NAMU CCUP cheat sheet

Credit unions are not-for-profit, member-owned cooperatives: members are both owners and customers, and each member typically has one vote regardless of share balance.

The seven cooperative principles include voluntary and open membership, democratic member control, member economic participation, autonomy and independence, education/training/information, cooperation among cooperatives, and concern for community.

Net worth ratio = total net worth ÷ total assets; the standard PCA well-capitalized threshold for credit unions is 7% net worth ratio.

A credit union's board of directors is elected by the membership; the board hires and oversees the CEO/manager, who runs daily operations.

The supervisory committee is elected by members (or appointed as permitted) and is responsible for internal audit oversight and member account verification, independent of the board.

The credit committee or a designated loan officer reviews loan applications; larger loans commonly require committee approval under written lending policy.

Field of membership defines who may join; common types are single common bond (occupational/associational), multiple common bond, and community charter.

NCUSIF insures member share accounts up to $250,000 per member per insured credit union, with separate coverage for certain retirement accounts.

Annual regulatory reporting (5300 call report) covers financial condition, and the board must establish written policies for lending, collections, and funds management.

The service-to-sales path: greet, identify need, recommend, explain features and benefits, overcome objections, and confirm satisfaction - each step should be documented where policy requires.

Cross-selling is appropriate only when the product meets a documented member need; suitability and fair treatment outrank sales volume.

Member complaints must be logged and resolved per policy; unresolved complaints may escalate to the regulator, so accurate records and timely responses are required.

Account ownership structures (single-party, joint with right of survivorship, POD/Totten trust, fiduciary) determine access and survivorship and must be confirmed at account opening.

Know Your Member requirements mean collecting and verifying identity, understanding expected account activity, and updating information when it changes.

Service recovery: acknowledge the error, take ownership, resolve within authority, and escalate promptly; never promise an outcome you cannot authorize.

Member education on fraud, budgeting, and credit is a cooperative principle obligation, not merely a marketing activity.

Privacy rules limit sharing nonpublic personal information; members must receive privacy notices and opt-out rights where applicable.

Regulation CC funds availability: next-day availability applies to cash, wire transfers, and certain official checks; local checks generally within two business days; new-account holds may extend to nine business days.

The first $225 (as adjusted) of a day's deposits must generally be available next business day; larger holds require specific exception notices.

Regulation D historically limited certain transfers from savings/MMDA accounts to six per month; the transfer limit is now commonly removed but policies vary, so follow the credit union's written policy.

Regulation E error resolution: provisional credit generally within 10 business days for most disputes (20 for new accounts), and final resolution within 45 days of the claim.

Check 21/remote deposit: substitute checks have the same legal standing as originals; members must be told of funds availability and image-retention practices.

Dormancy and escheat: inactive accounts are subject to state unclaimed property laws; required notices must be sent before remitting funds to the state.

Stop-payment orders on checks must be honored when received in time; the order should be confirmed in writing and documented with date and time.

Large currency transactions over $10,000 in cash require a Currency Transaction Report (CTR) filed within 15 calendar days.

Truth in Savings (Regulation DD) requires disclosure of APY, dividend rate, minimum balance, and fee terms before an account is opened.

Five Cs of credit: character, capacity, capital, collateral, and conditions; capacity (ability to repay) is generally the strongest predictor of repayment.

Debt-to-income ratio = total monthly debt obligations ÷ gross monthly income; many credit unions cap total DTI near 36–43% depending on program.

Loan-to-value (LTV) = loan amount ÷ appraised value or purchase price, whichever is lower; higher LTV typically requires PMI or a higher rate.

APR under Regulation Z (Truth in Lending) reflects the cost of credit as a yearly rate including finance charges; the note rate alone does not.

Regulation Z requires the Loan Estimate within three business days of application and the Closing Disclosure at least three business days before consummation for covered mortgages.

Equal Credit Opportunity Act prohibits discrimination based on race, color, religion, national origin, sex, marital status, age, receipt of public assistance, or good-faith exercise of rights.

Adverse action notices must state the action taken, the reasons, and the applicant's rights; they are generally required within 30 days of a completed application.

Flood insurance is required for improved structures in special flood hazard areas when the loan is secured by the property.

HMDA requires reporting of covered mortgage applications and originations, including applicant demographics and loan pricing data.

Bank Secrecy Act/Anti-Money Laundering requires a written program with four pillars: internal controls, designated compliance officer, ongoing training, and independent testing.

Suspicious Activity Reports (SARs) must be filed within 30 calendar days of initial detection (extendable to 60 if no suspect identified) and are confidential - never disclose to the member.

Customer Identification Program: collect name, date of birth, address, and identification number, verify identity, and retain records for five years after account closure.

Regulation P (privacy) requires an initial privacy notice, annual notices, and opt-out rights for sharing with nonaffiliated third parties.

Regulation B/ECOA record retention: 12 months for consumer loans and 25 months for business loans after adverse action or application.

Fair lending laws (ECOA, FHA) prohibit disparate treatment and disparate impact; loan files must show consistent, documented underwriting reasons.

The S.A.F.E. Act requires mortgage loan originators to be registered in NMLS and to include their unique identifier on loan documents.

Regulation Z ability-to-repay and qualified mortgage rules require verification of income, assets, and debts for covered residential mortgages.

Gramm-Leach-Bliley Act and its implementing rules govern information security safeguards; the FTC Safeguards Rule and NCUA Part 748 require a written information security program.

Fraud red flags: unusual account activity, mismatched signatures, frequent address changes, structured cash deposits just under $10,000, and reluctance to provide identification.

Elder financial exploitation indicators include sudden large withdrawals, unfamiliar joint account holders, confusion about transactions, and caregiver control of finances; report per policy and applicable law.

Phishing, smishing, and vishing use spoofed communications to obtain credentials; staff should verify identity through out-of-band channels before acting on instructions.

Card fraud controls include EMV chip authentication, tokenization, real-time transaction monitoring, and velocity limits on card-not-present transactions.

Business continuity planning requires a business impact analysis, recovery time objectives, alternate sites, and periodic testing of the plan.

Risk assessment uses likelihood × impact to prioritize controls; residual risk is the risk remaining after controls are applied.

Segregation of duties and dual control over cash, vault access, and wire transfers reduce internal fraud risk.

Incident response includes identification, containment, eradication, recovery, and lessons learned; suspicious activity may trigger SAR filing and member notification.

Check fraud defenses include positive pay, signature verification, and review of check stock and endorsement irregularities.

Fiduciary duty: act in the member's best interest, avoid conflicts of interest, and disclose any conflict promptly to a supervisor.

Confidentiality: member information may be accessed only for a legitimate business purpose and shared only under permitted exceptions.

Accepting gifts or gratuities beyond the credit union's written limit creates a conflict of interest and must be reported.

Insider trading and misuse of nonpublic information about the credit union or its members is prohibited and may be illegal.

Truthfulness in records: falsifying documents, backdating forms, or altering signatures is grounds for immediate discipline and possible criminal referral.

Fair treatment: apply consistent standards to all members and avoid steering members toward products that benefit the employee.

Whistleblower protections and the duty to report suspected fraud or misconduct through designated channels.

Professional competence: complete required training (BSA/AML, security, fair lending) and follow written procedures rather than informal shortcuts.