By The Way
The By The Way newsletter is a great way to keep Kentucky credit unions informed of the latest updates in governmental affairs, compliance and regulations, education and training. In addition, By the Way highlights the difference credit unions are making on a daily basis.
League Updates
From America's Credit Unions
Educational Opportunities
Credit Union News
Compliance Updates
SUBMIT AN ARTICLE OR PRESS RELEASE
Career Opportunities
Subscribe to our Newsletter
Not Receiving Our Newsletter?
President's Update
An eye on the election…
We’re less than a week away from election day and, sort of like passing an accident on the highway, we can’t take our eyes off things. There are several races of national importance that will undoubtedly influence our industry, and we can’t make any assumptions about the outcome. The only thing we know for certain is that there will be changes coming.
Senator McConnell, long-time stalwart for credit unions, is stepping down from his leadership role in the Senate. As he is fond of saying, Kentucky “punches above its weight” in national politics, and the Senator’s decision will have an undeniable impact on our influence nationally.
On the brighter side, Congressman Andy Barr (6th District) is positioned for a possible chairmanship role over the House Financial Services Committee. He currently chairs the Subcommittee on Financial Institutions and Monetary Policy. This highly visible and influential role would be a significant win for both Mr. Barr and for our commonwealth.
Similarly, Congressman Brett Guthrie (2nd District) is positioned to potentially chair the House Energy and Commerce Committee. Congressman Guthrie currently chairs the committee’s Health Subcommittee.
Obviously, the outcome in November deciding the House majority will have a big impact on these possibilities.
We expect less change in Frankfort than D.C. though there are a few races that are close. We enjoy good relationships with our State legislators and regulators. We will continue to work hard to ensure that does not change.
All that said, regardless of what happens in the election, Chairman Harper at the NCUA is busy dropping hints about the Board’s priorities. In particular, he asked for feedback from his credit union connections on their thoughts about extending the Community Reinvestment Act to credit unions. (I’ll let you guess what those comments were like!) In one terse exchange posted publicly, he reminded his connections that the NCUA board is not intended to be a “cheerleader for the industry”. I don’t suspect many of us are surprised by that assessment!
We assume one doesn’t float trial balloons like that without purpose. The League, along with our advocacy partners, will be vigilant in keeping CRA rules focused where they should be – on banks.
The remainder of our advocacy priorities remains stubbornly the same as usual. If it feels like we’re constantly playing defense, it’s because we are. We know the interchange battle will continue into next year, and tax reform will certainly be a topic of interest that will draw the attention of our bank friends.
We appreciate and rely on your support as we fight for you in both Frankfort and Washington, D.C.
Sincerely,
Jim Kasch
League President
BACK TO TOP
Governmental Affairs Update
October is one of my favorite months—not only for the chance to decorate and hand out candy on Halloween, though that’s always a highlight! This month also marks the final push of election season and signals the beginning of serious preparations for the upcoming legislative session.
Recognizing the importance of this shift, our League made a visit to Frankfort earlier this month. Alongside Larry Lucas, CEO of Ashland Credit Union, we addressed the Interim Joint Committee on Banking and Insurance during their October meeting. We emphasized the unique value of the Credit Union model and highlighted how Kentucky’s Credit Unions embrace this difference, supporting their members and communities both financially and holistically. This is a vital opportunity for our advocacy work, allowing us to inform policymakers about what makes Credit Unions distinct and why it’s essential to support them, their member-owners, and the communities they serve.
If you have any questions about the issues we addressed, are interested in getting more involved in advocacy, or if I can assist you in any way, please don't hesitate to reach out.
Sincerely,
Kyle Hagerty, CUCE
VP, Governmental Affairs & Compliance
BACK TO TOP
The Governmental Affairs Conference 2025
March 2–6, 2025 // Washington D.C.
Venue: Walter E. Washington Convention Center
Registration is now open for Governmental Affairs Conference 2025!
Join thousands of credit union professionals in Washington, D.C., where you’ll engage with lawmakers and make a lasting impact on the credit union industry. Governmental Affairs Conference is the perfect opportunity to highlight the meaningful work credit unions are doing to improve the financial well-being of members and communities.
As the premier event for credit union advocates, GAC empowers you to connect with industry leaders, influence policy, and drive positive change.
This year’s theme, Together We Move – Moving with purpose. Moving with passion. Moving with strength, reflects the unity and determination you’ll help shape as we work together to improve financial well-being across the nation.
Here’s what to expect:
Hear from world-class keynote speakers: Gain insights and inspiration from leaders and innovators.
- Participate in impactful Hill Hikes: Collaborate with your state League to meet lawmakers and emphasize the credit union difference.
- Explore the industry's largest exhibit hall: Discover the latest products, services, and technologies in the credit union sector.
- Network with industry experts: Connect with professionals from credit unions, politics, business, and more.
Marketing, PR & Development Council Conference 2025
March 23 - 26, 2025 | Austin, TX
Join us for four days of inspiration, collaboration, and growth in Austin, TX!
Marketing, PR & Development Council Conference is the perfect environment to reconnect with other credit union marketing and business development peers who understand the challenges you face. Whether you’re a council member or not, you’ll want to be a part of this excitement!
This conference will feature a dynamic lineup of expert speakers, interactive workshops, and panel discussions that delve into hot topics relevant to today’s marketers. Conference content is driven by the Marketing, PR & Development Council, so you can be sure we are hitting relevant and trending topics impacting your role.
Whether you're looking to enhance your skills, network with like-minded professionals, or discover innovative solutions, this conference provides the perfect platform.
Who should attend:
This conference is beneficial for Marketing, PR & Development Council Members, as well as Marketing professionals.
Unlock Your Leadership Potential
Four Levels of Credit Union Leadership Programs Available at Your League
At every stage of your career, leadership development is essential for growth. Credit unions thrive when their leaders are equipped with the right tools and skills to guide their teams. Whether you’re just starting to tap into your leadership potential or ready to sharpen your executive expertise, we have the perfect program for you.
Discover our four levels of leadership training designed to help you excel at every level of your career.
Emerging Leaders:
For those just beginning to show their leadership potential, the Emerging Leaders program is designed to ignite your growth. You’ll learn fundamental leadership principles that prepare you for future roles and responsibilities. Whether you're a rising star or an up-and-coming employee eager to take on more, this program will nurture your natural abilities and give you the confidence to lead with purpose.
Additionally, the iLead Emerging Leaders Program offers a great complement to our Emerging Leaders program. Together, these programs provide a well-rounded foundation for aspiring leaders looking to fast-track their development and prepare for future leadership opportunities.
Learn more about Emerging Leaders
Supervisor Boot Camp:
New to a managerial role? The Supervisor Boot Camp is perfect for new supervisors, branch managers, department managers, or even seasoned leaders looking for a refresher. This boot camp covers essential management strategies, employee engagement, and leadership fundamentals, giving you the tools to effectively manage your team and operations. Whether you’re transitioning to a leadership role or seeking to enhance your managerial skills, this program will help you hit the ground running.
Save the Date for the next Supervisor Boot Camp: February 3-4, 2025
Southeast Management School:
As a current manager looking to move up the leadership ladder, the Southeast Management School is a critical step toward executive-level success. This program focuses on preparing you for the complexities of high-level credit union leadership. You'll dive deep into the ins and outs of strategic decision-making, operational excellence, and the financial dynamics of running a credit union. Whether you're aspiring to become an executive or a CEO, this program will help you navigate the path to leadership at the highest level.
Learn more about Southeast Management School.
iLead:
For seasoned executives aiming to sharpen their leadership acumen, the iLead program offers advanced leadership training. This program is designed for current executives who want to deepen and strengthen their leadership skill set. Through advanced strategies, innovative thinking, and personalized coaching, iLead will equip you to elevate your leadership and continue inspiring and driving your organization toward success.
Learn more about iLead
Whether you’re an Emerging Leader, a manager in need of a Supervisor Boot Camp, preparing for an executive role through the Southeast Management School, or an executive seeking to refine your skills in iLead, we’ve got a leadership development program to help you succeed.
Take the next step in your leadership journey today! Contact Janet Garrett for more information.
Emerging Leaders Program
Program Overview
The Emerging Leaders Program is a dynamic leadership development experience designed to shape and grow the credit union leaders of tomorrow. Throughout the program, participants will learn from inspiring guest presenters, collaborate in small groups, explore essential topics, take part in meaningful community service, and sharpen the skills needed for success at the next level and beyond.
About the Emerging Leaders Program
- 8-month commitment
- 6 one-day interactive leadership development workshops
- 1 community service project
- Limited to 20 leaders
Why apply?
- Develop and build leadership skills.
- Share and grow with peers.
- Learn from nationally recognized presenters and industry experts.
Educational Investment: $725 per participant
Pricing includes:
- Meals and refreshments
- Presentation materials and handouts
- 1-Day Registration to Annual Meeting & Convention
Travel expenses are not included. Participants will be required to work on a group project, which may require additional hours and/or travel outside of your credit union’s normal work hours. Group project may require coordination between credit unions.
Program Agenda
To Register:
To register and pay by credit card, click HERE.
To register and receive an invoice, click HERE.
Earn Your CCUE Designation at the Southeast Management School!
Why Attend?
First-Rate Learning
Enjoy academic teaching that has direct credit union applications. The three-year program, which takes place one week per year in person, will help you develop your operational, managerial and leadership skills.
Collaboration
Engaging activities in class, on campus, and via team projects foster a collaborative atmosphere for you and your classmates. Form life-long bonds while benefiting from shared successes, resources, challenges, and solutions.
Shaping Leaders
Become a Certified Credit Union Executive (CCUE) here, and better the future for yourself, your team, and organization. For more than 50 years, we’ve seen alumni go on to hold leadership positions at their credit unions, in their local chapters, and with community-based organizations.
Start Your Journey!
June 15 – 20, 2025 at the UGA Center for Continuing Education in Athens, GA
Unlock Your Leadership Potential with iLead@11!
Are you ready to accelerate your performance and take your leadership skills to the next level? iLead@11 is a virtual leadership development program designed with YOU in mind. Comprised of three dynamic sections and two tailored tracks, this program is specially curated to support your unique leadership journey.
Take control of your professional growth:
- Discover more about your strengths
- Push beyond your limits
- Achieve results you never imagined possible!
Why iLead@11?
- Always-open registration for maximum flexibility
- Choose dates and times that fit your schedule
- Designed for leaders who want to elevate their game
Exclusive Offer!
Use promo code KCU for Platinum Partner Reward pricing.
Don’t wait—start your leadership transformation today!
Have questions? Contact Janet Garrett or Jenna Dye.
*The iLead@11 Emerging Leaders track differs from our existing Emerging Leaders Program.
2024 HR & Compliance Mini Conference
November 19 & 20 | Virtual Learning Experience
Your compliance compass…
The HR & Compliance Mini Conference is a compact, focused virtual event aimed at guiding credit unions through HR and Regulatory challenges.
Day One: Legal Insights for HR
November 19, 2024
9:30 a.m. – 1:30 p.m.
$99 per person
Join employment law attorneys from Woods Rogers for a half-day session providing expert legal insights on critical HR topics, including compliance, employment law updates, and best practices.
Day Two: Streamlining Fraud Prevention
November 20, 2024
9:30 a.m. – 1:30 p.m.
$99 per person
Attend this half-day session to learn practical strategies for check loss prevention and recovery, fraud prevention through direct payment for large checks, and effective plastic card compliance and fraud loss mitigation.
Meet the Speakers:
Commonwealth Credit Union Launches Food Drive for International Credit Union Day
On Thursday, October 17, Commonwealth Credit Union (CCU) proudly joined credit unions worldwide in celebrating International Credit Union Day, a tradition established in 1948 by the World Council of Credit Unions. This special day honors the meaningful work that credit unions do globally, from fostering financial empowerment to supporting local communities.
To mark the occasion, CCU launched a food drive to benefit families in need within the communities they serve. The drive, which began on October 17 and ran through the end of the month, invited both team members and members to contribute non-perishable food items to donation boxes set up at each CCU branch. Every donation is aimed to make a difference for those facing food insecurity, underscoring CCU’s commitment to giving back.
To further celebrate International Credit Union Day, CCU team members wore their specially provided ICU Day t-shirts on October 17 as a symbol of solidarity with credit unions worldwide. This served as a visible expression of their support for the credit union mission: making a positive impact on the lives of members and communities.
By hosting this food drive, Commonwealth Credit Union joined hands with the broader credit union community, working together toward a shared vision of service and support. Through these contributions, CCU and its members exemplified the true spirit of International Credit Union Day—building stronger communities, one generous act at a time.
CFPB Finalizes Personal Financial Data Rights Rule to Boost Competition, Protect Privacy, and Give Families More Choice in Financial Services
Today, the Consumer Financial Protection Bureau (CFPB) finalized a rule that will give consumers greater rights, privacy, and security over their personal financial data. The rule requires financial institutions, credit card issuers, and other financial providers to unlock an individual’s personal financial data and transfer it to another provider at the consumer’s request for free. Consumers will be able to more easily switch to providers with superior rates and services. By fueling competition and consumer choice, the rule will help lower prices on loans and improve customer service across payments, credit, and banking markets.
“Too many Americans are stuck in financial products with lousy rates and service,” said CFPB Director Rohit Chopra. “Today’s action will give people more power to get better rates and service on bank accounts, credit cards, and more.”
Today’s rule ensures consumers will be able to access and share data associated with bank accounts, credit cards, mobile wallets, payment apps, and other financial products. It aims to address market concentration that limits consumer choice over financial products and services. Consumers will be able to access, or authorize a third party to access, data such as transaction information, account balance information, information needed to initiate payments, upcoming bill information, and basic account verification information. Financial providers must make this information available without charging fees.
The rule moves the United States closer to having a competitive, safe, secure, and reliable “open banking” system. Today’s rule is part of the CFPB’s efforts to finally activate Section 1033 of the Consumer Financial Protection Act, a dormant legal authority enacted by Congress in 2010. This is the CFPB’s first significant rule to accelerate responsible open banking in the U.S., and the CFPB will be developing additional rules to address more products, services, and use cases. The rules will boost competition by giving people more freedom to switch banks or providers and shop around for the best deal. This increased choice will incentivize financial institutions to offer improved products that help them attract new customers and retain old customers.
Today’s rule also establishes strong privacy protections, requiring that personal financial data can only be used for the purposes requested by the consumer. It ensures that third parties cannot use consumer data for other purposes that benefit the third party, but that consumers do not want. It also helps move the industry away from “screen scraping,” a still common but risky practice that typically involves consumers providing their account passwords to third parties who use them to access data indiscriminately through online banking portals.
In giving consumers more control over their financial data, the Personal Financial Data Rights final rule will spur greater choice and increase competition by enabling people to:
- Fire fintechs and banks that provide lousy service: Consumers will be able to transfer their bank data to another bank, ensuring consumers can keep much of their banking history as they switch to another financial institution. People will not have to pay fees or clear hurdles from companies that make it harder to switch providers.
- Shop for better rates on products and credit: Consumers will be able to comparison shop and move to a competitor offering better rates, such as higher interest on deposits or lower interest on loans. It can also help people—including consumers with shorter credit histories, like young people—gain access to credit or obtain credit on better terms, by allowing lenders to make loans using data held by other institutions, such as information on income and expenses.
- Make secure payments, including with “pay-by-bank”: The rule ensures consumers are able to securely share payments information, which can help enable what is sometimes referred to as pay-by-bank. Such products enable consumers to pay merchants, peers, and others, as well as move money between their own accounts. The rule will help bring greater competition to payments markets, which have long been an area of anti-competitive practices.
The final rule strengthens protections for consumers’ data by:
- Banning bait-and-switch data harvesting: Third parties can only collect, use, or retain data to deliver the product the consumer requested. They cannot secretly collect, use, or retain consumers’ data for their own unrelated business reasons – for example, by offering consumers a loan using consumer data that they also use for targeted advertising. The rule does not prohibit any particular uses of data, but it requires that all use be driven by what is necessary to deliver the product sought by the consumer.
- Creating revocation and deletion rights: When a person revokes access, the rule requires that data access end immediately, and deletion would be the default practice. Access can be maintained for no more than one year, absent express reauthorization. To prevent “dark patterns” from emerging, the process to revoke access must be simple and straightforward.
Compliance with the rule will be implemented in phases, with larger providers subject to the rule sooner than smaller ones. Financial firms will be required to comply based on their size; the largest institutions will have to comply by April 1, 2026, while the smallest covered institutions will have until April 1, 2030. Certain small banks and credit unions are not subject to this rule.
In June, the CFPB finalized a rule outlining the qualifications to become a recognized industry standard setting body, which can issue standards that companies can use to help them comply with the CFPB’s Personal Financial Data Rights Rule.
Read the regulatory text of the final Personal Financial Data Rights rule .
Read the notice of the final Personal Financial Data Rights rule.
Consumers can submit complaints about financial products or services by visiting the CFPB’s website or by calling (855) 411-CFPB (2372).
Employees who they believe their company has violated federal consumer financial protection laws are encouraged to send information about what they know to [email protected].
Source: consumerfinance.gov
BACK TO TOP
Board of Director Engagement in Cybersecurity Oversight
To:
Federally Insured Credit Unions
Subject:
Cybersecurity
Status:
Active
Dear Boards of Directors and Chief Executive Officers:
The frequency, speed, and sophistication of cyberattacks have increased at an exponential rate. Foreign adversaries and cyber-fraudsters continue to target all sectors of our nation’s critical infrastructure — including credit unions and other financial institutions. From September 1, 2023, the effective date of the NCUA’s cyber incident notification rule, through August 31, 2024, federally insured credit unions reported 1,072 cyber incidents. Seven out of ten of these cyber incident reports were related to the use or involvement of a third-party vendor.
A recent ransomware attack on a credit union has been attributed to “malvertising(Opens new window),” a relatively new cyberattack technique that injects malicious code within digital ads. For this type of attack to work, the user doesn’t even have to physically click on a link for the system to become infected. Instead, a simple internet search can result in malvertising that exploits the vulnerabilities in an internet browser. Credit union cybersecurity teams should focus on standardizing and securing web browsers and deploying ad blocking software to protect against this threat.
Given the proliferation of sophisticated information security threats and the importance of safeguarding the assets and information of your members, the NCUA urges credit union boards of directors to prioritize cybersecurity as a top oversight and governance responsibility. Credit union board directors like you must ensure that a credit union’s senior leadership is highly focused on managing cyber risks and that your credit union has the necessary resources to maintain an effective cybersecurity program that aligns with the products, services, and risk profile of your institution.
The following are four key areas your board of directors should focus on:
Provide for Recurring Training
Your board should engage in ongoing education about current cybersecurity threats, trends, and best practices. The NCUA provides various resources to assist, including training webinars, web-based learning resources(Opens new window), and written guidance. Your credit union board needs to stay aware of the specific cyber risks that pertain to your credit union’s operations and the implications of these risks. Board members don’t need to be technical experts, but they must know enough about cybersecurity to provide effective oversight and direction for the executive team and subject matter experts.
Furthermore, your board should ensure the credit union’s employees receive regular cybersecurity education to maintain high awareness and preparedness across the organization. This education should emphasize the importance of a security-minded culture and adherence to important information security practices to mitigate the risk of cyber incidents.
Approve Information Security Program
Your board must approve a comprehensive information security program that meets the requirements of Part 748(Opens new window) of the NCUA’s regulations, which includes risk assessments, security controls, and incident response plans. Your credit union board should review the program at least annually to ensure it adapts to the evolving threat landscape and incorporates lessons learned from past incidents.
Oversee Operational Management
Your board is responsible for overseeing management of the credit union, focusing on the following cybersecurity areas:
- Third-Party Due Diligence. Your board should set clear expectations for management about the due diligence of third-party vendors with respect to information security. The credit union must ensure that contracts with third-party vendors include specific cybersecurity requirements, like timely notification to the credit union of any incidents, and clauses that protect credit union and member data.
- Embed Cybersecurity and Operational Resilience into the Organizational Culture. Your board and management should ensure that cybersecurity is a core value within the credit union, influencing decision-making at all levels.
- Resources. Your board must provide management access to cybersecurity expertise and an adequate budget to implement and maintain a cybersecurity posture commensurate with the credit union’s risk profile. Your board should also encourage needed investment in cybersecurity technologies and tools to enhance the credit union’s defenses.
- Vulnerability/Patch Management and Threat Intelligence. Your board must ensure that operational management places high emphasis on diligent vulnerability management, including timely software updates, patch management, and whitelisting and blacklisting URLs, websites, and software to mitigate risks. The credit union should use threat intelligence to stay informed about emerging threats and vulnerabilities that could impact the credit union. Government resources such as the Cybersecurity and Infrastructure Security Agency’s cyber hygiene service for vulnerability management and the U.S. Treasury’s automated threat information feed are free to credit unions.1
- Audit Function. Consistent with the size and risk profile of the credit union, your board should ensure management engages external parties with the requisite expertise to conduct audits of the cybersecurity program, to receive an objective assessment of program effectiveness.
- Reporting. Your board should establish a framework for periodic reporting by management to the board on cybersecurity audits, incidents, and the effectiveness of the cybersecurity program. This reporting should include cybersecurity risk assessments, including the identification of threats, vulnerabilities, and the effectiveness of controls. These reports should describe the overall status of the program. Reports should also outline material matters related to the program, including risk assessments, risk-management and control decisions, service provider arrangements, results of testing, and any recommendations for changes in the cybersecurity program.
- Protecting and Managing Backups. In the face of increasing ransomware threats, credit unions must implement robust backup strategies to safeguard credit union and member data. Your board should ensure management regularly backs up all critical data and that these backups are securely stored. Implementation of access controls will also prevent unauthorized access to backup data.
In addition, the credit union needs clear, documented procedures for restoring data from backups in the event of a ransomware attack or data loss incident. This process should include identifying which data is critical for operations and prioritizing its restoration. Backup systems should be tested regularly to ensure that data can be restored quickly and effectively. Conducting routine drills will help identify any gaps in the backup process and ensure that staff are familiar with restoration procedures.
- Membership Education. Your board should work with management to provide periodic information security education for members to promote sound cybersecurity practices, such as the use of multi-factor authentication and the importance of strong, frequently changed passwords.
Incident Response Planning and Resilience
Your board must, moreover, ensure that resilience plans allow the credit union to operate effectively during and after a cyber-attack. This planning may involve identifying alternative processes or systems that can be utilized during an outage. Consistent with statutory requirements, the NCUA’s regulations require that a federally insured credit union that experiences a reportable cyber incident must report the incident to the NCUA as soon as possible and no later than 72 hours after the credit union reasonably believes that it has experienced such an incident. This statutory requirement underscores the importance of having a well-defined incident response plan that enables prompt reporting and effective communication with regulatory bodies.2
Effective resilience planning includes the following:
- Internal and External Communication. Establish a communication strategy for informing your board immediately following a security incident, ensuring transparency and timely decision-making. The communication strategy should also inform both internal stakeholders and external parties, including your members and regulators, in the event of a cyber incident. Clear communication can help manage expectations and maintain trust.
- Insurance Considerations. Evaluate cybersecurity insurance policies to ensure adequate coverage for potential incidents. This assessment includes understanding the scope of coverage and any exclusions that may apply.
- Incident Response Team. Identify and designate an incident response team that includes key personnel from various departments. This team should be prepared to take immediate action in the event of a cyber incident.
- Tabletop Exercises. Conduct regular tabletop exercises to simulate cyber incident scenarios. These exercises will help your credit union board and management practice response plans, identify areas for improvement, and ensure that all team members understand their roles during an incident.
Conclusion
By focusing on the key areas outlined above, your credit union’s board of directors can significantly improve the credit union’s cybersecurity posture and protect the interests of its members. Cybersecurity is not just an “IT” issue. It must be a critical component of any credit union’s overall governance and risk-management strategy. A cyber incident can have far-reaching consequences, not only affecting your institution’s financial stability but also potentially impacting the entire financial services system while eroding member trust and damaging your credit union’s reputation.
By taking the proactive steps outlined above and prioritizing cybersecurity as a fundamental aspect of governance, your credit union’s board of directors can effectively safeguard the credit union and its members’ assets, maintain member trust, and ensure compliance with regulatory requirements. To that end, we encourage you to consult the many available cybersecurity resources available on the NCUA’s public website not just during cybersecurity month in October but also year round.
Sincerely,
/s/
Todd M. Harper
Chairman
Source: ncua.gov
Are you tuned in?
Have you had a chance to watch Eileen's monthly compliance series, Collaboration Station?
We're now on the 4th episode, so don’t miss out! If you're not receiving the email on the 15th of each month, just reach out to us at [email protected], and we’ll gladly add you to the list. This series is a quick, easy way to stay up-to-date with trending compliance topics, plus hear valuable insights on overcoming challenges and sharing effective solutions. Better communication means better service for all!
Join us for the next episode on 11/15!
|
