NCUA UPDATE
Utah’s Credit UnionsChairman/CEO and Volunteer
ConferenceOctober 10, 2014
Elizabeth A. WhiteheadNCUA Region V Director
2
Agenda
1. National Trends
2. Examination Modernization
3. 2014 Exam Priorities
Risks on the Horizon
Credit Union Industry’s Trends
Positive Trends in U.S. Credit Unions2010 – 2014
Year-End 2009 Year-End 2010 3RD Qtr. 2012
Year-End2011
Year-End2012
Year-End2013
2nd-Quarter2014
Return on Assets 0.67 % 0.85% 0.78% 0.81 %
Net Worth 10.21 % 10.43 % 10.77 % 10.77 %
Loan Growth +1.2 % + 4.6 % + 7.97 % + 8.91 %
Loan Delinquencies 1.60 % 1.16% 1.01 % 0.85%
Net Charge-offs 0.91 % 0.73 % 0.57 % 0.49 %
Membership Growth + 1.5% + 2.2 % + 2.56 % + 3.63 %
3
Risks on the Horizon
Utah Credit Unions’ Performance
Trends in Utah Credit UnionsCompared to U.S. Credit Unions
Year-End 2009 Year-End 2010 3RD Qtr. 2012
Year-End2011
Year-End2012
Year-End2013
2nd-Qtr.2014
U.S. Credit Unions
Return on Assets 0.56 % 1.20 % 1.45 % 1.36 % 0.81%
Net Worth 8.8 % 9.4 % 10.27 % 10.40 % 10.77 %
Loan Growth - 3.5% +3.9 % +8.54 % + 12.58 % + 8.91 %
Delinquencies 2.37 % 1.47 % 1.24 % 0.72 % 0.85 %
Net Charge-offs 1.53 % 1.06 % 0.55 % 0.43 % 0.49%
Membership +0.2 % + 4.4% + 4.26 % + 6.37 % + 3.63 %
5
Improving Credit Risk
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
Mar-14
0.0%
0.2%
0.4%
0.6%
0.8%
1.0%
1.2%
1.4%
1.6%
1.8%
2.0%
Credit Risk Trends
PLLL Exp to Avg Assets Delinquency Net Charge Offs
October 9, 2014
6
2008 2009 2010 2011 2012 2013 416990
500
1,000
1,500
2,000
2,500
1,5261,648
1,818 1,7261,563 1,480 1,471
243
312
341374
348302 295
11
16
19 21
12
7 11
CAMEL 3 CAMEL 4 CAMEL 5
Problem Credit Unions Decreasing
CAMEL 3, 4, and 5 Institutions
7
Number of Institutions (by asset size)
< $50 $50-250 250 - $1B >$1 B Total0
2000
4000
6000
8000
10000
12000
7891
1353
37270
9686
4245
1460
568218
6491
2002 2014
Decline in Number of Credit Unions
8
Total Assets: $1.01 Trillion
Three Credit Union Profiles
Small Mid Large0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
65%
23%
12%6%
15%
79%
Percent Units Percent Assets
$250M$50M
4,245
1,460786
9
EXAMMODERNIZATION
10
Completed Initiatives
• Restored annual exam cycle for federal credit unions and larger FISCUs
• Established Office of National Examination and Supervision (ONES)–Corporate credit unions and NPCUs with
more than $10 billion in assets• Developed National Supervision Policy
Manual• Implemented Small Credit Union Exam
Program
11
Completed Initiatives
• Exam Modernization (LCU 13-CU-09)– Updated exam report cover letter – Separated DOR and Findings– Simplified Overview, DOR includes full discussion
of material problems– DOR status report– Status update template– Removed informal discussion items– Controls over DORs (cessation, follow-up,
communication with management)
12
Initiatives in Process
• Small credit union exam techniques• Enhanced questionnaire workbook• Update of Examiner’s Guide• AIRES update
• Loan, Investment, Shares and ALM Analytics• Value added analytics reports available to CUs• Better coordination in pre-exam process = less
time onsite(?)
13
2014 EXAMPRIORITIES
14
Key Risks
• Interest Rate Risk• Cybersecurity• Fraud
New Requirements
• Participation loans• Liquidity• CUSO• Mortgage rules
15
New RequirementsNew Rule Effective Date
Participation LoansLCU 13-CU-07
September 23, 2013
Liquidity FundingLCU 13-CU-10
March 31, 2014
CUSOsLCU 13-CU-13 and LCU 14-CU-07
June 30, 2014** Registry when active
CFPB Mortgage RulesLCU 14-CU-01 Regulatory Alert 14-RA-01
January 10, 2014
16
20-Year Real Estate Loan Trends
Changing Credit Union Balance Sheets19
92
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
*
-
100,000,000,000
200,000,000,000
300,000,000,000
400,000,000,000
500,000,000,000
600,000,000,000
700,000,000,000
Car Loans Credit CardsOther Real Estate
1992: 34% of loans
2013: 53% of loans
Increasing concentration results in increased interest rate risk sensitivity and slower increases in yields
17
Changing Credit Union Balance Sheets
-
100,000,000,000
200,000,000,000
300,000,000,000
400,000,000,000
500,000,000,000
600,000,000,000
700,000,000,000
800,000,000,000
900,000,000,000
1,000,000,000,000
Regular Shares Share Drafts Other Money Market Certificates
1990: volatile shares = 34% of shares
2013: volatile shares = 45% of shares
20-Year Share Trends
Increasing volatility and sensitivity from funding sources means costs will rise faster
18
Interest Rate Risk
• Sophisticated balance sheets demand sophisticated and robust analysis
• Interest rate risk rule in place (Part §741.3(b)(5)(i) of NCUA Rules and Regulations)
– Requires written IRR policy and effective risk management programs
– Rule does not apply to credit unions with less than $50 million in assets
– Excess risk will be addressed through supervisory action
19
Web Services in FICUs
Cybersecurity
250750
1,2501,7502,2502,7503,2503,7504,2504,750
2,500,0007,500,00012,500,00017,500,00022,500,00027,500,00032,500,00037,500,00042,500,000
Cybersecurity risk affects credit unions of all shapes and sizesNearly half of all FICU members use a transactional website
20
Cyber Security• Growing Risk Exposure
– Size is not so important for criminals anymore– Inter-connectedness compounds risk
• Some key fronts– Financial Risk – Loss of Assets – Account Takeovers
• $136 cost per capita worldwide - $188 in U.S. (source Ponemon Institute 2013 Study)
– Reputation/financial Risk – loss of personal data function (ID Theft)• Target - Profit down 46% sales fell 5.3% since breach.
(CBSnews.com)– 860+ Million Records Stolen since 2005 (privacy rights.org)
21
Cyber Security
Some Recent Examples
• Target Breach - 40 million + records• Heartbleed – 2 year vulnerability in SSL• Internet Explorer vulnerability – May 2014• AOL Breach – April 2014 • Michaels – April 2014 - 8 million card numbers• CU Corporate Acct takeover - $100k outgoing
before Corporate CU stopped.• DDOS Attacks on FICUs in 2013
22
Cybersecurity Key Fronts
• Financial risk (loss of assets, account takeovers)– $136 cost per capita worldwide– $188 cost per capita in U.S.
• Reputation/financial risk (loss of personal data function, ID theft)– 860+ million records stolen since 2005– Target Corporation’s profits fell 46%; sales fell
5.3% following data breach (CBSnews.com)
23
Cybersecurity Program Elements
• Cyber governance, cyber risk management, resources, training and culture
1) Cyber risk management and oversight
• Intelligence gathering, monitoring and analyzing, information sharing
2) Threat intelligence and collaboration
• Preventative, detective, and corrective controls
3) Cybersecurity controls
• Connections, relationships and responsibilities
4) External dependency management
• Incident detection and response, mitigation, escalation and reporting, resilience
5) Cyber incident management and resilience
Recent Fraud Areas in Credit Unions
Lending
ChangeFund
Corporate
Accts.
Major Areas of Control WeaknessesLending
Lending Process – Employee with ability to create and disburse loan without review
Improvement:• - Employee with no other lending
ability use New Loan report to verify
• - Remove create or disburse ability
Major Areas of Control WeaknessesChange Fund
Vault & Change Fund Account – Head Teller with access to general ledger and control over physical vault and
change fund
Improvement: Dual counting of vault with independent reconciliation of count to general ledger
Major Areas of Control WeaknessesIT Controls
IT Employees with unlimited restriction – Employee has unlimited access to data processing system with no oversight.
Improvement: : Review of IT employee transactions by employee independent of IT access. Reality is that this is very difficult to control.
Internal Control Realities
Good policies don’t equate to good
controlsManagement override trumps all
good controls
Collusion between employees beats all controls
Very challenging to implement good
controls in small CU
Supervisory Committees provide little to no comfort
29
Types of Fraud
• Financial Statement Fraud
•Misappropriation of Assets
30
Financial Statement Fraud
• Mask delinquent loans (bumping due dates)• Defer Loan charge offs (rewrite bad loans)• Increase earnings for year end bonuses
(usually ALLL account)• Increase asset size for CEO contract
negotiations (share CD specials)• Hide incompetency
31
Misappropriation of Assets
• Stealing “borrowing” cash from change fund or teller drawers
• Fictitious loan and loan payments• Unrecorded share deposits• Loans to family and friends• Unrecorded non-member share deposits
32
Fraud Hot Spots
• Poor accounting/internal controls or un-reconciled accounts (corporate statement)
• Fictitious and fraudulent loans • Dormant/inactive accounts• Un-cleared overdrafts• Unrecorded shares• No internal audit function
33
Internal Controls to Mitigate Losses
• Adopting travel expense policies and controls• Implementing a whistleblower policy• Restricting access to CU’s GL and corporate
accounts, staff and related-party accounts.• Segregating duties • Rotating employee duties• Fraud training with emphasis on fraud prevention• Conducting mandatory investigations of all out-of-
balances or shortages
34
Control Framework
• Board Policies• Budget and Plans• Reports/Reporting
Tier 1 Governance
• Procedures• Segregation• Control Reports
Tier 2Management
• Internal Audits• External Audit• Active Oversight
Tier 3Supervisory Committee
Controls can vary with the complexity of the organization
Small institutions often have limited segregation of duties
35
Contact NCUA
National Credit Union AdministrationRegion V – Tempe, AZ
602-302-6000