NCUA UPDATE Utah’s Credit Unions Chairman/CEO and Volunteer Conference October 10, 2014 Elizabeth A. Whitehead NCUA Region V Director

Agenda 2 1.National Trends 2.Examination Modernization Exam Priorities

Risks on the Horizon Credit Union Industry’s Trends Positive Trends in U.S. Credit Unions 2010 – 2014 Year-End 2009Year-End RD Qtr Year-End 2011 Year-End 2012 Year-End nd -Quarter 2014 Return on Assets 0.67 %0.85%0.78%0.81 % Net Worth %10.43 %10.77 % Loan Growth +1.2 %+ 4.6 % % % Loan Delinquencies 1.60 %1.16%1.01 %0.85% Net Charge-offs 0.91 %0.73 %0.57 %0.49 % Membership Growth + 1.5%+ 2.2 % % % 3

Risks on the Horizon Utah Credit Unions’ Performance Trends in Utah Credit Unions Compared to U.S. Credit Unions Year-End 2009Year-End RD Qtr Year-End 2011 Year-End 2012 Year-End nd -Qtr U.S. Credit Unions Return on Assets 0.56 %1.20 %1.45 %1.36 %0.81% Net Worth 8.8 %9.4 %10.27 %10.40 %10.77 % Loan Growth - 3.5%+3.9 %+8.54 % % % Delinquencies 2.37 %1.47 %1.24 %0.72 %0.85 % Net Charge-offs 1.53 %1.06 %0.55 %0.43 %0.49% Membership +0.2 %+ 4.4% % % %

Improving Credit Risk 5 October 9, 2014

6 Problem Credit Unions Decreasing CAMEL 3, 4, and 5 Institutions

7 Number of Institutions (by asset size) Decline in Number of Credit Unions

8 Total Assets: $1.01 Trillion Three Credit Union Profiles $50M 4,245 1,

EXAM MODERNIZATION 9

Completed Initiatives 10 Restored annual exam cycle for federal credit unions and larger FISCUs Established Office of National Examination and Supervision (ONES) – Corporate credit unions and NPCUs with more than $10 billion in assets Developed National Supervision Policy Manual Implemented Small Credit Union Exam Program

Completed Initiatives 11 Exam Modernization (LCU 13-CU-09) – Updated exam report cover letter – Separated DOR and Findings – Simplified Overview, DOR includes full discussion of material problems – DOR status report – Status update template – Removed informal discussion items – Controls over DORs (cessation, follow-up, communication with management)

Initiatives in Process 12 Small credit union exam techniques Enhanced questionnaire workbook Update of Examiner’s Guide AIRES update Loan, Investment, Shares and ALM Analytics Value added analytics reports available to CUs Better coordination in pre-exam process = less time onsite(?)

2014 EXAM PRIORITIES 13

14 Key Risks Interest Rate Risk Cybersecurity Fraud New Requirements Participation loans Liquidity CUSO Mortgage rules

New Requirements 15 New RuleEffective Date Participation Loans LCU 13-CU-07 September 23, 2013 Liquidity Funding LCU 13-CU-10 March 31, 2014 CUSOs LCU 13-CU-13 and LCU 14-CU-07 June 30, 2014* * Registry when active CFPB Mortgage Rules LCU 14-CU-01 Regulatory Alert 14-RA-01 January 10, 2014

16 20-Year Real Estate Loan Trends Changing Credit Union Balance Sheets Increasing concentration results in increased interest rate risk sensitivity and slower increases in yields

17 Changing Credit Union Balance Sheets 20-Year Share Trends Increasing volatility and sensitivity from funding sources means costs will rise faster

Interest Rate Risk 18 Sophisticated balance sheets demand sophisticated and robust analysis Interest rate risk rule in place (Part §741.3(b)(5)(i) of NCUA Rules and Regulations) – Requires written IRR policy and effective risk management programs – Rule does not apply to credit unions with less than $50 million in assets – Excess risk will be addressed through supervisory action

19 Web Services in FICUs Cybersecurity Cybersecurity risk affects credit unions of all shapes and sizes Nearly half of all FICU members use a transactional website

Cyber Security 20 Growing Risk Exposure – Size is not so important for criminals anymore – Inter-connectedness compounds risk Some key fronts – Financial Risk – Loss of Assets – Account Takeovers $136 cost per capita worldwide - $188 in U.S. (source Ponemon Institute 2013 Study) – Reputation/financial Risk – loss of personal data function (ID Theft) Target - Profit down 46% sales fell 5.3% since breach. (CBSnews.com) – 860+ Million Records Stolen since 2005 (privacy rights.org)

Cyber Security 21 Some Recent Examples Target Breach - 40 million + records Heartbleed – 2 year vulnerability in SSL Internet Explorer vulnerability – May 2014 AOL Breach – April 2014 Michaels – April million card numbers CU Corporate Acct takeover - $100k outgoing before Corporate CU stopped. DDOS Attacks on FICUs in 2013

Cybersecurity Key Fronts 22 Financial risk (loss of assets, account takeovers) – $136 cost per capita worldwide – $188 cost per capita in U.S. Reputation/financial risk (loss of personal data function, ID theft) – 860+ million records stolen since 2005 – Target Corporation’s profits fell 46%; sales fell 5.3% following data breach (CBSnews.com)

Cybersecurity Program Elements 23 Cyber governance, cyber risk management, resources, training and culture 1) Cyber risk management and oversight Intelligence gathering, monitoring and analyzing, information sharing 2) Threat intelligence and collaboration Preventative, detective, and corrective controls 3) Cybersecurity controls Connections, relationships and responsibilities 4) External dependency management Incident detection and response, mitigation, escalation and reporting, resilience 5) Cyber incident management and resilience

Recent Fraud Areas in Credit Unions Lending Change Fund Corporate Accts.

Major Areas of Control Weaknesses Lending Lending Process – Employee with ability to create and disburse loan without review Improvement: - Employee with no other lending ability use New Loan report to verify - Remove create or disburse ability

Major Areas of Control Weaknesses Change Fund Vault & Change Fund Account – Head Teller with access to general ledger and control over physical vault and change fund Improvement: Dual counting of vault with independent reconciliation of count to general ledger

Major Areas of Control Weaknesses IT Controls IT Employees with unlimited restriction – Employee has unlimited access to data processing system with no oversight. Improvement: : Review of IT employee transactions by employee independent of IT access. Reality is that this is very difficult to control.

Internal Control Realities Good policies don’t equate to good controls Management override trumps all good controls Collusion between employees beats all controls Very challenging to implement good controls in small CU Supervisory Committees provide little to no comfort

Types of Fraud 29 Financial Statement Fraud Misappropriation of Assets

Financial Statement Fraud 30 Mask delinquent loans (bumping due dates) Defer Loan charge offs (rewrite bad loans) Increase earnings for year end bonuses (usually ALLL account) Increase asset size for CEO contract negotiations (share CD specials) Hide incompetency

Misappropriation of Assets 31 Stealing “borrowing” cash from change fund or teller drawers Fictitious loan and loan payments Unrecorded share deposits Loans to family and friends Unrecorded non-member share deposits

Fraud Hot Spots 32 Poor accounting/internal controls or un- reconciled accounts (corporate statement) Fictitious and fraudulent loans Dormant/inactive accounts Un-cleared overdrafts Unrecorded shares No internal audit function

Internal Controls to Mitigate Losses 33 Adopting travel expense policies and controls Implementing a whistleblower policy Restricting access to CU’s GL and corporate accounts, staff and related-party accounts. Segregating duties Rotating employee duties Fraud training with emphasis on fraud prevention Conducting mandatory investigations of all out-of- balances or shortages

Control Framework 34 Board Policies Budget and Plans Reports/Reporting Tier 1 Governance Procedures Segregation Control Reports Tier 2 Management Internal Audits External Audit Active Oversight Tier 3 Supervisory Committee Controls can vary with the complexity of the organization Small institutions often have limited segregation of duties

Contact NCUA 35 National Credit Union Administration Region V – Tempe, AZ