Samantha: Hello this is Samantha Shares.
This episode covers NCU A's Letter to Credit Unions on Concentration Risk.
Many credit unions are receiving Documents of Resolution on
Concentration Risk and told to comply with the guidance in this letter.
The following is and audio version of that letter.
But first this podcast is educational and is not legal advice.
We are sponsored by Credit Union Exam Solutions Incorporated, whose
team has over two hundred and Forty years of National Credit
Union Administration experience.
We assist our clients with N C U A so they save time and money.
If you are worried about a recent, upcoming or in process N C U A
examination, reach out to learn how they can assist at Mark Treichel DOT COM.
Also check out our other podcast called With Flying Colors where we provide tips
on how to achieve success with N C U A.
And now the Supervisory letter.
Supervisory Letter Concentration Risk Credit union officials and management
have a fiduciary responsibility to identify, measure, monitor,
and control concentration risk.
Concentration risk must be managed in conjunction with credit, interest rate
and liquidity risks; as a negative event in any category may have significant
consequences on the other areas, as well as strategic and reputation risks.
Concentration risk has increased in importance during the
recent economic recession.
Poor risk management of residential and commercial mortgage loan concentrations,
in particular, is having an adverse effect on credit unions nationwide;
resulting in significant loan losses, earnings deterioration, capital depletion,
and increased credit union failures.
Most of the recent large losses to the National Credit Union Share
Insurance Fund (NCUSIF) are due to poor management of large concentrations
in various asset classes in relation to the asset size and net worth
level of the failed institutions.
What is concentration risk?
A risk concentration is any single exposure or group of exposures with the
potential to produce losses large enough (relative to capital, total assets,
or overall risk level) to threaten a financial institution’s health or
ability to maintain its core operations.
Avoiding concentrating too much in any single product or service is a core
tenet of effective risk management and when violated increases the risk of loss
to the credit union and to the NCUSIF.
Too much reliance on any single product or service increases
the potential for adverse consequences from “event risk” (i.e.
a negative event, such as a housing market crash, that significantly affects the
financial condition of the institution).
Every asset, liability, product, service, and third party provider presents
a risk of loss to the credit union under varying conditions or events.
Some risks are less likely than others to occur.
It is up to credit union management to identify the risk in each product
or service line, quantify the risk and set appropriate concentration
limits based on the analysis.
What are some types of concentration risk?
Concentration risk is present in many forms across credit union operations.
Examples include: Asset classes (e.g.
residential real estate loans, member business loans, automobile loans,
loan participations or investments).
Concentrations within a class of assets.
Examples include, but are not limited to: o Residential Real Estate Loans
– collateral type, lien position, geographic area, non-traditional terms (such as
interest-only, payment option, or balloon payment), fixed or variable interest
rate, low or reduced underwriting documentation, and loan-to-value (L T V).
o Member Business Loans (M B Ls) – types of loans (e.g.
real estate, working capital, and credit cards), collateral type, payment feature
(such as interest-only, balloon payments), loan term, geographic area, and L T V.
Loan Participations – types of loans (e.g.
residential real estate, MBL, and automobile) and the sub-classes
associated with the types, originating lender, and geographic area.
o Loans to one borrower or associated group of borrowers (may
include several different types of loans – residential real estate,
MBLs, consumer loans, etcetera).
o Investments – types of investments (e.g.
Treasury securities, certificates of deposit, and mortgage-backed
securities), collateral type, interest rates, issuer (public or private),
tranche priority, and broker.
Liabilities (e.g.
rate sensitive share deposits or callable borrowings).
Third-party providers (e.g.
CUSOs, indirect loan partners or mortgage brokerage firms).
Services provided to other parties (e.g.
loan underwriting and/or servicing, insurance services,
and investment consultation).
When reviewing the types of concentrations in a credit union,
examiners must be cognizant of other asset categories that may seem unrelated.
For instance, the types of loans and characteristics of the loans
may be one form of concentration risk that is easily identified.
However, similar characteristics may exist in a loan participation
portfolio or an investment portfolio.
A clear example of this concept would be a credit union that holds a portfolio
of real estate loans and also a portfolio of mortgage backed securities.
There are common event risks in these types of assets that must be
quantified and mitigated by management.
What are the largest exposures (risk concentrations) in credit unions?
Concentration in credit portfolios is considered to be the most significant
source of risk to financial institutions.
Trends in credit union balance sheets reflect increased exposure
to concentration risk in areas of their credit portfolios, such as:
Real estate loans (fixed rates) – As of December thirty one, two
thousand and nine, real estate loans held by credit unions comprise
fifty-four percent of total loans.
Of the two hundred and seventeen billion dollars in first mortgage loans, over
60 percent have fixed rate terms.
In addition, fixed rate first mortgage loans have increased by fifty five
percent since two thousand and five.
Member business loans – As of December thirty one, two thousand and nine, member
business loans totaled $35 billion.
Credit unions grew their member business loan portfolios by 9.8
percent in two thousand and nine.
Loan participations – As of December thirty one, two thousand and
nine, credit union participations outstanding totaled $12.4 billion,
and participation lending increased by 11.6 percent in two thousand and nine.
Construction and Development (C&D) loans – As of December thirty one,
two thousand and nine, credit unions owned two point four billion dollars in
commercial and residential C&D loans.
While this trend has declined since two thousand and seven, the
real estate market downturn could continue to have an adverse effect
on credit unions with concentrations of C&D loans in their portfolio.
Investments in Mortgage-Related Securities – As of December thirty
one, two thousand and nine, credit union investments in mortgage-related securities
totaled fifty eight point seven billion dollars; which is in addition to the
real estate loan exposure stated above.
Investments in mortgage-related securities have more than doubled
since two thousand and five.
How is concentration risk identified and measured?
Each product or service carries some risk of financial exposure
or loss for the credit union.
Management needs to perform a risk assessment which demonstrates their
understanding of the risk of the product or service, quantifies the potential
loss exposure, and documents a rational business decision on the acceptable
concentration level based on the analysis.
The larger the concentration level, the more robust and advanced the analysis
and risk management techniques should be.
For instance, the sophistication and depth of risk management systems and
analysis conducted on a real estate portfolio that represents twenty percent
of total loans could be acceptably less than a real estate portfolio that
represents fifty percent of total loans.
Another example is the level of due diligence conducted on
a third party service provider.
The more important the service to the core operation of the credit union and
the higher the amount of activity and dollar volume of credit union activity it
handles, the more sophisticated and robust the due diligence oversight needs to be.
Supervisory Letter – Page 4
Similar to the depth and sophistication of the initial review, management must
increase the intensity and depth of on-going monitoring and review of products
and services with high concentrations.
To measure and monitor concentration risk, credit unions must start with the systems
used to store and analyze their data.
For more complex products, establishing comprehensive data warehousing
will allow management to track changes in the quality of their
various lines of business over time.
Without an all-inclusive process to maintain and analyze data, the board
of directors and senior management will not have the tools necessary
to make strategic and operational decisions in a safe and sound manner.
Maintaining Comprehensive and Accurate Data
Credit union management must emphasize the importance of maintaining comprehensive
and accurate data for each risk area.
This includes a quality control function to ensure that data entry
and changes are accurate and timely.
The credit union should have a data processing system capable of
warehousing data on various lines of business, commensurate with its size
and complexity, to properly identify and measure concentration risk.
For example, this would include maintaining information relevant to
the loan portfolio such as loan type, interest rate, interest rate reset
dates (if applicable), payment amount, payment shock (the potential increase
in payment from an interest rate reset or conversion from interest-only to
principal and interest payments), credit score (including original and updated
periodically), collateral description, and collateral value (including
original and updated periodically).
Another example would include maintaining information relevant to
the investment portfolio such as type, interest rate, collateral information,
market value (original and updated periodically), and external rating
(original and updated periodically).
This is not an all-inclusive list, but rather a starting point for evaluating
if the data processing system is capable of maintaining this type of data.
If the credit union does not have the data processing capability, management
should contract with a third party to provide data warehousing and reporting.
If management elects to pursue this route, examiners should review their
initial and ongoing due diligence of the vendor to ensure it is in
accordance with published guidance and safe and sound business practices.
Risk Rating System
Developing an effective, accurate, and timely risk rating system is
an important tool for managing concentration risk in the loan portfolio.
Risk ratings should be objective, sensitive to changes in borrower and/or
loan characteristics, and validated via an independent review function.
With loan participations, credit unions should assess the loan utilizing
their own internal rating system.
In the absence of an internal rating system, management should not rely on
the originating institution’s system without completing timely, thorough, and
ongoing due diligence of that system.
Supervisory Letter – Page 5
Examiners should review management’s documentation of the original and
ongoing due diligence; ensuring that it is consistent with safe
and sound business practices.
Reporting
Management reporting must be periodic and timely, in a format that clearly indicates
changes in concentration risk and is commensurate with the size, complexity,
and risk exposure of the credit union.
The reports should not only measure concentration risk against board
approved parameters, but should also measure how the risks change over time.
For example, a key factor in determining concentration risk in a
loan portfolio would be to measure credit score migration, by obtaining
updated credit scores on a periodic basis and analyzing those borrowers
who have a declining credit score.
The frequency of reporting should be commensurate with the type and
size of the concentration; for example, larger portfolios should
have at least quarterly reporting.
How is concentration risk managed?
Implementing sound risk management practices is the key
to managing concentration risk.
When credit unions have significant concentrations on their balance
sheet, examiners need to ensure risk management practices are commensurate
with the risk assumed relative to net worth, and management clearly
identifies and measures the risk taken.
The ultimate responsibility for setting the level of concentration
risk assumed by the credit union rests with the board of directors.
Senior management is responsible for maintaining concentration risk within the
parameters set by the board of directors.
Concentration risk has a substantial influence on credit, strategic,
reputation, interest rate, and liquidity risks as all are closely related.
All of these risks impact net worth and must be supported by a
net worth level commensurate with the risk in the balance sheet.
The board of directors and senior management need to manage all of
these risk areas simultaneously.
One of the common flaws in managing risks within a credit union is to tie
each risk independently to net worth, without monitoring the aggregate
exposure of different risks to net worth.
The result may be excessive reliance on the level of net worth
to manage each individual risk.
Effective risk management practices would not only include tying the limits
of each product or service to net worth, but also consolidating the risks in
products and services and measuring the totality of the risks against net worth.
Board Policy & Concentration Risk Limits
The board of directors must establish a policy which addresses its philosophy on
concentration risk, limits commensurate with net worth levels, and the rationale
as to how the limits fit into the overall strategic plan of the credit union.
Supervisory Letter – Page 6
The board should use a global perspective when developing this policy,
including identifying outside forces (such as economic or housing price
uncertainty) which will affect the ability to manage concentration risk.
For example, the board should not begin or expand a mortgage program
that allows high loan-to-values at the height of a real estate bubble,
which will likely lead to significant losses when the market declines.
The parameters set by the board should be specific to each portfolio
and should include limits on loan types, share types, third party
relationship exposure, etcetera.
The risk limits should correlate to the overall growth objectives,
financial targets, and net worth plan.
The risk limits set forth in the concentration risk policy should be
closely linked to those codified in related policies, including, but not
limited to, real estate loan, member business loan, loan participation,
asset/liability management (ALM), and investment policies.
Concentrations that exceed one hundred percent of net worth must be monitored
carefully, and the board of directors should document an adequate rationale
for undertaking that level of risk.
Third Party Oversight
When working with third parties, due diligence is essential to ensure the
risks are properly identified and managed.
Examples of third party services include purchase of participations
in loans; underwriting, processing and safekeeping member loans; and
purchase or safekeeping investments.
Numerous guidance letters have been issued on this subject, and are listed
in the references section of this letter.
The guidance discusses the need for due diligence reviews to take into account the
nature of the service, length and depth of expertise exhibited by the vendor,
staffing changes, economic and regulatory changes, and risk mitigation strategies
associated with vendor oversight.
Also important to note is that due diligence is an ongoing process.
It encompasses the original review at the outset of product or service
implementation and should be updated periodically to monitor changes
in the vendor’s ability to deliver products or services which meet
the credit union’s expectations.
How is concentration risk monitored and controlled?
Once the appropriate risk management systems and policies are in place, it
is essential monitoring and oversight become routine functions at the senior
management level within the credit union.
Ultimately, the board of directors is responsible for oversight and
monitoring at a strategic level.
Regular formal reporting to the board and senior management on compliance
with the concentration and risk limits they establish is expected.
In addition, management should implement appropriate internal controls, including
segregation of duties, to ensure accurate reporting on concentration risk.
Compliance and Oversight Senior management needs to implement
procedures and controls to effectively adhere to and monitor compliance with
established policies and strategies.
Both the board and management must periodically review information that
identifies and measures the level and nature of concentration risk and
implement corrective action should the risk from any one area exceed
the board approved tolerance level.
Supervisory Letter – Page 7
Credit unions with large and complex loan or investment programs should
establish a specific risk management committee as a sound business practice.
The composition of the committee will depend on the size and complexity
of the credit union, but should be limited to a small number of senior
executives and one or more board members.
The agenda of this committee should be limited to risk management issues;
specifically concentration risk, credit risk, interest rate risk, liquidity
risk, and financial performance.
From a reporting perspective, management should demonstrate compliance with
every board established policy limit dealing with concentration risk, as well
as limits on associated risks such as credit, interest rate, and liquidity.
Scenario and Sensitivity Analysis
Credit unions should routinely perform portfolio-level scenario and sensitivity
tests to quantify the impact of changing economic conditions on asset
quality, earnings, and net worth.
In general, scenario analysis uses the model to predict a possible
future outcome given an event or a series of events, while sensitivity
analysis tests a model’s parameters without relating those changes to an
underlying event or real world outcome.
The outcome of sensitivity analysis is to determine which assumptions have
the most impact on the model’s results.
Credit unions should consider the susceptibility of portfolio segments
with common risk characteristics to changing market conditions.
Examples of common risk characteristics can be by loan type, investment type,
collateral type, geographic area, individual or associational groups of
borrowers, business lines, etcetera.
An example scenario analysis for a concentration in HE LOCK mortgages would
be the risk to earnings if unemployment in the area doubled while house market
values declined by twenty five percent, combined with the effect of interest
rate resets and associated payment shock.
An example scenario analysis for a concentration in thirty year, fixed-rate
mortgages would be the risk to earnings and capital from liquidity and interest
rate risks in a rising rate environment; where liquidity risk increases as
mortgage cash flows decrease, and rising interest rate risk causes earnings
to deteriorate as members seek higher dividend rates to maintain their deposits.
The analyses should be multi-faceted to explore the effect of single
and multiple simultaneous negative events on the portfolio.
The sophistication of scenario and sensitivity analyses should
be consistent with the size, complexity, and risk characteristics
of the portfolio as a whole.
Basel Committee on Banking Supervision, Principles for Sound Stress
Testing Practices and Supervision.
May two thousand and nine.
Supervisory Letter – Page 8
What are basic review procedures for examiners related to concentration risk?
The following are some basic review steps and questions examiners should ask when
conducting a review of concentration risk.
Examiner expectations for the depth and sophistication of the responses
from credit union management should increase if the initial review
of a credit union’s balance sheet reveals potentially high exposure.
• Does the credit union have policies directly related to identifying,
measuring, monitoring, and controlling concentration risk?
Examiners should ensure credit unions consider the following when evaluating
the board policies: The level and nature of inherent risk on the
balance sheet; Management expertise; Risk management practices; Market
conditions; and Adequacy of reserves allocated for concentration risk.
• Has the credit union developed appropriate policies and procedures,
including establishing acceptable risk limits for each product and service
on an individual and aggregate basis?
• Has management assessed the adequacy of net worth based on the aggregate
potential exposure to all forms of concentration risk, while also considering
the potential credit, interest rate, and liquidity risk impact on net worth?
• Has the credit union considered the various types of concentrations and
their interrelationship, particularly between asset classes or common products
and service characteristics, which may present higher risk when aggregated?
• Has the credit union considered the “event risks” that may expose them to financial
loss for each asset class, quantified the risk, and established appropriate risk
tolerance limits based on the probability and potential impact from each event?
• Do the board and senior management receive regular reports on the individual and
aggregate exposure to concentration risk?
• Does management have predetermined actions to take when risk limits are reached?
Do they take the appropriate action?
A material red flag is a credit union that simply raises the established
limit when it is reached without advanced analysis supporting the
rationale for the change in policy.
• Is the credit union’s system of identifying, measuring, monitoring,
and controlling concentration risk commensurate with the level of
potential concentration risk exposure?
Supervisory Letter – Page 9
• When credit unions have significant loan concentrations, does management
maintain reports and perform analysis of the following: Origination and
portfolio trends by product, loan structure, originator channel, credit
score, LTV, debt-to-income ratio (DTI), lien position, documentation
type, property type, appraiser, appraised value, and appraisal date;
Delinquency and loss distribution trends by product and originator channel with
accompanying analysis of significant underwriting characteristics, such as
credit score, L TV, and D T I; Vintage tracking3 (i.e., static pool analysis);
The performance of third-party (brokers, auto dealers, and
correspondents) originated loans;
and, Market trends by geographic area and property type to identify
areas of rapidly appreciating or depreciating housing values.
What options are available when a credit union or the examiner
identifies elevated concentration risk?
The board of directors and management should have triggers and action plans
in writing for any material risk area.
If the credit union’s monitoring activities identify concerns with
a concentration, the board of directors must respond accordingly.
Similarly, if an examiner believes there may be elevated concentration risk
issues present in a credit union, and management has not properly quantified
and mitigated the risk, they should require corrective actions of management
that include, but are not limited to:
Expanding the review of the risk environment for the particular sector(s);
Performing elevated scenario and sensitivity analyses;
Expanding the review of performance of existing borrowers;
Reviewing growth and limitations for new business lines;
and/or Reviewing risk mitigation options and timeframes for
reduction of risk, if necessary.
3Risk Alert zero five Risk 0 1, Specialized Lending Activities
– Third-Party Indirect Lending and Participations, and the accompanying
supplemental guidance whitepaper on static pool analysis discusses how
such analysis can be used to track the performance of most loan pools.
This guidance can be applied to all non-traditional products or other loan
products, not just indirect lending.
Supervisory Letter – Page 10
If management determines concentration risk is elevated, they should
implement steps to mitigate the risk.
If management does not properly assess or control the level of
risk, examiners should require corrective actions to mitigate the
risks, including but not limited to:
Reducing limits or thresholds on risk concentrations; Reducing
exposure to new business lines to address undue concentrations;
Transferring risk to other parties by either selling directly or as
part of securitization transactions;
and/or Ceasing the product or service line.
Conclusion Excessive concentration risk can severely impact the
financial condition of a credit union.
High concentrations in areas experiencing severe economic distress
could result in significant losses exceeding a credit union’s net worth.
It is the fiduciary responsibility of management and officials of credit
unions to identify, manage, monitor, and control the risks facing the credit
union, including concentration risk.
Examiners need to ascertain whether the board of directors and management
understand and actively manage this risk.
Credit union management should know what their concentration risk is and
be able to demonstrate appropriate risk management and mitigation
practices to minimize the risk of significant financial condition decline.
This concludes the Concentration Risk Letter.
If your credit union could use assistance with your exam, reach out to Mark Treichel
on LinkedIn, or at mark Treichel dot com.
This is Samantha Shares and I Thank you for listening.