Credit Union Regulatory Guidance Including: NCUA, CFPB, FDIC, OCC, FFIEC

Samantha: Hello, this is Samantha Shares.

This episode covers N C U A’s
proposed rule to eliminate reputation

risk from its supervisory program.

The following is an audio
version of that proposal.

This podcast is educational
and is not legal advice.

We are sponsored by Credit Union
Exam Solutions Incorporated, whose

team has over two hundred and
forty years of National Credit

Union Administration experience.

We assist our clients with N C
U A so they save time and money.

If you are worried about a recent,
upcoming or in process N C U A

examination, reach out to learn how they
can assist at Mark Treichel DOT COM.

Also check out our other podcast called
With Flying Colors where we provide tips

on how to achieve success with N C U A.

And now the proposal.

Summary

The National Credit Union Administration
Board (Board) is issuing a notice

of proposed rulemaking to codify
the elimination of reputation

risk from its supervisory program.

Among other things, the proposed
rule would prohibit the agency from

criticizing or taking adverse action
against an institution, defined as an

entity for which the N C U A makes or
will make supervisory determinations

or other decisions, either solely or
jointly on the basis of reputation risk.

The proposed rule would also prohibit
the agency from requiring, instructing,

or encouraging an institution to close
an account, to refrain from providing an

account, product, or service, or to modify
or terminate any product or service on the

basis of a person or entity’s political,
social, cultural, or religious views

or beliefs, constitutionally protected
speech, or on the basis of politically

disfavored but lawful business activities
perceived to present reputation risk.

Supplementary Information

I.

Background and Policy Objectives

Citing reputation risk as a basis for
supervisory criticisms can lead to

inconsistency and subjectivity in the
examination and supervision process,

without adding material value from
a safety and soundness perspective.

To improve the efficiency and
effectiveness of the examination

and supervision program, the N C U A
has removed reputation risk from its

supervisory framework and is proposing
to codify this change through regulation.

These actions align with the requirements
in Executive Order 14331, Guaranteeing

Fair Banking for All Americans, that
notes the use of reputation risk can be

a pretext for restricting law-abiding
individuals’ and businesses’ access

to financial services on the basis
of political or religious beliefs or

disfavored but lawful business activities.

Because assessing reputation risk is
subjective, it can lead to confusion

and is time-consuming to measure for
both examiners and credit unions.

Reputation risk is ambiguous and
lacks measurable criteria, which

leaves it too open to interpretation.

Therefore, the agency’s supervision
for reputation risk could reflect

individual perspectives rather
than data-driven conclusions.

Given the difficulty of measuring
reputation risk or quantifying its impact,

if any, in an accurate and precise way,
it is inappropriate for the agency to

examine credit unions for this risk.

While it is important for a credit union
to operate in a manner that member-owners

view as favorable, credit union management
is generally in the best position to

identify the business decisions that will
positively influence the membership’s

perception or opinion of the credit union.

Examiners are not equipped and should
not be expected to gauge public

opinion or quantify the impact of
member perception on a credit union’s

financial and operational condition.

The highly subjective nature
of these determinations creates

unpredictability and inconsistency
for regulated entities and introduces

the potential for political or other
biases into the supervisory process.

This could result in examiners
implicitly or explicitly encouraging or

discouraging credit unions to restrict
access to credit union services on the

basis of examiners’ personal views of
a group’s or individual’s political,

social, cultural, or religious views
or beliefs, constitutionally protected

speech, or politically disfavored
but lawful business activities.

If a credit union alters its
behavior to comply with supervisory

expectations relating to reputation
risk management, such as by closing an

account or choosing not to enter into
or continue a business relationship

with a member or accountholder that
it would otherwise maintain, it is

forgoing an opportunity to maintain or
build a productive relationship within

its authorized field of membership
that may otherwise be consistent

with sound risk management practice.

Even though reputation risk has been
assessed as part of N C U A’s examination

and supervision program for decades,
the agency has not seen evidence of

reputation risk being a primary driver
of unsafe or unsound conditions, or

posing a material risk to the National
Credit Union Share Insurance Fund.

From a safety and soundness perspective,
most activities that could negatively

impact a credit union’s reputation do
so through traditional risk channels

such as credit risk and liquidity risk.

These core financial and operational risk
areas are more concrete and measurable and

allow examiners to more objectively assess
a credit union’s safety and soundness.

In addition to not enhancing safety
and soundness, focusing on reputation

risk can distract credit unions and
the agency from devoting resources

to managing core financial and
operational risks that are quantifiable

and have been shown to present
significant threats to credit unions.

In the judgment of the agency, examining
for reputation risk diverts resources that

could be better spent on other risks that
have been shown to present significant,

tangible threats to institutions and
that are more easily quantified and

addressed through regulatory intervention.

The N C U A is responsible for the
supervision and examination of all

federally insured credit unions, including
for safety and soundness principles.

In furtherance of these objectives,
the agency’s supervision should

focus on concrete risks and more
objective criteria directly related

to applicable statutory requirements.

In the agency’s experience, using
reputation risk in its supervisory

process does not further this mission.

II.

Legal Authority

Under the Federal Credit Union Act (F
C U Act), the N C U A examines all F I

C Us and is required to ensure that all
F I C Us operate safely and soundly.

In particular, 12 U.S.C.

1786(b) compels the agency to
act to correct unsafe or unsound

conditions or practices in F I C Us.

Further, under the F C U Act,
the N C U A is the chartering and

supervisory authority for federal
credit unions and the federal

supervisory authority for F I C Us.

The F C U Act grants the N C U A a
broad mandate to issue regulations

governing both F C Us and F I C Us.

Section 120 of the F C U Act is a
general grant of regulatory authority,

and it authorizes the Board to
prescribe rules and regulations for

the administration of the F C U Act.

Section 207 of the F C U Act is
a specific grant of authority

over share insurance coverage,
conservatorships, and liquidations.

Section 209 of the F C U Act is a plenary
grant of regulatory authority to the

N C U A to issue rules and regulations
necessary or appropriate to carry out its

role as share insurer for all F I C Us.

Accordingly, the F C U Act grants the
Board broad rulemaking authority to ensure

the credit union industry and the Share
Insurance Fund remain safe and sound.

Also, the N C U A has statutory
authority to determine whether F I

C Us are operated in an unsafe or
unsound manner and terminate a F I

C U’s insurance if a F I C U is not
operated in a safe or sound manner.

Finally, the Board has the authority
to adopt such rules as it sees fit for

the transaction of its business, which
includes oversight of the N C U A’s

supervisory and examination programs.

III.

Description of the
Proposed Rule and Changes

Based on the legal authorities set forth
previously, the subjectivity of reputation

risk, the limited value of reputational
risk at identifying risks to safety and

soundness or other statutory mandates,
and the potential for distracting

examiners and institutions from
examining or managing core financial and

operational risks, the agency has removed
reputation risk from its supervisory

framework and is proposing to codify
this change in N C U A’s regulations.

This proposed rule would be a
regulation as defined in section

5 of Executive Order 14192.

The proposed rule would be a
significant regulatory action for the

purposes of Executive Order 12866.

The proposed elimination of reputation
risk supervision is deregulatory.

The proposed rule would not alter or
affect the ability of an institution

to make business decisions regarding
its members, accountholders, or

third-party arrangements and to
manage them effectively, consistent

with safety and soundness and
compliance with applicable laws.

The proposed rule would prohibit the
agency from criticizing, formally or

informally, rewarding, using in its
decision-making process, or taking any

adverse action against institutions
on the basis of reputation risk.

The agency would be prohibited from
requiring, instructing, or encouraging an

institution or its employees, to refrain
from contracting with or to terminate

or modify a contract with a third party,
including an institution-affiliated

party, on the basis of reputation risk.

The agency also could not require,
instruct, or encourage an institution

or its employees to refrain from doing
business with or to terminate or modify

a business relationship with a third
party, including an institution-affiliated

party, on the basis of reputation risk.

The proposed rule would also prevent
the agency from requiring, instructing,

or encouraging an institution or its
employees to enter into a contract

or business relationship with a third
party on the basis of reputation risk.

The proposed rule would further prohibit
the agency from requiring, instructing,

or encouraging an institution or its
employees to terminate a contract with,

discontinue doing business with, or
modify the terms under which it will

do business with a person or entity on
the basis of the person’s or entity’s

political, social, cultural, or religious
views or beliefs, constitutionally

protected speech, or on the basis of the
third party’s involvement in politically

disfavored but lawful business activities
perceived to present reputation risk.

The proposed rule would also prevent
the agency from requiring, instructing,

or encouraging an institution or its
employees to engage in or refrain from

acquiring or terminating a relationship
with any person or entity within

the credit union’s authorized field
of membership, or person or entity

the credit union or institution is
otherwise lawfully permitted to serve,

on the basis of reputation risk.

This prohibition would not affect
member service requirements and

limitations related to a credit
union’s field of membership.

Similarly, this prohibition would
not affect requirements intended to

prohibit or reject transactions or
accounts associated with Office of

Foreign Assets Control-sanctioned
persons, entities, or jurisdictions.

Such prohibitions and rejections would
not be based on the person’s or entity’s

political, social, cultural, or religious
views or beliefs, constitutionally

protected speech, or politically
disfavored but lawful business activities

perceived to present reputation risk.

The prohibition also does not affect
the agency’s authority to enforce

the requirements of the provisions of
United States Code title 31, chapter

53, subchapter II regarding reporting
on monetary transactions, field of

membership requirements under the F
C U Act, administration of Community

Development Revolving Loan Fund
activities, or any other application

decision where federal law mandates
the N C U A to consider criteria such

as character and fitness or integrity.

“Adverse action,” as defined by the
proposed rule, would include the provision

of negative feedback, including written
feedback in a report of examination,

a document of resolution, oral
feedback, or an enforcement action.

This definition would only apply to
N C U A-initiated adverse actions.

N C U A will often jointly examine
federally insured, state-chartered credit

unions along with the state regulator.

In these instances, the state
regulator generally will take

the lead in issuing the report of
examination and any corrective action.

If the state regulator elects to examine
for reputation risk, N C U A examiners

will not participate in these discussions
or enforce any resulting supervisory

actions taken by the state regulator.

Furthermore, adverse action encompasses
any N C U A-led action of any agency

employee, including any communication
characterized as informal or preliminary.

A downgrade (or contribution to a
downgrade) of any supervisory rating,

including a rating assigned under
N C U A’s CAMELS ratings system

also would constitute an “adverse
action” under the proposed rule.

Further, an approval or denial of
a filing, or an imposition of a

discretionary supervisory action
under prompt corrective action, on

the basis of “reputation risk” would
constitute an “adverse action” under

the proposed rule, except where
federal law requires consideration

of reputation-related criteria.

This includes any burdensome requirements
placed on an approval, the introduction

of additional approval requirements,
or any other heightened requirements

or emphasis on an activity or change.

The agency is also including a
general “catch-all” for any other

actions, including approval or denial
of applications, waivers, and other

agency actions or decisions for any
party, that could impact the party.

This catch-all is meant to include
actions such as decisions on applications

for waivers, applications to engage
in certain business activities

for which supervisory permission
is required, or other regulatory

decisions affecting institutions.

The agency believes that most actions
would be covered under the other

definitions outlined in the regulation
but has included this additional

“catch-all” to account for any
circumstances that may not be apparent

or may become applicable as regulatory
and supervisory standards change.

Additionally, actions subject to this
prohibition would include feedback

that is oral, a condition attached
to an approval, the introduction of

new approval requirements, and any
other heightened requirements that

are intended to force the institution
to address perceived reputation risk.

The term “doing business with” in
the proposed rule is intended to be

construed broadly and to include both
business relationships with credit

union members, accountholders, and
with third-party service providers.

It is also intended to include the
relationship of an institution with

organizations or individuals that
the institution is providing with

charitable donations or services.

This term is intended to include
both existing business relationships

and prospective business relations.

The term “institution-affiliated party”
has the same meaning as in 12 U.S.C.

1786(r).

The proposed rule would define “reputation
risk” as the risk, regardless of how

the risk is labeled by the institution
or by the agency, that an action or

activity, or combination of actions
or activities, or lack of actions or

activities, of an institution could
negatively impact public perception of

the institution for reasons unrelated
to the current or future financial and

operational condition of the institution.

This definition is intended to include
not just risks that the agency or the

institution identify as “reputation
risks,” but any similar risk based

around concerns regarding the public’s
perception of the institution beyond

the scope of other risks in the
agency’s supervisory frameworks.

This definition is not intended to
capture risks posed by public perceptions

of the institution’s current or future
financial or operational condition

because such perceptions relate to
risks other than reputation risk.

For example, public perceptions
that an institution has insufficient

liquidity and therefore is
susceptible to a run on shares would

not be considered reputation risk.

The prohibitions of the proposed rule
would apply to actions taken on the basis

of reputation risk; political, social,
cultural, or religious views and beliefs;

constitutionally protected speech;
or based on bias against politically

disfavored but lawful business activities
perceived to present reputation risk.

The proposed rule would not prohibit
criticism, supervisory feedback, or

other actions to address traditional
risk channels related to safety and

soundness and compliance with applicable
laws, including credit risk, interest

rate risk, and transaction risk
(including cybersecurity, information

security, and illicit finance), provided
that such criticism, supervisory

feedback, or other actions addressing
these other risks is not a pretext by

examiners aimed at reputation risk.

Under the proposed rule, the N C U A
would make one conforming amendment

to the N C U A’s regulations to
eliminate references to reputation risk.

The conforming amendment would
be made in the stress testing

requirements for complex credit unions.

One other N C U A regulation codified
in 12 C F R part 717 refers to

reputation risk concerning certain
identity theft prevention programs

required by the Fair and Accurate
Credit Transactions Act of 2003.

However, by statute, guidelines and
regulations for these programs must occur

jointly across certain federal agencies,
so no conforming amendment is suggested

for 12 C F R part 717 at this time.

The N C U A will consider making changes
to 12 C F R part 717 in a separate,

joint rulemaking in the future.

Until that separate, joint rulemaking
occurs, the N C U A expects to

exercise its discretion in enforcing
12 C F R part 717 by using agency

resources to assess compliance
without regard to reputation risk.

IV.

Expected Effects

A.

Background

As previously discussed, to improve
the efficiency and effectiveness

of the supervisory framework, the
N C U A is proposing to establish

a regulation codifying the removal
of reputation risk from its

examination and supervision programs.

B.

Parties Affected by the Proposal

1.

N C U A Regulated Entities
Affected by the Rule

The N C U A currently supervises
2,740 F C Us and 1,630 federally

insured, state-chartered credit unions
(collectively referred to as F I C Us).

Because all F I C Us were subject to
reputation risk assessments, the proposed

rule would affect all 4,370 institutions.

2.

Other Parties

Because the proposed rule aims to remove
the influence of the agency’s reputation

risk assessments on institutions’ member
and business relationships, N C U A

concludes that the proposed rule could
potentially affect all F I C Us’ current

and future members and business partners.

It would also affect any other
institutions over which the N C U A has

or may be granted supervisory authority.

C.

Current Legal and Regulatory Baselines

On September 25, 2025, the N C U A
issued Letter to Credit Unions 25–C

U–05 wherein the agency notified
supervised institutions that it was

ceasing to use reputation risk in the
examination and supervisory process.

The N C U A also sent a memo to
staff on that same day, instructing

staff that they may no longer base
supervisory concerns on reputation risk.

N C U A employees were notified that
they may not refer to or engage in

discussions about reputation risk or
similar concepts as part of examinations

and supervision contacts or other
regulatory or supervisory actions (such

as waivers, application decisions, or
enforcement actions) for a credit union

or credit union service organization.

The agency is in the process of removing
reputation risk from its regulations,

policies, manuals, and training materials.

Therefore, the N C U A has already
discontinued reputation risk-based

supervision as of September 25, 2025.

The proposed rule would create a formal,
legal mandate to remove reputation risk

from N C U A’s supervision framework.

Effectively, there would be no additional
burden, and therefore no compliance

costs since reputation risk will not be
examined for effective September 25, 2025.

D.

Costs and Benefits

Implementing a regulation to prohibit
the use of reputation risk in the

examination and supervision program
will remove uncertainty and the

potential for misuse, which inherently
will provide benefits to F I C Us.

The removal of reputation risk will
ensure greater consistency and objectivity

of supervisory decisions, increasing
the predictability for regulated

institutions to understand and manage
regulators’ supervisory expectations.

The proposed rule should benefit credit
unions and their members by formally

eliminating actual or perceived reputation
risk-related regulatory restrictions

and constraints on member services
that would otherwise be permissible.

Other than the inherent benefits described
above, the N C U A cannot quantify the

number of institutions, or the associated
costs, where an institution was criticized

for activities because of reputation risk.

Nor does the N C U A have the information
necessary to quantify the number of

institutions that might make changes to
their operations based on this change.

This concludes the proposal.

If your Credit union could use assistance
with your exam, reach out to Mark Treichel

on LinkedIn, or at mark Treichel dot com.

This is Samantha Shares and
we Thank you for listening.