(a) General requirements. The extent and sophistication of a covered credit union's governance over its capital planning and analysis process must align with the extent and sophistication of that process. The process must be consistent with the financial condition, size, complexity, risk profile, scope of operations, and level of capital of the covered credit union. The ultimate responsibility for governance over a covered credit union's capital planning and analysis process rests with the credit union's board of directors. Senior management must establish a comprehensive, integrated, and effective process that fits into the broader risk management of the credit union. Senior management responsible for capital planning and analysis must provide regular reports on capital planning and analysis to the credit union's board of directors (or a designated committee of the board).
(b) Mandatory elements. A covered credit union's board of directors (or a designated committee of the board) must review and approve a capital policy, along with procedures to implement it. The capital policy must:
(1) State goals and limits for capital levels and risk exposure.
(2) Establish requirements for reviewing and reporting capital levels and breaches of capital limits, with contingency plans for remedying any breaches.
(3) State the governance over the capital analysis process, including all the activities that contribute to the analysis;
(4) Specify capital analysis roles and responsibilities, including controls over external resources used for any part of capital analysis (such as vendors and data providers);
(5) Specify the internal controls that govern capital planning, including review by internal audit, control of changes in capital planning procedures, and required documentation;
(6) Describe the frequency with which capital analyses will be conducted;
(7) State how capital analysis results are used and by whom; and
(8) Be reviewed at least annually and updated as necessary to ensure that it remains current with changes in market conditions, credit union products and strategies, credit union risk exposures and activities, the credit union's established risk appetite, and industry practices.