What's the Dilly-o with credit & enrichment data: a buyer's guide for credit unions

The Dilly-o

Keep your bureau relationship, and add cash-flow or enrichment data only where it fills a gap you can name, such as thin-file members or small business borrowers. Before you sign, check three things: the provider's error process, the reasons behind its scores, and whether it plugs into your digital banking platform. We'd start any new data source as a small test and widen its use only once it proves out.

How we'd size up a vendor

1. Accuracy - how does the provider catch errors, how fast will it tell you, and who pays to make members whole? Ask for its last data incident and what it did about it.
2. Explainability - can the provider give you the principal reasons behind each score in plain words? We'd ask for sample reason codes and check that they would read clearly in a member notice.
3. Platform fit - does it already connect to your digital banking platform or your core, or will you build the link yourself?
4. Pricing clarity - do you pay for lookups that return nothing, do credits expire, and what is the contract minimum? Get these answers in writing before you compare quotes.

What changed this year

Until a final rule lands, data sharing runs on private bank and aggregator agreements and the Financial Data Exchange (FDX) standard.⁴

NCUA joined the other federal banking agencies in proposing new third-party risk guidance.⁵⁶ The proposal appeared in the Federal Register on September 15, 2026, and comments are due November 16, 2026.⁷ Separately, the CFPB's April 2026 Regulation B rule left the adverse action notice requirements unchanged.⁸

Will it work with your systems?

Alkami has expanded its partnership with Plaid, giving its institutions account linking, transaction aggregation and merchant data enrichment inside their digital banking.⁹¹⁰ We've seen Signzy listed on the Jack Henry Fintech Integration Network for Symitar credit unions, under digital banking, lending and deposits.^C Ask your platform and core provider which data vendors are already live with credit unions like yours, and what a new connection costs.

What other credit unions did

Suncoast Credit Union wanted to reduce disputes and call center volume by helping members understand their finances.¹¹ If you run a pilot with the same aim, agree with the vendor up front which measure counts, such as disputes or call volume.

What your examiner will ask

NCUA Letter 07-CU-13 expects risk assessment, due diligence and ongoing monitoring across the vendor lifecycle.¹² NCUA guidance also expects contracts to cover audit rights, data security and member confidentiality, service levels, termination and business resumption.¹³ The agencies' statement on alternative data tells firms to consider adverse action notice requirements under Regulation B and the Fair Credit Reporting Act (FCRA).¹⁴ Regulation B requires notices that name the principal reasons and describe the factors actually considered or scored.¹⁵ Have your due diligence file, the signed contract and a sample notice built from the vendor's reason codes ready to show.

What it costs

Most providers price per pull or per record, and many do not publish rates, so expect to ask. For one public example, iSoftpull says its soft pulls start at $3.84 per bureau, per pull, with volume discounts.¹⁶¹⁷ Implementation time is not public for this category, so ask each vendor for a dated plan. In the contract, watch auto-renewal windows and price rises at renewal.¹⁸¹⁹ Ask for performance penalties and audit rights too.¹⁸¹⁹

Food for thought

The CFPB's new Section 1033 proposal was still under review in October 2026.²⁰ Bloom Credit describes Section 1033 as a rule about who can access consumer-permissioned data, who can charge for it and what standards govern how it moves.²¹ While those questions stay open, we'd keep any new cash-flow data contract short or ask for a price review clause.