CUNA Regulatory Comment Call
April 3, 2007
Records Preservation Program and Catastrophic Act Preparedness
- NCUA has issued a proposed rule to clarify the obligation of federally-insured credit unions (FICUs) to maintain a records preservation program. According to the Board, lessons learned from previous catastrophic acts, including events in the aftermath of Hurricanes Katrina and Rita, indicate the need for advance planning and preparation in successfully responding to a catastrophic act. While many elements of disaster recovery planning are covered in previous NCUA guidance, the proposal will clarify and identify critical issues for maintaining member services and confidence in the credit union system.
- At the Board meeting where the Board voted to publish the proposal for public comment, Board Member Hyland noted that this proposal balances the need for a records preservation program with the burdens to smaller credit unions.
- The proposal would revise the definition in Part 748 (Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts and Bank Secrecy Act Compliance) of the term catastrophic act to clarify that any event causing an interruption in vital member services for more than two business days is a qualifying event.
- Several revisions would be made to Part 749 (Records Preservation Program and Record
Retention Appendix), including:
- The question format currently used in the section headings would be replaced with language simply describing each sections contents.
- Changes to the vital records definition would clarify that share, deposit, and loan balances for each members account should be available as of the most recent business day, while the credit unions financial reports should be available as of the most recent months end. All other vital records should be updated as changes occur.
- Vital members services would be defined as informational account inquiries, share withdrawals and deposits, and loan payments and disbursements.
- Credit unions would be required to maintain certain emergency contact information.
- The definition of a vital records center would remain the same, but would clarify that a credit unions back-up site may be another federally-insured credit union.
- Language would be added to address the importance of having any equipment or software necessary to access the records at the vital records center. The equipment or software should permit the examiner to access those records during the examination process.
- FICUs which have some or all of their records maintained by an off-site data processor would be considered to be in compliance with requirements for the storage of those records as long as the service agreement specifies the data processor safeguards against the simultaneous destruction of production and back-up information.
- The proposal would mandate that a FICUs vital records preservation program be in writing. The proposal recommends that a FICU complement its written program by establishing a method for restoring vital member services in the event of a catastrophic act. It is further recommended that a FICU include in its written program a method for using duplicate records to restore vital member services in the event of a catastrophic act.
- A new appendix (Appendix B) would be added to Part 749 containing catastrophic
preparedness guidelines. The guidelines recommend that a credit union, with oversight
and approval of the FICUs board of directors, develop a program to prepare for a
catastrophic act. The proposed guidelines recommend that a catastrophic preparedness
program include the following five elements:
- A business impact analysis to evaluate potential threats;
- A risk assessment to determine critical systems and necessary resources;
- A written plan addressing such issues as persons with authority to enact the plan, preservation and ability to restore vital records, communication with employees and members, notification of regulators, training of employees, and testing procedures;
- Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant; and
- Annual testing.
- NCUA has decided to expedite the rulemaking process in this case to allow for the issuance of a final rule prior to the height of the approaching hurricane season. The comment period for this proposal has been shortened to 45 days. Comments are due to NCUA by May 11, 2007. Please send your comments to CUNA by April 27, 2007. Please feel free to fax your responses to CUNA at 202-638-7052; e-mail them to Deputy General Counsel Mary Dunn at email@example.com or to Senior Regulatory Counsel Catherine Orr at firstname.lastname@example.org; or mail them to Mary or Catherine in c/o CUNA's Regulatory Advocacy Department, 601 Pennsylvania Avenue, NW, 6th Floor - South Building, Washington, DC 20004. You may also contact us at 800-356-9655, ext. 6743, if you would like a copy of the proposal, or you may access it here.
QUESTIONS REGARDING THE INVITATION TO COMMENT
- Do you agree with the proposed modification in the definition of catastrophic act
to state that either physical destruction or damage to the FICU, as in the current rule
, or interruption in vital member services lasting more than 2 business days would
Yes ______ No ______
- Do you agree with the new definition of vital records?
Yes ______ No ______
- Do you feel the definition of vital member services is complete and appropriate?
Yes ______ No ______
- In the proposal, the Board recognizes that FICUs generally engage in some form of
planning for catastrophic acts and have access to existing guidance on disaster preparedness,
which is parallel. In light of those facts, the Board is specifically requesting feedback on
the usefulness of providing recommendations to assist FICUs to prepare for catastrophic acts.
Do you believe there is a need for the proposed Appendix B Catastrophic Act Preparedness
Yes ______ No ______
- Other comments?
Eric Richard General Counsel (202) 508-6742 email@example.com
Mary Mitchell Dunn SVP & Deputy General Counsel (202) 508-6736 firstname.lastname@example.org
Jeffrey Bloch Assistant General Counsel (202) 508-6732 email@example.com
Lilly Thomas Assistant General Counsel (202) 508-6733 firstname.lastname@example.org
Catherine Orr Senior Regulatory Counsel (202) 508-6743 email@example.com