wireless systems, and implementing session time outs;
• Ensuring employees are working with a user account and not an administrator or privileged account and establishing strong, unique passwords for all log-ins and devices on the employee’s home network;
• Leveraging firewall capabilities available through internet service providers;
• Updating software and removing unnecessary services and software;
• Ensuring system and account logs are being collected and maintained

Responding to a Security Incident

Credit union policies for remote employees should address actions the employee should take if they suspect a cyber incident and what responses the credit union will take.

Cybersecurity Resources

Additional resources are available at:

• DHS Cybersecurity & Infrastructure Security Agency, Security Tips for Home Network Security
• NIST Special Publication 800-46r2, Guide to Enterprise Telework, Remote Access and Bring Your Own Device (BYOD) Security
• Information Sharing and Analysis Organization groups, such as the FS-ISAC and the NCU-ISAO. The NCU-ISAO also has a complete list of Information Sharing Groups on its website .