JACKSON, Miss.–Where were the regulators and how could this happen? Those are the first questions always asked by many in the CU community whenever there is a case of misappropriation of funds—especially when it’s alleged to be nearly $100-million—at a credit union. Two experts are offering their insights.
To be clear, there were some obvious warning signs in the case of Jackson Area FCU that something might be amiss: not just the alleged extravagant lifestyle of the CEO and her husband—a state employee—that board members and staff members must have noticed—but the credit union was also sitting on a substantial amount of cash while also borrowing money, the two analysts pointed out.
As the CU Daily reported here, here, and here, NCUA conserved Jackson Area FCU in Mississippi on May 6 and filed a complaint May 14 in the U.S. District Court for the Southern District of Mississippi against former President and CEO Leigh Bridges and her husband, Chad, in which it alleges $95 million was embezzled from the $142-million credit union via fraudulent accounting entries, wire transfers and other transactions for personal use that allegedly included multiple homes, grand pianos, private plane trips and more.
Among the questions being asked by one person: Why is NCUA proposing as part of its Deregulation Project to loosen internal controls and requirements for board training and financial knowledge at the same time board members missed obvious red flags something wasn’t on the up an up?
Statement from NCUA
In a statement to the CU Daily, NCUA declined to say how long it has been looking into the books at Jackson Area FCU, noting only that it had conserved the institution on May 6. The agency said it is now in control of the credit union and has assumed the role of its board, and has an interim management team in place, with representatives from the Southern Region’s Special Actions staff onsite regularly.
Asked what the next steps are, NCUA said in a statement, “As with all conservatorships, we will take the time needed to fully evaluate the assets and records, and then to develop the best resolution options for the credit union, its members, and the share insurance fund. Concurrently, we will seek to maximize recoveries for any identified losses which will likely be a lengthy process.”
The credit union trade groups have not issued any statements related to the conservatorship and lawsuit.
Insights From Two Experts
While that lengthy process plays out, the CU Daily asked two people who have deep insights and experience in examinations, conservatorships and more to share their perspectives on how what allegedly took place at Jackson Area FCU could have taken place, what should have been flagged, what happens at a CU during a conservatorship, what the cost to the insurance fund might be, what might lie ahead, and more.
Below, questions from the CU Daily and its readers are answered by:
- Mark Treichel, who spent 33 years at NCUA, the last several as executive director, before founding Credit Union Exam Solutions. Treichel said his firm helps “credit unions save time and money on all things NCUA related.” In addition, Treichel hosts the podcast With Flying Colors, which provides exam-related guidance on how to pass exams “with flying colors.”
- Ancin Cooley, principal with Synergy Credit Union Consulting & Synergy Bank Consulting Inc., which provides strategic planning, MBL Review, internal audit, credit risk management and other solutions, including directors exams. Cooley previously worked for the Office of the Comptroller of the Currency (OCC) as an examiner, and also with a regional accounting firm where he led loan reviews and internal audits. He holds both the Certified Internal Auditor (CIA) and Certified Information Systems Auditor (CISA) designations.
The CU Daily: When people see an alleged embezzlement of this size, their first question is how could this occur at a regulated financial institution? So, how could this occur?
Treichel: Lack of internal controls, when one person controls both the books and the money, and nobody independent ever appropriately checks the two against each other. At Jackson Area, the official who became CEO around 2021 allegedly prepared and signed the 5300 call reports and also held wire-transfer authority. That’s the whole story in one sentence. When the person who certifies the numbers is the same person who moves the cash, there’s no second set of eyes and no friction between an impulse and an entry.
The mechanism was simple and durable. The complaint alleges false deposit entries — roughly $51 million — into the CEO’s and her husband’s own share accounts, made to look like funds arriving from outside institutions when they actually came from the credit union’s own general ledger. On top of that, the complaint alleges accounting entries that overstated funds held at a corporate credit union — and that’s the account the restatement later collapsed. That’s the phantom cash. It sat on the balance sheet for years because no one independent ever reconciled the reported corporate balance back to the corporate’s actual statement. “Regulated” doesn’t mean “continuously audited.” It means examined periodically on a sample basis. A determined insider who controls everything can hide a hole for a long time.
Cooley: There’s an embedded presumption in that question, that because an institution is regulated, it’s regulated well. Those aren’t the same thing.
I want to be careful not to paint with a broad brush. There are field offices where this would never get this far, because of the culture in that office. There are individual examiners who would have caught this, even inside a weak field office, because of their experience and the care they bring to the work. I can name several states where this wouldn’t have gotten this far. And I can think of states where something like this is probably brewing right now.
Part of what enables it is the drift toward principle-based examination. I believe in principle-based examination as a concept. But when you stop being prescriptive about what your expectations are, you create an environment where everyone gets to make up their own rules about what can and cannot happen. That ambiguity is where problems take root.
The CU Daily: In your experience, what is necessary to pull off this kind of alleged embezzlement?
Treichel: Think of it through the fraud triangle — pressure, opportunity, and rationalization. Opportunity is the one a credit union actually controls, and it’s the one that failed here.
Opportunity means concentrated authority with no compensating control. One person signing the filings and holding wire authority. No independent reconciliation of cash and corporate accounts to source statements. A small shop where “we’ve always trusted her” substitutes for separation of duties. That’s the soil this grows in.
Pressure and rationalization you usually can’t see from the outside, and frankly neither can the examiner. The alleged spending here — millions in credit-card payments, $3.3 million in jewelry and handbags, a Tiffany wire, a Mercedes, a Porsche, a Tesla, multiple properties, and a $129,000 Steinway — points to a lifestyle that needed feeding.
The CU Daily: In your experience, and acknowledging you may not be familiar with the specifics of the case, what should examiners have identified?
Treichel: Remember the line of defense is Internal controls, separation of duties, then the supervisory committee, and their hired auditor, then the exam relies upon all of that to determine their scope. The cause was theft, not a missed exam step. But that is a fair question, and the Inspector General’s material loss review will run them down.
With 20/20 hindsight, it is easy to say the balance sheet screamed something was wrong. About $162 million in assets, a reported 9.2% net worth, but only 28% of assets in loans, roughly 66% in cash on deposit at other institutions, and $41 million in non-member deposits the institution had no apparent need for. When a credit union borrows money it doesn’t need and parks two-thirds of itself in cash, the question writes itself: why?
NCUA is heading into an era of budget cuts and fewer examiner hours. Less is not more when it comes to ferreting out fraud. The IG will look at when NCUA first became aware and how it responded, and will also make findings on changes to the exam process that NCUA will have to address.
The CU Daily: NCUA’s lawsuit alleges the defendants were leading extraordinarily extravagant lifestyles. Is this a red flag examiners should have seen, or would they not have any reason to be aware of it? What about the board?
Treichel: Often times, the thief creates a narrative to explain their wealth and spending by saying they had an inheritance.
That being said, examiners generally have no window into how an executive spends money outside the institution. They don’t see personal credit-card statements, personal real-estate purchases, or what someone drives. So no, I wouldn’t fault an examiner for not knowing about the handbags and the Steinway. What an examiner can and should chase is inside the four walls — and here that was the unreconciled corporate cash.
The board is a different matter, and this is where lifestyle does become a fair question. Directors live in the same community. A CEO of a roughly $162 million, limited-income credit union suddenly buying jewelry by the millions, multiple properties, and a fleet of luxury cars is the kind of thing local boards sometimes notice and too often explain away — “family money,” “her husband does well,” and so on. Lifestyle is the symptom you might catch. Separation of duties is the control that would have caught the first dollar.
The CU Daily: There’s clearly board governance failure, and board ignorance, at work here. What governance practices should have been in place?
Cooley: The harder truth is that there are no broad, sweeping governance expectations in the credit union space. We have 12 CFR 701.4(b)(3), which says a director must develop at least a working familiarity with basic finance and accounting within six months, enough to read a balance sheet and an income statement and to ask substantive questions of management and the auditors. But that’s a thin standard, and it’s rarely enforced with any teeth.
Now consider the direction we’re heading. Under the current (NCUA) Deregulation Project, the NCUA board proposes to remove that requirement entirely, on the rationale that it reduces the compliance burden on volunteer boards. It doesn’t replace the requirement with any guideline or expectation. So, in the year after appointment, a director could be asked to vote on decisions that materially impact the institution without any working knowledge of accounting or finance, and without any obligation to acquire it.
That’s the point. The situation at Jackson Area FCU isn’t an anomaly. It’s a symptom of a particular regulatory posture, one that’s actively loosening the very expectations that catch this kind of thing.
The CU Daily: What happens inside of a credit union in terms of management and culture and employees when the kind of sizeable embezzlement alleged here takes place?
Treichel: It’s traumatic, and it lands hardest on people who did nothing wrong. The staff trusted a leader who allegedly used the place as a piggy bank. There’s anger, embarrassment, and real fear about jobs, because conservatorship and a forced merger usually mean consolidation and layoffs.
There’s also almost always more than one person who sensed something. The complaint alleges the scheme traces back to 2015, yet the CEO didn’t hold that role that long, so my read is that someone else at the institution likely had visibility into pieces of it.
In these cases, you typically find a few employees who saw an odd entry or an override and didn’t feel safe raising it — which is itself a culture issue. The reconciliation that should have caught it was either skipped or controlled by the very person committing the fraud, and the culture didn’t give anyone a safe channel to pull that thread.
Then there’s the cleanup. NCUA steps in as regulator, insurer, and board all at once, and sells the credit union to whomever offers to buy it at the least cost. Members who relied on the credit union get absorbed into an acquirer. The whole thing is a reminder that fraud isn’t just a dollar figure on a call report — it’s a community asset that took decades to build, gutted by one or two people.
The CU Daily: What will NCUA need to do to get another credit union to merge in JAFCU, assuming it must be merged?
Treichel: NCUA is already shopping JAFCU. Each interested credit union submits a package saying what they want to buy and for how much. NCUA is required to pursue the least cost alternative.
The CU Daily: If the allegations are true, what is your estimate of the potential loss to the insurance fund?
Treichel: My estimate is $70 to $80 million cost to the fund. The restated call report recognized a $91.7 million loss and cut cash by $93.6 million, swinging net worth from positive 9% to negative 107%. That deficit is partly offset by what can be recovered.
Three recovery buckets matter. The fidelity bond is one. A fraud of this kind exceeds the bond limit, because the real loss includes dividends paid on the stolen money over years, and you can’t recover phantom dividends from a bond. My expectation is the bond claim covers $4 or $5 million, not the $70 to $80 million figure.
The second is asset recovery from the defendants: the houses, the cars, the jewelry, the piano. Some of that is recoverable, though forced-sale values rarely match purchase prices, and lawyers and time eat into it.
The third, depending on what the engagement actually covered, is a potential claim against the CPA firm if the agreed-upon procedures should have caught the phantom cash. None of these three makes the fund whole, but together they take the edge off the gross number.
Ironically, this loss erases much of the savings from NCUA’s recent reorganization. One loss this size won’t move anyone’s insurance premium. But stack a handful of these against a growing industry and the fund math eventually points toward a premium. I wouldn’t sound an alarm on that yet but it’s coming someday.
The CU Daily: As you look at this fraud and others like it, what other thoughts do you have?
Treichel: If you want to eliminate fraud like this, require a CPA opinion audit for all credit unions. If you don’t want that, require positive confirmation of all investments held at outside institutions. A shrinking NCUA footprint is a good thing in some ways in the short term, but in the long term creates more opportunity for theft without a strong audit rule.
Cooley: A few things worth putting on the record.
First, this is not a one-off. Money goes missing in credit unions, in larger amounts than people realize, with varying levels of sophistication. It goes missing during core conversions and the related processes around them. The Jackson Area case is dramatic, but the underlying pattern is not rare.
Second, the data already tells the story. The NCUA’s own Office of Examination and Insurance reviewed failure postmortems and material loss reviews from the back half of the last decade. Poor internal controls were cited in 12 of the 16 failed credit unions they examined, and 13 of the 16 cited fraud as a contributor, almost all of it insider fraud. The report named exactly what was missing: strong internal controls, periodic review of those controls, and consistent enforcement of them.
Now hold that finding against the direction of the Deregulation Project. Despite that record, the proposal would let every credit union define internal controls as it sees fit and would strip the prescriptive elements out of the internal-control definition that Part 715 relies on, the same kind of definition the OCC and the FDIC still hold their institutions to. So, at the moment the agency’s own research says weak controls are killing institutions, the rulemaking would loosen the very standard that defines what a control is. That’s the contradiction I keep coming back to.
An All-Time Low
Third, account reconciliation hygiene is at an all-time low across the industry, and it isn’t an accident. We aren’t required to follow proper internal audit procedures. The agreed-upon-procedures loophole lets an institution commission a narrow engagement that looks like an audit but tests almost nothing. In a case like Jackson Area, the reconciliation process had to be in shambles for this to run as long as it did, and I’d want to understand what the audit firm was actually engaged to do.
Last, watch what happens on accountability. It will be telling whether the NCUA tries to excuse the directors from gross negligence and reach for the directors’ liability insurance, rather than naming the governance failure for what it was. How the agency handles that will say more about the regulatory posture than any rule on paper.
