NAFCU Compliance Blog

Record Retention in the Real World

Written by JiJi Bahhur, Regulatory Compliance Counsel

As many of you know, the NAFCU Compliance Team has been in and out of the office all week at NAFCU’s Regulatory Compliance School at National Harbor, Maryland.  Today, I'm presenting on record retention.  

If I had to sum up record retention in one brief sentence, it would be as follows: It’s not that easy.

When coming up with a retention schedule, credit unions must be aware of all sources out there that affect the requirements.  My presentation focuses on NCUA’s Vital Records Preservation Program (12 C.F.R. Part 749), its Appendix A Retention Guidelines, other regulations and law, and also legal concerns.  

To demonstrate why “it’s not that easy,” I thought it would be fitting to share a real world example:

Question:   What is the retention requirement for credit card statements?  

The initial starting point is Regulation Z which covers credit card accounts.  Section 1026.25 of Regulation Z indicates that credit unions must retain evidence of compliance for two years.  Here is the regulation:

Ҥ 1026.25 Record retention.

(a) General rule. A creditor shall retain evidence of compliance with this part (other than advertising requirements under §§1026.16 and 1026.24) for 2 years after the date disclosures are required to be made or action is required to be taken. The administrative agencies responsible for enforcing the regulation may require creditors under their jurisdictions to retain records for a longer period if necessary to carry out their enforcement responsibilities under section 108 of the Act.” 

But note that NCUA’s retention guidelines (Appendix A of Part 749) mention that the following records must be kept permanently: 

"(h) Copies of the periodic statements of members, or the individual share and loan ledger. (A complete record of the account should be kept permanently.)” (Emphasis added).

The word “OR” exists in that statement so if you were to keep credit card statements only for 2 years, it would be fine as long as you are keeping individual ledgers permanently, so that you can reconstruct the member’s loan history if need be.

Also, take a look at the Official Staff Commentary from Regulation Z.  The section relating to record retention uses open-end periodic statements as an example and states that you don’t technically have to retain each one, so long as you are saving other records that have necessary information on it to reconstruct the history.

“25(a) General rule

..... 

2. Methods of retaining evidence. Adequate evidence of compliance does not necessarily mean actual paper copies of disclosure statements or other business records. The evidence may be retained on microfilm, microfiche, or by any other method that reproduces records accurately (including computer programs). The creditor need retain only enough information to reconstruct the required disclosures or other records. Thus, for example, the creditor need not retain each open-end periodic statement, so long as the specific information on each statement can be retrieved.” (Emphasis added)

And so there it is, folks.  We had to visit Regulation Z, Appendix A of NCUA’s Vital Records Preservation Program, and the Official Interpretations to Regulation Z to get our answer to what seemed to be such a simple question.  

Put on Your Thinking Hat and Sharpen Your Pencils; You Can't Spell Baseball without BSA; It Is Easy, Being Green

Posted by Anthony Demangone

NCUA reviews a third of its regulations every three years.  It maintains a "rolling list" of the rules that it will review in a given year.  Here is their list for 2011.   From a compliance point of view, here's what stood out:

• 748 Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts, and Bank Secrecy Act Compliance
• 749 Records Preservation Program and Appendices-Record Retention Guidelines; Catastrophic Act Preparedness Guidelines
• 760 Loans in Areas Having Special Flood Hazards

NCUA is asking for comments on these (and other) regulations by August 5, 2011.  Now's your chance.  So, ask yourself this question.  Is there anything that I'd like to see clarified in these rules?  Removed?  Added? 

Say It Ain't So, Livo.  If you've read this blog long enough, you'll know that I'm a big fan of the Washington Nationals.  Well, the fact that one of our best pitchers is the target of a money laundering investigation clearly caught my attention. (NatsInsider.com.)

NCUA is going green.  As part of its "Earth Day" efforts, NCUA reminded credit unions that its NCUA Express service is a nice and free way to get useful NCUA-related information and protect some trees. If you are a credit union employee and you have compliance or audit-related responsibilities, this is a no-brainer.  Sign up if you have not done so already.  If you are a consultant, though, you can't sign up.  I wish NCUA would allow any interested third party to sign up for this useful service.  The FDIC does.  So does the OCC.  And Treasury.  And FinCEN.  And the Department of Justice. And the CFPB. So please, NCUA - please let us sign up. If for no other reason, NCUA, do it for the trees.  Oh, and the children.  Do it for the trees and the children. 

Risk-Based Pricing Notice and Recordkeeping; Other Stuff

Posted by Anthony Demangone

As you pore over your risk-based pricing notice procedures, you may come across an interesting discovery.  There really are no record retention requirements spelled out in the final regulation.  So, what is one supposed to do?  How can you prove compliance?

One thought is that a credit union could rely on its policies and procedures, which will spell out how a credit union has decided to provide notices under the rule - assuming it has to provide risk-based pricing notices. I don't think such a stance is unreasonable.  In fact, that is the requirement the Fed created for Regulation E.  Here's the Fed's description of Regulation E's record retention requirements, found in the Staff Commentary, Section .13(b).

A financial institution need not retain records that it has given disclosures and documentation to each consumer; it need only retain evidence demonstrating that its procedures reasonably ensure the consumers' receipt of required disclosures and documentation.

I'm curious to see how others are handling this.  Feel free to leave a comment on the blog with your record retention plans.

***

Here are some other items.

• The most recent episode of Current Issues in Credit Unions is available.  So fire up that iPod!
• At Compliance Seminar, a speaker noted that the best risk management guidance document for ACH is OCC 2006-39.  After looking at the document, it is hard to argue against the speaker's statement.
• Leave it to Saturday Night Live to create perhaps the most effective financial literacy tool for consumers that I've ever seen. (Video.)  Keep in mind that your workplace may have a policy on watching videos while at work.  Believe me, though - this one is gold.  Gold, Jerry. Pure gold.

Recordkeeping; This and That

Posted by Anthony Demangone

I really like NCUA's Records Preservation Program rule.  You'll find it at Part 749 of NCUA's rules and regulations.  I don't know who drafted it, but I agree with their view of why and how people keep records.  Here are two sections from Appendix A that I always admire:

Credit unions often look to NCUA for guidance on the appropriate length of time to retain various types operational records. NCUA does not regulate in this area, but as an aid to credit unions it is publishing this appendix of suggested guidelines for record retention. NCUA recognizes that credit unions must strike a balance between the competing demands of space, resource allocation and the desire to retain all the records that they may need to conduct their business successfully. Efficiency requires that all records that are no longer useful be discarded, just as both efficiency and safety require that useful records be preserved and kept readily available. (Emphasis added.)

And this...

D. What Are the Recommended Minimum Retention Times?

Record destruction may impact the credit union’s legal standing to collect on loans or defend itself in court. Since each state can impose its own rules, it is prudent for a credit union to consider consulting with local counsel when setting minimum retention periods. A record pertaining to a member’s account that is not considered a vital record may be destroyed once it is verified by the supervisory committee. Individual Share and Loan Ledgers should be retained permanently. Records, for a particular period, should not be destroyed until both a comprehensive annual audit by the supervisory committee and a supervisory examination by the NCUA have been made for that period. (Emphasis added.)

When it comes to recordkeeping, few records have clear-cut requirements.  Outside of those documents, credit unions have to make a business decision regarding what to keep and how long.  It isn't an easy process, but it is an important one.

***

And in other news...

Regulation CC.  NCUA has released Regulatory Alert 10-RA-11to note that due to Federal Reserve restructuring, there are no longer any non-local checks. 

Seminar.  You need to register for NAFCU's Regulatory Compliance Seminar by this Friday to take advantage of the early-bird discount of $200.  Hey, it's no skin off my nose if you don't decide to attend.  We'd love to have you, but I understand that training dollars are not unlimited and that we aren't the only cowboys at this rodeo.  But by all means, if you know you will attend, please register by this Friday to save some money.  A penny saved is a penny earned, and all that jazz.

August and NCUA.  Remember, there is no monthly NCUA board meeting scheduled in August. (The board can call special meetings, though.)

NCUA and transparency.  NCUA will now create videos of board meetings, complete with a word-for-word transcript of what was said.

Do you know where your paperwork is?

Fred Becker (NAFCU's CEO) forwarded this news story to me.  After reading it, only one word came to mind:

Ugh.

In short, homeowners facing foreclosure are demanding to see the paperwork that proves they owe the bank or credit union.  In short, they are using the old legal strategy of "Oh yeah?  Prove it!"  According to the story, some lenders can't.  For whatever reason: mergers, loan sales, etc., they just can't put their fingers on the magic paperwork.

What are the lessons to take from this story?

• Recordkeeping is like insurance.  It is a pain.  A drag.  Sometimes it seems pointless and a waste.  Until you need it.
• Share this post or the news story with your mortgage peeps.  It is a good reminder that boring adherence to recordkeeping requirements can pay hidden dividends.

• Make sure you have your paperwork lined up.  If you have limited resources, focus your efforts where it will do the most good.  Look at your mortgage portfolio.  Those loans that look to be at risk of foreclosure is where I'd start.

Go here to read NCUA's recordkeeping guidelilnes.

***

You know the saying, may you live in interesting times.  OK, enough already.  I'm done with interesting.

Have a great weekend, everyone!

Corporate Stabilization; Hmmmm; BOA is updated

During yesterday's NCUA Corporate Stabilization webinar, I picked up the following points.:

• NCUA is still working on a Supervisory Letter.  Once they release this, probably in the form of a letter to credit unions, we'll have some clarity on how examiners are supposed to view credit unions that might take a hit to their ROA or capital due to any required payments to the NCUSIF.
• Payments to the NCUSIF are not inevitable.  NCUA has indicated that they are still working on alternatives that might change their initial stabilization plan. 
• If payments come, it sounded to me like your credit union would make the payment in September.
• How do you book this?  Follow GAAP.
• Dave Marquis indicated that there were more than 1,200 questions submitted.  I estimate that they answered 20.  Be on the lookout for a Q and A document that synthesizes all the questions, along with NCUA's response.
• And for the latest, don't' forget that NCUA has created a Corporate Stabilization Program page on its website.

***

Yesterday, I stumbled upon two things that made me go hmmmm.

• First, a GAO report indicates that understaffing at the Social Security Administration is causing huge problems. 
• But then I find where the Social Security Administration apparently has the time to track the most common names given to baby boys and girls.  (This was a legitimate find. I was researching whether a person possibly could receive 2 social security numbers.  The answer, apparently, is yes.)

***

Hey NAFCUers, our Book of Answers has been updated again. Access it here. (Member login needed.)

For you non-NAFCUers, here's a taste of what you're missing.

Question: As our credit union staff expands, we find ourselves with a shortage of secure storage space. Our employees rarely pull physical signature cards since we use an optical system. Can our credit union dispense with the metal signature boxes by placing each member’s signature card in their respective files? It would save us a lot of filing trouble and ease the issue of pulling signature cards and files.

Answer:There is nothing in the National Credit Union Administration’s (NCUA’s) Records Preservation Program and Record Retention Appendix stating that a credit union can not keep the original signature card together and within the member file. The regulations state “Preserved records may be in any format that can be used to reconstruct the credit union’s records.” 12 C.F.R. § 749.4. In addition, NCUA indicates that “(c)redit unions may use any format, electronic or other, for maintaining the writings records or information that accurately reflects the information, remains accessible to all persons who are entitled to access by statute, regulation or rule of law, and is cable of being reproduced by transmission, printing or otherwise.” 12 C.F.R. § 749.5.
August 2007

Have a great weekend, everyone!

Good Things Come in Threes: NCUA Issues a Legal Opinion Letter on Recordkeeping

Earlier this week, NCUA released three legal opinion letters.  I've discussed the first two in earlier posts.  Today, I'll tackle NCUA Legal Opinion Letter 07-0812 (January 11, 2008).  You may access it here.

NCUA's record retention regulation, which you can locate at Part 749 of its rules and regulations, is a clearly-written regulation that gives credit unions the ability to maintain documents in several different formats.  In its letter, NCUA states:

You asked for our opinion on the permissibility of a federally insured credit union retaining records, specifically original loan documents for outstanding loans to members, in an electronic format instead of a paper format. Under federal law and NCUA's record retention regulation, records can be preserved in any format that can be used to reconstruct the records, including in an electronic format.

This legal opinion supersedes an older legal opinion letter, NCUA Legal Opinion Letter 99-0043, which recommended that credit unions maintain original loan documents until the loan was paid off.

That being said, NCUA clarified that its regulation and legal opinion letter cannot speak to the admissibility of electronic documents in a court proceeding.

Records retention guidance for federally insured credit unions is provided in Appendix A to Part 749 in NCUA’s regulations and it specifically addresses the question of formats credit unions can use for retaining records stating that “NCUA does not recommend a particular format for record retention.” 12 C.F.R. Part 749, Appendix A, Section A. This section also discusses the criteria regarding accuracy and accessibility of which credit unions should be mindful and notes that, as far as relying on copies or reproductions of records, credit unions “should also ensure that the reproduction is acceptable for submission as evidence in a legal proceeding.” Id. Whether a reproduction will be acceptable in a legal proceeding may vary with state law requirements and, therefore, we encourage credit unions to consult with their own legal counsel on this aspect of their record retention policy. (Emphasis added.)

Sarbanes-Oxley and Credit Unions

Many people believe that the Sarbanes-Oxley Act of 2002 only applies to publicly-traded companies.  This is not exactly true. 

Two provisions clearly apply to non-profits.  Those would be Section 802 (document destruction) and Section 1107 (whistle-blower protections).   Here's an ABA article (not that ABA) that provides a nice overview of the issue.

Finally, NCUA's only real guidance concerning SOX and federal credit unions is Letter to Federal Credit Unions 03-FCU-07.  The guidance does not discuss the two provisions noted above, however.

It is probably worth noting that NCUA already has a whistle-blowing provision that protects credit union employees when they share information with NCUA.  Here is that provision.

BSA Infobase Updated

The FFIEC announced yesterday that it updated its Bank Secrecy Act Infobase.   The Compliance Guy loves this website.  Play around on the website, and you'll find these gems:

• A link to an electronic version of the FFIEC BSA/AML Examination Manual.
• A link to NCUA materials that relate to BSA.
• A link to Appendix P of the manual, which outlines all of the BSA recordkeeping requirements.  (A personal favorite.)
• A link to BSA-related forms.