What's the Dilly-o with AML & transaction monitoring: a buyer's guide for credit unions

The Dilly-o

We'd begin with two checks: your alert thresholds, and how well you monitor automated clearing house (ACH) payments your members receive. We'd shop for a new vendor only if your current one can't show a documented tuning history and an audit trail your examiner can follow.

How we'd size up a vendor

1. Tuning ownership - after go-live, who adjusts the thresholds: your team, the vendor's professional services or a managed service, and what does each cost? Ask to see how the system records a threshold change and who approved it.
2. Coverage - do the scenarios match the risks in your own Bank Secrecy Act (BSA) risk assessment, including ACH credits your members receive? Ask the vendor to map its default rules to your products, members and geographies, and to name the gaps.
3. Data readiness - can the vendor take a clean feed from your core, and will it test on six to twelve months of your own history? A proof of concept on your data shows the alert volume your staff will face before you sign.
4. Audit trail - can an examiner follow every alert from trigger to decision to filing without asking your staff to rebuild it? Ask whether the system files SARs with FinCEN electronically and logs who closed each alert and why.

What changed this year

Phase 2 of Nacha's fraud monitoring rule applies to all other receiving depository financial institutions (RDFIs), the ones Phase 1 did not capture.⁴⁵ Its formal date was June 19, 2026, a federal holiday, so the practical date was Monday, June 22, 2026.⁶ Nacha says the rules are neutral on which methods or technologies you use.⁷ You must also review your processes and procedures at least once a year.⁵ On SARs, FinCEN has said you don't have to document a decision not to file.⁸ FinCEN and the agencies have proposed an effective date of 12 months after final rules are issued.⁹ We'd use any time saved on paperwork to check how well your monitoring catches fraud on payments your members receive.

Will it work with your systems?

We've confirmed that Signzy and Temenos appear on Jack Henry's Fintech Integration Network for Symitar credit unions.^C We've also confirmed that Unit21 is a Corelation preferred partner for Keystone.^C Ask your core provider which AML vendors already pull its transaction data in production. Then ask each finalist to name credit unions on your core that run its software.

What other credit unions did

FinCEN assessed a $15 million penalty against a community bank with as few as 15 branches.¹⁰ An OCC order shows one pattern: a bank grew its payments business without matching controls, left thresholds untuned and auto-closed alerts that needed human review.¹¹

What your examiner will ask

An NCUA inspector general audit found that only 5 of 30 examinations tested included an assigned BSA subject matter examiner.¹² On vendors, a proposed update to third-party guidance would let you proceed with a vendor that won't share all you ask for.¹³ You'd need to understand the risks, and the residual risk would have to fit your risk appetite.¹³

What it costs

Most vendors don't publish prices, so expect a quote. One buyer's guide calls data readiness the biggest schedule risk.¹⁴ The same guide advises getting implementation timelines in writing.¹⁵

Food for thought

Before you hand alerts to an agent, decide who sets its thresholds, which alerts a person must still see and how you'll show that trail to your examiner.