The National Credit Union Administration held its seventh open meeting of 2024 on October 24, during which they received briefs from three departments: the Office of Examination and Insurance, the Office of the Executive Director, and the Office of Credit Union Resources and Expansion.

Cyber incidents involving third parties a concern

The former two provided a report on cybersecurity and hacking economics, as well as a program briefing from the Information Security Examination program. Per the briefing, since the cyber incident notification went into effect in September 2023, credit unions have reported over one thousand reports, with nearly 70% stemming from the use or involvement of a third-party vendor. The rule requires federally insured credit unions to report cyber incidents within 72 hours of detection.

In the past, the NCUA has argued that it should have more direct oversight of CUSOs and other third parties as they relate to credit union operations, citing threats to credit union security. Said Chairman Todd Harper: “Far too often, we see that third-party service providers are a weak link in the financial system, a danger noted in the most recent Annual Report of the Financial Stability Oversight Council. And credit union third-party service providers are no exception.”

Vendor management and due diligence continues to be a key part of ensuring good cybersecurity, with the NCUA stressing the importance of reviewing vendor relationships, as well as assessing and mitigating potential risk vectors. Harper also recently published a letter to credit unions on “Board of Director Engagement in Cybersecurity Oversight” in which he addressed recent development in cyberattacks, the need for recurring training, a reminder to boards to approve an information security program, and a reminder on the responsibilities of the board with respect to operational management.

NCUA’s chartering process has improved, but needs more work

These briefings were followed by the Office of Credit Union Resources and Expansion’s (CURE) report on the agency’s efforts to modernize and improve the chartering system.

NCUA has long been criticized for creating a chartering process that makes it an uphill climb from the get go for interested organizations and communities to establish a new credit union, with steep capital requirements, early limitations on available services which make it hard to establish firm roots, and a lengthy application process both in time and materials needed. In recent years, however, NCUA has been making strides to streamline the process, with success already seen.

Although not a massive increase in the number of new federal charters, in the last four years the NCUA has approved 14 new FCUs (and 1 FISCU)—the three years prior to that (2018-2020) saw only 4 new federal charters. The amount of time for a charter to be approved has also decreased, though 2024 saw a slight bump.

Said Harper of the efforts: “The NCUA has made meaningful strides during the past four years in facilitating the chartering process so that organizers can pursue their visions of people helping people. Welcoming a new credit union into the system of cooperative credit is good not only for the system but also for the consumer, many of whom have been unbanked and underserved for far too long.”

In 2023, the NCUA established a Provisional Charter Concept to address the challenges to start-up capital, giving the de novo 12 months to secure necessary capital as a legal entity with limited services. Of the four pilot credit unions, two have been approved with provisional charters including Tribe FCU and Fair Break FCU.

Vice Chairman Hauptman spoke on the efforts that have been made by CURE and the NCUA, noting how all start-ups start small, and the risk to NCUA is limited, calling it a “rounding error” compared with the changes in the largest credit unions.

He added, “To me it’s an inclusion issue. If we’re making it hard for any group of Americans to decide to have their own financial service provider, we are only paying lip service to all the words like “financial inclusion” and everything. And for over ninety years forming a credit union has been the answer to financial inclusion. Hundreds of thousands of immigrants, religious groups, factory workers, or more—Americans should decide how many financial service providers we have. Every single one of the charters ever granted, it was somebody out there who wasn’t totally satisfied with the existing financial services marketplace.”

He went on to say how the first 3,000 credit unions formed prior to the 1934 Federal Credit Union Act had the benefit of not having to go through Washington to get something done, make it easier and faster to get established. By comparison, today’s application process continues to be a sticking point for Hauptman, stating that if there’s never a completed application because the process is so difficult, there’s never going to be the data to show how many opportunities were actually lost. And so though he lauded the work being done, he warned that there is still room to grow for NCUA.