What's the Dilly-o with bill pay & P2P: a buyer's guide for credit unions

The Dilly-o

For most credit unions, we'd start with the bill pay and person-to-person (P2P) payments your digital banking platform already offers, then judge them on fraud controls. Scams, claims and exit terms are where the real risk sits, so ask about those before you ask about screens. Think of fraud screening as the moat and your contract's exit terms as the drawbridge, and you want both in place.

How we'd size up a vendor

1. Scam screening - does the vendor flag payments a member authorizes under pressure, not just stolen logins? Ask to see how it scores a first-time payee, a large amount or a rushed transfer.
2. Platform fit - does the service run natively inside your digital banking platform, or does it hand members off through single sign-on (SSO)? We'd ask the vendor to show a member paying a bill and sending money in a live demo.
3. Claims support - what data and tools will the vendor give your team to work Regulation E disputes? We'd also ask how fast that data reaches your team once a member files a claim.
4. Exit terms - can you leave for cause and for convenience, and what will deconversion cost you? Get the answer in writing before you sign, while you still have leverage.

What changed this year

Nacha's second phase of fraud monitoring rules took effect in practice on Monday, June 22, 2026, because June 19 was a federal holiday.² Nacha says the rules are neutral on the methods or technologies used.³ Covered participants must review their processes at least annually.⁴⁵ On the instant rails, RTP's per-transaction limit rose from $1 million to $10 million effective February 9, 2025.⁶ FedNow raised its network limit to $10 million effective November 2025.⁷ Meanwhile, the CFPB's December 10, 2024 rule to supervise large payment apps is gone, repealed on May 9, 2025.⁸⁹

Will it work with your systems?

Check your digital banking platform first, because it may already cover bill pay and P2P. Jack Henry's technology guide lists iPay Consumer Bill Pay and the Payrailz Digital Payments Platform.¹⁰¹¹ Alkami's partner listing for Jack Henry names Payrailz bill pay and P2P, plus Zelle through SSO.^C Alkami also lists Neural Payments for P2P and Paymentus for bill pay among its partners.¹²¹³ Lumin Digital partnered with Alacriti to integrate Orbipay loan payments.¹⁴ Ask your provider which bill pay and P2P options run natively on your platform today, and which need a separate login.

What other credit unions did

CCU moved members to CheckFree's new bill pay, closing the old system on August 17 and opening the new one on August 19.¹⁵ Members didn't have to re-enroll but did have to accept new terms and conditions.¹⁶ First South Financial Credit Union in Bartlett, Tennessee, chose Lumin Digital for digital banking plus bill pay.¹⁷ Beacon Credit Union warned members about a fake "Fraud Department" telling them to set up Zelle or download Cash App.¹⁸ When Fiserv went down, Navy Federal was among the credit unions hit, and the credit union takes the blame when the vendor fails.¹⁹²⁰

What your examiner will ask

NCUA didn't issue the 2023 interagency third-party guidance, so it doesn't formally bind credit unions.²¹ A newer proposal, joined by NCUA, includes insured credit unions and would replace the 2023 guidance if finalized.²²²³ Consider a Jacksonville, Florida credit union that used a new, untested vendor for its banking platform and never provided proper vendor oversight.²⁴ Its development team warned against a rushed conversion, but the launch went ahead.²⁵ Have your vendor due diligence, contract incident-notice terms, Reg E claim procedures and annual Nacha monitoring review ready to show.

What it costs

Plan on asking each vendor for a written quote. On the member side, Associated Credit Union offers 30 free bill payments a month, then $0.50 per item, and $5 a month if no bills are paid.²⁶ NCUA notes that early termination, escape clause and default terms are often negotiable.²⁷ Early termination fees sometimes reach seven figures.²⁸ Vendors may also pull back earlier incentives and add deconversion and data migration charges when you leave.²⁹

Food for thought

Corporate One said in February 2026 that real-time payments are not inherently higher-risk than legacy rails.³⁰ We agree, and we think the next question is whether your P2P vendor's scam screening works the same on instant rails as on ACH.