NCUA Board Briefed on Emerging Cybersecurity Threats, PCA Relief Measures

Board Action Bulletin

ALEXANDRIA, Va. (April 22, 2021) – Through a live audio webcast, the National Credit Union Administration Board held its fourth open meeting of 2021 and was briefed on two matters:

• Current cybersecurity events and trends affecting federally insured credit unions and the broader financial system.
• An interim final rule that temporarily modifies two areas of NCUA’s prompt corrective action regulations.

Board Briefed on Evolving Cyberthreats to the Financial System

The COVID-19 pandemic has increased cybersecurity vulnerabilities for federally insured credit unions and financial services market participants, which remain a target for hackers and thieves. Top threats include ransomware, malware and phishing attacks, identity theft, denial of service, ATM skimming, pandemic-themed attacks, and supply chain attacks.

As stressed in the briefing provided to the Board by the Chairman’s Special Advisor for Cybersecurity, supply chain risk is a significant threat to financial services because of the layered dependencies that exist in a complex, multi-service provider environment found in the financial services sector.

The NCUA continues to encourage credit union boards of directors to use previously issued advisories to review their relationships, assess and mitigate risk as it relates to their specific supply chain, and continue to strengthen their institution’s cyber vigilance and preparedness efforts.

“Like my fellow Board Members, I am deeply concerned about the risk cyberattacks pose to our financial system,” Chairman Todd M. Harper said. “Briefings like this today are a critical part of our efforts to promote cybersecurity best practices and inform credit unions about the potential threats they face. I encourage credit unions to utilize the information-sharing groups and other resources presented in this briefing.”

Chairman Harper encouraged eligible low-income credit unions to apply for up to $7,000 in funding to strengthen their cyber defenses as part of this years’ Community Development Revolving Loan Fund grant initiative. The application period runs May 3 through June 26, and additional information about this initiative is available on the NCUA website.

Cyber information for credit unions, including regulations and guidance, along with information about protecting themselves and their members from cyber threats is available on the NCUA’s cybersecurity resources webpage.

Interim Final Rule Renews Prompt Corrective Action Relief

The NCUA Board received a briefing by the Office of Examination and Insurance staff on an interim final rule that temporarily modifies certain regulatory requirements to help ensure federally insured credit unions remain operational and able to provide needed financial services during the COVID-19 pandemic.

Specifically, the interim final rule makes two temporary changes to the NCUA’s prompt corrective action regulations. The first change temporarily reduces the earnings retention requirement for federally insured credit unions classified as adequately capitalized. The second change temporarily permits an undercapitalized credit union to submit a streamlined net worth restoration plan if it becomes undercapitalized predominantly because of share growth. If a credit union becomes less than adequately capitalized for reasons other than share growth, it must still submit a net worth restoration plan under the current requirements in NCUA’s regulations.

Due to the pandemic’s continued financial and economic disruptions, the Board approved the interim rule by notation vote and announced this action on April 16. This interim final rule is substantively similar to the interim final rule approved by the Board in May 2020.

“Given the ongoing uncertainty associated with the pandemic and continued elevated levels of insured share growth resulting from the third stimulus package, many well-run credit unions with positive earnings could continue to experience falling net worth ratios this year despite being well managed and fundamentally safe and sound,” Chairman Harper said. “As a result of this change, eligible credit unions will be able to focus their limited resources on serving their members’ needs — especially those of modest means and those disproportionately affected by the pandemic — instead of planning for earnings transfers and developing detailed net worth restoration plans.”

These temporary measures will remain in place until March 31, 2022. The interim final rule is effective upon publication in the Federal Register, and there is a 60-day public comment period.

Chairman Harper discussed the health of the National Credit Union Share Insurance Fund, which is also experiencing stress on its equity ratio due to increased insured share growth. The Chairman noted that the NCUA staff is currently reviewing the financial performance data for the industry.

“I appreciate Vice Chairman Hauptman’s and Board Member Hood’s engagement with the NCUA team and my office on this issue,” Chairman Harper said. “We are all striving to ensure that we continue to manage the Share Insurance Fund in a prudent way, which, by law, is one of the Board’s primary statutory responsibilities. That is the right thing to do for credit unions and their members, the agency, and the taxpayers.”

The NCUA tweets all open Board meetings live. Follow @TheNCUA on Twitter, and access Board Action Memorandums and NCUA rule changes at www.ncua.gov. The NCUA also live streams, archives and posts videos of open Board meetings online.