regulatory and compliance issues and considerations

Procedures
60. Training Policy See Standard NCUA
Bylaws – Article VI.
Section 6.
64. Vendor
Management Policy
and Procedures
65. Vendor Risk
Assessment
General: See NCUA
Letter Nos.: 00-FCU-
11; 07-FCU-13; 01-
FCU-20; and 08-FCU-
09 03-FCU-06;
02-FCU-13; Mortgage
Brokers: 08-FCU-19
Technology Vendors:
02-FCU-13;
Information System
Service Providers 98-
FCU-11; Brokers
(Investments) See
NCUA Letter No. 157
Copyright©1994-2010 by Credit Union Resources & Educational Services, LLC. All rights reserved.
Revised February 2010
NA
May address
applicable provisions
in depth via
procedures vs. policy
as long as in accord
with what can be a
very brief policy.
Production of
Information to avoid
Privacy Violations in
light of the many
situations a Credit
Union faces in this
regard.
We include this in the
General Compliance
Policy. See Above.
This is incredibly
important as Credit
Union place
themselves in
significant peril by
entering into contracts
that do not address
“before – during and
after.” From a legal
and compliance point
of view – this is an
absolute must – with
proper and intelligent /
experienced legal due
diligence-contract
reviews upon which to
negotiate and assess
contractual
relationships (what we
refer to a the
“prenuptial” in the
contractual marriage).
NCUA Supervisory Letter No.: 07-01: Third Party Vendor /
Outsourcing: “Risk assessments for less complex third party
arrangements may be part of a broader risk management program or
documented in board minutes.” NCUA Letter to Credit Unions No. 08-
FCU-09.
NOTE A: Generally the policy should address the overall program or reference the program in a
short policy. For the most part we address the details of BSA/AML in procedure, but recommend
the policy refer to and incorporate approval of same. Also, be sure the appointment of the BSA
Officer empowers the BSA Officer to delegate tasks/duties to others as this is common in the
industry as long as the BSA Officer maintains oversight.
NOTE B: Procedures will address the following
NOTE C: The BSA/AML Manual (FFIEC) provides that it is “sound practice to update the risk
assessment every 12-18 months” or as needed. This risk assessment and updates should be
specifically documented and noted in the Board Minutes.
NOTE D: See NCUA Letter to Credit Union No. 00-FCU-10 for Examination Procedure Summary.
Also, Chapter 13 of the NCUA Field Examiner’s Guide Provides: “However, no requirement exists for a
separate IRR (“interest rate risk”) or ALM policy independent of other policies, even for large, complex
credit unions. Credit unions have the option of either creating a separate IRR or ALM policy or
37