Credit union regulator: lack of third-party oversight ‘Achilles’ heel’

National Credit Union Administration Chairman Todd Harper said his agency’s lack of oversight of credit union service organizations is an Achilles’ heel for the credit union system.

Details: Speaking at the Brookings Institution in Washington, Harper said credit unions are increasingly outsourcing activities that are fundamental to the credit union mission—such as loan origination, lending services, BSA/AML compliance, and financial management—to CUSOs and other third-party providers.

Atlanta Fed Report: The Federal Reserve Bank of Atlanta raised concerns about the lack of NCUA third-party oversight in a recent report following a series of ransomware attacks on credit unions last year. The Atlanta Fed noted that while banking agency guidance states that use of third parties does not diminish banks’ responsibility to operate safely and soundly, the NCUA’s temporary authority over third-party vendors expired in 2001.

ICBA View: As ICBA has testified before Congress, it supports allowing the NCUA to directly examine and regulate CUSOs, core providers, and other third-party providers. During the 117th Congress, a bipartisan group of senators introduced ICBA-supported legislation to grant the NCUA such authority, as recommended by the Government Accountability Office, Financial Stability Oversight Council, and NCUA Inspector General.

Grassroots Resources: Community bankers can use ICBA’s Be Heard grassroots action center to call on their members of Congress to hold a hearing on the NCUA’s lax oversight. Additional resources on credit union policy are available on the ICBA website.