NCUA's Concentration Risk Expectations for Credit Unions

Hello, this is Samantha Shares.

This episode covers NCUA's letter to
credit unions on concentration risk.

Many credit unions are receiving
documents of resolution on

concentration risk and told to comply
with the guidance in this letter.

The following is an audio
version of that letter.

But first, this podcast is
educational and is not legal advice.

We are sponsored by Credit Union
Exam Solutions, Inc., whose team has

over 240 years of national credit
union administration experience.

We assist our clients with NCUA
so they save time and money.

If you are worried about a recent,
upcoming, or in process NCUA

examination, reach out to learn how
they can assist at marktreichel.

com.

Also, check out our other podcast called
With Flying Colors, where we provide

tips on how to achieve success with NCUA.

And now, the letter.

Concentration risk.

Credit union officials and management
have a fiduciary responsibility

to identify, measure, monitor,
and control concentration risk.

Concentration risk must be managed
in conjunction with credit.

Interest Rate and Liquidity Risks,
as a negative event in any category

may have significant consequences
on the other areas, as well as

strategic and reputation risks.

Concentration risk has increased
in importance during the

recent economic recession.

Poor risk management of residential and
commercial mortgage loan concentrations,

in particular, is having an adverse
effect on credit unions nationwide,

resulting in significant loan losses,
earnings deterioration, capital depletion,

and increased credit union failures.

Most of the recent large losses
to the National Credit Union Share

Insurance Fund in CUSIF are due to
poor management of large concentrations

in various asset classes in relation
to the asset size and net worth

level of the failed institutions.

What is concentration risk?

A risk concentration is any single
exposure or group of exposures with

the potential to produce losses large
enough relative to capital, total

assets, or overall risk level to threaten
a financial institution's health or

ability to maintain its core operations.

Avoiding concentrating too much in any
single product or service is a core tenet

of effective risk management and when
violated increases the risk of loss to

the credit union and to the incusive.

Too much reliance on any single product
or service increases the potential for

adverse consequences from event risk, i.

e.

a negative event, such as a housing market
crash, that significantly affects the

financial condition of the institution.

Every asset, liability, product, service,
and third party provider presents

a risk of loss to the credit union
under varying conditions or events.

Some risks are less likely
than others to occur.

It is up to credit union management
to identify the risk in each product

or service line, quantify the risk,
and set appropriate concentration

limits based on the analysis.

What are some types of concentration risk?

Concentration risk is present in many
forms across credit union operations.

Examples include asset classes, e.

g.

residential real estate loans, member
business loans, automobile loans,

loan participations, or investments,
concentrations within a class of assets.

Examples include, but are not limited
to, O residential real estate loans

collateral type, lien position,
geographic area, non traditional terms

such as interest only, payment option,
or balloon payment, fixed or variable

interest rate, low or reduced underwriting
documentation, and loan to value LTV.

O member business loans,
MBLS types of loans, e.

g.

Real estate, working capital, and credit
cards, collateral type, payment features

such as interest only, balloon payments,
loan term, geographic area, and LTV.

Loan participation types of loans e.

g.

residential real estate, MBL, and
automobile, and the subclasses

associated with the types, originating
lender, and geographic area.

O loans to one borrower or associated
group of borrowers may include several

different types of loans residential real
estate, MBLS, consumer loans, et cetera.

Oh, investments, types of investments, e.

g.

treasury securities, certificates
of deposit and mortgage backed

securities, collateral type interest
rates, issue a public or private trans

priority and broker liabilities, e.

g.

rate sensitive share deposits or callable
borrowings, third party providers, e.

g.

PUSOs, indirect loan partners
or mortgage brokerage firms.

Services provided to other parties, e.

g., loan underwriting and or
servicing, insurance services,

and investment consultation.

When reviewing the types of
concentrations in a credit union,

examiners must be cognizant of other
asset categories that may seem unrelated.

For instance, the types of loans
and characteristics of the loans

may be one form of concentration
risk that is easily identified.

However, similar characteristics
may exist in a loan participation

portfolio or an investment portfolio.

A clear example of this concept would
be a credit union that holds a portfolio

of real estate loans and also a
portfolio of mortgage backed securities.

There are common event risks in
these types of assets that must be

quantified and mitigated by management.

What are the largest exposures, risk
concentrations in credit unions?

Concentration in credit portfolios is
considered to be the most significant

source of risk to financial institutions.

Trends in credit union balance
sheets reflect increased exposure to

concentration risk in areas of their
credit portfolios, such as real estate

loans fixed rates as of December 31,
2009, Real estate loans held by credit

unions comprise 54 percent of total loans.

Of the 217 billion in first
mortgage loans, over 60

percent have fixed rate terms.

In addition, fixed rate first
mortgage loans have increased

by 55 percent since 2005.

Member business loans
as of December 31, 2009.

Member business loans totaled 35 billion.

Credit unions grew their member business
loan portfolios by 98 percent in 2009.

Loan participations as of December
31, 2009, credit union participations

outstanding totaled 24 billion, and
participation lending increased by 11.

6 percent in 2009.

Construction and development
C& D loans, as of December 31,

2009, credit unions owned 2.

4 billion in commercial
and residential C& D loans.

While this trend has declined since
2007, the real estate market downturn

could continue to have an adverse effect
on credit unions with concentrations

of C& D loans in their portfolio.

Investments in mortgage related
securities, as of December 31, 2009,

Credit union investments in mortgage
related securities totaled 58.

7 billion, which is in addition to the
real estate loan exposure stated above.

Investments in mortgage related securities
have more than doubled since 2005.

How is concentration risk
identified and measured?

Each product or service carries
some risk of financial exposure

or loss for the credit union.

Management needs to perform a
risk assessment which demonstrates

their understanding of the
risk of the product or service.

Quantifies the potential loss exposure
and documents a rational business

decision on the acceptable concentration
level based on the analysis.

The larger the concentration level, the
more robust and advanced the analysis

and risk management techniques should be.

For instance, the sophistication and
depth of risk management systems and

analysis conducted on a real estate
portfolio that represents 20 percent

of total loans could be acceptably
less than a real estate portfolio that

represents 50 percent of total loans.

Another example is the level
of due diligence conducted on

a third party service provider.

The more important the service to the
core operation of the credit union and

the higher the amount of activity and
dollar volume of credit union activity, it

handles the more sophisticated and robust
the due diligence oversight needs to be.

Similar to the depth and sophistication
of the initial review, management must

increase the intensity and depth of
ongoing monitoring and review of products

and services with high concentrations.

To measure and monitor concentration risk,
credit unions must start with the systems

used to store and analyze their data.

For more complex products, establishing
comprehensive data warehousing

will allow management to track
changes in the quality of their

various lines of business over time.

Without an all inclusive process to
maintain and analyze data, the Board

of Directors and Senior Management
will not have the tools necessary

to make strategic and operational
decisions in a safe and sound manner.

Maintaining Comprehensive and
Accurate Data Credit union management

must emphasize the importance
of maintaining comprehensive and

accurate data for each risk area.

This includes a quality control
function to ensure that data entry

and changes are accurate and timely.

The credit union should have a
data processing system capable of

warehousing data on various lines of
business commensurate with its size

and complexity to properly identify
and measure concentration risk.

For example, this would include
maintaining information relevant to

the loan portfolio, such as loan type,
interest rate, interest rate reset

dates, if applicable, payment amount,
Payments shock the potential increase

in payment from an interest rate reset
or conversion from interest only to

principal and interest payments credit
score including original and updated

periodically, collateral description,
and collateral value including

original and updated periodically.

Another example would include
maintaining information relevant to

the investment portfolio, such as type,
interest rate, collateral information,

market value original and updated
periodically, and external rating

original and updated periodically.

This is not an all inclusive list, But
rather a starting point for evaluating

if the data processing system is capable
of maintaining this type of data.

If the credit union does not have the
data processing capability, management

should contract with a third party to
provide data warehousing and reporting.

If management elects to pursue this
route, examiners should review their

initial and ongoing due diligence
of the vendor to ensure it is in

accordance with published guidance
and safe and sound business practices.

Risk Rating System Developing an
effective, accurate, and timely

risk rating system is an important
tool for managing concentration

risk in the loan portfolio.

Risk ratings should be objective,
sensitive to changes in borrower and

or loan characteristics, and validated
via an independent review function.

For With loan participations, credit
unions should assess the loan utilizing

their own internal rating system.

In the absence of an internal rating
system, management should not rely

on the originating institution system
without completing timely, thorough, and

ongoing due diligence of that system.

Examiners should review management's
documentation of the original and

ongoing due diligence, ensuring
that it is consistent with safe

and sound business practices.

Reporting.

Management reporting must be periodic and
timely in a format that clearly indicates

changes in concentration risk and is
commensurate with the size, complexity,

and risk exposure of the credit union.

The report should not only measure
concentration risk against board

approved parameters, but should also
measure how the risks change over time.

For example, a key factor in
determining concentration risk in a

loan portfolio would be to measure
credit score migration by obtaining

updated credit scores on a periodic
basis and analyzing those borrowers

who have a declining credit score.

The frequency of reporting should
be commensurate with the type

and size of the concentration.

For example, larger portfolios should
have at least quarterly reporting.

How is concentration risk managed?

Implementing sound risk
management practices is the key

to managing concentration risk.

When credit unions have significant
concentrations on their balance

sheet, examiners need to ensure risk
management practices are commensurate

with the risk assumed relative to
net worth, and management clearly

identifies and measures the risk taken.

The ultimate responsibility for
setting the level of concentration

risk assumed by the credit union
rests with the board of directors.

For Senior Management is responsible for
maintaining concentration risk within the

parameters set by the Board of Directors.

Concentration risk has a substantial
influence on credit, strategic,

reputation, interest rate, and liquidity
risks as all are closely related.

All of these risks impact net
worth and must be supported by a

net worth level commensurate with
the risk in the balance sheet.

The Board of Directors and Senior
Management need to manage all of

these risk areas simultaneously.

One of the common flaws in managing
risks within a credit union is to

tie each risk independently to net
worth without monitoring the aggregate

exposure of different risks to net worth.

The result may be excessive
reliance on the level of net worth

to manage each individual risk.

Effective risk management practices
would not only include tying the limits

of each product or service to net worth,
but also consolidating the risks in

products and services and measuring the
totality of the risks against net worth.

Board Policy and
Concentration Risk Limits.

The Board of Directors must establish a
policy which addresses its philosophy on

concentration risk, limits commensurate
with net worth levels, and the rationale

as to how the limits fit into the overall
strategic plan of the credit union.

The board should use a global
perspective when developing this policy,

including identifying outside forces
such as economic or housing price

uncertainty, which will affect the
ability to manage concentration risk.

For example, the board should not
begin or expand a mortgage program

that allows high loan to values at
the height of a real estate bubble,

which will likely lead to significant
losses when the market declines.

The parameters set by the board should
be specific to each portfolio, and should

include limits on loan types, share types,
third party relationship exposure, etc.

The risk limits should correlate
to the overall growth objectives,

financial targets, and net worth plan.

The risk limits set forth in
the concentration risk policy

should be closely linked to those
codified in related policies,

including, but not limited to,
real estate loan, mortgage loan.

Member Business Loan, Loan
Participation, Asset Liability

Management, OM, and Investment Policies.

Concentrations that exceed 100
percent of net worth must be monitored

carefully and the Board of Directors
should document an adequate rationale

for undertaking that level of risk.

Third Party Oversight When working
with third parties, due diligence

is essential to ensure the risks
are properly identified and managed.

Examples of third party services
include purchase of participations

and loans, underwriting, processing,
and safekeeping member loans, and

purchase or safekeeping investments.

Numerous guidance letters have been
issued on this subject and are listed in

the References section of this letter.

The guidance discusses the need for due
diligence reviews to take into account the

nature of the service, length and depth
of expertise exhibited by the vendor,

staffing changes, economic and regulatory
changes, and risk mitigation strategies

associated with vendor oversight.

Also important to note is that due
diligence is an ongoing process.

It encompasses the original review
at the outset of product or service

implementation and should be updated
periodically to monitor changes

in the vendor's ability to deliver
products or services which meet

the credit union's expectations.

How is concentration risk
monitored and controlled?

Once the appropriate risk management
systems and policies are in place, it

is essential monitoring and oversight
become routine functions at the senior

management level within the credit union.

Ultimately, the Board of Directors
is responsible for oversight and

monitoring at a strategic level.

Regular formal reporting to the board
and senior management on compliance

with the concentration and risk
limits they establish is expected.

In addition, management should implement
appropriate internal controls, including

segregation of duties, to ensure
accurate reporting on concentration risk.

Compliance and oversight senior
management needs to implement

procedures and controls to effectively
adhere to and monitor compliance with

established policies and strategies.

Both the board and management must
periodically review information that

identifies and measures the level
and nature of concentration risk and

implement corrective action, should
the risk from any one area exceed

the board approved tolerance level.

Credit unions with large and complex
loan or investment programs should

establish a specific risk management
committee as a sound business practice.

The composition of the committee will
depend on the size and complexity

of the credit union, but should be
limited to a small number of senior

executives and one or more board members.

The agenda of this committee should
be limited to risk management issues,

specifically concentration risk,
credit risk, interest rate risk.

From a reporting perspective, management
should demonstrate compliance with

every board established policy limit
dealing with concentration risk, as well

as limits on associated risks such as
credit, interest rate, and liquidity.

Scenario and Sensitivity Analysis
Credit unions should routinely perform

portfolio level scenario and sensitivity
tests to quantify the impact of

changing economic conditions on asset
quality, earnings, and net worth.

In general, scenario analysis uses
the model to predict a possible

future outcome given an event or a
series of events, while sensitivity

analysis tests a model's parameters
without relating those changes to an

underlying event or real world outcome.

The outcome of sensitivity analysis
is to determine which assumptions have

the most impact on the model's results.

Credit unions should consider the
susceptibility of portfolio segments

with common risk characteristics
to changing market conditions.

Examples of common risk characteristics
can be by loan type, investment type,

collateral type, geographic area,
individual or associational groups

of borrowers, business lines, etc.

An example scenario analysis for a
concentration in HELOC mortgages would

be the risk to earnings if unemployment
in the area doubled while house market

values declined by 25%, combined
with the effect of interest rate

resets and associated payment shock.

In example scenario analysis for a
concentration in 30 year, fixed rate

mortgages would be the risk to earnings
and capital from liquidity and interest

rate risks in a rising rate environment,
where liquidity risk increases as

mortgage cash flows decrease, and rising
interest rate risk causes earnings

to deteriorate as members seek higher
dividend rates to maintain their deposits.

The analysis should be multifaceted
to explore the effect of single

and multiple simultaneous
negative events on the portfolio.

The sophistication of scenario
and sensitivity analyzes should

be consistent with the size,
complexity, and risk characteristics

of the portfolio as a whole.

Basel Committee on Banking Supervision,
Principles for Sound Stress Testing

Practices and Supervision, May 2009.

What are basic review procedures for
examiners related to concentration risk?

The following are some basic review steps
and questions examiners should ask when

conducting a review of concentration risk.

Examiner expectations for the depth
and sophistication of the responses

from credit union management should
increase if the initial review

of a credit union's balance sheet
reveals potentially high exposure.

Does the credit union have policies
directly related to identifying,

measuring, monitoring, and
controlling concentration risk?

Examiners should ensure credit
unions consider the following when

evaluating the board policies.

The level and nature of inherent risk on
the balance sheet, management expertise,

risk management practices, market
conditions, and adequacy of reserves

allocated for concentration risk.

Has the credit union developed
appropriate policies and procedures,

including establishing acceptable risk
limits for each product and service

on an individual and aggregate basis?

Has management assessed the adequacy
of net worth based on the aggregate

potential exposure to all forms of
concentration risk, while also considering

the potential credit, interest rate,
and liquidity risk impact on net worth?

Has the credit union considered the
various types of concentrations and

their interrelationship, particularly
between asset classes or common products

and service characteristics, which may
present higher risk when aggregated?

Has the credit union considered the event
risks that may expose them to financial

loss for each asset class, quantified the
risk, and established appropriate risk

tolerance limits based on the probability
and potential impact from each event?

Do the board and senior management receive
regular reports on the individual and

aggregate exposure to concentration risk?

Does management have predetermined actions
to take when risk limits are reached?

Do they take the appropriate action?

A material red flag is a credit union
that simply raises the established

limit when it is reached without
advanced analysis supporting the

rationale for the change in policy.

Is the credit union system of
identifying, measuring, monitoring,

and controlling concentration risk
commensurate with the level of

potential concentration risk exposure?

When credit unions have significant
loan concentrations, does

management maintain reports and
perform analysis of the following?

Origination and portfolio trends
by product, loan structure,

originator channel, credit score,
LTV, debt to income ratio DTI,

lien position, documentation type.

Property type, appraiser, appraised
value, and appraisal date.

Delinquency and lost distribution
trends by product and originator

channel with accompanying analysis of
significant underwriting characteristics

such as credit score, LTV, and DTI.

Vintage Tracking 3IE Static Pool Analysis.

The performance of third party brokers,
auto dealers, and correspondents

originated loans and market trends by
geographic area and property type to

identify areas of rapidly appreciating
or depreciating housing values.

What options are available when
a credit union or the examiner

identifies elevated concentration risk?

The Board of Directors and management
should have triggers and action plans

in writing for any material risk area.

If the credit union's monitoring
activities identify concerns with

a concentration, the Board of
Directors must respond accordingly.

Similarly, if an examiner believes
there may be elevated concentration risk

issues present in a credit union, and
management has not properly quantified

and mitigated the risk, they should
require corrective actions of management

that include, but are not limited to.

Expanding the review of the risk
environment for the particular sectors.

Performing elevated scenario
and sensitivity analyzes.

Expanding the review of
performance of existing borrowers.

Reviewing growth and limitations for
new business lines and or reviewing

risk mitigation options and time frames
for reduction of risk if necessary.

Risk Alert 05 Risk 01 specialized
lending activities third party indirect

lending and participations and the
accompanying supplemental guidance white

paper on static pool analysis discusses
how such analysis can be used to track

the performance of most loan pools.

This guidance can be applied to all
non traditional products or other loan

products, not just indirect lending.

If management determines concentration
risk is elevated, they should

implement steps to mitigate the risk.

If management does not properly
assess or control the level of

risk, examiners should require
corrective actions to mitigate the

risks, including but not limited to.

Reducing limits or thresholds
on risk concentrations.

Reducing exposure to new business
lines to address undue concentrations.

Transferring risk to other parties
by either selling directly or as

part of securitization transactions.

And or ceasing the
product or service line.

Conclusion excessive concentration
risk can severely impact the

financial condition of a credit union.

High concentrations in areas
experiencing severe economic distress

could result in significant losses
exceeding a credit union's net worth.

It is the fiduciary responsibility
of management and officials of credit

unions to identify, manage, monitor,
and control the risks facing the credit

union, including concentration risk.

Examiners need to ascertain whether
the Board of Directors and management

understand and actively manage this risk.

Credit union management should know
what their concentration risk is and

be able to demonstrate appropriate
risk management and mitigation

practices to minimize the risk of
significant financial condition decline.

This concludes the
concentration risk letter.

If your credit union could use assistance
with your exam, reach out to Mark

Treichel on LinkedIn or at marktreichel.

com.

This is Samantha Shares and
I thank you for listening.

NCUA's Concentration Risk Expectations for Credit Unions
Broadcast by