Compliance Blog

As Hurricane Dorian makes its way up the east coast, I have decided to dedicate today’s blog to an issue many credit unions are concerned with: what to do during a hurricane or other disaster.

One important task to complete in the days leading up to or immediately after a disaster-related closure is to notify NCUA. Section 748.1 of NCUA’s rules and regulations requires all federally-insured credit unions to notify the regional director within 5 business days of the disaster. A disaster is any event that causes physical damage to the credit union or is expected to cause an interruption in vital member services projected to last more than two consecutive business days. Vital member services include account inquiries, withdrawals and deposits and loan payments and disbursements. For many credit unions, one or more of these services may be affected by an office closure due to a hurricane.

NCUA has explained that it expects credit unions to have procedures in place to be able to communicate with NCUA about disasters affecting the credit union. NCUA has emphasized that its field staff need the following information from the credit union in the case of a disaster-related closure:

• Specific description of damage to credit union facilities, if any;
• Specific member services that are offline, if any;
• An estimate of when the affected location will be re-opening;
• Specific details of any assistance needed from NCUA;
• A contact number for members if the normal business number is not working; and
• A contact number—like a cell phone or out of area number—that NCUA can use to reach key credit union staff during and after the disaster.

Credit unions may need to determine if back-up means of communication are available in case telephone lines and internet services become unavailable in their area.

Other than notifying the NCUA regional director within 5 business days of a natural disaster, NCUA encourages credit unions to communicate disaster preparedness and response efforts before, during and after an emergency to keep members, volunteers, employees and regulators fully aware of the situation. Many credit unions post on the home page of their websites and signs at branch locations if they know ahead of time that the credit union will close during a hurricane. Although this is not required by regulation, it may be a reasonable way of letting members know that the credit union will be or is closed.

Unfortunately, once the storm ends and the affected credit unions clean up the mess, the hard work continues. An interagency Supervisory Examiner Guide outlines the supervisory practices to be followed in assessing credit unions affected by a natural disaster. The guidance outlines the types of risk assessments that should be conducted after a disaster and the types of actions examiners should take. These include:

•    “review[ing] management’s response plans and assessing the reasonableness of those plans given the credit union’s business strategy and operational capacity in the distressed economic and business environment”;
•     “consider[ing] any asset losses, extraordinary expenses, unexpected deposit growth, contingent liabilities and risks that were incurred as a result of a major disaster. If substantial declines in the affected institution’s capital ratios have occurred or are projected, examiners should determine whether management has developed a satisfactory capital restoration plan”;
•      “consider[ing] whether management has been able to identify all loans and investments substantially affected by a major disaster and any potential loss exposure. For secured loans, examiners should expect management to have a process for tracking information on the condition of collateral and the collectability and timing of insurance proceeds.”

In anticipation of any examination that may occur after a credit union is affected by a natural disaster, a credit union may need to review its business continuity plan and document all of the steps taken in accordance with the plan. This may help the credit union to show that it was prepared for the disaster and followed appropriate procedures afterward.

In addition to reviewing its own operations, NCUA expects credit unions to check the status of vendors and partners to determine the level of damage or loss that may affect the credit union. A previous NAFCU blog explains the importance of vendor management and having vendor relationships that can withstand emergencies and disasters. The blog cites the FFIEC’s booklet, which indicates that contractual provisions should include the vendor’s responsibility for backup and records protection, time frames for recovery that will meet the credit union’s requirements, appropriate equipment, key program and data files and maintenance and testing of plans. Ultimately, credit unions may be responsible for making sure their vendors have taken appropriate steps to recover after a disaster.

Credit unions affected by a hurricane or other disaster may want to take a look at our disaster recovery resources and previous NAFCU blog for more information.