Third-party risk is a member experience problem — and in 2026 it became the credit union's problem alone
The Tightrope Walk, Part 2 of 4
In July 2026, a service provider used by the overwhelming majority of U.S. credit unions identified a cybersecurity incident and proactively shut down its own network to contain it.[1]
What followed is worth studying. Credit unions lost access to insurance and protection products they deliver to members through that provider. Members were locked out of accounts, including retirement accounts. Claims for guaranteed asset protection, mechanical repair coverage, and payment protection stalled with no clear resolution date. Within two days, a credit union filed a proposed class action on behalf of every institution that had entrusted the company with confidential data. More suits followed. Three weeks after the disclosure, the provider was still working toward full recovery.[1]
The credit unions involved had done nothing wrong. For this purpose, their own security postures were irrelevant.
I want to be precise about what is established and what is not. The provider has said it would be premature to draw conclusions about the scope of the incident, including whether any data was accessed. The complaint pleads unauthorized access on information and belief and identifies no stolen data and no attacker. This was a disruption. Whether it was also a breach remains unknown.
That distinction matters a great deal legally. It matters not at all to a member who could not reach a retirement account for weeks.
The Experience Nobody Designed
Security and member experience are the same objective viewed from two angles — a claim I have made at length elsewhere in this series. Third-party risk is where that argument stops being philosophical.
A member who encounters a verification prompt is having a friction-heavy experience. A member who cannot complete a transaction at all is having no experience. And when the outage originates with a vendor, the credit union is left explaining something it does not fully understand, on a timeline it does not control, using information the vendor decides to release.
That is the structural problem. The credit union owns the member relationship and depends on a third party for the infrastructure that delivers it, which makes it accountable for an outcome it cannot produce on its own. When I hear vendor risk management described as a back-office compliance function, I think about that gap. The member does not experience a vendor. The member experiences their credit union.
This is not a rare failure mode. It is the dominant one.
The Numbers, and The Number That Disappeared
When the NCUA's 72-hour cyber incident reporting rule took effect on September 1, 2023, it produced the first reliable picture of where credit union cyber risk actually originates. The answer was not flattering to the industry's mental model.
The NCUA reported that of the 892 cyber incidents credit unions filed between September 1, 2023 and May 1, 2024, approximately 73 percent involved the use or involvement of a third party.[2] A board briefing four months later, covering the rule's first full year, put it at 742 of 1,072 incidents, or nearly seven in ten.[3]
Roughly seven out of every ten reported incidents came through somebody else's infrastructure. Not through the credit union's firewall, its endpoint controls, or its patching cadence. Through a partner.
Since then the reporting has gotten quieter, in a way that deserves attention. The NCUA's most recent resilience report, published April 30, 2026, counts 539 incidents for the year ending April 30, 2025 and states that none was systemic to the credit union system.[4] The report lists third-party service providers as one of four incident categories and flags vendor risk qualitatively among emerging threats.
It publishes no third-party percentage at all.
I have read the report. The metric that established vendor risk as a first-order concern for this industry is simply no longer in it. Anyone citing a current NCUA third-party percentage is necessarily citing 2024-vintage data, because 2024 is the last time NCUA published one.
The Authority That Was Never There, and The Hook That Just Came Out
Here is the part that most credit union executives I talk to do not fully appreciate: unlike the banking agencies, the NCUA lacks direct supervisory authority over third-party service providers. It cannot examine them. It cannot compel their remediation. When seven in ten incidents originate with vendors, the agency responsible for the safety and soundness of the credit union system has no examination authority over the source of most of the risk.
This is not a novel observation. The Government Accountability Office and the NCUA's own Office of Inspector General have both identified the gap and recommended that Congress restore the authority.[5] That legislative fix has not happened. Prior vehicles were introduced in the 117th and 118th Congresses and did not advance.
What happened instead runs the other direction. On August 5, 2026, the NCUA announced eleven final rules under its Deregulation Project. One of them removes 12 CFR 701.26. Among the provisions eliminated:
"Agreements must be in writing and must advise all parties subject to the agreement that the goods and services provided are subject to examination by NCUA to the extent permitted by law."[6]
The Board's rationale, from the proposed rule, was that the provision was unnecessary because "the NCUA's examination authority is generally limited to the products, services, and operations of the credit union, not vendors that may supply products and services," and the agency "does not otherwise require credit union vendors to provide the NCUA access to their books and records."[7]
That reasoning is accurate. The clause was largely symbolic, because the authority it gestured at was never really there. But it was the last place in the NCUA's regulations where the idea of examining a vendor appeared in writing, and it published while a service provider outage was still locking credit union members out of their retirement accounts.
Two things about this rule need to be stated plainly, because a careless reading gets both wrong.
First, this is not a clean removal. The final rule departs from the proposal by adding a new § 721.3(n) to the incidental powers rule, preserving federal credit union authority to represent other credit unions or organizations in contractual arrangements with third parties.
Second, and more important, the Board expressly reaffirmed vendor oversight expectations in the final rule preamble. Removal of § 701.26, it states, "does not alter existing expectations regarding written contracts, vendor oversight, or safe and sound third-party risk management practices." The preamble then lists what contracts should address: audit rights, information security obligations, business continuity expectations, indemnification, performance metrics, data ownership and return provisions, termination language, and dispute resolution.[6]
The NCUA did not walk away from vendor risk. Anyone who tells you it did has not read the preamble.
But look carefully at what the Board actually said. The expectation persists. The agency's own authority to verify it does not, and never really did. Vendor oversight has moved from a regulatory requirement backed by a supervisory hook into a contractual and governance obligation resting entirely on the credit union.
That is a transfer of burden, not a reduction of one.
What This Obliges You to Do
If no external party is going to examine your critical vendors, the quality of that oversight becomes a function of what you demand and what you verify. I would treat the Board's own list as a floor.
Audit rights you actually exercise. A right to audit that has never been invoked is a clause, not a control. At minimum, obtain the SOC 2 Type II annually and have someone competent read the exceptions rather than the cover letter.
Notification timelines that permit member communication. Your 72-hour clock to the NCUA starts when you form a reasonable belief that an incident occurred. If your vendor's contract gives them ten business days to tell you, your clock and your contract are incompatible.
Continuity plans that assume the vendor is gone. Not degraded, gone, for three weeks. What can members still do? What can staff do manually? Which communications go out on day one, day three, day ten, and who signs them? An institution inventing this during an outage will invent it badly.
Concentration risk on the board's agenda. When one provider serves most of the industry, its failure is not an idiosyncratic risk to be managed institution by institution. It is a systemic exposure that every board should have named, discussed, and either accepted with eyes open or declined.
None of this is exotic, and most of it appears in the NCUA's own preamble. What changed is who is responsible for making sure it happens.
Scaling This to Your Institution
The honest problem with that list is that it describes a program a $2 billion credit union can staff and a $60 million credit union cannot.
The NCUA's regulations do not resolve that, and it is worth understanding exactly why. Part 748, Appendix A requires a written information security program with safeguards "appropriate to the size and complexity of the credit union and the nature and scope of its activities." On vendors, it directs each credit union to exercise due diligence in selection, require contractual safeguards, and, "where indicated by the credit union's risk assessment," monitor providers to confirm they have met their obligations.[8]
There is no asset threshold anywhere in Part 748. The obligation is identical at $40 million and $4 billion, scaled only by that qualitative phrase.
The contrast with the FTC's Safeguards Rule is instructive. That rule exempts institutions holding information on fewer than 5,000 consumers from the written risk assessment, the written incident response plan, penetration testing, and annual reporting to the board.[9] Federally insured credit unions get no such relief, because you are regulated under Part 748 rather than 16 CFR Part 314, and Part 748 has no counterpart carve-out.
Every asset threshold the NCUA does maintain governs supervision rather than obligation. Credit unions at or below $50 million receive defined-scope examinations instead of risk-focused ones. The $100 million line determines small-entity treatment in rulemaking. Above $500 million you are "complex" for risk-based capital purposes.[10] None of those change what your vendor program is supposed to accomplish. They change how closely someone looks.
So the scaling is real, but it happens in execution rather than in scope.
Under roughly $100 million, you will not renegotiate a core contract, and a year spent trying is a year wasted. Concentrate on what one person can actually finish: read the SOC 2 exceptions for your three most critical providers, and write a one-page manual-operations plan for a multi-week outage of each. For leverage you cannot generate alone, work through your league or a CUSO.
Between $100 million and $1 billion, contract renewal is your only real leverage point. Treat every renewal as the vendor risk program for that year and get notification timelines and audit rights into the paper then, rather than attempting to amend mid-term.
Above $1 billion, you have both the leverage and the staff for continuous monitoring and for making concentration a standing board topic. At that size, not doing it is a governance choice rather than a resourcing constraint.
The Uncomfortable Part
Security decisions are business decisions, measured against a defined risk tolerance. Vendor risk is where that framing gets uncomfortable, because the honest analysis often concludes the risk is real, material, and largely unavoidable. You cannot run a modern credit union without third parties. You will not out-negotiate a provider that serves most of the industry. And you cannot examine anyone.
What you can do is stop treating this as a compliance exercise and start treating it as a direct determinant of whether your members can reach their money next month. That is not fatalism. It is a reason to put vendor concentration, contractual leverage, and outage continuity in front of the board, in the language of risk tolerance, before the next provider shuts down its own network to contain something.
Part 3 examines who now defines an adequate security posture for a credit union, and why the answer has quietly become your board.
Sources
- Reporting on the July 2026 service provider incident, including the provider's own public statements and the filed complaint: American Banker and CU Times, July–August 2026.
- NCUA, Cybersecurity and Credit Union System Resilience Annual Report to Congress, June 25, 2024.
- NCUA Board Action Bulletin, "Board Briefed on Cybersecurity, New Charters and Field of Membership," October 24, 2024.
- NCUA, 2025 Cybersecurity and Credit Union System Resilience Report, published April 30, 2026.
- U.S. Government Accountability Office and NCUA Office of Inspector General reporting on third-party service provider authority, 2024.
- NCUA, "NCUA Board Approves 11 Final Rules Under Deregulation Project," August 5, 2026; final rule, FR Doc. 2026-16021, published August 6, 2026.
- NCUA, proposed rule, "Credit Union Service Contracts," 91 FR 9185, February 25, 2026 (RIN 3133-AF83).
- 12 CFR Part 748, Appendix A, "Guidelines for Safeguarding Member Information," Sections II.A and III.D.
- FTC Standards for Safeguarding Customer Information, 16 CFR 314.6; 86 FR 70308, December 9, 2021. Scope of covered entities at 16 CFR 314.1(b).
- NCUA, Letter to Credit Unions 26-CU-01, January 2026, and NCUA Examination Program; 12 CFR 702.103 ("complex" credit union definition); IRPS 15-1, 80 FR 57512, September 24, 2015 (small entity threshold).
The views expressed in this article reflect the author's professional experience and do not represent the official position of any specific institution.
