What's the Dilly-o with account & income data: a buyer's guide for credit unions

The Dilly-o

Pick a provider that covers your members' payrolls and banks, gives a fallback when a login fails, and plugs into your core and loan system. We'd also ask for a contract term that lets you revisit the choice if the open banking rules change.

How we'd size up a vendor

1. Coverage - does the provider reach the payroll systems and small banks and credit unions your members use? Ask for connection success rates on your own member mix rather than a national average.
2. Connection method - does it use direct bank and payroll connections, or does it ask members for their passwords? We'd favor direct connections and ask the vendor to show how often each kind of connection fails.
3. Data handling - where does your members' data live, how long is it kept, and who can see it? Get the answer in writing, because this vendor holds member information on your behalf.

What changed this year

The CFPB began rethinking the open banking rule with an advance notice in August 2025.³ From June 19, 2026, a different rule reaches receiving institutions not covered by its first phase.⁴ They must run risk-based processes that identify credit entries initiated due to fraud.⁴ That date fell on a federal holiday, so the practical start was Monday, June 22.⁵⁴ The rule does not require checks before posting.⁵⁴

Will it work with your systems?

In this category, we have reviewed core fit for Blend and MX on Symitar and for no other vendor.^C Ask your core and digital banking provider which account and income data vendors they already connect to, and whether that link reaches your loan origination system.

What other credit unions did

We'd look for lessons in what happened at other vendors that held member data. Suffolk, Fairwinds and IRCO Community FCU were among the credit unions that disclosed the auditor Mercadien held their members' data.⁶ People suing Mercadien asked to see its contracts and indemnification agreements with clients.⁶ Blaze Credit Union said it planned to pursue legal options to hold its vendor Marquis accountable after a breach.⁷ We'd read the indemnity clause in any data aggregator contract before you sign.

What your examiner will ask

NCUA's security guidelines apply to member information maintained by or on behalf of federally insured credit unions.⁸ Each credit union should report to its board or a board committee at least once a year.⁹ Under the Fair Credit Reporting Act (FCRA), a credit union without another permissible purpose may get the consumer's written authorization to obtain a report.¹⁰ Have ready your vendor due diligence file, the member consent screens, and a note from compliance on whether each report counts as a consumer report.

What it costs

Expect to negotiate pricing in this category. Equifax's employment verification guide says verifiers pay a transactional fee.¹¹ One industry review says MX contracts typically start at $25,000 to $50,000 a year, plus per-connection fees.¹² Another says Plaid's pricing is negotiated, with teams reporting minimum commitments, and a third says Truv publishes no rates.¹³¹⁴ We found no public figures for time to implement, so ask each vendor for a dated plan and push back on minimums you may not hit.

Food for thought

NCUA warns that emerging agentic AI lets attackers operate at greater scale with less human effort.¹⁵ We'd ask any vendor in this category how it will tell a member's own AI assistant from an attacker's tool.