E7-5070. Records Preservation Program and Appendices-Record Retention Guidelines; Catastrophic Act Preparedness Guidelines

AGENCY:

National Credit Union Administration (NCUA).

ACTION:

Proposed rule.

SUMMARY:

NCUA proposes to amend its regulations to address a federally-insured credit union's obligation to maintain a records preservation program. The proposed rule draws from existing guidance to clarify requirements for preserving vital records and to suggest important items for consideration in restoring vital member services. NCUA believes the revised language and new appendix will facilitate the recovery of essential operations after a catastrophic act resulting in continued member confidence in the credit union system. The agency also proposes to amend its regulations to clarify the meaning of catastrophic act.

DATES:

Comments must be received on or before May 11, 2007.

ADDRESSES:

You may submit comments by any of the following methods (Please send comments by one method only):

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• NCUA Web Site: http://www.ncua.gov/​RegulationsOpinionsLaws/​proposed_​regs/​proposed_​regs. html. Follow the instructions for submitting comments.
• E-mail: Address to [e-mail]. Include “[Your name] Comments on Proposed Rule Parts 748 and 749,” in the e-mail subject line.
• Fax: [phone]. Use the subject line described above for e-mail.
• Mail: Address to Mary F. Rupp, Secretary of the Board, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428.
• Hand Delivery/Courier: Same as mail address.

Public inspection: All public comments are available on the agency's Web site at http://www.ncua.gov/​RegulationsOpinionsLaws/​comments as submitted, except as may not be possible for technical reasons. Public comments will not be edited to remove any identifying or contact information. Paper copies of comments may be inspected in NCUA's law library, at 1775 Duke Street, Alexandria, Virginia 22314, by appointment weekdays between 9 a.m. and 3 p.m. To make an appointment, call [phone] or send an e-mail to [e-mail].

FOR FURTHER INFORMATION CONTACT:

Andrew Healey, Program Officer, Division of Supervision, Office of Examination and Insurance, at [phone] or Linda K. Dent, Staff Attorney, Office of General Counsel, at [phone].

SUPPLEMENTARY INFORMATION:

Background

Lessons learned from previous catastrophic acts, including the dramatic effects of the Katrina and Rita hurricanes, indicate the importance of preserving vital records and swiftly restoring vital member services. In particular, NCUA's review of events in the hurricanes' aftermath demonstrates the need for advance planning and preparation in successfully responding to a catastrophic act.

Challenges such as providing members with access to funds and account information, loss of, or lack of, access to facilities, and locating and communicating with staff were some of the immediate issues credit unions faced. Fortunately, affected credit unions did not face these challenges alone. Help came from NCUA, other credit unions, trade organizations, and service providers. For example, NCUA operated a call center to assist credit union members in contacting their institutions. Agency field staff checked on credit union facilities, helped locate staff, assisted credit unions with equipment needs, and helped credit unions restore share and loan data where necessary. Other credit unions mobilized to send needed cash, provided operating space, made staff available, and sent needed equipment to affected credit unions. Trade organizations served as a clearinghouse to match those with resources with those in need. Shared branch facilities signed on institutions enabling them to service displaced members.

In reviewing these experiences, the Board determined credit unions, which had considered potential threats and identified critical functions necessary for the retrieval of vital records, were able to address anticipated challenges and unforeseen difficulties and restore vital member services. These institutions were able to provide members with access to their funds and handle member inquiries in a relatively short time period. The proposed amendments draw from these experiences to identify program elements the Board considers essential to restoring vital records and member services.

Many of these elements are covered in previous NCUA guidance issued to federally-insured credit unions (FICUs) on disaster recovery planning. Despite the existence of this guidance, the Board is concerned that some credit unions may not be maintaining sufficient plans and safeguards to respond to events causing the destruction of vital records or catastrophic acts. The Board believes this proposal is necessary to ensure credit unions address these critical issues in the paramount interest of maintaining services to members and confidence in the credit union system if a catastrophic act occurs.

Proposed Changes

The proposed changes specifically address the Board's concerns regarding restoration of vital member records and services. The proposed changes establish minimum standards for preserving vital records and include recommendations concerning restoring member services considered vital to a credit union's continued operation.

Part 748

The Board proposes to revise the definition of catastrophic act to clarify that any event causing an interruption in vital member services for more than two business days is a qualifying event.

Part 749

Several of the proposed changes pertain to format and grammar and are made to clarify the rule's language. For example, the Board proposes to eliminate the question format currently used in the section headings and replace these with language simply describing each section's contents. Section 749.1 includes two changes of note. Changes to the vital records definition clarify that share, deposit, and loan balances for each member's account should be available as of the most recent business day, while a financial report of the credit union's asset and liability accounts and bank reconcilements should be available as of the most recent month's end. All other vital records should be updated as changes occur. A new paragraph (d) is added requiring credit unions to maintain certain emergency contact information.

The definition of a vital records center remains the same, essentially a fixed site in a geographic area different from the credit union's primary site and that is unlikely to be negatively affected by the same catastrophic act whether natural or otherwise, for example, a power grid failure. The Board proposes to add a phrase which clarifies the back-up site may be another federally-insured credit union. The Board also proposes to add a sentence to the end of this section to address the importance of having any equipment or software necessary to access the vital records at the center.

The proposed rule also includes recommendations on restoring vital member services for a credit union. Specifically, § 749.0 suggests a credit union should complement its plans for safeguarding and reconstructing vital records by establishing a method for restoring vital member services in the event of a catastrophic act. Similarly, § 749.2 recommends that procedures for maintaining duplicate vital records should include a method for using these records to restore vital member services.

Appendix B—Catastrophic Act Preparedness Guidelines

NCUA has issued considerable guidance relative to disaster preparedness which parallels preparation for a catastrophic act as set forth below:

Letter to Credit Unions 01-CU-21 Disaster Recovery and Business Resumption Contingency Plans; Letter to Credit Unions 03-CU-07 FFIEC Release of Information Technology Examination Handbook; Risk Alert 06-Risk-01 Disaster Planning and Response; Letter to Credit Unions 06-CU-06 Influenza Pandemic Preparedness; Letter to Credit Unions 06-CU-10 NCUA's Information System and Technology Program—Business Continuity Planning Questionnaire; Letter to Credit Unions 06-CU-11 Interagency Guidance Lessons Learned By Institutions Affected by Hurricane Katrina; and Letter to Credit Unions 06-CU-12 Disaster Preparedness & Response Examination Procedures.

The Board recognizes credit unions generally engage in some form of planning for responses to catastrophic acts and have access to existing guidance. The Board is specifically interested in commenters' feedback on the usefulness and/or need of including a new appendix providing recommended information credit unions could use in preparing for a catastrophic act.

Regulatory Procedures

NCUA Interpretive Ruling and Policy Statement 87-2

The comment period for this proposal has been shortened to 45 days. The NCUA Board believes it is important to expedite the rulemaking process in this matter to allow for its completion prior to the height of the approaching hurricane season.

Paperwork Reduction Act

The proposed changes involve information collection requirements. As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)), NCUA is submitting a copy of this proposed rule as part of an information collection package to the Office of Management and Budget (OMB) for its review.

The proposed rulemaking amends an existing requirement for a records preservation program by requiring the program be in writing and include emergency contact information for designated persons.

The Board believes these requirements will not create an undue burden on credit unions as it expects credit unions will document existing plans and practices. The Board estimates 8,405 respondents will take an average of one hour to comply with these requirements. Additionally, 15 respondents representing newly-chartered credit unions will take an average of seven hours to develop a written records preservation program. The total annual collection burden is estimated to be approximately 8,510 hours.

The Paperwork Reduction Act and OMB regulations require that the public be provided an opportunity to comment on the paperwork requirements, including an agency's estimate of the burden of the paperwork requirements. The NCUA Board invites comment on: (1) Whether the paperwork requirements are necessary; (2) the accuracy of NCUA's estimates on the burden of the paperwork requirements; (3) ways to enhance the quality, utility, and clarity of the paperwork requirements; and (4) ways to minimize the burden of the paperwork requirements.

Comments should be sent to: OMB Reports Management Branch, New Executive Office Building, Room 10202, Washington, DC 20503; Attention: Mark Menchik, Desk Officer for NCUA. Please send NCUA a copy of any comments submitted to OMB.

The Paperwork Reduction Act requires OMB to make a decision concerning the collection of information contained in these proposed regulations between 30 and 60 days after publication of this document in the Federal Register. Therefore, a comment to OMB is best assured of having its full effect if OMB receives it within 30 days of publication. This does not affect the deadline for the public to comment to the NCUA on the proposed regulation.

Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA) requires NCUA to prepare an analysis to describe any significant economic impact a proposed regulation may have on a substantial number of small entities. 5 U.S.C. 601-612. NCUA considers credit unions having less than ten million dollars in assets to be small for purposes of RFA. Interpretive Ruling and Policy Statement (IRPS) 87-2 as amended by IRPS 03-2.

The NCUA has determined and certifies that this proposed rule, if adopted, will not have a significant economic impact on a substantial number of small credit unions. Accordingly, the NCUA has determined that an RFA analysis is not required. NCUA solicits comment on this analysis and welcomes any information that would suggest a different conclusion.

Executive Order 13132

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their regulatory actions on state and local interests. In adherence to fundamental federalism principles, NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntary complies with the executive order. This proposed rule, if adopted, will not have substantial direct effects on the states, on the relationship between the national government and states, or on the distribution of power and responsibilities among the various levels of government. NCUA has determined the proposed rule does not constitute a policy that has federalism implications for purposes of the executive order.

Treasury and General Government Appropriations Act, 1999

NCUA has determined that the proposed rule will not affect family well-being within the meaning of section 654 of the Treasury and General Appropriations Act, 1999, Public Law 105-277, 112 Stat. 2681 (1998).

List of Subjects

12 CFR Part 748

• Credit unions
• Reporting and recordkeeping requirements

12 CFR Part 749

• Credit unions
• Reporting and recordkeeping requirements

By the National Credit Union Administration Board on March 15, 2007.

Mary Rupp,

Secretary of the Board.

Accordingly, NCUA proposes to amend 12 CFR part 748 as follows:

PART 748—SECURITY PROGRAM, REPORT OF SUSPECTED CRIMES, SUSPICIOUS TRANSACTIONS, CATASTROPHIC ACTS AND BANK SECRECY ACT COMPLIANCE

1. The authority citation for parts 748 and 749 continues to read as follows:

Authority: 12 U.S.C. 1766(a) and 1786(q); 15 U.S.C. 6801 and 6805(b); 31 U.S.C. 5311 and 5318.

2. Amend § 748.1 by revising the second sentence of paragraph (b) to read as follows:

§ 748.1

Filing of reports.

* * * * *

(b) * * * A catastrophic act is any event, natural or otherwise, resulting in physical destruction or damage to the credit union or an interruption in vital member services projected to last more than 2 business days. * * *

* * * * *

PART 749—RECORDS PRESERVATION PROGRAM AND APPENDICES—RECORD RETENTION GUIDELINES; CATASTROPHIC ACT PREPAREDNESS GUIDELINES

1. The authority citation for part 749 continues to read as follows:

Authority: 12 U.S.C. 1766, 1783 and 1789; 15 U.S.C. 7001(d).

2. Amend part 749 by revising the part heading to read as set forth above.

3. Revise § 749.0 to read as follows:

§ 749.0

Purpose and scope.

(a) This part describes the obligations of all federally-insured credit unions to maintain a records preservation program to identify, store and reconstruct vital records in the event that the credit union's records are destroyed and provides recommendations for restoring vital member services. All credit unions must have a written program that includes plans for safeguarding records and reconstructing vital records. To complement these plans, it is recommended a credit union develop a method for restoring vital member services in the event of a catastrophic act. Additionally, the regulation establishes flexibility in the format credit unions may use for maintaining writings, records or information required by other NCUA regulations.

(b) Appendix A to this part provides guidance concerning the appropriate length of time credit unions should retain various types of operational records. Appendix B to this part also provides guidance for developing a program for responding to a catastrophic act to ensure duplicate vital records can be used for restoration of vital member services.

4. Revise § 749.1 to read as follows:

§ 749.1

Definitions.

For purposes of this part:

Vital member services mean informational account inquiries, share withdrawals and deposits, and loan payments and disbursements.

Vital records refer to the following records:

(a) A list of share, deposit, and loan balances for each member's account as of the most recent business day that:

(1) Shows each balance individually identified by a name or number;

(2) Lists multiple loans of one account separately; and

(3) Contains information sufficient to enable the credit union to locate each member, such as address and telephone number.

(b) A financial report, which lists all of the credit union's asset and liability accounts and bank reconcilements, current as of the most recent month-end.

(c) A list of the credit union's accounts at financial institutions, insurance policies, and investments along with related contact information, current as of the most recent month-end.

(d) Emergency contact information for employees, officials, regulatory offices, and vendors used to support vital records.

5. Revise § 749.2 to read as follows:

§ 749.2

Vital records preservation program.

The board of directors of a credit union is responsible for establishing a vital records preservation program within 6 months after its insurance certificate is issued. The program must be in writing and contain procedures for maintaining duplicate vital records at a vital records center. The procedures must include: designated staff responsible for vital records preservation, a schedule for the storage and destruction of records, and a records preservation log detailing for each record stored, its name, storage location, storage date, and name of the person sending the record for storage. It is recommended credit unions include in these procedures a method for using duplicate records to restore vital member services in the event of catastrophic act. Credit unions which have some or all of their records maintained by an off-site data processor are considered to be in compliance for the storage of those records if the service agreement specifies the data processor safeguards against the simultaneous destruction of production and back-up information.

6. Revise § 749.3 to read as follows:

§ 749.3

Vital records center.

A vital records center is defined as a storage facility, which may include another federally-insured credit union, at any location far enough from the credit union's offices to avoid the simultaneous loss of both sets of records in the event of a catastrophic act. A credit union must maintain or contract with a third party to maintain any equipment or software for its vital records center necessary to access records.

7. Revise § 749.4 to read as follows:

§ 749.4

Format for vital records preservation.

Preserved records may be in any format that can be used to reconstruct the credit union's records. The format used must accurately reflect the information in the record, remain accessible to all persons entitled to access by statute, regulation or rule of law, and be capable of reproduction by transmission, printing, or otherwise.

8. Revise § 749.5 to read as follows:

§ 749.5

Format for records required by other NCUA regulations.

Where NCUA regulations require credit unions to retain certain writings, records or information, credit unions may use any format that accurately reflects the information in the record, is accessible to all persons entitled to access by statute, regulation or rule of law, and is capable of being reproduced by transmission, printing, or otherwise. The credit union must maintain the necessary equipment or software to permit an examiner to access the records during the examination process.

9. Add new Appendix B to Part 749 to read as follows:

Appendix B to Part 749—Catastrophic Act Preparedness Guidelines

Credit unions often look to NCUA for guidance on preparing for a catastrophic act. While NCUA has minimal regulation in this area ^[1] , as an aid to credit unions it is publishing this appendix of suggested guidelines. It is recommended that all credit unions develop a program to prepare for a catastrophic act. The program should be developed with oversight and approval of the board of directors. It is recommended the program address the following five elements:

(1) A business impact analysis to evaluate potential threats;

(2) A risk assessment to determine critical systems and necessary resources;

(3) A written plan addressing:

(i) Persons with authority to enact the plan;

(ii) Preservation and ability to restore vital records;

(iii) A method for restoring of vital member services through identification of alternate operating location(s) or mediums to provide services, such as telephone centers, shared service centers, agreements with other credit unions, or other appropriate methods;

(iv) Communication methods for employees and members;

(v) Notification of regulators as addressed in 12 CFR 748.1(b);

(vi) Training and documentation of training to ensure all employees and volunteer officials are aware of procedures to follow in the event of destruction of vital records or loss of vital member services; and

(vii) Testing procedures, including a means for documenting the testing results.

(4) Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant, for example, to address changes in the credit union's operations; and

(5) Annual testing.

Footnotes

1.  See 12 CFR 748.1(b) concerning a FICU's reporting of any catastrophic act that occurs at its office to its regional director and 12 CFR 749.3 concerning the location of a FICU's vital records center to avoid the simultaneous loss of both sets of records in the event of disaster.