NCUA: Concentration Risk Supervisory Letter to Credit Unions
Samantha: Hello this is Samantha Shares.
This episode covers NCU A's Letter to
Credit Unions on Concentration Risk.
Many credit unions are receiving
Documents of Resolution on
Concentration Risk and told to comply
with the guidance in this letter.
The following is and audio
version of that letter.
But first this podcast is
educational and is not legal advice.
We are sponsored by Credit Union
Exam Solutions Incorporated, whose
team has over two hundred and
Forty years of National Credit
Union Administration experience.
We assist our clients with N C
U A so they save time and money.
If you are worried about a recent,
upcoming or in process N C U A
examination, reach out to learn how they
can assist at Mark Treichel DOT COM.
Also check out our other podcast called
With Flying Colors where we provide tips
on how to achieve success with N C U A.
And now the Supervisory letter.
Supervisory Letter Concentration Risk
Credit union officials and management
have a fiduciary responsibility
to identify, measure, monitor,
and control concentration risk.
Concentration risk must be managed in
conjunction with credit, interest rate
and liquidity risks; as a negative event
in any category may have significant
consequences on the other areas, as
well as strategic and reputation risks.
Concentration risk has increased
in importance during the
recent economic recession.
Poor risk management of residential and
commercial mortgage loan concentrations,
in particular, is having an adverse
effect on credit unions nationwide;
resulting in significant loan losses,
earnings deterioration, capital depletion,
and increased credit union failures.
Most of the recent large losses
to the National Credit Union Share
Insurance Fund (NCUSIF) are due to
poor management of large concentrations
in various asset classes in relation
to the asset size and net worth
level of the failed institutions.
What is concentration risk?
A risk concentration is any single
exposure or group of exposures with the
potential to produce losses large enough
(relative to capital, total assets,
or overall risk level) to threaten
a financial institution’s health or
ability to maintain its core operations.
Avoiding concentrating too much in any
single product or service is a core
tenet of effective risk management and
when violated increases the risk of loss
to the credit union and to the NCUSIF.
Too much reliance on any single
product or service increases
the potential for adverse
consequences from “event risk” (i.e.
a negative event, such as a housing market
crash, that significantly affects the
financial condition of the institution).
Every asset, liability, product, service,
and third party provider presents
a risk of loss to the credit union
under varying conditions or events.
Some risks are less likely
than others to occur.
It is up to credit union management
to identify the risk in each product
or service line, quantify the risk
and set appropriate concentration
limits based on the analysis.
What are some types of concentration risk?
Concentration risk is present in many
forms across credit union operations.
Examples include: Asset classes (e.g.
residential real estate loans, member
business loans, automobile loans,
loan participations or investments).
Concentrations within a class of assets.
Examples include, but are not limited
to: o Residential Real Estate Loans
– collateral type, lien position, geographic
area, non-traditional terms (such as
interest-only, payment option, or balloon
payment), fixed or variable interest
rate, low or reduced underwriting
documentation, and loan-to-value (L T V).
o Member Business Loans (M
B Ls) – types of loans (e.g.
real estate, working capital, and credit
cards), collateral type, payment feature
(such as interest-only, balloon payments),
loan term, geographic area, and L T V.
Loan Participations – types of loans (e.g.
residential real estate, MBL, and
automobile) and the sub-classes
associated with the types, originating
lender, and geographic area.
o Loans to one borrower or
associated group of borrowers (may
include several different types of
loans – residential real estate,
MBLs, consumer loans, etcetera).
o Investments – types of investments (e.g.
Treasury securities, certificates
of deposit, and mortgage-backed
securities), collateral type, interest
rates, issuer (public or private),
tranche priority, and broker.
Liabilities (e.g.
rate sensitive share deposits
or callable borrowings).
Third-party providers (e.g.
CUSOs, indirect loan partners
or mortgage brokerage firms).
Services provided to other parties (e.g.
loan underwriting and/or
servicing, insurance services,
and investment consultation).
When reviewing the types of
concentrations in a credit union,
examiners must be cognizant of other
asset categories that may seem unrelated.
For instance, the types of loans
and characteristics of the loans
may be one form of concentration
risk that is easily identified.
However, similar characteristics
may exist in a loan participation
portfolio or an investment portfolio.
A clear example of this concept would
be a credit union that holds a portfolio
of real estate loans and also a
portfolio of mortgage backed securities.
There are common event risks in
these types of assets that must be
quantified and mitigated by management.
What are the largest exposures (risk
concentrations) in credit unions?
Concentration in credit portfolios is
considered to be the most significant
source of risk to financial institutions.
Trends in credit union balance
sheets reflect increased exposure
to concentration risk in areas of
their credit portfolios, such as:
Real estate loans (fixed rates) – As
of December thirty one, two
thousand and nine, real estate
loans held by credit unions comprise
fifty-four percent of total loans.
Of the two hundred and seventeen billion
dollars in first mortgage loans, over
60 percent have fixed rate terms.
In addition, fixed rate first mortgage
loans have increased by fifty five
percent since two thousand and five.
Member business loans – As of December
thirty one, two thousand and nine, member
business loans totaled $35 billion.
Credit unions grew their member
business loan portfolios by 9.8
percent in two thousand and nine.
Loan participations – As of December
thirty one, two thousand and
nine, credit union participations
outstanding totaled $12.4 billion,
and participation lending increased by
11.6 percent in two thousand and nine.
Construction and Development (C&D)
loans – As of December thirty one,
two thousand and nine, credit unions
owned two point four billion dollars in
commercial and residential C&D loans.
While this trend has declined
since two thousand and seven, the
real estate market downturn could
continue to have an adverse effect
on credit unions with concentrations
of C&D loans in their portfolio.
Investments in Mortgage-Related
Securities – As of December thirty
one, two thousand and nine, credit union
investments in mortgage-related securities
totaled fifty eight point seven billion
dollars; which is in addition to the
real estate loan exposure stated above.
Investments in mortgage-related
securities have more than doubled
since two thousand and five.
How is concentration risk
identified and measured?
Each product or service carries
some risk of financial exposure
or loss for the credit union.
Management needs to perform a risk
assessment which demonstrates their
understanding of the risk of the product
or service, quantifies the potential
loss exposure, and documents a rational
business decision on the acceptable
concentration level based on the analysis.
The larger the concentration level, the
more robust and advanced the analysis
and risk management techniques should be.
For instance, the sophistication and
depth of risk management systems and
analysis conducted on a real estate
portfolio that represents twenty percent
of total loans could be acceptably
less than a real estate portfolio that
represents fifty percent of total loans.
Another example is the level
of due diligence conducted on
a third party service provider.
The more important the service to the
core operation of the credit union and
the higher the amount of activity and
dollar volume of credit union activity it
handles, the more sophisticated and robust
the due diligence oversight needs to be.
Supervisory Letter – Page 4
Similar to the depth and sophistication
of the initial review, management must
increase the intensity and depth of
on-going monitoring and review of products
and services with high concentrations.
To measure and monitor concentration risk,
credit unions must start with the systems
used to store and analyze their data.
For more complex products, establishing
comprehensive data warehousing
will allow management to track
changes in the quality of their
various lines of business over time.
Without an all-inclusive process to
maintain and analyze data, the board
of directors and senior management
will not have the tools necessary
to make strategic and operational
decisions in a safe and sound manner.
Maintaining Comprehensive
and Accurate Data
Credit union management must emphasize the
importance of maintaining comprehensive
and accurate data for each risk area.
This includes a quality control
function to ensure that data entry
and changes are accurate and timely.
The credit union should have a
data processing system capable of
warehousing data on various lines of
business, commensurate with its size
and complexity, to properly identify
and measure concentration risk.
For example, this would include
maintaining information relevant to
the loan portfolio such as loan type,
interest rate, interest rate reset
dates (if applicable), payment amount,
payment shock (the potential increase
in payment from an interest rate reset
or conversion from interest-only to
principal and interest payments), credit
score (including original and updated
periodically), collateral description,
and collateral value (including
original and updated periodically).
Another example would include
maintaining information relevant to
the investment portfolio such as type,
interest rate, collateral information,
market value (original and updated
periodically), and external rating
(original and updated periodically).
This is not an all-inclusive list, but
rather a starting point for evaluating
if the data processing system is capable
of maintaining this type of data.
If the credit union does not have the
data processing capability, management
should contract with a third party to
provide data warehousing and reporting.
If management elects to pursue this
route, examiners should review their
initial and ongoing due diligence
of the vendor to ensure it is in
accordance with published guidance
and safe and sound business practices.
Risk Rating System
Developing an effective, accurate,
and timely risk rating system is
an important tool for managing
concentration risk in the loan portfolio.
Risk ratings should be objective,
sensitive to changes in borrower and/or
loan characteristics, and validated
via an independent review function.
With loan participations, credit
unions should assess the loan utilizing
their own internal rating system.
In the absence of an internal rating
system, management should not rely on
the originating institution’s system
without completing timely, thorough, and
ongoing due diligence of that system.
Supervisory Letter – Page 5
Examiners should review management’s
documentation of the original and
ongoing due diligence; ensuring
that it is consistent with safe
and sound business practices.
Reporting
Management reporting must be periodic and
timely, in a format that clearly indicates
changes in concentration risk and is
commensurate with the size, complexity,
and risk exposure of the credit union.
The reports should not only measure
concentration risk against board
approved parameters, but should also
measure how the risks change over time.
For example, a key factor in
determining concentration risk in a
loan portfolio would be to measure
credit score migration, by obtaining
updated credit scores on a periodic
basis and analyzing those borrowers
who have a declining credit score.
The frequency of reporting should
be commensurate with the type and
size of the concentration; for
example, larger portfolios should
have at least quarterly reporting.
How is concentration risk managed?
Implementing sound risk
management practices is the key
to managing concentration risk.
When credit unions have significant
concentrations on their balance
sheet, examiners need to ensure risk
management practices are commensurate
with the risk assumed relative to
net worth, and management clearly
identifies and measures the risk taken.
The ultimate responsibility for
setting the level of concentration
risk assumed by the credit union
rests with the board of directors.
Senior management is responsible for
maintaining concentration risk within the
parameters set by the board of directors.
Concentration risk has a substantial
influence on credit, strategic,
reputation, interest rate, and liquidity
risks as all are closely related.
All of these risks impact net
worth and must be supported by a
net worth level commensurate with
the risk in the balance sheet.
The board of directors and senior
management need to manage all of
these risk areas simultaneously.
One of the common flaws in managing
risks within a credit union is to tie
each risk independently to net worth,
without monitoring the aggregate
exposure of different risks to net worth.
The result may be excessive
reliance on the level of net worth
to manage each individual risk.
Effective risk management practices
would not only include tying the limits
of each product or service to net worth,
but also consolidating the risks in
products and services and measuring the
totality of the risks against net worth.
Board Policy & Concentration Risk Limits
The board of directors must establish a
policy which addresses its philosophy on
concentration risk, limits commensurate
with net worth levels, and the rationale
as to how the limits fit into the overall
strategic plan of the credit union.
Supervisory Letter – Page 6
The board should use a global
perspective when developing this policy,
including identifying outside forces
(such as economic or housing price
uncertainty) which will affect the
ability to manage concentration risk.
For example, the board should not
begin or expand a mortgage program
that allows high loan-to-values at
the height of a real estate bubble,
which will likely lead to significant
losses when the market declines.
The parameters set by the board
should be specific to each portfolio
and should include limits on loan
types, share types, third party
relationship exposure, etcetera.
The risk limits should correlate
to the overall growth objectives,
financial targets, and net worth plan.
The risk limits set forth in the
concentration risk policy should be
closely linked to those codified in
related policies, including, but not
limited to, real estate loan, member
business loan, loan participation,
asset/liability management
(ALM), and investment policies.
Concentrations that exceed one hundred
percent of net worth must be monitored
carefully, and the board of directors
should document an adequate rationale
for undertaking that level of risk.
Third Party Oversight
When working with third parties, due
diligence is essential to ensure the
risks are properly identified and managed.
Examples of third party services
include purchase of participations
in loans; underwriting, processing
and safekeeping member loans; and
purchase or safekeeping investments.
Numerous guidance letters have been
issued on this subject, and are listed
in the references section of this letter.
The guidance discusses the need for due
diligence reviews to take into account the
nature of the service, length and depth
of expertise exhibited by the vendor,
staffing changes, economic and regulatory
changes, and risk mitigation strategies
associated with vendor oversight.
Also important to note is that due
diligence is an ongoing process.
It encompasses the original review
at the outset of product or service
implementation and should be updated
periodically to monitor changes
in the vendor’s ability to deliver
products or services which meet
the credit union’s expectations.
How is concentration risk
monitored and controlled?
Once the appropriate risk management
systems and policies are in place, it
is essential monitoring and oversight
become routine functions at the senior
management level within the credit union.
Ultimately, the board of directors
is responsible for oversight and
monitoring at a strategic level.
Regular formal reporting to the board
and senior management on compliance
with the concentration and risk
limits they establish is expected.
In addition, management should implement
appropriate internal controls, including
segregation of duties, to ensure
accurate reporting on concentration risk.
Compliance and Oversight Senior
management needs to implement
procedures and controls to effectively
adhere to and monitor compliance with
established policies and strategies.
Both the board and management must
periodically review information that
identifies and measures the level
and nature of concentration risk and
implement corrective action should
the risk from any one area exceed
the board approved tolerance level.
Supervisory Letter – Page 7
Credit unions with large and complex
loan or investment programs should
establish a specific risk management
committee as a sound business practice.
The composition of the committee will
depend on the size and complexity
of the credit union, but should be
limited to a small number of senior
executives and one or more board members.
The agenda of this committee should
be limited to risk management issues;
specifically concentration risk, credit
risk, interest rate risk, liquidity
risk, and financial performance.
From a reporting perspective, management
should demonstrate compliance with
every board established policy limit
dealing with concentration risk, as well
as limits on associated risks such as
credit, interest rate, and liquidity.
Scenario and Sensitivity Analysis
Credit unions should routinely perform
portfolio-level scenario and sensitivity
tests to quantify the impact of
changing economic conditions on asset
quality, earnings, and net worth.
In general, scenario analysis uses
the model to predict a possible
future outcome given an event or a
series of events, while sensitivity
analysis tests a model’s parameters
without relating those changes to an
underlying event or real world outcome.
The outcome of sensitivity analysis
is to determine which assumptions have
the most impact on the model’s results.
Credit unions should consider the
susceptibility of portfolio segments
with common risk characteristics
to changing market conditions.
Examples of common risk characteristics
can be by loan type, investment type,
collateral type, geographic area,
individual or associational groups of
borrowers, business lines, etcetera.
An example scenario analysis for a
concentration in HE LOCK mortgages would
be the risk to earnings if unemployment
in the area doubled while house market
values declined by twenty five percent,
combined with the effect of interest
rate resets and associated payment shock.
An example scenario analysis for a
concentration in thirty year, fixed-rate
mortgages would be the risk to earnings
and capital from liquidity and interest
rate risks in a rising rate environment;
where liquidity risk increases as
mortgage cash flows decrease, and rising
interest rate risk causes earnings
to deteriorate as members seek higher
dividend rates to maintain their deposits.
The analyses should be multi-faceted
to explore the effect of single
and multiple simultaneous
negative events on the portfolio.
The sophistication of scenario
and sensitivity analyses should
be consistent with the size,
complexity, and risk characteristics
of the portfolio as a whole.
Basel Committee on Banking Supervision,
Principles for Sound Stress
Testing Practices and Supervision.
May two thousand and nine.
Supervisory Letter – Page 8
What are basic review procedures for
examiners related to concentration risk?
The following are some basic review steps
and questions examiners should ask when
conducting a review of concentration risk.
Examiner expectations for the depth
and sophistication of the responses
from credit union management should
increase if the initial review
of a credit union’s balance sheet
reveals potentially high exposure.
• Does the credit union have policies
directly related to identifying,
measuring, monitoring, and
controlling concentration risk?
Examiners should ensure credit unions
consider the following when evaluating
the board policies: The level and
nature of inherent risk on the
balance sheet; Management expertise;
Risk management practices; Market
conditions; and Adequacy of reserves
allocated for concentration risk.
• Has the credit union developed
appropriate policies and procedures,
including establishing acceptable risk
limits for each product and service
on an individual and aggregate basis?
• Has management assessed the adequacy
of net worth based on the aggregate
potential exposure to all forms of
concentration risk, while also considering
the potential credit, interest rate,
and liquidity risk impact on net worth?
• Has the credit union considered the
various types of concentrations and
their interrelationship, particularly
between asset classes or common products
and service characteristics, which may
present higher risk when aggregated?
• Has the credit union considered the “event
risks” that may expose them to financial
loss for each asset class, quantified the
risk, and established appropriate risk
tolerance limits based on the probability
and potential impact from each event?
• Do the board and senior management receive
regular reports on the individual and
aggregate exposure to concentration risk?
• Does management have predetermined actions
to take when risk limits are reached?
Do they take the appropriate action?
A material red flag is a credit union
that simply raises the established
limit when it is reached without
advanced analysis supporting the
rationale for the change in policy.
• Is the credit union’s system of
identifying, measuring, monitoring,
and controlling concentration risk
commensurate with the level of
potential concentration risk exposure?
Supervisory Letter – Page 9
• When credit unions have significant
loan concentrations, does management
maintain reports and perform analysis
of the following: Origination and
portfolio trends by product, loan
structure, originator channel, credit
score, LTV, debt-to-income ratio
(DTI), lien position, documentation
type, property type, appraiser,
appraised value, and appraisal date;
Delinquency and loss distribution trends
by product and originator channel with
accompanying analysis of significant
underwriting characteristics, such as
credit score, L TV, and D T I; Vintage
tracking3 (i.e., static pool analysis);
The performance of third-party
(brokers, auto dealers, and
correspondents) originated loans;
and, Market trends by geographic
area and property type to identify
areas of rapidly appreciating
or depreciating housing values.
What options are available when
a credit union or the examiner
identifies elevated concentration risk?
The board of directors and management
should have triggers and action plans
in writing for any material risk area.
If the credit union’s monitoring
activities identify concerns with
a concentration, the board of
directors must respond accordingly.
Similarly, if an examiner believes
there may be elevated concentration risk
issues present in a credit union, and
management has not properly quantified
and mitigated the risk, they should
require corrective actions of management
that include, but are not limited to:
Expanding the review of the risk
environment for the particular sector(s);
Performing elevated scenario
and sensitivity analyses;
Expanding the review of
performance of existing borrowers;
Reviewing growth and limitations
for new business lines;
and/or Reviewing risk mitigation
options and timeframes for
reduction of risk, if necessary.
3Risk Alert zero five Risk 0 1,
Specialized Lending Activities
– Third-Party Indirect Lending and
Participations, and the accompanying
supplemental guidance whitepaper on
static pool analysis discusses how
such analysis can be used to track
the performance of most loan pools.
This guidance can be applied to all
non-traditional products or other loan
products, not just indirect lending.
Supervisory Letter – Page 10
If management determines concentration
risk is elevated, they should
implement steps to mitigate the risk.
If management does not properly
assess or control the level of
risk, examiners should require
corrective actions to mitigate the
risks, including but not limited to:
Reducing limits or thresholds
on risk concentrations; Reducing
exposure to new business lines
to address undue concentrations;
Transferring risk to other parties
by either selling directly or as
part of securitization transactions;
and/or Ceasing the
product or service line.
Conclusion Excessive concentration
risk can severely impact the
financial condition of a credit union.
High concentrations in areas
experiencing severe economic distress
could result in significant losses
exceeding a credit union’s net worth.
It is the fiduciary responsibility
of management and officials of credit
unions to identify, manage, monitor,
and control the risks facing the credit
union, including concentration risk.
Examiners need to ascertain whether
the board of directors and management
understand and actively manage this risk.
Credit union management should know
what their concentration risk is and
be able to demonstrate appropriate
risk management and mitigation
practices to minimize the risk of
significant financial condition decline.
This concludes the
Concentration Risk Letter.
If your credit union could use assistance
with your exam, reach out to Mark Treichel
on LinkedIn, or at mark Treichel dot com.
This is Samantha Shares and
I Thank you for listening.
