REGular Blog: NCUA to Issue ANPR on Records Preservation Programs

The NCUA Released the Agenda for their April 2024 Board Meeting this week, and it includes only one item: an Advance Notice of Proposed Rulemaking (ANPR) on Part 749, Records Preservation Program.

Part 749 of the Federal Credit Union Act describes the obligations of credit unions to store records. Appendix A to Part 749 is the agency's Record Retention Guidelines, which provides some guidance for credit unions on what format records should be retained in, for how long, and what records can be destroyed. I say "some guidance" because in the Appendix, it reads:

Credit unions often look to NCUA for guidance on the appropriate length of time to retain various types of operational records. NCUA does not regulate in this area, but as an aid to credit unions it is publishing this appendix of suggested guidelines for record retention. NCUA recognizes that credit unions must strike a balance between the competing demands of space, resource allocation and the desire to retain all the records that they may need to conduct their business successfully. Efficiency requires that all records that are no longer useful be discarded, just as both efficiency and safety require that useful records be preserved and kept readily available.

Appendix A does list items that should be retained permanently, as well as items that are "appropriate for periodic destruction."

Appendix B to Part 749 is titles Catastrophic Act Preparedness Guidelines. It lists the elements that a credit union's plan to address a catastrophic act should address, which include:

(1) A business impact analysis to evaluate potential threats;

(2) A risk assessment to determine critical systems and necessary resources;

(3) A written plan addressing:

1. Persons with authority to enact the plan;
2. Preservation and ability to restore vital records;
3. A method for restoring vital member services through identification of alternate operating location(s) or mediums to provide services, such as telephone centers, shared service centers, agreements with other credit unions, or other appropriate methods;
4. Communication methods for employees and members;
5. Notification of regulators as addressed in 12 CFR 748.1(b);
6. Training and documentation of training to ensure all employees and volunteer officials are aware of procedures to follow in the event of destruction of vital records or loss of vital member services; and
7. Testing procedures, including a means for documenting the testing results.

(4) Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant, for example, to address changes in the credit union's operations; and

(5) Annual testing.

My wish is for the ANPR to provide more detailed record retention periods for specific record types. This is a frequently asked question from credit unions - how long do we have to keep X, Y, or Z document? NCUA's hands-off approach to setting retention periods has led to many of those questions persisting and credit unions making different business decisions on how long to keep documents.

While this would be great, I think it is unlikely. My prediction is that the ANPR, which will be released on Thursday morning when the Board meeting commences, will be targeted at Appendix B. Information Security and Cybersecurity is a top supervisory priority for the agency in 2024, and examiner's expectations of credit unions on incident response plans and Disaster Recovery/Business Continuity (DRBC) programs have elevated in recent years. Updates to Appendix B would be in line with this emphasis trend. We will evaluate the ANPR as it is released.

Speaking of record retention, America's Credit Unions released a post yesterday on their Compliance Blog on the topic, which you can find here.