ALEXANDRIA, Va.—Cybersecurity and credit risk remain at the top of NCUA’s supervisory priorities for 2025, according to a recent Letter To Credit Unions (25-CU-01).
In the letter NCUA noted there continued to be signs of financial stress on credit union balance sheets during 2024.
“Aggregate loan performance began to deteriorate in 2022, and the trend has continued through 2024. The overall loan delinquency rate is currently at its highest point since year-end 2013, while the rolling 12-month net charge-off rate is at its highest point since the second quarter of 2012. Additionally, the return on average assets continues to experience pressure from the interest rate environment and provision for loan and lease loss expense. Even considering these trends, the credit union system remains stable and relatively resilient against economic disruptions,” the agency said.
NCUA Supervisory Priorities For 2025
Credit Risk
Credit risk will remain a supervisory priority for 2025. Loan growth moderated during 2024 while overall delinquencies and charge-offs increased.
“Most notably, the performance within credit card portfolios has deteriorated much more rapidly than other aspects of federally insured credit union loan portfolios. The current delinquency rate and rolling 12-month net charge-off rate for credit card loans both exceed the peak that was reached during the global financial crisis fifteen years ago. Used vehicle loan performance has also materially deteriorated. The delinquency rate and rolling 12-month net charge-off rates for used vehicle loans are currently at the highest levels on record,” NCUA said.
To address these matters, NCUA said examiners will continue to review a credit union’s lending and related risk-management practices.
“This priority will include reviewing the sufficiency of your loan underwriting standards, collection programs, Allowance for Credit Losses reserves, charge-off practices, management and board reporting, and management of any concentrations of credit risk. To the extent possible, examiners will also review your credit union’s third-party risk-management practices when lending, servicing, or collection functions are outsourced,” the agency said.
Balance Sheet Management and Risk to Earnings and Net Worth
NCUA noted that among the most significant risks CU face are credit, liquidity, and market risk.
“For credit unions, the primary market risk element is interest rate risk. Interest rate changes can affect the income credit unions generate from their lending and funding activities, which can affect the credit union’s ability to build net worth. Loan losses can also diminish a credit union’s earnings and net worth,” NCUA said.
Over the last few years, the rising interest rate environment increased some credit unions’ cost of funds faster than the returns on loans and investments, squeezing the net interest margin, NCUA noted.
“In 2023 and 2024, this increase in funding costs put pressure on earnings until loan and investment returns could catch up. If interest rates continue to decline, higher yielding loans and investments are prone to prepayment, which could accelerate as rates drop, reducing interest income from longer-duration assets. For the last several quarters, net interest margins have only slightly exceeded operating expenses. Any increase in operating expenses or further decline in loan performance could put earnings and net worth at risk,” NCUA said.
In evaluating a credit union’s earnings and net worth risk-management frameworks, NCUA said examiners will weigh the current and prospective sources of earnings and the composition of net worth relative to the credit union’s approved plans and thresholds.
“This approach will help examiners focus on trends in earnings and develop a better understanding of concentration risks for both earnings and net worth. Also, examiners will continue to consider the current and prospective sources of liquidity compared to funding needs to determine the adequacy of your credit union’s liquidity risk-management framework. Examiners will review your credit union’s policies, procedures, risk limits, and evaluate the adequacy of your credit union’s risk-management framework relative to its size, complexity, and risk profile,” NCUA said.
Cybersecurity
NCUA emphasized that cybersecurity remains a top supervisory priority.
“The risk of a cybersecurity incident rises as dependence on networks and technology increases. A loss or compromise in confidentiality, integrity, or availability of systems or information may lead to fraud, as well as financial and reputational loss. It is thus crucial for your credit union to manage its information security programs and continuity of operations plans proactively, and to conduct ongoing due diligence of your critical service providers,” the agency said.
In 2025, NCUA said examiners will continue to use the information security examination procedures to assess whether a credit union has implemented “robust” information security programs to safeguard both members and the credit union itself.
“The NCUA will continue to support credit unions’ voluntary use of the Automated Cybersecurity Evaluation Toolbox to assess their cybersecurity maturity. For access to more cybersecurity information and resources, including detailed information on examination procedures, credit unions are encouraged to visit the NCUA’s Cybersecurity Resources webpage. These resources provide valuable insights and guidance to help your credit union strengthen its cybersecurity stance and stay abreast of the latest developments,” the agency said.
Consumer Financial Protection
NCUA said it will continue to prioritize reviewing compliance with consumer financial protection laws and regulations during every federal credit union examination.
“In addition to reviewing any areas specific to your credit union identified during the risk-focused examination scoping process, in 2025 examiners will, in particular, assess your credit union’s compliance with the following consumer financial protection areas:
- Overdraft programs. Examiners will continue a review of credit union overdraft programs, including policies, procedures, disclosures, fees, account statements, member complaints, internal reviews, and websites.
- Fair lending. Examiners will assess policies and practices for identifying and mitigating potential discrimination in residential real estate valuation practices.
- Home Mortgage Disclosure Act and Regulation C. Examiners will evaluate compliance with Home Mortgage Disclosure Act data collection and reporting policies and practices, including transaction testing, for credit unions above the reporting threshold.
- Military Lending Act. Examiners will review compliance with the Military Lending Act requirements, including policies and procedures, compliance management systems, and checking and monitoring for military status.
- Electronic Fund Transfer Act and Regulation E. Examiners will assess policies and procedures related to payments and error resolution.
Exam Updates
NCUA reminded that in 2025 the agency will update its exam flexibility initiative to provide an extended exam cycle for credit unions over $1 billion in assets where the NCUA rated the credit union a CAMELS composite 1 or 2 with no change in CEO since the last examination. These institutions will now be eligible for a 12- to 16-month exam cycle. Additionally, the extended exam cycle for eligible federal credit unions will be shortened from 14 to 20 months to 14 to 18 months.