13-03-26-02. Interest rate risk policy and program requirements.

1. Any credit union that has assets of less than fifty million dollars must maintain a basic written policy that provides a credit union board-approved framework for managing interest rate risk.

2. Any credit union that has assets of fifty million dollars or more is required to have an interest rate risk policy and program that incorporates the following elements into their interest rate risk program: a. Board-approved interest rate risk policy. b. Oversight by the board of directors and implementation by management. c. Risk measurement systems assessing the interest rate risk sensitivity of earnings and asset and liability values. d. Internal controls to monitor adherence to interest rate risk limits.

1. e. Decisionmaking that is informed and guided by interest rate risk measures.1. 3. The board of directors shall establish adequacy of an interest rate risk policy and its limits. This must be either a separate policy or part of other written policies. The policy must be consistent with the credit union's business strategies and reflect the board's risk tolerance, taking into account the credit union's financial condition and risk measurement systems and methods commensurate with the balance sheet structure. The policy must state actions and authorities required for exceptions to policy, limits, and authorizations.

2. 4. The policy established to address interest rate risk must identify responsibilities and procedures for identifying, measuring, monitoring, controlling, and reporting interest rate risk, and establish risk limits. A written policy will: - a. Identify committees, persons, or other parties responsible for review of the credit union's interest rate risk exposure; - b. Direct appropriate actions to ensure management takes steps to manage interest rate risk so that interest rate risk exposures are identified, measured, monitored, and controlled; - c. State the frequency with which management will report on measurement results to the board to ensure routine review of information that is current and at least quarterly and in sufficient detail to assess the credit union's interest rate risk profile; - d. Set risk limits for interest rate risk exposures based on selected measures, such as limits for changes in repricing or duration gaps, income simulation, asset valuation, or net economic value; - e. Choose tests, such as interest rate shocks, that the credit union will perform using the selected measures; - f. Provide for periodic review of material changes in interest rate risk exposures and compliance with board-approved policy and risk limits; - g. Provide for assessment of the interest rate risk impact of any new business activities prior to implementation such as evaluating the interest rate risk profile of a new product or service; and - h. Provide for at least an annual evaluation of policy to determine whether it is still commensurate with the size, complexity, and risk profile of the credit union.

3. 5. Interest rate risk policy limits must maintain risk exposures within prudent levels.

4. 6. To implement the board's interest rate risk policy, management shall: - a. Develop and maintain adequate interest rate risk measurement systems; - b. Evaluate and understand interest rate risk exposures; - c. Establish an appropriate system of internal controls, such as establishing separation between the risk taker and interest rate risk measurement staff; - d. Allocate sufficient resources for an effective interest rate risk program. For example, a complex credit union with an elevated interest rate risk profile likely will necessitate a greater allocation of resources to identify and focus on interest rate risk exposures; - e. Develop and support competent staff with technical expertise commensurate with the interest rate risk program;

1. f. Identify the procedures and assumptions involved in implementing the interest rate risk measurement systems;
2. g. Establish clear lines of authority and responsibility for managing interest rate risk; and
3. h. Provide a sufficient set of reports to ensure compliance with board-approved policies.7. Credit unions shall have interest rate risk measurement systems that capture and measure all material and identified sources of interest rate risk. An interest rate risk measurement system quantifies the risk contained in the credit union's balance sheet and integrates the important sources of interest rate risk faced by a credit union in order to facilitate management of its risk exposures. This must include:- a. Model and analysis assumptions that are reasonable and supportable;
4. b. Documentation of any changes to assumptions based on observed information;
5. c. Monitoring of positions with uncertain maturities, rates and cashflows, such as nonmaturity shares, fixed rate mortgages where prepayments may vary, adjustable rate mortgages, and instruments with embedded options, such as calls; and
6. d. Interest rate risk calculation techniques, measures, and tests to be sufficiently rigorous to capture risk. Some options to calculate this risk include:
7. (1) Gap analysis for noncomplex or low-risk balance sheets;
8. (2) Income simulation; and
9. (3) Net economic value.8. Prudent internal controls must be established as permitted by the size, structure, and risk profile of the credit union.9. Credit unions with large or complex balance sheets shall establish prudent risk mitigation processes which include:- a. A policy that provides for the use of outside parties to validate the tests and limits commensurate with the risk exposure and complexity of the credit union;
10. b. Interest rate risk measurement systems that report compliance with policy limits as shown both by risks to earnings and net economic value of equity under a variety of defined and reasonable interest rate scenarios;
11. c. The effect of changes in assumptions on interest rate risk exposure results such as the impact of slower or faster prepayments on earnings and economic value; and
12. d. Enhanced levels of separation between risk taking and risk assessment such as assignment of resources to separate the investments function from interest rate risk measurement, and interest rate risk monitoring and oversight.

History: Effective January 1, 2019.

General Authority: NDCC 6-01-04

Law Implemented: NDCC 6-06-06