US regulators issue reporting updates for banks and credit unions

US Agencies proposed revision and a three-year extension of the Call Reports FFIEC 031, FFIEC 041, and FFIEC 051 as well as the FFIEC 002 and FFIEC 002S reports. These US Agencies are the Board of Governors of the Federal Reserve System (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency or OCC. The comment period on the proposed notice ends on April 24, 2023, while changes to the Call Reports and the FFIEC 002 are proposed to take effect as of June 30, 2023 report date. The National Credit Union Administration Board (NCUA) also outlined its supervisory priorities and approved the final rule on cyber incident reporting requirements with an effective date of September 01, 2023.

As part of the reporting updates, the US Agencies are now requesting comment on revisions to eliminate and consolidate items in the Call Reports and the FFIEC 002 resulting from the statutorily mandated full review of the Call Reports. The proposed revisions address, among others, the non-cash income from negative amortization loans (agencies are proposing to remove one item related to negative amortization loans) and certain reverse mortgage items (agencies no longer need the current level of detail on this activity and are proposing, for all versions of the Call Report, to consolidate the subitems). The US Agencies are seeking comments on the continued use of the optional tax worksheet to Call Report filers or other stakeholders and any concerns if the agencies discontinue its publication. Apart from these, the agencies are also seeking comment on the reporting of structured financial products (like K-Deals and Q-Deals issued by Freddie Mac), including those issued or guaranteed by the U.S. government or government-sponsored agencies. The agencies will alos continue to monitor the Paycheck Protection Program (PPP)-related data items and plan to propose discontinuing the collection of these items, once the aggregate industry activity has diminished to a point where individual institution information is of limited practical utility.

The recently approved NCUA final rule on cyber incident reporting requires a federally insured credit union to notify NCUA as soon as possible, but within 72 hours, once it reasonably ascertains that a reportable cyber incident has occurred. The intention of this requirement is to alert NCUA, not to provide a full incident assessment in the 72-hour timeframe. NCUA is expected to provide additional reporting guidance before the final rule goes into effect. NCUA also outlined its supervisory priorities for 2023, setting out interest rate risk (IRR), liquidity risk, and credit risk as the top areas of focus for the agency. A notable and new addition to the supervisory priorities in 2023 is fraud prevention and detection. NCUA states that it will implement a management questionnaire designed to enhance the identification of fraud red flags, material supervisory concerns, or other potential new risks to which credit unions may be exposed. Cybersecurity and consumer protection are the two key items remaining from the supervisory priorities last year that are included for this year as well. NCUA also shared updates on transition to the new current expected credit losses (CECL) accounting standard. Credit unions are required to implement the Financial Accounting Standards Board’s Accounting Standards Update No. 2016-13, Topic 326, Financial Instruments – Credit Losses, commonly referred to as Current Expected Credit Loss (CECL) for financial reporting years starting after December 15, 2022.

Related link:

• Proposed revisions to call reports