For credit unions, third-party risk management is no longer a back-office task. It is a top examination priority. Core processors, digital banking platforms, card processors, loan origination systems, and fintech partners now sit at the center of member service, and each one creates risk that the credit union is ultimately responsible for managing.
This guide explains what the NCUA expects from a credit union vendor management program, which guidance applies, and how to build a third-party risk management program that stands up to examiner scrutiny.
Why Third-Party Risk Is a Top Priority for Credit Unions
The numbers make the case. In its cybersecurity report to Congress, the NCUA found that roughly 73 percent of cyber incidents reported by credit unions between September 2023 and May 2024 involved a third party. Vendor-related incidents are now the most common cyber event credit unions face.
At the same time, the NCUA does not have the authority to examine third-party vendors directly. Unlike federal banking regulators, which can examine technology service providers, the NCUA’s vendor authority expired in 2001, and NCUA leadership has repeatedly asked Congress to restore it. The practical result is simple: the burden of vendor oversight falls on each credit union, and examiners look closely at how well you carry it.
What Guidance Governs Credit Union Vendor Management?
Credit union third-party risk management is shaped by several regulations and supervisory letters. The most important are:
- NCUA Letter to Credit Unions 07-CU-13, “Evaluating Third Party Relationships.” The foundational NCUA guidance. It sets expectations for risk assessment and planning, due diligence, and risk measurement, monitoring, and control across the vendor lifecycle.
- NCUA Letter 08-CU-09, “Evaluating Third Party Relationships Questionnaire.” A companion questionnaire that illustrates what examiners may ask about your vendor program.
- NCUA Letter 01-CU-20, “Due Diligence Over Third Party Service Providers.” Early guidance on due diligence for technology and service providers that remains relevant.
- 12 CFR Part 748, Appendix A. Implements the Gramm-Leach-Bliley Act (GLBA) safeguards requirements and explicitly requires credit unions to oversee service provider arrangements that involve member information.
- The NCUA cyber incident notification rule (12 CFR 748.1(c)). Since September 1, 2023, federally insured credit unions must notify the NCUA within 72 hours of reasonably believing a reportable cyber incident has occurred. This includes incidents at a third party. When a vendor tells you it has been compromised, the clock can start when you receive that notice.
- The FFIEC IT Examination Handbook. Examiners use the FFIEC booklets as reference standards for technology and vendor oversight.
- The 2023 Interagency Guidance on Third-Party Relationships. Issued by the OCC, Federal Reserve, and FDIC, this guidance does not formally bind credit unions, but it is widely treated as the industry best-practice model for the third-party risk management lifecycle.
What NCUA Examiners Look For in a Vendor Management Program
Examiners generally want evidence that your credit union’s third-party risk management program is risk-based, documented, and actively operating. Expect questions on:
- A complete vendor inventory identifying critical vendors and the member data each can access.
- Risk assessments that justify each vendor’s risk rating and the level of oversight applied.
- Due diligence files that include security reviews, SOC reports, business continuity plans, and financial condition analysis for critical vendors.
- Contract provisions covering data security, incident notification timelines that support your 72-hour obligation, audit rights, subcontractor use, and termination and data return.
- Ongoing monitoring, especially for long-standing vendors whose documentation has gone stale.
- Board and management reporting showing that leadership understands and oversees vendor risk.
- Payment and digital services vendors, including processors, real-time payments providers, and fintech partners, which continue to draw examiner attention.
How to Build a Credit Union Third-Party Risk Management Program
Step 1: Establish policy and ownership
Adopt a board-approved vendor management policy that defines roles, risk tiers, due diligence requirements, and reporting. Assign a clear program owner.
Step 2: Inventory and tier every vendor
List every third party, then tier each by the sensitivity of member data involved and the operational impact of a failure. Your core processor, digital banking provider, and card processor will almost always be critical.
Step 3: Perform risk-based due diligence
For critical vendors, review SOC 2 Type II or SOC 1 reports, information security and business continuity programs, insurance coverage, and financial health. GAAP-based financial assessments help identify vendors at risk of failure before a disruption reaches your members. For your highest-risk relationships, on-site assessments provide a level of assurance that questionnaires cannot.
Step 4: Strengthen contracts
Make sure contracts require prompt incident notification, give you the right to audit, restrict subcontracting without notice, and require the return or destruction of member data at termination.
Step 5: Monitor continuously
Reassess critical vendors at least annually, track SOC report exceptions and remediation, and watch for breaches, financial deterioration, and ownership changes between reviews.
Step 6: Report and plan for disruption
Report vendor risk to the board regularly, and maintain exit and contingency plans for critical vendors. See our approach to responding to vendor disruptions.
How Smaller Credit Unions Can Meet NCUA Expectations
Smaller credit unions face the same expectations as larger institutions but with far fewer staff. Hiring dedicated vendor risk analysts is often out of reach, and TPRM software still requires someone to review every response and report. An outsourced, analyst-driven model gives smaller credit unions examiner-ready documentation and expert review without adding headcount. Learn how Continuiti helps institutions with meeting regulatory expectations.
Frequently Asked Questions About Credit Union Vendor Management
Does the NCUA require credit unions to have a vendor management program?
Yes. NCUA guidance, including Letter 07-CU-13, and the GLBA safeguards requirements in 12 CFR Part 748, Appendix A, expect credit unions to perform due diligence on and oversee their third-party service providers. Examiners review vendor management as part of the examination process.
Does the 2023 interagency third-party guidance apply to credit unions?
Not directly. The guidance was issued by the OCC, Federal Reserve, and FDIC. However, it reflects current best practice, and many credit unions use it as a framework for their programs.
Can the NCUA examine a credit union’s vendors?
No. The NCUA currently lacks third-party vendor examination authority, which is why credit unions are expected to conduct thorough oversight themselves.
Do vendor cyber incidents count toward the NCUA 72-hour reporting rule?
Yes. A reportable cyber incident at a third party that affects your credit union can trigger the 72-hour notification requirement, so vendor contracts should require prompt notice of incidents.
How often should credit unions review critical vendors?
Critical vendors should be reviewed at least annually, with ongoing monitoring between formal reviews. Lower-risk vendors can be reviewed less frequently based on your risk assessment.
Make Your Vendor Program Examiner-Ready
Continuiti Solutions provides full-service vendor risk management for credit unions, combining experienced analysts with our GRC Pro portal at no additional cost. Contact us to see how we can help your credit union strengthen third-party risk management before your next exam.
New to vendor risk? Start with our guide to third-party risk management for small and mid-sized businesses.
This article is for general information and is not legal advice. Consult your compliance team or counsel about your credit union’s specific obligations.
