40 THE NAFCU JOURNAL March–April 2022 In January, the National Credit Union Association (NCUA) issued its supervisory priorities for 2022. NCUA identified payment systems as an area that it intends to examine with more vigor in this calendar year. NCUA also noted that the focus on payment systems is attributable to member demand for electronic payment options, and it suggested that the increased demand for these electronic payment options that provide for faster settlement of transactions can heighten fraud risk and compromise a credit union’s data security efforts. While NCUA targeted payment systems as a priority, it did not identify specific concerns. Credit unions looking for more information about NCUA’s expectations regarding electronic payment systems can look to NCUA’s online examiner’s guide. The examiner’s guide has an entire section devoted to electronic payment systems and reviews different types of electronic payment systems, such as the Automated Clearing House (ACH) network, wire transfers and mobile payments. The guide analyzes how electronic payment systems can affect a credit union’s risk exposure. For example, NCUA points out that a credit union’s credit risk, which is defined in the guide as “the risk that the receiver or originator of a transaction does not have sufficient funds to settle the transaction[,]” can increase if a credit union credits a new account before verifying the corresponding deposit. The online examiner’s guide addresses what credit unions can do to mitigate some of these risks. It distinguishes between the different credit union stakeholders that might have a role in implementing electronic payment system options. NCUA explains its expectations about how each of the different stakeholders (e.g., board of directors, management, tellers, backroom staff, etc.) can play a part in mitigating risk due to the use of electronic payment systems. The examiner’s guide provides guidance about what should be included in a credit union’s board-approved electronic payment systems policy and implementing procedures. The guide underscores the importance of developing a robust risk management program that facilitates a credit union’s identification, measurement and monitoring of electronic payment systems risk so that the credit union stays within the boundaries of its board-approved policies. Because of how dependent electronic payment systems are on technology, NCUA examiners will assess a credit union’s information technology competencies. They may review how credit union employees access payment systems, what information technology internal controls a credit union has implemented and how employees may authenticate their identities before accessing payment systems. The examiner’s guide also includes exam procedures covering wire transfers, ACHs and remote deposit capture. Reviewing the exam procedures can help credit unions get a sense of what examiners might focus on during a review. The exam procedures explain how examiners will determine the scope of their review of the aforementioned payment systems. They also identify the baseline requirements for a review, including NCUA expectations regarding internal controls. For more information about payment systems, credit unions can also look to the Federal Financial Institutions Examination Council’s Retail Payment Systems Booklet. The booklet covers other types of payment systems not specifically addressed in NCUA’s online examiner’s guide, such as peer-to-peer payments, and it also provides more guidance about how to manage risk in the area of payment systems. David Park is senior regulatory compliance counsel for NAFCU. COMPLIANCE CENTRAL NCUA: INCREASED SCRUTINY ON PAYMENT SYSTEMS By David Park
RkJQdWJsaXNoZXIy Nzc3ODM=