Hello, this is Samantha Shares.
This episode covers NCUA's letter to credit unions on concentration risk.
Many credit unions are receiving documents of resolution on
concentration risk and told to comply with the guidance in this letter.
The following is an audio version of that letter.
But first, this podcast is educational and is not legal advice.
We are sponsored by Credit Union Exam Solutions, Inc., whose team has
over 240 years of national credit union administration experience.
We assist our clients with NCUA so they save time and money.
If you are worried about a recent, upcoming, or in process NCUA
examination, reach out to learn how they can assist at marktreichel.
com.
Also, check out our other podcast called With Flying Colors, where we provide
tips on how to achieve success with NCUA.
And now, the letter.
Concentration risk.
Credit union officials and management have a fiduciary responsibility
to identify, measure, monitor, and control concentration risk.
Concentration risk must be managed in conjunction with credit.
Interest Rate and Liquidity Risks, as a negative event in any category
may have significant consequences on the other areas, as well as
strategic and reputation risks.
Concentration risk has increased in importance during the
recent economic recession.
Poor risk management of residential and commercial mortgage loan concentrations,
in particular, is having an adverse effect on credit unions nationwide,
resulting in significant loan losses, earnings deterioration, capital depletion,
and increased credit union failures.
Most of the recent large losses to the National Credit Union Share
Insurance Fund in CUSIF are due to poor management of large concentrations
in various asset classes in relation to the asset size and net worth
level of the failed institutions.
What is concentration risk?
A risk concentration is any single exposure or group of exposures with
the potential to produce losses large enough relative to capital, total
assets, or overall risk level to threaten a financial institution's health or
ability to maintain its core operations.
Avoiding concentrating too much in any single product or service is a core tenet
of effective risk management and when violated increases the risk of loss to
the credit union and to the incusive.
Too much reliance on any single product or service increases the potential for
adverse consequences from event risk, i.
e.
a negative event, such as a housing market crash, that significantly affects the
financial condition of the institution.
Every asset, liability, product, service, and third party provider presents
a risk of loss to the credit union under varying conditions or events.
Some risks are less likely than others to occur.
It is up to credit union management to identify the risk in each product
or service line, quantify the risk, and set appropriate concentration
limits based on the analysis.
What are some types of concentration risk?
Concentration risk is present in many forms across credit union operations.
Examples include asset classes, e.
g.
residential real estate loans, member business loans, automobile loans,
loan participations, or investments, concentrations within a class of assets.
Examples include, but are not limited to, O residential real estate loans
collateral type, lien position, geographic area, non traditional terms
such as interest only, payment option, or balloon payment, fixed or variable
interest rate, low or reduced underwriting documentation, and loan to value LTV.
O member business loans, MBLS types of loans, e.
g.
Real estate, working capital, and credit cards, collateral type, payment features
such as interest only, balloon payments, loan term, geographic area, and LTV.
Loan participation types of loans e.
g.
residential real estate, MBL, and automobile, and the subclasses
associated with the types, originating lender, and geographic area.
O loans to one borrower or associated group of borrowers may include several
different types of loans residential real estate, MBLS, consumer loans, et cetera.
Oh, investments, types of investments, e.
g.
treasury securities, certificates of deposit and mortgage backed
securities, collateral type interest rates, issue a public or private trans
priority and broker liabilities, e.
g.
rate sensitive share deposits or callable borrowings, third party providers, e.
g.
PUSOs, indirect loan partners or mortgage brokerage firms.
Services provided to other parties, e.
g., loan underwriting and or servicing, insurance services,
and investment consultation.
When reviewing the types of concentrations in a credit union,
examiners must be cognizant of other asset categories that may seem unrelated.
For instance, the types of loans and characteristics of the loans
may be one form of concentration risk that is easily identified.
However, similar characteristics may exist in a loan participation
portfolio or an investment portfolio.
A clear example of this concept would be a credit union that holds a portfolio
of real estate loans and also a portfolio of mortgage backed securities.
There are common event risks in these types of assets that must be
quantified and mitigated by management.
What are the largest exposures, risk concentrations in credit unions?
Concentration in credit portfolios is considered to be the most significant
source of risk to financial institutions.
Trends in credit union balance sheets reflect increased exposure to
concentration risk in areas of their credit portfolios, such as real estate
loans fixed rates as of December 31, 2009, Real estate loans held by credit
unions comprise 54 percent of total loans.
Of the 217 billion in first mortgage loans, over 60
percent have fixed rate terms.
In addition, fixed rate first mortgage loans have increased
by 55 percent since 2005.
Member business loans as of December 31, 2009.
Member business loans totaled 35 billion.
Credit unions grew their member business loan portfolios by 98 percent in 2009.
Loan participations as of December 31, 2009, credit union participations
outstanding totaled 24 billion, and participation lending increased by 11.
6 percent in 2009.
Construction and development C& D loans, as of December 31,
2009, credit unions owned 2.
4 billion in commercial and residential C& D loans.
While this trend has declined since 2007, the real estate market downturn
could continue to have an adverse effect on credit unions with concentrations
of C& D loans in their portfolio.
Investments in mortgage related securities, as of December 31, 2009,
Credit union investments in mortgage related securities totaled 58.
7 billion, which is in addition to the real estate loan exposure stated above.
Investments in mortgage related securities have more than doubled since 2005.
How is concentration risk identified and measured?
Each product or service carries some risk of financial exposure
or loss for the credit union.
Management needs to perform a risk assessment which demonstrates
their understanding of the risk of the product or service.
Quantifies the potential loss exposure and documents a rational business
decision on the acceptable concentration level based on the analysis.
The larger the concentration level, the more robust and advanced the analysis
and risk management techniques should be.
For instance, the sophistication and depth of risk management systems and
analysis conducted on a real estate portfolio that represents 20 percent
of total loans could be acceptably less than a real estate portfolio that
represents 50 percent of total loans.
Another example is the level of due diligence conducted on
a third party service provider.
The more important the service to the core operation of the credit union and
the higher the amount of activity and dollar volume of credit union activity, it
handles the more sophisticated and robust the due diligence oversight needs to be.
Similar to the depth and sophistication of the initial review, management must
increase the intensity and depth of ongoing monitoring and review of products
and services with high concentrations.
To measure and monitor concentration risk, credit unions must start with the systems
used to store and analyze their data.
For more complex products, establishing comprehensive data warehousing
will allow management to track changes in the quality of their
various lines of business over time.
Without an all inclusive process to maintain and analyze data, the Board
of Directors and Senior Management will not have the tools necessary
to make strategic and operational decisions in a safe and sound manner.
Maintaining Comprehensive and Accurate Data Credit union management
must emphasize the importance of maintaining comprehensive and
accurate data for each risk area.
This includes a quality control function to ensure that data entry
and changes are accurate and timely.
The credit union should have a data processing system capable of
warehousing data on various lines of business commensurate with its size
and complexity to properly identify and measure concentration risk.
For example, this would include maintaining information relevant to
the loan portfolio, such as loan type, interest rate, interest rate reset
dates, if applicable, payment amount, Payments shock the potential increase
in payment from an interest rate reset or conversion from interest only to
principal and interest payments credit score including original and updated
periodically, collateral description, and collateral value including
original and updated periodically.
Another example would include maintaining information relevant to
the investment portfolio, such as type, interest rate, collateral information,
market value original and updated periodically, and external rating
original and updated periodically.
This is not an all inclusive list, But rather a starting point for evaluating
if the data processing system is capable of maintaining this type of data.
If the credit union does not have the data processing capability, management
should contract with a third party to provide data warehousing and reporting.
If management elects to pursue this route, examiners should review their
initial and ongoing due diligence of the vendor to ensure it is in
accordance with published guidance and safe and sound business practices.
Risk Rating System Developing an effective, accurate, and timely
risk rating system is an important tool for managing concentration
risk in the loan portfolio.
Risk ratings should be objective, sensitive to changes in borrower and
or loan characteristics, and validated via an independent review function.
For With loan participations, credit unions should assess the loan utilizing
their own internal rating system.
In the absence of an internal rating system, management should not rely
on the originating institution system without completing timely, thorough, and
ongoing due diligence of that system.
Examiners should review management's documentation of the original and
ongoing due diligence, ensuring that it is consistent with safe
and sound business practices.
Reporting.
Management reporting must be periodic and timely in a format that clearly indicates
changes in concentration risk and is commensurate with the size, complexity,
and risk exposure of the credit union.
The report should not only measure concentration risk against board
approved parameters, but should also measure how the risks change over time.
For example, a key factor in determining concentration risk in a
loan portfolio would be to measure credit score migration by obtaining
updated credit scores on a periodic basis and analyzing those borrowers
who have a declining credit score.
The frequency of reporting should be commensurate with the type
and size of the concentration.
For example, larger portfolios should have at least quarterly reporting.
How is concentration risk managed?
Implementing sound risk management practices is the key
to managing concentration risk.
When credit unions have significant concentrations on their balance
sheet, examiners need to ensure risk management practices are commensurate
with the risk assumed relative to net worth, and management clearly
identifies and measures the risk taken.
The ultimate responsibility for setting the level of concentration
risk assumed by the credit union rests with the board of directors.
For Senior Management is responsible for maintaining concentration risk within the
parameters set by the Board of Directors.
Concentration risk has a substantial influence on credit, strategic,
reputation, interest rate, and liquidity risks as all are closely related.
All of these risks impact net worth and must be supported by a
net worth level commensurate with the risk in the balance sheet.
The Board of Directors and Senior Management need to manage all of
these risk areas simultaneously.
One of the common flaws in managing risks within a credit union is to
tie each risk independently to net worth without monitoring the aggregate
exposure of different risks to net worth.
The result may be excessive reliance on the level of net worth
to manage each individual risk.
Effective risk management practices would not only include tying the limits
of each product or service to net worth, but also consolidating the risks in
products and services and measuring the totality of the risks against net worth.
Board Policy and Concentration Risk Limits.
The Board of Directors must establish a policy which addresses its philosophy on
concentration risk, limits commensurate with net worth levels, and the rationale
as to how the limits fit into the overall strategic plan of the credit union.
The board should use a global perspective when developing this policy,
including identifying outside forces such as economic or housing price
uncertainty, which will affect the ability to manage concentration risk.
For example, the board should not begin or expand a mortgage program
that allows high loan to values at the height of a real estate bubble,
which will likely lead to significant losses when the market declines.
The parameters set by the board should be specific to each portfolio, and should
include limits on loan types, share types, third party relationship exposure, etc.
The risk limits should correlate to the overall growth objectives,
financial targets, and net worth plan.
The risk limits set forth in the concentration risk policy
should be closely linked to those codified in related policies,
including, but not limited to, real estate loan, mortgage loan.
Member Business Loan, Loan Participation, Asset Liability
Management, OM, and Investment Policies.
Concentrations that exceed 100 percent of net worth must be monitored
carefully and the Board of Directors should document an adequate rationale
for undertaking that level of risk.
Third Party Oversight When working with third parties, due diligence
is essential to ensure the risks are properly identified and managed.
Examples of third party services include purchase of participations
and loans, underwriting, processing, and safekeeping member loans, and
purchase or safekeeping investments.
Numerous guidance letters have been issued on this subject and are listed in
the References section of this letter.
The guidance discusses the need for due diligence reviews to take into account the
nature of the service, length and depth of expertise exhibited by the vendor,
staffing changes, economic and regulatory changes, and risk mitigation strategies
associated with vendor oversight.
Also important to note is that due diligence is an ongoing process.
It encompasses the original review at the outset of product or service
implementation and should be updated periodically to monitor changes
in the vendor's ability to deliver products or services which meet
the credit union's expectations.
How is concentration risk monitored and controlled?
Once the appropriate risk management systems and policies are in place, it
is essential monitoring and oversight become routine functions at the senior
management level within the credit union.
Ultimately, the Board of Directors is responsible for oversight and
monitoring at a strategic level.
Regular formal reporting to the board and senior management on compliance
with the concentration and risk limits they establish is expected.
In addition, management should implement appropriate internal controls, including
segregation of duties, to ensure accurate reporting on concentration risk.
Compliance and oversight senior management needs to implement
procedures and controls to effectively adhere to and monitor compliance with
established policies and strategies.
Both the board and management must periodically review information that
identifies and measures the level and nature of concentration risk and
implement corrective action, should the risk from any one area exceed
the board approved tolerance level.
Credit unions with large and complex loan or investment programs should
establish a specific risk management committee as a sound business practice.
The composition of the committee will depend on the size and complexity
of the credit union, but should be limited to a small number of senior
executives and one or more board members.
The agenda of this committee should be limited to risk management issues,
specifically concentration risk, credit risk, interest rate risk.
From a reporting perspective, management should demonstrate compliance with
every board established policy limit dealing with concentration risk, as well
as limits on associated risks such as credit, interest rate, and liquidity.
Scenario and Sensitivity Analysis Credit unions should routinely perform
portfolio level scenario and sensitivity tests to quantify the impact of
changing economic conditions on asset quality, earnings, and net worth.
In general, scenario analysis uses the model to predict a possible
future outcome given an event or a series of events, while sensitivity
analysis tests a model's parameters without relating those changes to an
underlying event or real world outcome.
The outcome of sensitivity analysis is to determine which assumptions have
the most impact on the model's results.
Credit unions should consider the susceptibility of portfolio segments
with common risk characteristics to changing market conditions.
Examples of common risk characteristics can be by loan type, investment type,
collateral type, geographic area, individual or associational groups
of borrowers, business lines, etc.
An example scenario analysis for a concentration in HELOC mortgages would
be the risk to earnings if unemployment in the area doubled while house market
values declined by 25%, combined with the effect of interest rate
resets and associated payment shock.
In example scenario analysis for a concentration in 30 year, fixed rate
mortgages would be the risk to earnings and capital from liquidity and interest
rate risks in a rising rate environment, where liquidity risk increases as
mortgage cash flows decrease, and rising interest rate risk causes earnings
to deteriorate as members seek higher dividend rates to maintain their deposits.
The analysis should be multifaceted to explore the effect of single
and multiple simultaneous negative events on the portfolio.
The sophistication of scenario and sensitivity analyzes should
be consistent with the size, complexity, and risk characteristics
of the portfolio as a whole.
Basel Committee on Banking Supervision, Principles for Sound Stress Testing
Practices and Supervision, May 2009.
What are basic review procedures for examiners related to concentration risk?
The following are some basic review steps and questions examiners should ask when
conducting a review of concentration risk.
Examiner expectations for the depth and sophistication of the responses
from credit union management should increase if the initial review
of a credit union's balance sheet reveals potentially high exposure.
Does the credit union have policies directly related to identifying,
measuring, monitoring, and controlling concentration risk?
Examiners should ensure credit unions consider the following when
evaluating the board policies.
The level and nature of inherent risk on the balance sheet, management expertise,
risk management practices, market conditions, and adequacy of reserves
allocated for concentration risk.
Has the credit union developed appropriate policies and procedures,
including establishing acceptable risk limits for each product and service
on an individual and aggregate basis?
Has management assessed the adequacy of net worth based on the aggregate
potential exposure to all forms of concentration risk, while also considering
the potential credit, interest rate, and liquidity risk impact on net worth?
Has the credit union considered the various types of concentrations and
their interrelationship, particularly between asset classes or common products
and service characteristics, which may present higher risk when aggregated?
Has the credit union considered the event risks that may expose them to financial
loss for each asset class, quantified the risk, and established appropriate risk
tolerance limits based on the probability and potential impact from each event?
Do the board and senior management receive regular reports on the individual and
aggregate exposure to concentration risk?
Does management have predetermined actions to take when risk limits are reached?
Do they take the appropriate action?
A material red flag is a credit union that simply raises the established
limit when it is reached without advanced analysis supporting the
rationale for the change in policy.
Is the credit union system of identifying, measuring, monitoring,
and controlling concentration risk commensurate with the level of
potential concentration risk exposure?
When credit unions have significant loan concentrations, does
management maintain reports and perform analysis of the following?
Origination and portfolio trends by product, loan structure,
originator channel, credit score, LTV, debt to income ratio DTI,
lien position, documentation type.
Property type, appraiser, appraised value, and appraisal date.
Delinquency and lost distribution trends by product and originator
channel with accompanying analysis of significant underwriting characteristics
such as credit score, LTV, and DTI.
Vintage Tracking 3IE Static Pool Analysis.
The performance of third party brokers, auto dealers, and correspondents
originated loans and market trends by geographic area and property type to
identify areas of rapidly appreciating or depreciating housing values.
What options are available when a credit union or the examiner
identifies elevated concentration risk?
The Board of Directors and management should have triggers and action plans
in writing for any material risk area.
If the credit union's monitoring activities identify concerns with
a concentration, the Board of Directors must respond accordingly.
Similarly, if an examiner believes there may be elevated concentration risk
issues present in a credit union, and management has not properly quantified
and mitigated the risk, they should require corrective actions of management
that include, but are not limited to.
Expanding the review of the risk environment for the particular sectors.
Performing elevated scenario and sensitivity analyzes.
Expanding the review of performance of existing borrowers.
Reviewing growth and limitations for new business lines and or reviewing
risk mitigation options and time frames for reduction of risk if necessary.
Risk Alert 05 Risk 01 specialized lending activities third party indirect
lending and participations and the accompanying supplemental guidance white
paper on static pool analysis discusses how such analysis can be used to track
the performance of most loan pools.
This guidance can be applied to all non traditional products or other loan
products, not just indirect lending.
If management determines concentration risk is elevated, they should
implement steps to mitigate the risk.
If management does not properly assess or control the level of
risk, examiners should require corrective actions to mitigate the
risks, including but not limited to.
Reducing limits or thresholds on risk concentrations.
Reducing exposure to new business lines to address undue concentrations.
Transferring risk to other parties by either selling directly or as
part of securitization transactions.
And or ceasing the product or service line.
Conclusion excessive concentration risk can severely impact the
financial condition of a credit union.
High concentrations in areas experiencing severe economic distress
could result in significant losses exceeding a credit union's net worth.
It is the fiduciary responsibility of management and officials of credit
unions to identify, manage, monitor, and control the risks facing the credit
union, including concentration risk.
Examiners need to ascertain whether the Board of Directors and management
understand and actively manage this risk.
Credit union management should know what their concentration risk is and
be able to demonstrate appropriate risk management and mitigation
practices to minimize the risk of significant financial condition decline.
This concludes the concentration risk letter.
If your credit union could use assistance with your exam, reach out to Mark
Treichel on LinkedIn or at marktreichel.
com.
This is Samantha Shares and I thank you for listening.