In addition, we urge NCUA and the other federal financial regulators to support legislative and regulatory changes to minimize the costs and problems institutions encounter to meet BSA requirements and to satisfy examiners. We strongly encourage meaningful changes to BSA and anti-money laundering requirements, including increasing the threshold for current transactions from the $10,000 level established decades ago to $20,000 and at least doubling other key thresholds, such as the $3,000 trigger for reporting wire transfers and the $5,000 threshold for filing a Suspicious Activity Report (SAR).
In 2010, FinCEN proposed changes to track money laundering and terrorist financing through cross border electronic transmittals of funds (CBETFs), to further modernize the SAR filing process, and to clarify Foreign Bank Account Report (FBAR) requirements. While CUNA generally supports FinCEN’s objectives to track money and to improve the filing process, we have significant concerns about the additional regulatory burdens and compliance costs to credit unions. We urge NCUA and the other regulators to work with FinCEN to help minimize requirements on regulated financial institutions.
Guidelines for safeguarding member information and responding to unauthorized access to member information (12 CFR 748, Appendices A and B):
Appendix B
Another area of concern with Part 748 relates to Appendix B, which contains NCUA’s guidance on credit union response programs for unauthorized access to member information and on disclosure of such access to the credit union’s members.
In regard to the provisions included in Appendix B, CUNA frequently receives questions from credit unions about their responsibilities following a merchant data breach. In particular, the questions relate to whether a credit union needs to send a member notice and/or notify NCUA when a merchant’s breach impacts cards issued by that credit union.
Appendix B to Part 748 only applies to member information systems within the control of the credit union or its service provider. Based on inquiries from credit unions, there appears to be a lack of clear guidance on how to handle merchants’ security breaches. We ask NCUA to consider expanding the guidance included in Appendix B. However, we would like to emphasize that such elaboration should be in the form of “guidance” and be limited to the Appendix of Part 748.
Cybersecurity Assessment Tool
In addition, we have some concerns with the Cybersecurity Assessment Tool that was released last summer by the FFIEC, of which NCUA is a member. While we support the FFIEC’s effort in the area of cybersecurity, and we feel the tool can be useful, we believe its use should remain voluntary. We do not agree with the FFIEC agencies’, including NCUA, decision to implement the tool as part of the examination process to benchmark and assess institutions’ cybersecurity efforts. Credit unions should have the flexibility to utilize the tool in the manner they believe is most appropriate for the size and complexity of their operations.
Liquidity and Contingency Funding Plans (12 CFR 741.12):
NCUA has recently updated the Liquidity rule in 12 CFR 741.12 encapsulated by Supervisory Letter SL No. 14-03. NCUA in large part models its requirements on the FFIEC Interagency Policy Statement on Funding and Liquidity Risk Management (10-CU-14). We note that the agency makes distinctions between those with assets of $50 million and $250 million. We suggest the NCUA revisit those thresholds periodically to determine whether or not they should be adjusted.
On a related issue, NCUA has articulated that they intend to add an “S” to the CAMEL rating system and revise the “L” to reflect only Liquidity issues, in large part due to the Office of Inspector General’s Review of NCUA’s Interest Rate Risk Program (#OIG-15-11). The new “S” ostensibly would be to monitor a credit union’s sensitivity to market risk. While there is no current proposal made public by the NCUA at this point in time, we believe these changes are likely driven by similar changes on the banking side. We urge the NCUA to consider the unique structure of credit unions when considering such a change. CUNA suggests Interest Rate Risk, Liquidity, & Contingency Funding are all interrelated and the current procedures under the existing “L” and existing “M” can adequately identify issues in a credit union. While we understand the supervisory guidance for those categories may need to change over time, it does not necessarily warrant the establishment of a new category under the CAMEL rating system.
Thank you for the opportunity to express these views to the NCUA. If you have further questions or would like to discuss CUNA’s comments in more detail, please feel free to contact me at 202- 508-3630.
Sincerely,
Andrew T. Price
Senior Director of Advocacy & Counsel
aprice@cuna.coop