Key Changes in Credit Union Regulations: MCC Requirements and Implications

18/04/2024 www.lia.ie Practical Implications of MCC for Credit Unions Presented By de McCormack

Contents Introduction MCC F&P Register MCC Requirements Fitness & Probity Controlled Functions MCC In-Scope Activities for CU F&P Due Supporting Diligence Documentation New F&P Controlled Functions F&P Process for CU CF Roles Impact on Governance Arrangements F&P Due Diligence Requirements Impact on Operational Processes Data Protection Obligations MCC Gap Analysis Review of Governance & Operational Documents Developing MCC Plan

Introduction A key objective of the CBI over the last number of years is to ensure an appropriate and standardised level of professional competency within the financial services sector Achieved by the roll out of the MCR and Fitness & Probity Regimes The MCR will now include Credit Unions from 1st Oct 2024 for in scope activities The recent changes to the MCC/F&P requirements, the new Individual Accountability regime and the recently enacted Credit Union Amendment Bill represents some of the most significant changes to the Credit Union legal and regulatory landscape in recent years

MCC Requirements Already applies to Credit Unions providing Mortgages and who act as insurance intermediaries The MCR requires credit unions to ensure relevant persons are compliant with MCC requirements after 1st October 2024 Individuals performing specified activities regardless of whether they are a member of staff, or a volunteer must meet the MCC requirements by 1st October 2028 but have commenced the process by 1st October 2024

MCC In-Scope Activities for Credits Unions After 1st October 2024 any officer providing information to members on Lending and Term Deposits will be required to hold or be in the process of attaining a recognized MCC qualification for these products, such activities include: Talking to a member about a loan or term deposit product Taking an application for a loan or term deposit, including for temporary arrangements and rescheduling a loan so tellers, MSO, credit and credit control officers for example Deciding on a loan application (or other product) so tellers (particularly for loans within shares), credit officers, credit committee, Board Overseeing/supervising the loan or term deposit process e.g. Head of Lending, Supervisor, Operations Manager. Branch Manager, Credit & Credit Control Committee Loan or Term Deposit new product development Management Team, Committee or Board

New F&P Controlled Functions In-Scope Activity Controlled Function Giving of advice to a member of a Credit Union, while providing, or in relation to the provision of, the financial service. Arranging, or offering to arrange, a financial service for a member of a Credit Union. CUCF-3 CUCF-4 Assisting a member of a Credit Union in the making of a claim under a contract of insurance or reinsurance. Determining the outcome of a claim arising under a contract of insurance or reinsurance. Acting in the direct management or supervision of those persons who act for a Credit Union in providing the services referred to in CUCF-3-6. Adjudicating on any complaint communicated to a Credit Union by a member in relation to the provision of a financial service. CUCF-5 CUCF-6 CUCF-7 CUCF-8

Impact on Governance Arrangements - Loans An entire Committee (Credit and Credit Control Committee s) or Board needs to be qualified which will require sufficient qualified officers Credit Unions may have difficulty in having qualified Board members Credit Union Amendment Act 2023 permits an alternative loan decision / appeals process Hybrid or fully operational committees are permitted once the CUA 1997 Section 67 (Third Schedule Section 3 & 4) requirements are met

Impact on Operational Processes - Loans Staff who are involved in the lending process, from the loan enquiry stage to drawdown (along with those in a supervisory capacity), will need to meet MCC requirements Impact of this on operations including front line roles could be significant as in general, provide members with initial loan quotations In many credit unions Tellers take loan applications and assist with determining loan duration/repayment, pay out approved loans, including issuing the Credit Agreement, discuss member queries for a new loan or in relation to an existing loan including late payments, clearing arrears

Impact on Operational Processes - Loans If Credit & Credit Committees becomes operational and it is expected they will for most credit unions, this could put a serious strain on staff resources as 6 qualified staff are required to fill these committees and as Credit nor Credit Control Officers can sit on these committees these roles will need to be resourced separately with 2-3 credit officers on average and 1-2 credit control staff. So that is a minimum of 8-10 staff excluding any tellers involved in in-scope activities as noted above May result in MCC qualified 2ndline staff sitting on Credit /Credit Control Committee s Which raises segregation of duty concerns and impacts on the independence and objectivity of 2nd line In this instance will require a risk assessment to be completed with mitigating controls identified

Impact on Operational Process Aside from the loan process from enquiry to drawdown, the following processes require suitably qualified individuals: Term deposit enquiries, account opening, etc. Claims involving loans e.g. LP/LS as loan protection covers permanent incapacity Complaints officer/team/committee Loan appeals Persons/body in direct management or in a supervisory role who may not have a direct involvement in the lending or term deposit process e.g. Operations Manager, Office Manager, etc.

Impact on Operational Processes Credit Control Credit Control staff need to meet MCC requirements as they assist members with temporary arrangements, rescheduling and arrears management Discussion or queries with members regarding out of order overdrafts, missed payments, extra payments, arrears or pre arrears can only be with a qualified teller or Credit Control Officer If Credit Control work is outsourced MCC requirements need to be addressed as part of the tender process and the annual review process to ensure continued compliance Need to be cognizant of the ongoing F&P requirements for in scope outsourced functions An outsourcing review template should be used to ensure a standardised and compliant approach

Impact on Member Terms Deposit Account Processes Where credit unions provide term deposit accounts for 1 year or more to members the following activities are within scope of MCC requirements from 1st October 2024: Giving of advice to a member in relation to the provision of a term deposit account Arranging or offering to arrange a term deposit account for a member Supervising or direct managing those persons providing the above services Adjudicating on any member complaint relating to term deposit accounts

Impact on Member Complaints Process In line with the MCC changes, the body or person with responsibility for member complaints regarding loans and term deposits needs to meet the MCC requirements It is expected that member complaints becomes an operational role/committee

Impact on Product Design/Development Process MCC requires that the design /development of in-scope products requires at least one key person on the appointed committee shall meet the required professional standard Directors who are not qualified could sit on this committee once at least one key member of the committee meets the requirements and is present at each meeting it is therefore advisable to have more than one qualified person on the committee It is recommended that a Product Development Policy is documented which outlines the process for developing and testing new products or services right though to approving the new product

MCC Gap Analysis A gap analysis should be competed to determine gaps in suitably qualified persons to fill the various in-scope committees and activities, such as: Insurance claims involving loans e.g. LP/LS Complaints officer/team/committee Loan appeals Persons/body in direct management or in a supervisory role who may not have a direct involvement in the lending or term deposit process e.g. Operations Manager, Office Manager, etc. Loan and term deposit product development The loan process from enquiry to drawdown (where it includes the signing of the Credit Agreement by the person paying out the loan) Term deposit enquiries, form filling, account opening, etc.

Developing an MCC Plan An MCC Plan should be completed to ensure the necessary changes to governance and operational processes are in place prior to 1st October 2024 to allow for full compliance with MCC requirements, including: Process for consideration of Officer loans and loan appeals once Section 37 of CUA 1997 is amended by the commencement of the relevant section of the Credit Union Amendment Act 2023 Have identified sufficient persons who will meet MCC requirements to fill the various MCC committees and roles A process to ensure unqualified persons are either qualified or in the process of attaining a qualification by 1st October 2024

Developing an MCC Plan - continued Ensure individuals identified to fill MCC roles have appropriate F&P due diligence completed and meet the F&P requirements prior to confirming their Controlled Function status Ensure Board and operational succession planning is reviewed to take account of MCC requirements ensure sufficient (qualified) staff to meet succession requirements or fill MCC roles on a temporary basis for taking account of planned and unplanned leave, segregation of duties, conflicts of interest, etc. Succession plan should be used to inform Board and operations recruitment campaigns Relevant policies and procedures are updated re MCC requirements Data Protection obligations

MCC F&P Register Credit Unions are required to maintain and up to date MCC Register Needs to record all officers (voluntary / staff) who are involved in an in-scope activity this will include loans and term deposits from 1st October 2024 A listing of each officers MCC qualifications and CPD membership status to be documented in the register Including a section for officers in the process of attaining a suitable qualification, e.g. date of initial registration for exam(s), how many completed, expected completion date, etc. Ongoing CPD membership status e.g. progress on completing mandatory topics and sufficient CPD hours, etc. Recommend it is sufficiently detailed to serve as the required F&P Register needs to include individuals various CF roles and the certification process.

Fitness & Probity Controlled Functions Further controlled functions have been introduced to ensure full alignment between the new in- scope MCC activities and F&P Regulations CUCF 3 -8 CUCF 1 & 2 are already in place including the various PCF roles, as such all credit unions should have a documented process for identifying and managing the various F&P obligations for voluntary and paid officers Credit Unions will need to be satisfied on an ongoing basis that relevant officers & outscored function: Meet the F&P standard a process of due diligence Continue to maintain those standards self-certification

F&P Due Diligence Certification Process Y = Evident of checks undertaking by CU SC = Self Certify by CF I/A = If Applicable Standard Supporting Documents Obtained from a Third Party CU CF 1- 5 CU CF 1-2 CU CF 3-8 Record of Experience CV Record of Interview/Application Employers References Y Y Y Y - Y Y - Y General Evidence of Professional Qualifications Transcripts MCC Qualifications & CPD Membership Professional Body Check Conflicts Y I/A Y SC Y I/A Y SC Y SC/Y - SC Competent and Capable Garda Check/Convictions Regulator Check SC Y SC SC SC SC Honest, Ethical and with Integrity Judgemental Search CRO Check Y Y Y Y SC SC Financial Soundness

F&P Process for CU CF Roles - (Voluntary/Staff) The following should be adequately documented: 1. 2. 3. What standard of F&P is appropriate to a particular CF Obligations on a person performing a CF Obligations on the Credit Union with respect to persons performing CF roles including procedure for conducting due diligence Process for informing applicant for elected positions where they are deemed not to have meet the Standards and therefore not eligible to stand for election Pre-approval process is sufficiently documented Process for notifying Central Bank via the Online Reporting System Appeals process 4. 5. 6. 7.

F&P Due Diligence Process Requirements Should already have documented F&P processes including for due diligence, which includes: Profile for each elected official is prepared and kept on file, briefly providing a description of the CF (PCF) holder s relevant qualifications and experience and an overview of the person s attributes Evidence that the succession plan is used as a tool to assist with assessment of the Credit Unions needs/requirements A separate Due Diligence File maintained for each CF holder containing records of relevant previous experience and qualifications, noting whether certain qualifications were a requirement of the role - staff who will become CF s for the first time will not require the same level of documentation on previous experience, CV s etc. Evidence of the assessment conducted by the credit union included in each due diligence file

Data Protection Obligations Documentary evidence of the Credit Union's compliance with GDPR Article 13 - providing the data subject with sufficient information (prior to commencement of due diligence) to ensure they are fully aware of and understand why they are completing an IQ form and/or providing F&P paperwork (in the form of a letter or statement) Ensure existence and adequacy of record retention policy for the appropriate retention period to ensure its compliance with the General Data Protection Regulation ( GDPR ). Article 5(1)(e) of the GDPR provides that personal data processed for any purpose(s) shall not be kept for longer than is necessary for that purpose(s)

Data Protection Obligations - Continued The initial DPIA completed for the F&P process should now be reviewed and updated if necessary and where not yet completed one should now be documented It is expected that documents will be retained (in a secure manner) for a set period after the officer no longer holds the CF to demonstrate compliance with F&P requirements, a rationale for the record retention timeframe should be documented within the Record Retention Policy

Review of Governance & Operational Documents All relevant policies and procedures will need to be reviewed and updated accordingly to ensure full compliance with the new MCC regime, including but not limited to: Fitness and Probity Policy Nominations Policy Governance Policy HR Policy / Staff Handbook Training Policy Suite of Credit Policies Savings Policy Complaints New Product Development Policy Outsourcing Policy (where credit control work, Compliance Officer, policy and/or product development, etc. is outsourced); Terms of Reference for relevant committees The Standard Operating Procedures for the above policies 2nd Line Work Plans

Thank you Any questions? For more information: LIA education@lia.ie de McCormack imccormack@creditunion.ie