What's the Dilly-o with core processing: a buyer's guide for credit unions

The Dilly-o

We think most credit unions should start the next core decision long before renewal and negotiate the exit terms as hard as the price. Most core contracts run seven years, and conversion timelines range from nine to 18 months.⁴ Start late and you inherit the rushed timeline that hurt the credit union above, so build in time to test the digital banking cutover too.

How we'd size up a vendor

1. Exit terms - what will it cost to leave, and is every deconversion fee defined in writing today? Think of the contract as a drawbridge, and know who holds the chain before you cross.
2. Integration openness - can your digital banking platform and other providers connect to the core without extra fees or vendor approval?
3. Conversion track record - how many conversions has the vendor finished at your size, and what does its test plan look like? We'd ask for references from credit unions with recent conversions and ask what went wrong at cutover.

What changed this year

On September 15, 2026, the NCUA joined the OCC, Fed and FDIC on a proposal to replace the 2023 third-party risk guidance.⁵⁶ Comments close November 16, 2026.⁶ As of October 7, 2026, the NCUA had not said what happens to its older vendor letters, 07-CU-13 and 01-CU-20.⁷

Will it work with your systems?

Central Credit Union's conversion FAQ says it will get new online and mobile banking systems as part of its core conversion.⁸ TEN Credit Union plans to launch Bankjoy digital banking at the same time as its move to Corelation's KeyStone core.⁹ On the vendor side, Jack Henry has "Symitar in Jack Henry Platform" in closed beta with several credit unions.¹⁰ We've also seen Temenos Core Banking listed on the Jack Henry Fintech Integration Network for Symitar credit unions.^C Ask your provider which digital banking platforms are live on its core today, and which remain in beta.

What other credit unions did

Credit Union of Georgia finalized its conversion to a new core on July 7.¹¹ Self-Help Credit Union ($2.4 billion, Durham, NC) filed a federal lawsuit against Fiserv.¹² On April 30 a judge treated Self-Help as admitting it could have used authenticator-app passcodes on Portico since June 2025.¹³ The judge also ordered it to pay Fiserv's fees for that motion.¹³ The lesson we take: settle security terms before signing, because court is a slow way to fix them.

What your examiner will ask

NCUA rules require you to vet your service providers, require security measures by contract and monitor them where your risk assessment calls for it.¹⁴ Letter 23-CU-07 tells credit unions to review critical service provider contracts for timely incident notice.¹⁵ The cyber incident notification rule took effect September 1, 2023.¹⁶ The NCUA cannot examine your technology vendor directly.¹⁷ As NCUA Chairman, Todd Harper pointed to a ransomware disruption at a third-party core provider that affected 60 small credit unions.¹⁸ Have your due diligence file, the signed contract, incident notice terms and your outage plan ready to hand over.

What it costs

Expect to negotiate core pricing from a private quote, and ask for every fee in writing. In one public example from 2016, Sooper Credit Union ($334.5 million, Denver) paid $1 per member per month, about $35,000 a month, against $50,000 a month before it converted.¹⁹ Most contracts require non-renewal notice at least 180 days ahead, and early termination fees sometimes reach seven figures.²⁰²¹ Regulators have flagged long back-billing periods, undefined deconversion fees and limits on other providers integrating with the core.²² We'd ask your vendor to answer each of those points in writing while you negotiate.

Food for thought

After a Fiserv outage, one analyst said that when the processor goes down, all of its client connections are lost.²³ The NCUA cannot examine third-party technology providers.¹⁷ So ask your core provider what your members can do during an outage, and write the answer into your plan.