Why Your Credit Union Needs a Robust Disposition Policy
In the world of credit union operations, how you say “goodbye” to assets is just as important as how you acquire them. Whether you are retiring an old server, selling an abandoned branch office, or shredding a decade’s worth of loan applications, the process requires more than just a dumpster or a “For Sale” sign. It requires a formal Disposition Policy. There are cases where sensitive data was found in unique places. So let’s examine secure departures and your credit union in how have a better disposition policy.
Without one, your credit union faces significant compliance gaps, security vulnerabilities, and potential hits to your net worth. Here is everything you need to know about why these policies matter and how to ensure yours is up to code.
What is a Disposition Policy?
A disposition policy is a formal, board-approved document that governs the removal of assets from your credit union’s books. This typically covers two distinct areas:
- Physical/Fixed Assets: Buildings, land, furniture, and equipment.
- Information Assets: Member data, loan records, and sensitive internal documents.
Why It Matters: Risk and Responsibility
A “winging it” approach to asset disposal creates three major types of risk:
- Security Risk: Tech hardware (printers, hard drives, scanners) often stores “ghost” data. Improper disposal is a leading cause of data breaches.
- Safety and Soundness Risk: For fixed assets like real estate, holding onto “abandoned” property for too long can drain earnings and negatively impact your net worth.
- Legal & Reputational Risk: Improperly handling member records can lead to massive fines under federal privacy laws and shatter the trust your members place in you.
Key Regulations You Must Know
Compliance isn’t a suggestion; it’s a requirement. Here are the primary “rulebooks” your policy must reference:
1. NCUA 12 CFR § 701.36 (Fixed Assets)
This regulation specifically addresses how Federal Credit Unions (FCUs) handle premises.
- Abandonment: If you stop using a property, you must make “diligent efforts” to dispose of it at fair market value.
- Timelines: Generally, you must publicly advertise abandoned property within 4 hours of abandonment and complete the sale within 5 years.
- Prohibitions: You cannot sell or lease property to “insiders” (board members, senior management, or their families) without an NCUA waiver.
2. NCUA 12 CFR Part 749 (Records Preservation)
While the NCUA provides flexibility on how you keep records, it is strict about Vital Records. Your policy must include a schedule for the destruction of records that are no longer useful, ensuring they are disposed of in a way that prevents reconstruction.
3. The FACT Act / Disposal Rule
Under the Fair and Accurate Credit Transactions Act (FACTA), credit unions are required to take “reasonable measures” to protect against unauthorized access to consumer information during disposal.
- Standard Practice: Burning, pulverizing, or shredding physical papers; erasing or destroying electronic media so data cannot be read.
How to Create or Update Your Policy
If you’re starting from scratch or performing an annual review, follow these five steps to ensure compliance:
1. Define Scope and Authority
Clearly state which assets the policy covers and who has the authority to approve a disposal (e.g., the Board, the CFO, or a specific Facilities Manager).
2. Establish a Retention & Disposal Schedule
Align your information disposal with your record retention policy. Use a grid to define how long to keep specific documents (e.g., 7 years for certain tax records, permanently for charter documents) and the exact method of destruction.
3. Conduct Due Diligence on Third Parties
If you hire a shredding company or a tech recycling firm, you are still responsible for the data. Your policy should require an annual review of the vendor’s security certifications and “certificates of destruction.”
4. Address “Insider” Conflicts
Explicitly forbid the sale of credit union assets to employees or officials at “buddy prices.” All disposals should be at arm’s length and for fair market value.
5. Documentation and Logging
Audit trails are your best friend. Require an Asset Disposition Form for every major item, noting the asset’s ID, the reason for disposal, the method used, and the final approval.
Asset Disposition Audit: A 10-Point Checklist
Use this checklist to evaluate whether your current processes meet NCUA standards and federal privacy laws. A “No” in any category indicates a gap that should be addressed in your next policy update.
1. Board Approval & Review
- [ ] Does the credit union have a standalone Disposition Policy (or a clearly defined section within the Fixed Asset/Information Security policy) that has been reviewed and approved by the Board within the last 12–24 months?
2. Comprehensive Asset Scope
- [ ] Does the policy explicitly cover all asset types, including physical real estate (premises), hardware (servers, laptops, MFP printers/copiers), and non-public member information (NPPI)?
3. Abandoned Property Timelines (NCUA 701.36)
- [ ] For closed branches or unused land, does the process mandate public advertisement within 4 years of abandonment and a completed sale within 5 years (unless an NCUA waiver is on file)?
4. Record Preservation & Destruction Index
- [ ] Does the credit union maintain a permanent index of all destroyed records that includes the date, a description of the records, and the signatures of at least two authorized witnesses?
5. Data Sanitization Standards
- [ ] Are the methods for destroying electronic media (hard drives, flash drives) specific and consistent with NIST standards (e.g., shredding, degaussing, or multi-pass overwriting) rather than just “deleting” files?
6. Third-Party Vendor Due Diligence
- [ ] Does the credit union perform annual due diligence on disposal vendors (shredding companies, e-waste recyclers) to verify their security certifications and insurance coverage?
7. Certificates of Destruction
- [ ] Is there a standard operating procedure to collect and file a Certificate of Destruction for every batch of sensitive data or hardware sent off-site for disposal?
8. Conflict of Interest Controls
- [ ] Does the policy strictly prohibit the sale or lease of credit union assets to “insiders” (officials, senior management, or their immediate family) without explicit board approval or a regulatory waiver?
9. Arm’s Length Transactions
- [ ] Does the policy require that all asset disposals are conducted at fair market value, with documentation (appraisals or market comparisons) kept on file to prove the transaction was “arm’s length”?
10. Audit Readiness
- [ ] Are the disposal logs and indices kept in a format (physical or electronic) that is immediately accessible for an NCUA examiner during a surprise or routine inspection?
Final Compliance Check
Is your policy “Audit Ready”?
- Does it have a current board approval date?
- Does it specify the destruction method for electronic media (e.g., “wiping” vs. “physical crushing”)?
- Does it include a process for seeking NCUA waivers for real estate timelines?
Managing the lifecycle of your assets doesn’t have to be a headache. By instituting a clear, compliant disposition policy, you protect your credit union’s reputation and ensure that every “goodbye” to an old asset is handled with professional integrity. Oak Tree is about reliable and compliant forms for your credit union, and our company is about the credit union movement. We are always looking for points of interest that you may be concerned with when it comes to running your credit union. Be sure to follow our socials and keep up with our blogs posts. We are here to create the documents and now to help you have some ideas what to do with their retention and disposition.
Disclaimer
Please Note: The information provided in this article is for educational and informational purposes only and does not constitute legal, financial, or regulatory advice. This content is based on the independent research of a staff writer and is intended to highlight general industry standards and NCUA guidelines. Because laws and regulations are subject to change and may vary based on specific institutional charters or state locations, we recommend consulting with a qualified attorney or a compliance professional before finalizing or instituting any new internal policies.
