What's the Dilly-o with compliance management: a buyer's guide for credit unions

The Dilly-o

We'd buy a tool that tracks regulatory change and keeps examiner-ready evidence, sized to your credit union rather than to a large bank. The NCUA says the depth of each part of a compliance management system (CMS) varies with a credit union's size and complexity.⁵ So we'd size the tool to what your team can keep current.

How we'd size up a vendor

1. Regulatory change tracking - does the tool flag a new rule and show which of your policies it touches? Ask the vendor to walk you through how its tool handled one recent rule change.
2. Examiner-ready evidence - can the tool show an examiner what changed, who reviewed it and when? Ask for a sample exam package from a credit union of your size.
3. Fit to your size - does the vendor scale its setup to a credit union of your size, or sell you a large bank's program? Ask which modules you can leave off, and what that does to the price.
4. Third-party oversight - does the tool help you track your own vendors' due diligence, contracts and reviews? Ask how it stores contract terms and flags a review that is overdue.

What changed this year

The NCUA's interim final rule clarifying federal credit unions' power to charge non-interest fees, including interchange fees, took effect June 30, 2026.⁶ Earlier, on February 10, 2026, a court ruled that the Federal Credit Union Act did not preempt the core of Illinois' Interchange Fee Prohibition Act.⁷ FinCEN's proposed reform of anti-money laundering (AML) program rules covers credit unions, and its comments closed June 9, 2026.⁸⁹ FinCEN has set no date to finalize it, and it would take effect 12 months after a final rule.¹⁰¹¹ The Consumer Financial Protection Bureau (CFPB) sent a new open banking proposal for review on August 6, 2026, and it was still under review in October.¹²¹³ Several of these are still proposals, so we'd ask each vendor whether its tool tracks proposals and comment deadlines too.

Will it work with your systems?

We haven't yet reviewed how any compliance management vendor fits a specific core.^C Until we do, ask your digital banking and core providers what compliance checks they already run, so you don't pay twice for the same control.

What other credit unions did

In May 2026, the OCC acted against a New York-based bank whose payment-processing activity had grown since 2020 while its controls did not keep pace.¹⁴ The CFPB faulted a financial institution for a rushed core conversion.¹⁵ It had tried to launch a new online and mobile banking platform on a new, untested core hosting provider.¹⁵ Our takeaway: your compliance program has to grow with every new product and vendor change.

What your examiner will ask

NCUA examiners look at your commitment to the CMS, your change management, and whether you find and fix your own problems.¹⁶ They also check whether management does ongoing due diligence and oversight of third parties.¹⁷ So have your change log, fix-it records and vendor reviews ready to show.

What it costs

Pricing and implementation times for these vendors are not public, so ask each one for a written quote and timeline. The NCUA lists terms a vendor contract should cover, including service levels, audit rights, data security, termination and escape clauses.¹⁸ It also warns that some credit unions signed contracts with steep buyout penalties, and that termination and default terms are often negotiable.¹⁹ Negotiate those terms before you sign, not at renewal.

Food for thought

The new third-party proposal drops the checklist of contract terms and does not list expected terms.²⁰ So a compliance tool that records why you chose each term will help when an examiner asks.