WEBVTT NOTE This file was generated by Descript 00:00:00.080 --> 00:00:01.830 Samantha: Hello this is Samantha Shares. 00:00:02.370 --> 00:00:06.900 This episode covers NCU A's Letter to Credit Unions on Concentration Risk. 00:00:07.370 --> 00:00:10.510 Many credit unions are receiving Documents of Resolution on 00:00:10.510 --> 00:00:14.160 Concentration Risk and told to comply with the guidance in this letter. 00:00:14.650 --> 00:00:17.070 The following is and audio version of that letter. 00:00:17.560 --> 00:00:21.260 But first this podcast is educational and is not legal advice. 00:00:21.710 --> 00:00:25.700 We are sponsored by Credit Union Exam Solutions Incorporated, whose 00:00:25.700 --> 00:00:28.840 team has over two hundred and Forty years of National Credit 00:00:28.840 --> 00:00:30.750 Union Administration experience. 00:00:31.170 --> 00:00:34.890 We assist our clients with N C U A so they save time and money. 00:00:35.170 --> 00:00:39.060 If you are worried about a recent, upcoming or in process N C U A 00:00:39.060 --> 00:00:43.310 examination, reach out to learn how they can assist at Mark Treichel DOT COM. 00:00:43.750 --> 00:00:47.960 Also check out our other podcast called With Flying Colors where we provide tips 00:00:47.960 --> 00:00:50.570 on how to achieve success with N C U A. 00:00:50.982 --> 00:00:52.562 And now the Supervisory letter. 00:00:53.011 --> 00:00:57.041 Supervisory Letter Concentration Risk Credit union officials and management 00:00:57.041 --> 00:01:00.921 have a fiduciary responsibility to identify, measure, monitor, 00:01:00.921 --> 00:01:02.761 and control concentration risk. 00:01:03.251 --> 00:01:07.161 Concentration risk must be managed in conjunction with credit, interest rate 00:01:07.161 --> 00:01:11.841 and liquidity risks; as a negative event in any category may have significant 00:01:11.841 --> 00:01:16.281 consequences on the other areas, as well as strategic and reputation risks. 00:01:16.821 --> 00:01:19.721 Concentration risk has increased in importance during the 00:01:19.721 --> 00:01:21.331 recent economic recession. 00:01:21.681 --> 00:01:25.851 Poor risk management of residential and commercial mortgage loan concentrations, 00:01:25.851 --> 00:01:29.961 in particular, is having an adverse effect on credit unions nationwide; 00:01:30.351 --> 00:01:34.881 resulting in significant loan losses, earnings deterioration, capital depletion, 00:01:35.081 --> 00:01:37.061 and increased credit union failures. 00:01:37.631 --> 00:01:40.991 Most of the recent large losses to the National Credit Union Share 00:01:40.991 --> 00:01:45.091 Insurance Fund (NCUSIF) are due to poor management of large concentrations 00:01:45.091 --> 00:01:49.101 in various asset classes in relation to the asset size and net worth 00:01:49.101 --> 00:01:51.001 level of the failed institutions. 00:01:51.371 --> 00:01:52.891 What is concentration risk? 00:01:53.191 --> 00:01:57.501 A risk concentration is any single exposure or group of exposures with the 00:01:57.501 --> 00:02:01.791 potential to produce losses large enough (relative to capital, total assets, 00:02:01.791 --> 00:02:05.661 or overall risk level) to threaten a financial institution’s health or 00:02:05.661 --> 00:02:08.121 ability to maintain its core operations. 00:02:08.589 --> 00:02:12.519 Avoiding concentrating too much in any single product or service is a core 00:02:12.519 --> 00:02:17.129 tenet of effective risk management and when violated increases the risk of loss 00:02:17.129 --> 00:02:19.319 to the credit union and to the NCUSIF. 00:02:19.879 --> 00:02:23.259 Too much reliance on any single product or service increases 00:02:23.259 --> 00:02:26.909 the potential for adverse consequences from “event risk” (i.e. 00:02:27.239 --> 00:02:31.689 a negative event, such as a housing market crash, that significantly affects the 00:02:31.689 --> 00:02:33.709 financial condition of the institution). 00:02:34.339 --> 00:02:38.769 Every asset, liability, product, service, and third party provider presents 00:02:38.769 --> 00:02:42.829 a risk of loss to the credit union under varying conditions or events. 00:02:43.059 --> 00:02:45.699 Some risks are less likely than others to occur. 00:02:46.249 --> 00:02:50.149 It is up to credit union management to identify the risk in each product 00:02:50.149 --> 00:02:53.969 or service line, quantify the risk and set appropriate concentration 00:02:53.969 --> 00:02:55.669 limits based on the analysis. 00:02:56.115 --> 00:02:58.225 What are some types of concentration risk? 00:02:58.639 --> 00:03:03.049 Concentration risk is present in many forms across credit union operations. 00:03:03.409 --> 00:03:06.249 Examples include: Asset classes (e.g. 00:03:06.529 --> 00:03:10.689 residential real estate loans, member business loans, automobile loans, 00:03:10.869 --> 00:03:13.059 loan participations or investments). 00:03:13.409 --> 00:03:15.789 Concentrations within a class of assets. 00:03:16.089 --> 00:03:20.759 Examples include, but are not limited to: o Residential Real Estate Loans 00:03:20.759 --> 00:03:25.599 – collateral type, lien position, geographic area, non-traditional terms (such as 00:03:25.599 --> 00:03:30.229 interest-only, payment option, or balloon payment), fixed or variable interest 00:03:30.229 --> 00:03:35.289 rate, low or reduced underwriting documentation, and loan-to-value (L T V). 00:03:35.599 --> 00:03:38.849 o Member Business Loans (M B Ls) – types of loans (e.g. 00:03:39.199 --> 00:03:43.869 real estate, working capital, and credit cards), collateral type, payment feature 00:03:43.869 --> 00:03:49.339 (such as interest-only, balloon payments), loan term, geographic area, and L T V. 00:03:49.776 --> 00:03:52.116 Loan Participations – types of loans (e.g. 00:03:52.626 --> 00:03:56.556 residential real estate, MBL, and automobile) and the sub-classes 00:03:56.556 --> 00:04:00.366 associated with the types, originating lender, and geographic area. 00:04:00.876 --> 00:04:04.256 o Loans to one borrower or associated group of borrowers (may 00:04:04.256 --> 00:04:07.416 include several different types of loans – residential real estate, 00:04:07.726 --> 00:04:09.916 MBLs, consumer loans, etcetera). 00:04:10.276 --> 00:04:12.366 o Investments – types of investments (e.g. 00:04:12.856 --> 00:04:16.416 Treasury securities, certificates of deposit, and mortgage-backed 00:04:16.446 --> 00:04:20.596 securities), collateral type, interest rates, issuer (public or private), 00:04:20.776 --> 00:04:22.496 tranche priority, and broker. 00:04:22.996 --> 00:04:24.086 Liabilities (e.g. 00:04:24.606 --> 00:04:27.546 rate sensitive share deposits or callable borrowings). 00:04:28.006 --> 00:04:29.176 Third-party providers (e.g. 00:04:29.176 --> 00:04:33.616 CUSOs, indirect loan partners or mortgage brokerage firms). 00:04:34.066 --> 00:04:36.346 Services provided to other parties (e.g. 00:04:36.766 --> 00:04:39.956 loan underwriting and/or servicing, insurance services, 00:04:40.046 --> 00:04:41.576 and investment consultation). 00:04:42.076 --> 00:04:45.106 When reviewing the types of concentrations in a credit union, 00:04:45.316 --> 00:04:49.796 examiners must be cognizant of other asset categories that may seem unrelated. 00:04:50.296 --> 00:04:53.586 For instance, the types of loans and characteristics of the loans 00:04:53.766 --> 00:04:57.446 may be one form of concentration risk that is easily identified. 00:04:57.816 --> 00:05:01.526 However, similar characteristics may exist in a loan participation 00:05:01.526 --> 00:05:03.936 portfolio or an investment portfolio. 00:05:04.406 --> 00:05:08.476 A clear example of this concept would be a credit union that holds a portfolio 00:05:08.476 --> 00:05:12.726 of real estate loans and also a portfolio of mortgage backed securities. 00:05:13.176 --> 00:05:16.456 There are common event risks in these types of assets that must be 00:05:16.456 --> 00:05:18.646 quantified and mitigated by management. 00:05:19.211 --> 00:05:22.941 What are the largest exposures (risk concentrations) in credit unions? 00:05:23.331 --> 00:05:27.121 Concentration in credit portfolios is considered to be the most significant 00:05:27.121 --> 00:05:29.511 source of risk to financial institutions. 00:05:29.971 --> 00:05:33.531 Trends in credit union balance sheets reflect increased exposure 00:05:33.531 --> 00:05:37.321 to concentration risk in areas of their credit portfolios, such as: 00:05:37.923 --> 00:05:41.203 Real estate loans (fixed rates) – As of December thirty one, two 00:05:41.203 --> 00:05:45.173 thousand and nine, real estate loans held by credit unions comprise 00:05:45.223 --> 00:05:47.193 fifty-four percent of total loans. 00:05:47.673 --> 00:05:51.583 Of the two hundred and seventeen billion dollars in first mortgage loans, over 00:05:51.583 --> 00:05:53.743 60 percent have fixed rate terms. 00:05:54.333 --> 00:05:58.203 In addition, fixed rate first mortgage loans have increased by fifty five 00:05:58.203 --> 00:06:00.273 percent since two thousand and five. 00:06:00.717 --> 00:06:05.047 Member business loans – As of December thirty one, two thousand and nine, member 00:06:05.047 --> 00:06:07.707 business loans totaled $35 billion. 00:06:08.147 --> 00:06:11.687 Credit unions grew their member business loan portfolios by 9.8 00:06:11.687 --> 00:06:13.407 percent in two thousand and nine. 00:06:13.867 --> 00:06:17.307 Loan participations – As of December thirty one, two thousand and 00:06:17.307 --> 00:06:21.877 nine, credit union participations outstanding totaled $12.4 billion, 00:06:21.927 --> 00:06:26.487 and participation lending increased by 11.6 percent in two thousand and nine. 00:06:26.950 --> 00:06:30.920 Construction and Development (C&D) loans – As of December thirty one, 00:06:30.920 --> 00:06:35.020 two thousand and nine, credit unions owned two point four billion dollars in 00:06:35.020 --> 00:06:37.560 commercial and residential C&D loans. 00:06:38.070 --> 00:06:41.250 While this trend has declined since two thousand and seven, the 00:06:41.250 --> 00:06:44.590 real estate market downturn could continue to have an adverse effect 00:06:44.590 --> 00:06:48.980 on credit unions with concentrations of C&D loans in their portfolio. 00:06:49.442 --> 00:06:52.832 Investments in Mortgage-Related Securities – As of December thirty 00:06:52.832 --> 00:06:57.382 one, two thousand and nine, credit union investments in mortgage-related securities 00:06:57.382 --> 00:07:01.572 totaled fifty eight point seven billion dollars; which is in addition to the 00:07:01.572 --> 00:07:03.962 real estate loan exposure stated above. 00:07:04.632 --> 00:07:07.872 Investments in mortgage-related securities have more than doubled 00:07:07.872 --> 00:07:09.432 since two thousand and five. 00:07:10.002 --> 00:07:12.782 How is concentration risk identified and measured? 00:07:13.093 --> 00:07:16.653 Each product or service carries some risk of financial exposure 00:07:16.653 --> 00:07:18.363 or loss for the credit union. 00:07:18.863 --> 00:07:22.263 Management needs to perform a risk assessment which demonstrates their 00:07:22.263 --> 00:07:26.163 understanding of the risk of the product or service, quantifies the potential 00:07:26.163 --> 00:07:30.553 loss exposure, and documents a rational business decision on the acceptable 00:07:30.553 --> 00:07:33.033 concentration level based on the analysis. 00:07:33.503 --> 00:07:37.733 The larger the concentration level, the more robust and advanced the analysis 00:07:37.733 --> 00:07:39.843 and risk management techniques should be. 00:07:40.133 --> 00:07:44.083 For instance, the sophistication and depth of risk management systems and 00:07:44.083 --> 00:07:48.203 analysis conducted on a real estate portfolio that represents twenty percent 00:07:48.203 --> 00:07:52.103 of total loans could be acceptably less than a real estate portfolio that 00:07:52.103 --> 00:07:54.453 represents fifty percent of total loans. 00:07:54.939 --> 00:07:57.909 Another example is the level of due diligence conducted on 00:07:57.909 --> 00:07:59.719 a third party service provider. 00:08:00.309 --> 00:08:04.089 The more important the service to the core operation of the credit union and 00:08:04.089 --> 00:08:08.479 the higher the amount of activity and dollar volume of credit union activity it 00:08:08.479 --> 00:08:13.009 handles, the more sophisticated and robust the due diligence oversight needs to be. 00:08:13.424 --> 00:08:15.174 Supervisory Letter – Page 4 00:08:15.613 --> 00:08:19.883 Similar to the depth and sophistication of the initial review, management must 00:08:19.883 --> 00:08:24.003 increase the intensity and depth of on-going monitoring and review of products 00:08:24.003 --> 00:08:26.133 and services with high concentrations. 00:08:26.593 --> 00:08:30.813 To measure and monitor concentration risk, credit unions must start with the systems 00:08:30.813 --> 00:08:32.783 used to store and analyze their data. 00:08:33.303 --> 00:08:37.213 For more complex products, establishing comprehensive data warehousing 00:08:37.213 --> 00:08:40.163 will allow management to track changes in the quality of their 00:08:40.163 --> 00:08:42.263 various lines of business over time. 00:08:42.719 --> 00:08:47.109 Without an all-inclusive process to maintain and analyze data, the board 00:08:47.109 --> 00:08:50.579 of directors and senior management will not have the tools necessary 00:08:50.579 --> 00:08:54.519 to make strategic and operational decisions in a safe and sound manner. 00:08:54.959 --> 00:08:57.409 Maintaining Comprehensive and Accurate Data 00:08:57.867 --> 00:09:02.077 Credit union management must emphasize the importance of maintaining comprehensive 00:09:02.077 --> 00:09:04.327 and accurate data for each risk area. 00:09:04.947 --> 00:09:08.547 This includes a quality control function to ensure that data entry 00:09:08.547 --> 00:09:10.547 and changes are accurate and timely. 00:09:10.997 --> 00:09:14.197 The credit union should have a data processing system capable of 00:09:14.197 --> 00:09:18.237 warehousing data on various lines of business, commensurate with its size 00:09:18.237 --> 00:09:22.457 and complexity, to properly identify and measure concentration risk. 00:09:22.978 --> 00:09:26.298 For example, this would include maintaining information relevant to 00:09:26.298 --> 00:09:30.378 the loan portfolio such as loan type, interest rate, interest rate reset 00:09:30.378 --> 00:09:34.208 dates (if applicable), payment amount, payment shock (the potential increase 00:09:34.208 --> 00:09:37.928 in payment from an interest rate reset or conversion from interest-only to 00:09:37.928 --> 00:09:42.018 principal and interest payments), credit score (including original and updated 00:09:42.018 --> 00:09:45.898 periodically), collateral description, and collateral value (including 00:09:45.898 --> 00:09:48.088 original and updated periodically). 00:09:48.604 --> 00:09:51.864 Another example would include maintaining information relevant to 00:09:51.864 --> 00:09:56.034 the investment portfolio such as type, interest rate, collateral information, 00:09:56.174 --> 00:10:00.264 market value (original and updated periodically), and external rating 00:10:00.264 --> 00:10:02.444 (original and updated periodically). 00:10:02.944 --> 00:10:07.014 This is not an all-inclusive list, but rather a starting point for evaluating 00:10:07.064 --> 00:10:10.964 if the data processing system is capable of maintaining this type of data. 00:10:11.514 --> 00:10:15.664 If the credit union does not have the data processing capability, management 00:10:15.664 --> 00:10:19.544 should contract with a third party to provide data warehousing and reporting. 00:10:20.064 --> 00:10:23.664 If management elects to pursue this route, examiners should review their 00:10:23.664 --> 00:10:27.274 initial and ongoing due diligence of the vendor to ensure it is in 00:10:27.274 --> 00:10:31.194 accordance with published guidance and safe and sound business practices. 00:10:31.635 --> 00:10:32.795 Risk Rating System 00:10:33.282 --> 00:10:37.032 Developing an effective, accurate, and timely risk rating system is 00:10:37.032 --> 00:10:40.962 an important tool for managing concentration risk in the loan portfolio. 00:10:41.462 --> 00:10:45.202 Risk ratings should be objective, sensitive to changes in borrower and/or 00:10:45.202 --> 00:10:49.522 loan characteristics, and validated via an independent review function. 00:10:49.984 --> 00:10:53.934 With loan participations, credit unions should assess the loan utilizing 00:10:53.934 --> 00:10:55.794 their own internal rating system. 00:10:56.374 --> 00:11:00.354 In the absence of an internal rating system, management should not rely on 00:11:00.354 --> 00:11:04.404 the originating institution’s system without completing timely, thorough, and 00:11:04.404 --> 00:11:06.544 ongoing due diligence of that system. 00:11:06.969 --> 00:11:08.869 Supervisory Letter – Page 5 00:11:09.262 --> 00:11:12.772 Examiners should review management’s documentation of the original and 00:11:12.802 --> 00:11:16.702 ongoing due diligence; ensuring that it is consistent with safe 00:11:16.702 --> 00:11:18.422 and sound business practices. 00:11:18.853 --> 00:11:19.523 Reporting 00:11:19.898 --> 00:11:24.638 Management reporting must be periodic and timely, in a format that clearly indicates 00:11:24.638 --> 00:11:29.018 changes in concentration risk and is commensurate with the size, complexity, 00:11:29.048 --> 00:11:31.168 and risk exposure of the credit union. 00:11:31.648 --> 00:11:34.838 The reports should not only measure concentration risk against board 00:11:34.838 --> 00:11:38.988 approved parameters, but should also measure how the risks change over time. 00:11:39.438 --> 00:11:42.958 For example, a key factor in determining concentration risk in a 00:11:42.958 --> 00:11:47.188 loan portfolio would be to measure credit score migration, by obtaining 00:11:47.188 --> 00:11:51.538 updated credit scores on a periodic basis and analyzing those borrowers 00:11:51.538 --> 00:11:53.188 who have a declining credit score. 00:11:53.688 --> 00:11:56.648 The frequency of reporting should be commensurate with the type and 00:11:56.648 --> 00:12:00.458 size of the concentration; for example, larger portfolios should 00:12:00.458 --> 00:12:02.038 have at least quarterly reporting. 00:12:02.598 --> 00:12:04.588 How is concentration risk managed? 00:12:04.943 --> 00:12:08.043 Implementing sound risk management practices is the key 00:12:08.043 --> 00:12:09.873 to managing concentration risk. 00:12:10.193 --> 00:12:13.493 When credit unions have significant concentrations on their balance 00:12:13.493 --> 00:12:17.803 sheet, examiners need to ensure risk management practices are commensurate 00:12:17.803 --> 00:12:21.553 with the risk assumed relative to net worth, and management clearly 00:12:21.553 --> 00:12:23.683 identifies and measures the risk taken. 00:12:24.263 --> 00:12:27.543 The ultimate responsibility for setting the level of concentration 00:12:27.543 --> 00:12:31.123 risk assumed by the credit union rests with the board of directors. 00:12:31.673 --> 00:12:35.743 Senior management is responsible for maintaining concentration risk within the 00:12:35.743 --> 00:12:38.143 parameters set by the board of directors. 00:12:38.606 --> 00:12:42.576 Concentration risk has a substantial influence on credit, strategic, 00:12:42.576 --> 00:12:46.866 reputation, interest rate, and liquidity risks as all are closely related. 00:12:47.356 --> 00:12:50.566 All of these risks impact net worth and must be supported by a 00:12:50.566 --> 00:12:53.606 net worth level commensurate with the risk in the balance sheet. 00:12:54.126 --> 00:12:57.286 The board of directors and senior management need to manage all of 00:12:57.286 --> 00:12:59.286 these risk areas simultaneously. 00:12:59.686 --> 00:13:03.666 One of the common flaws in managing risks within a credit union is to tie 00:13:03.706 --> 00:13:07.656 each risk independently to net worth, without monitoring the aggregate 00:13:07.656 --> 00:13:09.936 exposure of different risks to net worth. 00:13:10.416 --> 00:13:13.666 The result may be excessive reliance on the level of net worth 00:13:13.666 --> 00:13:15.626 to manage each individual risk. 00:13:16.176 --> 00:13:20.046 Effective risk management practices would not only include tying the limits 00:13:20.046 --> 00:13:24.406 of each product or service to net worth, but also consolidating the risks in 00:13:24.406 --> 00:13:28.826 products and services and measuring the totality of the risks against net worth. 00:13:29.396 --> 00:13:32.046 Board Policy & Concentration Risk Limits 00:13:32.434 --> 00:13:36.814 The board of directors must establish a policy which addresses its philosophy on 00:13:36.814 --> 00:13:41.434 concentration risk, limits commensurate with net worth levels, and the rationale 00:13:41.434 --> 00:13:45.574 as to how the limits fit into the overall strategic plan of the credit union. 00:13:45.957 --> 00:13:47.787 Supervisory Letter – Page 6 00:13:48.259 --> 00:13:51.699 The board should use a global perspective when developing this policy, 00:13:51.969 --> 00:13:56.079 including identifying outside forces (such as economic or housing price 00:13:56.079 --> 00:13:59.949 uncertainty) which will affect the ability to manage concentration risk. 00:14:00.429 --> 00:14:04.039 For example, the board should not begin or expand a mortgage program 00:14:04.139 --> 00:14:07.579 that allows high loan-to-values at the height of a real estate bubble, 00:14:07.859 --> 00:14:11.299 which will likely lead to significant losses when the market declines. 00:14:11.869 --> 00:14:15.559 The parameters set by the board should be specific to each portfolio 00:14:15.809 --> 00:14:19.389 and should include limits on loan types, share types, third party 00:14:19.389 --> 00:14:21.339 relationship exposure, etcetera. 00:14:21.569 --> 00:14:24.829 The risk limits should correlate to the overall growth objectives, 00:14:24.829 --> 00:14:27.109 financial targets, and net worth plan. 00:14:27.619 --> 00:14:31.119 The risk limits set forth in the concentration risk policy should be 00:14:31.119 --> 00:14:35.309 closely linked to those codified in related policies, including, but not 00:14:35.309 --> 00:14:39.699 limited to, real estate loan, member business loan, loan participation, 00:14:39.749 --> 00:14:42.919 asset/liability management (ALM), and investment policies. 00:14:43.369 --> 00:14:47.259 Concentrations that exceed one hundred percent of net worth must be monitored 00:14:47.259 --> 00:14:51.229 carefully, and the board of directors should document an adequate rationale 00:14:51.229 --> 00:14:53.149 for undertaking that level of risk. 00:14:53.655 --> 00:14:54.835 Third Party Oversight 00:14:55.341 --> 00:14:58.941 When working with third parties, due diligence is essential to ensure the 00:14:58.941 --> 00:15:01.431 risks are properly identified and managed. 00:15:01.921 --> 00:15:05.721 Examples of third party services include purchase of participations 00:15:05.721 --> 00:15:10.041 in loans; underwriting, processing and safekeeping member loans; and 00:15:10.041 --> 00:15:12.071 purchase or safekeeping investments. 00:15:12.661 --> 00:15:16.381 Numerous guidance letters have been issued on this subject, and are listed 00:15:16.381 --> 00:15:18.341 in the references section of this letter. 00:15:18.828 --> 00:15:22.708 The guidance discusses the need for due diligence reviews to take into account the 00:15:22.708 --> 00:15:26.898 nature of the service, length and depth of expertise exhibited by the vendor, 00:15:27.038 --> 00:15:31.968 staffing changes, economic and regulatory changes, and risk mitigation strategies 00:15:31.968 --> 00:15:33.808 associated with vendor oversight. 00:15:34.288 --> 00:15:38.008 Also important to note is that due diligence is an ongoing process. 00:15:38.508 --> 00:15:42.058 It encompasses the original review at the outset of product or service 00:15:42.058 --> 00:15:46.138 implementation and should be updated periodically to monitor changes 00:15:46.138 --> 00:15:49.608 in the vendor’s ability to deliver products or services which meet 00:15:49.608 --> 00:15:51.498 the credit union’s expectations. 00:15:52.018 --> 00:15:54.798 How is concentration risk monitored and controlled? 00:15:55.228 --> 00:15:59.348 Once the appropriate risk management systems and policies are in place, it 00:15:59.348 --> 00:16:03.248 is essential monitoring and oversight become routine functions at the senior 00:16:03.248 --> 00:16:05.338 management level within the credit union. 00:16:05.848 --> 00:16:09.358 Ultimately, the board of directors is responsible for oversight and 00:16:09.358 --> 00:16:11.208 monitoring at a strategic level. 00:16:11.818 --> 00:16:15.558 Regular formal reporting to the board and senior management on compliance 00:16:15.558 --> 00:16:18.998 with the concentration and risk limits they establish is expected. 00:16:19.548 --> 00:16:23.678 In addition, management should implement appropriate internal controls, including 00:16:23.678 --> 00:16:27.928 segregation of duties, to ensure accurate reporting on concentration risk. 00:16:28.188 --> 00:16:31.308 Compliance and Oversight Senior management needs to implement 00:16:31.308 --> 00:16:35.568 procedures and controls to effectively adhere to and monitor compliance with 00:16:35.568 --> 00:16:37.628 established policies and strategies. 00:16:38.108 --> 00:16:41.558 Both the board and management must periodically review information that 00:16:41.558 --> 00:16:45.378 identifies and measures the level and nature of concentration risk and 00:16:45.378 --> 00:16:49.168 implement corrective action should the risk from any one area exceed 00:16:49.168 --> 00:16:50.998 the board approved tolerance level. 00:16:51.414 --> 00:16:53.254 Supervisory Letter – Page 7 00:16:53.758 --> 00:16:57.728 Credit unions with large and complex loan or investment programs should 00:16:57.728 --> 00:17:02.028 establish a specific risk management committee as a sound business practice. 00:17:02.608 --> 00:17:05.948 The composition of the committee will depend on the size and complexity 00:17:05.948 --> 00:17:09.548 of the credit union, but should be limited to a small number of senior 00:17:09.548 --> 00:17:11.868 executives and one or more board members. 00:17:12.458 --> 00:17:16.068 The agenda of this committee should be limited to risk management issues; 00:17:16.308 --> 00:17:20.898 specifically concentration risk, credit risk, interest rate risk, liquidity 00:17:20.898 --> 00:17:22.798 risk, and financial performance. 00:17:23.165 --> 00:17:26.825 From a reporting perspective, management should demonstrate compliance with 00:17:26.825 --> 00:17:31.265 every board established policy limit dealing with concentration risk, as well 00:17:31.265 --> 00:17:35.545 as limits on associated risks such as credit, interest rate, and liquidity. 00:17:35.962 --> 00:17:38.252 Scenario and Sensitivity Analysis 00:17:38.679 --> 00:17:43.089 Credit unions should routinely perform portfolio-level scenario and sensitivity 00:17:43.089 --> 00:17:47.109 tests to quantify the impact of changing economic conditions on asset 00:17:47.109 --> 00:17:49.049 quality, earnings, and net worth. 00:17:49.469 --> 00:17:53.209 In general, scenario analysis uses the model to predict a possible 00:17:53.209 --> 00:17:57.539 future outcome given an event or a series of events, while sensitivity 00:17:57.539 --> 00:18:01.549 analysis tests a model’s parameters without relating those changes to an 00:18:01.579 --> 00:18:04.039 underlying event or real world outcome. 00:18:04.464 --> 00:18:08.284 The outcome of sensitivity analysis is to determine which assumptions have 00:18:08.284 --> 00:18:10.364 the most impact on the model’s results. 00:18:10.894 --> 00:18:14.534 Credit unions should consider the susceptibility of portfolio segments 00:18:14.534 --> 00:18:17.884 with common risk characteristics to changing market conditions. 00:18:18.254 --> 00:18:22.544 Examples of common risk characteristics can be by loan type, investment type, 00:18:22.654 --> 00:18:26.814 collateral type, geographic area, individual or associational groups of 00:18:26.814 --> 00:18:28.904 borrowers, business lines, etcetera. 00:18:29.424 --> 00:18:33.634 An example scenario analysis for a concentration in HE LOCK mortgages would 00:18:33.634 --> 00:18:37.774 be the risk to earnings if unemployment in the area doubled while house market 00:18:37.774 --> 00:18:41.774 values declined by twenty five percent, combined with the effect of interest 00:18:41.774 --> 00:18:44.214 rate resets and associated payment shock. 00:18:44.740 --> 00:18:49.160 An example scenario analysis for a concentration in thirty year, fixed-rate 00:18:49.160 --> 00:18:53.050 mortgages would be the risk to earnings and capital from liquidity and interest 00:18:53.050 --> 00:18:57.310 rate risks in a rising rate environment; where liquidity risk increases as 00:18:57.310 --> 00:19:01.760 mortgage cash flows decrease, and rising interest rate risk causes earnings 00:19:01.760 --> 00:19:06.290 to deteriorate as members seek higher dividend rates to maintain their deposits. 00:19:06.666 --> 00:19:10.346 The analyses should be multi-faceted to explore the effect of single 00:19:10.346 --> 00:19:13.616 and multiple simultaneous negative events on the portfolio. 00:19:14.046 --> 00:19:17.416 The sophistication of scenario and sensitivity analyses should 00:19:17.416 --> 00:19:20.966 be consistent with the size, complexity, and risk characteristics 00:19:20.966 --> 00:19:22.556 of the portfolio as a whole. 00:19:23.049 --> 00:19:26.869 Basel Committee on Banking Supervision, Principles for Sound Stress 00:19:26.899 --> 00:19:28.939 Testing Practices and Supervision. 00:19:29.379 --> 00:19:30.829 May two thousand and nine. 00:19:31.214 --> 00:19:32.874 Supervisory Letter – Page 8 00:19:33.419 --> 00:19:37.639 What are basic review procedures for examiners related to concentration risk? 00:19:38.019 --> 00:19:42.159 The following are some basic review steps and questions examiners should ask when 00:19:42.159 --> 00:19:44.559 conducting a review of concentration risk. 00:19:44.979 --> 00:19:48.879 Examiner expectations for the depth and sophistication of the responses 00:19:48.879 --> 00:19:52.259 from credit union management should increase if the initial review 00:19:52.259 --> 00:19:56.079 of a credit union’s balance sheet reveals potentially high exposure. 00:19:56.531 --> 00:20:00.161 • Does the credit union have policies directly related to identifying, 00:20:00.261 --> 00:20:03.481 measuring, monitoring, and controlling concentration risk? 00:20:03.931 --> 00:20:07.811 Examiners should ensure credit unions consider the following when evaluating 00:20:07.811 --> 00:20:11.481 the board policies: The level and nature of inherent risk on the 00:20:11.481 --> 00:20:16.351 balance sheet; Management expertise; Risk management practices; Market 00:20:16.351 --> 00:20:20.711 conditions; and Adequacy of reserves allocated for concentration risk. 00:20:21.195 --> 00:20:24.785 • Has the credit union developed appropriate policies and procedures, 00:20:25.095 --> 00:20:29.255 including establishing acceptable risk limits for each product and service 00:20:29.255 --> 00:20:31.625 on an individual and aggregate basis? 00:20:31.935 --> 00:20:35.795 • Has management assessed the adequacy of net worth based on the aggregate 00:20:35.795 --> 00:20:40.415 potential exposure to all forms of concentration risk, while also considering 00:20:40.415 --> 00:20:44.645 the potential credit, interest rate, and liquidity risk impact on net worth? 00:20:45.049 --> 00:20:48.759 • Has the credit union considered the various types of concentrations and 00:20:48.759 --> 00:20:53.079 their interrelationship, particularly between asset classes or common products 00:20:53.079 --> 00:20:57.279 and service characteristics, which may present higher risk when aggregated? 00:20:57.704 --> 00:21:01.914 • Has the credit union considered the “event risks” that may expose them to financial 00:21:01.914 --> 00:21:06.684 loss for each asset class, quantified the risk, and established appropriate risk 00:21:06.684 --> 00:21:11.004 tolerance limits based on the probability and potential impact from each event? 00:21:11.320 --> 00:21:15.570 • Do the board and senior management receive regular reports on the individual and 00:21:15.620 --> 00:21:18.050 aggregate exposure to concentration risk? 00:21:18.427 --> 00:21:22.497 • Does management have predetermined actions to take when risk limits are reached? 00:21:22.857 --> 00:21:24.617 Do they take the appropriate action? 00:21:24.967 --> 00:21:29.057 A material red flag is a credit union that simply raises the established 00:21:29.057 --> 00:21:32.287 limit when it is reached without advanced analysis supporting the 00:21:32.287 --> 00:21:34.287 rationale for the change in policy. 00:21:34.761 --> 00:21:38.531 • Is the credit union’s system of identifying, measuring, monitoring, 00:21:38.531 --> 00:21:41.641 and controlling concentration risk commensurate with the level of 00:21:41.641 --> 00:21:43.921 potential concentration risk exposure? 00:21:44.241 --> 00:21:46.051 Supervisory Letter – Page 9 00:21:46.451 --> 00:21:50.471 • When credit unions have significant loan concentrations, does management 00:21:50.471 --> 00:21:54.751 maintain reports and perform analysis of the following: Origination and 00:21:54.751 --> 00:21:58.901 portfolio trends by product, loan structure, originator channel, credit 00:21:58.901 --> 00:22:03.991 score, LTV, debt-to-income ratio (DTI), lien position, documentation 00:22:03.991 --> 00:22:08.161 type, property type, appraiser, appraised value, and appraisal date; 00:22:08.650 --> 00:22:12.990 Delinquency and loss distribution trends by product and originator channel with 00:22:12.990 --> 00:22:17.090 accompanying analysis of significant underwriting characteristics, such as 00:22:17.090 --> 00:22:22.970 credit score, L TV, and D T I; Vintage tracking3 (i.e., static pool analysis); 00:22:23.355 --> 00:22:26.585 The performance of third-party (brokers, auto dealers, and 00:22:26.585 --> 00:22:28.585 correspondents) originated loans; 00:22:29.054 --> 00:22:32.804 and, Market trends by geographic area and property type to identify 00:22:32.874 --> 00:22:36.764 areas of rapidly appreciating or depreciating housing values. 00:22:37.185 --> 00:22:40.595 What options are available when a credit union or the examiner 00:22:40.595 --> 00:22:43.025 identifies elevated concentration risk? 00:22:43.419 --> 00:22:46.939 The board of directors and management should have triggers and action plans 00:22:46.939 --> 00:22:49.169 in writing for any material risk area. 00:22:49.729 --> 00:22:53.229 If the credit union’s monitoring activities identify concerns with 00:22:53.229 --> 00:22:56.909 a concentration, the board of directors must respond accordingly. 00:22:57.309 --> 00:23:01.359 Similarly, if an examiner believes there may be elevated concentration risk 00:23:01.359 --> 00:23:05.759 issues present in a credit union, and management has not properly quantified 00:23:05.759 --> 00:23:09.849 and mitigated the risk, they should require corrective actions of management 00:23:09.849 --> 00:23:12.139 that include, but are not limited to: 00:23:12.598 --> 00:23:16.338 Expanding the review of the risk environment for the particular sector(s); 00:23:16.728 --> 00:23:20.068 Performing elevated scenario and sensitivity analyses; 00:23:20.515 --> 00:23:23.575 Expanding the review of performance of existing borrowers; 00:23:24.036 --> 00:23:27.066 Reviewing growth and limitations for new business lines; 00:23:27.535 --> 00:23:30.855 and/or Reviewing risk mitigation options and timeframes for 00:23:30.855 --> 00:23:32.845 reduction of risk, if necessary. 00:23:33.400 --> 00:23:37.640 3Risk Alert zero five Risk 0 1, Specialized Lending Activities 00:23:37.690 --> 00:23:41.430 – Third-Party Indirect Lending and Participations, and the accompanying 00:23:41.430 --> 00:23:45.570 supplemental guidance whitepaper on static pool analysis discusses how 00:23:45.570 --> 00:23:49.420 such analysis can be used to track the performance of most loan pools. 00:23:49.878 --> 00:23:53.828 This guidance can be applied to all non-traditional products or other loan 00:23:53.828 --> 00:23:56.028 products, not just indirect lending. 00:23:56.428 --> 00:23:58.198 Supervisory Letter – Page 10 00:23:58.620 --> 00:24:02.270 If management determines concentration risk is elevated, they should 00:24:02.300 --> 00:24:04.280 implement steps to mitigate the risk. 00:24:04.830 --> 00:24:08.090 If management does not properly assess or control the level of 00:24:08.090 --> 00:24:11.800 risk, examiners should require corrective actions to mitigate the 00:24:11.800 --> 00:24:14.270 risks, including but not limited to: 00:24:14.745 --> 00:24:18.635 Reducing limits or thresholds on risk concentrations; Reducing 00:24:18.635 --> 00:24:22.405 exposure to new business lines to address undue concentrations; 00:24:22.860 --> 00:24:26.560 Transferring risk to other parties by either selling directly or as 00:24:26.560 --> 00:24:28.660 part of securitization transactions; 00:24:29.072 --> 00:24:31.492 and/or Ceasing the product or service line. 00:24:31.972 --> 00:24:35.512 Conclusion Excessive concentration risk can severely impact the 00:24:35.512 --> 00:24:37.622 financial condition of a credit union. 00:24:38.162 --> 00:24:42.172 High concentrations in areas experiencing severe economic distress 00:24:42.172 --> 00:24:46.152 could result in significant losses exceeding a credit union’s net worth. 00:24:46.722 --> 00:24:50.272 It is the fiduciary responsibility of management and officials of credit 00:24:50.272 --> 00:24:54.732 unions to identify, manage, monitor, and control the risks facing the credit 00:24:54.732 --> 00:24:57.082 union, including concentration risk. 00:24:57.482 --> 00:25:01.072 Examiners need to ascertain whether the board of directors and management 00:25:01.072 --> 00:25:03.582 understand and actively manage this risk. 00:25:03.972 --> 00:25:07.642 Credit union management should know what their concentration risk is and 00:25:07.642 --> 00:25:10.902 be able to demonstrate appropriate risk management and mitigation 00:25:10.902 --> 00:25:15.112 practices to minimize the risk of significant financial condition decline. 00:25:15.583 --> 00:25:17.873 This concludes the Concentration Risk Letter. 00:25:18.333 --> 00:25:22.403 If your credit union could use assistance with your exam, reach out to Mark Treichel 00:25:22.403 --> 00:25:25.123 on LinkedIn, or at mark Treichel dot com. 00:25:25.593 --> 00:25:28.233 This is Samantha Shares and I Thank you for listening.