(Oct. 22, 2021) Eligible low-income credit unions (LICUs) may accept 30-year subordinated debt investments from a Treasury program meant to encourage the institutions to augment efforts to support small businesses and consumers, NCUA announced Thursday.
In a letter to credit unions (LTCU 21-CU-11) Thursday, the agency said the LICUs may accept the subordinated debt investments from the Treasury Department’s Emergency Capital Investment Program (ECIP). In addition, the agency said, the credit union may treat the investment as secondary capital in accordance with NCUA regulations. That is, provided that the LICU has an agency-approved secondary capital plan by year’s end.
According to NCUA Board Chairman Harper, the policy will allow ECIP-participating credit unions to fulfill that statutory mission and advance economic equity and justice. “Going forward, the NCUA will pursue additional action to permit ECIP funding to count as regulatory capital for the entire time it is held,” he said.
The agency’s subordinated debt rule, adopted in January, includes a 20-year limitation on the regulatory capital treatment of “Grandfathered Secondary Capital,” NCUA said. That is defined as any secondary capital issued under a secondary capital plan that was approved by the NCUA before Jan. 1, 2022. The agency indicated it plans, in the future, to clarify that ECIP participating credit unions may count ECIP funding as regulatory capital for the entire time it is held.
NCUA said the latest LTCU is the second step in a three-step process for ensuring credit unions can use ECIP. The first step was a proposed rule issued earlier this year to allow eligible credit unions to accept ECIP funding in 2022 without having to fill out a new subordinated debt application after the effective date of the new rule. The third step, according to the agency, will be more NCUA action – “sometime in 2022” — to permit ECIP funding to count as regulatory capital for the entire time it is held.
LINK:
NCUA LTCU 21-CU-11: Emergency Capital Investment Program Participation
(Oct. 22, 2021) An “S” for “market sensitivity” is now part of the NCUA exam rating system, thanks to a unanimous vote by the agency board at its Thursday meeting – and long-term advocacy by NASCUS – bringing the agency in line with a policy already adopted by more than half of all state regulators.
The rule also redefines the “L” component (liquidity risk) of the rating system.
The new rating – which effectively renames the rating system “CAMELS” – will take effect April 1, 2022.
Adding the “S” component, according to NCUA, will allow the agency and federally insured credit unions to better distinguish between liquidity risk (“L”) and sensitivity to market risk (“S”). Also, the amendment will enhance consistency between the regulation and supervision of credit unions and other financial institutions.
The CAMELS proposal was issued in January and approved for public comment on a unanimous NCUA Board vote. As proposed, the rule would bring NCUA’s rating system up to date with a change that banking regulators incorporated decades ago and satisfy a recommendation the agency’s inspector general has been recommending for about the past five years.
More than five years ago, NASCUS wrote to NCUA urging the change and adding the “S” component. “NASCUS and state supervisory agencies encourage NCUA to consider earlier adoption of ‘CAMELS,’” NASCUS’ Lucy Ito wrote in the June 2016 letter to the board. “We again note that the separation of the ‘S’ component does not require a credit union to develop additional management system enhancements where market risk is already appropriately identified, measured, monitored and managed as part of the ‘L’ component.”
She also noted that in states that have adopted CAMELS (now totaling 25 – up from 16 when Ito penned the letter in 2016), that regulators and credit unions have reported positive outcomes with nearly no additional regulatory burden.
In its comment letter filed last spring, NASCUS said there is no need to “reinvent the wheel and develop a credit union CAMELS Rating System that diverges from the established CAMELS system currently in use in bank supervision and in the states that have adopted CAMELS for credit union supervision.”
In the final rule commentary issued Thursday, NCUA stated that the updated rating system is based on (and consistent with) the Uniform Financial Institutions Rating System (UFIRS) system used by NCUA and the banking regulators. However, the commentary noted, NCUA has made certain minor, non-substantive modifications to the rating descriptions to clarify and better reflect supervision of credit unions. “Notwithstanding this slight divergence from UFIRs, the Board has determined that the NCUA’s revised rating system is consistent with the other financial supervisors,” NCUA said.
Agency staff also told the board that, in their view, the new rule will have little, if any, impact on the 20 state regulators (and their credit unions) that do not yet have the S component in their exam ratings.
LINKS:
Final Rule: CAMELS Rating System
NASCUS comment: Notice of Proposed Rulemaking Regarding CAMELS Rating System
(Oct. 22, 2021) NASCUS President and CEO Lucy Ito congratulated the NCUA Board for finalizing an “S” component (for market sensitivity) to the CAMEL rating system (making it now “CAMELS”) at its Thursday meeting (and adjusting the “L” component, accordingly, for liquidity). She also thanked Board Member Hood for responding to NASCUS’ recommendation to introduce the change, which he did early this year – something NASCUS has advocated for years.
“To date, 25 states have implemented CAMELS and two additional states are scheduled to do so by Jan. 1,” Ito said. “Without exception, all states that have already adopted CAMELS report a very smooth and seamless transition for credit unions including smaller asset sizes as all credit unions are already monitoring market risk under the L component. Indeed, under CAMEL, credit unions can be ‘dinged’ unfairly. If their liquidity and sensitivity to market risk are rated differently, the lower rating will prevail for the L component. The addition of the ‘S’ component will not only be fairer, it will also position both credit unions and examiners to more effectively monitor and evaluate interest rate risk as the U.S. enters an uncertain interest rate environment.”
(Oct. 22, 2021) Speaking of cybersecurity: Use of cloud-based email services are proving to be targets for cybercriminals, and credit unions need to take steps to thwart any exploitation and take preventative steps, NCUA said this week.
In Risk Alert 21-RISK-01, the agency said phishing emails designed to steal account credentials through cloud-based email services have proven to be among the most effective types of business email compromise (BEC) scams. The agency said that action occurs by cybercriminals using phishing kits to target victims on cloud-based services, analyze accounts, impersonate email communications, fraudulently demand (and receive) payments, compromise address books, send more phishing emails — and more.
The risk alert listed 12 methods credit unions may take to prevent BEC fraud; the top three are: Enable multi-factor authentication for all email accounts; disable basic or legacy account authentication that does not support multi-factor authentication; use caution when posting information on social media and company websites, especially job duties and descriptions, hierarchal information, and out-of-office details.
The risk alert also notes wire transfer fraud incidents are also increasing, as more transactions through virtual environments have tilted that way. The alert lists a number of operational, transactional, and physical and logical controls for limiting wire fraud risk and incidents.
LINK:
(Oct. 22, 2021) The state system supports the NCUA proposed rule establishing a “complex credit union leverage ratio” (CCULR), as well as a quick implementation of a final regulation, but also has key considerations for the agency before it finalizes the rule, NASCUS wrote in its comment letter this week.
More specifically, NASCUS wrote that subordinated debt should be permitted in calculating net worth for CCULR thresholds; that complex credit unions of all sizes can appropriately manage the optionality of both entering and exiting the CCULR; and changes are needed to the current (and proposed) risk-based capital (RBC) and subordinated debt rules in order to avoid a “chilling effect” on the low-income credit union (LICU) secondary capital system.
The NASCUS letter was in response to a call for comments issued by NCUA in July for its proposal to make a simplified measure of capital adequacy available to federally insured credit unions defined as “complex” – meaning those with more than $500 million in assets. According to NCUA, the CCULR framework is comparable to the community bank leverage ratio (CBLR) that went into effect in January 2020 for banks under the 2018 financial regulatory relief law. That rule allows banks to hold a certain, uniform level of capital (now at 9% of assets) as long as they meet certain conditions, including in lending and investments.
Under the NCUA proposed rule, a complex credit union that opts into the CCULR framework and maintains the minimum net worth ratio would be considered well capitalized. For the CCULR, that would begin with 9% as of Jan. 1, 2022, and rise gradually to 10% by Jan. 1, 2024. The credit union would not be required to calculate a risk-based capital ratio under the Oct. 29, 2015, risk-based capital final rule, which also takes effect Jan. 1, 2022. Other qualifying criteria for the proposed framework include: off-balance-sheet exposures equal to 25% or less of total assets; trading assets and trading liabilities that are 5% or less of total assets; and goodwill and other intangible assets that are 2% or less of total assets.
NASCUS wrote developing the CCULR would reduce regulatory burden for those complex credit unions opting-in and would allow them to redirect scarce resources toward other operational priorities, without compromising capital standards or endangering the credit union share insurance fund (SIF).
“By ensuring that the CCULR is available as an option to all complex credit unions, the NCUA can maximize synergy with the RBC rule, maintain flexibility, and achieve greater consistency with sound public policy and the Federal Credit Union Act,” NASCUS wrote. “Thus, the CCULR can achieve its purposes of providing optionality and regulatory relief to complex credit unions by allowing for more effective and efficient deployment capital in service of the members.”
NASCUS also urged the agency to make some additional considerations before finalizing the rule, which – as proposed – would take effect at the beginning of next year, the same date that the RBC rule is scheduled to take effect.
NASCUS recommended that that agency incorporate subordinated debt into the calculation of the CCULR net worth ratio. “Excluding subordinated debt from the CCULR would be an unfortunate step back from nearly a decade’s worth of work to modernize the credit union capital framework,” NASCUS wrote. “Allowing complex credit unions to access capital in addition to retained earnings to meet regulatory benchmarks is sound public policy.”
Further, NASCUS urged the agency provide credit unions with authority to opt in and out of the CCULR with the same flexibility that community banks have udder the CBLR (the proposal allows credit unions to open in at the end of a reporting quarter, and they can only opt out if they provide NCUA with at least 30 days prior notice; banks can do both at any time under their rule). NCUA, in its proposal, said the advance notice was required because credit unions do not have experience, yet, with calculating risk-based capital under the RBC, which takes effect at the beginning of next year.
“While it is true that complex credit unions have not been required to calculate the risk-based capital ratio pursuant to the 2015 final RBC rule, the fact is that the rule has been in place for several years and we believe many complex credit unions have familiarized themselves with the calculations in anticipation of previous, and now pending, effective date(s),” NASCUS asserted.
Finally, the state system urged NCUA to address ongoing concerns about whether the final Subordinated Debt rule is properly calibrated with respect to low-income designated credit unions (LICUs).
“LICUs are a critically important component of the credit union system providing services to predominantly low-income members,” NASCUS wrote. “While an overwhelming majority of LICUs are not subject to the RBC rule, they are subject to the 2020 Subordinated Debt rule. Given the genesis of the Subordinated Debt rule as a corollary to the RBC rule, it is appropriate that refinements to the subordinated debt framework be considered contemporaneously with changes to the RBC rule.”
(Oct. 22, 2021) “FedNow” – the Federal Reserve’s much-anticipated (and delayed) round the clock payment system – will be ready “sooner rather than later,” Federal Reserve Bank President Esther George (the “executive sponsor” of the Fed initiative) told a bankers’ group Tuesday, reiterating that a 2023 debut is on track. Her comments confirmed an announcement by the Fed made in February, also targeting 2023 as the debut for the system. Originally, the Fed had set the system’s debut for as late as 2024 … Likely in response to strong political pressure brought by both the credit union and banking industries, the Treasury this week raised the proposed threshold to $10,000 for reporting of balances at accounts held at credit unions and banks to the IRS. The banking industry immediately rejected the amended proposal (as it had the previous threshold of $600 or more). Under the proposal, meant to find and track account holders who are not paying their taxes, credit unions and banks would have to provide data on accounts with total annual deposits or withdrawals worth more than $10,000, not including payroll and beneficiary deposits … Large technology companies operating U.S. payments systems were ordered this week by the CFPB to provide information on their business practices, which CFPB said would help it better understand how the firms use personal payments data and manage data access to users in order to ensure adequate consumer protection. CFPB said the initial orders were sent to Amazon, Apple, Facebook, Google, PayPal, and Square. CFPB said it will also be studying the payment system practices of Chinese tech giants, including Alipay and WeChat Pay.
LINKS:
Statement by Secretary of the Treasury Janet L. Yellen on Congressional Tax Compliance Proposals
CFPB Orders Tech Giants to Turn Over Information on their Payment System Plans
(Oct. 22, 2021) Actions credit unions, banks and nonbanks alike should consider taking to ensure safe-and-sound practices during the transition away from the LIBOR reference rate were outlined in joint guidance this week by NCUA, the federal bank regulators, state credit union and bank regulators and the CFPB.
NCUA covered the joint statement in letter to credit unions (LTCU) 21-CU-10, Interagency Statement on LIBOR Transition. In the letter, NCUA noted that the regulators are emphasizing the expectation that credit unions and other supervised institutions with exposure to LIBOR (the London Interbank Offered Rate) will continue to progress toward an orderly transition away from LIBOR toward an alternative reference rate.
“The NCUA encourages all federally insured credit unions to transition away from using U.S. dollar LIBOR as a reference rate as soon as possible, but no later than Dec. 31, 2021, and to ensure existing contracts have robust fallback language that includes a clearly defined alternative reference rate,” the NCUA letter states.
LIBOR will be discontinued for new contracts after Dec. 31; existing contracts using LIBOR after that date must transition to an alternative by June 30, 2023.
CFPB said it joined the letter to highlight the consumer risks posed by the discontinuation of LIBOR, and urged credit unions, banks and nonbanks alike to continue their efforts to transition to alternative reference rates to mitigate consumer protection.
“The financial services industry uses LIBOR as a reference interest rate for many consumer financial products including mortgage loans, reverse mortgages, home equity lines of credit, credit cards, and student loans,” CFPB said in a press release. “The approaching discontinuation of most LIBOR tenors in June 2023 presents financial, legal, operational, and consumer protection risks. Additionally, consumers may not know when the transition from LIBOR will occur or how institutions will calculate their interest rates if they do not issue required disclosures to consumers.”
The regulators’ joint statement, among other things, urges financial institutions to ensure that no new contracts utilizing a LIBOR index reference rate are entered into after Dec. 31 – the day LIBOR becomes defunct. NCUA and the other regulators outlined supervisory considerations for financial institutions in transitioning away from LIBOR. Among them: clarification on the meaning of new LIBOR contracts, which stated that contracts entered into on or before Dec. 31 should either use a reference rate other than LIBOR or have fallback language that provides for use of a “strong and clearly defined alternative reference rate after LIBOR’s discontinuation.”
The statement also outlines considerations when assessing the appropriateness of alternative reference rates, expectations for fallback language and more.
Also this week, the OCC released an updated self-assessment tool to aid banks in their LIBOR transition. According to the agency, the tool is aimed at evaluating bank preparedness to deal with the end of the rate, particularly by helping banks evaluate their management processes for identifying and mitigating LIBOR transition risks.
LINKS:
NCUA LTCU 21-CU-10: Interagency Statement on LIBOR Transition
Joint Statement on Managing the LIBOR Transition
CFPB Joins Other Financial Regulatory Agencies in Issuing Statement on Discontinuation of LIBOR
LIBOR Transition: Updated Self-Assessment Tool for Banks
(Oct. 22, 2021) Ransonware risks and threats to credit unions and other financial institutions are rising considerably, the NCUA Board was told Thursday, noting that the method now accounts for 10% of all cyber breaches.
The threat, NCUA Critical Infrastructure Division Director Ernie Chambers told the board, is enabled by cryptocurrency and has been cited as “among the largest of cybersecurity threats” today to financial institutions.
The cybersecurity presentation was made to the board partly in advance the updated Automated Cybersecurity Evaluation Toolbox (ACET), which will be introduced by the agency in a webinar set for next week (Oct. 28).
Chambers also cited phishing and supply chain attacks as key threats to the credit union system; he urged institutions to take steps to address each.
“NASCUS applauds NCUA’s comprehensive approach to fostering credit union cybersecurity resilience,” NASCUS’s Lucy Ito said. In addition to NCUA’s enhanced ACET self-assessment tool, she said, NASCUS supports the agency’s plan for rolling out Information Technology Risk Examination for Credit Unions (InTRExCU) in 2022. The system is based on the FDIC’s InTREx program for banks and has been adapted for credit union use.
“Several state agencies are already utilizing FDIC’s InTREx tools in state credit union IT examinations,” Ito noted. “This early adoption of InTREx in state regulator supervisory programs combined with NCUA’s InTRExCU pilot, together provide proof of concept for the relevance and value of adopting InTREx more broadly as a tool for evaluating credit union cyber hygiene and exposure.”
She said with most credit union CEOs citing cybersecurity risks as their greatest concern, utilizing a proven, scalable examination tool such as InTREx should be a “welcome addition to the national credit union system’s collective arsenal.”
LINK:
NCUA Board Briefing, Cybersecurity (in PowerPoint format)
(Oct. 22, 2021) In yet another split decision over the issue, a final rule giving CUSOs the power to originate any type of loan an FCU may originate – and give the NCUA Board more flexibility in approving permissible CUSO activities and services – was approved by the board at its meeting Thursday.
The rule will become effective 30 days after publication in the Federal Register.
On a 2-1 vote (with Chairman Todd Harper dissenting), the board finalized the rule that – from the start – has been contentious. In January, when the proposal was issued, the board voted 2-1 in favor of issuing it for comment. In September, the board voted 2-1 to bring the final rule up for consideration. Harper dissented on all three.
NCUA said that it made no substantive changes from the proposal in finalizing the rule. The agency said the final rule is intended to accomplish two things: expand the list of permissible activities and services for CUSOs to include the origination of any type of loan that an FCU may originate; and grant the NCUA Board additional flexibility to approve permissible activities and services.
By allowing CUSOs to originate any type of loan an FCU can, the list of permissible loans by CUSOs is expanded from only business loans, consumer mortgage loans, student loans, and credit cards. The list of new loans includes automobile and small-dollar (payday) loans – the two types NCUA has said would likely draw the newest involvement by CUSOs.
Harper scorned the rule, saying (as he has in the past) that its adoption will result in a “wild west” among credit unions of affording “little accountability for consumer protection.” Board Member Rodney Hood, in his comments, disregarded Harper’s concerns, asserting that CUSOs are already largely regulated under state laws. He also told the board that the new rule doesn’t go far enough: it should allow, he said, CUSOs to invest directly into financial technology companies (fintechs) without requiring the fintechs to become CUSOs. Hood said he intended to work toward that end, and other expansions of the rule, in the remaining tenure of his term.
Vice Chairman Kyle Hauptman, in his comments, suggested that the rule could be tweaked in the future, to address any emerging issues or developments.
However, both Hood and Harper stated their continued support for giving NCUA exam authority over third-party vendors to credit unions.
In its comment filed on the proposal in late April, NASCUS noted as a key concern with the proposal that possible, additional reporting requirements for state credit unions could be a result of a finalized rule. NASCUS noted that the proposal could influence state credit unions considering collaborating with FCU investors in the formation and ownership of a CUSO – a condition that prompted the association to comment.
In some states, NASCUS pointed out, CUSOs owned by state credit unions already hold expanded lending power. The association noted, however, that the NCUA proposal could end up requiring additional reporting requirements that don’t today exist for SCUs. “NASCUS opposes extension of any additional reporting requirements to SCU CUSOs resulting from an expansion of FCU powers,” the association wrote.
NCUA, however, in its commentary on the final rule, rejected that view saying that it “does not believe the effect of this rule on CUSOs in which only FISCUs have an ownership interest represents a policy change” from existing NCUA reporting requirements.
Following the meeting, NASCUS’ Ito reiterated the point the association made in its comment letter last spring that CUSOs owned by state credit unions already hold expanded lending powers with benefits accruing to members and participating credit unions alike, without raising safety and soundness nor consumer protection concerns. She said NASCUS views the final rule as a “natural evolution“ in a robust dual charter system.
“However, we note that, as finalized, the CUSO rule includes additional reporting requirements which could impact state-chartered credit unions in considering whether to collaborate with FCU investors in the formation and ownership of a CUSO. An additional concern is whether the rule adds new reporting requirements to state credit union CUSOs, because of expanding FCU CUSO powers. Is there something wrong with this picture? NASCUS will review the final rule closely and look forward to working with NCUA to resolve any unintended, negative impacts on state credit union CUSOs.”
LINKS:
Final Rule, Part 712, Credit Union Service Organizations
NASCUS comment: Proposed Rule, Credit Union Service Organizations (CUSOs) – RIN 3133–AE95