Credit union ALM providers: outsourced, in-house or agents, compared

Credit union ALM providers fall into three approaches: an outside provider that runs the asset/liability model from data the credit union sends and returns a report; an in-house model licensed and run by the credit union's own staff; and, newer, agents that work around either, proving the inputs, explaining the results and building the ALCO package. The choice matters less than most comparisons suggest, because NCUA's rule does not move with it: a federally insured credit union with more than $50 million in assets must adopt a written interest rate risk policy and run an effective program, and the selection and understanding of the measurement system are the board's and management's responsibility either way. The useful comparison is what each approach leaves the credit union to evidence itself. The ALM model runs the numbers in all three; Botminds' ALCO Reporting is the third approach, built to sit beside whichever model the credit union already uses.

The rule text below is NCUA's and the interagency agencies' own, linked where quoted. Product examples come from a fictional sample institution in the solution, Tessaly Community Bank; it is a bank, so its pages say EVE where a credit union's say net economic value (NEV).

What does NCUA require for interest rate risk?

NCUA requires a written policy and an effective program, and puts both on the credit union. The rule reaches every federally insured credit union with more than $50 million in assets on its latest Call Report, which must adopt a written IRR policy and run an effective IRR program (the rule's text is quoted in who signs the interest rate risk policy). Appendix A to Part 741 is the guidance on how, and it is explicit that form is flexible but writing is not: the policy can stand alone or sit inside "investment, ALM, funds management, liquidity or other policies", but "Regardless of form, credit unions must clearly document their IRR policy in writing" (12 CFR Part 741 and Appendix A).

The appendix then assigns the work. "The board of directors is responsible for ensuring the adequacy of an IRR policy and its limits." Management should use assumptions it can support and write down every change it makes to them in light of what it observes, which is the test applied to deposit assumptions in core deposit study or back-test. And on the system itself: "The selection and assessment of appropriate IRR measurement systems is the responsibility of credit union boards and management." None of those sentences changes when the model is run by someone else.

Liquidity has its own thresholds. Under 741.12, a credit union with $50 million or more in assets must keep a documented contingency funding plan that states, among other things, how often the credit union will test and update it, and one with $250 million or more must also document access to at least one contingent federal liquidity source. An ALM provider's report often covers interest rate risk only; the liquidity obligations sit beside it in the same package.

Who provides ALM services for credit unions?

ALM services for credit unions come from three kinds of provider: outside firms and credit union service organizations that run the model and report on it, software vendors that license a model for the credit union to run, and the credit union's own staff using either. A fourth option now sits across them: agents that do the reconciliation, explanation and reporting work around a model that stays with whoever runs it today.

This guide names no providers. The questions further down apply to all of them, including Botminds, and the comparison table is organized by obligation rather than by vendor, because NCUA examines the credit union's program, not its provider's.

What does an outsourced ALM provider deliver?

An outsourced ALM provider typically delivers a periodic model run on the credit union's data and a report of its results: net interest income under rate scenarios, NEV under rate shocks, perhaps a repricing gap and liquidity projections, compared with the policy limits the credit union supplies. Appendix A anticipates this: alternate rate scenarios may be "devised by the user or provided by the vendor", and prepayment speeds "may be estimated or derived from numerous national or vendor data sources."

What a report does not deliver is the credit union's own understanding of it, and NCUA tests for exactly that. Its supervisory letter on the interest rate risk framework says: "The NCUA will assess the extent of credit union management's involvement as part of the IRR examination and whether a credit union understands the information provided by third-party vendors in supporting its analysis" (NCUA, Updates to Interest Rate Risk Supervisory Framework). A board that receives a provider's report and files it has outsourced the arithmetic and kept the examination risk.

What stays the credit union's responsibility if ALM is outsourced?

Everything except the arithmetic stays with the credit union: the policy and limits, the accuracy of the data it sends, the reasonableness of the assumptions, the independent check of the information it gets back, the decisions taken on the results, and the written account of those decisions. NCUA's supervisory letter on third-party relationships puts the principle in one sentence: "outsourcing processes or functions does not eliminate credit union responsibility for the safety and soundness of those processes and functions" (NCUA Supervisory Letter 07-01).

The same letter says what that means for measurement information a third party provides: "clear controls should be contractually established and subject to periodic independent testing to ensure the accuracy of the information." For the model's mechanics, the interagency advisory sets a reasonable floor: "Institutions that use vendor-supplied models are not required to test the mechanics and mathematics of the measurement model. However, the vendor should provide documentation showing a credible independent third party has performed such a function" (Interagency Advisory on Interest Rate Risk Management, 2010). The data going in and the assumptions applied are not covered by that documentation; they are the credit union's to test.

Outsourced, in-house or agents: the comparison

Set side by side by obligation, the three approaches differ mainly in who does the model run and how much of the surrounding work is left to the credit union's staff. The third column assumes agents working around whichever of the first two the credit union already has.

Read down the first two columns and the pattern is plain: the provider takes one row, the model run, and the credit union keeps the rest. That is not a criticism of outsourcing; for many credit unions it is the right way to get a sound model without hiring a modeller. It does mean that the comparison between providers should focus on what each makes easier in the other seven rows, and that a credit union with a good provider and a thin staff may still be short of the evidence NCUA asks for.

ALM software for credit unions: in-house modelling

ALM software for credit unions, run in-house, moves the model run onto staff and with it the control of timing, scenarios and assumptions. The obligations that come with it are the ones Appendix A lists for management: maintain adequate measurement systems, staff them with people whose expertise matches the program, and set internal controls that keep the people who take interest rate risk apart from the people who measure it.

For a credit union with a few staff in finance, that separation is the hard part. Appendix A allows for it: where there is no internal auditor, management or a supervisory committee that stands apart from the IRR work may carry out the review, and management "may also supplement the internal audit with outside expertise." An in-house model is defensible at almost any size; the question is whether the credit union can staff both the running of it and an independent look at it.

How much does outsourced ALM cost?

No independent source we found publishes outsourced ALM prices, and they vary with frequency, balance sheet complexity and what is bundled. The figure a credit union can compute is its own remaining cost: the staff hours each cycle still takes after the provider's report arrives, preparing and checking the data, reviewing the assumptions, writing the board and ALCO material, and keeping the minutes and actions. For a monthly package at a community bank, Botminds' estimate of the by-hand work, worked through in pricing the ALCO package, comes to about $67,000 a year in loaded wages at national median pay, before the model's own cost; a credit union meeting quarterly would scale that down accordingly.

That remaining cost is what any change of provider or approach should be measured against. A cheaper report that leaves more of the seven rows to staff is not cheaper.

The fourth row deserves a sentence of its own. Appendix A says "Management should utilize the results of the credit union's IRR measurement systems in making operational decisions such as changing balance sheet structure, funding, pricing strategies, and business planning", and that this "is particularly the case when measures show a high level of IRR or when measurement results approach board-approved limits." The evidence for that is in the ALCO minutes, not in the provider's report; how to write them is covered in ALCO meeting minutes.

How do you compare ALM providers? Questions for any provider

Compare ALM providers by asking each the same questions, organized around the credit union's obligations rather than the provider's features, and by asking for the answers on the credit union's own data.

Where ALCO Reporting fits for a credit union

ALCO Reporting does not run the model and does not replace a provider. It reads the run, from an outside provider or an in-house model, together with the general ledger, the core system and the policy, and takes the rows the comparison table leaves to staff: proving the inputs before drafting, explaining each move by driver, comparing every limit, showing assumption changes with their effect, answering committee members from the package's own sources, and drafting minutes from the secretary's notes. People approve every page, exception and assumption change; the chair approves the minutes.

Every limit, every cycle, with the share used and last period beside it

It fits best where the credit union produces a package monthly or near it, draws on several systems, and has one or two people building it. It adds least where a provider already delivers a complete package and the committee meets quarterly with few limits. In between, the test is the same as for any provider: run one cycle of the credit union's own data and count what is left to do by hand.

The margin note shows its work: the steps, the sources and the check that it sums

Questions people ask

Does a credit union under $50 million need an ALM model?

The written interest rate risk policy and program requirement in 741.3(b)(5) applies above $50 million in assets. Below that, a credit union still needs a basic written liquidity policy under 741.12, and Appendix A describes widely accepted interest rate risk practices "for the benefit of all FICUs".

Can the supervisory committee review the ALM program?

Yes. Appendix A says that where there is no internal auditor, management or a supervisory committee that is independent of the interest rate risk process may assess the program and its compliance with policy, supplemented by outside expertise where appropriate, and that findings go to the board or supervisory committee with corrective actions and timeframes.

How often should a credit union run its ALM model?

As often as its policy says and its risk requires. Appendix A asks the policy to state how often results are reported to the board, giving "current and at least quarterly" as the example, and a monthly run lets the committee see trends between quarterly board reports.

Does NCUA test NEV itself?

Yes. NCUA uses its own NEV Supervisory Test and, for smaller credit unions, an estimated NEV tool built from Call Report data, alongside its review of the credit union's own measurement. Its 2022 framework update also warns staff that high-risk results from the estimated tool sometimes come from inaccurate Call Report information.

Can we switch ALM providers mid-year?

Yes, with a parallel run. Running the old and new models on the same quarter's data, reconciling both to the general ledger and explaining the differences in assumptions gives the board, and later the examiner, a documented reason for any change in the reported risk.