Credit Unions
Your examiner cannot audit your AI vendors. So they audit you.
Core processors, digital banking platforms, and lending tools are adding AI features faster than most credit unions can review them. Bank regulators can examine those vendors directly. NCUA cannot. That leaves the credit union as the only place the oversight can happen, and the only party an examiner can hold to account for it.
The Oversight Gap
Banks have a backstop. Credit unions do not.
The Bank Service Company Act lets the OCC, Federal Reserve, and FDIC examine the technology companies that serve banks. NCUA had similar authority over credit union vendors only temporarily, and it expired at the end of 2001. NCUA has asked Congress to restore it for years; Congress has not.
In May 2025 the Government Accountability Office named two gaps in NCUA's oversight of credit union AI: no authority to examine technology service providers, and model risk guidance that is narrow in scope and detail. The same limit applies to CUSOs. A credit union that invests in or buys from a CUSO has to verify the CUSO's AI governance itself.
In practice, NCUA supervises your vendors through you. You can outsource a function. You cannot outsource the accountability for it.
What Stays With You
The vendor builds the model. The obligations are yours.
Fair lending
If a vendor's underwriting or pricing model produces disparate impact, the ECOA and Regulation B exposure belongs to the credit union that made the loan, not the vendor that built the model.
Adverse action reasons
A denial needs specific, accurate reasons. A model whose outputs cannot be explained leaves you unable to send a compliant adverse action notice, however accurate the model is.
Member data
Part 748 and GLBA obligations follow member information into every vendor system that touches it, including any use of that data to train a vendor's models. A reportable cyber incident at a vendor still starts your 72-hour clock to notify NCUA.
Board and management oversight
Examiners judge vendor oversight through your own program: the due diligence on file, the contract terms you negotiated, and the monitoring you can show. Weak AI vendor oversight reads as a management finding.
Most credit unions rely on a small number of core platforms, and few have the leverage to negotiate custom audit terms or inspect a vendor's model. That makes a consistent due diligence file more valuable, not less: it is what you can show when the vendor will not open the box.
What We Review
Five questions for every AI vendor.
Our AI Vendor Risk Assessment answers these for each tool, records the evidence, and builds on NCUA's existing third-party due diligence guidance (Letters 01-CU-20 and 07-CU-13). The result is a file your board can approve and an examiner can follow.
Model validation and explainability
Whether the model has been independently validated, how it behaves on your membership, and whether it can produce adverse action reasons that hold up under ECOA and FCRA.
Bias and fair lending testing
Evidence of disparate impact testing before deployment, and a vendor process for monitoring drift and proxy variables after it.
Data governance
Where member data is stored, whether it is segregated from other clients, and whether the contract prohibits the vendor from training shared models on it.
Contractual audit rights
The right to review model documentation, logs, and independent audit reports such as a SOC 2 Type II, and to make them available to NCUA examiners on request.
Human review and fallbacks
Which decisions require a person to sign off, and what happens when the model fails, drifts, or goes offline.
How We Work
Sized for a credit union, not a national bank.
We start with an inventory of the AI already running in your credit union, including features your core and digital banking vendors switched on in recent releases. Each tool is tiered by how it touches members: convenience, data processing, or decisions about credit and accounts. Diligence is weighted to match, so a meeting-notes tool does not get the same review as an underwriting model.
Every engagement is a fixed fee, set in writing after a scoping call. Where you need a standing program, we build AI governance and model risk management to match your size, with the inventory, policy, and board reporting an examiner expects to see.