NCUA 2025 Supervisory Priorities

In Letter to Credit Unions 25-CU-01, the NCUA outlined its supervisory priorities and updates to its 2025 examination program.

The letter states that “there continued to be signs of financial stress on credit union balance sheets during 2024. Aggregate loan performance began to deteriorate in 2022, and the trend has continued through 2024. The overall loan delinquency rate is currently at its highest point since year-end 2013, while the rolling 12-month net charge-off rate is at its highest point since the second quarter of 2012. Additionally, the return on average assets continues to experience pressure from the interest rate environment and provision for loan and lease loss expense.”

With this in mind, the NCUA’s primary focus for 2025 will be:

Credit Risk
NCUA examiners will continue to review credit unions’ lending and related risk-management practices. This priority will include reviewing the sufficiency of loan underwriting standards, collection programs, Allowance for Credit Losses reserves, charge-off practices, management and board reporting, and management of any concentrations of credit risk. To the extent possible, examiners will also review credit unions’ third-party risk-management practices when lending, servicing, or collection functions are outsourced.

Balance Sheet Management and Risk to Earnings and Net Worth
For credit unions, the primary market risk element is interest rate risk. Interest rate changes can affect the income credit unions generate from their lending and funding activities, which can affect a credit union’s ability to build net worth. Loan losses can also diminish a credit union’s earnings and net worth.

In evaluating credit unions’ earnings and net worth risk-management frameworks, examiners will weigh the current and prospective sources of earnings and the composition of net worth relative to a credit union’s approved plans and thresholds. This approach will help examiners focus on trends in earnings and develop a better understanding of concentration risks for both earnings and net worth. Also, examiners will continue to consider the current and prospective sources of liquidity compared to funding needs to determine the adequacy of a credit union’s liquidity risk-management framework. Examiners will review credit unions’ policies, procedures, risk limits, and evaluate the adequacy of a credit union’s risk-management framework relative to its size, complexity, and risk profile.

Cybersecurity
Examiners will continue to use the information security examination procedures to assess whether a credit union has implemented robust information security programs to safeguard both members and the credit union itself.

In Letter to Credit Unions 25-CU-02, the NCUA updated Letter to Credit Unions 23-CU-07 and announced the availability of a new cyber incident reporting webform. Credit unions now have three methods to report cyber incidents:

• Complete the Cyber Incident Credit Union Reporting System online form to send a secure incident report.
• Call the NCUA at 1.833.CYBERCU (1.833.292.3728) and leave a voicemail.
• Email the NCUA utilizing the Secure Email Message Center to send a secure email to cybercu@ncua.gov.

Consumer Financial Protection
As always, the NCUA will continue to prioritize reviewing compliance with consumer financial protection laws and regulations during every examination. In 2025 examiners will, in particular, assess credit unions’ compliance with the following consumer financial protection areas:

• Overdraft programs. Examiners will continue a review of credit union overdraft programs, including policies, procedures, disclosures, fees, account statements, member complaints, internal reviews, and websites.

The CFPB withdrew its proposed rule on instantaneously declined transactions and is considering “whether a more comprehensive approach to also prohibit NSF fees charged for additional types of transactions will better protect consumers from potentially unlawful fees.”

• Fair lending. Examiners will assess policies and practices for identifying and mitigating potential discrimination in residential real estate valuation practices.

On December 4th, 2024, the Federal Reserve hosted a multi-agency Fair Lending Webinar, in which the NCUA stated that “The NCUA’s division of Fair lending supervision will schedule fair lending examinations in 2025 to review redlining risk and risk management practices at credit unions with recent underserved area expansions. Credit unions, especially those with fields of membership defined by or partially defined by geography, such as community charters and underserved areas, must ensure they provide equal access to credit in the market areas defined within their fields of membership.”

• Home Mortgage Disclosure Act and Regulation C. Examiners will evaluate compliance with Home Mortgage Disclosure Act data collection and reporting policies and practices, including transaction testing, for credit unions above the reporting threshold.
• Military Lending Act. Examiners will review compliance with the Military Lending Act requirements, including policies and procedures, compliance management systems, and checking and monitoring for military status.
• Electronic Fund Transfer Act and Regulation E. Examiners will assess policies and procedures related to payments and error resolution.

The NCUA also says that it will update its exam flexibility initiative to provide an extended exam cycle for credit unions over $1 billion in assets where the NCUA rated the credit union a CAMELS composite 1 or 2 with no change in CEO since the last examination. These institutions will now be eligible for a 12- to 16-month exam cycle. Additionally, the extended exam cycle for eligible federal credit unions will be shortened from 14 to 20 months to 14 to 18 months.

• Eligibility of Federal Credit Unions for Extended Exam Cycle
• Eligibility of Federally Insured, State-chartered Credit Unions for Extended Exam Cycle

Please be advised that CSG provides financial services compliance audit and consulting services to our clients.  The services that we provide include certain tasks that may be characterized as “law-related services” under Rule 5.7 of the Rules of Professional Conduct governing lawyers.  Since some of our employees are lawyers with an active bar license but are NOT engaged in the private practice of law, that Rule requires us to make disclosures clarifying that the services we perform may be law-related services, but they are not legal services.  Because they are not legal services, those services and our relationship will not be governed by the Rules of Professional Conduct that guide the client-lawyer relationship, such as rules applicable to privileged communications and prohibitions of conflicts of interest.  Notwithstanding this disclaimer, we will continue to govern our relationship with you using reasonable ethical and professional standards that are expected to meet your expectations.