SS2/23 – Supervising credit unions

1.1

This supervisory statement (SS) sets out the Prudential Regulation Authority’s (PRA) expectations of credit unions. It applies to all UK credit unions as defined in the Credit Unions Part of the PRA Rulebook.

1.2

This SS seeks to advance the PRA’s statutory objective of promoting the safety and soundness of the firms it regulates by setting out the PRA’s expectations of how credit unions should comply with core elements of the regulatory framework contained in the Credit Unions Part of the PRA Rulebook.

2.1

A credit union will be expected to maintain the relevant minimum capital requirement specified by Rule 8.5 of the Credit Unions Part of the PRA Rulebook at all times. The PRA also expects credit unions to consider whether additional capital should be held above the minimum in order to meet the requirement in Rule 8.1 of the Credit Unions Part of the PRA Rulebook. For example, credit unions that are growing rapidly, providing mortgages, or corporate loans should consider holding additional capital in light of the additional risks to which they are exposed. A credit union providing credit cards would be expected to consider what additional capital is required in order to cover potential claims arising from Section 75 of the Consumer Credit Act 1974.

2.2

Credit unions should expect that the PRA may impose an additional capital add-on (ie via the PRA’s own initiative powers, as provided by section 55M the Financial Services and Markets Act 2000 (’FSMA’) ‘own initiative requirements’ or ‘OIREQ’), where there are specific risks present in a credit union (examples might include credit unions with high risk business models, high arrears, or governance concerns) and where a credit union has not taken up the PRA’s invitation to apply for a ‘voluntary requirement’ (VREQ) as provided by section 55M of FSMA.

2.3

A credit union is expected to notify the PRA immediately should it become aware that it is likely to fall below its relevant minimum capital requirement. It must comply with the immediate notification requirement in Rule 8.6 of the Credit Unions Part of the PRA Rulebook if its capital falls below the relevant minimum. 

2.4

Where a credit union’s capital ratio is below 5%, the PRA expects it to engage more fully with the PRA. In particular, the PRA will expect a credit union to engage on its ongoing sustainability and the PRA will challenge it to demonstrate its ability and capacity to produce, work to, and monitor a viable business plan. As part of that discussion, the PRA will expect it to engage on whether it has a viable future and if not, what plans it has to close in an orderly fashion, which could be by way of insolvent wind-up, solvent wind-down, or the transfer of its engagements to another credit union. 

2.5

Capital acts as a cushion to absorb unexpected losses, for example if members fail to repay their loans, or losses arise from fraud or operational incidents. Broadly speaking, for most credit unions, capital predominantly comprises of retained earnings (reserves). This capital is considered high quality capital (ie highly loss-absorbing) as it does not have any features that make it less able to absorb losses, such as a principal that needs to be repaid or a requirement to pay non-discretionary distributions.

2.6

Credit unions have limited access to a wider range of capital instruments; their capital may also comprise of deferred shares, subordinated debt, and revaluation reserves (see Rule 8.2 of the Credit Unions Part of the PRA Rulebook).

2.7

External capital investment (in the form of subordinated debt or deferred shares) can be important in supporting a credit union’s growth, particularly in the early years when a credit union is first established, to help it recover from financial shocks in the short term and to support growth plans or the expansion of services in a sustainable manner.

2.8

Subordinated debt is considered lower quality capital given the principal needs to be repaid (which carries refinancing risk) and coupons (the annual interest payments) are paid to service the debt rather than being returned to members as dividends.

2.9

Deferred shares, while they do not carry refinancing risk, usually carry a perpetual coupon although in some cases this can be discretionary and non-cumulative.

2.10

However, the PRA holds concerns that the use of material amounts of subordinated debt and interest-bearing deferred shares could have the potential to threaten the sustainability of a credit union if not used appropriately and prudently. Credit unions utilising such instruments must be able to demonstrate they are acting in the best interests of members, particularly if the capital arrangements mean that operating profit is in a large part used to service the capital coupons rather than serving as returns to members. Credit unions should carefully plan their approach to such instruments with a view to operational sustainability and viability. 

2.11

The PRA expects credit unions utilising such instruments to manage the associated risks: for example, the refinancing risk of subordinated debt and the perpetual nature of a coupon attached to deferred shares. For the avoidance of doubt, a credit union should not raise external capital in order to service capital coupons.

2.12

There is also concern regarding potential conflicts of interest arising from externally-influenced business models. Capital sourced from third parties should not have conditions attached that give preferential treatment to the third party. Credit unions should ensure that any potential conflicts of interest arising from the provision of capital are managed adequately.

2.13

For credit unions with total assets over £50 million, the PRA expects them to not hold more than 50% of their minimum capital requirement as subordinated debt; and that no more than 75% of the minimum capital requirement be comprised of subordinated debt and interest-bearing deferred shares. There may be circumstances where these limits may be exceeded. In such instances, the PRA would expect the credit union to provide sufficient details to satisfy supervisors of the credit union’s arrangements for managing the associated risks before proceeding with their plans to raise external capital above these limits.

2.14

Factors the PRA will take into account when reviewing such plans are:

1. (i) whether the capital arrangements provide investors with external influence over the credit union;
2. (ii) evidence that the interest rate and liquidity risks are being managed adequately;
3. (iii) the reasonableness and credibility of the credit union’s plans for growth (including how it would service the capital investment through distributable profits as opposed to raising further capital to pay coupons);
4. (iv)whether the credit union is contractually able to defer coupon payments and/or whether such payments are cumulative;
5. (v) whether the investment (for example, the rate of interest offered) represents a reasonable and justified risk-reward proposition; and
6. (vi) whether the credit union has provided a robust and credible plan for reducing reliance on external capital investment.

2.15

The capital instruments should not have any features that hinder recapitalisation such as provisions that require the issuer to compensate investors if a new instrument is issued at a lower price during a specified timeframe.

3.1

Rule 10.5 of the Credit Unions Part of the PRA Rulebook requires that credit unions must establish, implement, and maintain an up-to-date liquidity management policy statement approved by the governing body. Rule 9.4 of the Credit Unions Part of the PRA Rulebook requires that the amount and composition of liquid assets held by a credit union must be prudent and appropriate to the nature, scale, and complexity of its business, having regard to material risks, including the risk of a sudden adverse cash flow.

3.2

The PRA therefore expects a credit union’s strategy for liquidity management, which should be set out in the liquidity management policy statement, to take account of the nature, scale, and complexity of the credit union. As part of this, it is expected that consideration should be given to the credit union’s strategic plan, risk profile, and the current economic environment. The liquidity management policy statement is also expected to cover:

• the roles and responsibilities of officers involved in liquidity management;
• the quantity and quality of liquid assets to be maintained by the credit union over time, taking into account the minimum liquidity requirements in Rule 9.2 of the Credit Unions Part of the PRA Rulebook; and
• procedures for complying with regulatory requirements, including monitoring and reporting against internal targets and regulatory ratios to the board.

4.1

A credit union that is undertaking ‘additional activities’¹ (see Table 1) or that has more than 15,000 members, and is therefore subject to the requirement in Rule 10.3(3) of the Credit Unions Part of the PRA Rulebook, is expected to monitor its relevant business by using the ratios in paragraph 4.3 below, calibrated with values that are specifically aligned to its individual business model. Credit unions should have measures that help them define their tolerance for triggers and ratios that underpin their resilience. The ratios in table 1 below are indicative; the PRA expects boards to assess what is most important and reflects the risks in their organisation. The PRA expects the values selected by the credit union to provide an accurate and reliable business tool, by which its board may routinely and accurately monitor the credit union’s performance against its strategic plan and its regulatory obligations. The PRA also expects the credit union to be able to provide details of its chosen ratios, and evidence of the rationale underlying them, on request.

4.2

The PRA expects such a credit union to review performance against its target ratios at least monthly, and to satisfy itself that performance is consistent with maintaining a business that is viable over a 12-month period and sustainable over a 36-month period. 

4.3

By way of example only, the PRA considers that prudent practice suggests that the indicative ratio percentages for credit unions that undertake additional activities or have more than 15,000 members for all calculations save loans to assets are those outlined in Table 1.

Table 1: Indicative ratios for credit unions that undertake additional activities or have more than 15,000 members

Ratio	Additional Investments	Additional lending	Mortgages	Transactional accounts	Indicative ratio
Credit union’s borrowings as percentage of total asset	Y	Y	Y	Y	≤5%
Total shares as percentage of total assets	Y	Y	Y	Y	≥70% and ≤90%
Total bad debt written off as percentage of total loans		Y	Y	Y	≤10%
Net assets as percentage of sum of total shares and juvenile deposits		Y	Y	Y	≥105%
Bad debt (more than three months in arrears) as percentage of total loans	Y	Y	Y	Y	≤20%
Non-earning assets as percentage of total assets	Y	Y	Y	Y	≤10%
Net zero cost funds as percentage of non-earning assets	Y	Y	Y	Y	≥200%
Loan income over 12 months as percentage of total loans		Y	Y	Y	≥6%
Net loans as percentage of total assets			Y	Y	Deliberately left blank

4.4

Table 2 sets out the PRA’s definitions of the terms set out in Table 1 for the purposes of the ratio calculations.

Table 2: Definitions for ratio calculations

Term	Definition
Total assets	The total assets of a credit union that appear on its balance sheet.
Borrowings	The total closing balances of all loans received by a credit union (excluding any subordinated loans), authorised overdrafts, and committed lines of credit.
Total shares	The total closing balances of all loans received by a credit union (excluding any subordinated loans), authorised overdrafts, and committed lines of credit.
Net loans	The total amount outstanding at the relevant date on all loans to members (irrespective of when such loans were made) less provision for bad and doubtful debt.
Net liquid assets	Assets which can be realised for cash at short notice, and within at most eight days, less any liabilities payable within 30 days.
Bad debt	Total amount of loans to members where the loan is more than three months in arrears.
Total loans	The total amount outstanding at the relevant date on all loans to members (irrespective of when such loans were made). This includes any loans written off during the period.
Net assets	Total assets less liabilities (excluding members’ shares and juvenile deposits).
Juvenile deposits	The total amount due to juvenile depositors.
Non-earning asset	The total amount of cash, current account balances (excluding any balances earning interest), pre-paid expenses, and fixed assets.
Net zero cost funds	The total sum of a credit union’s capital and liabilities excluding any liabilities that are subject to interest payable by or charges to the credit union. In practical terms, this is likely to only constitute a credit union’s reserves. (In general, shares are excluded as most credit unions pay a dividend on shares if they make a profit and any interest-bearing shares or juvenile deposits should be excluded).
Loan income	The total amount of interest received on loans made to members during the 12-month period preceding the relevant date.

4.5

Where a credit union is experiencing significant growth of members, the PRA expects the credit union to consider the risks associated with increased membership and, where appropriate, take steps to address those risks. This should include consideration of operational risks such as those in Chapter 10 (for example, whether systems are capable of managing additional capacity, whether the credit union has sufficient staff to cope with the increasing demand), and whether any changes need to be made to update their processes and procedures.

5.1

When a credit union gives notice in accordance with Rule 2.3 of the Credit Unions Part of the PRA Rulebook, it will be expected to inform the PRA of its current loans to assets, capital, and liquidity ratios. It will also be expected to provide the PRA with details of the proposed use of the funds to be deposited and to confirm that its single customer view file is complete and up-to-date. The credit union is expected to satisfy the PRA that its acceptance of such a deposit would be prudent.

5.2

The PRA expects that any credit union that intends to issue fixed-rate shares or deposits complies with the statutory mandatory requirements that must be satisfied before beginning such activity.²

5.3

Credit unions that wish to offer shares in an Individual Savings Account (ISA) tax-free wrapper are expected to refer to the relevant regulations issued by HM Revenue and Customs (HMRC). Credit unions should be aware that approval from HMRC does not provide any degree of exemption from compliance with the statutory requirements referred to above in paragraph 5.2.

6.1

The PRA expects all credit unions to pay close attention to the quality of their underwriting of loans, whether unsecured or otherwise. Credit unions are expected to apply a consistent lending policy in making all credit decisions, and to retain records of such decisions for at least the life of the loan in question.

6.2

Where a credit union proposes to undertake fixed-rate lending (including mortgage lending), the PRA expects the credit union to be able to demonstrate, on request, that it has a thorough understanding of any risks that this activity may create, particularly interest rate and basis risk. In some circumstances (for example where a credit union has a material fixed-rate lending book), the PRA may engage with the credit union as to whether any fixed-rate lending for periods of more than two years should be reported using form FSA017.³ Where a credit union’s fixed-rate lending exposes it to specific material prudential risk it will be expected to make sufficient additional capital provision to mitigate such risk.

7.1

The PRA expects that the assessment required by Rule 6.5 of the Credit Unions Part of the PRA Rulebook will be proportionate to the complexity, or otherwise, of the proposed investment. As part of the assessment, the PRA expects a credit union to consider counterparty risk.

7.2

Additional expectations relating to investments for credit unions with more than £10 million in assets and credit unions that invest in more complex investments (supranational bonds, corporate bonds, bank bonds, and money market funds) are set out in Chapters 11 and 14, respectively. Credit unions undertaking additional activities⁴ are also expected to maintain a board-approved investment policy (see paragraph 14.2 in Chapter 14).

8.1

The PRA considers that good governance is fundamental to the safety and soundness of all financial institutions. Accordingly, all directors are expected to fully understand their individual and corporate responsibilities and, in the context of the size and complexity of each individual business, to have the technical competence necessary for them to set, and to oversee, the strategy of their credit union. All directors will be expected to understand the risks inherent in their credit union’s business model and to exercise appropriate oversight of the management of those risks. The PRA recognises that in applying these principles credit unions will take an approach that is proportionate to their size, complexity, and resources.

8.2

The following are indicators of good practice (the PRA considers that some credit unions will be limited in their ability to implement these practices, due to their size and resources, but the PRA would generally expect credit unions with more than £10 million in total assets to meet all or most of the below):

• there is a clear separation between the role and responsibilities of the General Manager/ Chief Executive Officer (CEO)/Senior Management Team (largely operational (although the General Manager/ CEO also plays a key role in developing strategy) keeping the board informed, and bringing recommendations to the board) and that of the board (largely strategic, approving key policies, making key decisions, overseeing performance, and appraising the CEO);
• the board demonstrates a clear understanding and ownership of strategy and associated risks, focusing on this as a key agenda item at board meetings (rather than getting involved in operational detail);
• the board has an appropriate range of skills and experience relevant to the activities carried on by the credit union;
• the credit union carries out an analysis of skills gaps, and prioritises identified gaps when recruiting replacements and buys in external expertise as necessary;
• the board is provided with management information which clearly indicates the credit union’s financial position and whether key financial measures are being met with reference to the board’s risk appetite;
• the CEO/General Manager has formal objectives which they are assessed against, via a formal appraisal process, led by the Chair (this is separate to ongoing obligations under the Senior Managers and Certification regime and should not cause the credit union to duplicate any assessments they are already doing);
• a formal assessment of the board, both individually and collectively, is carried out annually, led by the Chair;
• a formal assessment of the Chair is carried out annually (for example, by another board member such as the Vice-Chair); and
• the board maintains a succession plan that addresses the unexpected loss of key individuals.

8.3

All directors, without exception, are expected to ensure that their credit union fully complies with the requirements of the Financial Services Compensation Scheme (FSCS), and that their credit union’s provisioning policy and practices are prudent and effective. The PRA expects that directors of all credit unions, irrespective of size and complexity, will ensure that the credit union complies with the Fundamental Rules within the PRA Rulebook, by maintaining its single customer view file accurately and in a form agreed by the FSCS at all times.⁵ The PRA expects that directors of all credit unions will ensure that the credit union complies with rules relating to the maintenance of an accurate Single Customer View and Exclusions View as set out in the Depositor Protection Part of the PRA Rulebook. This includes ensuring that credit union software is updated as necessary.

8.4

The PRA expects that directors understand that all outsourcing arrangements are commercial, business decisions, and that sole responsibility for ensuring operational continuity and data security, among other things, rests with the individual credit union.

8.5

The PRA expects that all directors regularly satisfy themselves that their credit union accurately complies with the provisioning requirements in Rules 3.11 and 3.12 of the Credit Unions Part of the PRA Rulebook.

8.6

For a broader overview and more detailed good governance examples, credit unions may wish to review the UK Corporate Governance Code.⁶

8.7

Credit unions must maintain an up-to-date business plan approved by the board (Rule 11.7 of the Credit Unions Part of the PRA Rulebook). The plan should be fit-for-purpose, and the detail provided commensurate with the size and complexity of the credit union. The PRA expects that the business plan should include (at a minimum):

• clear and measurable objectives for the next three years, which include realistic targets for the year in question (eg in respect of loans, savings, and arrears) to 
  measure performance against;
  • plausible financial forecasts (income and balance sheet) extending to at least two years beyond the current financial year. It is best practice for this to include reasoned and explicitly stated underlying assumptions (eg Bank of England Base Rate) and a coherent strategy for achieving the objectives; and
  • a robust plan for delivering the strategy which contains, among other things, an assessment of the current and emerging risks attached to the credit union’s business and operations and the impact of actual and anticipated external developments.

8.8

The business plan should be regularly updated and reviewed. Progress against business plan targets should be discussed regularly by the board, variances analysed and, where appropriate, pre-emptive or corrective action taken to deliver the business objectives.

8.9

Credit unions are expected to inform their PRA supervisors ahead of undertaking any significant diversification of, or change to, their business model. The PRA expects a credit union to engage with it on the risks and benefits of the proposed diversification, financial projections before and after the diversification, and stress tests of those projections, based on severe, but plausible, scenarios. Examples of what the PRA would consider to be significant changes to a business model include providing new loan products such as corporate loans or issuing interest-bearing shares to raise deposit funding. Examples of what the PRA would not consider to a significant change to a business model include different branding for small unsecured personal loans.

9.1

Credit unions should have proportionate risk management systems, adequate for the needs of their business. Where there is evidence of poor risk management and/or governance at a credit union, the credit union should expect the PRA to engage with it on its mitigation plans. Where the credit union fails to engage or make meaningful progress, it should expect the PRA to engage more fully on whether it has a viable future and, if not, what plans it has to close in an orderly fashion. This could be by way of insolvent wind-up, solvent wind-down, or the transfer of its engagements to another credit union.

9.2

Credit unions are required to establish and maintain an internal audit function under Rule 15.1 of the Credit Unions Part of the PRA Rulebook. The PRA expects the internal audit function⁷ of a credit union to act as a forward-looking tool of risk management and control (taking into account the nature, size, and scope of the credit union’s activities). The PRA expects the internal audit function to be independent from management, report to the board, and be capable of providing robust advice to the board, in particular where material business and regulatory risks are being run. The PRA considers indicators of good practice include:

• internal audit function checks go beyond basic operational checks; for example, the internal audit function carries out checks to assess the soundness of the credit union’s governance checks (examples include but are not limited to, observations of board meetings to determine whether there is comprehensive strategy-setting process, whether the board considers all matters of material relevance and documents the reasons for its decisions, checks of the board minutes to ensure actions are carried out);
• the internal audit function provides sufficient challenge to the board; and
• the internal audit function is sufficiently independent from the board. The PRA expects that where the credit union outsources its internal audit function, it does not engage its external auditor for that purpose unless in exceptional circumstances and, if it does so, only for the minimum practicable period.

9.3

The PRA expects credit unions with total assets of more than £10 million should be able to meet all of the above expectations. Boards of smaller credit unions may use other means to satisfy themselves that their internal audit function is operating adequately.

10.1

Rule 17.1 of the Credit Unions Part of the PRA Rulebook requires a credit union to put in place contingency arrangements to ensure it could continue to operate and comply with its regulatory obligations in the event of an unforeseen interruption, such as a complete failure of information technology systems or destruction of premises by fire, which would otherwise prevent the normal operation of the credit union. Operational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, people, and systems or from an external event. Examples include the risk of losses arising from the following:

• internal/external fraud – this may arise from lack of adequate security of information systems as well as credit union officers, assets, and systems (including cyberattacks);
• damage to physical assets;
• business disruptions and information system failures – this includes hardware and software failures, telecommunication problems, and utility outages;
• execution, delivery, and process management failures –this includes transaction and execution errors arising from human error, lack of resources, skills, training, policies, procedures, or poor management;
• failure of an outsourcing or a third party service provider;
• legal risk –this includes failure to meet legal, contractual, and other obligations (including exposure to fines, penalties, or damages); and
• member, product, and business practices – this includes unintentional or negligent failure to meet obligations to specific members (including fiduciary and suitability requirements), or from the nature or design of a product.

10.2

The PRA’s expectations for operational risk management should apply proportionately according to the scale and nature of the credit union. The PRA expects all credit unions to consider the operational risks they are exposed to, and to have mitigating policies and procedures in place to manage them appropriately. As part of this, credit unions may consider, as evidence of good practice, the Basel Committee on Banking Supervision document on Principles for the Sound Management of Operational Risk.⁸ 

10.3

The PRA expects governance and oversight arrangements for operational resilience to be in place. All credit unions must test the business continuity arrangements regularly (under Rule 17.1 and Rule 17.2 of the Credit Unions Part of the PRA Rulebook). The PRA expects business continuity arrangements to be reviewed at least annually. 

10.4

The PRA expects to be notified, in advance of material operational changes and/or a credit union entering into any material outsourcing agreements. Credit unions are expected to ensure they have appropriate governance, risk management, and mitigation in place in advance of the material operational change or material outsourcing including, where relevant, communications to affected members. Plans for exiting from the material operational change or material outsourcing agreement and contingency plans should also be included. This could be a simple plan, depending on the complexities involved and materiality of the services impacted, and should not require material additional costs and resources to develop. The PRA considers failed or poorly implemented operational changes have the potential to cause significant disruption to credit unions, including interruption to critical services, often with an immediate impact on members relying on these services.

10.5

Examples of material operational changes that the PRA would expect to be notified of include the replacing of core banking systems, material change of or new relationship with third party critical service suppliers (including Cloud suppliers and payment systems providers), digital transformation programmes, and data centre migrations. Where a credit union is unclear on their notification expectations, it should discuss this with the PRA.

11.1

The PRA expects credit unions with more than £10 million in total assets, and any credit unions that hold investments that come under Rules 6.4(7) and 6.4(8) of the Credit Unions Part of the PRA Rulebook, to adhere to the following concentration limits (in addition to the limits required by Rule 6.4A of the Credit Unions Part of the PRA Rulebook,⁹ and with the exception of the investments listed in paragraph 11.2):

• no more than 20% of a credit union’s total investments¹⁰ to be held with a single counterparty; and
• an amount equivalent to no more than 75% of credit union’s total capital to be held with any single counterparty.

11.2

The PRA considers that the above concentration limits set out in paragraph 11.1 would not apply to the following investments:

• sterling-denominated securities issued by the UK government, or a fixed-interest sterling-denominated security guaranteed by the UK government with a maturity of up to five years from the date on which the investment is made (under Rules 6.3.3, 6.3.4, 6.4.3, and 6.4.4 of the Credit Unions Part of the PRA Rulebook);
• deposits placed with a credit institution which is authorised in the UK to accept deposits on terms that the deposit shall be repayable within at most 12 months from the date on which the investment is made (under Rule 6.3 (1) of the Credit Unions Part) and rated A-AAA by at least two credit rating agencies registered with the FCA; and
• UK bank bonds which have a maturity of up to five years from the date on which the investment is made (under Rule 6.4 (6) of the Credit Unions Part) rated A-AAA by at least two credit rating agencies registered with the FCA.¹¹

11.3

When the credit rating of an investment (or a relevant credit institution that holds the investment) that falls under the categories in paragraph 11.2 changes so that it no longer meets the required credit rating, a credit union would be expected to move funds as appropriate to ensure that they meet the limits set out in paragraph 11.1. The PRA does not expect a credit union to break a term deposit to meet the limits set out in paragraph 11.1.

11.4

Where a credit union’s existing investments exceed the concentration limits in paragraph 11.1, the PRA would not expect a credit union to break existing investment contracts to bring them into line with the expected limits. Rather, when investments mature the PRA expects credit unions to ensure that new investments made are compliant with the limits in paragraph 11.1.

11.5

It is best practice to spread funds out where practicable and before making investment decisions, credit unions should remain mindful of the importance of not creating excessive time band or counterparty concentrations in line with credit unions rule 6.5(4).

11.6

Credit unions investing their surplus funds are required to consider and document their decisions and account for counterparty, concentration, liquidity, and interest rate risk under Rules 6.5 and 6.6 of the Credit Unions Part of the PRA Rulebook. When making investment decisions, the PRA expects credit unions to carefully consider the risk return trade-off and to ensure investment decisions reflect the credit union’s risk appetite. Credit unions should consider setting exposure limits for different counterparties based on their risk profile, as part of their risk appetite statement. 

11.7

Credit unions should be mindful of the need to meet liquidity expectations, in particular the additional liquidity expectations where credit unions invest in more complex investments (see Chapter 14). In order to help credit unions manage their liquidity in the face of unexpected outflows, and in line with Rule 6.5 of the Credit Unions Part of the PRA Rulebook, the PRA expects credit unions to ensure that an adequate proportion of its investments are able to be broken before the end of the term is reached (even if a fine is incurred).

11.8

The PRA considers that the limits in paragraph 11.1 would not apply to funds held temporarily in an account before an investment decision is made. 

11.9

For credit unions with more than £10 million in assets, the PRA also expects the liquidity management policy statement to cover:

• the credit union’s strategy, processes, and systems in place for liquidity risk management;
• the liquidity risk appetite agreed by the board;
• any liquidity buffers to be maintained as a safeguard on the basis of stressed conditions that may arise;
• plans to address any liquidity or funding risks arising from mismatches in maturity (which can give rise to cash flow imbalances and a risk that there could be insufficient cash resources to meet payment outflows when they fall due); and
• contingency plans with actions that will be taken if liquidity targets are not met.

11.10

Rule 11.1(2) of the Credit Unions Part of the PRA Rulebook requires credit unions to establish, implement, and maintain effective processes to identify, manage, monitor, and report the risks it is, or might be, exposed to. Rule 11.2 requires that these processes are comprehensive and proportionate to the nature, scale, and complexity of the risks inherent in its business model and activities. In line with these requirements, the PRA expects all credit unions with more than £10 million in assets to maintain a risk appetite statement (RAS). This should:

• include clear, objective and, where appropriate, quantitative measures which the whole board has approved;
• be explicitly connected to the business objectives, and accurately reflect the credit union’s specific risk appetite (including articulation of the threshold at which it would consider taking management actions against each risk); and
• be used proactively by the board to inform the strategy and business plan, and ensure the board’s decisions are compliant and consistent with, aligned to and not in excess of, the board’s risk appetite.

11.11

In addition to the expectations set out in Chapter 10, the PRA expects credit unions with more than £10 million in assets to consider and document the core systems and outsourcing arrangements that are critical to the operation of the business.

12.1

In order to ensure a credit union is holding sufficient liquid funds under Credit Unions 9.4, the PRA expects credit unions with more than £50 million in total assets to carry out periodic (at least annual) liquidity stress testing whereby the impact of stressed outflows is considered.

12.2

The liquidity stress testing expectation referred to in paragraph 12.1 could be met by the credit union’s own analysis, which is based on a clearly articulated RAS (see paragraph 10.1) defining the duration and type of stress or stresses that the credit union aims to survive. The PRA expects the stress tests to consider the impact of a range of severe, but plausible scenarios (including combined scenarios). Credit unions should expect the PRA to engage with them on the method used and assumptions made, eg their assessment of the likely run-off of different elements of the retail book.  

12.3

For illustrative purposes, liquidity stress testing referred to in paragraph 12.1 could be met by calculating (total cash + assets that can be realised for cash within eight business days)/total net cash outflows over 30 calendar days, where:

• Total net cash outflows = total expected cash outflows – total expected cash inflows (or 75% of total expected outflows, whichever is greater)
• Total expected cash outflow = (FSCS covered deposits [excluding internet deposits] *5% withdrawal rate) + ([uncovered deposits and internet deposits] *10% withdrawal rate).
• Total expected cash inflow= contractual inflows (ie loan and mortgage payments) expected over 30 day period that are fully performing.

12.4

The above calculation would be expected by the PRA to be more than 100%. Credit unions may use contractual outflows/ inflows and behavioural flows in their calculations. Credit unions should be able to clearly explain their rationale to the PRA. 

12.5

In addition to the expectations set out in Chapters 9 and 11, credit unions with more than £50 million in total assets and/or credit unions that carry out more complex lending (such as providing mortgages or lending to corporates), and/or credit unions that invest in more complex investment products (supranational bonds, corporate bonds, bank bonds, and money market funds) should expect to engage more with the PRA. The PRA expects these credit unions to undertake scenario analysis to identify the impact of key strategic initiatives and external risks on their businesses. Examples of scenarios a credit union may use include: poorer than expected loan book performance; greater than expected increase in shares, higher than expected arrears, changes to welfare benefits, changes in bank interest rates etc. The PRA considers it good practice to look at combined scenarios.

12.6

In addition to the expectations set out in Chapters 10 and 11, the PRA expects credit unions with more than £50 million in assets to consider and document:

• the people, processes, and technology required to deliver critical services;¹² and
• what scenarios could result in them exceeding their risk appetite, and what actions they will take to respond and react to instances of crystallised operational risk to ensure they remain within their risk appetite. This should include consideration of external disruptions, and where the disruption is initiated at a provider whose products or services support the credit union’s critical services.

13.1

In line with requirements under Rule 11.1(2) of the Credit Unions Part of the PRA Rulebook, for a credit union to have effective processes to identify, manage, monitor, and report the risks to which it is exposed, the PRA expects a credit union with more than £100 million in assets to be able to demonstrate that it has management information, monitoring, and governance processes to support timely wind-down decision making. As part of this, it is best practice for a credit union to consider the scenarios that could lead to it no longer being viable. 

13.2

Credit unions with more than £100 million in assets are expected to consider the steps and resources needed to (i) wind down, and (ii) achieve a transfer of engagements, while, to the extent possible, avoiding any negative effects on members. These credit unions are expected to evidence that they have evaluated the risks and impact of a wind-down or transfer and considered how best to mitigate them.

14.1

Credit unions that invest in more complex investments under Rules 6.4(7) and 6.4(8) of the Credit Unions Part of the PRA Rulebook are expected to adhere to the investment expectations set out in Chapter 11 (paragraphs 11.1-11.6).

14.2

The PRA expects credit unions undertaking additional activities and/or credit unions investing in more complex investments (supranational bonds, corporate bonds, non-UK bank bonds, and money market funds) to maintain a board-approved investment policy. This should:

• set out organisational arrangements including the roles and responsibilities of officers involved in the credit union’s investments;
• set out their strategy for managing investments, including:
  • the credit union’s risk appetite;
  • the characteristics of the investments the credit union will make including quality, counterparty, and maturity; and
  • how the credit union will manage market risk including specifically listing institutions, issuers, and counterparties that may be used, or criteria for their selection, and limits on the amounts that may be invested with each;
• include the credit union’s approach to assessing credit worthiness and counterparty risk and maintaining a diversified investment portfolio;
• consider liquidity and funding risks arising from maturity mismatch and consider if and when additional liquidity may be required; and
• be reviewed regularly (at least annually).

14.3

Credit unions that invest in more complex investments are expected to meet the liquidity stress testing expectations set out in paragraphs 12.1 to 12.4.

15.1

The PRA expects credit unions that provide loans to corporate members¹³ should be mindful of the additional risks involved in providing corporate loans, for example business model risks, or difficulty predicting future cash flow.

15.2

Credit unions providing loans to corporate members are required to comply with the requirements in Rule 10.3 of the Credit Unions Part of the PRA Rulebook. The PRA expects credit unions that have notified the PRA that they are undertaking corporate lending to:

• establish overall and individual limits for these loans (while noting the statutory limitation¹⁴ that aggregate corporate loan balances must not exceed 10% of outstanding balances of all loans made). Separate limits should be considered for secured loans to corporate members;
• set a risk appetite (and limit) for these loans, agreed by the board. A separate risk appetite and limit for secured corporate loans should be considered;
• incorporate within monthly management information reports to the board, corporate lending levels (percentage of corporate loans that make up loan book and level of arrears associated with corporate loans at a minimum), with separate reporting for secured corporate loans. This information should be reviewed by the board regularly; and
• conduct scenario analysis to consider the risks of not recovering funds (for example, looking at the impact of a number of corporate loans defaulting at the same time).

15.3

Where a credit union undertakes secured loans to corporate members, the PRA may seek additional information from the credit union on the nature of its lending to corporate members, including:

• a quarterly review of existing loans (including performance of the businesses); and
• whether/ how funds could be recovered –commercial property generally has a significantly higher default rate than residential mortgage lending, and the credit union should consider scenario analysis to determine the impact this could have on their business.

15.4

Credit unions that provide loans to corporate members are expected to meet the liquidity stress testing expectations set out in paragraphs 12.1 to 12.4.

16.1

Credit unions providing credit cards, hire purchase, and/or conditional sale are required to meet the provisions in Rule 10.3 of the Credit Unions Part of the PRA Rulebook. The PRA also expects credit unions that provide credit card services to ensure:

• the board has sufficient knowledge and expertise regarding the risks involved; and
• a credit card policy is maintained which sets out (among other matters) how they would monitor and mitigate risks arising from the activity. This should include:
  • appropriate risk management arrangements, including monitoring metrics to provide effective oversight;
  • details of how the credit union is meeting its obligations with respect to outsourcing arrangements that apply to credit cards. For example, credit unions should be able to demonstrate that they are able to terminate outsourcing arrangements where necessary without detriment to the continuity of provision of services to members;¹⁵ and
  • an assessment of how much capital is required to cover specific risks related to credit cards (for example claims arising under section 75 of the Consumer Credit Act 1974, or losses from fraud, issues with the payment systems, product design, mis-selling, incorrect interest charges); this should be clearly documented. Where a credit union fails to demonstrate that they have enough capital to cover such risks, PRA supervisors may consider imposing an additional capital add-on (see section 2 above on capital).

16.2

Credit unions that provide credit cards or enter into hire purchase or conditional sale agreements are expected to meet the liquidity stress testing expectations set out in paragraphs 12.1 to 12.4.

17.1

Credit unions that provide mortgages are expected to consider the additional risks to which they are exposed, and put in place appropriate systems and controls to monitor and mitigate those risks. As part of this, the PRA considers it good practice for these credit unions to consider the key risks inherent in mortgage lending as highlighted in SS20/15 Supervising building societies’ treasury and lending activities.¹⁶ The PRA acknowledges; however, that the expectations set out in SS20/15 may not all be applicable to such credit unions and the size, scale, and nature of a credit union’s mortgage book should be taken into account to ensure a proportionate approach. For example, the ability to gain Mortgage Indemnity Guarantee (MIG) insurance may not be feasible due to low volumes.

17.2

In particular, it is good practice for credit unions that provide mortgages to have regard to Chapter 3 of SS20/15 (lending) and ensure they consider relevant sections. It is good practice for such credit unions to:

• be able to evidence that they have given consideration to the relevant risks and put mitigating controls in place where they consider it appropriate. Risks to be considered include:
  • affordability risk profile including appropriate controls over interest only mortgages, to ensure that repayment of the loan principal at maturity is achievable;
  • accurate and verifiable assessment and valuation of security;
  • pricing of risk. Credit unions are expected to have risk pricing models that at a minimum take into account the factors outlined in Chapter 3 of SS20/15; and
  • the risks inherent in different sub categories of mortgage lending (eg impaired credit, buy-to-let lending, self-build lending, shared ownership, lending in and into retirement, and commercial real estate lending).
• review their board-approved lending policy to ensure its aims and contents align with Chapter 3 of SS20/15.
• put in place risk management controls that are appropriate and proportionate to the types of business undertaken, as set out in SS20/15.
• have in place lending limits set by reference to available management expertise and risk management capability as set out in SS20/15. The PRA expects the lending limits outlined in the credit union’s lending policy to resemble the Traditional Approach set out in Appendix 2 of SS20/15 (credit unions should; however, use ‘total mortgage book’ instead of ‘total loan book’ when calculating the indicative limits). In some instances, credit unions may set different limits dependent on their risk appetite; in such instances the credit union should make the PRA aware of the limits, the rationale, and any risk mitigation arrangements.

17.3

In line with the requirements in Rule 10.3 of the Credit Unions Part of the PRA Rulebook, credit unions providing mortgages should also consider Chapter 4 (Financial risk management) of SS20/15 and be able to evidence that they have given consideration to the key financial risks described, and how they are managing and mitigating these. The key financial risks include:

• liquidity risks, arising from maturity transformation;
• funding risk, arising from the relative stability of different funding sources and reliance on new funding to replace outflows;
• wholesale counterparty credit risk interest rate risks: a credit union that provides mortgages should have an adequate system for managing financial risks arising from fluctuations in interest rates. The PRA expects credit unions that have a fixed-rate mortgage book to be able to demonstrate that they are managing the interest rate risks adequately. Such credit unions should follow, to the extent possible, the risk analysis elements of the financial risk management indicative control framework in Appendix 3 of SS20/15 for the administered approach. The PRA expects such credit unions to discuss their approach for managing interest rate risk with their supervisor and share their plan; and
• operational risks in treasury and related activities.

17.4

Credit unions that provide mortgages are expected to have in place internal controls on treasury financial risk management (see Rule 10.3 of the Credit Unions Part of the PRA Rulebook). As such, these credit unions should review relevant sections of paragraphs 4.6- 4.31 of SS20/15 and consider, as evidence of good practice:

• establishing a board-approved treasury management policy that governs all areas of treasury activities (see paragraph 4.6 of SS20/15);
• the imposition of policy limits (see paragraphs 4.9-4.13 of SS20/15);
• putting in place risk management systems and controls that are proportionate, and appropriate for the business they intend to undertake. This includes stress testing to evaluate the impact in income of abnormal market conditions, and board information reporting; (see paragraphs 4.15-4.27 of SS20/15); and
• conducting an independent review of treasury activities, including adequacy of controls over maturity mismatch (see paragraphs 4.28-4.31 of SS20/15).

17.5

Credit unions that provide mortgages are expected to meet the liquidity stress testing expectations set out in paragraphs 12.1 to 12.4. 

17.6

Credit unions engaged in, or wishing to engage in, commercial real estate lending should be mindful of the different nature of the risks associated with this activity. For example, commercial property will generally require different valuation skills to residential housing and has a significantly higher default rate. As such, the PRA expects credit unions undertaking or considering undertaking this activity to carefully consider paragraphs 3.48- 3.53 of SS20/15 and be able to evidence that they have adequate risk controls in place.