Samantha: Hello, this is Samantha Shares.
This episode covers NCU A letter to credit unions number Zero Seven
C U Thirteen titled Evaluating Third-party Relationships.
This letter is often cited as support for Document of Resolution
items in NCU A exam reports.
The following is an audio version of that advisory and the press release.
This podcast is educational and is not legal advice.
We are sponsored by Credit Union Exam Solutions Incorporated, whose
team has over two hundred and Forty years of National Credit
Union Administration experience.
We assist our clients with N C U A so they save time and money.
If you are worried about a recent, upcoming or in process N C U A
examination, reach out to learn how they can assist at Mark Treichel DOT COM.
Also check out our other podcast called With Flying Colors where we provide tips
on how to achieve success with N C U A.
And now the letter.
Third-party Relationships
In recent years, credit unions have increasingly developed third-party
relationships to meet strategic objectives and enhance member services.
Properly managed and controlled third-party relationships provide
a wide range of potential benefits to credit unions and their members.
Many credit unions have utilized third-party arrangements to gain
expertise, realize economies of scale, or even reach new members.
Leveraging the talents and experience of third parties can assist credit unions
in meeting their members’ needs while accomplishing their strategic goals.
In some cases, third-party relationships are critical to the
on-going success of a credit union.
Credit unions taking the time to properly evaluate and cultivate their
participation in third-party arrangements can experience a high degree of success.
Collaboration with third parties has become more prevalent in credit
unions due to increasing complexity of services and competitive pressures.
In some third-party arrangements, credit unions surrender direct
control over one or more key business functions to a third-party
in exchange for potential benefits.
As credit unions consider the potential benefits of third-party
arrangements, credit union officials and management (officials) are
faced with a balancing act.
Officials must carefully consider the potential risks these relationships
may present and how to manage them.
As credit unions seek to manage risk, they should carefully consider the
correlation between their level of control over business functions and
the potential for compounding risks.
Credit unions maintaining complete control over all functions may be
operationally or financially inefficient.
Credit unions outsourcing functions without the appropriate level
of due diligence and oversight may be taking on undue risk.
Ultimately, credit unions are responsible for safeguarding member assets and
ensuring sound operations irrespective of whether or not a third-party is involved.
Outsourcing complete control over one or more business functions
to a third-party amplifies the risks inherent in those functions.
Additionally, credit unions trading direct control over business functions
for third-party program benefits may expose themselves to a full range of
risks including credit, interest rate, liquidity, transaction, compliance,
strategic, and reputation risks.
Credit unions must complete the due diligence necessary to ensure the
risks undertaken in a third-party relationship are acceptable in
relation to their risk profile and safety and soundness requirements.
Less complex risk profiles and third-party arrangements typically
require less analysis and documentation.
Further, where credit unions have a longstanding and tested history of
participating in a given third-party relationship, less analysis is
required to renew the relationship.
Risks may be mitigated, transferred, avoided, or accepted; however,
they are rarely eliminated.
The risk management process involves identifying and making informed
decisions about how to address risk.
One of the best ways to employ the risk management process is to start
small and gain experience over time.
Less complex credit unions unfamiliar with analyzing third-party arrangements
may utilize this risk management approach by entering third-party relationships
with small, well-defined goals and expanding their exposure to third-party
risks as their experience grows.
When evaluating third-party arrangements, examiners should ensure credit unions
have addressed the following concepts in a manner commensurate with their
size, complexity, and risk profile:
Risk Assessment and Planning;
Due Diligence; and
Risk Measurement, Monitoring and Control.
The remainder of this Supervisory Letter outlines
considerations for these concepts.
The considerations discussed are not an exhaustive list of all possible
risk mitigation procedures, but a representation of the considerations
necessary when credit unions engage in significant third-party relationships.
The depth and breadth of due diligence required depends upon a credit union’s
complexity and risk management process.
Smaller or less complex credit unions may develop alternative methods of
accomplishing due diligence, while credit unions utilizing a time tested
third-party relationship may already have addressed these considerations over time.
Risk Assessment and Planning Considerations for
Third-party Relationships
Credit union officials are responsible for planning, directing, and
controlling the credit union’s affairs.
Risk assessment and due diligence for third-party relationships is
an important part of officials’ fiduciary responsibilities.
Examiners should consider the following elements in evaluating the adequacy of
credit unions’ risk assessment and due diligence over third-party relationships:
Planning and Initial Risk Assessment
Before entering into a third-party relationship, officials should
determine whether the relationship complements their credit union’s
overall mission and philosophy.
Officials should document how the relationship will relate to their credit
union’s strategic plan, considering long-term goals, objectives, and
resource allocation requirements.
Officials should design action plans to achieve short-term and long-term
objectives in support of strategic planning for new third-party arrangements.
All planning should contain measurable, achievable goals and clearly defined
levels of authority and responsibility.
Additionally, officials should weigh the risks and benefits of outsourcing business
functions with the risks and benefits of maintaining those functions in-house.
In order to demonstrate an understanding of a third-party relationship’s
risk, the officials must clearly understand the credit union’s strengths
and weaknesses in relation to the arrangement under consideration.
Credit unions should complete a risk assessment prior to engaging in a
third-party relationship to assess what internal changes, if any, will be required
to safely and soundly participate.
Risk assessments are a dynamic process, rather than a static process,
and should be an on-going part of a broader risk management strategy.
Credit unions’ initial risk assessments for a third-party relationship should
consider all seven risk areas (Credit, Interest Rate, Liquidity, Transaction,
Compliance, Strategic, and Reputation), and more specifically the following:
Expectations for Outsourced Functions
– Credit unions should clearly define the nature and scope of their needs.
Which needs will the third-party meet?
Will the third-party be responsible for desired results?
To what extent?
Staff Expertise
Is credit union staff qualified to manage and monitor the third-party relationship?
How much reliance on the third-party will be necessary?
Criticality
How important is the activity to be outsourced?
Is the activity mission critical?
What other alternatives exist?
Risk-Reward or Cost-Benefit Relationship
Does the potential benefit of the arrangement outweigh
the potential risks or costs?
Will this change over time?
Insurance
Will the arrangement create additional liabilities?
Is credit union insurance coverage sufficient to cover the
potentially increased liabilities?
Will the third-party carry “key man” insurance or other insurance
to protect the credit union?
Impact on Membership
How will officials gauge the positive or negative impacts of the
arrangement on credit union members?
How will they manage member expectations?
Exit Strategy
Is there a reasonable way out of the relationship if it becomes necessary
to change course in the future?
Is there another party that can provide any services officials deem critical?
Risk assessments for less complex third-party arrangements may be part
of a broader risk management program or documented in board minutes.
Financial Projections
In evaluating the cost-benefit or risk-reward of a third-party relationship,
credit unions should develop financial projections outlining the range of
expected and possible financial outcomes.
Credit unions should project a return on their investment in the
proposed third-party arrangement, considering expected revenues,
direct costs, and indirect costs.
For example, when outsourcing loan functions, credit unions should
not only consider the expected loan yield, but also the potential
effect of borrower prepayments and third-party fees on the overall return.
Officials should evaluate financial projections in the context of
their overall strategic plans and asset-liability management framework
before making a decision to participate in a third-party arrangement.
Examiners should evaluate these projections for reasonableness,
considering historical performance, underlying assumptions, stated business
plan objectives, and the complexity of the credit union’s risk profile.
Due Diligence for Third-party Relationships
When considering third-party relationships, proper due diligence
includes developing a demonstrated understanding of a third-party’s
organization, business model, financial health, and program risks.
In order to tailor controls to mitigate risks posed by a third-party, credit
unions must have an understanding of a prospective third-party’s responsibilities
and all of the processes involved with prospective third-party programs.
Examiners should consider the adequacy of due diligence in the areas below,
given credit unions’ risk profiles, internal controls, and overall complexity.
Due diligence should be tailored to the complexity of the third-party
relationship and may consist of reasonable alternative procedures to
accomplish acceptable risk mitigation.
It is also important for credit unions to understand how a third-party has
performed in other relationships before entering into a third-party arrangement.
Credit unions should request referrals from the prospective third-party’s clients
to determine their satisfaction and experience with the proposed arrangement.
Credit unions should also review and consider any lawsuits or
legal proceedings involving the third-party or its principals.
Additionally, credit unions should ensure that third parties or their agents have
any required licenses or certifications, and that they remain current for
the duration of the arrangement.
Finally, sources of information such as the Better Business Bureau, Federal
Trade Commission, credit reporting agencies, state consumer affairs
offices, or state attorney general offices may also offer insight to a
third-party’s business reputation.
Business Model
New business models often emerge due to changes in the regulatory,
technological, or economic environment.
When evaluating a prospective third-party arrangement, credit union officials should
consider the longevity and adaptability of third-party business models.
Some business models may be well suited for economic expansion, but
untenable during economic recession.
Since new business models are not time tested and have not experienced a
complete economic cycle, they may present additional risks to a credit union.
Likewise, longstanding business models that cannot easily adapt may
not be sustainable in times of rapid technological or regulatory change.
Before entering into a third-party arrangement, credit union officials
should thoroughly understand the third-party’s business model.
The third-party’s business model is simply the conceptual architecture
or business logic employed to provide services to its clients.
If the third-party’s business and marketing plans are available,
officials should review them.
Credit union officials should also understand and be able to explain the
third-party’s role in the proposed arrangement and any processes for
which the third-party is responsible.
Examiners should assess credit union officials’ understanding and consideration
of key third-party business models as an integral element of due diligence.
Credit union officials should also understand the third-party’s
sources of income and expense, considering any conflicts of
interest that may exist between the third-party and the credit union.
For example, if a third-party’s revenue stream is tied to the volume of loan
originations rather than loan quality, its financial interest in underwriting
as many loans as possible may conflict with the credit union’s interest
in originating only quality loans.
Credit unions should also identify any vendor related parties (such
as subsidiaries, affiliates, or subcontractors) involved with the
proposed arrangement and understand the purpose and function of each.
Examiners should consider the potential effects of identified conflicts
of interest and ensure officials mitigate risks where reasonable.
Cash Flows
Perhaps one of the most important considerations, when analyzing a
potential third-party relationship, is the determination of how cash
flows move between all parties in a proposed third-party arrangement.
In addition to third-party fees, premiums, and claims receipts, many
third-party arrangements include cash flows between the credit union, the
third-party, and credit union members.
Credit union officials should be able to explain how cash flows (both incoming
and outgoing) move between the member, the third-party, and credit unions.
Credit unions should also be able to independently verify the source
of these cash flows and match them to related individual accounts.
Examiners should ensure credit unions are tracking and
identifying cash flows accurately.
Financial and Operational Control Review
Credit unions should carefully review the financial condition of third parties
and their closely related affiliates.
The financial statements of a third-party and its closely related affiliates
should demonstrate an ability to fulfill the contractual commitments proposed.
Credit unions should consider the financial statements with regard to
outstanding commitments, capital strength, liquidity, and operating results.
Additionally, credit unions should consider any potential off-balance sheet
liabilities and the feasibility that the third-party or its affiliated parties can
financially perform on such commitments.
Audited and segmented financial statements or ratings from nationally recognized
statistical rating organizations (N R S R O ratings) may be useful in periodically
evaluating the overall financial health of a prospective or existing third-party.
If available, officials may use copies of S A S seventy (Type II) reports
prepared by an independent auditor, audit results, or regulatory reports
to evaluate the adequacy of the proposed vendor’s internal controls.
If these items are not available, credit unions should consider whether
to require an independent review of the proposed vendor’s internal controls.
Generally, contracts establish requirements for periodic audits
or access to third-party records.
Examiners should ensure credit unions have adequately reviewed the financial
and internal control structure of the prospective third-party, considering
credit unions’ risk profiles and the arrangement’s relationship to net worth.
Contract Issues and Legal Review
Contracts outlining third-party arrangements are often complex.
Credit unions should take measures to ensure careful review and understanding
of the contract and legal issues relevant to third-party arrangements.
It is prudent to seek qualified external legal counsel to review prospective
third-party arrangements and contracts.
Any legal counsel consulted should be independent and have the experience
or specialization necessary to review properly the arrangements and contracts.
Typically, at a minimum, third-party contracts should address the following:
Scope of arrangement, services offered, and activities authorized;
Responsibilities of all parties (including subcontractor oversight);
Service level agreements addressing performance standards and measures;
Performance reports and frequency of reporting;
Penalties for lack of performance;
Ownership, control, maintenance and access to financial and operating records;
Ownership of servicing rights;
Audit rights and requirements (including responsibility for payment);
Data security and member confidentiality (including testing and audit);
Business resumption or contingency planning;
Insurance;
Member complaints and member service;
Compliance with regulatory requirements (e.g.
GLBA, Privacy, BSA, etcetera);
Dispute resolution; and
Default, termination, and escape clauses.
Of particular importance, credit unions should exercise their right to negotiate
contract terms with third parties for mutually beneficial contracts.
For example, some credit unions have entered into third-party agreements
with significant buyout or termination penalties, believing the penalties or
fees were standard or non-negotiable.
In many cases, early termination, escape clause, and default terms are negotiable.
Credit union officials should ensure that any contract terms agreed
to would not adversely affect the credit union’s safety and soundness,
regardless of contract performance.
In addition to a legal review of contracts and written agreements
relevant to a prospective third-party arrangement, it may be prudent for
credit unions to obtain a legal opinion about any services provided by the
third-party under the arrangement.
For example, if a third-party is engaged to perform loan collections for the credit
union, a legal review of their collection methods may be prudent to ensure debt
collection and reporting practices comply with applicable state and federal laws.
Credit unions should ensure compliance with state and federal laws and
regulations, and contractually bind the third-party to compliance
with applicable laws (i.e.
Regulation B, Regulation Z, HMDA, etcetera).
Since credit unions may ultimately be responsible for consumer compliance
violations committed by their agents, credit unions should be familiar with
the third-party’s internal controls for ensuring regulatory compliance and
adherence to agreed upon practices.
Accounting Considerations
Credit unions should consider that third-party relationships might
create accounting complexities.
Credit unions must have adequate accounting infrastructures to
appropriately track, identify, and classify transactions in
accordance with Generally Accepted Accounting Principles (GAAP).
Credit unions often develop third-party arrangements to outsource new products
or functions, and may not have experience in accounting for the particulars
of those new products or functions.
Conversely, although credit unions may be familiar with the accounting rules
for a given function, the nature of a third-party arrangement may change
the required accounting procedures.
In some instances, a certified public accountant’s guidance may be necessary
to ensure proper accounting treatment.
A credit union’s audit scope should provide for independent
reviews of third-party arrangements and associated activities.
Examiners should ensure credit unions have considered the accounting implications
of new products or services introduced through third-party arrangements.
Risk Measurement, Monitoring and Control of Third-party Relationships
In addition to careful due diligence when entering third-party arrangements,
credit unions must establish ongoing expectations and limitations, compare
program performance to expectations, and ensure all parties to the arrangement
are fulfilling their responsibilities.
Third-party arrangements and risk profiles will vary; thus, credit unions should
tailor risk mitigation efforts to the specific nature of considered programs,
the materiality of risks identified, and the credit union’s overall complexity.
Examiners should consider the adequacy of the credit union’s policies,
risk measurement, and monitoring in light of the same factors.
Policies and Procedures
Credit unions should develop detailed policy guidance sufficient to outline
expectations and limit risks originating from third-party arrangements.
Policies and procedures should outline staff responsibilities
and authorities for third-party processes and program oversight.
Additionally, policy guidance should define the content and
frequency of reporting to credit union management and officials.
Credit unions should also establish program limitations to control the pace
of program growth and allow time to develop experience with the program.
For example, credit unions participating in third-party loan programs should
initially limit the volume of loans granted in order to identify any problems
with the third-party process prior to the volume of loans becoming significant.
Risk Measurement and Monitoring
Credit unions must be able to measure the risks of third-party programs,
but also the performance of third parties in terms of profitability,
benefit, and service delivery.
For example, credit unions outsourcing loan servicing functions should be able to
identify individual loan characteristics, repayment histories, repayment methods,
delinquency status, and any loan file maintenance relative to serviced loans.
To the extent that credit unions rely on the third-party to provide this type of
measurement information, clear controls should be contractually established and
subject to periodic independent testing to ensure the accuracy of the information.
Examiners should ensure that credit unions are measuring the performance
of third-party arrangements and periodically verifying the accuracy
of any information provided to them by a third-party or its affiliate.
Credit unions engaging in third-party relationships must have an
infrastructure (in example staffing, equipment, technology, etcetera)
sufficient to monitor the performance of third-party arrangements.
In many cases, credit unions outsource processes or functions due to a lack of
internal infrastructure or experience.
However, outsourcing processes or functions does not eliminate
credit union responsibility for the safety and soundness of
those processes and functions.
Examiners should ensure officials demonstrate the knowledge, skills,
and abilities necessary to monitor and control third-party arrangements.
Control Systems and Reporting
After credit unions have conducted internal risk assessments and
due diligence over prospective third parties, they must implement
on-going controls over third-party arrangements to mitigate risks.
While control systems need not be elaborate for less complex third-party
arrangements, credit unions are ultimately responsible for establishing
internal controls and audit functions reasonably sufficient to assure them
that third parties are appropriately safeguarding member assets, producing
reliable reports, and following the terms of the third-party arrangement.
Additionally, credit unions should tailor internal controls as necessary
to ensure staff observes policy guidance for third-party relationships.
Examiners should ensure credit unions have ongoing risk management
procedures with regard to any material third-party relationship.
Designated credit union staff should be qualified and responsible for
continued monitoring and oversight of third-party arrangements, exhibiting
familiarity with and understanding of the reports available from the third-party.
Responsible staff should measure the performance of third-party
programs in relation to credit union policy guidance, contractual
commitments, and service levels.
Credit unions should implement quality control procedures to review the
performance of third parties periodically.
Credit union officials should receive periodic reports on the performance
of all material third-party programs.
Examiners should ensure controls are in place, and that management and
officials receive periodic reports with information sufficient to assist them in
evaluating the performance of the overall arrangement and the adequacy of reserves.
Summary
Third-party relationships can be invaluable to credit unions
and credit union members.
Properly managed third-party relationships can allow credit unions
to accomplish strategic objectives through increased member service,
competitiveness, and economies of scale.
However, outsourcing critical business functions increases the
risk inherent in those functions.
Credit unions are responsible for safeguarding member assets and ensuring
sound operations irrespective of whether or not a third-party is involved.
Smaller or less complex credit unions may have to develop alternative
methods of accomplishing due diligence.
Examiners should ensure credit unions adequately address risk assessment,
planning, due diligence, risk measurement, risk monitoring, and controls when
involved in third-party relationships.
APPENDIX A
Third-party Relationships- Areas for Consideration
Risk Assessment and Planning
Planning
Third-party arrangements should be synchronized with strategic
plans, business plans, and credit unions’ philosophies.
Risk Assessment
Dynamic process should consider the seven areas of risk as well as
expectations of the arrangement, staff expertise, criticality of function,
cost-benefit, insurance requirements, member impact, and exit strategy.
Financial Projections
Return on investment should be estimated considering revenue,
direct costs, indirect costs, fees, and likely cash flow stream.
Return should be considered relative to the credit unions’ strategic
plans and asset-liability frameworks.
Due Diligence
Background Check
Credit unions should consider references, prior performance, licensing
and certification, and any legal proceedings involving prospective
third parties, key individuals of the third-party’s organization.
Credit unions should also consider third-party motivations.
Business Model
Credit unions must understand business logic of the third-party arrangement and
business model, as well as third-party processes and related affiliates.
Cash Flows
Credit unions must demonstrate an understanding of incoming and
outgoing cash flows, and be able to independently verify sources of
cash flows in third-party programs.
Financial and Operation Control Review
Credit unions must review the overall financial condition of third parties
and their closely related affiliates, as well as the state of operational controls
in the third-party’s business model.
Contract Issues and Legal Review
Credit unions should generally have legal counsel with appropriate
expertise and experience review contracts and third-party arrangements
to ensure equitable contracts and compliance with applicable state
and federal laws and regulations.
Accounting Considerations
Credit unions should be prepared for potential accounting complexity and may
need a CPA opinion on accounting for third-party relationship activities.
Risk Measurement, Monitoring and Control
Staff Oversight and Quality Control
Credit unions should have qualified staff designated to oversee and control the
quality of the third-party relationships.
Policies and Procedures
Policy guidance must be in place and sufficient to control the risks
of the third-party relationship.
Policy guidance should address responsibilities, oversight, program
and portfolio limitations, and content and frequency of reporting.
Monitoring and Reporting
Adequate infrastructure is required to support monitoring and reporting
outlined in policy guidance.
Credit unions should be able to measure and verify the performance of third
parties and third-party programs.
APPENDIX B
List of Resources
The resources listed in the letter are too numerous to list here.
Refer to NCU A’s website for these details.
This concludes the NCU A Letter to credit unions on Evaluating
Third-party Relationships
If your Credit union could use assistance with your exam, reach out to Mark Treichel
on LinkedIn, or at mark Treichel dot com.
This is Samantha Shares and we Thank you for listening.