New Examination Procedures, Common Concerns & 2017 Outlook from a Regulators Perspective

1. Judy Graham, Program Officer Office of Examination and Insurance New Examination Procedures, Common Concerns & 2017 Outlook from a Regulators Perspective January 2017

2. Overview • Supervisory Priorities for 2017 • Bank Secrecy Act • Regulations • Compliance Concerns • Supervisory Focus • Customer Due Diligence Regulation

3. Supervisory Priorities 2017 • Letter to Credit Unions – January 2017 • Streamlined small credit union exam procedures • Assets > $50 million • CAMEL rates of 1, 2, or 3 • Extended Examination Cycle • Letter to Credit Unions 16-CU-12

4. Supervisory Priorities 2017 • Cybersecurity Assessment • Cybersecurity Assessment Tool • Bank Secrecy Act Compliance • Internal Controls and Fraud Prevention • Interest Rate and Liquidity Risk • LCU 16-CU-08

5. Supervisory Priorities 2017 • Commercial Lending • LCU 16-CU-11 • Consumer Compliance • Military Lending Act – LCU 16-CU-07 • Servicemembers’ Civil Relief Act

6. NCUA BSA Regulations • 12 USC 1786(q)(2) requires NCUA to conduct a review of the BSA compliance program at each examination of a federally insured credit union. • 12 CFR. 748.2 requires every federally insured credit union to establish a BSA compliance program that: • Establishes a system of Internal Controls to ensure ongoing BSA compliance • Provides for Independent Testing for BSA compliance by the credit union or outside party • Designates a BSA Compliance Officer responsible for monitoring day-to-day compliance • Establishes a BSA Training program for appropriate employees and volunteers • Establishes a Customer Identification Program

7. Compliance Concerns • Information Sharing (FinCEN 314(a) lists) • Check the lists timely • Document activity • Activity Report available in SISS • Update point of contact info • Credit Union Online at www.NCUA.gov • Up to four points of contact may be provided • Up to three week time lag for changes to take effect

8. Compliance Concerns • Internal Controls • Review and update risk assessment • Maintain adequate Suspicious Activity Monitoring System • Perform proper Member Due Diligence procedures

9. Compliance Concerns • Independent Testing • Include all credit union operations • Risk based • Should be recent (12 to 18 months) • Should be independent

10. Compliance Concerns • Training • Risk-based • Recent (12 to 18 months – depending on risk) • Document training • Cover BSA requirements and credit union’s policies & procedures • Include training for Board of Directors/Supervisory Committee

11. Supervisory Focus – Money Services Businesses (MSBs) • MSBs offer one or more of the following services: • Issuers or sellers of money orders or traveler’s checks • Check cashers • Dealers in foreign exchange Must conduct more than $1,000 in money services business activity with the same person (in one type of activity) on the same day -OR- • Provides money transfer services in any amount -OR- • Provider or Seller of Prepaid Access – various limits apply

12. Due Diligence Expectations - MSBs Not all MSBs pose the same level of risk, and not all MSBs will require the same level of due diligence NCUA Letter to Credit Unions 14-CU-10 Interagency Guidance Issued April, 2005 Minimum Due Diligence Expectations • Perform CIP • Confirm FinCEN registration, if applicable • Confirm state or local licensing, if applicable • Conduct BSA/AML risk assessment • Conduct Enhanced Due Diligence, if applicable

13. Risk Assessment • Purpose of the account • Anticipated account activity • Types of products and services offered • Locations and markets served

14. Due Diligence Expectations • Enhanced Due Diligence* • Review the MSB’s BSA/AML Program • Review results of the MSB’s independent testing • Review written procedures for the operation of the MSB • Conduct on-site visits • Review list of agents, including locations • Review written employee screening practices * This list is not all inclusive, nor are all of the steps listed on this slide required. Each credit union must make the determination of the enhanced due diligence steps it will take depending upon the level of perceived risk posed by each account.

15. Customer Due Diligence (CDD) • FinCEN finalized CDD Rule May 11, 2016 – effective May 11, 2018 • Credit unions already expected to conduct adequate CDD as part of internal controls • Rule clarifies existing CDD expectations • Rule also requires CUs to obtain Beneficial Ownership information related to legal entities • Ownership • Control • Certification Form Available • NCUA working with other regulators regarding examination expectations

16. Resources • NCUA website: www.ncua.gov • NCUA Examiner’s Guide • AIRES BSA Questionnaire • NCUA Compliance Self-Assessment Guide • Interagency Statement on Enforcement of BSA\AML Requirements • FFIEC BSA/AML Examination Manual: www.ffiec.gov • FinCEN Website: www.fincen.gov

17. Office Contact Page Feel free to contact our office with questions or comments. Primary Staff: Judy Graham Program Officer jgraham@ncua.gov Office Phone: 703-518-6392 Secondary Staff: eimail@ncua.gov