NCUA Chairman Todd M. Harper’s Remarks at the Brookings Institution: Agenda for Credit Union Regulation

As Prepared for Delivery on February 6, 2024

Good morning, everyone, and thank you, Aaron, for the warm introduction. It’s always good to see you. And, thank you as well to the Brookings Institution for inviting me here today.

Although I may have grown up a Chicago Cubs fan, I have long appreciated the wisdom of the New York Yankees baseball legend, Yogi Berra, who famously once said, “The future ain’t what it used to be.” His astute, if slightly mind-bending, observation rings true for today’s credit union system. The future viability and success of the evolving credit union system requires not only planning, but flexibility and agility as new developments call for changes or course corrections. Before delving into what will be needed for the future, let me first speak briefly about the foundation laid in the past and the challenges of the present.

The 90^th Anniversary of the Federal Credit Union Act

Credit unions in the United States date back to 1909, when St. Mary’s Cooperative Credit Association opened in Manchester, New Hampshire. And, the number of state-chartered credit unions and their members grew at a healthy rate for 25 years. But, when the Great Depression sent our economy spiraling, it became clear that we also had to look differently at the way we organized our financial institutions at the federal level. So, in 1934, President Franklin Delano Roosevelt signed the Federal Credit Union Act to ensure the continued health of the credit union system in this country.

In those early years after that bill became law, my grandfather helped to start and chair a federal credit union at a soap factory in Indiana. About 30 years later, my father would go on to do the same by starting a teachers’ credit union in Illinois. And, about 20 years after that, I would join my first credit union before starting to work on credit union policy issues a few years later. So, my family has firsthand experience with the benefits of cooperative credit, including lower rates of interest on loans and higher rates of interest on share deposits, that have allowed us to build intergenerational wealth.

This year marks the ninetieth anniversary of this landmark legislation that established the federal system for credit unions. That law also set up a federal agency to oversee credit unions at the national level. The then-newly created Federal Credit Union Division was initially placed in the Farm Credit Administration but, over time, moved to other agencies until the National Credit Union Administration was created in 1970. The NCUA has evolved considerably since then, as has the credit union system, into what it is today. That includes creating the National Credit Union Share Insurance Fund in 1970, to protect the share deposits of now nearly 139 million Americans. Until 1970, credit unions had operated without federal deposit insurance.

That evolution also included the establishment of a Board to oversee the NCUA’s operations in 1979. And, that evolution included the enactment of legislation in 1998 to allow for the organization of multiple common-bond federal credit unions with many smaller groups within a federal credit union’s field of membership and to establish, comparable to banks, the minimal capital ratios that a federally insured institution must maintain and triggers that limit the activities of federally insured credit unions should they drop below those levels.

The passage of the Federal Credit Union Act was a watershed moment in our nation’s history. But, just as that law was forward-thinking when enacted nearly a century ago, it must evolve to reflect current realities with an eye to the future.

Credit Union Performance Data in the Third Quarter of 2023 & Warning Signs

As of today, the credit union system remains largely stable in its performance and relatively resilient against economic disruptions. For the $2.2 trillion federally insured credit union system, total loans increased 9.1 percent, total assets rose 3.7 percent, and total insured shares and deposits grew 1.4 percent over the year ending in the third quarter of 2023. Together, these metrics demonstrate signs of strength for the system.

However, in recent quarters, the NCUA has also seen growing signs of financial strain on credit union balance sheets and in household budgets, along with growing consumer financial stress. For instance, during the third quarter of 2023, the overall delinquency rate for federally insured credit unions was 72 basis points, up 19 basis points from one year earlier. Credit card and automobile loan delinquencies are elevated at 190 and 78 basis points, respectively. In fact, the dramatic rise of 60 basis points in credit card delinquencies is well above historic averages. And, aggregate credit card balances are rising while average share deposits per member are falling.

The NCUA, therefore, continues to watch credit union performance closely and urges credit unions to remain diligent in managing the potential risks on their balance sheets and when monitoring economic conditions and the interest rate environment. These aggregate statistics result from economic warning signs that have been flashing for some time, including inflationary pressures, geopolitical turbulence, and growing interest rate, liquidity, and credit risks within the credit union system. The numbers also show that today’s economic environment requires active — not passive — management by credit union boards and senior leadership. We all need to be paying attention.

The NCUA’s recent Share Insurance Fund quarterly update in November additionally illuminated that action is needed to ensure the credit union system’s continued health and members’ financial security. As part of the examination process, the NCUA uses its CAMELS rating system, which like the system used by other federal banking safety-and-soundness regulators, is based on an evaluation of six critical elements of a credit union’s operations, namely: capital adequacy, asset quality, management, earnings, liquidity, and sensitivity to market risk. A credit union with a CAMELS 1 rating generally exhibits sound performance and risk management practices, whereas credit unions with a CAMELS 5 rating exhibit extremely unsafe and unsound practices and conditions.

According to the latest data, the number of composite CAMELS code 3, 4, and 5 credit unions has increased. More concerning is that assets in composite CAMELS code 3 institutions increased sizably in the last quarter. In fact, the number of large, complex credit unions with a composite CAMELS code 3 rating increased by 9 credit unions to a total of 51 credit unions in the third quarter of 2023. Assets in the CAMELS code 3 group for credit unions of all sizes also increased to $131.7 billion, a nearly 45 percent jump from the previous quarter’s results. And, we have seen more credit unions fall into the composite CAMELS code 4 and 5 ratings during the second and third quarters. This means a large and growing share of the credit union system’s assets reside in institutions with potential safety-and-soundness concerns that require immediate remediation.

Given the current economic conditions and the stress in the credit union system from growing liquidity, interest rate and credit risks, the NCUA Board decided to build up the liquidity position of the Share Insurance Fund to a targeted amount of $4 billion, which it reached last September. By year’s end, those overnight reserves had increased to $5.2 billion.

Protecting the Share Insurance Fund against losses is job number one for the NCUA Board. Going forward, the Board will continue to closely monitor credit union and Share Insurance Fund performance in the quarters ahead. Rest assured, the NCUA is committed to protecting credit union members and the safety and soundness of the credit union system. No one has ever lost a single penny of insured share deposits.

Vendor Authority

The NCUA Board’s decision to increase the Share Insurance Fund’s liquidity position was made to prepare for potential losses. That same forward thinking is needed by credit unions. Credit unions can and must identify and mitigate risks that endanger their operations, their institutions, and their members. We all speak about the importance of innovation to maintain longevity, but credit unions must also be careful, meticulous, scrupulous, and attentive.

In today’s economic environment, it’s not a single catastrophic event that wipes out financial institutions. Human error, cutting corners, and passivity are also key ingredients that lead to a crisis. What’s more, risks in the credit union system often lurk in the regulatory shadows beyond the NCUA’s reach, namely within credit union service organizations and third-party service providers, because the NCUA does not have supervisory authority over these third-party vendors, unlike its federal banking agency counterparts.

This lack of authority is an Achilles’ heel for the credit union system. Increasingly, activities that are fundamental to the credit union mission, such as loan origination, lending services, Bank Secrecy Act or Anti-money laundering compliance, and financial management, are being outsourced to third-party vendors. And, credit unions use third-party vendors to provide technological services, including information security, and mobile and online banking. Member data are also stored on vendors’ servers — including, as we’ve been told by concerned credit unions, on servers not utilizing industry-standard cybersecurity protections.

The pandemic, which accelerated the credit union industry’s movement to digital services, has only increased credit union reliance on third-party vendors. The NCUA’s lack of visibility into these critical industry participants is a major problem in that it poses a systemic risk to the financial services system and our national security. And, it costs the agency and the industry money.

Consider these statistics: The NCUA’s Office of Inspector General stated that between 2008 and 2015, nine credit union service organizations contributed to material losses to the Share Insurance Fund — costing credit unions more to maintain it. That same report noted one of the credit union service organizations caused losses in 24 credit unions, a number of which failed, leaving their members financially vulnerable. And, according to NCUA staff calculations, at least 73 credit unions incurred losses between 2007 and 2020 as losses at credit union service organizations rolled onto credit union ledgers and led to some credit union liquidations.

More recently, the implementation of the NCUA’s cyber incident notification rule yielded new insights into the scale of third-party vendors’ vulnerability to cyberattacks. Within the first 30 days of the rule’s effective date on September 1, the NCUA received 146 incident reports, roughly 60 percent of which involved third-party service providers.

Moreover, there’s an associated concentration risk as five core banking processors handle more than 90 percent of the credit union system’s assets. A failure of one of these third parties could cause hundreds of credit unions and potentially tens of millions of their members to lose access to their funds simultaneously. In fact, we encountered that very scenario last November when the NCUA received cyber incident reports from multiple small credit unions stating their core service provider had been experiencing intermittent system outages. Dozens of credit unions across 40 states with aggregate assets of nearly $1 billion and almost 100,000 members experienced outages or disruptions of services in some form. The fallout of this cyber incident demonstrates how a single vendor’s problems can quickly metastasize into crisis for credit unions, members, and the overall system.

The lack of vendor authority impeded the NCUA’s ability to quickly respond to the situation. And, the lack of vendor authority will become an even larger issue as credit union service organizations and third-party vendors are poised to capitalize on financial institutions’ growing use of artificial intelligence and real-time payment services.

To be clear, restoring the NCUA’s vendor authority is not just about what credit unions stand to lose, it’s also about what they stand to gain. The benefits include credit union access to NCUA examination information when conducting due diligence of vendors, which would enhance the competitiveness of the industry by providing federally insured credit unions with access to the same types of information that bankers have when conducting their own due diligence. Other benefits for credit unions include fewer requests from the NCUA to credit unions to intervene with vendors experiencing problems, and fewer losses to the Share Insurance Fund. Again, both are a savings of money.

Consistent with Board-approved policy, the NCUA will continue to ask Congress for this authority, as we have in multiple testimonies. The NCUA is not alone in recognizing this problem. Other government officials support this request as well, including the Government Accountability Office, the Financial Stability Oversight Council, the NCUA’s Office of Inspector General, and the Federal Reserve Bank of Atlanta, which cited the Treasury Department’s Office of Financial Research 2023 annual report that underscored how smaller banks and credit unions are especially vulnerable to ransomware attacks due to a greater reliance on third-party service providers.

Until Congress restores vendor authority, the onus remains on credit unions to ask the right questions of their vendors. Those questions include: What are they doing to safeguard their members’ hard-earned savings as the economic environment continues to experience turbulence and the financial services industry endures regular cyberattacks? And, what practices are credit unions engaging in to remain competitive amidst an evolving technological landscape and increasingly demanding consumer expectations?

When the NCUA is given this authority by Congress to complete its job, it will implement a risk-based examination program for third-party vendors focusing on services that relate to safety and soundness, cybersecurity, Bank Secrecy Act and Anti-Money Laundering Act compliance, consumer financial protection, and areas posing significant financial risk for the Share Insurance Fund. In short, the time has come to close this growing regulatory blind spot.

Central Liquidity Facility

Liquidity management also remains a focus for the NCUA. In this current economic environment of heightened interest rates and liquidity risk for credit unions, including several with over $1 billion in assets, the role of the NCUA’s Central Liquidity Facility as a liquidity backstop has taken on greater importance.

Created by Congress in 1979, the Central Liquidity Facility functions as an emergency liquidity backstop for the credit union industry, similar to the Federal Reserve’s Discount Window. The saying, “there’s strength in numbers,” is applicable to the Central Liquidity Facility, because the more members it has, the more effective it is as a liquidity shock absorber.

Unfortunately, statutory enhancements that allowed for greater flexibility in accessing the facility expired at the start of 2023. This statutory lapse caused membership in the facility to decline and consequently its effectiveness to diminish. Between the end of 2022 and September 30, 2023, Central Liquidity Facility membership declined from 3,990 to 399 consumer credit unions, with 3,322 credit unions with less than $250 million in assets, losing access to the facility. This means that $211 billion in credit union members’ assets are no longer protected by access to the Central Liquidity Facility, and its borrowing capacity has contracted by almost $10 billion, impacting its current members.

This development comes at a time when the need for the Central Liquidity Facility’s role as a liquidity backstop has grown. For example, out of the 443 credit unions that were potentially affected by last November’s major cyber incident, only four — less than one percent — currently have access to emergency liquidity through the facility.

Access to the Central Liquidity Facility and the Federal Reserve’s Discount Window should be part of participating credit unions’ broader liquidity risk management plans for a variety of contingencies, not just during times of crises. For that reason, the NCUA Board has repeatedly asked Congress to allow corporate credit unions to purchase capital stock in the Central Liquidity Facility to help smaller credit unions access liquidity, and to provide other regulatory flexibilities to increase the facility’s accessibility. We are hopeful these changes can be made.

Consumer Financial Protection

The safety-and-soundness concerns for the credit union system that I’ve so far described today tell only part of the story. Protecting consumers’ interests and their hard-earned savings is equally important. Some critics have drawn a false dichotomy between the NCUA’s two missions, but the truth is you can neither separate them nor have one without the other. The NCUA’s vision statement — unanimously approved by the NCUA Board in 2022 as part of the strategic plan — is a clear confirmation of that relationship, to quote, “[s]trengthen communities and protect consumers by ensuring equitable financial inclusion through a robust, safe, sound, and evolving credit union system.” And, the investment in consumer financial protection isn’t only a good principle, it’s good business.

The NCUA’s supervisory efforts over the last few years are aimed at creating a more equitable and legally compliant financial system. That commitment is reflected in the agency’s 2024 and 2025 budgets approved in December and in this year’s supervisory priorities, which the agency issued last month. Overdraft and non-sufficient fund fees are a key component of the NCUA’s review. NCUA examiners this year will continue an expanded review of credit union overdraft programs, including website advertising, balance calculation methods, and settlement processes. Problematic overdraft programs and non-sufficient funds alerts include fees that aren’t reasonable and proportional, rely on systems that authorize positive and settle negative, or impose multiple representment fees, often in one day.

NCUA’s fair lending examinations will also increase in number and focus on ensuring policies and practices are fair and not discriminatory. And, examiners will continue to evaluate credit unions’ policies and procedures governing compliance with flood insurance rules. The NCUA's other areas of emphasis for 2024 include Bank Secrecy Act compliance and support for small credit unions and minority depository institutions.

Closing

So, as we approach the ninetieth anniversary of the Federal Credit Union Act in late June, it’s appropriate to consider where we’ve been, where we are now, and where we’re going. What began with paper ledgers, volunteers meeting on factory floors — including that soap factory where my grandpa worked — limited hours of service, and simple appliance loans has evolved into a $2.2 trillion system serving tens of millions of members and employing in excess of 350,000 full- and part-time professionals. That modern system includes 24/7 mobile and online services, automated underwriting, a complex system of third-party vendors, and a full array of financial products and services.

The NCUA’s regulatory and examination framework must likewise keep pace, evolve, and adapt. The phrase “regulatory parity” has taken on a negative connotation as a euphemism for overreach or, worse, a one-size-fits-all approach. But, credit unions face the same challenging economic environment, growing interest rate, liquidity, and credit risks, shifting technological landscape, and evolving consumer expectations as banks. And, with the creation of the Federal Financial Institutions Examination Council in 1979, Congress called on the federal banking agencies and the NCUA to promote uniformity in the supervision of financial institutions.

As such, the NCUA’s legislative requests and initiatives are aimed at safeguarding credit union members’ choice of financial institution and ensuring their savings are equally protected. Similarly, the agency’s initiatives to support small credit unions and minority depository institutions, streamline the charter process, and amend field-of-membership rules will enhance consumer access to safe, fair, and affordable financial services, especially in under-resourced communities across the country. Together, these efforts can help ensure the credit union system thrives in an increasingly competitive marketplace while remaining faithful to its statutory mission of meeting the credit and savings needs of members, especially those of modest means.

In closing, let me return to the wisdom of Yogi Berra, who said, “You’ve got to be very careful if you don’t know where you are going, because you might not get there.” The statutory mission of the credit union system is clear, but the path to accomplishing that mission in today’s evolving marketplace must be charted with an appreciation for the achievements of yesterday, an understanding of the conditions of today, and an ability to anticipate and meet the challenges of tomorrow. Those changes and developments require a more level playing field when it comes to regulations, examinations, and supervision, especially when it comes to the largest of credit unions.

Thank you again for the invitation. Aaron, I look forward to our conversation.