FedBizOpsNotice_NCUA-17-CDAS.pdf

Federal Business Opportunities Credit and Deposit Analytic Solution (CDAS)

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 1

Introduction

The National Credit Union Administration (NCUA) is an independent federal agency that regulates, charters, and supervises federal credit unions throughout the United States and its territories. NCUA insures savings in federal and most state-chartered credit unions through the National Credit Union

Share Insurance Fund (NCUSIF), a federal fund backed by the full faith and credit of the United States

Government. The NCUSIF insures the savings of more than 103 million credit union account holders.

As of December 31, 2016, there were 5,785 federally insured credit unions with an aggregate total assets of $1.3 trillion and individual financial institution assets of less than $1M to over $70B. NCUA administers the Federal Credit Union Act created by Congress to serve, protect, and promote a safe, stable national system of cooperative financial institutions that encourage thrift and offer a source of credit for their members.

In 2016, as part of a broader examination modernization initiative, NCUA decided to improve loan and deposit portfolio analytics used during credit union examinations. Currently, NCUA uses an in-house examination system called AIRES to produce a series of queries from credit union-provided member loan and deposit data1. Industry complexity, evolving technologies, and user requirements necessitate a review of the current process in favor of opportunities to improve efficiencies by leveraging cloud computing, on-demand and usage-priced shared services, and virtualization technologies.

Mission and Vision

The Credit and Deposit Analytic Solution (CDAS) is defined as a suite of information and reports derived from member2 loan and deposit data provided by credit unions and will include portfolio segmentation, composition, performance attribution, collateral valuation, trends, and data integration. It includes shared services, desktop, and cloud services (e.g., Software as a Service).

The primary objective of CDAS is to obtain a scalable, cost-effective, secure, and reliable solution to provide examiners with an improved tool to identify, monitor, measure, and analyze risk in loan and deposit activities. NCUA seeks to implement a FedRamp, FedRamp-authorized,3 or comparable commercial off-the-shelf (COTS) analytic solution to integrate into our examination process. By providing a standard, “out-of-the-box” suite of portfolio reports, as well as functionality to individually stratify available data and create custom reports, the solution will supplement and eventually replace the tools used in NCUA’s examination platform. NCUA seeks to improve the effectiveness of its risk assessments and leverage the expertise and current best practices in the financial industry to provide

1 Also known as the AIRES loan and share download. Member loans refer to products including consumer, residential, and commercial lending. Consumer-based lending includes autos, credit cards, student loans and other loan products. Share data refers to deposits including checking, savings, money market, and certificate of deposit accounts.

2 Also known as customers. Credit unions are member-owned and the field of membership of a credit union is part of its official charter and is the legal definition of who is eligible to join the credit union.

3 The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. If applicable, offerors should indicate if their solution is in the process of being FedRAMP-authorized. NCUA will take this into consideration in its evaluation. Reference: www.fedramp.gov

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 2

proven analytic capabilities. This solution will encourage consistency through the use of a standard method of assessing loan and deposit data across all NCUA examinations.

NCUA’s highest priorities in our examination program are ensuring credit unions operate in a safe and sound manner and protecting the NCUSIF from undue risk. Effective problem resolution with the credit union requires transparency and information sharing to persuade, influence, and motivate the credit union management and board members to correct unsafe and unsound operations. NCUA is interested in solutions that enable staff to generate summary information suitable for examination and supervision needs and share the output with subject credit unions.

Also essential is the ability to timely deliver these services to the individual end users within the NCUA organization. It is envisioned these services will capture the shared on-demand capabilities of today’s cloud technology. This technology enables on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services).

Background

Examiners4 obtain loan and deposit data at the beginning of every examination, during some supervision contacts, and on an ad hoc basis from the credit union5. This raw data, sometimes from multiple sources and in multiple data files and formats, provides examiners with essential information in evaluating the credit and deposit risks in credit unions.

Implementation of CDAS may present the following challenges:

1. Broad range of vendors and data processing platforms: Credit unions use many external service providers to record, track, update, and monitor their loan and deposit accounts.

2. Data standardization: NCUA recognizes data may need to be in a standard format for the solution. If the current file download format from credit unions (e.g., tab delimited) will not work with the solution, NCUA may need to investigate the industry impact of changing the requirements in NCUA Letter to Credit Unions 03-CU-05.

3. Data Fields: NCUA may collect fewer or a more extensive list of data fields from a credit union. NCUA will coordinate with the offeror about any gaps and reporting options based on the available data.

4 In addition to approximately 700 NCUA examiners, a majority of the State Supervisory Authorities (SSA) also use NCUA’s examination platform and supervision tools. NCUA anticipates approximately 500 SSAs would also use this analytic solution when examining federally insured, state chartered credit unions. NCUA estimates users would utilize this analytic solution on at least 5,000 examinations annually with an average of 800 examinations/credit union contacts in process at any given time.

5NCUA issued Letter to Credit Unions 03-CU-05 in April 2003. This letter provides file layout specifications for credit union management and vendors. The current data file from credit unions must be a simple ASCII tab delimited text file.

NCUA currently collects 39 loan-related and 20 deposit-related fields. Reference: https://www.ncua.gov/regulation-supervision/Pages/policy-compliance/communications/letters-to-credit-unions/2003.aspx

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 3

NCUA is considering a phased approach to implementation of the CDAS. NCUA envisions users utilizing the solution independently of our examination solution to compile and stratify data and generate reports. Once NCUA selects a new audit management solution6, the CDAS could be accessed from within that solution.

As indicated in Figure 1, each notional phase builds on the previous phase, adding more functionality and output information for end users. Depending on the solution capabilities, NCUA may adopt a more aggressive implementation approach to provide functionality to end users. To summarize:

Phase 1 – Use existing data collected from credit unions for portfolio attribution reports, data stratification, custom querying, and exporting individual loan and deposit data for further review in the examination solution. For the majority of examinations, the user will only submit the existing AIRES loan and share information (i.e., 59 data fields); however, there may be instances where credit unions can provide additional data fields electronically. In these ad hoc cases, the user would utilize the solution to analyze the broader data set.

Phase 2 - Integrate other data that is available from the offeror and/or NCUA into the analytic solution for a more comprehensive analysis of risk and trends. This may include, but is not limited to, economic, credit bureau, census, industry information, etc.

Phase 3 – Incorporate more data fields collected from most credit unions on a regular basis for improved portfolio attribution reports. Generate “what if” scenarios based on existing and industry data.

Future – Capture all portfolio data from credit unions electronically with different schemas and data sets for portfolio trending, migration, and segmentation.

6 This is a separate procurement. NCUA anticipates implementing the new examination solution in 2019 or 2020.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 4

Figure 1: Notional Phased Approach for Implementing CDAS

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 5

NCUA also developed a notional process framework (Figure 2) representing the CDAS entities, paths, and offerings. As shown below, it identifies key elements supporting data retrieval and transfer to the offeror and delivery of analytic results. The primary difference between the two diagrams is the integration of other data scheduled to begin in Phase 2.

Figure 2: Notional CDAS Process Framework

Market Research

Market research is underway to obtain a comprehensive view of current technology and the emerging environment to effectively and efficiently satisfy business needs. To this end, market research will encompass a variety of forums:

Open source, online research

Request for Information (RFI)

Individual meetings with offerors

Discussions with other federal agencies

Current market research of the industry demonstrates the value of releasing this RFI for further analysis and assistance in developing requirements.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 6

Moving forward: CDAS

NCUA is looking for offerors to provide a written response, not to exceed 10 pages, highlighting their technical capabilities and a rough order of magnitude based on the following general solution requirements. Additionally, NCUA is requesting information about the proposed solution and has provided a list of questions. Please provide a description about the solution, respond to all questions, and provide a sample, out-of-the-box analytic report from the solution. The questions are not included in the written response page count.

General Solution Requirements

Solution Requirements

1. Ensure the confidentiality, integrity, and availability of the raw data and the output reports.

2. Enforce security rules based on user roles and control access to data input and output reports.

3. Allow for one or more users to access and view available reports for a credit union.

4. Provide user-friendly screen design and search capability.

5. Purge data and/or reports as designated by NCUA.

6. Maintain and provide user audit logs, reports, etc.

7. Comply with Section 508 standards7.

8. Interface and integrate with NCUA systems, databases, and solutions, as needed.

9. Adhere to laws, regulations, directives, policies, standards and guidelines mandating protection of federal government information, information systems and related resources, including all information systems owned or operated on behalf of the government by the offeror (e.g., privacy, eDiscovery)8.

Business Requirements – Both Credit and Deposit Analytics

10. Aggregate, cleanse, and transform data from multiple files for one credit union from structured and unstructured data sets (e.g., core data processor, credit card processor, mortgage servicer, student loans) and produce standard, out of the box individual and aggregate portfolio reports.

11. Combine credit union data with other data service providers (e.g., credit bureaus and other data providers) and sources to produce loan and deposit portfolio analytics. Analytics may include data stratifications, statistical analysis, and model forecasting.

12. Produce a standard suite of reports from a limited data set.

13. Structure data in time series for one credit union to create historical trending analysis and portfolio migration reports vertically and horizontally (e.g., across all credit unions and within one credit union).

14. Allow users to create ad-hoc queries and reports without vendor or IT assistance.

15. Allow users to drill down into reports and view individual or group loan/deposit-level data.

16. Produce a suite of reports and dashboards identifying red flags, possible data manipulation, and fraud indicators.

17. Provide printing capabilities.

18. Export reports and data to various formats (e.g., PDF, Microsoft Excel, CSV).

7 Reference: www.section508.gov

8 Reference: https://cio.gov/wp-content/uploads/downloads/2012/09/cloudbestpractices.pdf https://cio.gov/wp-content/uploads/downloads/2012/09/cloudbestpractices.pdf

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 7

Business Requirements – Credit Analytics

19. Stratify loan level data, for example, segmenting loans by such categories as loan type, interest rate, collateral, remaining maturity and other attributes.

20. Generate time series graphs and reports from two or more variables showing correlations between data points to identify patterns (e.g., correlation between delinquent loans by collateral type, loan to value, and credit risk score).

21. Produce statistical correlations of time series data to exogenous independent variables (e.g., the credit union’s 60 day delinquency history and unemployment rate history).

22. Model commercial and residential real estate portfolios by updating property evaluations, factoring in collateral geographic concentrations, and modeling scenarios impacting portfolios

(e.g., amount of negative equity if home values decline 10%, 20%).

23. Model auto loan portfolios by updating collateral valuations, concentrations, and scenarios impacting portfolios (e.g., negative equity).

24. Generate a random sample of loans for the examiner to review from the entire loan portfolio or by loan type, interest rate, or other criteria.

25. Allow users to create lists of selected individual loans and export the lists, with the associated data fields, in various formats (e.g., Microsoft Excel, CSV).

Business Requirements – Deposit Analytics

26. Stratify account level deposit data, dividend type, rate, product name, average monthly balance, maturity date, margin, index and other deposit attributes.

27. Model deposit data for market rate analysis, growth rate, and cost of funds by product.

28. Model member services and customer penetration (e.g., number of deposit and loan services used, member location).

Vendor Services

29. Provide portfolio analytic expertise and experience that evolves with industry changes and informs NCUA about current and emerging opportunities for better analytics.

30. Provide an efficient data cleansing, mapping, and ETL (Extract, Transform, and Load) process.

31. Provide implementation and post-implementation support, including obtaining and maintaining the required Authority to Operate in accordance with National Institute of Standards and

Technology (NIST) Special Publication 800-53 Rev. 4.

Requested information about the solution:

Provide a brief description of the current version of your software solution:

1. Name and current version of the software solution.

2. General description of the solution, capabilities, out-of-the-box reports, and custom query functionality including capabilities, analytic process, and reporting.

3. General description how the solution determines risk in different types of deposit and loan portfolios including residential real estate, commercial, direct and indirect auto loans.

4. Describe the solution scalability to support changes in the number of users and the number and size of data files.

5. Describe your post-implementation support services.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 8

Please address the following questions in your response about your solution:

6. What, if any, custom coding is required to meet NCUA’s requirements?

7. Does the solution have any offline capability (e.g., users can utilize the solution without an active internet connection)?

8. How often is the solution updated (e.g., patches, releases to clients)? What are the average maintenance down times and frequency?

9. Describe the best practices for implementation approach. What is your implementation approach?

10. What are the minimum hardware and software requirements for end user workstations accessing this solution?

11. When is the next version expected to be released? What enhancements are you anticipating with that release?

Provide a Rough Order of Magnitude costs for implementation and post implementation support services including9:

12. Cost for system licenses and software.

13. Cost of associated services for tasks such as solution set up, testing, end user training, and operations and maintenance.

14. If the solution is available “as a service”, a Rough Order of Magnitude for service and what the service includes.

Please address the following questions in your response about your experience:

15. Describe your experience supporting federal government clients.

16. Describe your experience working with bank, credit union, or financial industry data.

17. Describe any partnerships or data sources you can access and integrate with credit union data and how it enhances your analytic solution. Would NCUA have access to this raw data?

18. Describe your value-added specialty or expertise that differentiates your solution from others.

19. What help desk processes and capabilities do you offer?

20. Name of government agencies currently using the solution:

a. Brief description of how it is used.

b. Number of users (concurrent user capacity)

c. Volume of transactions or files supported

d. Explain the help desk approach

Please address the following questions in your response to the input and output:

21. Describe the loan and deposit types supported with your solution and your experience working with consumer, real estate, indirect, participation, and commercial lending data.

22. Describe your data cleansing process and how you ensure accuracy of output information.

23. How does the solution handle unstructured data and data errors?

24. What are the limitations on individual data file size, file storage capacity, and simultaneous requests?

25. What are the file structure limitations? Is there a required file format for the data and how does this requirement align with the current AIRES loan and share download?

9 See footnote on Page 2 for estimated number of users and solution usage.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) 9

26. What are the average response times from data transmission to report generation (e.g., average data cleansing cycle time)?

Please address the following questions in your response about your security:

27. Discuss your adherence to FISMA requirements within your managed services and hosting to include that of the NIST and FedRAMP.

28. Does the solution support end user authentication using PIV cards or other means of multi-factor authentication?

29. Can the solution reside on an existing FedRAMP cloud service provider’s Infrastructure as a

Service?

30. Does the solution support the ability to partition or restrict access to sets of files for different users?

Future Communications

NCUA will publish any amendments based on responses to this announcement or any additional information that becomes available on FedBizOpps. Vendors are encouraged to check the website directly for any status and/or updates.

Questions

Questions or comments regarding this information or the initiative in general will be accepted through

(July 31, 2017) and should be submitted to: DSmiley@ncua.gov.

mailto:DSmiley@ncua.gov