NCUA's Concentration Risk Expectations for Credit Unions
Hello, this is Samantha Shares.
This episode covers NCUA's letter to
credit unions on concentration risk.
Many credit unions are receiving
documents of resolution on
concentration risk and told to comply
with the guidance in this letter.
The following is an audio
version of that letter.
But first, this podcast is
educational and is not legal advice.
We are sponsored by Credit Union
Exam Solutions, Inc., whose team has
over 240 years of national credit
union administration experience.
We assist our clients with NCUA
so they save time and money.
If you are worried about a recent,
upcoming, or in process NCUA
examination, reach out to learn how
they can assist at marktreichel.
com.
Also, check out our other podcast called
With Flying Colors, where we provide
tips on how to achieve success with NCUA.
And now, the letter.
Concentration risk.
Credit union officials and management
have a fiduciary responsibility
to identify, measure, monitor,
and control concentration risk.
Concentration risk must be managed
in conjunction with credit.
Interest Rate and Liquidity Risks,
as a negative event in any category
may have significant consequences
on the other areas, as well as
strategic and reputation risks.
Concentration risk has increased
in importance during the
recent economic recession.
Poor risk management of residential and
commercial mortgage loan concentrations,
in particular, is having an adverse
effect on credit unions nationwide,
resulting in significant loan losses,
earnings deterioration, capital depletion,
and increased credit union failures.
Most of the recent large losses
to the National Credit Union Share
Insurance Fund in CUSIF are due to
poor management of large concentrations
in various asset classes in relation
to the asset size and net worth
level of the failed institutions.
What is concentration risk?
A risk concentration is any single
exposure or group of exposures with
the potential to produce losses large
enough relative to capital, total
assets, or overall risk level to threaten
a financial institution's health or
ability to maintain its core operations.
Avoiding concentrating too much in any
single product or service is a core tenet
of effective risk management and when
violated increases the risk of loss to
the credit union and to the incusive.
Too much reliance on any single product
or service increases the potential for
adverse consequences from event risk, i.
e.
a negative event, such as a housing market
crash, that significantly affects the
financial condition of the institution.
Every asset, liability, product, service,
and third party provider presents
a risk of loss to the credit union
under varying conditions or events.
Some risks are less likely
than others to occur.
It is up to credit union management
to identify the risk in each product
or service line, quantify the risk,
and set appropriate concentration
limits based on the analysis.
What are some types of concentration risk?
Concentration risk is present in many
forms across credit union operations.
Examples include asset classes, e.
g.
residential real estate loans, member
business loans, automobile loans,
loan participations, or investments,
concentrations within a class of assets.
Examples include, but are not limited
to, O residential real estate loans
collateral type, lien position,
geographic area, non traditional terms
such as interest only, payment option,
or balloon payment, fixed or variable
interest rate, low or reduced underwriting
documentation, and loan to value LTV.
O member business loans,
MBLS types of loans, e.
g.
Real estate, working capital, and credit
cards, collateral type, payment features
such as interest only, balloon payments,
loan term, geographic area, and LTV.
Loan participation types of loans e.
g.
residential real estate, MBL, and
automobile, and the subclasses
associated with the types, originating
lender, and geographic area.
O loans to one borrower or associated
group of borrowers may include several
different types of loans residential real
estate, MBLS, consumer loans, et cetera.
Oh, investments, types of investments, e.
g.
treasury securities, certificates
of deposit and mortgage backed
securities, collateral type interest
rates, issue a public or private trans
priority and broker liabilities, e.
g.
rate sensitive share deposits or callable
borrowings, third party providers, e.
g.
PUSOs, indirect loan partners
or mortgage brokerage firms.
Services provided to other parties, e.
g., loan underwriting and or
servicing, insurance services,
and investment consultation.
When reviewing the types of
concentrations in a credit union,
examiners must be cognizant of other
asset categories that may seem unrelated.
For instance, the types of loans
and characteristics of the loans
may be one form of concentration
risk that is easily identified.
However, similar characteristics
may exist in a loan participation
portfolio or an investment portfolio.
A clear example of this concept would
be a credit union that holds a portfolio
of real estate loans and also a
portfolio of mortgage backed securities.
There are common event risks in
these types of assets that must be
quantified and mitigated by management.
What are the largest exposures, risk
concentrations in credit unions?
Concentration in credit portfolios is
considered to be the most significant
source of risk to financial institutions.
Trends in credit union balance
sheets reflect increased exposure to
concentration risk in areas of their
credit portfolios, such as real estate
loans fixed rates as of December 31,
2009, Real estate loans held by credit
unions comprise 54 percent of total loans.
Of the 217 billion in first
mortgage loans, over 60
percent have fixed rate terms.
In addition, fixed rate first
mortgage loans have increased
by 55 percent since 2005.
Member business loans
as of December 31, 2009.
Member business loans totaled 35 billion.
Credit unions grew their member business
loan portfolios by 98 percent in 2009.
Loan participations as of December
31, 2009, credit union participations
outstanding totaled 24 billion, and
participation lending increased by 11.
6 percent in 2009.
Construction and development
C& D loans, as of December 31,
2009, credit unions owned 2.
4 billion in commercial
and residential C& D loans.
While this trend has declined since
2007, the real estate market downturn
could continue to have an adverse effect
on credit unions with concentrations
of C& D loans in their portfolio.
Investments in mortgage related
securities, as of December 31, 2009,
Credit union investments in mortgage
related securities totaled 58.
7 billion, which is in addition to the
real estate loan exposure stated above.
Investments in mortgage related securities
have more than doubled since 2005.
How is concentration risk
identified and measured?
Each product or service carries
some risk of financial exposure
or loss for the credit union.
Management needs to perform a
risk assessment which demonstrates
their understanding of the
risk of the product or service.
Quantifies the potential loss exposure
and documents a rational business
decision on the acceptable concentration
level based on the analysis.
The larger the concentration level, the
more robust and advanced the analysis
and risk management techniques should be.
For instance, the sophistication and
depth of risk management systems and
analysis conducted on a real estate
portfolio that represents 20 percent
of total loans could be acceptably
less than a real estate portfolio that
represents 50 percent of total loans.
Another example is the level
of due diligence conducted on
a third party service provider.
The more important the service to the
core operation of the credit union and
the higher the amount of activity and
dollar volume of credit union activity, it
handles the more sophisticated and robust
the due diligence oversight needs to be.
Similar to the depth and sophistication
of the initial review, management must
increase the intensity and depth of
ongoing monitoring and review of products
and services with high concentrations.
To measure and monitor concentration risk,
credit unions must start with the systems
used to store and analyze their data.
For more complex products, establishing
comprehensive data warehousing
will allow management to track
changes in the quality of their
various lines of business over time.
Without an all inclusive process to
maintain and analyze data, the Board
of Directors and Senior Management
will not have the tools necessary
to make strategic and operational
decisions in a safe and sound manner.
Maintaining Comprehensive and
Accurate Data Credit union management
must emphasize the importance
of maintaining comprehensive and
accurate data for each risk area.
This includes a quality control
function to ensure that data entry
and changes are accurate and timely.
The credit union should have a
data processing system capable of
warehousing data on various lines of
business commensurate with its size
and complexity to properly identify
and measure concentration risk.
For example, this would include
maintaining information relevant to
the loan portfolio, such as loan type,
interest rate, interest rate reset
dates, if applicable, payment amount,
Payments shock the potential increase
in payment from an interest rate reset
or conversion from interest only to
principal and interest payments credit
score including original and updated
periodically, collateral description,
and collateral value including
original and updated periodically.
Another example would include
maintaining information relevant to
the investment portfolio, such as type,
interest rate, collateral information,
market value original and updated
periodically, and external rating
original and updated periodically.
This is not an all inclusive list, But
rather a starting point for evaluating
if the data processing system is capable
of maintaining this type of data.
If the credit union does not have the
data processing capability, management
should contract with a third party to
provide data warehousing and reporting.
If management elects to pursue this
route, examiners should review their
initial and ongoing due diligence
of the vendor to ensure it is in
accordance with published guidance
and safe and sound business practices.
Risk Rating System Developing an
effective, accurate, and timely
risk rating system is an important
tool for managing concentration
risk in the loan portfolio.
Risk ratings should be objective,
sensitive to changes in borrower and
or loan characteristics, and validated
via an independent review function.
For With loan participations, credit
unions should assess the loan utilizing
their own internal rating system.
In the absence of an internal rating
system, management should not rely
on the originating institution system
without completing timely, thorough, and
ongoing due diligence of that system.
Examiners should review management's
documentation of the original and
ongoing due diligence, ensuring
that it is consistent with safe
and sound business practices.
Reporting.
Management reporting must be periodic and
timely in a format that clearly indicates
changes in concentration risk and is
commensurate with the size, complexity,
and risk exposure of the credit union.
The report should not only measure
concentration risk against board
approved parameters, but should also
measure how the risks change over time.
For example, a key factor in
determining concentration risk in a
loan portfolio would be to measure
credit score migration by obtaining
updated credit scores on a periodic
basis and analyzing those borrowers
who have a declining credit score.
The frequency of reporting should
be commensurate with the type
and size of the concentration.
For example, larger portfolios should
have at least quarterly reporting.
How is concentration risk managed?
Implementing sound risk
management practices is the key
to managing concentration risk.
When credit unions have significant
concentrations on their balance
sheet, examiners need to ensure risk
management practices are commensurate
with the risk assumed relative to
net worth, and management clearly
identifies and measures the risk taken.
The ultimate responsibility for
setting the level of concentration
risk assumed by the credit union
rests with the board of directors.
For Senior Management is responsible for
maintaining concentration risk within the
parameters set by the Board of Directors.
Concentration risk has a substantial
influence on credit, strategic,
reputation, interest rate, and liquidity
risks as all are closely related.
All of these risks impact net
worth and must be supported by a
net worth level commensurate with
the risk in the balance sheet.
The Board of Directors and Senior
Management need to manage all of
these risk areas simultaneously.
One of the common flaws in managing
risks within a credit union is to
tie each risk independently to net
worth without monitoring the aggregate
exposure of different risks to net worth.
The result may be excessive
reliance on the level of net worth
to manage each individual risk.
Effective risk management practices
would not only include tying the limits
of each product or service to net worth,
but also consolidating the risks in
products and services and measuring the
totality of the risks against net worth.
Board Policy and
Concentration Risk Limits.
The Board of Directors must establish a
policy which addresses its philosophy on
concentration risk, limits commensurate
with net worth levels, and the rationale
as to how the limits fit into the overall
strategic plan of the credit union.
The board should use a global
perspective when developing this policy,
including identifying outside forces
such as economic or housing price
uncertainty, which will affect the
ability to manage concentration risk.
For example, the board should not
begin or expand a mortgage program
that allows high loan to values at
the height of a real estate bubble,
which will likely lead to significant
losses when the market declines.
The parameters set by the board should
be specific to each portfolio, and should
include limits on loan types, share types,
third party relationship exposure, etc.
The risk limits should correlate
to the overall growth objectives,
financial targets, and net worth plan.
The risk limits set forth in
the concentration risk policy
should be closely linked to those
codified in related policies,
including, but not limited to,
real estate loan, mortgage loan.
Member Business Loan, Loan
Participation, Asset Liability
Management, OM, and Investment Policies.
Concentrations that exceed 100
percent of net worth must be monitored
carefully and the Board of Directors
should document an adequate rationale
for undertaking that level of risk.
Third Party Oversight When working
with third parties, due diligence
is essential to ensure the risks
are properly identified and managed.
Examples of third party services
include purchase of participations
and loans, underwriting, processing,
and safekeeping member loans, and
purchase or safekeeping investments.
Numerous guidance letters have been
issued on this subject and are listed in
the References section of this letter.
The guidance discusses the need for due
diligence reviews to take into account the
nature of the service, length and depth
of expertise exhibited by the vendor,
staffing changes, economic and regulatory
changes, and risk mitigation strategies
associated with vendor oversight.
Also important to note is that due
diligence is an ongoing process.
It encompasses the original review
at the outset of product or service
implementation and should be updated
periodically to monitor changes
in the vendor's ability to deliver
products or services which meet
the credit union's expectations.
How is concentration risk
monitored and controlled?
Once the appropriate risk management
systems and policies are in place, it
is essential monitoring and oversight
become routine functions at the senior
management level within the credit union.
Ultimately, the Board of Directors
is responsible for oversight and
monitoring at a strategic level.
Regular formal reporting to the board
and senior management on compliance
with the concentration and risk
limits they establish is expected.
In addition, management should implement
appropriate internal controls, including
segregation of duties, to ensure
accurate reporting on concentration risk.
Compliance and oversight senior
management needs to implement
procedures and controls to effectively
adhere to and monitor compliance with
established policies and strategies.
Both the board and management must
periodically review information that
identifies and measures the level
and nature of concentration risk and
implement corrective action, should
the risk from any one area exceed
the board approved tolerance level.
Credit unions with large and complex
loan or investment programs should
establish a specific risk management
committee as a sound business practice.
The composition of the committee will
depend on the size and complexity
of the credit union, but should be
limited to a small number of senior
executives and one or more board members.
The agenda of this committee should
be limited to risk management issues,
specifically concentration risk,
credit risk, interest rate risk.
From a reporting perspective, management
should demonstrate compliance with
every board established policy limit
dealing with concentration risk, as well
as limits on associated risks such as
credit, interest rate, and liquidity.
Scenario and Sensitivity Analysis
Credit unions should routinely perform
portfolio level scenario and sensitivity
tests to quantify the impact of
changing economic conditions on asset
quality, earnings, and net worth.
In general, scenario analysis uses
the model to predict a possible
future outcome given an event or a
series of events, while sensitivity
analysis tests a model's parameters
without relating those changes to an
underlying event or real world outcome.
The outcome of sensitivity analysis
is to determine which assumptions have
the most impact on the model's results.
Credit unions should consider the
susceptibility of portfolio segments
with common risk characteristics
to changing market conditions.
Examples of common risk characteristics
can be by loan type, investment type,
collateral type, geographic area,
individual or associational groups
of borrowers, business lines, etc.
An example scenario analysis for a
concentration in HELOC mortgages would
be the risk to earnings if unemployment
in the area doubled while house market
values declined by 25%, combined
with the effect of interest rate
resets and associated payment shock.
In example scenario analysis for a
concentration in 30 year, fixed rate
mortgages would be the risk to earnings
and capital from liquidity and interest
rate risks in a rising rate environment,
where liquidity risk increases as
mortgage cash flows decrease, and rising
interest rate risk causes earnings
to deteriorate as members seek higher
dividend rates to maintain their deposits.
The analysis should be multifaceted
to explore the effect of single
and multiple simultaneous
negative events on the portfolio.
The sophistication of scenario
and sensitivity analyzes should
be consistent with the size,
complexity, and risk characteristics
of the portfolio as a whole.
Basel Committee on Banking Supervision,
Principles for Sound Stress Testing
Practices and Supervision, May 2009.
What are basic review procedures for
examiners related to concentration risk?
The following are some basic review steps
and questions examiners should ask when
conducting a review of concentration risk.
Examiner expectations for the depth
and sophistication of the responses
from credit union management should
increase if the initial review
of a credit union's balance sheet
reveals potentially high exposure.
Does the credit union have policies
directly related to identifying,
measuring, monitoring, and
controlling concentration risk?
Examiners should ensure credit
unions consider the following when
evaluating the board policies.
The level and nature of inherent risk on
the balance sheet, management expertise,
risk management practices, market
conditions, and adequacy of reserves
allocated for concentration risk.
Has the credit union developed
appropriate policies and procedures,
including establishing acceptable risk
limits for each product and service
on an individual and aggregate basis?
Has management assessed the adequacy
of net worth based on the aggregate
potential exposure to all forms of
concentration risk, while also considering
the potential credit, interest rate,
and liquidity risk impact on net worth?
Has the credit union considered the
various types of concentrations and
their interrelationship, particularly
between asset classes or common products
and service characteristics, which may
present higher risk when aggregated?
Has the credit union considered the event
risks that may expose them to financial
loss for each asset class, quantified the
risk, and established appropriate risk
tolerance limits based on the probability
and potential impact from each event?
Do the board and senior management receive
regular reports on the individual and
aggregate exposure to concentration risk?
Does management have predetermined actions
to take when risk limits are reached?
Do they take the appropriate action?
A material red flag is a credit union
that simply raises the established
limit when it is reached without
advanced analysis supporting the
rationale for the change in policy.
Is the credit union system of
identifying, measuring, monitoring,
and controlling concentration risk
commensurate with the level of
potential concentration risk exposure?
When credit unions have significant
loan concentrations, does
management maintain reports and
perform analysis of the following?
Origination and portfolio trends
by product, loan structure,
originator channel, credit score,
LTV, debt to income ratio DTI,
lien position, documentation type.
Property type, appraiser, appraised
value, and appraisal date.
Delinquency and lost distribution
trends by product and originator
channel with accompanying analysis of
significant underwriting characteristics
such as credit score, LTV, and DTI.
Vintage Tracking 3IE Static Pool Analysis.
The performance of third party brokers,
auto dealers, and correspondents
originated loans and market trends by
geographic area and property type to
identify areas of rapidly appreciating
or depreciating housing values.
What options are available when
a credit union or the examiner
identifies elevated concentration risk?
The Board of Directors and management
should have triggers and action plans
in writing for any material risk area.
If the credit union's monitoring
activities identify concerns with
a concentration, the Board of
Directors must respond accordingly.
Similarly, if an examiner believes
there may be elevated concentration risk
issues present in a credit union, and
management has not properly quantified
and mitigated the risk, they should
require corrective actions of management
that include, but are not limited to.
Expanding the review of the risk
environment for the particular sectors.
Performing elevated scenario
and sensitivity analyzes.
Expanding the review of
performance of existing borrowers.
Reviewing growth and limitations for
new business lines and or reviewing
risk mitigation options and time frames
for reduction of risk if necessary.
Risk Alert 05 Risk 01 specialized
lending activities third party indirect
lending and participations and the
accompanying supplemental guidance white
paper on static pool analysis discusses
how such analysis can be used to track
the performance of most loan pools.
This guidance can be applied to all
non traditional products or other loan
products, not just indirect lending.
If management determines concentration
risk is elevated, they should
implement steps to mitigate the risk.
If management does not properly
assess or control the level of
risk, examiners should require
corrective actions to mitigate the
risks, including but not limited to.
Reducing limits or thresholds
on risk concentrations.
Reducing exposure to new business
lines to address undue concentrations.
Transferring risk to other parties
by either selling directly or as
part of securitization transactions.
And or ceasing the
product or service line.
Conclusion excessive concentration
risk can severely impact the
financial condition of a credit union.
High concentrations in areas
experiencing severe economic distress
could result in significant losses
exceeding a credit union's net worth.
It is the fiduciary responsibility
of management and officials of credit
unions to identify, manage, monitor,
and control the risks facing the credit
union, including concentration risk.
Examiners need to ascertain whether
the Board of Directors and management
understand and actively manage this risk.
Credit union management should know
what their concentration risk is and
be able to demonstrate appropriate
risk management and mitigation
practices to minimize the risk of
significant financial condition decline.
This concludes the
concentration risk letter.
If your credit union could use assistance
with your exam, reach out to Mark
Treichel on LinkedIn or at marktreichel.
com.
This is Samantha Shares and
I thank you for listening.
