NCUA Board Receives Cybersecurity Update; Proposed Rules for Insurance Coverage, Fair Hiring Issued

The NCUA Board received a Cybersecurity Update from the Office of Examination and Insurance. The update covered trending cybersecurity attack tactics and best practices on how credit unions can effectively counteract them including highlighting the Cybersecurity and Infrastructure Security Agency (CISA) and its Shield Up guidance guidance and resources. The overview covered the NCUA’s Information Security Examination programs and its three levels (Small Credit Union Examination Program, CORE, and CORE Plus), each based on asset size, complexity, and risk profile. They also discussed the three primary components to the Information Security Examination program which include the Exam, Profile, Statements, and sub-statements, along with strengths and suggestions for each Program Type.

It should be noted that the overview highlighted there were 146 cybersecurity incidents reported in the first 30 after the implementation of the NCUA’s 72-hour cyber security incident reporting rule. The 146 incidents were as many as had been reported the who year prior. The League provided guidance and resources on this rule after its implementation in August. The Report noted that 60% of the 146 reported incidents were due to third-party compromises. Chairman Harper used this information to reiterate his priority of the NCUA to have third-party vendor authority.

Proposed Rule – Simplification of Share Insurance Rules (Part 745) – Approved for 60-Day Comment Period

The proposed rule would seek comment on proposed amendments to the NCUA’s regulations governing share insurance coverage. The proposed rule would address the following items: simplify the share insurance regulations by establishing a “trust accounts” category that would provide for coverage of funds of both revocable trusts and irrevocable trusts deposited at federally insured credit unions (FICUs) in the accounts of members or those otherwise eligible to maintain insured accounts (member accounts); provide consistent share insurance treatment for all mortgage servicing account balances held to satisfy principal and interest obligations to a lender; and provide more flexible recordkeeping requirements to explicitly allow the NCUA to look to records held in the normal course of businesses that are maintained by parties other than a FICU and its members on their behalf. The proposed changes to the trust account and mortgage servicing account provisions would align with changes the FDIC previously adopted and are set to take effect on April 1, 2024.

It was noted that while few may be directly affected by the simplification, it will still allow for trusts with multiple beneficiaries to fully ensure up to 5 different beneficiaries. Over the past 4 years, the NCUA’s CURE office has received over 6,400 inquiries regarding trust accounts. This change could help free up the offices resources to assist credit union on other issues.

Proposed Rule – Fair Hiring in Banking (Parts 701, 741, 746, 748, and 752) – Approved for 60 Day Comment Period

The proposed rule would incorporate Interpretive Ruling and Policy Statement 19- 1 (“IRPS 19-1”) regarding statutory prohibitions imposed by Section 205(d) of the Federal Credit Union Act (“Section 205(d)”) into NCUA’s regulations. Section 205(d) prohibits, except with the prior written consent of the Board, a person who has been convicted of certain criminal offenses involving dishonesty or breach of trust, or who has entered into a pretrial diversion or similar program in connection with a prosecution for such an offense, from participating in the conduct of the affairs of an insured credit union. The proposed rule would amend the NCUA’s policies and procedures governing an application to rescind a prohibition pursuant to Section 205(d), as currently reflected in IRPS 19-1 and consistent with both amendments made by the recent Fair Hiring in Banking Act and with comparable Federal Deposit Insurance Corporation regulations.

Following the issuance of a final regulation, IRPS 19-1 would be rescinded. The proposed rule would also amend the regulation governing the conditions under which federally insured credit unions that are newly chartered or in troubled condition must notify the NCUA of any proposed changes to the credit union’s board of directors, committee members, or senior executive staff and make other conforming changes. This proposed rule covers credit union employees and volunteers.

At the conclusion of the Board meeting, all three Board members recognized the work of H. Lenwood Brooks, V, who is leaving his position as Senior Policy Advisor to Board Member Hood for a position at the Federal Reserve Bank of Dallas. Chairman Harper introduced Naghi Khaled as Board Member Hood’s new Senior Policy Advisor. League President/CEO Carrie Hunt and Chief Advocacy Officer JT Blau were in attendance for this Board meeting and met Mr. Khaled after the meeting adjourned.

Additional information here.