Records Preservation Program and Appendices-Record Retention Guidelines; Catastrophic Act Preparedness Guidelines, 14251-14254 [E7-5070]

Agencies

• National Credit Union Administration

[Federal Register Volume 72, Number 58 (Tuesday, March 27, 2007)]
[Proposed Rules]
[Pages 14251-14254]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E7-5070]


=======================================================================
-----------------------------------------------------------------------

NATIONAL CREDIT UNION ADMINISTRATION

12 CFR PARTS 748 and 749

RIN 3133-AD24


Records Preservation Program and Appendices--Record Retention 
Guidelines; Catastrophic Act Preparedness Guidelines

AGENCY: National Credit Union Administration (NCUA).

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: NCUA proposes to amend its regulations to address a federally-
insured credit union's obligation to maintain a records preservation 
program. The proposed rule draws from existing guidance to clarify 
requirements for preserving vital records and to suggest important 
items for consideration in restoring vital member services. NCUA 
believes the revised language and new appendix will facilitate the 
recovery of essential operations after a catastrophic act resulting in 
continued member confidence in the credit union system. The agency also 
proposes to amend its regulations to clarify the meaning of 
catastrophic act.

DATES: Comments must be received on or before May 11, 2007.

ADDRESSES: You may submit comments by any of the following methods 
(Please send comments by one method only):
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     NCUA Web Site: https://www.ncua.gov/
RegulationsOpinionsLaws/proposed_regs/proposed_regs. html. Follow the 
instructions for submitting comments.
     E-mail: Address to regcomments@ncua.gov. Include ``[Your 
name] Comments on Proposed Rule Parts 748 and 749,'' in the e-mail 
subject line.
     Fax: (703) 518-6319. Use the subject line described above 
for e-mail.
     Mail: Address to Mary F. Rupp, Secretary of the Board, 
National Credit Union Administration, 1775 Duke Street, Alexandria, 
Virginia 22314-3428.
     Hand Delivery/Courier: Same as mail address.
    Public inspection: All public comments are available on the 
agency's Web site at https://www.ncua.gov/RegulationsOpinionsLaws/
comments as submitted, except as may not be possible for technical 
reasons. Public comments will not be edited to remove any identifying 
or contact information. Paper copies of comments may be inspected in 
NCUA's law library, at 1775 Duke Street, Alexandria, Virginia 22314, by 
appointment weekdays between 9 a.m. and 3 p.m. To make an appointment, 
call (703) 518-6540 or send an e-mail to OGCMail@ncua.gov.

FOR FURTHER INFORMATION CONTACT: Andrew Healey, Program Officer, 
Division of Supervision, Office of Examination and Insurance, at (703) 
518-6360 or Linda K. Dent, Staff Attorney, Office of General Counsel, 
at (703) 518-6540.

SUPPLEMENTARY INFORMATION:

Background

    Lessons learned from previous catastrophic acts, including the 
dramatic effects of the Katrina and Rita hurricanes, indicate the 
importance of preserving vital records and swiftly restoring vital 
member services. In particular, NCUA's review of events in the 
hurricanes' aftermath demonstrates the need for advance planning and 
preparation in successfully responding to a catastrophic act.
    Challenges such as providing members with access to funds and 
account information, loss of, or lack of, access to facilities, and 
locating and communicating with staff were some of the immediate issues 
credit unions faced. Fortunately, affected credit unions did not face 
these challenges alone. Help came from NCUA, other credit unions, trade 
organizations, and service providers. For example, NCUA operated a call 
center to assist credit union members in contacting their institutions. 
Agency field staff checked on credit union facilities, helped locate 
staff, assisted credit unions with equipment needs, and helped credit 
unions restore share and loan data where necessary. Other credit unions 
mobilized to send needed cash, provided operating space, made staff 
available, and sent needed equipment to affected credit unions. Trade 
organizations served as a clearinghouse to match those with resources 
with those in need. Shared branch facilities signed on institutions 
enabling them to service displaced members.
    In reviewing these experiences, the Board determined credit unions, 
which had considered potential threats and identified critical 
functions necessary for the retrieval of vital records, were able to 
address anticipated challenges and unforeseen difficulties and restore 
vital member services. These institutions were able to provide members 
with access to their funds and handle member inquiries in a relatively 
short time period. The proposed amendments draw from these experiences 
to identify program elements the Board considers essential to restoring 
vital records and member services.
    Many of these elements are covered in previous NCUA guidance issued 
to federally-insured credit unions (FICUs) on disaster recovery 
planning. Despite the existence of this guidance, the Board is 
concerned that some credit unions may not be maintaining sufficient 
plans and safeguards to respond to events causing the destruction of 
vital records or catastrophic acts. The Board believes this proposal is 
necessary to ensure credit unions address these critical issues in the 
paramount interest of maintaining services to members and confidence in 
the credit union system if a catastrophic act occurs.

Proposed Changes

    The proposed changes specifically address the Board's concerns 
regarding restoration of vital member records and services. The 
proposed changes establish minimum standards for preserving vital 
records and include recommendations concerning restoring member 
services considered vital to a credit union's continued operation.

Part 748

    The Board proposes to revise the definition of catastrophic act to 
clarify that any event causing an interruption in vital member services 
for more than two business days is a qualifying event.

Part 749

    Several of the proposed changes pertain to format and grammar and 
are made to clarify the rule's language. For example, the Board 
proposes to eliminate the question format currently used in the section 
headings and replace these with language simply describing each 
section's contents. Section 749.1 includes two changes of note. Changes 
to the vital records definition clarify that share, deposit, and loan 
balances for each member's account should be available as of the most 
recent business day, while a financial report of the credit union's 
asset and liability accounts and bank reconcilements should be 
available as of the most recent month's end. All other vital records 
should be updated as changes occur. A new paragraph (d) is added 
requiring

[[Page 14252]]

credit unions to maintain certain emergency contact information.
    The definition of a vital records center remains the same, 
essentially a fixed site in a geographic area different from the credit 
union's primary site and that is unlikely to be negatively affected by 
the same catastrophic act whether natural or otherwise, for example, a 
power grid failure. The Board proposes to add a phrase which clarifies 
the back-up site may be another federally-insured credit union. The 
Board also proposes to add a sentence to the end of this section to 
address the importance of having any equipment or software necessary to 
access the vital records at the center.
    The proposed rule also includes recommendations on restoring vital 
member services for a credit union. Specifically, Sec.  749.0 suggests 
a credit union should complement its plans for safeguarding and 
reconstructing vital records by establishing a method for restoring 
vital member services in the event of a catastrophic act. Similarly, 
Sec.  749.2 recommends that procedures for maintaining duplicate vital 
records should include a method for using these records to restore 
vital member services.

Appendix B--Catastrophic Act Preparedness Guidelines

    NCUA has issued considerable guidance relative to disaster 
preparedness which parallels preparation for a catastrophic act as set 
forth below:
    Letter to Credit Unions 01-CU-21 Disaster Recovery and Business 
Resumption Contingency Plans; Letter to Credit Unions 03-CU-07 FFIEC 
Release of Information Technology Examination Handbook; Risk Alert 06-
Risk-01 Disaster Planning and Response; Letter to Credit Unions 06-CU-
06 Influenza Pandemic Preparedness; Letter to Credit Unions 06-CU-10 
NCUA's Information System and Technology Program--Business Continuity 
Planning Questionnaire; Letter to Credit Unions 06-CU-11 Interagency 
Guidance Lessons Learned By Institutions Affected by Hurricane Katrina; 
and Letter to Credit Unions 06-CU-12 Disaster Preparedness & Response 
Examination Procedures.
    The Board recognizes credit unions generally engage in some form of 
planning for responses to catastrophic acts and have access to existing 
guidance. The Board is specifically interested in commenters' feedback 
on the usefulness and/or need of including a new appendix providing 
recommended information credit unions could use in preparing for a 
catastrophic act.

Regulatory Procedures

NCUA Interpretive Ruling and Policy Statement 87-2

    The comment period for this proposal has been shortened to 45 days. 
The NCUA Board believes it is important to expedite the rulemaking 
process in this matter to allow for its completion prior to the height 
of the approaching hurricane season.

Paperwork Reduction Act

    The proposed changes involve information collection requirements. 
As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)), 
NCUA is submitting a copy of this proposed rule as part of an 
information collection package to the Office of Management and Budget 
(OMB) for its review.
    The proposed rulemaking amends an existing requirement for a 
records preservation program by requiring the program be in writing and 
include emergency contact information for designated persons.
    The Board believes these requirements will not create an undue 
burden on credit unions as it expects credit unions will document 
existing plans and practices. The Board estimates 8,405 respondents 
will take an average of one hour to comply with these requirements. 
Additionally, 15 respondents representing newly-chartered credit unions 
will take an average of seven hours to develop a written records 
preservation program. The total annual collection burden is estimated 
to be approximately 8,510 hours.
    The Paperwork Reduction Act and OMB regulations require that the 
public be provided an opportunity to comment on the paperwork 
requirements, including an agency's estimate of the burden of the 
paperwork requirements. The NCUA Board invites comment on: (1) Whether 
the paperwork requirements are necessary; (2) the accuracy of NCUA's 
estimates on the burden of the paperwork requirements; (3) ways to 
enhance the quality, utility, and clarity of the paperwork 
requirements; and (4) ways to minimize the burden of the paperwork 
requirements.
    Comments should be sent to: OMB Reports Management Branch, New 
Executive Office Building, Room 10202, Washington, DC 20503; Attention: 
Mark Menchik, Desk Officer for NCUA. Please send NCUA a copy of any 
comments submitted to OMB.
    The Paperwork Reduction Act requires OMB to make a decision 
concerning the collection of information contained in these proposed 
regulations between 30 and 60 days after publication of this document 
in the Federal Register. Therefore, a comment to OMB is best assured of 
having its full effect if OMB receives it within 30 days of 
publication. This does not affect the deadline for the public to 
comment to the NCUA on the proposed regulation.

Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA) requires NCUA to prepare an 
analysis to describe any significant economic impact a proposed 
regulation may have on a substantial number of small entities. 5 U.S.C. 
601-612. NCUA considers credit unions having less than ten million 
dollars in assets to be small for purposes of RFA. Interpretive Ruling 
and Policy Statement (IRPS) 87-2 as amended by IRPS 03-2.
    The NCUA has determined and certifies that this proposed rule, if 
adopted, will not have a significant economic impact on a substantial 
number of small credit unions. Accordingly, the NCUA has determined 
that an RFA analysis is not required. NCUA solicits comment on this 
analysis and welcomes any information that would suggest a different 
conclusion.

Executive Order 13132

    Executive Order 13132 encourages independent regulatory agencies to 
consider the impact of their regulatory actions on state and local 
interests. In adherence to fundamental federalism principles, NCUA, an 
independent regulatory agency as defined in 44 U.S.C. 3502(5), 
voluntary complies with the executive order. This proposed rule, if 
adopted, will not have substantial direct effects on the states, on the 
relationship between the national government and states, or on the 
distribution of power and responsibilities among the various levels of 
government. NCUA has determined the proposed rule does not constitute a 
policy that has federalism implications for purposes of the executive 
order.

Treasury and General Government Appropriations Act, 1999

    NCUA has determined that the proposed rule will not affect family 
well-being within the meaning of section 654 of the Treasury and 
General Appropriations Act, 1999, Public Law 105-277, 112 Stat. 2681 
(1998).

List of Subjects

12 CFR Part 748

    Credit unions, Reporting and recordkeeping requirements.

[[Page 14253]]

12 CFR Part 749

    Credit unions, Reporting and recordkeeping requirements.

    By the National Credit Union Administration Board on March 15, 
2007.
Mary Rupp,
Secretary of the Board.

    Accordingly, NCUA proposes to amend 12 CFR part 748 as follows:

PART 748--SECURITY PROGRAM, REPORT OF SUSPECTED CRIMES, SUSPICIOUS 
TRANSACTIONS, CATASTROPHIC ACTS AND BANK SECRECY ACT COMPLIANCE

    1. The authority citation for parts 748 and 749 continues to read 
as follows:

    Authority: 12 U.S.C. 1766(a) and 1786(q); 15 U.S.C. 6801 and 
6805(b); 31 U.S.C. 5311 and 5318.

    2. Amend Sec.  748.1 by revising the second sentence of paragraph 
(b) to read as follows:


Sec.  748.1  Filing of reports.

* * * * *
    (b) * * * A catastrophic act is any event, natural or otherwise, 
resulting in physical destruction or damage to the credit union or an 
interruption in vital member services projected to last more than 2 
business days. * * *
* * * * *

PART 749--RECORDS PRESERVATION PROGRAM AND APPENDICES--RECORD 
RETENTION GUIDELINES; CATASTROPHIC ACT PREPAREDNESS GUIDELINES

    1. The authority citation for part 749 continues to read as 
follows:

    Authority: 12 U.S.C. 1766, 1783 and 1789; 15 U.S.C. 7001(d).

    2. Amend part 749 by revising the part heading to read as set forth 
above.
    3. Revise Sec.  749.0 to read as follows:


Sec.  749.0  Purpose and scope.

    (a) This part describes the obligations of all federally-insured 
credit unions to maintain a records preservation program to identify, 
store and reconstruct vital records in the event that the credit 
union's records are destroyed and provides recommendations for 
restoring vital member services. All credit unions must have a written 
program that includes plans for safeguarding records and reconstructing 
vital records. To complement these plans, it is recommended a credit 
union develop a method for restoring vital member services in the event 
of a catastrophic act. Additionally, the regulation establishes 
flexibility in the format credit unions may use for maintaining 
writings, records or information required by other NCUA regulations.
    (b) Appendix A to this part provides guidance concerning the 
appropriate length of time credit unions should retain various types of 
operational records. Appendix B to this part also provides guidance for 
developing a program for responding to a catastrophic act to ensure 
duplicate vital records can be used for restoration of vital member 
services.
    4. Revise Sec.  749.1 to read as follows:


Sec.  749.1  Definitions.

    For purposes of this part:
    Vital member services mean informational account inquiries, share 
withdrawals and deposits, and loan payments and disbursements.
    Vital records refer to the following records:
    (a) A list of share, deposit, and loan balances for each member's 
account as of the most recent business day that:
    (1) Shows each balance individually identified by a name or number;
    (2) Lists multiple loans of one account separately; and
    (3) Contains information sufficient to enable the credit union to 
locate each member, such as address and telephone number.
    (b) A financial report, which lists all of the credit union's asset 
and liability accounts and bank reconcilements, current as of the most 
recent month-end.
    (c) A list of the credit union's accounts at financial 
institutions, insurance policies, and investments along with related 
contact information, current as of the most recent month-end.
    (d) Emergency contact information for employees, officials, 
regulatory offices, and vendors used to support vital records.
    5. Revise Sec.  749.2 to read as follows:


Sec.  749.2  Vital records preservation program.

    The board of directors of a credit union is responsible for 
establishing a vital records preservation program within 6 months after 
its insurance certificate is issued. The program must be in writing and 
contain procedures for maintaining duplicate vital records at a vital 
records center. The procedures must include: designated staff 
responsible for vital records preservation, a schedule for the storage 
and destruction of records, and a records preservation log detailing 
for each record stored, its name, storage location, storage date, and 
name of the person sending the record for storage. It is recommended 
credit unions include in these procedures a method for using duplicate 
records to restore vital member services in the event of catastrophic 
act. Credit unions which have some or all of their records maintained 
by an off-site data processor are considered to be in compliance for 
the storage of those records if the service agreement specifies the 
data processor safeguards against the simultaneous destruction of 
production and back-up information.
    6. Revise Sec.  749.3 to read as follows:


Sec.  749.3  Vital records center.

    A vital records center is defined as a storage facility, which may 
include another federally-insured credit union, at any location far 
enough from the credit union's offices to avoid the simultaneous loss 
of both sets of records in the event of a catastrophic act. A credit 
union must maintain or contract with a third party to maintain any 
equipment or software for its vital records center necessary to access 
records.
    7. Revise Sec.  749.4 to read as follows:


Sec.  749.4  Format for vital records preservation.

    Preserved records may be in any format that can be used to 
reconstruct the credit union's records. The format used must accurately 
reflect the information in the record, remain accessible to all persons 
entitled to access by statute, regulation or rule of law, and be 
capable of reproduction by transmission, printing, or otherwise.
    8. Revise Sec.  749.5 to read as follows:


Sec.  749.5  Format for records required by other NCUA regulations.

    Where NCUA regulations require credit unions to retain certain 
writings, records or information, credit unions may use any format that 
accurately reflects the information in the record, is accessible to all 
persons entitled to access by statute, regulation or rule of law, and 
is capable of being reproduced by transmission, printing, or otherwise. 
The credit union must maintain the necessary equipment or software to 
permit an examiner to access the records during the examination 
process.
    9. Add new Appendix B to Part 749 to read as follows:

Appendix B to Part 749--Catastrophic Act Preparedness Guidelines

    Credit unions often look to NCUA for guidance on preparing for a 
catastrophic act. While NCUA has minimal regulation in this area 
\1\, as an aid to credit unions it is

[[Page 14254]]

publishing this appendix of suggested guidelines. It is recommended 
that all credit unions develop a program to prepare for a 
catastrophic act. The program should be developed with oversight and 
approval of the board of directors. It is recommended the program 
address the following five elements:
---------------------------------------------------------------------------

    \1\ See 12 CFR 748.1(b) concerning a FICU's reporting of any 
catastrophic act that occurs at its office to its regional director 
and 12 CFR 749.3 concerning the location of a FICU's vital records 
center to avoid the simultaneous loss of both sets of records in the 
event of disaster.
---------------------------------------------------------------------------

    (1) A business impact analysis to evaluate potential threats;
    (2) A risk assessment to determine critical systems and 
necessary resources;
    (3) A written plan addressing:
    (i) Persons with authority to enact the plan;
    (ii) Preservation and ability to restore vital records;
    (iii) A method for restoring of vital member services through 
identification of alternate operating location(s) or mediums to 
provide services, such as telephone centers, shared service centers, 
agreements with other credit unions, or other appropriate methods;
    (iv) Communication methods for employees and members;
    (v) Notification of regulators as addressed in 12 CFR 748.1(b);
    (vi) Training and documentation of training to ensure all 
employees and volunteer officials are aware of procedures to follow 
in the event of destruction of vital records or loss of vital member 
services; and
    (vii) Testing procedures, including a means for documenting the 
testing results.
    (4) Internal controls for reviewing the plan at least annually 
and for revising the plan as circumstances warrant, for example, to 
address changes in the credit union's operations; and
    (5) Annual testing.

 [FR Doc. E7-5070 Filed 3-26-07; 8:45 am]
BILLING CODE 7535-01-P