regulatory and compliance issues and considerations

Compliance Update - I 

REGULATORY AND COMPLIANCE ISSUES AND CONSIDERATIONS FOR CREDIT 

UNION EXECUTIVES 

Michigan Credit Union League 

Sherpy & Jones P.A. 

POST OFFICE BOX 2599 

LEXINGTON, SC 29071 

CREDIT UNION RESOURCES AND EDUCATIONAL SERVICES, LLC (“CURES”) 

104 PENINSULA DRIVE 

PEACHTREE CITY, GA 30269 

770-631-3527 

STREET ADDRESS FOR DELIVERIES: PHONE: (803) 356-3327 

129-B EAST MAIN STREET FAX: (803) 356-3591 


RTS@SHERPY-JONES-LAW.COM 

WEBSITE: SHERPY-JONES-LAW.COM 

COPYRIGHT AND NON-REPRESENTATION. Copyright© 2010 by Sherpy & Jones, P.A.. All rights reserved. 

These materials are designed to provide thorough, timely and accurate information regarding the topics 

addressed. These materials are distributed with the understanding that R. Todd Sherpy nor Sherpy & Jones, 

P.A, are not rendering legal or other professional advice, and these materials should not be relied upon or 

substituted for such advice. Any questions or issues addressed, discussed, or in any way posed shall be addressed 

within the scope of the presentation, but are not in any way intended to serve as legal advice or representation 

whatsoever. If the recipient of these materials needs legal or professional advice, an appropriate professional 

should be consulted. You may engage us to provide these services; however, no such relationship shall exist 

absent a formal written agreement between us and the participant or the participant's Credit Union. These 

materials may not be reproduced in whole or in part, in any form whatsoever, without the express written 

permission of R. Todd Sherpy and Sherpy & Jones, P.A.

About the Presenter... 

R. Todd Sherpy is a founding partner in the law firm of Sherpy & Jones, P.A. The firm is dedicated to serving 

all legal needs of Credit Unions; and provides day-to-day compliance, compliance auditing, training and 

consulting services to Credit Unions throughout the United States. Todd dedicates a large portion of his time to 

teaching Credit Unions, having made presentations in 43 States and participating as an instructor through 

CUNA & Affiliates Regulatory Compliance, Collections and Credit Counseling, Marketing, Consumer Loan 

Officer and Economics and Investments Schools and Conferences. Todd authored CUNA’s RegTrac 

Compliance Modules on Consumer, Real Estate Lending, and Member Business Lending; CUNA’s 

White Paper on Privacy; CUNA's Guide to Compliance with Revised Article Nine; CSG’s Volunteers 

Achievement Program on Directors’ Liability, and many other Credit Union resources. Todd is General 

Counsel to the South Carolina and consults with several other Credit Leagues on a regular basis. 

CURES and SimpliLend: 1992 Todd developed CURES, LLC., (Credit Union Resources and Educational 

Services) and SimpliLend to serve the compliance/regulatory needs of Credit Unions. CURES includes the 

"Compliance Community Plan" under which Credit Unions are offered audit and/or continuing compliance 

services at a significant saving through cooperative participation in a plan serving the common needs of many 

Credit Union. Under the Plan, the firm and/or CURES now works with approximately 500 Credit Unions in 27 

States. Under this plan, CURES provides participants with secure web access to all electronic policies, 

procedures, notices, updates, explanations, internal training guides, as well as many forms from simple 

collection and bankruptcy documentation to full member account services guides and other forms and day-today 

resources. 

Todd serves on the Credit Union Sub-committee of the American Bar Association, the Operations and 

Supervisory Committee’s of the Credit Union Committee; and chaired the Consumer Law Section for the South 

Carolina Bar. Todd, whose family has a tradition of working with and supporting Credit Unions, then began his 

current practice. Todd is married to the Executive Officer at a Large Georgia Credit Union. Todd has two 

daughters, Caroline and Catherine who he absolutely adores. 

The Largest Credit Unions to whom we provided in the last year include: 

Boeing West Employees Credit Union Mountain America Credit Union Founders Federal Credit Union 

Langley Federal Credit Union State Farm Credit Union Black Hills Federal Credit Union 

Arizona Federal Credit Union Robins Federal Credit Union Elevations Federal Credit Union 

Bankfund Staff Federal Credit Union Sharonview Federal Credit Union SC Federal Credit Union 

Addison Avenue Federal Credit Union 66 Federal Credit Union Centris Federal Credit Union 

Tinker Federal Credit Union American Airlines Federal Credit Union Piedmont Aviation Federal Credit 

Union 

Lake Michigan Credit Union POPA Federal Credit Union Aberdeen Proving Ground Federal 

Credit Union 

Day Met Credit Union Pearl Harbor Federal Credit Union Leaders Federal Credit Union 

SPC Cooperative Credit Union Mid-America Credit Union Association TruChoice Federal Credit Union 

Memphis Area Teachers Credit Union Credit Union of Colorado Atlantic Regional Federal Credit Union 

Smaller Credit Unions to whom we provided in the last year include: 

GHS Federal Credit Union Aberdeen Federal Credit Union Ball State Federal Credit Union 

Bangor Federal Credit Union Bay Gulf Federal Credit Union Central Sunbelt Federal Credit Union 

Community United Federal Credit 

Union 

Delaware First Federal Credit Union Family Advantage Federal Credit 

Union 

Fort Campbell Federal Credit Union Jefferson Financial Credit Union Leaders CU Credit Union 

ListerHill Federal Credit Union Maui Teachers Federal Credit Union Kahului Federal Credit Union 

New Orleans Firefighters Federal Credit Penobscot County Federal Credit Union PortAlliance Federal Credit Union 

Union 

Savannah Postal Federal Credit Union Strategic FCU Tuscaloosa County Credit Union 

We provide or have provided in the last year services to the following non-Credit Union entities: 

CUNA Mutual Insurance, CUNA CPD or Minnesota Mutual Insurance Company, Securian, Inc 

other affiliated companies 

Inc. 

South Carolina Credit Union League North Carolina Credit Union League Hawaii Credit Union League 

Indiana Credit Union League Missouri Credit Union League Maine Credit Union League 

Michigan Credit Union League Florida Credit Union League Virginia Credit Union League 

SD-ND Credit Union League Georgia Credit Union Affiliates The Financial Forms Company, LLC 

Copyright©1994-2010 by Credit Union Resources & Educational Services, LLC. All rights reserved. 

Revised February 2010 

2

Introductory Notes: 

Basic Obligations, Standards and Liability Issues 

Related to Knowledge and Training and Methods for 

Protecting Senior Management and Volunteers from 

the Possibility of Liability Actions 

An Overview of the Law of Negligence, Liability, Duties of Management and 

Volunteers, Insurance-Bonds and Something Called FIRREA – and how the 

American “Business Judgment Doctrine” can Protect All who Follow a Few Basic 

Rules. 

Duties of Senior / Executive Management and a Credit Union’s 

Volunteers. “Preserve the Credit Union for the Benefit of the Credit 

Union’s Members” 

64-2009 Community Notice // FIRREA Q & A 

I love some of the questions y’all pose: 

Question: Todd, when you refer to FIRREA in connection with recent emails 

addressing Insurance-Bond Coverages “The Business Judgment Rule;” Training; 

Proper Policies, Procedures and Risk Assessments; Etc. … are you just trying to 

make our skin crawl? Why? 

Response: Yes – absolutely I am trying to make your skin crawl. It is usually my best 

shot to get folks to listen. If I can do that … then we will never have to actually address 

FIRREA; and the very personal liability that can be imposed on Credit Union 

management and Volunteers (personal not insured – not bonded liability). Here is a 

brief summary of FIRREA for you to consider in regard to your question: 

SUMMARY: “Financial Institutions Reform, Recovery and Enforcement Act of 1989Title IX: 

Regulatory Enforcement Authority and Criminal Enhancements - Subtitle A: Expanded 

Enforcement Powers, Increased Penalties, and Improved Accountability - Amends the Federal 

Deposit Insurance Act and the Federal Credit Union Act to define the personnel liable for civil and 

criminal penalties for participating with knowing or reckless disregard with respect to: (1) any 

violation of any law or regulation; (2) any breach of fiduciary duty; or (3) any unsafe or unsound 

practice likely to cause an adverse effect upon an insured depository institution. Enhances the 

enforcement powers of banking regulatory agencies to include the authority to: (1) require restitution, 

reimbursement, indemnification, or guarantee against loss; (2) restrict the institution's growth; (3) dispose 

of any loan or asset; (4) rescind agreements or contracts; (5) require the employment of qualified 



3

personnel; (6) place restrictions upon an institution's activities; (7) apply enforcement actions to savings 

and loan affiliates and entities; (8) issue temporary orders with respect to incomplete or inaccurate 

recordkeeping by an insured financial institution; and (9) remove or prohibit certain personnel from 

engaging in banking activities on an industry-wide basis. Sets forth a limitations period for enforcement 

proceedings against such personnel after separation from banking service. Establishes a tiered schedule 

of increased civil money penalties for violations by insured financial institutions or their personnel. 

Establishes a criminal penalty for participation in the affairs of either a bank holding company or a savings 

and loan holding company by individuals who are prohibited from engaging in the affairs of a financial 

institution. Increases the civil penalties for non-compliance with reporting requirements.” 

We can provide significant protections from this and other possible liability if the 

Credit Union’s will follow the guidance we give; conduct and document proper 

due diligence and legal/compliance assessments; engage in proper training, etc. 

Thus – I seek to gain your attention by referring to FIRREA. 

How’s the skin feeling now? 

Moving forward together to meet members' needs and to exceed expectations, 

Todd 

R. Todd Sherpy 

Sherpy & Jones, P.A. 

CURES, LLC 

Post Office Box 2599 

Lexington, SC 29071 

Phone: (803) 356-3327 

Atlanta Phone: (770) 631-3527 

Cell: (803) 351-3316 

Fax: (803) 356-3591 

e-Mail: rts@sherpy-jones-law.com 

a. Common Law 

b. Statutes, Laws, Regulations, and Guidelines (Example: FFIEC) 

c. Industry Standards (“The Banking Industry”) 

d. “The Business Judgment Rule” in American Jurisprudence 

(i) 

(ii) 

(iii) 

Due Diligence – Is it Conducted? Documented? 

Board Minutes – Do they reflect Execution of Duties? 

Training? Is it done / documented? 

e. Bylaws Up to Date – Meeting what is Stated therein? 

NCUA Standard Credit Union Bylaws -- Article VI -- Section 6. Board 

responsibilities. 

The board has the general direction and control of the affairs of this credit 

union and is responsible for performing all the duties customarily 



4

performed by boards of directors. This includes but is not limited to the 

following: 

(a) Directing the affairs of the credit union in accordance with the Act, 

these bylaws, the rules and regulations and sound business practices. 

(b) Establishing programs to achieve the purposes of this credit union as 

stated in Article I, Section 2, of these bylaws. 

(c) Establishing a loan collection program and authorizing the charge off of 

uncollectible loans. 

(d) Establishing a policy to address training for newly elected and 

incumbent directors and volunteer officials, in areas such as ethics 

and fiduciary responsibility, regulatory compliance, and accounting 

and determining that all persons appointed or elected by this credit 

union to any position requiring the receipt, payment or custody of 

money or other property of this credit union, or in its custody or 

control as collateral or otherwise, are properly bonded in accordance 

with the Act and regulations. 

(e) Performing additional acts and exercising additional powers as 

may be required or authorized by applicable law. 

2. Insurance, Bonds, Coverages and that Little Matter Called FIRREA 

a. Is the Credit Union Covered? 

b. What Coverages are out there? 

c. What about third party incidents? (Example: Heartland) 

d. Do we broker and compare coverages? 

e. Do we obtain bids? 

f. Does a qualified Broker Advise us? 

g. Is Credit Union Management and Its Board Covered? 

h. What have we told the Board? Is it Accurate? What is a 

“misrepresentation?” 

Not Intended to Depict any Governmental Agency or Regulator (Any 

Similarity is Merely Coincidental): 



5

Get Out of Jail Free Cards” Protecting the Credit Union and its Management 

and/or Volunteers from Liability and/or Regulatory Actions; and Avoidance of 

Other Losses: 

1. The Business Judgment Rule Addresses in A above. 

2. Training – See Compliance Policy and Training Chart … 

3. Proper Policies, Procedures and Risk Assessments: 

a. The 68, 69, 70 …….. areas ……… 

b. Testing Systems – and Records 

c. Proper Audits 

d. Proper Policies and Procedures 

The concept of protecting the Credit Union at all times: 

78-2009 Community Notice // Protecting the Credit Union – Training and Event – 

Incident Reports 

Present Recollection Recorded: 

Here we go with one of Todd’s Lessons on the law – but of course -- to protect the 

Credit Union. This one begins with the English Common Law and comes forward to 

today’s modern Rules of Evidence. 

“What if.” 

What if an applicant “volunteers” information about her divorce and/or her children while 

you are taking a loan application? Are these topics that can be discussed in the loan 

application process? What if she is denied? Later, she claims the denial resulted from 

your consideration of the information in question. You claim it didn’t; and that she 

volunteered this and it was not considered. She calls you a liar. Who is going to win the 

case? 



6

What if an applicant “volunteers” information about his medical condition while you are 

taking a loan application? Can the Credit Union ask about or consider a medical 

condition in connection with a loan application? 

What if a middle-aged man falls in the lobby? The Credit Union offers assistance. He 

declines; hops up and skips out of the Credit Union. The next day he falls off a ladder 

and is hurt. Since he cannot sue himself – he claims he was hurt in the Credit Union 

lobby fall and sues the Credit Union instead. What record does the Credit Union have to 

prove the facts above? 

What if there is an intrusion event? The Credit Union investigates and determines not 

remediation is needed. Later, it turns out that some member information was in fact 

compromised; or a member’s information is compromised elsewhere – but they blame 

you. Are you prepared to either support your decision that remediation was not required; 

or that the compromise was not as a result of the Credit Union event? 

Evidence to Support the Credit Union: 

Some time ago we adopted concepts from the insurance industry and the workplace in 

creating “incident report forms.” (e.g., The form McDonald’s completes when a rocket 

pharmacist pours hot coffee on themselves to address any legal or insurance claims 

that later arise; the form the industrial plant complete when there is an accident on the 

job to address worker’s comp and related potential claims). Personnel in other 

industries are trained in responding and documenting “incidents” for a reason. Do you 

do the same so the Credit Union can avail itself the possible legal and insurance 

protections that can come into play? 

Board Qualifications 

APPLICATION TO BOARD OF DIRECTORS OF 

_________________ CREDIT UNION 

Qualifications for a Board Member: (This agreement may be significant revised and is 

provided only as a guide. Please consult with competent legal counsel regarding 

customization and/or revisions). 

1. Be a member in good standing of the Credit Union. 

Conditions under which a member maybe classified as not in good standing are defined as: 

a) Member has caused the Credit Union a loss. 

b) Member has an overdrawn account. 

c) Member has a delinquent loan. 

d) Member has exceeded authorized credit limit. 

e) Member has an attachment and/or tax levy. 

f) Member has failed to provide security documentation as specified in their loan/security 



7

agreement. 

g) Member has misrepresented information or provided a false document to the Credit Union. 

h) Member has destroyed Credit Union property, threatened employees, or caused a disruption at 

the Credit Union. 

2. Attend all regular, committee, and special meetings of the Board of Directors and all required 

educational and planning programs each year. The time commitment varies 6-10 hours each 

month. 

3. Be committed to learning about the Credit Union, its services, laws, and regulations that govern 

it, and the responsibilities of a Board member. 

4. Possess the ability to take and handle criticism for making necessary but unpopular decisions. 

5. Have an open mind, the ability to use sound judgment, a willingness to accept responsibility, 

and the ability to make group decisions with colleague Board members. 

6. Have experience in an aspect of finance and/or leadership dynamics. 

Disclosures: 

1. It is important that potential candidates understand that there is a risk of liability associated with 

acting as a Credit Union officer or director. The risk also involves a potential personal liability that 

could include recovery from the directors themselves (personally) rather than or in addition to the 

liability of the Credit Union. The Credit Union carries Bond and Insurance to protect the Board in 

the case a matter of liability arises; and may also enter into indemnification agreements. 

However, there are some circumstances under applicable laws where such coverages may not 

be sufficient or unavailable, such as where a Board Member commits a criminal act. It is 

recommended that an applicant consult with such persons as he or she feels appropriate to 

further assess this consideration. 

2. It is the intent of the Credit Union to do a credit check on all potential candidates; obtain and/or 

furnish information concerning your credit affairs to any association, firm, corporation or 

personnel office; check your employment and credit history; and to obtain credit reports in 

connection with this application. This may also include criminal and other background 

checks/investigations. 

3. All application information is confidential and will stay at the Credit Union. If you request, the 

Credit Union will tell you the name and address of any credit bureau from which it received a 

credit report on you. 

4. If you are selected as a candidate, you will be required to attend a formal interview with the 

Board and/or the Nominating Committee. 

FULL NAME (First / Middle/ Last): 

HOME ADDRESS: 

SOCIAL SECURITY NUMBER: 

WORK NUMBER: 

CELL NUMBER: 

HOME NUMBER: 

EMAIL: 



8

Please answer the following questions in the spaces provided (attach additional sheets, if 

necessary): 

1. Why do you want to serve as a member of the Board of Directors of the Credit Union? 

2. Have you ever been a member of a Board or governing body of any organization? 

3. What do you see as your responsibilities as a member of the Credit Union’s Board of 

Directors? 

4. What expertise and skills do you have that are related to a financial institution? How do you 

see these skills being of value to the Board's activities and responsibilities? 

5. Describe your present job. Is there a potential conflict of interest with the confidential aspects of the Credit 

Union and your job and other activities in which you may be involved? Explain. 

Pleaser Deliver this Application To: 

INSERT NAME OF CREDIT UNION 

NOMINATING COMMITTEE 

INSERT ADDRESS 

By: INSERT DATE 

SIGNATURES, CONSENTS AND AGREEMENTS: 

By signing below I agree to fully comply with all laws, rules, regulations and the Credit Union’s 

Bylaws, as may be amended from time to time. I certify all information provided is true and 

correct. I consent that the Credit Union or its Board and/or Committees may undertake to verify 

information provided; and I authorize the Credit Union to obtain information concerning my credit 

history, including any credit reports and all other investigations noted in this application or 

otherwise as deemed appropriate by the Credit Union and/or its Board/Nominating Committee. I 

agree that if elected I may be removed from the Board or any Committee by a majority vote of the 

Board if the Board determines in its sole discretion that: (1) I have a conflict of interest in serving 

as a Board Member, for any reason whatsoever (and that the merest appearance of any conflict 

or impropriety is the standard that shall apply in such determinations); (2) I fail to perform my 

duties pursuant to the Credit Union’s Bylaws; (3) I do not in all respects comply with all laws, 

rules, regulations and governmental requirements; or (4) if the Board determines such action to 



9

e in the Credit Union’s best interests. This Agreement shall be governed by and interpreted 

consistently with the Insert your state here laws. Except as provided herein, no amendment or 

waiver in the provisions of this Agreement shall be effective unless in writing and signed by the 

parties. No failure on the part of the parties to exercise, and no delay in exercising, any right shall 

preclude any other or further exercise of any other right. Should any provision of this document 

be deemed unenforceable by a court of competent jurisdiction, all remaining provision shall 

remain valid and binding. 

Further, I understand that all information provided to me in connection with service as a board 

member or in any other capacity with the Credit Union shall at all times be absolutely confidential. 

I represent and warrant that I shall not disclose such information, documentation, data, etc., 

absent a requirement to do so per a valid legal order or other valid legal process. I agree to be 

fully liable for all damages should I violate this promise. I agree to entry of an injunction against 

such disclosure or further disclosure if I should in any way violate this promise. I further agree that 

I shall personally pay all damages and court costs and attorney’s fees associated with any action 

the Credit Union or any employee or Credit Union volunteer may undertake as a result of my 

breach of this promise. 

SIGNATURE: 

DATE: 

Segregation of Duties 

GENERAL CONCEPT 



10

MULTIPLE ISSUES AND RESOURCES – SOME EXAMPLES: 

Chapter 4 – NCUA Examination Guide -- INTERNAL CONTROLS 

Examination Objectives 

Associated Risks 

DATE: June 25, 1996 

LETTER NO.: 96-CU-4 

. NCUA LETTER TO CREDIT UNIONS 

NATIONAL CREDIT UNION ADMINISTRATION 

1775 Duke Street, Alexandria, VA 22314 

TO ALL FEDERALLY INSURED CREDIT UNIONS: 

SUBJECT: INTERNAL CONTROL STRUCTURE 

We are sharing the results of NCUA's review of the 1995 fraud and embezzlement cases with 

credit union officials so that you can use the results to review your internal control structure and 

make needed adjustments. Credit unions with limited staff are often at risk of fraud and 

embezzlement because the critical work is done by few people. 

Fraud and Embezzlement Study. Our study involved seven credit unions in which fraud and 

embezzlement caused the credit unions to fail and service to be lost to many members. 

We conducted the study to determine common factors and to develop procedures to detect or 

minimize the risk of similar occurrences. Unfortunately, once fraud or embezzlement schemes 

are uncovered, it is often too late to enact corrective measures. Since credit union officials 

provide the first and most important first line of supervision of the credit union's staff and 

operations, we encourage the officials to review their credit union's internal control structure and 

to make adjustments where needed. 

Common Factors. You, as officials, can study these internal control weaknesses that are 

common elements of fraud or embezzlement and make necessary revisions to your credit union's 

internal controls: 

• Lack of board approved policies - for areas such as lending, investing, borrowing, and 

operating expenses; 



11

• Lack of segregation of duties - concentrating the control over all phases of a transaction 

in one dominant controlling manager, often a single person operation; 

• Lack of mandatory vacation policy - embezzlements usually require the embezzler's 

ongoing attention; therefore, policies that require managers and employees to take at least 

one and preferably two weeks' vacation (not a day here and there) reduce the risk of 

embezzlements; 

• Failure to maintain adequate audit trails - audit trails enable the tracing of any given item 

through the credit union's books; 

• Incomplete or inadequate audits or verifications - audits (required at least annually) and 

verifications (required at least every two years) must be performed in a timely manner, 

under controlled conditions, and independent of credit union management and staff; 

• Inactive supervisory committees - the committee is the most important single element in 

the internal control structure; 

• Repeated record keeping problems - inaccurate or incomplete records are often used to 

hide fraud; 

• Manipulated bank reconcilements - hides problems from casual review; 

• Failure to review standard computer reports; 

• Fictitious loan or share accounts; 

• Concealment of embezzlement using corporate credit union accounts - the nature of 

corporate transactions is numerous large amounts, therefore, a casual review may not 

detect fraud; 

• Cost of funds far exceeding average stated dividend rates; 

• Yield on loans far less than stated loan rate in credit unions with low delinquency; 

• Yield on investments well below the coupon rates; and 

• Excessive and unexplained operating expense ratio. 

Alternative Testing Procedures. Fraud and embezzlement schemes are not solely a problem of 

larger credit unions. In fact, the very size of small credit unions creates opportunities for a weak 

internal control structure and fraud. Officials of smaller credit unions must work within their 

organizations to develop methods that will safeguard their members' accounts and reduce the 

opportunity for fraud. Suggested reviews and alternative testing methods that the supervisory 

committee members or someone independent of the credit union staff should perform include: 



12

• Review of the negative shares report; 

• Review of unposted items report; 

• Review of maintenance reports showing loan due date changes - unwarranted changes to 

loan due dates may disguise a fictitious loan or loans not receiving regular payments; 

• Review of reports showing loans by interest rate - reveals unusually low loan rates; 

• Review of general ledger suspense accounts - generally used to temporarily "store" a 

transaction until all necessary information is available, but can also be used to hide an 

unauthorized transaction; and 

• Review of the reconciliation of cash receipts to cash deposits - daily receipts should be 

promptly deposited in amounts readily traceable to the bank deposits. 

Conclusion. Credit union officials are responsible for implementing a system of sound internal 

controls and for ensuring that the controls are regularly followed by management and staff. 

Although fraud may be uncovered, the annual audit and regulatory examination are not intended 

to detect fraud. 

The purpose of internal controls is not to entrap employees; rather, good internal controls 

provide a working environment in which good employees are not tempted to do something they 

would not ordinarily do. In smaller credit unions, the supervisory committee often oversees the 

internal controls, while in larger credit unions, the controls are often monitored by the internal 

auditing department. Credit unions that initiate and consistently follow basic internal controls are 

less likely to experience fraud and embezzlement than credit unions whose internal controls are 

weak. 

Real Life: 

June 4, 2004 

Robert Teachworth, President and CEO 

Denali Alaskan Federal Credit Union 

3400 Latouche 

Anchorage, Alaska 99508 

Re: Authority of FCU Board of Directors to Approve Loans. 

Dear Mr. Teachworth: 



13

You asked about the authority of a federal credit union’s (FCU’s) board of directors to approve 

loans and when and how the board could approve loans that are outside the loan approval 

authority delegated to the FCU’s loan officers or credit committee. Our thoughts, including some 

options available to the board, follow. 

The FCU Act states that “loans must be approved by the credit committee or a loan officer . . . . ” 

12 U.S.C. §1757(x). Generally, if a credit committee or a loan officer does not consider a loan 

application first, an FCU’s board of directors may approve a loan only if the FCU Act provides 

specific authority for the board to act on that type of loan. For example, an FCU’s board must 

approve loans to directors or supervisory or credit committee members exceeding $20,000 plus 

pledged shares. 12 U.S.C. §1757(iv). 

We understand that an FCU’s board may not want to delegate the authority to approve every type 

of loan or may want to be involved in the decision-making on some loans, such as loans that are 

part of a new area of lending for the FCU or particularly large loans. An FCU may, consistent 

with the FCU Act, restructure its lending processes in various ways to increase its board’s 

involvement. For example, if its bylaws provide for a credit committee, an FCU board could 

appoint itself or some of its members to serve as the FCU’s credit committee. FCU Bylaws 

(10/99), Article VIII, Option 1. Alternatively, an FCU could modify its lending policies to create 

two levels of review and approval for certain loans: first, by a loan officer or credit committee, 

and, second, by the board of directors or a committee consisting of directors. 

We caution that FCUs must comply with the various statutory and regulatory requirements for 

lending, including the experience requirements placed on member business lending. 12 C.F.R. 

§723.5(a). We also caution that FCUs may only make loans as provided in their written lending 

policies. Id.; 12 C.F.R. §701.21(c)(2). An FCU that provides an expanded role for its board in the 

lending process must ensure that the authority of all persons involved in lending, including the 

board or a committee of board members, is described in those policies and that the FCU 

maintains proper segregation of duties. Lending policies must also be designed and implemented 

to ensure that an FCU does not make loans on an ad hoc basis or in an arbitrary fashion, but in 

accordance with the limits and criteria of its written lending policies. 

Sincerely, 

Sheila A. Albin 

Associate General Counsel 

OGC/PMP:bhs 

02-0737 

Purpose and Scope of the IT Security Compliance Guide 

This IT Security Compliance Guide1 is intended to help credit unions2 comply with the Interagency 

Guidelines Establishing Information Security Standards (NCUA Rules & Regulations, Part 748, 

Appendix A&B). The guide summarizes the obligations of credit unions to protect information, and 



14

illustrates how certain provisions of the National Credit Union Administration Rules and 

Regulations, Part 748, Appendix A & B (Security Guidelines) apply to specific situations. The 

appendix lists resources that may be helpful in assessing risks and designing and implementing 

information security programs. 

- Dual control procedures, segregation of duties, and employee background checks for employees 

with responsibilities for, or access to, member information; 

LINES OF COMMAND AND INSURING THE COMMAND STRUCTURE 

AND PLANNING 

Examination Standards and Surviving Regulatory 

Assessments 

A. The Reality About those who Examine Us 

B. Documentation Standards: 

SAMPLES: 



15

SAMPLE MINUTES 

Initial Board or Designated Committee of Board Adoption of Red Flags 

Assessment and Credit Union Red Flags Policy/Procedures – 12 CFR 717.90 

Drafting Notes are in RED --- Add/Revise to Minutes or by way of a resolution (Example – Craft 

to suit adoptions and/or future revisions as needed): Who must approve the Assessment and the 

Policy/Procedures: 12 CFR 717.90(e) requires [“Each federal credit union must] … (1) Obtain 

approval of the initial written Program from either its board of directors or an appropriate 

committee of the board of directors. 

__________________________ (name of person or committee) the 

__________________________ (Officer such as Manager, CEO, Compliance Officer, etc., or 

describe committee) presented the Credit Union’s risk assessment of “covered accounts” 

described in 12 CFR 717.90(b)(3)(ii), taking into consideration: (1) The methods it provides to 

open its accounts; (2) The methods it provides to access its accounts; and (3) Its previous 

experiences with identity theft. The Board/Committee has received appropriate training and 

information on the Credit Union’s duties and obligations regarding the detection, prevention, and 

mitigation of identity theft in order to properly assess the issues set forth herein; and to approve 

of the Credit Union’s Policy/Procedures. 

Approval of Assessment of “Covered Accounts.” The Board/Committee approves the Credit 

Union’s risk assessment as presented and finds it to be appropriate pursuant to the size and 

complexity of the Credit Union and the nature and scope of the Credit Union’s activities. 

Approval of the Credit Union’s Identity Theft Prevention Program. The Board/Committee 

approves of the Credit Union’s Policies and Procedures dated as of the date of this resolution and 

finds that the Policies and Procedures: 

(1) Identify relevant Red Flags for the “covered accounts” that the Credit Union offers or 

maintains, and incorporates said Red Flags into its Policies/Procedures; 

(2) Provide for appropriate methods/procedures to detect identified Red Flags that have been 

incorporated into the Policies/Procedures of the Credit Union; 

(3) Provide Procedures to respond appropriately to any identified Red Flags that are detected 

pursuant to the Credit Union’s Policies/Procedures; and 

(4) The Credit Union’s Policies/Procedures provide for appropriate periodic auditing, 

assessment and updates to reflect changes in risks to members and the Credit Union as 

appropriate to the risk assessment and the safety and soundness of the Credit Union 

relating to or arising from potential identity theft. 

(5) Provide proper controls and assessment of third parties including Credit Union vendors 

and service providers pursuant to these policies and the Credit Union’s Vendor 

Management Policies/Procedures. 

The board of directors approved the Identity Theft Risk Assessment and the Credit Union’s 

Policies/Procedures this ______________________. 



16

SAMPLE CREDIT UNION BUSINESS PLAN 

Most of this Plan is Omitted 

Management Plan — Directors and Officers 

A. Provide the number of organizers and/or directors. Provide a list of board committees 

and a brief explanation of the responsibilities of each committee. 

B. Describe the organizational structure and provide an organizational chart, indicating 

the number of officers and employees. Describe the duties and responsibilities of the 

senior executive officers. Describe committees that are or will be established. 

C. Discuss the credit union’s plans to address management succession, including a 

management training program. 

Financial Management Plan 

A. Capital and Earnings 

1) Discuss the capital goals and the means to achieve them. Include amount of 

ownership shares purchased by each provisional director, and the anticipated total 

amount of ownership share capital as of the formation of the credit union. 

2) Discuss the earnings goals in terms of return on assets, net interest margin, or other 

profitability measurements, and summarize the strategies to achieve those goals. 

3) Discuss the plan for raising capital and for financing growth, with particular emphasis 

on conformance with regulatory capital requirements. 

4) Discuss the adequacy of the proposed capital structure relative to internal and 

external risks, planned operational and financial assumptions, including technology, 

branching, and projected organization and operating expenses. Present a thorough 

justification to support the proposed capital. 

B. Liquidity and Funds Management 

C. Sensitivity to Market Risk 



17

D. Credit Risk 

Monitoring and Revising the Plan 

Financial Projections 

A. Provide financial information for opening day pro forma and quarterly projections for 

the three years of operations. Also provide annual totals for the Income Statement. The 

line items in the financial statements should be consistent with the Consolidated 

Reports of Condition and Income so that projected items may be compared 

conveniently with actual performance. 

1) Describe in detail all of the assumptions used to prepare the projected statements, 

including the assumed interest rate scenario for each interest earning asset and interest 

costing liability over the term of the business plan. Also present a thorough justification 

to support proposed capital. 

2) Provide the basis for the assumptions used for noninterest income and noninterest 

expense. Indicate the amount of lease expense, capital improvements, and furniture, 

fixtures, and equipment, including systems and equipment upgrades. 

3) Describe the assumptions for the start-up costs, volumes, expected returns, and 

expected time frame to introduce each new product and service. 

B. Discuss how the credit union used marketing studies or surveys to support the 

institution’s projected growth. 

C. Discuss the level of marketing expenses necessary to achieve the projected market 

share for both loan and deposit products. 

D. Provide a sensitivity analysis of the financial projections. A sensitivity analysis 

provides a realistic stress test of the major underlying assumptions used in the business 

plan and the resultant financial projections. 

For example, adjust the financials to reflect the effects of adverse changes in the 

interest rate environment, changes in the asset/liability mix, higher than expected 

operating expenses, marketing costs, and/or growth rates. 

SAMPLE EMPLOYMENT AGREEMENT 

Most of this Agreement is Omitted 



18

EMPLOYMENT AGREEMENT 

Revise to address Position and Terms as needed. 

EMPLOYMENT AGREEMENT (“Agreement”), made this ____ day of ______, 

______, between XXXXXXXXXXXXXXXXXXX, South Carolina, ("Executive") and 

XXXXXXX Credit Union, a federally / state chartered Credit Union with principal offices 

located at XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (“Employer” or “Credit 

Union”). 

RECITALS: 

WHEREAS, Employer is a Credit Union organized and operating under the laws of the 

United States of America; and 

WHEREAS, Employer and Executive wish to enter into the Agreement to employ 

Executive as President and Chief Executive Officer of Credit Union; and 

WHEREAS, Employer and Executive wish to reduce to writing their entire agreement 

and understanding with respect to Executive’s employment, 

NOW, THEREFORE, in furtherance of the foregoing recitals, and the mutual covenants 

contained herein, and for other good and valuable consideration, the receipt and sufficiency of 

which are hereby acknowledged, Employer and Executive agree as follows: 

TERMS AND CONDITIONS 

SECTION ONE 

Employment. Employer agrees to employ Executive as its President and Chief Executive 

Officer (“CEO”), and Executive accepts such employment subject to the terms and conditions 

of this Agreement. 

SECTION TWO 

A. Duties. During the term of this Agreement, Executive shall report to, and perform such 

duties as are assigned by, Employer’s Board of Directors (“the Board”), acting through its 

Chairperson or delegated representative or committee. All duties shall be in accord and 

compliance with applicable federal and state laws, regulations, NCUA orders, letters and other 

binding guidelines together with “industry standards” applicable to a Federal Credit Union. It is 

intended that the Executive’s duties shall generally include those tasks and responsibilities 

customarily assigned to one holding the position of President and CEO in a financial institution 

of similar size and character. Specifically, Executive’s duties shall include, but not be limited to: 

1. Understand the philosophy of “creating financial security for you and your 

family” and applying this Credit Union Mission Statement throughout daily 



19

activities; while at al times operating the Credit Union in a safe and sound manner 

that is compliant with the parameters set forth in A, above. 

2. Direct all Credit Union operations, which include planning, recommending and 

implementing programs and policies and providing general administrative 

direction. 

3. Analyze work flow of the Credit Union on a continuous basis and make changes 

to improve efficiency and reduce cost. 

4. Assist the Board of Directors with the creation of, or changes to, the policies of 

the Credit Union. 

5. Implement Board policies and develop such procedures as may be required to 

insure compliance with the parameters set forth in A, above; or as may deemed 

necessary or appropriate to insure the implementation of all Board Policies that 

comply with said parameters. 

6. Ensure the completion and accuracy of all accounting records financial reports, 

including federal and state regulatory reports. 

7. Work with the Board of Directors in developing a strategic plan of action, to 

ensure the long-term success of the Credit Union, while ensuring that the 

membership’s financial interest is best served. 

8. Ensure compliance with the Credit Union’s charter, bylaws, policies and 

procedures, and adherence to all applicable federal, state and local laws, 

regulations and ordinances. 

9. Recruit, hire and fire as may be deemed necessary and appropriate to accomplish 

the goals set forth herein; or as required to meet the future needs and/or goals of 

the Credit Union; and to select quality applicants for management vacancies, 

ensuring that the Credit Union is adequately staffed with competent employees. 

10. Oversee the development of all Credit Union resources, including labor, technical, 

and related assets, to meet the objectives set forth for the Credit Union. 

11. Be responsible for the successful operation of all Credit Union facilities, and to 

recommend the acquisition or enhancement of such assets that would ensure such 

success. 

12. Establish and maintain effective employee relations, and foster a work 

atmosphere that promotes teamwork and a positive image to all who come into 

contact with the Credit Union. 



20

13. Evaluate the job performance of Credit Union management to ensure quality of 

work and service to members. 

14. Keep abreast of economic, regulatory, or industry changes which may affect the 

Credit Union. Inform the Board of Directors regularly of such changers and of 

their impact on the membership and on the financial condition of the Credit 

Union. 

15. Attend Board meetings and report on the activities of the Credit Union. Make 

periodic progress reports concerning strategic plan and budget status. Maintain 

effective and timely communications with the Board of Director’s Chairman. 

16. Be responsible for the planning, development, and implementation of products, 

services, and procedures as a means of achieving the goals and objectives set forth 

by the Board of Directors. 

17. Support and volunteer for Credit Union sponsored community activities. 

18. Analyze data pertaining to the assets and liabilities of the Credit Union, including 

the monitoring of the loan and investment portfolios, key performance ratios, in 

order to obtain maximum return at minimal risk. Discuss data with the Board of 

Directors and make recommendations on best course of action in relation to 

achieving the overall goals and objectives established by the Board of Directors. 

19. Conduct business development activities as a way to promote growth and 

development of the Credit Union. 

XXXXXXXXXXXXXX 

20. Perform any additional duties prescribed from time to time by the Credit 

Union’s Board of Directors or which may be required by circumstance. 

SECTION THREE 

A. Term. The term of this Agreement shall be three (3) years [with each “year” being 

calculated on the basis of 365-days], commencing on or before the date first stated herein, unless 

earlier terminated pursuant to the terms of this Agreement. 

B. Renewal. 

1. This Agreement shall automatically renew for one additional term of one year in 

duration under the same terms contained herein unless, at least 180 calendar days 

prior to the expiration of the initial term or any renewal terms hereunder, the 

Credit Union notifies Executive in writing of its intent not to renew this 

Agreement. This automatic renewal is limited to two renewals. Prior to the 

commencement of any renewal terms hereunder, the parties hereto may enter into 



21

XXXXXXXXXXXXXX 

alternate renewal terms by amendment hereto addressing such amend terms 

and/or conditions as the parties may agree to. Should the parties not be able to 

agree to renewal terms, then the renewal terms for one year each herein shall 

govern as the default renewal terms and conditions. 

SECTION EIGHT 

Termination of Agreement. This Employment Agreement may be terminated prior to its 

expiration under the following circumstances: 

1. By Employer for Cause. Notwithstanding any other provision in this 

Agreement, Employer may terminate Executive’s employment “for cause,” if, in 

the Board’s sole discretion, excluding the vote of Executive if Executive is then 

serving on the Board, the Board determines, by a majority vote, that “cause” 

exists for termination. “Cause” shall include, but not be limited to, any one or 

more of the following in connection with the Executive’s duties to the Credit 

Union hereunder: 

a) illegal acts; 

b) gross and willful insubordination; 

c) proven or admitted breach of confidentiality prohibited by applicable law 

or agreement; 

d) revocation or impairment of bond eligibility; 

e) repeated failure or refusal to comply with official policies and procedures 

pursuant to the parameters set forth in Section Two. A herein; 

f) failure or refusal to perform the terms of this Agreement, or to achieve 

previously agreed upon goals as set forth herein, provided that Executive 

has been given a sixty day notice to cure such deficiencies and has failed 

or refused to comply with said notice; 

g) dishonesty, including false or deceptive statements or reports to the Board, 

the Supervisory Committee or examiners; or 

In the event this Agreement is terminated for cause, Employer may elect to 

terminate Executive’s duties immediately and without notice. In such event, 

Executive shall be entitled to all compensation earned or accrued to the date of 

termination in accordance with the applicable policies of Employer, but nothing 

more absent any requirements of federal or state laws such as COBRA. Executive 

is not entitled to any severance or any benefits if terminated for cause. 



22

2. By Employer For No Cause. Employer may elect to terminate this Agreement 

“for no cause” at any time prior to its expiration upon a 2/3 vote of the Board. 

Assuming no basis for cause exists under paragraph A (1) above, Employer may 

elect to either provide Executive with written notice of its intent to terminate and 

the intended termination date, or terminate this Agreement and Executive's duties 

immediately. In either case, Executive shall be entitled to all compensation 

earned or accrued to date in accordance with the applicable policies of Employer, 

together with a lump sum payment equal to six months of pay, payable in full at 

the time of termination together with the benefits set forth in Section Six A.2, A.4, 

and A.5. Further, in the case of termination for no cause the Credit Union shall 

continue to pay the Executive’s compensation and the benefits set forth herein for 

an additional period of up to ___ additional months based on the following 

conditions: (1) the Executive is seeking alternate commensurate employment in 

good faith; and (2) is not able to secure such alternate commensurate employment 

for a period of up to twelve additional months. 

3. By Executive. Executive may terminate this Agreement at any time by resigning. 

In such event, Employer may either permit Executive to remain throughout the 

notice period given by Executive, if any, or terminate the Agreement without 

further notice. A resignation by Executive, for severance purposes, shall be 

treated as if it were a termination for cause under paragraph A (1) of this section. 

4. By Employer Due To Executive’s Disability. Employer shall have the right to 

terminate this Agreement in the event any illness, disability, or loss of capacity 

which prevents Executive from performing the essential functions of his position 

as President and Chief Executive Officer of the Credit Union for three 

consecutive months or more. Assuming no basis for cause exists under paragraph 

(1) of this section, a termination pursuant to this paragraph shall be treated as a 

termination for no cause under paragraph (2) of this section. 

5. By Mutual Consent. This Agreement may be terminated at any time by mutual 

written consent under terms negotiated by the parties at the time. 

SECTION NINE 

Confidential Information. Executive acknowledges that the business and financial affairs of 

Credit Union and its members constitute confidential information. Accordingly, Executive shall 

not, during the term of this Agreement or at any time thereafter, impart to any person, 

corporation, organization or other entity any confidential information acquired by Executive in 

the performance of Executive's duties under this Agreement, except as legally permitted by 

Employer’s policies or under compulsion of law. 



23

Vendor Due Diligence from a Regulatory and Common 

Sense Perspective 

The Ways of Credit Unions 

“Pretty People” 

Numbers 

Incentives – Why and 

Long Term Effects 

Vendor Due Diligence I 

A. NCUA and FFIEC Guidelines or Requirements (See NCUA 

Letter Nos: 00-FCU-11; 07-FCU-13; 01-CU-20; and 08- 

FCU-09 as applicable) 

**POLICIES AND PROCEDURES ** 

Step One: Needs Assessment and Basic Due Diligence 

Queries (who, what, where ….) 



24

Vendor Due Diligence II 

Security Assessment of a Vendor 

If applicable, has the Vendor provided 

their SAS-70; ISO 17799 or other 

compliant Independent assessment of 

technology, data and information 

security systems and compliance to 

the Credit Union? 

Is there any basis for concern based 

on such report(s)? 

Vendor Due Diligence IV 

D. The Big Deal About the Contract: 

Is Your Credit Union in 

Love? 

The “Pre-Nup” 

Before – During --After! 



25

Vendor Due Diligence IV 

D. The Big Deal About the Contract: 

Is Your Credit Union in 

Love? 

The “Pre-Nup” 

Before – During --After! 

Vendor Due Diligence V 

Matters to Address: 



26

Vendor Due Diligence VII 

TERM AND TERMINATION. 

Vendor Due Diligence VIII 

Penalty Provisions 



27

Information Security Laws 

15 USC §§ 6801-6809 and 12 CFR §716 /16 CFR §682 

12 CFR §717 

12 CFR §748 

RED FLAGS 

Others: 

Vendor Due Diligence IX 

CU24 agrees that it shall (or in the case of any third 

parties with whom it provides any services to Credit 

Union hereunder will cause such third parties) to fully 

comply with all applicable laws, rules and regulations 

governing privacy and confidentiality of information, 

including but not limited to ********* and to provide 

Credit Union with proof of such compliance sufficient to 

evidence compliance with said laws upon reasonable 

request. 



28

Vendor Due Diligence XII 

 

Background Checks. CUDC shall not knowingly permit any of 

its employees to have access to the premises, records or data 

of Discloser when such employee: (i) uses drugs illegally; or 

(ii) has been convicted of a crime in connection with a 

dishonest act or a breach of trust, as set forth in Section 19 of 

the Federal Deposit Insurance Act, 12 U.S.C. 1829(a). 

Consistent with CUDC employment practices, newly hired 

CUDC employees: ********* 

Vendor Due Diligence XIII 

Conversion and Deconversion ----- 



29

Vendor Due Diligence VI 

Insurance and Due Diligence 

What do they need? What do we 

need? What’s out there? 

Vendor Due Diligence VII 

The Credit Union Has an Obligation to 

Monitor – Follow Up? 



30

Monitoring the Vendor 

At a minimum, the monitoring program should 

over the following: 

• Key service level agreements (SLAs) and contract 

provisions 

• Financial condition of the service provider 

• General control environment of the service provider 

through the receipt and review of audit reports and 

other internal control reviews 

• Potential changes due to the external environment 

What to Monitor: 

Date Notice of Termination or Renewal 

Required 

Assessment of Vendor Performance 

Annual review of the Vendor's 

Financial Condition 

Annual Review of Vendor’s Insurance 

Coverage 

Annual Review of Contingency Plan 

Tests 

Security Testing Verification 



31

Key Components of Passing NCUA, State or Treasury 

Assessments for the Bank Secrecy Act 

HISTORY OF LAWS AND REGULATIONS 

The BSA was enacted in October 1970. Pursuant to the authority granted to it under the act, the 

United States Department of the Treasury adopted a regulation implementing its provisions, 

effective in July 1972. A separate law, known as the Currency and Foreign Transactions 

Reporting Act, was enacted in September 1982, and the Treasury Department amended its 

regulation to incorporate the requirements of this second act. 

The BSA was further amended by the enactment of the USA PATRIOT Act in 2001. This act is 

intended to further deter money laundering and is particularly aimed at preventing the transfer of 

funds intended for use in terrorist activities. The act tightens recordkeeping and reporting 

requirements and permits financial institutions to share information with one another in order to 

better identify and report to the federal government concerning activities that may involve 

money laundering or terrorist activities. All three of these acts are considered together under 

the popular name Bank Secrecy Act (BSA). 

PURPOSE AND SCOPE 

Congress recognizes that records maintained by “banks” have a “high degree of usefulness in 

criminal, tax, and regulatory investigations and proceedings.” The purpose of the BSA is to 

require financial institutions to maintain such records and to report transactions that they find 

have such a high degree of usefulness. The USA PATRIOT Act extends these purposes, aiming 

particularly at the financial activities of terrorists. 

APPLICABILITY; EXEMPTIONS 

None Applicable. 

LIABILITY PROVISIONS 

Criminal and 

Potentially Millions $$$$$$$$$. 



32

NOTE: The BSA also contains a “whistleblower” provision in section 5323. A person who 

provides original information that leads to a recovery by the secretary of the Treasury of a civil 

or criminal fine or penalty that exceeds $50,000 may receive an award from the secretary. The 

amount of such an award is at the discretion of the secretary, but with a maximum of 25 percent 

of the amount collected (up to a maximum of $150,000). 

THE FIRST STEP: 

It is All About the Assessment and Due Diligence: 

92-2006: Community Plan Notice // Revisions to Bank Secrecy Act Examination 

Manual -- Revised (Issued July 28, 2006) 

Review Risk Assessment Worksheets and Methodology: 

READ FFIEC BSA-AML Manual 

DOCUMENT YOUR RISK ASSESSMENT 

BSA Assessment Tools Subfolder 

B1- Risk Assessment -- General Assessment Tool (9-2008) 

B2- Risk Assessment -- Q & A 

B3- Risk Assessment -- High Risk Entities 

B4- Risk Rating Guide for High Risk Entities 

B5- High Risk Checklist Tool 

FILE SUSPICIOUS ACTIVITY REPORTS 

Guidance on Properly Filing and Documenting SARs 

The Credit Union should be familiar with and follow the guidance in the following 

resources: 



33

http://www.ncua.gov/reg_alerts/2007/07-RA-05.pdf 

http://www.ncua.gov/reg_alerts/2007/07-RA-09.pdf 

Also Review the Following if the matter involves “Mortgage Fraud:” 

http://www.ncua.gov/letters/2008/CU/08-CU- 

10FinCEN%20Mortgage%20Report%20040408%20LCU.pdf 

http://www.ncua.gov/letters/2008/CU/08-CU-12.pdf 

Question: What are the rules for reporting SAR filings to the Board of Directors? 

Answer: Each federal regulator has its own specific rule on reporting SAR filings to a financial 

institution's board (or designated committee). You should review the regulatory provision that 

applies to your institution. The citations are: 

• OCC: 12 CFR 21.11(h) 

• FRB: 12 CFR 208.62(h) 

• FDIC: 12 CFR 353.3(f) 

• OTS: 12 CFR 563.180(d)(9) 

• NCUA: 12 CFR 748.1(c)(4) 

Perhaps of more value is this excerpt from page 68 of the 2007 FFIEC BSA/AML Examination 

Manual: 

Notifying Board of Directors of SAR Filings 



34

(5) Confidentiality of reports. SARs are confidential. Any credit union, including its 

officials, employees, and agents, subpoenaed or otherwise requested to disclose a SAR 

or the information in a SAR must decline to produce the SAR or to provide any 

information that would disclose that a SAR was prepared or filed, citing this part, 

applicable law, for example, 31 U.S.C. 5318(g), or both, and notify NCUA of the 

request. A credit union must make the filed report and all supporting 

documentation available to appropriate law enforcement authorities and its 

regulatory supervisory authority upon request. 

RTS Note on Appropriate Law Enforcement Agencies 

Credit Unions are now required to disclose documentation supporting the filing of a Suspicious 

Activity Report to “appropriate law enforcement agencies” upon request. (The Banking regulators 

have defined this further as “federal, state or local law enforcement agencies and I feel relatively 

safe in following this lead). The regulation does not go further to provide Credit Unions with a free 

hand to share a SAR, or the information contained therein, with law enforcement agency absent 

such a request. As a general rule of thumb, an “appropriate law enforcement agency” is any 

agency that has jurisdiction under federal or state law to investigate or prosecute any person or 

entity involved in the transaction reported on the Suspicious Activity Report. If you have 

questions on a case by case basis, consult with your legal or compliance adviser. 

NOTE: Various OCC and OTS Advisory Letters (See for Example OCC AL 2001-4) indicate that a 

Credit Union is to file the SAR and report certain crimes to law enforcement. Reporting and 



35

providing local law enforcement the SAR prior to “REQUEST” are two different concepts. To the 

extent that this distinction causes you any heartburn, discuss the issue with your legal adviser on 

a case-by-case basis as needed. 

(6) Safe Harbor. Any credit union, including its officials, employees, and agents, that 

makes a report of suspected or known criminal violations and suspicious activities to 

law enforcement and financial institution supervisory authorities, including supporting 

documentation, are protected from liability for any disclosure in the report, or for failure 

to disclose the existence of the report, or both, to the full extent provided by 31 U.S.C. 

5318(g)(3). This protection applies if the report is filed pursuant to this part or is filed on 

a voluntary basis. 

MAINTAIN A BSA COMPLIANCE PROGRAM 

Policy Matters: 

Policy Area 

The Bank Secrecy Act including Currency Transaction Reporting and 

Monitoring High and Medium Risk Accounts. 

The USA Patriot Act and “Member / Customer Identification” 

Suspicious Activity Reporting 

Anti-Money Laundering Policy 

Full 314(a) Policies 

Office of Foreign Asset Control Act 

Customer Due Diligence Policies 

Procedure Matters: 

Regulatory Compliance Areas 

Independent Testing 

Training for all Applicable Persons 

Customer Identification Procedures 

Designation of BSA Officer and Delegation Issues 

Internal Controls and Day to Day Monitoring 

Sign Posting 



36

PRIVACY – INFORMATION SECURITY 

Privacy and Information 

Security 

Scope of Concern 

Written Correspondence 

E-Mail 

Voice MailInformation posted or submitted on or 

through the Internet or our internal Intranet 

FAX transmissions 

Telephone conversation 

Business meetings 

Presentations 

Wires and ACH transactions 

Scratch Paper, “sticky notes” 


Security 

Security Breaches 



37


Security 

Documentation 

Credit Union Policies 

Proper Requests and Credit Union 

Response Procedures 


Security 

Reactions to Claims of Privacy or 

Security Breach 



38

Disposal of Consumer 

Reports and Other Records 

Any confidential, personal credit information 

on any and all customers must be 

destroyed in an approved manner. 

Follow the Rules and No Shortcuts! 

THE ACTUAL RED FLAGS -- CREDIT 

UNION RED FLAGS POLICIES 

CONSIDERATIONS 

OFTEN OVERLOOKED 



39

Reg Flag Examples 

NOTICE FROM CONSUMER OR 

LAW ENFORCEMENT AGENCIES 

• Notification by consumer, victim, law 

enforcement, or other that FNBT has 

opened ID Theft related account. 



40

Compliance Update - II 

REGULATORY AND COMPLIANCE ISSUES AND CONSIDERATIONS FOR CREDIT 

UNION EXECUTIVES 

Michigan Credit Union League 

Sherpy & Jones P.A. 

POST OFFICE BOX 2599 


CREDIT UNION RESOURCES AND EDUCATIONAL SERVICES, LLC (“CURES”) 

104 PENINSULA DRIVE 

PEACHTREE CITY, GA 30269 

770-631-3527 

STREET ADDRESS FOR DELIVERIES: PHONE: (803) 356-3327 

129-B EAST MAIN STREET FAX: (803) 356-3591 


RTS@SHERPY-JONES-LAW.COM 

WEBSITE: SHERPY-JONES-LAW.COM 

COPYRIGHT AND NON-REPRESENTATION. Copyright© 2010 by Sherpy & Jones, P.A.. All rights reserved. 

These materials are designed to provide thorough, timely and accurate information regarding the topics 

addressed. These materials are distributed with the understanding that R. Todd Sherpy nor Sherpy & Jones, 

P.A, are not rendering legal or other professional advice, and these materials should not be relied upon or 

substituted for such advice. Any questions or issues addressed, discussed, or in any way posed shall be addressed 

within the scope of the presentation, but are not in any way intended to serve as legal advice or representation 

whatsoever. If the recipient of these materials needs legal or professional advice, an appropriate professional 

should be consulted. You may engage us to provide these services; however, no such relationship shall exist 

absent a formal written agreement between us and the participant or the participant's Credit Union. These 

materials may not be reproduced in whole or in part, in any form whatsoever, without the express written 

permission of R. Todd Sherpy and Sherpy & Jones, P.A.

About the Presenter... 

R. Todd Sherpy is a founding partner in the law firm of Sherpy & Jones, P.A. The firm is dedicated to serving 

all legal needs of Credit Unions; and provides day-to-day compliance, compliance auditing, training and 

consulting services to Credit Unions throughout the United States. Todd dedicates a large portion of his time to 

teaching Credit Unions, having made presentations in 43 States and participating as an instructor through 

CUNA & Affiliates Regulatory Compliance, Collections and Credit Counseling, Marketing, Consumer Loan 

Officer and Economics and Investments Schools and Conferences. Todd authored CUNA’s RegTrac 

Compliance Modules on Consumer, Real Estate Lending, and Member Business Lending; CUNA’s 

White Paper on Privacy; CUNA's Guide to Compliance with Revised Article Nine; CSG’s Volunteers 

Achievement Program on Directors’ Liability, and many other Credit Union resources. Todd is General 

Counsel to the South Carolina and consults with several other Credit Leagues on a regular basis. 

CURES and SimpliLend: 1992 Todd developed CURES, LLC., (Credit Union Resources and Educational 

Services) and SimpliLend to serve the compliance/regulatory needs of Credit Unions. CURES includes the 

"Compliance Community Plan" under which Credit Unions are offered audit and/or continuing compliance 

services at a significant saving through cooperative participation in a plan serving the common needs of many 

Credit Union. Under the Plan, the firm and/or CURES now works with approximately 500 Credit Unions in 27 

States. Under this plan, CURES provides participants with secure web access to all electronic policies, 

procedures, notices, updates, explanations, internal training guides, as well as many forms from simple 

collection and bankruptcy documentation to full member account services guides and other forms and day-today 

resources. 

Todd serves on the Credit Union Sub-committee of the American Bar Association, the Operations and 

Supervisory Committee’s of the Credit Union Committee; and chaired the Consumer Law Section for the South 

Carolina Bar. Todd, whose family has a tradition of working with and supporting Credit Unions, then began his 

current practice. Todd is married to the Executive Officer at a Large Georgia Credit Union. Todd has two 

daughters, Caroline and Catherine who he absolutely adores. 

The Largest Credit Unions to whom we provided in the last year include: 

Boeing West Employees Credit Union Mountain America Credit Union Founders Federal Credit Union 

Langley Federal Credit Union State Farm Credit Union Black Hills Federal Credit Union 

Arizona Federal Credit Union Robins Federal Credit Union Elevations Federal Credit Union 

Bankfund Staff Federal Credit Union Sharonview Federal Credit Union SC Federal Credit Union 

Addison Avenue Federal Credit Union 66 Federal Credit Union Centris Federal Credit Union 

Tinker Federal Credit Union American Airlines Federal Credit Union Piedmont Aviation Federal Credit 

Union 

Lake Michigan Credit Union POPA Federal Credit Union Aberdeen Proving Ground Federal 

Credit Union 

Day Met Credit Union Pearl Harbor Federal Credit Union Leaders Federal Credit Union 

SPC Cooperative Credit Union Mid-America Credit Union Association TruChoice Federal Credit Union 

Memphis Area Teachers Credit Union Credit Union of Colorado Atlantic Regional Federal Credit Union 

Smaller Credit Unions to whom we provided in the last year include: 

GHS Federal Credit Union Aberdeen Federal Credit Union Ball State Federal Credit Union 

Bangor Federal Credit Union Bay Gulf Federal Credit Union Central Sunbelt Federal Credit Union 

Community United Federal Credit 

Union 

Delaware First Federal Credit Union Family Advantage Federal Credit 

Union 

Fort Campbell Federal Credit Union Jefferson Financial Credit Union Leaders CU Credit Union 

ListerHill Federal Credit Union Maui Teachers Federal Credit Union Kahului Federal Credit Union 

New Orleans Firefighters Federal Credit Penobscot County Federal Credit Union PortAlliance Federal Credit Union 

Union 

Savannah Postal Federal Credit Union Strategic FCU Tuscaloosa County Credit Union 

We provide or have provided in the last year services to the following non-Credit Union entities: 

CUNA Mutual Insurance, CUNA CPD or Minnesota Mutual Insurance Company, Securian, Inc 

other affiliated companies 

Inc. 

South Carolina Credit Union League North Carolina Credit Union League Hawaii Credit Union League 

Indiana Credit Union League Missouri Credit Union League Maine Credit Union League 

Michigan Credit Union League Florida Credit Union League Virginia Credit Union League 

SD-ND Credit Union League Georgia Credit Union Affiliates The Financial Forms Company, LLC 



2

Introductory Notes: 

Knowing if you are Covered by Sarbanes-Oxley, 

Ethics, NCUA Letter 03-FCU-07 and the Risks of not 

being Covered 

REMINDERS FROM PART I – SET THE BOARD (SO TO 

SPEAK): 

ETHICS AND REGULATORY GUIDELINES 

CONFLICT OF INTEREST/CODE OF ETHICS POLICY - SAMPLE 

Initial Recommendations: (1) Each Credit Union should review and assess 

this item carefully and revise as applicable; (2) Each Credit Union should have 

the matter reviewed by a qualified employment lawyer in each state in which it 

has employees, and revise as needed; and (3) each Cu should consider the 

need to involve legal counsel promptly whenever issues arise under this 

Policy. 



3

In addition, each Credit Union should review NCUA Letter 03-FCU-07 and the Appendix 

thereto with regard to other audit, management and operational considerations. The 

audit function is becoming more and more important with the need to insure an 

thorough and un-conflicted audit process. This ranges from independent to internal 

audit functions. 

Beware of Rubber Stamps or other indicia of activity not strictly within the bounds of a 

thorough and independent process: In the world or Enron, Sarbanes-Oxley and NCUA 

Letter 03-FCU-07 (and the Appendix thereto), the Credit Union should watch out for any 

rubber stamps. A modest example: Under the Am. Bar Association Standards and in 

consideration of the foregoing, we and other attorneys who choose to follow appropriate 

practices, take these issues seriously. This includes responses to Auditor's Inquiry 

Letters. For the last 18-years, we have followed the practice of reviewing our annual 

relations with the Credit Union (or the audit period as noted in the letter), which includes 

reviews of files as needed and interviews with personnel that have handled Credit Union 

matters when we are asked to respond to such letters. This process can take anywhere 

from 1 to 4 hours depending on the client and the scope of the matters we have 

handled. 

(Retainer Clients: This is handled as a part of your annual retainer // Non-Retainer: We 

cap billing at a maximum of .75 hours regardless of the time required). 

In this process we will note any items that fall within the potential loss-contingencies 

applicable per the ABA Statements of Policy as well as any item that we feel necessary 

to accurate disclosure per the considerations noted (while at all time retaining attorneyclient 

privilege). If there is an item that requires disclosure, we will consult with the 

Credit Union before preparing our response. 

You should be aware of these requirements; and perhaps question any "rubber stamps" 

should you become aware of any such possibility. 

Not every item below will apply to every Credit Union. This is intended as a “guide.” 

Specific issues and questions should be discussed with compliance, legal and 

employment advisers as applicable. 



4

I. POLICY AND GUIDELINES Portions Omitted 

ABC Federal Credit Union and any CUSO or Affiliates policies and guidelines 

respecting compliance with the bank bribery statute and conflicts of interest are set out 

below. 

Maintaining a Positive Workplace 

II. ACCEPTING GIFTS MAY BE A CRIME 

It is a federal crime for any representatives of ABC Federal Credit Union or any CUSO 

or affiliates to seek or accept anything of value, for themselves or others, in connection 

with business of ABC Federal Credit Union or any CUSO where there is a corrupt intent 

that such representatives shall be influenced or rewarded related to ABC Federal Credit 

Union or any CUSO business. It is also a crime for anyone (including members, vendors 

and others) to offer or give anything to representatives of ABC Federal Credit Union or 

any CUSO with corrupt intent. 

This is provided in Title 18, section 215 of the United States Code (The Bank Bribery 

Act). Violations are punishable by fines and imprisonment. 

Section 215 applies to all officers, directors, employees, agents or attorneys of ABC 

Federal Credit Union or any CUSO and affiliates. Such persons are referred to below as 

"representatives of ABC Federal Credit Union or any CUSO.”. 

III. POLICY REGARDING ACCEPTING GIFTS 

A. General Policy 

No representative of ABC Federal Credit Union may solicit or accept anything of value 

(except normal compensation or fees) in connection with business of ABC Federal 

Credit Union or information about ABC Federal Credit Union or its business, except as 

provided below. Gifts or benefits may not be solicited or accepted, either personally, or 

on behalf of any other person or entity. 

This policy applies to gifts or favors from: 

1. anyone who is seeking to obtain a loan from ABC Federal Credit Union or any 

CUSO ; 

2. anyone who has or is seeking to obtain business or financial relations of any type 

with ABC Federal Credit Union or any CUSO ; 

3. anyone who has interests that may be substantially affected by decisions or 

actions of ABC Federal Credit Union or any CUSO ; 



5

4. anyone who is seeking to obtain confidential information about ABC Federal 

Credit Union or any CUSO ; 

5. anyone who is attempting to influence or affect any decision or action of ABC 

Federal Credit Union or any CUSO. 

B. Guidelines Regarding Certain Permitted Transactions 

There are many situations in which no harm is done by the acceptance of small gifts or 

favors - as long as there is no corrupt intent either by the giver or the receiver of the 

gifts. Personal gifts or favors may therefore by accepted in the circumstances described 

below, as long as there is no corrupt intent. 

1. BUSINESS LUNCHEONS, REFRESHMENTS. Representatives of ABC Federal 

Credit Union may accept food or refreshments of inconsequential value on 

infrequent occasions in the ordinary course of business at breakfast, lunch, or 

dinner or at other meetings, inspections or visits where such representatives are 

properly in attendance. [Food or refreshments having a value which appears to 

exceed $75 may not be accepted on such occasions unless such provisions are 

approved as provided in Paragraph C.] 

2. TRAVEL ON CREDIT UNION BUSINESS. Representatives of ABC Federal 

Credit Union may accept meals, refreshments, travel arrangements or 

accommodations, or entertainment of reasonable value, in the course of a 

meeting or other occasion attended in an official capacity, the purpose of which is 

to hold bona fide business discussions or to foster better business relations, if the 

expense is such that it would be paid for by ABC Federal Credit Union or any 

CUSO, as a reasonable business expense if not paid for by another party. [No 

one may accept any such arrangements having a value which exceeds $100 per 

day unless they are approved in advance as provided in Paragraph C.] 

3. TRADE MEETINGS, PUBLIC CEREMONIES. Representatives of ABC Federal 

Credit Union may accept modest entertainment, such as a meal or refreshment, 

in connection with widely attended gatherings sponsored by civic, professional or 

trade organizations; or in connection with attendance at public ceremonies or 

other activities where an individual's participation is either unrelated to ABC 

Federal Credit Union or any CUSO ’, business or the individual is attending in his 

official capacity as a representative of ABC Federal Credit Union and the 

entertainment accepted is related to and in keeping with official participation. 

[Food, entertainment or meals having a value of $75 may not be accepted on 

occasions related to ABC Federal Credit Union or any CUSO ’, business unless 

they are approved as provided in Paragraph C.] 

4. HOLIDAY SEASON GIFTS. At holiday seasons when gifts are traditionally given, 

representatives of ABC Federal Credit Union may accept small personal gifts 

from members and others who do business with ABC Federal Credit Union or 



6

any CUSO. [Gifts may not be accepted if their value appears to be more than 

$75.] 

5. GIFTS ON SPECIAL OCCASIONS. Representatives of ABC Federal Credit 

Union may accept gifts of reasonable value related to commonly recognized 

events or occasions, such as a promotion, new job, wedding, retirement, etc. 

[Gifts having a value greater than $75 may not be accepted unless approved as 

provided in Paragraph C.] 

6. PERSONAL RELATIONSHIPS. Representatives of ABC Federal Credit Union 

may accept gifts or other things of value from friends, parents, children or other 

relatives where the circumstances make it clear that the motivation for the gift or 

favor is a personal or family relationship and is unrelated to ABC Federal Credit 

Union or any CUSO ’ business. 

7. CHARITY AND POLITICAL SOLICITATIONS. Representatives of ABC Federal 

Credit Union may solicit or accept gifts on behalf of charitable institutions or in 

connection with political campaigns or similar activities when the circumstances 

make it clear that such solicitations or gifts are unrelated to ABC Federal Credit 

Union or any CUSO, business. 

8. SERVICE AWARDS. Representatives of ABC Federal Credit Union may accept 

civic, charitable, educational, or religious organizational awards for recognition of 

service and accomplishment. [Awards having a value greater than $100 may not 

be accepted unless approved as provided in Paragraph C.] 

9. DISCOUNTS AND REBATES. Representatives of ABC Federal Credit Union 

may accept discounts and rebates on merchandise and services that do not 

exceed those available to other members of the same providers of such 

merchandise or services. 

10. LOANS FROM OTHER INSTITUTIONS. Representatives of ABC Federal Credit 

Union may solicit or accept loans from other financial institutions which make 

loans in the ordinary course of their business on terms available to the general 

public in order to finance proper and usual activities such as home mortgage 

loans. 

11. ADVERTISING MATERIALS. Representatives of ABC Federal Credit Union may 

accept unsolicited advertising or promotional material of reasonable value such 

as pens, pencils, note pads, key chains, calendars and similar. 

C. Transactions Permitted on a Case-by Case Basis 

Gifts and things of value may be accepted in circumstances not described above if they 

are consistent with the bank bribery statute and approved in writing by the Ethics 

Committee. Requests for approval may be made on a case-by-case basis. Persons 



7

equesting such approvals shall submit their requests in writing and shall describe in 

writing all of the facts relevant to the request. Where possible, requests will be 

submitted in advance. If a request is submitted after a gift or favor has been received, 

and the request is denied, then the gift or favor shall be disposed of as directed by the 

Ethics Committee. Written records of all requests and approvals or disapprovals will be 

kept by the Personnel Officer. 

D. Reporting Gifts that Violate the Policy 

Whenever gifts are offered or received that violate this policy, they must be reported to 

the President together with all relevant facts. All such disclosures will be reviewed by 

the Ethics Committee. Contemporaneous written records of all such disclosures will be 

kept by the Personnel Officer. 

E. Disposition of Prohibited Gifts 

If a gift prohibited under this policy statement is received, it should be returned to the 

donor with an explanation. If return is not possible, you should consult the Ethics 

Committee. Depending on the circumstances, any such gifts will be turned over to the 

Ethics Committee or to a charitable institution. When possible, the donor will be 

informed of this disposition. 

F. Reimbursement of Volunteer and Employee “Immediate Family Member” 

Expenses 

It is the policy of Sample Credit Union to reimburse volunteers, officials and employees for 

ordinary, necessary, and reasonable business expenses incurred in the transaction of the credit 

union’s business. Reimbursements will be made by credit union check promptly after the 

expenses have been: 

• Itemized in amount on a properly prepared credit union expense report 

• Properly substantiated by attaching receipts for expenses 

• Approved by the signature an authorized person 

Credit union volunteers, officials and employees are expected to exercise sound judgment in 

distinguishing between comfort and extravagance when incurring expenses. 

Expenditures for transportation, lodging, and meals are examples of ordinary and necessary 

expenses normally incurred in connection with attendance at official Credit Union Functions is 

required. 



8

Conference and Seminar Costs 

Fees for attendance at conferences, conventions, and educational seminars attended by officials 

and employees of Sample Credit Union are to be approved in advance. These fees are not a part 

of this policy. Travel, lodging, and other reimbursable expenses incurred while attending these 

functions are to be submitted for reimbursement on a credit union expense report immediately 

upon return from such an event using the guidelines set forth in this policy. 

Use Of Credit Union Credit Card 

The Credit Union’s corporate credit card is the preferred form of payment for all 

business-related expenses at the credit union and all officials and employees 

who generate regular business expenses on behalf of the credit union should 

participate in its card program. All transportation, car rental, hotel, meal, and 

entertainment expenses should be charged to the corporate card whenever 

possible. The corporate card is for official use only. Use of the Credit Union’s 

Credit Card is otherwise governed by the Credit Union’s Credit Card Policy and/or 

any agreements or condition of the Credit Union associated with such. 

When completing the expense report for reimbursement, the term “business purpose” should be 

indicated on the report. 

Transportation Expense 

When combining business and personal travel, approval must be made in advance and the 

expense report should indicate only those business expenses that are reimbursable. 

When planning business trips, the cost of renting an automobile should be compared to the cost 

of taxis and airport shuttles to determine whether automobile rental is justified. Taxi and airport 

shuttle expenses are reimbursable when used in conjunction with business and receipts (if in 

excess of $10) are attached to the expense report. Parking and tolls require original receipts 

when either exceeds $10 in one day. Automobile mileage for travelers who are required to use 

their personal cars from time to time in the efficient performance of their duties will be 

reimbursed at a rate not to exceed the published IRS reimbursement rate per mile. 

Lodging Expense 

Lodging expenses will be reimbursed when a copy of the hotel charges is attached to the expense 

report. 

Meal Expense 

Personal meals are reimbursable expenses defined as meal expenses incurred when dining alone 

on an out-of-town business trip or when dining with another credit union official while on 



9

overnight business travel. The cost of meals recorded on the expense report should include taxes 

and tip. The cost of each meal is to be reported separately and will be reviewed for 

reasonableness. Receipts and explanations are required for all meals over $10 (including taxes 

and tip). Business meals are defined as meals taken during which, or immediately before or 

after, a specific business discussion takes place. The details of business meals must be 

documented on the expense report. 

Entertainment Expense 

Entertainment is defined as expenses incurred to promote credit union business through the 

entertainment of nonemployee business associates at places such as theaters and sporting events, 

during which, or immediately before or after, a business discussion takes place. Entertainment 

must be detailed on the expense report. Reimbursement under this policy will only be made for 

an entertainment expense for which there is a documented business purpose. The entertainment 

should include only those parties whose presence is necessary to facilitate the business 

discussion. To be reimbursable, the nonemployee business associate’s trade or business and the 

business relationship of the entertainment to the credit union’s business must be clearly shown. 

The entertainment may not be lavish or extravagant. 

Expenditures for selected employees or officials at a general social occasions are not 

reimbursable when the business purpose is lacking or when any personal benefit accrues to an 

individual or group of individuals. 

Compensatory Expense 

Whether reimbursement is taxable to an individual is dependent on whether , under IRS regulations, the travel 

expenses of an “immediate family member” it can be established that his or her presence serves a bona fide business 

purpose. A spouse who attends a function is considered to have a business purpose if he or she has a significant role 

in the proceedings or makes an important contribution to the success of an event. Generally, protocol or tradition 

dictates when the participation of an official's spouse is required at official function. Reimbursed expenses that 

are not for a bona fide business purpose will be added to the employee’s compensation (W-2) as 

earnings. 

“Immediate Family Member” Travel Expense 

It is recognized that there will be Official Credit Union functions where protocol requires the 

attendance and/or invitation of spouses and/or other persons who qualify as “immediate family 

members.” Reimbursement of travel expenses for one “immediate family member” of an official 

or employee of the credit union will be considered a business expense when such is for a bona 

fide business purpose. Reimbursement is predicated on the fact that the spouse’s presence is 

required at a Credit Union Official Function. 

To constitute an “immediate family member” the person in question must meet the standards set 

forth in the following Letter from the NCUA: 



10

We have stated that there must be an ongoing "familial" relationship between a primary 

member and those who qualify for membership as an immediate family member. In the 

context of unmarried couples, we have stated that we would look to factors indicating 

the intended permanence of a familial relationship, such as: regular cohabitation; 

joint ownership of property with right of survivorship; joint credit obligations; and 

custodial rights over minors or other dependents. Merely sharing a household or 

a purely business relationship would not be sufficient. 

Ref: NCUA General Counsel Letter No. 97-0852 and 12 CFR 701.33. 

What would this include? 

Legally Married Spouse 

A person that permanently co-habitates 

with the Board Member per the NCUA 

Letter noted immediately above. 

What would this exclude? 

A Date 

A non-cohabitating person per the 

assessment of “immediate family 

member” in the NCUA Letter noted 

immediately above. 

“De Minimis Expense Exceptions” 

The Credit Union recognizes the following “de minimis rules” and those 

otherwise set forth in IRS Publication 15-B (2009) in considering whether any 

expense herein is reimbursable/taxable: 

De Minimis (Minimal) Benefits 

You can exclude the value of a de minimis benefit you provide to an employee from the employee's wages. A 

de minimis benefit is any property or service you provide to an employee that has so little value (taking into 

account how frequently you provide similar benefits to your employees) that accounting for it would be 

unreasonable or administratively impracticable. Cash and cash equivalent fringe benefits (for example, use of 

gift card, charge card, or credit card), no matter how little, are never excludable as a de minimis benefit, except 

for occasional meal money or transportation fare. 

Employee. For this exclusion, treat any recipient of a de minimis benefit as an employee. 

De Minimis Meals 

You can exclude any meal or meal money you provide to an employee if it has so little value (taking into 

account how frequently you provide meals to your employees) that accounting for it would be unreasonable or 

administratively impracticable. The exclusion applies, for example, to the following items. 

• Coffee, doughnuts, or soft drinks. 

• Occasional meals or meal money provided to enable an employee to work overtime. (However, the 

exclusion does not apply to meal money figured on the basis of hours worked.) 



11

• Occasional parties or picnics for employees and their guests. 

Exclusion from wages. You can generally exclude the value of de minimis meals you provide to an 

employee from the employee's wages. 

For your convenience. Whether you furnish meals for your convenience as an employer depends on all the 

facts and circumstances. You furnish the meals to your employee for your convenience if you do this for a 

substantial business reason other than to provide the employee with additional pay. This is true even if a law or 

an employment contract provides that the meals are furnished as pay. However, a written statement that the 

meals are furnished for your convenience is not sufficient. 

. 

Meals after work hours. Meals you furnish to an employee immediately after working hours are furnished for 

your convenience if you would have furnished them during working hours for a substantial nonpay business 

reason but, because of the work duties, they were not eaten during working hours. 

Meals you furnish to promote goodwill, boost morale, or attract prospective employees. Meals you 

furnish to promote goodwill, boost morale, or attract prospective employees are not considered furnished for 

your convenience. However, you may be able to exclude their value as discussed under De Minimis Meals, 

earlier. 

G. Apply Common Sense 

The purpose of these policies is to avoid violations of 18 U.S.C. Section 215 and to 

ensure that ABC Federal Credit Union and its CUSOs’ business is safeguarded from the 

influence of bribery or personal favors. Whenever representatives of ABC Federal 

Credit Union or any CUSO, have personal dealings with persons who have business 

with ABC Federal Credit Union or any CUSO, the requirements of the law must be kept 

in mind. Necessarily, the application of the guidelines stated in Paragraph B above will 

require good judgment and common sense. If you encounter situations in which you are 

not sure of your obligations or if you find the application of these guidelines to be unduly 

restrictive, you should consult the Ethics Committee. Under no circumstances should 

you accept any personal gift or favor if it appears that by giving it the donor hopes to 

influence any business of ABC Federal Credit Union or any CUSO, or to reward you for 

actions taken by you or on behalf of ABC Federal Credit Union or any CUSO. 

H. Personal Relationships with Members and Vendors 

It is inevitable and desirable that persons associated with ABC Federal Credit Union 

and its CUSO, will have individual business and personal relationships unrelated to 

ABC Federal Credit Union or any CUSO business, with ABC Federal Credit Union or 

any CUSO ’ members, vendors and others who do business with ABC Federal Credit 

Union or any CUSO . This policy statement is not intended to discourage such 

relationships. Any personal business relationships should be on customary terms and 

for proper and usual purposes, however, and no one associated with ABC Federal 

Credit Union or any CUSO, should solicit any special favors in recognition of his or her 

position with ABC Federal Credit Union or any CUSO. See Section IV below. 



12

IV. POLICY REGARDING CONFLICTS OF INTEREST 

A. General Policy 

Conflicts of interest may arise when individuals associated with ABC Federal Credit 

Union or one of its CUSOs, acquire personal interests or engage in outside activities in 

which their normal self-interests or obligations to others conflict with the interests of 

ABC Federal Credit Union or any CUSO, or its members. 

In some circumstances, engaging in conflicts of interest violates the law. In other cases, 

conflicts of interest may lead individuals to accept inappropriate personal benefits -- 

which may violate the law. In all cases, where even the appearance of a conflict exists, 

there may be damage to ABC Federal Credit Union and/or its CUSOs’ reputation for 

integrity. Ultimately, our success depends on our reputation for integrity -- and we will 

take whatever steps may be necessary in order to preserve our good name. 

Accordingly, ABC Federal Credit Union and its CUSOs’ policy is that no employee may 

engage in activities or acquire interests in ABC Federal Credit Union or any CUSO that 

potentially creates any such conflict of interest(s). Guidelines respecting certain specific 

practices and conditions are discussed below. It is not possible to describe every 

possible conflict of interest. The fact that a particular practice or condition is not 

prohibited below does not mean that it has been approved. Questions will necessarily 

arise and they should be addressed to the Ethics Committee. All potential conflicts of 

interest must be disclosed to the Ethics Committee as provided in Paragraph F below. 

Employees should not attempt to resolve ambiguous or uncertain issues by themselves. 

B. Misuse of Position with ABC Federal Credit Union or its CUSOs 

The fact that a person holds a position with ABC Federal Credit Union or any CUSO 

may not be used as the basis to seek or accept any business opportunity or other favor 

or benefit that is not available to persons who are not employed by ABC Federal Credit 

Union or one of its CUSOs. For example, no representative of ABC Federal Credit 

Union may accept any offer to buy securities or other types of property or assets at 

terms which are more favorable than the terms available to the general public if the offer 

is made because the person is associated with ABC Federal Credit Union. See Sections 

II and III above. 

C. Employee Transactions with ABC Federal Credit Union or its CUSOs 

No employee and no member of an employee's immediate family, may sell or buy 

property of any kind - having a value greater than $100 - to or from ABC Federal Credit 

Union or any CUSO, directly or indirectly, except with the express approval of the Ethics 

Committee, after full disclosure of all relevant facts. 



13

D. Foreclosures and Repossessions 

Employees and their immediate family are prohibited from purchasing property which 

ABC Federal Credit Union or any CUSO, is foreclosing or has acquired through 

foreclosure or otherwise without first obtaining prior approval of the Ethics Committee. 

This prohibition includes not only a direct purchase from ABC Federal Credit Union or 

any CUSO, but also an indirect or "straw" purchase arranged through a dealer or any 

other person or third party. Employees and their immediate family are prohibited from 

purchasing any trust property administered by ABC Federal Credit Union or any CUSO. 

E. Guidelines Respecting Transactions Between Employees and Persons Outside 

ABC Federal Credit Union any CUSO 

Employees of ABC Federal Credit Union or any CUSO, may not engage in conduct or 

activities outside their employment that are disloyal, competitive with or damaging to 

ABC Federal Credit Union or any CUSO. 

Guidelines about certain specific practices and situations are set out below. 

1. OUTSIDE EMPLOYMENT. Employees are expected to devote their full time, 

attention and abilities to ABC Federal Credit Union or its CUSOs’ interests during 

regular hours of employment and for whatever additional time may properly be 

required. No other employment or activities may be undertaken, if they will impair 

an individual's ability to meet regular job responsibilities. Any outside 

employment must be approved in writing in advance by the Ethics Committee. 

No employment by a competitor of ABC Federal Credit Union or any CUSO will 

be approved. 

2. OUTSIDE BUSINESS VENTURES AND INVESTMENTS. All business ventures 

and certain types of investments made by employees and members of their 

immediate families must be disclosed as provided in Section VI below. 

Employees may not, without the prior approval of the Ethics Committee, engage, 

directly or indirectly, in business ventures or make investments in companies that 

do business with or compete with ABC Federal Credit Union or any CUSO. 

Employees who have interests in companies that do business with ABC Federal 

Credit Union or any CUSO may not represent ABC Federal Credit Union or any 

CUSO in any way business transactions between those companies and ABC 

Federal Credit Union or any CUSO. This paragraph does not apply to purchases 

of less that 5% of any class of publicly traded securities. 

3. PERSONAL LOANS INVOLVING MEMBERS OR VENDORS. No employee 

may borrow any money from or lend any money to any members or any others 

who do business with or may do business with ABC Federal Credit Union or any 

CUSO. Officers and employees may borrow from or lend to members of their 

families, however, and they may borrow from companies which make such loans 

in the ordinary course of their business on the terms available to the general 



14

public, even though, such relatives or companies may do business with ABC 

Federal Credit Union or its CUSOs. 

4. DIRECTORSHIPS. If employees (or members of their immediate families) serve 

as directors of any business corporations, or any non-profit corporations or 

associations, then such relationships must be disclosed as provided in Section VI 

below. No employee of ABC Federal Credit Union or any CUSO, may agree to 

serve as a director of any business corporation or any non-profit corporation or 

association that does business with the Credit Union, unless such service has 

been approved by the Ethics Committee. 

5. TRUSTEES AND FIDUCIARIES. If employees serve as trustees or fiduciaries 

(executor, administrator, guardian, etc.), then such relationships must be 

disclosed as provided in Section VI. No employee may agree to serve as a 

trustee or fiduciary unless such service has been approved in advance by the 

Ethics Committee. Service as trustee or fiduciary in connection with family 

relationships will normally be approved. 

6. RELATIVES. Relatives of persons associated with ABC Federal Credit Union 

and any of its CUSOs, are encouraged to become members of the bank. No 

employee may make decisions or represent the bank in matters involving loans 

to relatives, or investment of ABC Federal Credit Union or any CUSO’ funds with 

relatives, or purchasing goods or services from relatives. 

7. HIRING RELATIVES OF CURRENT EMPLOYEES. No person who is related by 

blood or marriage to any officer, director or employee of ABC Federal Credit 

Union or any CUSO may be employed by the Credit Union unless any such 

relationship has been disclosed to approved by the Ethics Committee. 

F. Disclosure of Possible Conflicts of Interest 

Potential conflicts of interest must be identified so they can be avoided. Accordingly, 

employees must disclose potential conflicts of interest, including those in which they are 

placed inadvertently because of business or personal relationships with ABC Federal 

Credit Union or any CUSO, members, suppliers, business associates or competitors. 

Facts about possible conflicts of interest should be disclosed to the Ethics Committee 

as they arise. Questions should be addressed to the Ethics Committee. Disclosures of 

potential conflict of interest will be kept by the Personnel Officer. 

V. BUSINESS INFORMATION IS CONFIDENTIAL 

A. Business Information May Not Be Disclosed 

Information about ABC Federal Credit Union and any/or of its CUSO’s business and 

information supplied to ABC Federal Credit Union and/or any of its CUSOs by its 

members (including prospective members) and suppliers in the course of business 



15

elations is confidential. Credit Union related persons including Volunteers, Committee 

Members and Employees may not disclose such information to other persons except to 

the extent that disclosure is necessary to carry out assigned responsibilities. Questions 

about disclosing information should be addressed to the President. 

B. Requests for Information by News Media, Financial Analysts, Financial 

Institutions and Others 

From time to time employees may receive requests for information about ABC Federal 

Credit Union and/or any of its CUSOs or its members or suppliers from the news media, 

investment analysts, financial institutions, or others. All such inquiries should be referred 

to the President. No employee may respond to such inquiries unless expressly directed 

to do so by the President. 

C. Information May Not Be Used for Personal Purposes 

No employee may use confidential information which might reflect upon the investment 

value or future market value of any business enterprise for purposes of personal 

advantage or to provide an advantage to others. In particular, information received in 

the course of employment with ABC Federal Credit Union or any CUSO, which is not 

available to the general public may never be used as the basis for making any decision 

to buy or sell stocks or other securities. Likewise, such information may not be used in 

giving investment advice to others. 

VI. DISCLOSURE OF PERSONAL FINANCIAL INTERESTS AND FIDUCIARY 

OBLIGATIONS 

Note: This provision is not specifically required, and may be subject to 

assessment based on employment agreements as well as state laws as 

applicable. 

Employees may be required to disclose certain of their outside financial interests and 

fiduciary obligations to the Ethics Committee as provided in this Section. In addition, the 

following persons may be requested to provide complete financial statements on a 

periodic basis: Chief Executive Officer, President, Senior Vice President & Executive 

Vice President. Employees must disclose all interests owned in business enterprises, 

including corporations, partnerships and proprietorships, if such interests have a fair 

market of $10,000 or more, or if more than a 10% interest in an enterprise is owned. 

Interests owned by the spouse and minor children of an employee and interests owned 

by other relatives who live in the home of an employee must be disclosed. "Interests 

owned" include interests over which an employee exercises voting control. No 

investments in publicly traded securities are required to be reported, unless an 

employee owns more than 5% of any such class of securities. Employees must disclose 

all firms, associations, trusts, estates or other beneficiaries for which they, their spouses 



16

and other relatives who live in their homes serve as officers, directors, trustees or other 

fiduciaries. 

Written disclosures regarding this requirement shall be provided upon the 

commencement of an employee's employment and annually thereafter. Disclosures are 

kept on file with the Personnel Officer. 

VII. ACKNOWLEDGMENT OF AGREEMENT TO COMPLY WITH ABC FEDERAL 

CREDIT UNION AND ITS CUSO’s POLICY REGARDING CONFLICTS OF 

INTEREST/CODE OF ETHICS 

Each director, officer and employee of ABC Federal Credit Union or any CUSO, shall 

sign a Certificate of Agreement to comply with this policy. Persons who are appointed or 

employed after this policy is adopted shall sign such a Certificate upon their 

appointment or employment. At times in the future when this policy is amended, all such 

persons shall also acknowledge and agree to the changes by written certificate. This 

certification will be maintained in a file with the Personnel Officer. 

VIII. MAINTENANCE AND AMENDMENT OF POLICY 

IX. THIS POLICY IS FOR THE BENEFIT OF ABC FEDERAL CREDIT UNION AND 

ITS CUSOs 

X. General Obligations of Senior Management 

XI. 

Reporting Violations of this Policy or any other Conduct Detrimental to the 

Credit Union: 

Compliance and Ethical Issues Involving Credit Union 

Boards: 

Section Topic 

Page 

A Introduction 1 

B Limited Insurance Benefits 1 

C Honorary Titles are Just that “Honorary Titles!” 3 

Reserved for Further Matters 




17


We intend for this to be a work that will address such matters periodically; and thus, 

anticipate expansion of this work as noted in connection with our other detailed 

Board/Volunteer Training Modules. 

A. Introduction: 

We field many questions each year involving the scope and duties of Credit Union Board and 

Committee Members; and the “benefits” that may be afforded to such persons. The first rule to 

remember is that these persons are serving as “NON-COMPENSATED VOLUNTEERS.” Let me 

say that again: ““NON-COMPENSATED VOLUNTEERS.” I fully understand that these persons 

perform an exceptionally valuable service to Credit Unions and their members. However, all 

must remember what a Credit Union is – and the capacity in which volunteers serve. Just as 

with my choice to focus my practice on Credit Unions – there is an economic downside to our 

choices as Credit Unions cannot afford the rates of other banking organizations. Likewise, if one 

wishes to be a “compensated director” then he/she needs to look to the public sector and seek 

nomination to a “for profit” board – such as that of a traditional bank. 

With Sarbanes-Oxley and the concepts addressed therein (and in NCUA Letter 03-FCU-07, we 

need to refocus on training our boards and management as to the nature and scope of the 

rules applicable to Volunteers. We need to train then on what a Credit Union can/cannot 

do; what their duties and Liabilities are; and re-focus or provide training on laws and 

rules that are there to protect persons who act in these roles. In addition, Credit Unions 

need to address liability protection and avoidance via such training, proper insurance 

and indemnification agreements. 

The following are just a few reminders on the basic rules regarding “benefits” or 

“compensation” for Board Members/Volunteers. 

B. What Insurance Benefits can be Provided to Volunteers? 

Section 701.33(2)(ii) answers this question. See below. 

Here is a recent question one Credit Union posed per its Board’s request; and the answer we 

provided (which addresses this issue): 

“Can the Credit Union provide a life insurance benefit to its Board Members; and if this 

cannot be done directly, is there some manner in which same can be provided 

indirectly?” 

Sometimes there are “gray areas in laws / regulations” that may leave room for interpretation. 

There are no such gray areas in this situation and my response has been and remains – No – 

as to both queries. The basis of this response relies exclusively on the Federal Credit Union Act, 

the NCUA’s Rules and Regulations and the Legal Opinions of the NCUA General Counsel’s 

Office as follow: 

12 USC § 1761 (c) No member of the board or of any other committee shall, as 

such, be compensated, except that reasonable health, accident, similar insurance 



18

protection, and the reimbursement of reasonable expenses incurred in the execution 

of the duties of the position shall not be considered compensation. 

12 CFR § 701.33 (2) (ii) provision of reasonable health, accident and related types of 

personal insurance protection, supplied for officials at the expense of the credit 

union: Provided, that such insurance protection must exclude life insurance; must be 

limited to areas of risk, including accidental death and dismemberment, to which the 

official is exposed by reason of carrying out the duties or responsibilities of the 

official’s credit union position; must cease immediately upon the insured person’s 

leaving office, without providing residual benefits other than from pending claims, if 

any; 

NCUA General Counsel Letter No. 99-0621 (Excerpt): Our regulations permit 

FCUs to provide health insurance to officials that is reasonable in coverage and 

amount. 12 C.F.R. §701.33(b)(2)(ii). An FCU may reimburse officials for their actual 

health insurance costs pursuant to written policies adopted in compliance with 12 

C.F.R. §701.33. No official, other than the designated compensated official, "may 

receive compensation for performing the duties or responsibilities of the board or 

committee position to which the person has been elected or appointed." 12 C.F.R. 

§701.33(b)(2)(1). Therefore, the FCU’s written policies must include limits and 

documentation requirements that ensure the FCU is not compensating officials, and 

monitor the direct application of funds to health insurance premiums. The policies 

would need to address the extent of coverage for which the FCU will provide 

reimbursement as the costs of coverage may vary depending on factors such as 

individual age and health. The policies would also need to provide that 

reimbursement of health insurance costs would terminate immediately upon the 

insured individual’s leaving office. 12 C.F.R. §701.33(b)(2)(ii). See also, NCUA 

General Counsel Letter No. 00-0508. 

In addition to the state and common law rules addressing the Board’s duties to the Credit Union 

and its members, all Credit Unions must consider the ideals of Sarbanes-Oxley and NCUA 

Letter 03-FCU-07. With these heightened duties so very much in the NCUA’s and public’s 

domain, any activity that exceeds the duties of the utmost good faith and fair dealing, or the 

slightest appearance of impropriety must be avoided. Thus, any attempt to structure a benefit 

that is otherwise prohibited as set forth above herein is inappropriate. Further, any activity that 

exceeds these prohibitions may subject the Credit Union, its Board and/or its management to 

report same. 

In short: (1) The benefit in question is prohibited; and (2) perhaps more importantly in light of the 

ethical standards mentioned -- no person, volunteer or otherwise should expose themselves or 

the Credit Union to the potential NCUA or membership based penalties, fines or potential claims 

that could arise from any action that is contrary to the plain and clear laws and regulations noted 

herein. 

C. Honorary Titles are just that “Honorary Titles!” 

See Legal / Compliance Consultation Note at the end of this Section. 



19

This is not a new issue (see the references below to prior NCUA Letters). Honorary Titles 

are not a mechanism to avoid application of the limitations and rules on compensation. In 2003 

NCUA addressed a request to give “director emeritus” status to certain persons. The NCUA 

response makes it clear that this is a purely honorary status (for persons to serve in a purely 

advisory capacity) and that there generally will not be expenses associated with such persons 

(such as for travel). Please read carefully what NCUA says (abridged) – and then read the 

Legal / Compliance Consultation Note at the end of this Section: 

You have asked this office to review and comment on proposed nonstandard bylaw 

amendments submitted for approval by [ ] Federal Credit Union to amend Article VI to add a 

director emeritus position. The credit union proposes to add three new sections to Article VI. 

The first two govern the appointment of a director emeritus. The third would permit a director 

emeritus to attend board meetings and to serve and vote on any committee. 

In previous legal opinions, this office determined that a board of directors may appoint an 

advisory committee under Section 113(13) of the FCU Act that consists of individuals given 

director emeritus status. See attached OGC 90- 0321, dated April 17, 1990; OGC 93-0527, 

dated June 29, 1993; OGC 95-0116, dated February 2, 1995. This office, therefore, has no 

legal objection to the FCU adopting a bylaw that provides for the appointment of director emeriti 

to function as an advisory committee. 

[Such persons] should not vote on proposals before the FCU’s committees. … [W]e 

believe these individuals can attend and provide advice at board meetings or committee 

meetings, it would be improper for these individuals to have voting authority. In their role as 

directors emeritus, these individuals are not given any responsibilities or standards for which 

they would be held accountable, other than attending a set number of board meetings. 

A director emeritus should not have a voice in a committee’s decision-making if they are 

not truly members of the committee. Voting authority should be limited to committee 

members that are seated in accordance with the bylaws and charged with the full responsibility 

of their position for the term appointed. 

Another reason for our objection to allowing a director emeritus to vote at committee meetings 

is that this person may improperly alter the makeup of other committees established under the 

FCU’s bylaws, causing technical violations of the FCU Bylaws. The FCU Bylaws require the 

FCU’s board to appoint between three and five members to the supervisory committee and to 

establish the number of members on an FCU’s credit committee, if it chooses to have one. FCU 

Bylaws, Articles IX, Sec. 1 and VIII, Option 1, Section 1 (Rev. Oct. 1999). If a director emeritus 

is allowed to vote on any committee matter, he or she effectively becomes a member of the 

committee and increases the number of members on the committee in a manner likely to violate 

the FCU’s bylaws. To avoid this problem and comply with the FCU Act, the FCU would have to 

submit corresponding bylaw amendments for review and approval. In addition, members of the 

supervisory and credit committees are seated with specified terms. By allowing a director 

emeritus to join any committee as a voting member, at any time, disrupts this process. 

We also note that, although the board of directors may appoint an advisory committee as 

discussed, we cannot foresee any need for the FCU to provide expense reimbursement or 

insurance benefits to these officials under Section 701.33. Our rule allows these limited 

benefits only as a result of an official carrying out the responsibilities of his or her credit union 

position. Given that the FCU grants this honorary title in recognition of past FCU service and 

that director emeriti simply provide experience-based advice, these people will not incur 

expenses such as those related to training or travel. 



20

Legal / Compliance Consultation Note: There may be circumstances where 

remuneration may be allowed, but the interpretation and assessment of the issue needs 

to be addressed with your legal/compliance advisor as there are many factual issues 

that may vary the interpretation of this NCUA “Opinion Letter” together with practical 

application issues that may cause you to risk assess the limited statement in a 

somewhat different light.” We acknowledge that many Credit Unions have extended 

certain such courtesies to former board members time out of mind; and that the matter – 

if not abusive – is low risk. Nonetheless, the Credit Union needs to consider the letter 

above; and insure it makes a fully informed decision with regard to any actions it may 

take that could be called into question pursuant to the Letter in question or otherwise. 

Question on Reimbursement of Expenses by Credit Union: Particular Question 

Omitted Per Rules of Prof. Responsibility. 

Response (Revised for general consideration): These are complicated issues; and 

complicated times (where such costs/expenses are more likely to face scrutiny. Thus, it 

is a good time to revisit this topic to insure your house is in order. It is difficult to assess 

without individual assessment of particular facts. Generally, such questions are 

determined via consideration of the following factors: 

1. For Volunteers: (1) Is it permissible per the Credit Union’s written policy and is 

also a bona fide business related expense; and (2) Are expenses for an 

“immediate family member” permissible? 

2. For Employees: (1) Is it permissible per the Credit Union’s written policy and is 

also a bona fide business related expense; and (2) Are expenses for an 

“immediate family member” taxable? 

In assessing this look to: 

1. Our Sample Policy in CUPP IX / Section T / Item O – see particularly pages 

5-9. (Updated 9/14/2009) 

2. Consider the following chart and assessment of NCUA Letters on these 

issues of reimbursement of expenses. 

3. Consider “common sense” issues – such as the “de minimis” rules 

associated with “less costly items such as meals per the IRS Publication 

15-B (2009) which is discussed in the CUPP Item noted. 

In light of the many variables I provide no further response other than the general 

matters addressed herein; and in the sample policy noted above. If you have 

particular questions, please pose them to a qualified legal and/or tax adviser as 

applicable. 

TABLE – Are expenses of a Volunteer, Employee and/or their Immediate Family 

Members Reimbursable. Based on the following considerations – each (Volunteer 

vs. Employee) is a separate matter that has to be assessed independently: 



21

Party Consideration Potential Consequences // One or All of 

the Following may Apply 

Board Members / 

Volunteers 

(1) Is it permissible per the 

FCU Act? Limited per 

the Act as 

“volunteers” cannot 

generally be 

compensated with the 

exceptions noted 

below. 

(2) Is it within the Credit 

Union’s written 

Policy? 

(3) Is it in any way 

intended to subvert 

the forgoing? 

(1) If not permissible violates the FCU Act? 

NCUA may use it authority to pursue 

civil or criminal penalties as appropriate. 

(2) If outside of approved policy – Credit 

Union cannot pay / reimburse; and 

Volunteer may be called upon to 

reimburse. 

(3) May be a violation of a duty to the Credit 

Union and its members under state 

laws; and If it is interpreted as a 

violation of FIRREA – the US 

government may pursue civil or criminal 

penalties as appropriate. 

Credit Union Employees 

(1) Is it permissible per the 

FCU Act? Generally – 

NOT limited as 

employees are 

“compensated” (not 

volunteers). NOTE: 

There may be Income 

issues per IRS Rules 

and Regulations for 

expenses associated 

with family members. 

It is recommended 

you consult with your 

tax adviser on such 

personal matters. 

(2) Is it within the Credit 

Union’s written 

Policy? 

(3) Is it in any way 

intended to subvert 

the forgoing? See (3) 

in Consequences for 

Volunteers above. 

(1) and (2) This issue is considered much 

differently for an employee. With an 

Employee the issues are not focused as 

much on the “can / cannot” – but instead on 

(1) whether policy allows for the 

reimbursement; and (2) whether the 

reimbursement is taxable to the employee. 

Generally (and each person should consult 

with their tax adviser) Under IRS regulations, 

the travel expenses of a spouse are 

generally not taxable, provided it can be 

established that his or her presence serves a 

bona fide business purpose. A spouse who 

attends a function is considered to have a 

business purpose if he or she has a 

significant role in the proceedings or makes 

an important contribution to the success of 

an event. Generally, protocol or tradition 

dictates when the participation of an official's 

spouse is required at official function. 

Generally, if a spouse has no significant role 

in the proceedings, or performs only 

incidental duties of a social or clerical nature, 

attendance does not constitute a bona fide 

business purpose. Such expenses are 

taxable to the employee. 

Refer to IRS Publication 17: 

http://www.irs.gov/publications/p17/ch26.htm 

l 

Summary of the NCUA’s Rules on “Reimbursement of Volunteers Expenses: 



22

MERGER AND CONSOLIDATIONS ISSUES NOT TO 

OVERLOOK! 

Loans: 

Compliance: 



23

Contracts: 

Accounting 

Other: 

CONFIDENTIALITY AGREEMENT 

This CONFIDENTIALITY AGREEMENT (the "Agreement") is by and between CREDIT UNION NAME 

HERE (hereinafter "Disclosing Party"), and the undersigned (hereinafter "Recipient"). 

WHEREAS, Recipient has requested information from Disclosing Party in connection with discussions 

regarding ______________DESCRIBE DOCUMENTS/INFORMATION/MATTER HERE 

_________________ (inclusively referred to as “Information”), for review and assessment regarding 

business or a business relationship between the parties hereto; 

WHEREAS, in the course of consideration of the relationship described or between the parties as set 

forth in a formal agreement, Disclosing Party may disclose to Recipient confidential, important, and/or 

proprietary trade secret information concerning Disclosing Party and its information from time to time in 

order to allow the parties to conduct reasonable research and due diligence; 

THEREFORE, in consideration of the Disclosing Party’s agreement to provide Confidential Information 

together with other good and valuable consideration, the parties agree to enter into a confidential 

relationship with respect to the disclosure by Disclosing Party to Recipient of certain information. 

1. Definitions. For purposes of this Agreement, "Confidential Information" shall include all information and 

information or material that has or could have commercial value or other utility in the business or 

prospective business of Disclosing Party or the Recipient. Confidential Information also includes any 

information we receive about the other's business practices, accounts, staff, contacts and plans and all 



24

information of which unauthorized disclosure could be detrimental to the interests of Disclosing Party 

whether or not such information is identified as Confidential Information by Disclosing Party. 

For purposes of this Agreement, the term "Recipient" shall include Recipient, the company he or she 

represents, and all affiliates, subsidiaries, and related companies of Recipient. For purposes of this 

Agreement, the term "Representative" shall include Recipient's directors, officers, employees, agents, 

and financial, legal, and other advisors. The undersigned also represents and warrants that he/she has 

authority to enter into this agreement on behalf of the company or entity identified herein. 

2. Confidentiality. Recipient and its Representatives shall not disclose any of the Confidential Information 

in any manner whatsoever, except as provided in paragraphs 3 and 4 of this Agreement, and shall hold 

and maintain the Confidential Information in strictest confidence. Recipient hereby agrees to indemnify 

Disclosing Party against any and all losses, damages, claims, expenses, and attorneys' fees incurred or 

suffered by Disclosing Party as a result of a breach of this Agreement by Recipient or its Representatives. 

3. Permitted Disclosures. Recipient may disclose Disclosing Party's Confidential Information to 

Recipient's responsible employees with a bona fide need to know such Confidential Information, but only 

to the extent necessary to conduct the Credit Union’s business and to third party vendors who agree to 

the terms herein - if such employees and/or vendors are advised of the confidential nature of such 

Confidential Information and the terms of this Agreement and are bound by a written agreement or by a 

legally enforceable code of professional responsibility to protect the confidentiality of such Confidential 

Information. 

4. Required Disclosures. Recipient may disclose Disclosing Party's Confidential Information if and to the 

extent that such disclosure is required by court order, provided that Recipient provides Disclosing Party a 

reasonable opportunity to review the disclosure before it is made and to interpose its own objection to the 

disclosure. 

5. Use. Recipient and its Representatives shall use the Confidential Information solely for the purpose of 

conducting Credit Union business; and shall not in any other way use the Confidential Information. 

Nothing in this Agreement shall be construed as granting any rights to Recipient, by license or otherwise, 

to any of Disclosing Party's Confidential Information. 

6. No Additional Agreements. Neither the holding of discussions nor the exchange of material or 

information shall be construed as an obligation of Disclosing Party to enter into any other agreement with 

Recipient or prohibit Disclosing Party from providing the same or similar information to other parties and 

entering into agreements with other parties. Disclosing Party reserves the right, in its sole discretion, to 

reject any and all proposals made by Recipient or its Representatives with regard to any licensing, use, 

relationship or transaction between Recipient and Disclosing Party and to terminate discussions and 



25

negotiations with Recipient at any time. Additional agreements of the parties, if any, shall be in writing 

signed by Disclosing Party and Recipient. 

7. Irreparable Harm. Recipient understands and acknowledges that any disclosure or misappropriation of 

any of the Confidential Information in violation of this Agreement may cause Disclosing Party irreparable 

harm, the amount of which may be difficult to ascertain, and therefore agrees that Disclosing Party shall 

have the right to apply to a court of competent jurisdiction for specific performance and/or an order 

restraining and enjoining any such further disclosure or breach and for such other relief as Disclosing 

Party shall deem appropriate. Such right of Disclosing Party is to be in addition to the remedies otherwise 

available to Disclosing Party at law or in equity. Such right of Disclosing Party is to be in addition to the 

remedies otherwise available to Disclosing Party at law or in equity. Recipient expressly waives the 

defense that a remedy in damages will be adequate and any requirement in an action for specific 

performance or injunction for the posting of a bond by Disclosing Party. 

8. Survival. This Agreement shall continue in perpetuity; and may only be amended, modified or 

superseded by a written agreement by and between the parties hereto. 

9. Governing Law and Jurisdiction. This Agreement and all rights hereunder or related in any way hereto 

shall be governed and construed by the laws of the State of ____________________; and it is further 

agreed that venue and jurisdiction for any disputes, claims or damages shall reside solely within the State 

of ____________________;. 

10. General. This Agreement sets forth the entire understanding of the parties with respect to the subject 

matter hereof and supersedes all prior and contemporaneous representations, understandings and 

agreements, oral or written, made between the parties effecting the subject matter hereof, and all such 

prior or contemporaneous representations, understandings and agreements are hereby terminated. If a 

court of competent jurisdiction determines that any provision contained in this Agreement is void, illegal or 

unenforceable, the other provisions shall remain in full force and effect and the provision held to be void, 

illegal or unenforceable shall be limited so that it shall remain in effect to the extent permissible by law. 

The undersigned agrees to and accepts the terms set forth herein: 

CREDIT UNION NAME HERE 

___________________________________________ 

Signature 

By: 

Print 

Title: 

Date: 

NAME OF VENDOR HERE 

___________________________________________ 

Signature 

By: 

Print 

Title: 

Date: 



26

A Review of ‘Red Flags’ and what Documentation may 

Leave your Credit Union Open to Liability 

RED FLAGS 

• Effects both Operations and Lending 

• New program for detecting, prevention, and mitigation of ID Theft on a 

covered account. 

• New address change procedures. 

• Detailed steps to take if a Red Flag appears prior to opening an account. 

• What to do if someone asks for a replacement card following an address 

change. 

Step One 

Step Two 

Step Three 

Step Four 

Step Five 

Step Six 

Understanding 

Red Flags and Information Security Assessment Checklist 

A Complete FCRA Policy – (Not Required – However -- we do not believe it 

is good practice to address a law in separate parts) 

Detailed Incident Response Policy/Procedures – intended to work hand-inhand 

with ID Theft and Red Flags Procedures – 

Detailed ID Theft and Red Flag Procedures 

Internal Credit Union Use - ID Theft Affidavit 

Step Seven Initial Board Adoption of Red Flags Assessment and Policy -- With the 

potential liability that can attach to the Credit Union’s Senior Management 

and Volunteers We have drafted this from a Legal Perspective to Provide a 

Level of Protection from Claims that we recommend to all Credit Union 

Clients. 

Step Eight Periodic Board Re-Assessment and Approval of Red Flags Policy // As with 

the initial Approval -- the potential liability that can attach to the Credit 

Union’s Senior Management and Volunteers We have drafted this from a 

Legal Perspective to Provide a Level of Protection from Claims that we 

recommend to all Credit Union Clients. 

Step Nine Possible ID Theft Investigation Form // A Credit Union may find its 

assessment of a possible Red Flags/ID Theft Matter being used as a Tool 

Against the Credit Union. Example – you suspected but chose not to act; 

and now some member sues claiming your assessment was negligent and if 

you would have acted – they would not have been insured (a classical 

negligence claim). This form is drafted to provide protections from such 

claims and is recommended to all Credit Union clients. 

Step Ten Initial Training -- Train Everyone as Applicable and document this. – 

Front Line Staff 

Security Officer(s) 



27

Senior Management 

Compliance Personnel 

Audit Personnel 

Volunteers 

ALL need an appropriate level of training. 

Options: 

A. Train Everyone Using Internal Resources 

B. Use External Training – sending ALL persons noted for training by 

November 1. 

C. Use “Professional” Training* – for ALL persons noted for training by 

November 1. To provide the Credit Union with the layer of protection we 

recommend for liability protection – (Example – in the case of a lawsuit 

against the Credit Union, Mgmt., or Board – the Credit Union shows it 

received professional training from qualified experts in the laws and 

compliance areas in question to show its utmost good faith in its 

compliance and protection of its members). This is a powerful protection for 

the Credit Union, Mgmt., and the Board from Liability Claims). 

Step Eleven 

Annual Updated Training -- Train Everyone as Applicable and document 

this. 

SEE RECOMMENDATIONS IN TEN ABOVE. 

Simplifying Commercial and Business Relationships 

BASIC CONCEPTS 

A. Who, What, Where, When and Why? 

B. Heavy or Light 

C. Walking versus Running 

D. State Charters 



28

Business Depositors: 

Understanding the Differences 

Building Knowledge 

Options 

Hire Resources? What Happened 

to the local bank? 

Go to School 

What’s the Problem 

for a Credit Union? 

Entities 

A Corporation 

A Partnership 

A Limited Liability Co. 

A Trust 

Sole Proprietor 

Others? 



29

Membership? 

Matters to Address: 

FOM and Bylaws 

BSA/CIP 

IRS Code – TIN or EIN 

Risk Assessment (MSBs and Other 

Issues … 

What Documents? 

What and From Where 



30

WHAT POLICIES, PROCEDURES AND RISK ASSESSMENTS 

ARE WE REALLY REQUIRED TO HAVE? 

AND 

WHAT SOULD IT HAVE? 

Policies, Procedures and Assessments 

Many Credit Unions are confused by the myriad “requirements,” advice, rules, 

regulations, instructions as to what policies, procedures and assessments it is required 

to implement and maintain. (Out of Date Matters Such as Y2K Related issues; and 

Items that are replaced by more current standards (Example: 1989 NCUA Letter 

on Technology Matters) are omitted from this Resource as not being applicable). 

To help I provide the following chart that provides: 

NOTE ONE: Generally, procedures are recommended in most instances based upon various legal 

liability and compliance considerations. Thus, the third column below is used for emphasis on 

areas where we consider such to be of particular importance. When properly drawn – and when 

combined with proper forms, procedures and other related tools – Credit Union procedures may 

provide a great deal of protection from liability claims and potential regulatory fines. 

NOTE TWO: References are to General Federal Laws / Regulations or to NCUA Regulatory Alerts, 

Letters to Credit Unions; Supervisory Letters; and the NCUA Field Examiners Guide. References 

are only to Active NCUA Resources. Retracted or Inactive Letters have not been used in this 

assessment. 

Policy / Procedure / 

Assessment 

Board Policy or 

Approval Required 

(as to Assessment 

and/or Procedures) 

Generally -- Left to 

Credit 

Union/Management 

– Board Approval or 

Assessment 

Generally Not 

Required 

NOTES and/or 

Recommendations 

per Legal / 

Compliance or as a 

Significant Liability 

Protection Tool 

1. Bank Secrecy Act 12 CFR 748, 31 CFR 

103 (Primary 

Regulation) - The Law 

states that the general 

BSA/AML program is 

to be Approved by the 

Board. The Board 

also appoints the BSA 

Officer. NOTE A. 

2. Bank Secrecy Act 

Risk Assessment 

For the most part the 

day-to-day 

procedures are 

addressed in several 

procedures; and via 

the Credit Union 

training materials and 

record of training. 

NOTE B. 

Must be presented to and approved by the Board. NOTE C. 

No Further Comment. 



31

3. Asset/Liability 

Management Policy 

and Procedures 

An ALM Policy is not 

actually required. 

However Read -- NOTE 

D as it is nonetheless 

recommended. Here you 

may also address loan 

concentration targets 

(with loans by type, risk 

tier, concentration 

levels, etc). This will 

make your Examiner 

happy and concentrate 

such information in “one 

place” facilitating the 

ease of review. NCUA 

General Procedures 

may be adopted as 

approved by the 

Policy – such as 

Investment 

Procedures may be 

Separate for 

Management – Board 

to Operate within the 

parameters of the 

Policy 


6. Advertising 

Procedures 

9. Credit Union 

Physical Security 

Procedures 

15. Compliance 

Program Policy and 

Procedures 

NA NA Procedures 

Recommended with 

Tie-in to Compliance 

Policy and Required 

Approvals due to 

Liability and 

Reputation Risk 

Exposure. 

NA 

Procedures are No Further Comment. 

Strongly 

Recommended and 

Likely Expected 

based on issues 

addressed in the 

NCUA Examination 

Guide as if Credit 

Union’s -- Treated as 

if Included in 12 USC 

1881 (“Bank Security 

Act”) See – NCUA 

Letter No. 02-FCU-12 

NA NA Recommend a Short 

Policy and a More 

Detailed Procedure to 

support the Credit 

Union’s compliance 

operations and to 

provide “good faith” 

error defense 

protections available 

in case of a claim or 

regulatory action. In 

this policy the Credit 

Union can address 

basic due diligence, 

training and “good 

faith” procedures to 

insure compliance – 



32

16. Conflict of 

Interest/Code of 

Ethics Policy and 

Procedures 

Policy is Required 

(also covers “Bank 

Bribery Act”: See 

NCUA Letters to 

Credit Union Nos. 03- 

FCU-07 (General and 

Sarbanes-Oxley 

Standards); NCUA 

Letter No. 84 on 

Insider Dealing and 

Conflicts of Interest 

Policies and 


bifurcated as the 

Credit Union chooses. 

However, the 

elements addressed 

in the foregoing must 

be addressed. 

rather than 

addressing same via 

several different 

polices (i.e., include 

all the general 

regulatory polices 

and/or procedure here 

into a single “Board 

Approved Policy” with 

Detailed Management 

Procedures. 


18. Credit Union 

Business Continuity 

Policy and 

Procedures // 

Disaster Recovery – 

// and Pandemic 

Influenza Policy and 

Procedures 

Policy Required: 05- 

FCU-02 – Travel 

Expenses (to pay / 

reimburse) 

NCUA Letter No. 109 

–The board of 

directors and senior 

management of 

financial institutions 

are responsible for: 

• Establishing policies, 

procedures and 

responsibilities for 

comprehensive 

contingency planning. 

• Reviewing and 

approving the 

institution's 

contingency plans 

annually, 

documenting 

such reviews in board 

minutes 





However, the 



be addressed. 


Required: See NCUA 

Letters to Credit 

Union Nos. 08-FCU- 

01; 06-FCU-12; 06- 

FCU-06; 01-FCU-21; 

98-FCU-12 



33

19. E-Banking 

Compliance Policy 


20. E-Commerce 


See Also, 

Information Security 

Below 

25. Fair Credit -- 

Equal Credit 

Opportunity Act 

(ECOA) Policy and 

Procedures 

26. Fair Credit 

Reporting Act Policy 


28. Risk 

Assessment of 

Insurance and Bond 

Coverage per Credit 

General – NCUA 

Letters to Credit 

Union Nos. 02-FCU- 

17; 97-FCU-05 and 

97-FCU-05a 

(Authentication) -- 05- 

FCU-18 

See Also, Information 

Technology and 


Addressed via either 

Policies and/or 

Procedures as the 


However, the 



be addressed. 




NCUA Letter to Credit Union No. 06-FCU-13 – Risk Assessment 

Required; NCUA Letter to Credit Union No. 01-FCU-12 (and to inform 

the Board of the Risk Assessment). See also FFIEC Guidelines. This 

includes an insurance risk assessment to include all high risk areas. 

NCUA Letter to Credit Union No. 02-CU-08 (Re: Account Aggregation) – 

and OCC Bulletin 2001-12 

Recommend a 

General Statement of 

Policy in Credit 

Union’s General Loan 

Policy. See 

Recommendations in 

the Section Above on 

a Compliance Policy 

NA – Red Flags and 

Identity Theft are 

addressed separately 

below. It is our 

recommendation to 

have complete FCRA 

Policy/Procedure as 

“Red Flags” standing 

alone does seems 

incomplete. 

NA 

NA – Red Flags and 

Identity Theft are 

addressed separately 

below. 

Appropriate 

Procedures are 

recommended tools to 

insure compliance 

with the complex laws 

that govern this area 

– and to protect 

against violations of 

such laws -- noncompliance 

with 

which may subject the 

Credit Union to 

significant damage 

claims. 

Appropriate 









with 

which may subject the 

Credit Union to 

significant damage 

claims. These may 

incorporate Red Flags 

and Identity Theft for 

consistency, which we 

also recommend. 

NCUA Rules and Regulations: 12 CFR 713.5; NCUA Field Examiner’s 

Guide – Chapter 6 – Appendix A (Page 6A-6) 

34

Union Assessment 

33. Identity Theft 


Procedures // Red 

Flags Policies - 

Procedures 

34. Red Flags Risk 

Assessment 

12 CFR 717.82 and 

717.91; and NCUA 

Letter to Credit Union 

No. 08-FCU-24 // 



required 

See Prior Entry – 

Properly drafted with 

supporting forms – 

these procedures may 

provide additional 

liability protection for 

the Credit Union and 

its Volunteers / Senior 

Management 

Annual – Must be Approved by the Board or a designated Board 

Committee 

36. Incident 

Response Policy 


39. Information 

Security and 

Information 

Technology Policies 

and Procedures; 

Internet Use Policy 


40. Information 

Technology Security 


43. Risk 

Assessment of 

Investments 


717.91; and NCUA 


No. 08-FCU-24 // 



required in part by the 

same laws governing 

Identity Theft and Red 

Flags 

12 CFR 748 and 

Appendices NCUA 


Nos. 06-FCU-10 06- 

FCU-06; 03-FCU-07 

General IT – FFIEC 

Guidance; 03-FCU- 

14; 03-FCU-06; 

Personnel and 

Responsibilities for IT 

and Patch 

Management; 01- 

FCU-11- Electronic 

Data Security; 99- 

FCU-19 – Monitor for 

Security Intrusions; 

06-FCU-07 E-Banking 

Security; 00-FCU-02 

Background Checks; 

03-FCU-08 Weblinking 

Risks (See 

also 02-FCU-04); 03- 

FCU-08 Wireless 

Technology; 05-FCU- 

See Prior Entry -- 



NA 

Properly drafted with 

supporting forms – 

these procedures may 

provide additional 

liability protection for 

the Credit Union and 

its Volunteers / Senior 

Management 

See NCUA Letter No. 

02-FCU-08 Re: 

“account aggregation 

services.” 

20 Phishing 

NCUA Letter to Credit Union No. 06-FCU-13 – Risk Assessment 

Required; NCUA Letter to Credit Union No. 01-FCU-12 (and to inform 

the Board of the Risk Assessment) NCUA Rules and Regulations: 12 

CFR 748.and Appendices; 12 CFR 749.and Appendix B 

NCUA Rules and Regulations: 12 CFR 703.13(c)(1) and (e)(2); NCUA 

Field Examiner’s Guide – Chapter 12 

35

46. Loan 

Participation Policy 

47. Loan Policy and 

Procedures 

48. Written Loan 

Extension 

Procedures 

49. Member 

Business Lending 


Procedures 

50. Risk Based 

Lending 

Policy/Procedure 

Required Policy -- 12 

CFR 701.22 


12 CFR 741; NCUA 

Letter No. 154 

Section 10 NCUA 

Field Examiner’s 

Guide 

12 CFR 723; NCUA 


Nos. 04-FCU-01 (SBA 

Loans) 04-FCU-10 

(Underwriting – Self- 

Employed) 


and NCUA Letter to 

Credit Union No. 99- 

FCU-05 

Appropriate Policies / 

Procedures should be 

adopted in connection 

with a Loan 

Participation Policy. 


Procedures should be 


Credit Union 

determines to be best 

-- with the basic 

issues addressed in 

Policy as required. 

However, whatever 

choices the Credit 

Union makes -- the 



be addressed via 

policy as noted. 


Appropriate 









and also 

to insure the Credit 

Union uses these 

laws in a manner that 

protects the Credit 

Union (as is – at least 

in part – the intent of 

the law in question). 

51. Loan Review and 


Issues 

Lending Generally – Including Audit and Loan Personnel 

Assessments: NCUA Accounting Bulletin 06-01; Risk Based Lending: 

NCUA Letter No. 174 and NCUA Letter to Credit Union No. 99-FCU-05 

53. NSF and/or 

Overdraft Privilege 


Procedures 

Policy may be a short 

statement with more 

detailed procedures 

under the applicable 

and evolving laws 

See, 12 CFR 701.21 

and NCUA Letter to 

Credit Union Nos. 05- 

FCU-21. 05-FCU-03 

54. Privacy Policy Required Per 12 CFR 

716 

55. Record 

Retention Policy and 

Procedures 

56. Record 

Production 





However, the 



be addressed. 

Credit Union may also 

wish to have 

procedures; or to 

adopt procedures in 

connection with 


12 CFR 748 and 749 Policies and 




However, the 



be addressed. 






NA NA Recommend Detailed 

Procedures on the 

36

Procedures 

60. Training Policy See Standard NCUA 

Bylaws – Article VI. 

Section 6. 

64. Vendor 

Management Policy 


65. Vendor Risk 

Assessment 

General: See NCUA 

Letter Nos.: 00-FCU- 

11; 07-FCU-13; 01- 

FCU-20; and 08-FCU- 

09 03-FCU-06; 

02-FCU-13; Mortgage 

Brokers: 08-FCU-19 

Technology Vendors: 

02-FCU-13; 

Information System 

Service Providers 98- 

FCU-11; Brokers 

(Investments) See 




NA 

May address 

applicable provisions 

in depth via 

procedures vs. policy 

as long as in accord 

with what can be a 

very brief policy. 

Production of 

Information to avoid 

Privacy Violations in 

light of the many 

situations a Credit 

Union faces in this 

regard. 

We include this in the 

General Compliance 

Policy. See Above. 

This is incredibly 

important as Credit 

Union place 

themselves in 

significant peril by 

entering into contracts 

that do not address 

“before – during and 

after.” From a legal 

and compliance point 

of view – this is an 

absolute must – with 

proper and intelligent / 

experienced legal due 

diligence-contract 

reviews upon which to 

negotiate and assess 

contractual 

relationships (what we 

refer to a the 

“prenuptial” in the 

contractual marriage). 

NCUA Supervisory Letter No.: 07-01: Third Party Vendor / 

Outsourcing: “Risk assessments for less complex third party 

arrangements may be part of a broader risk management program or 

documented in board minutes.” NCUA Letter to Credit Unions No. 08- 

FCU-09. 

NOTE A: Generally the policy should address the overall program or reference the program in a 

short policy. For the most part we address the details of BSA/AML in procedure, but recommend 

the policy refer to and incorporate approval of same. Also, be sure the appointment of the BSA 

Officer empowers the BSA Officer to delegate tasks/duties to others as this is common in the 

industry as long as the BSA Officer maintains oversight. 

NOTE B: Procedures will address the following 

NOTE C: The BSA/AML Manual (FFIEC) provides that it is “sound practice to update the risk 

assessment every 12-18 months” or as needed. This risk assessment and updates should be 

specifically documented and noted in the Board Minutes. 

NOTE D: See NCUA Letter to Credit Union No. 00-FCU-10 for Examination Procedure Summary. 

Also, Chapter 13 of the NCUA Field Examiner’s Guide Provides: “However, no requirement exists for a 

separate IRR (“interest rate risk”) or ALM policy independent of other policies, even for large, complex 

credit unions. Credit unions have the option of either creating a separate IRR or ALM policy or 

37

incorporating it into Investment, Cash Management, or other policies. The form of the policy is not as 

important as its scope. Regardless of form, credit unions should clearly document their IRR management 

program in writing.” See 02-FCU-09 for General Guidance on Allowance for Loan and Lease Losses; See 

01-FCU-08 for Liability Management Guidance; See 01-FCU-19 for Managing Share Inflows in Uncertain 

Times; 99-FCU-12 Managing Real Estate Balance Sheet Risk; NCUA Letter No. 126 on Guidelines for 

Establishing and Maintaining Allowance for Loan Losses (ALL); NCUA Letter Nos 154 and 157 on 

Investments and Selection of Brokers 

Preparing for new laws and regulations in 2010 

including significant developments with Truth-in- 

Lending and Regulation Z 

Due Diligence – Due Diligence – Due Diligence 

93A-2009 Community Notice // Open-end / Closed-end Lending July 2010 -- Be 

Sure to Assess the Big Picture 

Credit Unions keep hearing statements like – “multi-featured, open-end lending is 

a viable alternative for credit unions” --- I would agree in part yes – BUT – in part 

no. I am not concerned with the plan or forms you choose to use. I am concerned that 

you understand the systems and insure you have forms, procedures and training that 

“consistently” provide for compliance with the “coming TILA changes.” Below are 

excerpts sent to me from the CUNA website and my responses, which I provide to 

clients only to insure you are all considering the scope of issues I feel are appropriate to 

the “big picture.” 



38

Also – consider the other changes coming such as the CARD Act affects on 

periodic statements (which do not apply to closed-end loans) …. 

Further, when reviewing information from vendors such as the following from 

CUNA© be sure to assess the full nature of the question ---- 

Q: Can a credit union offer secured advances under [Multi-Featured Open-end 

Lending Plan] MFOEL? 

A. YES. Regulation Z allows credit unions to offer secured advances. The 

commentary states: “Some creditors offer programs containing a number of different 

credit features… Some features of the program might be used repeatedly (for example, 

an overdraft line) while others might be used infrequently (such as the part of the credit 

line available for secured credit). If the program as a whole is subject to prescribed 

terms and otherwise meets the definition of open-end credit, such a program would be 

considered a single, multi-featured plan.” (Regulation Z 226.2 (a)(20)). 

Ask yourself this question – how many additional advances can the member 

obtain under their new 60-month car loan under their “open-end” plan? Note – it 

says “infrequently” --- not one single advance under a “sub-account” under 

which the Credit Union does not allow future advances. Also – review your 

periodic statements on these open-end loans to insure your compliance with 12 

CFR 226.7 and after August 20, the CARD Act. 

Q: How do credit unions make informed credit decisions at the time of individual 

advance requests? 

A: Credit information about borrowers may be routinely verified throughout the plan 

through a credit update, credit report, or other means that a credit union establishes. 

The credit union may refuse an advance request under the plan due to the deterioration 

of the member's creditworthiness. 

This does not address the “underwriting” issue or assessment with an 

application, or assessment of a CR in connection with a risk-based lending 

system. In fact – it appears to paint over this key element. Here is what we wrote 

previously: 

HOWEVER – the FRB has adopted rules that will allow Credit Unions to continue 

to use “multi-featured open-end plans,” but will require a closed-end disclosure 

in connection with such a subaccount or advance (i.e., a “clopen-end loan 

disclosure”). Here is the crux of the new rules: 



39

(1) NO CLOSED-END DISCLOSURE GIVEN WITH “THE 

ADVANCE/SUBACCOUNT” – IF --you merely verify loan file 

credit information; and engage in no further underwriting of 

the loan. 

(2) A CLOSED-END DISCLOSURE BEING GIVEN WITH “THE 

ADVANCE/SUBACCOUNT IF --you engage in any 

“underwriting” in connection with the advance/subaccount. 

1. PROBLEM: The FRB has declined to define “underwriting.” Brilliant – 

huh? In a recent conference call – off the record – FRB Staff stated that 

they would consider a Credit Union’s assessment of any additional 

information including the pulling of a credit report to be “underwriting.” 

2. So – is there any actions a Credit Union could take that would not be 

underwriting? I believe there may be – however – the “safe harbour” 

requires that we consider what “underwriting is” with a very broad view 

of the concept unless or until there is further definition – or case law to 

provide specific guidance. Is pulling a credit report “underwriting?” – 

Maybe. Is pulling a beacon score off a credit report to assign an APR 

“underwriting?” – Maybe. An example of the broad view of what 

underwriting is can be viewed based on information in various 

dictionaries – lender resources – etc. I find the following from Bank of 

America’s website interesting in this regard: 

What is underwriting? Once all the required documentation has been gathered, your 

application is submitted to underwriting. Underwriting is the process of reviewing all of the 

information and making a decision as to whether a borrower qualifies for a loan. Underwriters 

evaluate your ability to repay the loan (income), your willingness to repay the loan (credit) 

and the value of the property that you've identified (collateral). 

• Loan application. The information provided on your application helps the lender answer 

basic questions such as: 

o What is the source of your income, and is the source stable? 

o Is your income adequate to cover the expense of the new mortgage payment? 

o How much long-term debt (debt that will not be paid within the next 10 months) do 

you have? 

• Credit history. Your credit history helps lenders evaluate your ability to manage debt. It 

reflects how repayment of your bills has been handled in the past. In some cases where 

borrowers don't have an extensive credit history, some lenders will consider alternative 

payment records, such as rental payments and utility bills. 

Q: Can a credit union still offer Open End Plans (MFOEL) to their members and 

remain complaint with Regulation Z? 

A: YES. Credit unions can continue to offer members the benefits of MFOEL. A credit 

union will need to make adjustments to their policies, procedures and documents to 

comply with the changes made to Regulation Z including: Credit unions will need 



40

policies, procedures and documents in place in order to establish creditworthiness when 

a plan is opened and verify continued creditworthiness for advance requests. Maximize 

the ‘revolving’ nature of the open end plan (offering of an LOC or OD Line to members) 

Work with data processor to ensure changes are made for compliance to Regulation Z 

(e.g. periodic statements). 

Of course they can. This does not address any of the issues of consequence as 

to when a loan may not be open-ended (note it specifically focuses on LOC and 

OD – which is what OE lending should focus upon). 

Q: Do all subaccounts within a Plan need to be replenishing? 

A: NO. This misconception started due to the original proposal from FRB in 2007 which 

stated all subaccounts need to be self replenishing. This provision was removed in the 

final rule. 

The commentary states: “Some creditors offer programs containing a number of 

different credit features… Some features of the program might be used repeatedly (for 

example, an overdraft line) while others might be used infrequently (such as the part of 

the credit line available for secured credit). If the program as a whole is subject to 

prescribed terms and otherwise meets the definition of open-end credit, such a program 

would be considered a single, multi-featured plan.” (Regulation Z 226.2 (a)(20)). 

See comment above and the word “infrequently.” 

Q: Can credit unions offer vehicle secured advances under MFOEL? 

A: YES. Vehicle secured advances do not need to be self replenishing and are a 

permissible subaccount. A credit union can verify continued creditworthiness based on 

their policies and procedures, to make an informed decision in relation to vehicle 

secured advance requests 

Of course they can – the question is – “is this really and OE advance.” Again, the 

question – how may additional advances can a member receive on his/her car 

loan sub-account? 

123-2009 Community Notice // Forms – Truth in Lending Homework and Due 

Diligence. 



41

In conducting your assessments regarding forms in light of recent CARD Act and pending 

TILA/Z changes, there is much being written on what Credit Unions should do with regard to 

forms. I have noted many issues that do not appear to be addressed consistently, or with an 

appreciation as to how Credit Unions actually conduct business day-to-day. Since I make no 

more and no less regardless of which systems of forms my Credit Union clients use I have 

prepared the following table to clarify some of these considerations; and to provide you with 

some guidance in the assessments you will be making between now and next Spring. 

NOTE: Although not required, as with the recent CARD Act, I believe there will be significant 

individual assessments Credit Unions will be making in preparing for the February and July 

2010 changes. Thus, as with CARD, individual conference calls to discuss legal and compliance 

issues, impacts, options, etc., may be the best course of action. I found these individual 

assessments to be illuminating for Credit Union and myself. 

Issue/Considerations and 

some Statements by Others 

– Clarified / Fully Addressed 

to Insure you have all the 

facts needed to make proper 

decisions. 

Open-End Lending 

Closed-end Lending 

Costs / Expenses 

Which Vendor 

Simplicity 

Flexibility 

This is an operational issue; and as a lawyer I have no input into 

such matters. However, in conducting your due diligence it may 

be considered appropriate to address this query to three quality 

vendors to likely assess a combination of OE and CE forms; or 

to conduct a cost/operations assessment of OE vs. CE. You 

may find an option that suits your assessment; and also saves 

the Credit Union a great deal of money. 

“Yo No Sé !” – “I Do Not Know.” Pick a good one that addresses 

your due diligence assessment concerns; has good answers to 

questions such as those that follow; and provides a good value 

to your Credit Union. 

OE is complex; Requires 

multiple documents; and many 

systems require follow up 

documents or “Proceeds 

Checks” with proper payees 

and must be properly 

endorsed to protect a Credit 

Union’s Security Interests 

The main advantage of OE 

Lending was its flexibility. That 

has been curtailed (if not 

entirely diminished) by recent 

laws and regulatory changes. 

CE is simple; requires on 

document; and you do not 

have the follow up concerns of 

OE plan documents. 

CE loans we never flexible 

(they did not need to be). They 

are one-time “deals.” They are 

intended to be simple. 

Periodic Statements Mandatory and Costly Never required; and thus 

much less costly to administer. 

A coupon book is not required. 

It is sometimes provided by a 

lender as a payment 

remainder or processing tool. 



42

Underwriting 

Advertising 

In July 2010, any loan where 

the Credit Union engages in 

underwriting – requires 

“closed-end” disclosures. This 

may be in connection with an 

OE plan – which means it is 

an OE Plan Subaccount with a 

CE feature (what we call 

“Clopen-ended”). Contrary to 

recent webinars/call-ins which 

have been brought to our 

attention by individual Credit 

Unions – Underwriting is a 

broad and encompassing 

concept. Verification (not in 

connection with a request, but 

periodic reviews such as a 

VISA Credit Card LOC) is not 

underwriting. Assessing an 

application for a 60-month car 

loan subaccount and/or pulling 

a beacon score for the risk 

based pricing of the subaccount 

is underwriting and 

CE disclosures are required. 

OE rules apply to OE loans. 

What rules is the Credit Union 

to apply to a “Clopen-end” 

loan? It is not clear as Truth in 

Lending and its basic 

principles provide for OE and 

CE. TILA does not provide for 

“Clopen.” If your Credit Union 

provides such lending – then 

you will need to provide 

special disclosures to explain 

the contradictions (example 

“60-month” car loan – that is 

Open-ended – but not other 

Credit Union’s always have 

the right to evaluate credit 

without being concerned that 

they will convert a CE loan to 

some other loan type. CE is 

always simple. 

CE rules apply to CE loans 

advances are allowed). 

Special Training Training is always required. Training is always required. 

Also, most Credit Unions 

already offer CE loans (via 

indirect lending, real estate or 

other). Thus, statements that a 

Credit Union will have to be 

“retrained” to use CE lending 

appear to be somewhat 

uninformed. 

Obtain Signatures with Each 

Loan or Advance 

Sometimes. It depends on 

whether a new security 

interest is being given. In such 

a case the Credit Union has to 

create a Security 

Generally, yes. However, 

Credit Union’s may use 

technology (scan/email // fax // 

e-signatures // etc) to facilitate 

CE loans as the applicable 



43

Agreement/Advance Voucher; 

and either this item or the 

“advance proceeds check” has 

to be signed. Thus, signatures 

are generally required for 

collateral loans (which most 

CE loans are). Note: The 

MFOE Plans rely on advance 

proceeds checks being 

properly drawn and endorsed 

to provide a proper security 

interest under UCC Article 9. 

Query – pull a sampling of 

your current OE loans and see 

if: (1) The checks are always 

made payable to all owners of 

the collateral to be pledged; 

and (2) all of those persons 

actually endorse the advance 

proceeds check. 

laws have caught up with 

technology. Remote lending is 

very much possible; most 

likely simpler; and less likely to 

create the paper mistakes of 

current OE systems. 

Remote Lending See Above See above. Also with a CE 

Loan Application that provides 

the Application will serve for all 

loan requests, the CE system 

and technology can in fact 

facilitate remote lending. 

Internet banks use it 

exclusively – not OE loan 

forms. 

In Branch Closings See Above See Above 

Modifications 

“Skip-a-pay” Programs 

As an OE Plan (an ongoing 

relationship) many changes 

require disclosures under 

TILA/Z; of may need to be 

addressed via the Credit 

Union’s Periodic Statement 

with revised or additional 

disclosures. 

Require additional disclosures; 

or in most cases – are not 

allowed where fees are 

charged (as these fees affect 

the APR). 

As a CE loan, modifications 

generally require no 

disclosures. Though some 

simple confirmation is 

generally recommended. 

Readily Available as TILA/Z 

have no requirements; and 

fees are not considered in the 

APR. 

Moving forward together to meet members' needs and to exceed expectations, 

Todd 



44

135-2009 Community Notice // OE/CE Loan Assessment and Comparison and 

Understanding Common Security Interest Documentation Issues Credit Union’s 

Face; and comparing OE versus CE Systems 

Assessing Fairly and Honestly OE vs. Closed End: To Determine which is the 

Better Compliance Solution for the Credit Union for July 2010 AND Thereafter? 

Closed-end versus Open-end – Signatures Required for Secured Loans are also 

required for Secured Advances under an LOC where a New Collateral Interest is 

Pledged. Misleading Sales Programs on the Simplicity of OE Lending Plan 

without a Discussion of the Risks of failing to property perfect such loans -- 

This is intended to dispel the somewhat misleading statement that MFOE Lending 

Plans are Better due to the fact that a Credit Union is required to obtain new 

signatures on each Closed-End loan it makes (with it being considered a given 

that this is not the case with OE Lending). This is not necessarily true as to 

collateralized OE loans. In fact, a MFOE Lending Plan is not based on one set of 

signatures. It is based on one set to establish the plan; and then may require 

follow up – additional signatures as time goes on in connection with collateral 

pledged to secure each loan/sub-account under the MFOE Plan. It is here that a 

Credit Union may face greater concerns that it may necessarily understand; and 

in considering the following – a simpler CE option may actually lead to lesser 

exposure to the Credit Union. Regardless of whether the Credit Union ultimately 

chooses OE or CE lending (as both will work “IF” properly used) – a Credit Union 

must assess and understand the following issues. 

Why does not one signature cover all loans/sub-accounts? 

It is a state law issue governed by laws that establish lien rights such as Article 

Nine of the Uniform Commercial Code (“UCC”). These laws require that a 

borrower give a lien at a time that is “proximate” to the time the lien is created 

(and thus a signature on a MFOE Plan months or even years before is likely not 

considered “proximate” to the time a car loan sub-account is opened on a five 

year old plan). Ref. Articles 9-203 and 9-204 of the Uniform Commercial Code. 

What is the Risk? 

The Credit Union may be using a MFOE Plan with one set of signatures to open a 

plan; and then the Credit Union uses a separate disbursement voucher and/or 

security agreement or a restrictive endorsement on the back of the OE Loan 

Disbursement Check to address the need for a signature for the pledge of the 

collateral intended to secure the loan. In assessing this compare: 

Closed-End Loan Execution Compliance 

Simple, but requires Requires Execution and System is Compliant 



45

Signatures 

Open-End Loan 

Complex – Multiple 

documents and Signatures are 

needed. 

Signatures when loan is 

obtained. Note is combined 

with the Pledge of Collateral – 

so only (1) set of signatures is 

required. 

Risks: De Minimis Assuming all 

parties who are borrowers or 

owners of the collateral sign 

the note and security 

agreement to document the 

pledge of collateral to the 

Credit Union. 

Execution 

Requires Execution and 

Signatures when loan is 

obtained on Credit Plan. Later 

is Time – when collateral is 

pledged the Credit Union is 

required to obtain a second set 

of signatures by way of a 

Disbursement Voucher and 

Security Agreement; or by use 

of a proper restrictive 

endorsement on the back of the 

loan proceeds check. 

when properly used. 

System is also 

Compliant when 

properly used. 

Risks: De Minimis Assuming all 

parties who are borrowers or 

owners of the collateral sign 

the note and security 

agreement to document the 

pledge of collateral to the 

Credit Union. 

In assessing just how compliant the Credit Union has been on the assumption that it uses 

its current MFOE system well – we recommend the following to test your understanding 

and use: 

Pull 30 current OE Loans where a Security Internets ins Car, Boat, Truck, etc., was pledged 

to the Credit Union. Assess the following: 

As to collateral loans, did 

the Credit Union in fact 

obtain the signatures of all 

owners of the collateral 

pledged on the Security 

Agreement used? This item 

will need to have been 

created and sighed close in 

time to the loan/advance 

secured by the collateral. 

If any one needed signatures 

was not obtained – the 

If the Credit Union relies 

upon the execution of a loan 

proceeds check with a 

restrictive endorsement 

assess: (1) IS the check 

payable to all owners?; and 

(2) did all owners in fact 

endorse the check? 

If the owners did not sign 

the restrictive endorsement 

If there Credit Union relies 

on the third party owner who 

is not a borrower to pledge a 

security interest -- 

If the collateral pledged is 

owned in whole or in part by 



46

Credit Union’s lien right are 

not complete. 

on the check properly and 

the Credit Union has no 

other manner to document 

the pledge of the security 

interest – then the Credit 

Union’s lien rights may not 

have attached. 

If there were a third party 

owner who was not a 

borrower the Credit Union 

could not list the third party 

owner on the check, but 

would have to use a 

separate security agreement 

or third party pledge form. 

another person who is not a 

borrower – did the Credit 

Union obtain a properly third 

party pledge from the other 

owner. 

Many Credit Unions make misstates in documenting the giving of security 

interests based on the requirement of OE lending and the options discussed 

above. As noted, both can work if used properly, but one is much easier ands 

does not require as many “parts” to document compliance. Intimately the forms 

systems question is for the Credit Union to assess and determine. However, you 

need to also assess what you are using, determine if you are using it as intended; 

and whether or not doing so – in order to understand the risks the complexity of 

OE Lending exposes you to. 

How to verify if your credit union is in proper 

compliance with Fair Credit Reporting Act / FACT Act 



47

Tips to verify if your Website meets critical areas of 

compliance 

New opt-in requirements for fee-generating services 

TISA / Regulation E 

CARD Act -- TILA / Regulation Z 

Other recent legal and regulatory issues including 

recent NCUA actions 



48

regulatory and compliance issues and considerations

Create successful ePaper yourself

Delete template?

Save as template?