NCUA’s 2024 Supervisory Priorities

In The News
Written By Sarah Cooke

Dear Boards of Directors and Chief Executive Officers:

This letter outlines the NCUA’s supervisory priorities and other updates to the agency’s 2024 examination program. We focus on the areas posing the highest risk to credit union members, the credit union industry, and the National Credit Union Share Insurance Fund (Share Insurance Fund).

The credit union system over the last year has remained largely stable in its performance and relatively resilient against economic disruptions. However, during 2023, the NCUA observed growing signs of financial strain on credit union balance sheets. The rise in interest rate and liquidity risks resulted in an increase in the number of composite CAMELS code 3, 4, and 5 credit unions. Inflation and interest rates are affecting household budgets, which could lead to an increase in credit risk in future quarters. Economists are also forecasting an economic slowdown as the lagged effects of elevated interest rates take hold. Each of these developments could affect credit union performance, create challenges for consumers, and pose a risk to the Share Insurance Fund in 2024.

The NCUA will continue to conduct onsite and offsite examination and supervision activities, as appropriate. Examiners may continue to conduct some examination activity offsite when it can be completed efficiently and effectively at credit unions that can accommodate offsite work.

The agency’s exam flexibility initiative will continue in 2024. This initiative provides an extended exam cycle for certain credit unions.1 The NCUA will also continue its Small Credit Union Exam Program in most federal credit unions with assets of $50 million or less. For all other credit unions, NCUA examiners will use the agency’s risk-focused examination procedures.

Below are the NCUA’s primary areas of supervisory focus in 2024.

Supervisory Priorities for 2024

Credit Risk

Credit risk remains a supervisory priority for 2024. Economic conditions continue to change the credit risk environment in the credit union industry, as inflation, high interest rates and borrowing costs, declining savings levels, and the end of pandemic-era stimulus and relief programs have negatively impacted some members’ ability to repay their debts. Credit unions’ loan portfolios expanded faster during 2022 than any year within the last 30 years, while aggregate loan performance began showing signs of deterioration in 2023.

NCUA examiners will review existing lending programs’ soundness and credit union risk management practices, including any adjustments a credit union made to loan underwriting standards, portfolio monitoring practices, modification and workout strategies for borrowers facing financial hardships, and collection programs. Examiners will carefully consider all factors in evaluating a credit union’s efforts to provide relief for borrowers, including whether the efforts were reasonable and conducted with proper controls and management oversight. Also, examiners will review policies and procedures related to the Allowance for Credit Losses (ACL), documentation of the ACL reserve methodology, the adequacy of ACL reserves, and adherence to generally accepted accounting principles.

For more resources, refer to the Examiner’s Guide and the following regulatory guidance:

Liquidity Risk

Credit unions will need to maintain strong liquidity risk management in 2024, due to increased uncertainty in interest rate levels and economic conditions. Pressure in deposit pricing and the use of wholesale funding is accelerating as alternative funding options, while new lending, participations, and loan sale markets may slow. Member behaviors and risk relationships are also changing, thus requiring a greater focus on forecasting assumptions, forward-looking cash flows and risk projections. The combined effect creates liquidity challenges and increased risk to earnings and capital.

Increased liquidity risk and uncertainty heighten the need for credit unions to prepare for contingency funding needs. Section 741.12(opens new window) of the NCUA’s regulations contains scaled credit union contingency funding plan expectations.

In July 2023, the NCUA issued Letter to Credit Unions 23-CU-06, Importance of Contingency Funding Plans, adding an addendum to the 2010 Interagency Policy Statement on Funding and Liquidity Risk Management(opens new window), reinforcing the need to adjust to changing market conditions. The NCUA will continue to examine institutions under this framework in 2024.

In evaluating the “L” component of CAMELS to determine the adequacy of a credit union’s liquidity risk management framework, examiners will continue to consider the current and prospective sources of liquidity compared to funding needs. Examiners will review the credit union’s policies, procedures, and risk limits, and also evaluate the adequacy of the credit union’s liquidity risk management framework relative to its size, complexity, and risk profile.

Examiners continue to assess liquidity management by evaluating:

  • The effects of changing interest rates on the market value of assets and borrowing capacity.

  • Scenario analysis for liquidity risk modeling, including possible member share migrations (for example, shifts from core deposits into more rate-sensitive accounts).

  • Scenario analysis for changes in cash flow projections for an appropriate range of relevant factors (for example, changing prepayment speeds).

  • The cost of various funding alternatives and their impact on earnings and capital.

  • The diversity of funding sources under normal and stressed conditions.

  • The appropriateness of contingency funding plans to address any plausible unexpected liquidity shortfalls.

Resources and guidance on liquidity risk can be found in the NCUA’s Examiner’s Guide and the Liquidity Risk Resources webpage.

Consumer Financial Protection

The NCUA will continue assessing federal credit unions’ compliance with applicable consumer financial protection laws and regulations. To determine areas of supervisory focus, the NCUA considers trends in violations identified through examinations and member complaints, emerging issues, and any recent changes to regulatory requirements. In 2024, examiners will accordingly focus on areas related to:

  • Overdraft programs.

  • Fair lending.

  • Auto lending, including review of indirect auto loans.

In 2024, examiners will continue an expanded review of credit unions’ overdraft programs, including website advertising, balance calculation methods, and settlement processes. The NCUA will also continue to evaluate adjustments credit unions made to their overdraft programs to address consumer compliance risk and potential consumer harm from unexpected overdraft fees.

Regarding fair lending, examiners will review policies and practices for redlining, marketing, and pricing discrimination risk factors.2

For auto lending, examiners will review credit unions’ disclosures, policies, and practices to assess compliance with the Truth in Lending Act as implemented by Regulation Z. Examiners will also review credit unions’ policies regarding Guaranteed Asset Protection insurance.

Lastly, examiners will continue to conduct reviews of credit unions’ policies and procedures governing compliance with flood insurance rules.

Information Security (Cybersecurity)

The evolving cybersecurity threat landscape poses persistent risks to credit unions. As credit union technology-related operating environments become ever more complex, it is crucial to establish a cybersecurity program that can adapt and evolve to counter these threats effectively.

Recognizing the importance of cybersecurity, the NCUA continues to prioritize this area as a key examination focus. Examiners will continue to assess whether credit unions have implemented robust information security programs to safeguard both members and the credit unions themselves. Examiners will continue to utilize the information security examination procedures in 2024, ensuring a thorough evaluation of cybersecurity measures.

The NCUA also implemented a new Cyber Incident Notification Reporting Rule, effective September 1, 2023, mandating federally insured credit unions swiftly — within 72 hours — notify the NCUA after the credit union reasonably believes that a reportable cyber incident has occurred. Credit unions should also notify the NCUA if a third-party provider experiences a cyber incident affecting the credit union.

The key steps to consider when implementing the reporting rule are found in the NCUA Letter to Credit Unions 23-CU-07, Cyber Incident Notification Requirements, and include:

  • Updating response plans.

  • Reviewing third-party contracts.

  • Training employees.

  • Monitoring and documenting incidents.

Credit unions can rely on Appendix B to Part 748 – Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice(opens new window) for guidance on cyber incident response. When reporting, omit sensitive data in the initial report; if more information is needed, the NCUA will request it.

Credit unions are strongly advised to maintain a high level of vigilance and continually enhance their ability to respond to evolving cybersecurity threats. To help in this endeavor, credit unions may conduct voluntary cybersecurity self-assessments using the Automated Cybersecurity Evaluation Toolbox. For access to more cybersecurity information and resources, including detailed information on examination procedures, credit unions are encouraged to visit the NCUA’s Cybersecurity Resources webpage. These resources provide valuable insights and guidance to help credit unions strengthen their cybersecurity stance and stay abreast of the latest developments.

Interest Rate Risk (IRR)

The tightening in U.S. monetary policy over the past two years has increased the importance of IRR management at credit unions. The higher interest rates continue to amplify market risk in asset and liability repricing mismatches and the overall management of IRR.

In evaluating the “S” CAMELS component, examiners will continue to evaluate whether a credit union proactively manages its IRR and the related risks to capital, asset quality, earnings, and liquidity. Examiners will review a credit union’s IRR program for the following key risk management and control activities:

  • Key assumptions and related data sets are reasonable and well documented.

  • Back testing and sensitivity testing of the assumption set.

  • The credit union’s overall level of IRR exposure is properly measured and controlled.

  • Results are communicated to decision-makers and the board of directors.

  • Proactive action is taken to remain within safe and sound policy limits.

More IRR resources are in Letter to Credit Unions 22-CU-09, Updates to Interest Rate Risk Supervisory Framework, Supervisory Letter 22-01, Updates to Interest Rate Risk Supervisory Framework, and the Examiner’s Guide.

Other Updates

Bank Secrecy Act (BSA) Compliance

BSA compliance continues to be a supervisory area of interest for the NCUA. A credit union’s deficiency in or failure to comply with the BSA’s programmatic, recordkeeping, and reporting requirements can pose a significant risk to the institution, its members, and the Share Insurance Fund. Credit unions play an important role in safeguarding our financial system and must remain vigilant in maintaining and updating their BSA policies, procedures, programs, and controls.

The NCUA will provide updates to credit unions regarding any regulatory changes to the BSA throughout 2024, as well as updates to supervisory expectations and examination procedures. Under the Anti-Money Laundering Act of 2020, the federal government must issue several rulemakings designed to improve, modernize, and strengthen the anti-money laundering and countering the financing of terrorism regulatory regime in the United States. These changes will impact future BSA requirements for credit unions.

For more BSA resources, visit the NCUA’s Bank Secrecy Act Resources webpage.

Support for Small Credit Unions and Minority Depository Institutions

In 2024, the NCUA remains committed to supporting and preserving small credit unions and minority depository institutions (MDIs) through its Small Credit Union and MDI Support Program (Support Program). Small credit unions and MDIs face unique risks and hurdles, and the NCUA will continue to offer custom support to eligible credit unions. Credit unions with less than $100 million in assets and MDIs of all asset sizes are eligible and can request assistance through their examiner or regional office. The NCUA recognizes the value small and MDI credit unions bring to members in underserved communities by offering access to safe, fair, and affordable loans and other financial products and services.

The benefits of this program are expected to include:

  • Expanded opportunities for qualifying credit unions to receive support through NCUA grants, training, and other initiatives;

  • Furthered partnerships with organizations and industry mentors that can support small credit unions and MDIs; and

  • Added support to credit union management in addressing operational challenges.

The agency also plans to enhance its MDI-specific examiner resources outlining procedures designed exclusively to guide examiners during their supervision of MDIs to recognize and support their unique business models.

Conclusion

In 2024, the NCUA will continue to evolve and improve how the agency supervises and supports credit unions. We are committed to adopting innovations and implementing efficient practices in our exam program. Our top objective of ensuring a safe and sound credit union system that protects credit union members can only be fulfilled when we adapt to the ever-changing economic and technological landscape.

If you have any questions about the NCUA’s supervisory priorities for 2024, please contact your NCUA examiner or regional office.

Sincerely,

/s/

Todd M. Harper
Chairman

Sarah Cooke
Previous

Tristate Collaboration, LLC Formalized to Create Value for Member Credit Unions
Next

A New Chapter Begins for The Tennessee Credit Union