2024-08680. Records Preservation Program and Appendices-Record Retention Guidelines; Catastrophic Act Preparedness Guidelines

AGENCY:

National Credit Union Administration (NCUA).

ACTION:

Advance notice of proposed rulemaking.

SUMMARY:

The NCUA Board (Board) is issuing this advance notice of proposed rulemaking (ANPR) to solicit comments on ways the agency can improve and update its records preservation program regulation and accompanying guidelines in the NCUA regulations. The Board is particularly interested in obtaining stakeholder input on the content of the regulation, which has not been updated in 15 years and may be outdated or at odds with current best practices. The Board is also interested in feedback on the structure of the part which may be confusing as it currently contains a combination of regulatory requirements and guidance.

DATES:

Comments must be received on or before June 24, 2024.

ADDRESSES:

You may submit written comments by any of the following methods identified by RIN (Please send comments by one method only):

• Federal eRulemaking Portal: https://www.regulations.gov. Follow the instructions for submitting comments for Docket Number NCUA-2024-0026.

• Mail: Address to Melane Conyers-Ausbrooks, Secretary of the Board, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428.

• Hand Delivery/Courier: Same as mail address.

Public Inspection: All public comments are available on the Federal eRulemaking Portal at https://www.regulations.gov as submitted, except when impossible for technical reasons. Public comments will not be edited to remove any identifying or contact information. If you are unable to access public comments on the internet, you may contact the NCUA for alternative access by calling [phone] or emailing [e-mail].

FOR FURTHER INFORMATION CONTACT:

Policy: Matt Huston, Policy Officer, Office of Examination and Insurance, at [phone] or [e-mail]; Legal: Gira Bose, Senior Staff Attorney, Office of General Counsel, at [phone] or [e-mail].

SUPPLEMENTARY INFORMATION:

I. Background

II. Current Standards and Request for Comment

III. Legal Authority

I. Background

In 2023, the NCUA received feedback that part 749 and its appendices are burdensome and unclear. Based on this feedback and other factors described below, the NCUA has identified the need to review part 749 to see if any changes or improvements are necessary. The Board recognizes the NCUA's regulations in this area, which were last updated many years ago, may be outdated or unclear for some credit unions, which ultimately may have adverse effects on their members. Thus, the Board is seeking advance comment on whether there is a need to update part 749, and if so, what should be updated and how, to ensure that credit unions continue to properly preserve records vital to their business operations, the NCUA's supervisory needs, and the needs of their members.

II. Current Standards and Request for Comment

Part 749 requires all federally insured credit unions (credit unions) to maintain a records preservation program to identify, store, and reconstruct vital records in the event that a credit union's records are destroyed.^[1]

Part 749 requires a vital records preservation program to be in writing and contain certain procedures for maintaining duplicate vital records at an offsite vital records center.^[2] The regulation defines the term `vital records' as: (a) a list of share, deposit, and loan balances for each member's account as of the close of the most recent business day that shows each balance individually identified by a name or number; lists multiple loans of one account separately; and contains information sufficient to enable the credit union to locate each member, such as address and telephone number; (b) a financial report, which lists all of the credit union's asset and liability accounts and bank reconcilements, current as of the most recent month-end; (c) a list of the credit union's accounts at financial institutions, insurance policies, and investments along with related contact information, current as of the most recent month-end; and (d) emergency contact information for employees, officials, regulatory offices, and vendors used to support vital records.^[3]

At the same time, appendix A—which is included in part 749 as suggested guidelines for record retention—advises that the following additional sets of records should be retained permanently: 1. Official records of the credit union: (a) Charter, bylaws, and amendments; (b) Certificates or licenses to operate under programs of various government agencies, such as a certificate to act as issuing agent for the sale of U.S. savings bonds. 2. Key operational records: (a) Minutes of meetings of the membership, board of directors, credit committee, and supervisory committee; (b) One copy of each financial report, NCUA Form 5300 or 5310, or their equivalent, and the Credit Union Profile report, NCUA Form 4501, or its equivalent as submitted to the NCUA at the end of each quarter; (c) One copy of each supervisory committee comprehensive annual audit report and attachments; (d) Supervisory committee records of account verification; (e) Applications for membership and joint share account agreements; (f) Journal and cash record; (g) General ledger; (h) Copies of the periodic statements of members, or the individual share and loan ledger; (i) Bank reconcilements; and (j) Listing of records destroyed.^[4]

Credit unions have expressed confusion regarding the interaction between part 749's requirements and appendix A, and between part 749 and other parts of the NCUA's regulations that have record retention requirements not referenced in part 749. Under part 749, certain supervisory committee documents are not vital records and are subject to periodic destruction; yet under § 715.8 the supervisory committee must retain the records of each verification of members' passbooks and accounts until the completion of the next member account verification.^[5]

The Board seeks comment on all aspects of part 749 and the appendices, including how they can be modernized, streamlined, and clarified, and other provisions in the NCUA's regulations that contain record retention requirements. The Board also encourages credit unions and other stakeholders that have developed well-functioning records preservation programs to comment on what works for them and share their best practices in response to this document. In addition, the Board specifically requests feedback addressing the following areas: ^[6]

A. Part 749 Definitions

Questions:

(1) Does the definition of vital records in 12 CFR 749.1 contain all, and only those, records you would consider to be vital for credit unions?

(2) Are there additional types of documents not listed as a “vital record” that you think should be as they are critical for business operations and to properly serve members?

(3) Are there other industry standards or methodologies outside of part 749 that the agency should consider for preserving vital records, for defining what vital records are, and for determining minimum retention periods?

(4) The primary focus of the records retention guidance in appendix B relates specifically to catastrophic act preparedness. Are there any terms, definitions, or standards that the Board should consider updating in appendix B?

(5) Are there any other changes to appendix B that you would recommend?

B. Records Retention Practices

Understanding current credit union retention practices would be helpful in determining whether part 749 is properly serving its purpose which is for a credit union to identify, store, and reconstruct vital records in the event that the credit union's records are destroyed.^[7]

Questions:

(6) How long, and in what format, does your credit union store its vital records?

(7) Does your credit union maintain and store any vital records in a physical format due to a regulatory requirement or supervisory expectation?

(8) What impediments, including estimated costs, does your credit union encounter with storing vital records?

(9) What records do you deem vital for business operations that a credit union should be required to keep permanently for the purpose of restoring vital member services?

(10) Other than for records that must be kept permanently, are there specific timeframes you would recommend that other vital records be retained?

(11) What are the pros and cons of storing vital records physically, electronically, or in other formats, such as cloud computing storage?

(12) Does your credit union rely on third-party vendors to accurately maintain vital records, and if so, what are some of the challenges that these arrangements present?

(13) How would you suggest the agency create a more effective framework for credit unions to preserve vital records?

(14) What are some challenges for smaller credit unions, defined as credit unions with total assets of $100 million or less, in maintaining vital records, and what has worked? ^[8]

(15) What additional support, training, or technical assistance could the NCUA provide, if any, to assist credit unions with both understanding and implementing records retention requirements?

C. Additional Guidance

The issuance of guidance in this area has been a long-standing agency practice to assist credit unions with their record preservation obligations. As noted in an earlier rulemaking on part 749, “there is a need for guidance in the area of record retention based on the frequency of requests for assistance from credit unions.” ^[9] Additionally, clearer guidance in this area would also allow NCUA to better execute its supervisory duties. As part of meeting this need, the agency has taken steps over the years to clearly state the difference between regulations and guidance. In a prior rulemaking on part 749, the Board attempted to clarify this issue by stating, “The Board has weighed the fact that guidance is available from other sources and the potential for confusion regarding enforceability of a regulation versus guidance. The Board believes the benefit to credit unions in having the guidance in the appendix to the regulatory requirement will enhance access to the guidance and will facilitate compliance.” ^[10] In the part 749 rulemaking, the Board further noted that “including specific words like `recommended' and `guidance' means, as a legal matter, that the guidance is just that—guidance—and is not enforceable as a regulation. These words clarify and minimize, to the extent linguistically possible, the potential for misinterpretation.” ^[11] The NCUA recently codified this position in an interagency rulemaking clarifying the distinction between a rule and guidance whereby the former creates binding legal obligations, and the latter does not.^[12]

Questions:

(16) What provisions of appendix A or appendix B do not align with the requirements of part 749, or are otherwise outdated or unclear examples of the types of records that should be retained? For records you consider outdated, please explain why.

(17) In terms of the content of any future guidance, what guidance would be helpful to better reflect the types of records that must be retained under part 749?

(18) What guidance would be helpful for catastrophic act or other disaster preparedness?

(19) Is there confusion among stakeholders regarding the enforceability of regulation versus guidance concerning part 749? If so, what should be revised?

D. Other NCUA Regulations

Questions:

(20) Are there other provisions in the NCUA's regulations that contain record retention requirements that should be incorporated into part 749?

III. Legal Authority

The Board issues this ANPR pursuant to its authority under the Federal Credit Union Act (FCUA) to prescribe rules and regulations as it deems appropriate for administering the FCUA, including its recordkeeping requirements for Federal credit unions.^[13] Maintaining vital records is central to a credit union's ability to properly service its members and to the NCUA's ability to fulfill its supervisory and enforcement duties. Section 209 of the FCUA is a plenary grant of regulatory authority to the Board to examine and require information and reports from credit unions as well as issue rules and regulations necessary or appropriate to carry out its roles as regulator and share insurer.^[14] Section 206 of the FCUA requires the agency to impose corrective measures whenever, in the opinion of the Board, any credit union is engaged in or has engaged in unsafe or unsound practices in conducting its business.^[15] Accordingly, the FCUA grants the Board broad rulemaking authority to ensure that credit unions, their member owners, and the National Credit Union Share Insurance Fund remain safe, sound and protected.

By the National Credit Union Administration Board.

Melane Conyers-Ausbrooks,

Secretary of the Board.

Footnotes

1.  12 CFR 749.0.

2.  12 CFR 749.2 and 749.3.

3.  12 CFR 749.1.

4.  12 CFR part 749, appendix A.

5.  12 CFR 715.8(c).

6.  In responding to the questions below, the NCUA recommends respondents consider the totality of their vital records, including any such records a credit union has acquired, come into possession of, or retained through operational or organizational changes, such as a merger.

7.  12 CFR 749.0(a).

8.  See NCUA Interpretive Ruling and Policy Statement 15-1, available at https://ncua.gov/​files/​publications/​regulations/​IRPS2015-1.pdf.

9.  66 FR 11239 (Feb. 23, 2001).

10.  72 FR 42271 (Aug. 2, 2007).

11.  12 U.S.C. 1766(e).

12.  12 U.S.C. 1766(e).

13.  12 U.S.C. 1766(e).

14.  12 U.S.C. 1789(a)(8) and (11).

15.  12 U.S.C. 1786(b)(1). There are several references to “safety and soundness” in the FCUA. See 12 U.S.C. 1757(5)(A)(vi)(I), 1759(d & f), 1781(c)(2), 1782(a)(6)(B), 1786(b), 1786(e), 1786(f), 1786(g), 1786(k)(2), 1786(r), 1786(s), and 1790d(h).