WEBVTT

NOTE
This file was generated by Descript 

00:00:00.449 --> 00:00:02.400
Samantha: Hello, this is Samantha Shares.

00:00:03.000 --> 00:00:07.110
This episode covers N C U A's
proposed changes to the Catastrophic

00:00:07.159 --> 00:00:08.640
Act Reporting Regulation.

00:00:09.369 --> 00:00:11.949
The following is an audio
version of that document.

00:00:12.519 --> 00:00:15.719
This podcast is educational
and is not legal advice.

00:00:16.229 --> 00:00:20.189
We are sponsored by Credit Union
Exam Solutions Incorporated, whose

00:00:20.189 --> 00:00:23.249
team has over two hundred and
forty years of National Credit

00:00:23.249 --> 00:00:25.149
Union Administration experience.

00:00:25.689 --> 00:00:29.279
We assist our clients with N C
U A so they save time and money.

00:00:29.659 --> 00:00:33.739
If you are worried about a recent,
upcoming, or in process N C U A

00:00:33.739 --> 00:00:38.059
examination, reach out to learn how they
can assist at Mark Treichel dot com.

00:00:38.569 --> 00:00:42.909
Also check out our other podcast called
With Flying Colors where we provide tips

00:00:42.909 --> 00:00:45.499
on how to achieve success with N C U A.

00:00:46.226 --> 00:00:47.916
And now the proposed regulation.

00:00:48.614 --> 00:00:52.904
The N C U A Board is publishing this
proposed rule to amend the requirements

00:00:52.904 --> 00:00:57.434
for federally insured credit unions to
report catastrophic acts to the agency.

00:00:57.884 --> 00:01:02.344
By providing more time for federally
insured credit unions to notify the agency

00:01:02.344 --> 00:01:06.464
of the occurrence of a catastrophic act
and by eliminating the specific list

00:01:06.464 --> 00:01:10.774
of items to be documented, the Board
expects the proposed rule to reduce the

00:01:10.774 --> 00:01:15.014
compliance burden and allow federally
insured credit unions to focus their

00:01:15.014 --> 00:01:19.844
resources on recovery and core functions
without compromising safety and soundness.

00:01:20.613 --> 00:01:24.063
Part seven forty eight requires
a federally insured credit union

00:01:24.063 --> 00:01:27.753
to notify the appropriate N C U
A Regional Director within five

00:01:27.753 --> 00:01:31.473
business days of any catastrophic
act that occurs at its offices.

00:01:32.003 --> 00:01:37.463
N C U A regulations define a catastrophic
act as any disaster, natural or otherwise,

00:01:37.593 --> 00:01:41.843
resulting in physical destruction or
damage to the credit union or causing an

00:01:41.843 --> 00:01:46.603
interruption in vital member services, as
defined in section seven forty nine point

00:01:46.603 --> 00:01:50.963
one of this chapter, projected to last
more than two consecutive business days.

00:01:51.696 --> 00:01:55.826
The agency adopted this requirement
under federal law requiring the agency

00:01:55.826 --> 00:02:00.366
to promulgate rules establishing minimum
safety standards relating to security.

00:02:00.936 --> 00:02:05.196
In two thousand seven, N C U A amended
the definition of catastrophic act to

00:02:05.196 --> 00:02:09.056
address concerns that relatively minor
events could be construed to trigger the

00:02:09.056 --> 00:02:13.646
need to file a report and to clarify the
causal link between a disaster and an

00:02:13.646 --> 00:02:15.726
interruption in vital member services.

00:02:16.366 --> 00:02:20.166
The Board believed these changes were
consistent with the usual and customary

00:02:20.166 --> 00:02:21.876
meaning of the word catastrophe.

00:02:22.216 --> 00:02:26.176
The Board also stated that these changes
reinforce its view that the reporting

00:02:26.176 --> 00:02:30.466
requirement applies only to a disaster,
as opposed to a circumstance where

00:02:30.466 --> 00:02:35.036
physical damage or a business closing
occurs but is not disaster related.

00:02:35.846 --> 00:02:39.096
While natural disasters were the
leading concern in the aftermath of

00:02:39.096 --> 00:02:43.736
hurricanes Katrina and Rita, the use
of the phrasing any disaster, natural

00:02:43.736 --> 00:02:47.656
or otherwise, was meant to illustrate
that other events, such as a power

00:02:47.656 --> 00:02:52.096
grid failure or physical attack, could
have a similar impact on access to

00:02:52.096 --> 00:02:54.106
member services and vital records.

00:02:54.823 --> 00:02:57.903
The Board is proposing to
further ease the reporting burden

00:02:57.903 --> 00:02:59.253
with the following amendments.

00:02:59.957 --> 00:03:03.367
First, the proposal would amend the
regulation to require that credit

00:03:03.367 --> 00:03:07.507
unions notify N C U A rather than
the specific regional director.

00:03:08.187 --> 00:03:12.247
This change is intended to modernize the
reporting process and provide greater

00:03:12.247 --> 00:03:16.867
operational flexibility for both federally
insured credit unions and the agency.

00:03:17.427 --> 00:03:21.507
By designating N C U A as the
recipient, the agency can centralize

00:03:21.507 --> 00:03:25.407
and streamline the intake of these
critical reports, ensuring they are

00:03:25.407 --> 00:03:29.417
routed efficiently to the appropriate
personnel for response and monitoring.

00:03:29.837 --> 00:03:33.287
This change would remove the burden
on a credit union, which may be

00:03:33.287 --> 00:03:37.567
operating under emergency conditions,
to identify and direct its report

00:03:37.567 --> 00:03:39.417
to a specific regional office.

00:03:40.073 --> 00:03:43.183
Second, the proposal would extend
the timeframe for submitting a

00:03:43.183 --> 00:03:47.523
catastrophic act report from five
business days to fifteen calendar days.

00:03:48.093 --> 00:03:51.563
The Board believes the current five
day deadline may be impractical for

00:03:51.563 --> 00:03:55.213
an institution recovering from a
significant operational disruption.

00:03:55.793 --> 00:04:00.093
Extending the deadline to fifteen calendar
days provides credit union management

00:04:00.153 --> 00:04:03.893
with a more reasonable amount of time
to stabilize operations, assess the

00:04:03.893 --> 00:04:08.273
full scope of the damage, and provide
a more accurate report to the agency.

00:04:08.713 --> 00:04:12.563
This change acknowledges the significant
operational challenges that follow a

00:04:12.563 --> 00:04:17.283
catastrophic act and would allow a credit
union to prioritize recovery efforts

00:04:17.373 --> 00:04:19.453
over immediate administrative reporting.

00:04:20.221 --> 00:04:24.531
Finally, the Board proposes to remove the
prescriptive list of items that a credit

00:04:24.531 --> 00:04:28.771
union should include in its internal
record of a catastrophic act and replace

00:04:28.771 --> 00:04:32.681
it with a requirement that a credit union
record the basic facts of the event.

00:04:33.171 --> 00:04:37.081
While maintaining a record containing
the basic facts of an event is a prudent

00:04:37.081 --> 00:04:41.201
business practice, the Board believes
that specifying the exact contents

00:04:41.201 --> 00:04:45.651
of this internal record to the degree
currently required is an unnecessary and

00:04:45.701 --> 00:04:47.921
overly prescriptive regulatory burden.

00:04:48.431 --> 00:04:52.451
Federally insured credit unions already
maintain records of such events as

00:04:52.451 --> 00:04:56.081
part of their own business continuity
and disaster recovery planning.

00:04:56.661 --> 00:05:00.851
Removing the list of items would reduce
administrative overhead and allow credit

00:05:00.851 --> 00:05:05.021
unions the flexibility to document these
incidents in a manner that best suits

00:05:05.021 --> 00:05:08.871
their operational and recordkeeping
policies, while still ensuring a

00:05:08.871 --> 00:05:10.771
record is created and maintained.

00:05:11.491 --> 00:05:14.641
This change would also make the
regulation clearer by removing

00:05:14.641 --> 00:05:18.301
a provision that is phrased as a
suggestion and not a requirement

00:05:18.301 --> 00:05:19.721
with the use of the word should.

00:05:20.583 --> 00:05:24.283
Commenters are invited to provide
feedback on these proposed changes to the

00:05:24.283 --> 00:05:26.583
catastrophic act reporting requirements.

00:05:27.013 --> 00:05:30.663
Specifically, the Board seeks feedback
on whether the proposed amendments

00:05:30.663 --> 00:05:34.413
appropriately balance the agency’s
need for timely information with the

00:05:34.413 --> 00:05:38.833
operational burdens faced by federally
insured credit unions during a crisis.

00:05:39.173 --> 00:05:42.533
The Board is also seeking comment
on whether credit unions should be

00:05:42.533 --> 00:05:47.053
permitted to use existing notification
tools, such as the form currently used

00:05:47.053 --> 00:05:51.173
to report cybersecurity incidents under
section seven forty eight point one,

00:05:51.283 --> 00:05:53.943
paragraph c, to report catastrophic acts.

00:05:54.483 --> 00:05:57.863
Commenters are also invited to
address whether the proposed fifteen

00:05:57.863 --> 00:06:01.823
calendar day reporting timeframe is
appropriate and whether the removal

00:06:01.823 --> 00:06:05.383
of the recordkeeping elements would
provide meaningful burden reduction.

00:06:06.175 --> 00:06:10.435
For the reasons stated in the preamble,
the N C U A Board proposes to amend

00:06:10.435 --> 00:06:12.855
twelve C F R part seven forty eight.

00:06:13.465 --> 00:06:17.585
Each federally insured credit union
will notify N C U A within fifteen

00:06:17.585 --> 00:06:21.375
calendar days of any catastrophic
act that occurs at its offices.

00:06:21.905 --> 00:06:26.225
A catastrophic act is any disaster,
natural or otherwise, resulting in

00:06:26.225 --> 00:06:30.535
physical destruction or damage to the
credit union or causing an interruption

00:06:30.535 --> 00:06:35.005
in vital member services projected to last
more than two consecutive business days.

00:06:35.525 --> 00:06:39.345
Within a reasonable time after a
catastrophic act occurs, the credit

00:06:39.345 --> 00:06:42.595
union shall ensure that a record
of the incident is prepared that

00:06:42.595 --> 00:06:44.785
contains the basic facts of the event.

00:06:45.492 --> 00:06:46.972
This concludes the document.

00:06:47.372 --> 00:06:51.592
If your credit union could use assistance
with your exam, reach out to Mark Treichel

00:06:51.592 --> 00:06:54.052
on LinkedIn or at Mark Treichel dot com.

00:06:54.662 --> 00:06:57.312
This is Samantha Shares, and
we thank you for listening.