Where NCUA regulations require credit unions to retain certain writings, records or information, credit unions may use any format that accurately reflects the information in the record, is accessible to all persons entitled to access by statute, regulation or rule of law, and is capable of being reproduced by transmission, printing, or otherwise. The credit union must maintain the necessary equipment or software to permit an examiner to access the records during the examination process. [72 FR 42273, Aug. 2, 2007]
Sec. Appendix A to Part 749--Record Retention Guidelines
Credit unions often look to NCUA for guidance on the appropriate length of time to retain various types of operational records. NCUA does not regulate in this area, but as an aid to credit unions it is publishing this appendix of suggested guidelines for record retention. NCUA recognizes that credit unions must strike a balance between the competing demands of space, resource allocation and the desire to retain all the records that they may need to conduct their business successfully. Efficiency requires that all records that are no longer useful be discarded, just as both efficiency and safety require that useful records be preserved and kept readily available.
A. What Format Should the Credit Union Use for Retaining Records?
NCUA does not recommend a particular format for record retention. If the credit union stores records on microfilm, microfiche, or in an electronic format, the stored records must be accurate, reproducible and accessible to an NCUA examiner. If records are stored on the credit union premises, they should be immediately accessible upon the examiner's request; if records are stored by a third party or off-site, then they should be made available to the examiner within a reasonable time after the examiner's request. The credit union must maintain the necessary equipment or software to permit an examiner to review and reproduce stored records upon request. The credit union should also ensure that the reproduction is acceptable for submission as evidence in a legal proceeding.
B. Who Is Responsible for Establishing a System for Record Disposal?
The credit union's board of directors may approve a schedule authorizing the disposal of certain records on a continuing basis upon expiration of specified retention periods. A schedule provides a system for disposal of records and eliminates the need for board approval each time the credit union wants to dispose of the same types of records created at different times. C. What Procedures Should a Credit Union Follow When Destroying Records?
The credit union should prepare an index of any records destroyed and retain the index permanently. Destruction of records should ordinarily be carried out by at least two persons whose signatures, attesting to the fact that records were actually destroyed, should be affixed to the listing.
D. What Are the Recommended Minimum Retention Times?
Record destruction may impact the credit union's legal standing to collect on loans or defend itself in court. Since each state can impose its own rules, it is prudent for a credit union to consider consulting with local counsel when setting minimum retention periods. A record pertaining to a member's account that is not considered a vital record may be destroyed once it is verified by the supervisory committee. Individual Share and Loan Ledgers should be retained permanently. Records, for a particular period, should not be destroyed until both a comprehensive annual audit by the supervisory committee and a supervisory examination by the NCUA have been made for that period.
E. What Records Should Be Retained Permanently?
1. Official records of the credit union that should be retained permanently are:
(a) Charter, bylaws, and amendments.
(b) Certificates or licenses to operate under programs of various government agencies, such as a certificate to act as issuing agent for the sale of U.S. savings bonds.
2. Key operational records that should be retained permanently are:
(a) Minutes of meetings of the membership, board of directors, credit committee, and supervisory committee.
(b) One copy of each financial report, NCUA Form 5300 or 5310, or their equivalent, and the Credit Union Profile report, NCUA Form 4501, or its equivalent as submitted to NCUA at the end of each quarter.
(c) One copy of each supervisory committee comprehensive annual audit report and attachments.
(d) Supervisory committee records of account verification.
(e) Applications for membership and joint share account agreements.
(f) Journal and cash record.
(g) General ledger.
(h) Copies of the periodic statements of members, or the individual share and loan ledger. (A complete record of the account should be kept permanently.)
(i) Bank reconcilements.
(j) Listing of records destroyed.
F. What Records Should a Credit Union Designate for Periodic
Destruction?
Any record not described above is appropriate for periodic destruction unless it must be retained to comply with the requirements of consumer protection regulations. Periodic destruction should be scheduled so that the most recent of the following records are available for the annual supervisory committee audit and the NCUA examination. Records that may be periodically destroyed include:
(a) Applications of paid off loans.
(b) Paid notes.
(c) Various consumer disclosure forms, unless retention is required by law.
(d) Cash received vouchers.
(e) Journal vouchers.
(f) Canceled checks.
(g) Bank statements.
(h) Outdated manuals, canceled instructions, and nonpayment correspondence from the NCUA and other governmental agencies. [66 FR 40579, Aug. 3, 2001, as amended at 74 FR 35769, July 21, 2009]
Sec. Appendix B to Part 749--Catastrophic Act Preparedness Guidelines
Credit unions often look to NCUA for guidance on preparing for a catastrophic act. While NCUA has minimal regulation in this area, \1\ as an aid to credit unions it is publishing this appendix of suggested guidelines. It is recommended that all credit unions develop a program to prepare for a catastrophic act. The program should be developed with oversight and approval of the board of directors. It is recommended the program address the following five elements:---------------------------------------------------------------------------
\1\ See 12 CFR 748.1(b) concerning a FICU's reporting of any catastrophic act that occurs at its office to its regional director and 12 CFR 749.3 concerning the location of a FICU's vital records center to avoid the simultaneous loss of both sets of records in the event of disaster.---------------------------------------------------------------------------
(1) A business impact analysis to evaluate potential threats;
(2) A risk assessment to determine critical systems and necessary resources;
(3) A written plan addressing:
i. Persons with authority to enact the plan;
ii. Preservation and ability to restore vital records;
iii. A method for restoring vital member services through identification of alternate operating location(s) or mediums to provide services, such as telephone centers, shared service centers, agreements with other credit unions, or other appropriate methods;
iv. Communication methods for employees and members;
v. Notification of regulators as addressed in 12 CFR 748.1(b);
vi. Training and documentation of training to ensure all employees and volunteer officials are aware of procedures to follow in the event of destruction of vital records or loss of vital member services; and
vii. Testing procedures, including a means for documenting the testing results.
(4) Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant, for example, to address changes in the credit union's operations; and
(5) Annual testing. [72 FR 42274, Aug. 2, 2007, as amended at 77 FR 71085, Nov. 29, 2012]