This week, National Credit Union Administration (NCUA) Chairman Todd Harper will testify before Congress alongside other federal financial regulators. Throughout his tenure as Chairman, Harper has used these semiannual hearings – as well as NCUA Board meetings and other public forums – as opportunities to spotlight a glaring regulatory gap that puts the credit union system and its 140 million members at serious risk.
Unlike federal banking regulators, the NCUA does not oversee third-party service providers. As Harper noted in his June 2024 message accompanying the NCUA’s Cybersecurity and Credit Union System Resilience Annual Report to Congress, “compromises within third-party services have led to systemic risks across the credit union ecosystem” and threaten “the nation’s critical economic infrastructure and national security.”
At the NCUA’s Annual Cybersecurity Update Briefing last month, officials disclosed that credit unions reported 1,072 cyber incidents between September 1, 2023, and August 31, 2024. Alarmingly, 742 of those incidents involved third parties.
Chairman Harper underscored the severity of this regulatory blind spot: a recent “incident disrupted the daily operations of 60 credit unions” and “approximately 90 percent of the industry’s assets are managed by third-party service providers with no NCUA oversight.”
Despite encouraging comments from Harper about support for restoring the NCUA’s third-party vendor examination authority among state and regional credit union leagues and officials, credit union lobbyists continue to oppose such efforts. Although they cite cost as their primary concern, industry representatives also assert that such oversight is duplicative as other regulators have examination authority and could ostensibly share their findings with the NCUA, though it’s unclear whether that would work in practice.
Earlier this year, a former lawmaker affiliated with a firm that lobbies for credit union interests and the leader of a trade group that represents credit union service organizations (CUSOs) said “Congress should be skeptical of any attempts to pull focus away from NCUA’s core mandate of ensuring safe and sound operation environments, and lawmakers certainly should be concerned with new attempts at overreach that dilute its work.” Interestingly, the NCUA’s lack of third-party oversight extends to CUSOs, which “are wholly or partly owned by credit unions and provide financial support services for credit unions and their members.”
A recent joint investigation by the NCUA and Consumer Financial Protection Bureau (CFPB) demonstrated how this opaqueness can harm consumers. In a consent order, the CFPB detailed one growth-oriented credit union’s violations of the Consumer Financial Protection Act and its inadequate due diligence of a vendor tasked with converting its mobile and online banking platforms.
In fact, the multi-billion-dollar credit union invested $20 million in the CUSO, a member of the CUSO trade group, “in the hope that the virtual banking platform project would demonstrate the Vendor’s services to other financial institutions and lead to the creation of products and services” that the credit union and CUSO “could sell to others.”
The regulatory blackhole for CUSOs and other third-party vendors imperils the $2.3 trillion credit union system, its 140 million members, and the nation’s “critical financial infrastructure,” warned 4 former NCUA Chairs who support alignment with banking regulation as it relates to third-party vendor authority. They also noted that “the NCUA’s Inspector General, the Financial Stability Oversight Council, and the Government Accountability Office” support Chairman Harper’s legislative request to rectify this situation.
As the 118th Congress and Harper’s term as NCUA Chairman near their conclusion, the need for third-party vendor and CUSO examination authority has never been clearer. Policymakers should heed Chairman Harper’s advice and act before it’s too late.
