NCUA UPDATE

Utah’s Credit UnionsChairman/CEO and Volunteer

ConferenceOctober 10, 2014

Elizabeth A. WhiteheadNCUA Region V Director

2

Agenda

1. National Trends

2. Examination Modernization

3. 2014 Exam Priorities

Risks on the Horizon

Credit Union Industry’s Trends

Positive Trends in U.S. Credit Unions2010 – 2014

Year-End 2009 Year-End 2010 3RD Qtr. 2012

Year-End2011

Year-End2012

Year-End2013

2nd-Quarter2014

Return on Assets 0.67 % 0.85% 0.78% 0.81 %

Net Worth 10.21 % 10.43 % 10.77 % 10.77 %

Loan Growth +1.2 % + 4.6 % + 7.97 % + 8.91 %

Loan Delinquencies 1.60 % 1.16% 1.01 % 0.85%

Net Charge-offs 0.91 % 0.73 % 0.57 % 0.49 %

Membership Growth + 1.5% + 2.2 % + 2.56 % + 3.63 %

3

Risks on the Horizon

Utah Credit Unions’ Performance

Trends in Utah Credit UnionsCompared to U.S. Credit Unions

Year-End 2009 Year-End 2010 3RD Qtr. 2012

Year-End2011

Year-End2012

Year-End2013

2nd-Qtr.2014

U.S. Credit Unions

Return on Assets 0.56 % 1.20 % 1.45 % 1.36 % 0.81%

Net Worth 8.8 % 9.4 % 10.27 % 10.40 % 10.77 %

Loan Growth - 3.5% +3.9 % +8.54 % + 12.58 % + 8.91 %

Delinquencies 2.37 % 1.47 % 1.24 % 0.72 % 0.85 %

Net Charge-offs 1.53 % 1.06 % 0.55 % 0.43 % 0.49%

Membership +0.2 % + 4.4% + 4.26 % + 6.37 % + 3.63 %

5

Improving Credit Risk

1990

1991

1992

1993

1994

1995

1996

1997

1998

1999

2000

2001

2002

2003

2004

2005

2006

2007

2008

2009

2010

2011

2012

2013

Mar-14

0.0%

0.2%

0.4%

0.6%

0.8%

1.0%

1.2%

1.4%

1.6%

1.8%

2.0%

Credit Risk Trends

PLLL Exp to Avg Assets Delinquency Net Charge Offs

October 9, 2014

6

2008 2009 2010 2011 2012 2013 416990

500

1,000

1,500

2,000

2,500

1,5261,648

1,818 1,7261,563 1,480 1,471

243

312

341374

348302 295

11

16

19 21

12

7 11

CAMEL 3 CAMEL 4 CAMEL 5

Problem Credit Unions Decreasing

CAMEL 3, 4, and 5 Institutions

7

Number of Institutions (by asset size)

< $50 $50-250 250 - $1B >$1 B Total0

2000

4000

6000

8000

10000

12000

7891

1353

37270

9686

4245

1460

568218

6491

2002 2014

Decline in Number of Credit Unions

8

Total Assets: $1.01 Trillion

Three Credit Union Profiles

Small Mid Large0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

65%

23%

12%6%

15%

79%

Percent Units Percent Assets

$250M$50M

4,245

1,460786

9

EXAMMODERNIZATION

10

Completed Initiatives

• Restored annual exam cycle for federal credit unions and larger FISCUs

• Established Office of National Examination and Supervision (ONES)–Corporate credit unions and NPCUs with

more than $10 billion in assets• Developed National Supervision Policy

Manual• Implemented Small Credit Union Exam

Program

11

Completed Initiatives

• Exam Modernization (LCU 13-CU-09)– Updated exam report cover letter – Separated DOR and Findings– Simplified Overview, DOR includes full discussion

of material problems– DOR status report– Status update template– Removed informal discussion items– Controls over DORs (cessation, follow-up,

communication with management)

12

Initiatives in Process

• Small credit union exam techniques• Enhanced questionnaire workbook• Update of Examiner’s Guide• AIRES update

• Loan, Investment, Shares and ALM Analytics• Value added analytics reports available to CUs• Better coordination in pre-exam process = less

time onsite(?)

13

2014 EXAMPRIORITIES

14

Key Risks

• Interest Rate Risk• Cybersecurity• Fraud

New Requirements

• Participation loans• Liquidity• CUSO• Mortgage rules

15

New RequirementsNew Rule Effective Date

Participation LoansLCU 13-CU-07

September 23, 2013

Liquidity FundingLCU 13-CU-10

March 31, 2014

CUSOsLCU 13-CU-13 and LCU 14-CU-07

June 30, 2014** Registry when active

CFPB Mortgage RulesLCU 14-CU-01 Regulatory Alert 14-RA-01

January 10, 2014

16

20-Year Real Estate Loan Trends

Changing Credit Union Balance Sheets19

92

1993

1994

1995

1996

1997

1998

1999

2000

2001

2002

2003

2004

2005

2006

2007

2008

2009

2010

2011

2012

2013

*

-

100,000,000,000

200,000,000,000

300,000,000,000

400,000,000,000

500,000,000,000

600,000,000,000

700,000,000,000

Car Loans Credit CardsOther Real Estate

1992: 34% of loans

2013: 53% of loans

Increasing concentration results in increased interest rate risk sensitivity and slower increases in yields

17

Changing Credit Union Balance Sheets

-

100,000,000,000

200,000,000,000

300,000,000,000

400,000,000,000

500,000,000,000

600,000,000,000

700,000,000,000

800,000,000,000

900,000,000,000

1,000,000,000,000

Regular Shares Share Drafts Other Money Market Certificates

1990: volatile shares = 34% of shares

2013: volatile shares = 45% of shares

20-Year Share Trends

Increasing volatility and sensitivity from funding sources means costs will rise faster

18

Interest Rate Risk

• Sophisticated balance sheets demand sophisticated and robust analysis

• Interest rate risk rule in place (Part §741.3(b)(5)(i) of NCUA Rules and Regulations)

– Requires written IRR policy and effective risk management programs

– Rule does not apply to credit unions with less than $50 million in assets

– Excess risk will be addressed through supervisory action

19

Web Services in FICUs

Cybersecurity

250750

1,2501,7502,2502,7503,2503,7504,2504,750

2,500,0007,500,00012,500,00017,500,00022,500,00027,500,00032,500,00037,500,00042,500,000

Cybersecurity risk affects credit unions of all shapes and sizesNearly half of all FICU members use a transactional website

20

Cyber Security• Growing Risk Exposure

– Size is not so important for criminals anymore– Inter-connectedness compounds risk

• Some key fronts– Financial Risk – Loss of Assets – Account Takeovers

• $136 cost per capita worldwide - $188 in U.S. (source Ponemon Institute 2013 Study)

– Reputation/financial Risk – loss of personal data function (ID Theft)• Target - Profit down 46% sales fell 5.3% since breach.

(CBSnews.com)– 860+ Million Records Stolen since 2005 (privacy rights.org)

21

Cyber Security

Some Recent Examples

• Target Breach - 40 million + records• Heartbleed – 2 year vulnerability in SSL• Internet Explorer vulnerability – May 2014• AOL Breach – April 2014 • Michaels – April 2014 - 8 million card numbers• CU Corporate Acct takeover - $100k outgoing

before Corporate CU stopped.• DDOS Attacks on FICUs in 2013

22

Cybersecurity Key Fronts

• Financial risk (loss of assets, account takeovers)– $136 cost per capita worldwide– $188 cost per capita in U.S.

• Reputation/financial risk (loss of personal data function, ID theft)– 860+ million records stolen since 2005– Target Corporation’s profits fell 46%; sales fell

5.3% following data breach (CBSnews.com)

23

Cybersecurity Program Elements

• Cyber governance, cyber risk management, resources, training and culture

1) Cyber risk management and oversight

• Intelligence gathering, monitoring and analyzing, information sharing

2) Threat intelligence and collaboration

• Preventative, detective, and corrective controls

3) Cybersecurity controls

• Connections, relationships and responsibilities

4) External dependency management

• Incident detection and response, mitigation, escalation and reporting, resilience

5) Cyber incident management and resilience

Recent Fraud Areas in Credit Unions

Lending

ChangeFund

Corporate

Accts.

Major Areas of Control WeaknessesLending

Lending Process – Employee with ability to create and disburse loan without review

Improvement:• - Employee with no other lending

ability use New Loan report to verify

• - Remove create or disburse ability

Major Areas of Control WeaknessesChange Fund

Vault & Change Fund Account – Head Teller with access to general ledger and control over physical vault and

change fund

Improvement: Dual counting of vault with independent reconciliation of count to general ledger

Major Areas of Control WeaknessesIT Controls

IT Employees with unlimited restriction – Employee has unlimited access to data processing system with no oversight.

Improvement: : Review of IT employee transactions by employee independent of IT access. Reality is that this is very difficult to control.

Internal Control Realities

Good policies don’t equate to good

controlsManagement override trumps all

good controls

Collusion between employees beats all controls

Very challenging to implement good

controls in small CU

Supervisory Committees provide little to no comfort

29

Types of Fraud

• Financial Statement Fraud

•Misappropriation of Assets

30

Financial Statement Fraud

• Mask delinquent loans (bumping due dates)• Defer Loan charge offs (rewrite bad loans)• Increase earnings for year end bonuses

(usually ALLL account)• Increase asset size for CEO contract

negotiations (share CD specials)• Hide incompetency

31

Misappropriation of Assets

• Stealing “borrowing” cash from change fund or teller drawers

• Fictitious loan and loan payments• Unrecorded share deposits• Loans to family and friends• Unrecorded non-member share deposits

32

Fraud Hot Spots

• Poor accounting/internal controls or un-reconciled accounts (corporate statement)

• Fictitious and fraudulent loans • Dormant/inactive accounts• Un-cleared overdrafts• Unrecorded shares• No internal audit function

33

Internal Controls to Mitigate Losses

• Adopting travel expense policies and controls• Implementing a whistleblower policy• Restricting access to CU’s GL and corporate

accounts, staff and related-party accounts.• Segregating duties • Rotating employee duties• Fraud training with emphasis on fraud prevention• Conducting mandatory investigations of all out-of-

balances or shortages

34

Control Framework

• Board Policies• Budget and Plans• Reports/Reporting

Tier 1 Governance

• Procedures• Segregation• Control Reports

Tier 2Management

• Internal Audits• External Audit• Active Oversight

Tier 3Supervisory Committee

Controls can vary with the complexity of the organization

Small institutions often have limited segregation of duties

35

Contact NCUA

National Credit Union AdministrationRegion V – Tempe, AZ

602-302-6000

region5@ncua.gov