Samantha: Hello, this is Samantha Shares.
This episode covers N C U Aâs letter to credit unions number twenty two dash
zero seven Federally Insured Credit Union Use of Distributed Ledger Technologies
The following is an audio version of that letter and the press release.
This podcast is educational and is not legal advice.
We are sponsored by Credit Union Exam Solutions Incorporated, whose
team has over two hundred and Forty years of National Credit
Union Administration experience.
We assist our clients with N C U A so they save time and money.
If you are worried about a recent, upcoming or in process N C U A
examination, reach out to learn how they can assist at Mark Treichel DOT COM.
Also check out our other podcast called With Flying Colors where we provide tips
on how to achieve success with N C U A.
And now the letter.
The National Credit Union Administration supports initiatives
by federally insured credit unions to better serve their members.
The rapid emergence of financial technology is creating opportunities
for credit unions to increase speed of service, improve security,
and expand products and services.
In this spirit, the Board is exploring how the agency can provide clarity
around expectations regarding financial technology adoption to not impede
safe, fair, and responsible federally insured credit union engagement.
This letter clarifies certain expectations for credit unions contemplating the
use of new or emerging distributed ledger technologies (D L T).
The agency does not prohibit credit unions from developing,
procuring, or using D L T.
D L T used as an underlying technology by credit unions is not prohibited
if it is deployed for permissible activities and in compliance with
all applicable laws and regulations, including applicable state laws or state
supervisory authority requirements.
As with the internet at its inception, the AGENCY recognizes that new
technologies may transform how credit unions perform traditional
financial operations and services.
This letter reiterates the importance of sound governance and planning related to
deploying new technologies like D L T.
While D L T is maturing, the AGENCY recognizes that cases for implementation
may expand rapidly as the technology becomes more widespread and credit
unions become more familiar with it.
For this reason, this letter provides areas for credit unions to consider
when evaluating whether to use D L T.
The AGENCY also recognizes that the specific application of D L T may
necessitate additional due diligence by credit unions, and approaches that
vary with some of the more general guidance provided in this letter.
As such, the AGENCY expects that this letter may generate follow-up
inquiries where additional guidance is requested and prudent.
This letter also signals to the broader financial and technology communities that
credit unions are a market to consider when designing products, considering
partnerships, or making investments.
As with all new and emerging technology, the AGENCY expects credit unions
to exercise judgment, apply sound risk-management practices, and conduct
necessary due diligence when choosing a platform, product, or service.
When considering D L T, credit unions should first evaluate the
permissibility of the activity itself and then assess the opportunities
and risks relative to the activity.
Finally, given the emerging nature of D L T and its potential use by credit unions,
considerations introduced in this letter should not be construed as all inclusive.
Governance, Oversight and Planning
As with the development of any new product or service, when deploying a platform,
product, or service using D L T as part of the underlying technology, credit
unions should find an appropriate balance between the opportunities and the risks.
Related project plans and risk assessments should include examining
internal constraints and obstacles, and ensuring, at a minimum:
â¢ The credit unionâs board of directors is notified of advancements in the
underlying technology, the purposes of the technology, and how using D L T aligns
with the credit unionâs strategic planning objectives and approved risk tolerances.
â¢ Credit union staff and third parties using and managing the technology are complying
with applicable laws and regulations and acting in a safe-and-sound manner.
â¢ Effective risk-management practices are followed to identify, assess,
and mitigate risks associated with D L T and the specific activities
for which it will be deployed.
â¢ Risk assessment and audit functions can validate and attest to the
effectiveness of risk-mitigation practices in accordance with internal
policy and industry leading practices.
Risk and Risk-Mitigation Strategies
All technology and systems have inherent risks.
Credit unions are responsible for ensuring sound operations whether
delivery of services is accomplished internally or through third parties.
For example, the AGENCY recognizes third-party relationships may be
valuable to credit unions in facilitating implementation and use of, and member
access to, new and emerging technology.
Inadequately managed and controlled third-party relationships, however, can
result in harm to members, unanticipated costs, legal disputes, and financial loss.
Therefore, effective risk management is important.
Credit unions must identify, assess, and mitigate risks associated with D L T.
Credit unions should consider specific questions related to D L
T as part of their due diligence efforts and ensure activities are
permissible and in compliance with all applicable laws and regulations.
Depending upon the characteristics of the D L T being deployed and
how it is being used, other risk factors may merit consideration.
Credit unions should employ a comprehensive approach to risk
identification, assessment, and mitigation as part of the development
and implementation of D L T.
In cases where vendor-provided solutions are considered, the responsibility
to identify, understand, and mitigate material risks resides with the
board and management of the credit union and not solely the vendor.
Depending on the purpose for which the D L T is being implemented,
credit unions should consider the following questions, among others:
Information and Cybersecurity Risk
â¢ What are the primary characteristics of the D L T network architecture?
â¢ Does the D L T exist within a private or public network?
â¢ Has the risk of compromise related to many points of entry (nodes) been assessed?
â¢ Are consensus mechanisms built into the D L T architecture
immune to external exploitation?
â¢ How are permissions and identity management credentials managed?
â¢ By whom and how is governance over the network conducted?
â¢ What are the data quality control expectations among
participants within the network?
â¢ Are D L T solutions deployed within a strictly governed
coding process in accordance with industry leading practices?
Legal and Compliance Risk
â¢ Have the potential legal and compliance risks been assessed, including those
related to maintaining confidentiality, privacy, data security, recordkeeping,
and consumer and fraud protections?
â¢ When deploying the D L T, will the credit union comply with applicable laws and
regulations, such as requirements of the Bank Secrecy Act (BSA), including customer
due diligence, âKnow Your Customer,â and anti-money laundering requirements?
â¢ Are each of the nodes on the D L T network BSA compliant?
â¢ If the application involves the use of smart contracts, is testing
of the underlying architecture in place and documented?
Has the credit union confirmed with whom and to what extent oversight,
governance, and maintenance of the smart contract application reside and exist?
Strategic and Reputation Risk
â¢ Have potential strategic and reputational risks related to the D L T been
identified, assessed, and mitigated?
â¢ Are consensus mechanisms built into the D L T architecture
well understood by management?
â¢ Is a process in place to monitor emerging risks and changes in technology?
Can the credit union or third-party apply changes in deployment and
internal controls in response?
â¢ Do contracts with third-party vendors provide reasonable âexit
strategiesâ in the event of deterioration in financial condition
or service delivery by the vendor?
Liquidity Risk
â¢ Have potential liquidity risks been identified, assessed, and mitigated?
Third-Party Risk
â¢ Have potential legal and compliance risks associated with new-entry participants
and third-party agreements been assessed?
â¢ Have the appropriate due diligence steps been taken in the selection of the third
party before entering a D L T arrangement?
Has AGENCYâs existing guidance on evaluating third-party relationships and
third-party due diligence been reviewed?
Conclusion
Examples of current and evolving use of D L T in various applications exist
within the credit union industry and larger financial services sector.
This letter explains that credit unions may appropriately use D L T as an
underlying technology and highlights a variety of relevant issues credit unions
should evaluate prior to deployment.
Credit unions can responsibly explore the use of D L T for business
uses to enhance their operations and ongoing competitiveness.
Credit unions must remain alert to new or evolving risks posed by use of
an emerging technology or approach.
The AGENCY expects credit unions to exercise good judgment and apply sound
risk-management practices when choosing to offer a new platform, product,
or service, including where D L T is part of the underlying technology.
These reviews include evaluating the permissibility of the activity
itself and the opportunities and risks associated with any
underlying technology, such as D L T.
Examiners will evaluate the rigor with which credit unions exercised good
judgement, applied sound risk management, and executed compliance and risk oversight
of acquisition or development and deployment of new systems and technology.
The AGENCY supports innovations that are safe and sound, in compliance
with all applicable laws and regulations, and fair to consumers.
The AGENCY also believes that D L T-related activities are rapidly
evolving, and present questions and evolving risks not yet well understood.
The AGENCY reserves the right to issue future guidance, as appropriate.
This concludes the AGENCY Letter to credit unions on Federally Insured Credit Union
Use of Distributed Ledger Technologies.
If your Credit union could use assistance with your exam, reach out to Mark Treichel
on LinkedIn, or at mark Treichel dot com.
This is Samantha Shares and we Thank you for listening.