WEBVTT NOTE This file was generated by Descript 00:00:08.083 --> 00:00:09.873 Hello, this is Samantha Shares. 00:00:10.373 --> 00:00:14.953 This episode covers NCUA's letter to credit unions on concentration risk. 00:00:15.373 --> 00:00:18.553 Many credit unions are receiving documents of resolution on 00:00:18.553 --> 00:00:22.203 concentration risk and told to comply with the guidance in this letter. 00:00:22.653 --> 00:00:25.093 The following is an audio version of that letter. 00:00:25.568 --> 00:00:29.278 But first, this podcast is educational and is not legal advice. 00:00:29.698 --> 00:00:33.253 We are sponsored by Credit Union Exam Solutions, Inc., whose team has 00:00:33.253 --> 00:00:38.748 over 240 years of national credit union administration experience. 00:00:39.178 --> 00:00:42.908 We assist our clients with NCUA so they save time and money. 00:00:43.158 --> 00:00:47.098 If you are worried about a recent, upcoming, or in process NCUA 00:00:47.098 --> 00:00:50.848 examination, reach out to learn how they can assist at marktreichel. 00:00:50.858 --> 00:00:51.288 com. 00:00:51.778 --> 00:00:55.638 Also, check out our other podcast called With Flying Colors, where we provide 00:00:55.648 --> 00:00:58.588 tips on how to achieve success with NCUA. 00:00:58.978 --> 00:00:59.948 And now, the letter. 00:01:00.378 --> 00:01:01.548 Concentration risk. 00:01:02.028 --> 00:01:05.698 Credit union officials and management have a fiduciary responsibility 00:01:05.698 --> 00:01:09.678 to identify, measure, monitor, and control concentration risk. 00:01:10.108 --> 00:01:13.248 Concentration risk must be managed in conjunction with credit. 00:01:13.348 --> 00:01:17.728 Interest Rate and Liquidity Risks, as a negative event in any category 00:01:17.728 --> 00:01:21.158 may have significant consequences on the other areas, as well as 00:01:21.168 --> 00:01:23.108 strategic and reputation risks. 00:01:23.488 --> 00:01:26.398 Concentration risk has increased in importance during the 00:01:26.398 --> 00:01:27.938 recent economic recession. 00:01:28.368 --> 00:01:32.558 Poor risk management of residential and commercial mortgage loan concentrations, 00:01:32.568 --> 00:01:36.688 in particular, is having an adverse effect on credit unions nationwide, 00:01:37.018 --> 00:01:41.578 resulting in significant loan losses, earnings deterioration, capital depletion, 00:01:41.918 --> 00:01:43.708 and increased credit union failures. 00:01:44.323 --> 00:01:47.683 Most of the recent large losses to the National Credit Union Share 00:01:47.683 --> 00:01:51.793 Insurance Fund in CUSIF are due to poor management of large concentrations 00:01:51.803 --> 00:01:55.823 in various asset classes in relation to the asset size and net worth 00:01:55.823 --> 00:01:57.583 level of the failed institutions. 00:01:58.073 --> 00:01:59.613 What is concentration risk? 00:01:59.833 --> 00:02:04.083 A risk concentration is any single exposure or group of exposures with 00:02:04.083 --> 00:02:07.843 the potential to produce losses large enough relative to capital, total 00:02:07.863 --> 00:02:12.313 assets, or overall risk level to threaten a financial institution's health or 00:02:12.313 --> 00:02:14.773 ability to maintain its core operations. 00:02:15.203 --> 00:02:19.543 Avoiding concentrating too much in any single product or service is a core tenet 00:02:19.553 --> 00:02:23.903 of effective risk management and when violated increases the risk of loss to 00:02:23.903 --> 00:02:26.023 the credit union and to the incusive. 00:02:26.528 --> 00:02:30.748 Too much reliance on any single product or service increases the potential for 00:02:30.748 --> 00:02:33.298 adverse consequences from event risk, i. 00:02:33.338 --> 00:02:33.578 e. 00:02:33.858 --> 00:02:38.358 a negative event, such as a housing market crash, that significantly affects the 00:02:38.358 --> 00:02:40.338 financial condition of the institution. 00:02:40.958 --> 00:02:45.418 Every asset, liability, product, service, and third party provider presents 00:02:45.438 --> 00:02:49.488 a risk of loss to the credit union under varying conditions or events. 00:02:49.718 --> 00:02:52.358 Some risks are less likely than others to occur. 00:02:52.868 --> 00:02:56.808 It is up to credit union management to identify the risk in each product 00:02:56.818 --> 00:03:00.648 or service line, quantify the risk, and set appropriate concentration 00:03:00.658 --> 00:03:02.328 limits based on the analysis. 00:03:02.758 --> 00:03:04.828 What are some types of concentration risk? 00:03:05.283 --> 00:03:09.693 Concentration risk is present in many forms across credit union operations. 00:03:10.033 --> 00:03:12.663 Examples include asset classes, e. 00:03:12.663 --> 00:03:12.963 g. 00:03:13.153 --> 00:03:17.353 residential real estate loans, member business loans, automobile loans, 00:03:17.503 --> 00:03:22.433 loan participations, or investments, concentrations within a class of assets. 00:03:22.713 --> 00:03:27.428 Examples include, but are not limited to, O residential real estate loans 00:03:27.428 --> 00:03:31.878 collateral type, lien position, geographic area, non traditional terms 00:03:31.878 --> 00:03:36.478 such as interest only, payment option, or balloon payment, fixed or variable 00:03:36.488 --> 00:03:41.928 interest rate, low or reduced underwriting documentation, and loan to value LTV. 00:03:42.238 --> 00:03:45.248 O member business loans, MBLS types of loans, e. 00:03:45.248 --> 00:03:45.548 g. 00:03:45.828 --> 00:03:50.578 Real estate, working capital, and credit cards, collateral type, payment features 00:03:50.588 --> 00:03:55.988 such as interest only, balloon payments, loan term, geographic area, and LTV. 00:03:56.408 --> 00:03:58.538 Loan participation types of loans e. 00:03:58.538 --> 00:03:58.838 g. 00:03:59.248 --> 00:04:02.648 residential real estate, MBL, and automobile, and the subclasses 00:04:03.188 --> 00:04:07.068 associated with the types, originating lender, and geographic area. 00:04:07.498 --> 00:04:11.698 O loans to one borrower or associated group of borrowers may include several 00:04:11.698 --> 00:04:16.593 different types of loans residential real estate, MBLS, consumer loans, et cetera. 00:04:16.903 --> 00:04:18.803 Oh, investments, types of investments, e. 00:04:18.803 --> 00:04:19.103 g. 00:04:19.493 --> 00:04:23.143 treasury securities, certificates of deposit and mortgage backed 00:04:23.143 --> 00:04:27.763 securities, collateral type interest rates, issue a public or private trans 00:04:27.793 --> 00:04:30.553 priority and broker liabilities, e. 00:04:30.553 --> 00:04:30.833 g. 00:04:31.233 --> 00:04:35.963 rate sensitive share deposits or callable borrowings, third party providers, e. 00:04:35.963 --> 00:04:36.313 g. 00:04:36.618 --> 00:04:40.228 PUSOs, indirect loan partners or mortgage brokerage firms. 00:04:40.718 --> 00:04:42.718 Services provided to other parties, e. 00:04:42.718 --> 00:04:46.618 g., loan underwriting and or servicing, insurance services, 00:04:46.668 --> 00:04:48.208 and investment consultation. 00:04:48.678 --> 00:04:51.758 When reviewing the types of concentrations in a credit union, 00:04:51.948 --> 00:04:56.458 examiners must be cognizant of other asset categories that may seem unrelated. 00:04:56.948 --> 00:05:00.248 For instance, the types of loans and characteristics of the loans 00:05:00.398 --> 00:05:04.128 may be one form of concentration risk that is easily identified. 00:05:04.458 --> 00:05:08.188 However, similar characteristics may exist in a loan participation 00:05:08.188 --> 00:05:10.608 portfolio or an investment portfolio. 00:05:11.038 --> 00:05:15.108 A clear example of this concept would be a credit union that holds a portfolio 00:05:15.108 --> 00:05:19.388 of real estate loans and also a portfolio of mortgage backed securities. 00:05:19.798 --> 00:05:23.098 There are common event risks in these types of assets that must be 00:05:23.098 --> 00:05:25.268 quantified and mitigated by management. 00:05:25.858 --> 00:05:29.598 What are the largest exposures, risk concentrations in credit unions? 00:05:29.968 --> 00:05:33.778 Concentration in credit portfolios is considered to be the most significant 00:05:33.778 --> 00:05:36.158 source of risk to financial institutions. 00:05:36.608 --> 00:05:40.328 Trends in credit union balance sheets reflect increased exposure to 00:05:40.338 --> 00:05:45.188 concentration risk in areas of their credit portfolios, such as real estate 00:05:45.188 --> 00:05:50.783 loans fixed rates as of December 31, 2009, Real estate loans held by credit 00:05:50.803 --> 00:05:53.853 unions comprise 54 percent of total loans. 00:05:54.293 --> 00:05:58.653 Of the 217 billion in first mortgage loans, over 60 00:05:58.653 --> 00:06:00.403 percent have fixed rate terms. 00:06:00.953 --> 00:06:03.993 In addition, fixed rate first mortgage loans have increased 00:06:04.003 --> 00:06:06.913 by 55 percent since 2005. 00:06:07.353 --> 00:06:11.223 Member business loans as of December 31, 2009. 00:06:11.388 --> 00:06:14.318 Member business loans totaled 35 billion. 00:06:14.798 --> 00:06:20.058 Credit unions grew their member business loan portfolios by 98 percent in 2009. 00:06:20.498 --> 00:06:26.008 Loan participations as of December 31, 2009, credit union participations 00:06:26.038 --> 00:06:31.348 outstanding totaled 24 billion, and participation lending increased by 11. 00:06:31.348 --> 00:06:33.128 6 percent in 2009. 00:06:33.588 --> 00:06:38.728 Construction and development C& D loans, as of December 31, 00:06:38.728 --> 00:06:39.878 2009, credit unions owned 2. 00:06:39.878 --> 00:06:44.228 4 billion in commercial and residential C& D loans. 00:06:44.688 --> 00:06:49.348 While this trend has declined since 2007, the real estate market downturn 00:06:49.358 --> 00:06:53.298 could continue to have an adverse effect on credit unions with concentrations 00:06:53.298 --> 00:06:55.648 of C& D loans in their portfolio. 00:06:56.058 --> 00:07:01.048 Investments in mortgage related securities, as of December 31, 2009, 00:07:01.073 --> 00:07:04.983 Credit union investments in mortgage related securities totaled 58. 00:07:05.063 --> 00:07:10.603 7 billion, which is in addition to the real estate loan exposure stated above. 00:07:11.253 --> 00:07:16.073 Investments in mortgage related securities have more than doubled since 2005. 00:07:16.633 --> 00:07:19.413 How is concentration risk identified and measured? 00:07:19.723 --> 00:07:23.293 Each product or service carries some risk of financial exposure 00:07:23.293 --> 00:07:24.953 or loss for the credit union. 00:07:25.503 --> 00:07:28.753 Management needs to perform a risk assessment which demonstrates 00:07:28.753 --> 00:07:31.303 their understanding of the risk of the product or service. 00:07:31.683 --> 00:07:35.773 Quantifies the potential loss exposure and documents a rational business 00:07:35.773 --> 00:07:39.673 decision on the acceptable concentration level based on the analysis. 00:07:40.123 --> 00:07:44.363 The larger the concentration level, the more robust and advanced the analysis 00:07:44.373 --> 00:07:46.523 and risk management techniques should be. 00:07:46.773 --> 00:07:50.723 For instance, the sophistication and depth of risk management systems and 00:07:50.723 --> 00:07:54.823 analysis conducted on a real estate portfolio that represents 20 percent 00:07:54.833 --> 00:07:58.778 of total loans could be acceptably less than a real estate portfolio that 00:07:58.778 --> 00:08:01.108 represents 50 percent of total loans. 00:08:01.558 --> 00:08:04.568 Another example is the level of due diligence conducted on 00:08:04.568 --> 00:08:06.398 a third party service provider. 00:08:06.938 --> 00:08:10.758 The more important the service to the core operation of the credit union and 00:08:10.758 --> 00:08:15.138 the higher the amount of activity and dollar volume of credit union activity, it 00:08:15.138 --> 00:08:19.668 handles the more sophisticated and robust the due diligence oversight needs to be. 00:08:20.088 --> 00:08:24.378 Similar to the depth and sophistication of the initial review, management must 00:08:24.378 --> 00:08:28.478 increase the intensity and depth of ongoing monitoring and review of products 00:08:28.498 --> 00:08:30.638 and services with high concentrations. 00:08:31.058 --> 00:08:35.288 To measure and monitor concentration risk, credit unions must start with the systems 00:08:35.288 --> 00:08:37.298 used to store and analyze their data. 00:08:37.798 --> 00:08:41.708 For more complex products, establishing comprehensive data warehousing 00:08:41.718 --> 00:08:44.668 will allow management to track changes in the quality of their 00:08:44.668 --> 00:08:46.718 various lines of business over time. 00:08:47.193 --> 00:08:51.593 Without an all inclusive process to maintain and analyze data, the Board 00:08:51.593 --> 00:08:55.083 of Directors and Senior Management will not have the tools necessary 00:08:55.083 --> 00:08:59.013 to make strategic and operational decisions in a safe and sound manner. 00:08:59.443 --> 00:09:03.573 Maintaining Comprehensive and Accurate Data Credit union management 00:09:03.583 --> 00:09:06.743 must emphasize the importance of maintaining comprehensive and 00:09:06.753 --> 00:09:08.853 accurate data for each risk area. 00:09:09.423 --> 00:09:13.043 This includes a quality control function to ensure that data entry 00:09:13.043 --> 00:09:15.103 and changes are accurate and timely. 00:09:15.463 --> 00:09:18.703 The credit union should have a data processing system capable of 00:09:18.703 --> 00:09:22.713 warehousing data on various lines of business commensurate with its size 00:09:22.743 --> 00:09:26.953 and complexity to properly identify and measure concentration risk. 00:09:27.463 --> 00:09:30.783 For example, this would include maintaining information relevant to 00:09:30.783 --> 00:09:34.903 the loan portfolio, such as loan type, interest rate, interest rate reset 00:09:34.903 --> 00:09:38.683 dates, if applicable, payment amount, Payments shock the potential increase 00:09:38.683 --> 00:09:42.443 in payment from an interest rate reset or conversion from interest only to 00:09:42.443 --> 00:09:46.543 principal and interest payments credit score including original and updated 00:09:46.543 --> 00:09:50.423 periodically, collateral description, and collateral value including 00:09:50.423 --> 00:09:52.613 original and updated periodically. 00:09:53.098 --> 00:09:56.358 Another example would include maintaining information relevant to 00:09:56.358 --> 00:10:00.538 the investment portfolio, such as type, interest rate, collateral information, 00:10:00.658 --> 00:10:04.778 market value original and updated periodically, and external rating 00:10:04.778 --> 00:10:06.938 original and updated periodically. 00:10:07.428 --> 00:10:11.488 This is not an all inclusive list, But rather a starting point for evaluating 00:10:11.538 --> 00:10:15.478 if the data processing system is capable of maintaining this type of data. 00:10:15.958 --> 00:10:20.158 If the credit union does not have the data processing capability, management 00:10:20.158 --> 00:10:23.958 should contract with a third party to provide data warehousing and reporting. 00:10:24.543 --> 00:10:28.133 If management elects to pursue this route, examiners should review their 00:10:28.133 --> 00:10:31.783 initial and ongoing due diligence of the vendor to ensure it is in 00:10:31.783 --> 00:10:35.663 accordance with published guidance and safe and sound business practices. 00:10:36.113 --> 00:10:40.233 Risk Rating System Developing an effective, accurate, and timely 00:10:40.233 --> 00:10:43.873 risk rating system is an important tool for managing concentration 00:10:43.873 --> 00:10:45.473 risk in the loan portfolio. 00:10:45.923 --> 00:10:49.553 Risk ratings should be objective, sensitive to changes in borrower and 00:10:49.553 --> 00:10:53.983 or loan characteristics, and validated via an independent review function. 00:10:53.983 --> 00:10:58.423 For With loan participations, credit unions should assess the loan utilizing 00:10:58.423 --> 00:11:00.303 their own internal rating system. 00:11:00.813 --> 00:11:04.703 In the absence of an internal rating system, management should not rely 00:11:04.733 --> 00:11:08.923 on the originating institution system without completing timely, thorough, and 00:11:08.933 --> 00:11:11.003 ongoing due diligence of that system. 00:11:11.473 --> 00:11:15.023 Examiners should review management's documentation of the original and 00:11:15.043 --> 00:11:18.943 ongoing due diligence, ensuring that it is consistent with safe 00:11:18.973 --> 00:11:20.643 and sound business practices. 00:11:21.078 --> 00:11:21.738 Reporting. 00:11:22.128 --> 00:11:26.868 Management reporting must be periodic and timely in a format that clearly indicates 00:11:26.868 --> 00:11:31.238 changes in concentration risk and is commensurate with the size, complexity, 00:11:31.268 --> 00:11:33.388 and risk exposure of the credit union. 00:11:33.858 --> 00:11:37.078 The report should not only measure concentration risk against board 00:11:37.078 --> 00:11:41.273 approved parameters, but should also measure how the risks change over time. 00:11:41.653 --> 00:11:45.223 For example, a key factor in determining concentration risk in a 00:11:45.223 --> 00:11:49.433 loan portfolio would be to measure credit score migration by obtaining 00:11:49.453 --> 00:11:53.763 updated credit scores on a periodic basis and analyzing those borrowers 00:11:53.773 --> 00:11:55.463 who have a declining credit score. 00:11:55.903 --> 00:11:58.723 The frequency of reporting should be commensurate with the type 00:11:58.723 --> 00:12:00.373 and size of the concentration. 00:12:00.653 --> 00:12:04.273 For example, larger portfolios should have at least quarterly reporting. 00:12:04.828 --> 00:12:06.858 How is concentration risk managed? 00:12:07.158 --> 00:12:10.288 Implementing sound risk management practices is the key 00:12:10.288 --> 00:12:12.138 to managing concentration risk. 00:12:12.478 --> 00:12:15.758 When credit unions have significant concentrations on their balance 00:12:15.758 --> 00:12:20.038 sheet, examiners need to ensure risk management practices are commensurate 00:12:20.048 --> 00:12:23.798 with the risk assumed relative to net worth, and management clearly 00:12:23.798 --> 00:12:25.948 identifies and measures the risk taken. 00:12:26.488 --> 00:12:29.818 The ultimate responsibility for setting the level of concentration 00:12:29.818 --> 00:12:33.338 risk assumed by the credit union rests with the board of directors. 00:12:33.338 --> 00:12:38.008 For Senior Management is responsible for maintaining concentration risk within the 00:12:38.008 --> 00:12:40.358 parameters set by the Board of Directors. 00:12:40.808 --> 00:12:44.818 Concentration risk has a substantial influence on credit, strategic, 00:12:44.818 --> 00:12:49.108 reputation, interest rate, and liquidity risks as all are closely related. 00:12:49.568 --> 00:12:52.818 All of these risks impact net worth and must be supported by a 00:12:52.818 --> 00:12:55.848 net worth level commensurate with the risk in the balance sheet. 00:12:56.338 --> 00:12:59.548 The Board of Directors and Senior Management need to manage all of 00:12:59.548 --> 00:13:01.508 these risk areas simultaneously. 00:13:01.903 --> 00:13:05.563 One of the common flaws in managing risks within a credit union is to 00:13:05.573 --> 00:13:09.913 tie each risk independently to net worth without monitoring the aggregate 00:13:09.913 --> 00:13:12.223 exposure of different risks to net worth. 00:13:12.633 --> 00:13:15.853 The result may be excessive reliance on the level of net worth 00:13:15.883 --> 00:13:17.903 to manage each individual risk. 00:13:18.383 --> 00:13:22.263 Effective risk management practices would not only include tying the limits 00:13:22.263 --> 00:13:26.633 of each product or service to net worth, but also consolidating the risks in 00:13:26.643 --> 00:13:31.023 products and services and measuring the totality of the risks against net worth. 00:13:31.598 --> 00:13:34.288 Board Policy and Concentration Risk Limits. 00:13:34.648 --> 00:13:39.068 The Board of Directors must establish a policy which addresses its philosophy on 00:13:39.078 --> 00:13:43.668 concentration risk, limits commensurate with net worth levels, and the rationale 00:13:43.668 --> 00:13:47.758 as to how the limits fit into the overall strategic plan of the credit union. 00:13:48.228 --> 00:13:51.698 The board should use a global perspective when developing this policy, 00:13:51.928 --> 00:13:56.058 including identifying outside forces such as economic or housing price 00:13:56.088 --> 00:13:59.958 uncertainty, which will affect the ability to manage concentration risk. 00:14:00.398 --> 00:14:04.038 For example, the board should not begin or expand a mortgage program 00:14:04.098 --> 00:14:07.578 that allows high loan to values at the height of a real estate bubble, 00:14:07.808 --> 00:14:11.208 which will likely lead to significant losses when the market declines. 00:14:11.823 --> 00:14:16.113 The parameters set by the board should be specific to each portfolio, and should 00:14:16.113 --> 00:14:21.363 include limits on loan types, share types, third party relationship exposure, etc. 00:14:21.543 --> 00:14:24.783 The risk limits should correlate to the overall growth objectives, 00:14:24.783 --> 00:14:27.043 financial targets, and net worth plan. 00:14:27.573 --> 00:14:30.793 The risk limits set forth in the concentration risk policy 00:14:30.803 --> 00:14:33.993 should be closely linked to those codified in related policies, 00:14:34.013 --> 00:14:37.153 including, but not limited to, real estate loan, mortgage loan. 00:14:37.223 --> 00:14:40.563 Member Business Loan, Loan Participation, Asset Liability 00:14:40.563 --> 00:14:42.893 Management, OM, and Investment Policies. 00:14:43.333 --> 00:14:47.283 Concentrations that exceed 100 percent of net worth must be monitored 00:14:47.283 --> 00:14:51.233 carefully and the Board of Directors should document an adequate rationale 00:14:51.233 --> 00:14:53.163 for undertaking that level of risk. 00:14:53.633 --> 00:14:57.588 Third Party Oversight When working with third parties, due diligence 00:14:57.598 --> 00:15:01.448 is essential to ensure the risks are properly identified and managed. 00:15:01.878 --> 00:15:04.798 Examples of third party services include purchase of participations 00:15:04.798 --> 00:15:10.018 and loans, underwriting, processing, and safekeeping member loans, and 00:15:10.018 --> 00:15:12.058 purchase or safekeeping investments. 00:15:12.618 --> 00:15:16.498 Numerous guidance letters have been issued on this subject and are listed in 00:15:16.498 --> 00:15:18.338 the References section of this letter. 00:15:18.788 --> 00:15:22.708 The guidance discusses the need for due diligence reviews to take into account the 00:15:22.708 --> 00:15:26.908 nature of the service, length and depth of expertise exhibited by the vendor, 00:15:27.028 --> 00:15:31.958 staffing changes, economic and regulatory changes, and risk mitigation strategies 00:15:31.968 --> 00:15:33.728 associated with vendor oversight. 00:15:34.243 --> 00:15:38.013 Also important to note is that due diligence is an ongoing process. 00:15:38.453 --> 00:15:42.043 It encompasses the original review at the outset of product or service 00:15:42.063 --> 00:15:46.133 implementation and should be updated periodically to monitor changes 00:15:46.153 --> 00:15:49.573 in the vendor's ability to deliver products or services which meet 00:15:49.573 --> 00:15:51.463 the credit union's expectations. 00:15:51.943 --> 00:15:54.803 How is concentration risk monitored and controlled? 00:15:55.183 --> 00:15:59.333 Once the appropriate risk management systems and policies are in place, it 00:15:59.333 --> 00:16:03.253 is essential monitoring and oversight become routine functions at the senior 00:16:03.253 --> 00:16:05.343 management level within the credit union. 00:16:05.803 --> 00:16:09.323 Ultimately, the Board of Directors is responsible for oversight and 00:16:09.333 --> 00:16:11.238 monitoring at a strategic level. 00:16:11.778 --> 00:16:15.548 Regular formal reporting to the board and senior management on compliance 00:16:15.548 --> 00:16:19.008 with the concentration and risk limits they establish is expected. 00:16:19.498 --> 00:16:23.708 In addition, management should implement appropriate internal controls, including 00:16:23.708 --> 00:16:27.948 segregation of duties, to ensure accurate reporting on concentration risk. 00:16:28.158 --> 00:16:31.268 Compliance and oversight senior management needs to implement 00:16:31.268 --> 00:16:35.568 procedures and controls to effectively adhere to and monitor compliance with 00:16:35.568 --> 00:16:37.568 established policies and strategies. 00:16:38.068 --> 00:16:41.568 Both the board and management must periodically review information that 00:16:41.568 --> 00:16:45.358 identifies and measures the level and nature of concentration risk and 00:16:45.388 --> 00:16:49.158 implement corrective action, should the risk from any one area exceed 00:16:49.158 --> 00:16:50.988 the board approved tolerance level. 00:16:51.478 --> 00:16:55.468 Credit unions with large and complex loan or investment programs should 00:16:55.468 --> 00:16:59.728 establish a specific risk management committee as a sound business practice. 00:17:00.283 --> 00:17:03.663 The composition of the committee will depend on the size and complexity 00:17:03.663 --> 00:17:07.273 of the credit union, but should be limited to a small number of senior 00:17:07.273 --> 00:17:09.583 executives and one or more board members. 00:17:10.163 --> 00:17:13.813 The agenda of this committee should be limited to risk management issues, 00:17:14.023 --> 00:17:17.923 specifically concentration risk, credit risk, interest rate risk. 00:17:17.998 --> 00:17:24.558 From a reporting perspective, management should demonstrate compliance with 00:17:24.588 --> 00:17:28.978 every board established policy limit dealing with concentration risk, as well 00:17:28.978 --> 00:17:33.278 as limits on associated risks such as credit, interest rate, and liquidity. 00:17:33.693 --> 00:17:38.413 Scenario and Sensitivity Analysis Credit unions should routinely perform 00:17:38.413 --> 00:17:42.643 portfolio level scenario and sensitivity tests to quantify the impact of 00:17:42.643 --> 00:17:46.753 changing economic conditions on asset quality, earnings, and net worth. 00:17:47.163 --> 00:17:50.943 In general, scenario analysis uses the model to predict a possible 00:17:50.943 --> 00:17:55.253 future outcome given an event or a series of events, while sensitivity 00:17:55.253 --> 00:17:59.283 analysis tests a model's parameters without relating those changes to an 00:17:59.303 --> 00:18:01.723 underlying event or real world outcome. 00:18:02.193 --> 00:18:06.023 The outcome of sensitivity analysis is to determine which assumptions have 00:18:06.023 --> 00:18:08.093 the most impact on the model's results. 00:18:08.613 --> 00:18:12.263 Credit unions should consider the susceptibility of portfolio segments 00:18:12.263 --> 00:18:15.593 with common risk characteristics to changing market conditions. 00:18:15.953 --> 00:18:20.293 Examples of common risk characteristics can be by loan type, investment type, 00:18:20.363 --> 00:18:24.403 collateral type, geographic area, individual or associational groups 00:18:24.403 --> 00:18:26.623 of borrowers, business lines, etc. 00:18:27.118 --> 00:18:31.348 An example scenario analysis for a concentration in HELOC mortgages would 00:18:31.358 --> 00:18:35.508 be the risk to earnings if unemployment in the area doubled while house market 00:18:35.508 --> 00:18:39.698 values declined by 25%, combined with the effect of interest rate 00:18:39.708 --> 00:18:41.928 resets and associated payment shock. 00:18:42.423 --> 00:18:46.843 In example scenario analysis for a concentration in 30 year, fixed rate 00:18:46.853 --> 00:18:50.773 mortgages would be the risk to earnings and capital from liquidity and interest 00:18:50.773 --> 00:18:55.053 rate risks in a rising rate environment, where liquidity risk increases as 00:18:55.053 --> 00:18:59.493 mortgage cash flows decrease, and rising interest rate risk causes earnings 00:18:59.493 --> 00:19:03.973 to deteriorate as members seek higher dividend rates to maintain their deposits. 00:19:04.363 --> 00:19:08.043 The analysis should be multifaceted to explore the effect of single 00:19:08.063 --> 00:19:11.343 and multiple simultaneous negative events on the portfolio. 00:19:11.753 --> 00:19:15.133 The sophistication of scenario and sensitivity analyzes should 00:19:15.143 --> 00:19:18.683 be consistent with the size, complexity, and risk characteristics 00:19:18.693 --> 00:19:20.293 of the portfolio as a whole. 00:19:20.743 --> 00:19:24.993 Basel Committee on Banking Supervision, Principles for Sound Stress Testing 00:19:24.993 --> 00:19:28.498 Practices and Supervision, May 2009. 00:19:28.998 --> 00:19:33.258 What are basic review procedures for examiners related to concentration risk? 00:19:33.588 --> 00:19:37.778 The following are some basic review steps and questions examiners should ask when 00:19:37.778 --> 00:19:40.198 conducting a review of concentration risk. 00:19:40.558 --> 00:19:44.468 Examiner expectations for the depth and sophistication of the responses 00:19:44.468 --> 00:19:47.818 from credit union management should increase if the initial review 00:19:47.838 --> 00:19:51.658 of a credit union's balance sheet reveals potentially high exposure. 00:19:52.118 --> 00:19:55.768 Does the credit union have policies directly related to identifying, 00:19:55.848 --> 00:19:59.098 measuring, monitoring, and controlling concentration risk? 00:19:59.508 --> 00:20:02.758 Examiners should ensure credit unions consider the following when 00:20:02.758 --> 00:20:04.518 evaluating the board policies. 00:20:04.878 --> 00:20:09.608 The level and nature of inherent risk on the balance sheet, management expertise, 00:20:09.778 --> 00:20:14.298 risk management practices, market conditions, and adequacy of reserves 00:20:14.308 --> 00:20:16.288 allocated for concentration risk. 00:20:16.788 --> 00:20:20.398 Has the credit union developed appropriate policies and procedures, 00:20:20.658 --> 00:20:24.818 including establishing acceptable risk limits for each product and service 00:20:24.828 --> 00:20:27.348 on an individual and aggregate basis? 00:20:27.518 --> 00:20:31.388 Has management assessed the adequacy of net worth based on the aggregate 00:20:31.398 --> 00:20:36.018 potential exposure to all forms of concentration risk, while also considering 00:20:36.018 --> 00:20:40.228 the potential credit, interest rate, and liquidity risk impact on net worth? 00:20:40.643 --> 00:20:44.373 Has the credit union considered the various types of concentrations and 00:20:44.373 --> 00:20:48.663 their interrelationship, particularly between asset classes or common products 00:20:48.683 --> 00:20:52.883 and service characteristics, which may present higher risk when aggregated? 00:20:53.293 --> 00:20:57.513 Has the credit union considered the event risks that may expose them to financial 00:20:57.513 --> 00:21:02.253 loss for each asset class, quantified the risk, and established appropriate risk 00:21:02.273 --> 00:21:06.523 tolerance limits based on the probability and potential impact from each event? 00:21:06.903 --> 00:21:11.183 Do the board and senior management receive regular reports on the individual and 00:21:11.203 --> 00:21:13.683 aggregate exposure to concentration risk? 00:21:14.003 --> 00:21:18.093 Does management have predetermined actions to take when risk limits are reached? 00:21:18.443 --> 00:21:20.193 Do they take the appropriate action? 00:21:20.543 --> 00:21:24.673 A material red flag is a credit union that simply raises the established 00:21:24.673 --> 00:21:27.903 limit when it is reached without advanced analysis supporting the 00:21:27.903 --> 00:21:29.893 rationale for the change in policy. 00:21:30.338 --> 00:21:34.118 Is the credit union system of identifying, measuring, monitoring, 00:21:34.128 --> 00:21:37.248 and controlling concentration risk commensurate with the level of 00:21:37.258 --> 00:21:39.528 potential concentration risk exposure? 00:21:39.873 --> 00:21:43.373 When credit unions have significant loan concentrations, does 00:21:43.373 --> 00:21:46.883 management maintain reports and perform analysis of the following? 00:21:47.273 --> 00:21:50.873 Origination and portfolio trends by product, loan structure, 00:21:50.943 --> 00:21:55.623 originator channel, credit score, LTV, debt to income ratio DTI, 00:21:55.693 --> 00:21:57.773 lien position, documentation type. 00:21:57.983 --> 00:22:01.593 Property type, appraiser, appraised value, and appraisal date. 00:22:02.063 --> 00:22:05.723 Delinquency and lost distribution trends by product and originator 00:22:05.723 --> 00:22:10.113 channel with accompanying analysis of significant underwriting characteristics 00:22:10.163 --> 00:22:13.143 such as credit score, LTV, and DTI. 00:22:13.233 --> 00:22:16.278 Vintage Tracking 3IE Static Pool Analysis. 00:22:16.818 --> 00:22:20.808 The performance of third party brokers, auto dealers, and correspondents 00:22:20.838 --> 00:22:25.678 originated loans and market trends by geographic area and property type to 00:22:25.678 --> 00:22:30.188 identify areas of rapidly appreciating or depreciating housing values. 00:22:30.598 --> 00:22:34.048 What options are available when a credit union or the examiner 00:22:34.048 --> 00:22:36.488 identifies elevated concentration risk? 00:22:36.828 --> 00:22:40.378 The Board of Directors and management should have triggers and action plans 00:22:40.388 --> 00:22:42.608 in writing for any material risk area. 00:22:43.138 --> 00:22:46.688 If the credit union's monitoring activities identify concerns with 00:22:46.688 --> 00:22:50.398 a concentration, the Board of Directors must respond accordingly. 00:22:50.748 --> 00:22:54.788 Similarly, if an examiner believes there may be elevated concentration risk 00:22:54.798 --> 00:22:59.198 issues present in a credit union, and management has not properly quantified 00:22:59.208 --> 00:23:03.268 and mitigated the risk, they should require corrective actions of management 00:23:03.278 --> 00:23:05.578 that include, but are not limited to. 00:23:06.008 --> 00:23:09.708 Expanding the review of the risk environment for the particular sectors. 00:23:09.708 --> 00:23:12.781 Performing elevated scenario and sensitivity analyzes. 00:23:12.781 --> 00:23:16.878 Expanding the review of performance of existing borrowers. 00:23:17.468 --> 00:23:21.878 Reviewing growth and limitations for new business lines and or reviewing 00:23:21.878 --> 00:23:26.298 risk mitigation options and time frames for reduction of risk if necessary. 00:23:26.728 --> 00:23:31.868 Risk Alert 05 Risk 01 specialized lending activities third party indirect 00:23:31.868 --> 00:23:35.898 lending and participations and the accompanying supplemental guidance white 00:23:35.898 --> 00:23:40.448 paper on static pool analysis discusses how such analysis can be used to track 00:23:40.498 --> 00:23:42.468 the performance of most loan pools. 00:23:42.938 --> 00:23:46.908 This guidance can be applied to all non traditional products or other loan 00:23:46.908 --> 00:23:49.068 products, not just indirect lending. 00:23:49.488 --> 00:23:53.168 If management determines concentration risk is elevated, they should 00:23:53.178 --> 00:23:55.198 implement steps to mitigate the risk. 00:23:55.708 --> 00:23:58.998 If management does not properly assess or control the level of 00:23:58.998 --> 00:24:02.728 risk, examiners should require corrective actions to mitigate the 00:24:02.728 --> 00:24:05.138 risks, including but not limited to. 00:24:05.613 --> 00:24:08.743 Reducing limits or thresholds on risk concentrations. 00:24:09.053 --> 00:24:13.293 Reducing exposure to new business lines to address undue concentrations. 00:24:13.743 --> 00:24:17.473 Transferring risk to other parties by either selling directly or as 00:24:17.473 --> 00:24:19.543 part of securitization transactions. 00:24:19.913 --> 00:24:22.373 And or ceasing the product or service line. 00:24:22.853 --> 00:24:26.433 Conclusion excessive concentration risk can severely impact the 00:24:26.433 --> 00:24:28.503 financial condition of a credit union. 00:24:29.053 --> 00:24:33.073 High concentrations in areas experiencing severe economic distress 00:24:33.073 --> 00:24:37.043 could result in significant losses exceeding a credit union's net worth. 00:24:37.583 --> 00:24:41.213 It is the fiduciary responsibility of management and officials of credit 00:24:41.213 --> 00:24:45.633 unions to identify, manage, monitor, and control the risks facing the credit 00:24:45.643 --> 00:24:48.023 union, including concentration risk. 00:24:48.343 --> 00:24:51.953 Examiners need to ascertain whether the Board of Directors and management 00:24:51.973 --> 00:24:54.423 understand and actively manage this risk. 00:24:54.873 --> 00:24:58.483 Credit union management should know what their concentration risk is and 00:24:58.493 --> 00:25:01.813 be able to demonstrate appropriate risk management and mitigation 00:25:01.823 --> 00:25:06.013 practices to minimize the risk of significant financial condition decline. 00:25:06.463 --> 00:25:08.803 This concludes the concentration risk letter. 00:25:09.193 --> 00:25:13.023 If your credit union could use assistance with your exam, reach out to Mark 00:25:13.033 --> 00:25:15.513 Treichel on LinkedIn or at marktreichel. 00:25:15.523 --> 00:25:15.993 com. 00:25:16.473 --> 00:25:19.113 This is Samantha Shares and I thank you for listening.