What's the Dilly-o with enterprise & model risk: a buyer's guide for credit unions

The Dilly-o

We'd keep model risk inside your enterprise risk program, so your board sees it next to every other risk. Start with the models you already rely on, such as your interest rate risk model and any AI vendor, before you shop. Then buy software that keeps the trail an examiner will ask to see, and walk away from any contract without audit rights.

How we'd size up a vendor

1. One view of risk - can the tool roll up risks from lending, liquidity, vendors and fraud into a single picture for your board? Ask the vendor to show you a board report built from more than one department's data.
2. AI coverage - can the vendor validate the machine learning and generative AI tools your credit union already uses?
3. Exit and audit rights - will the contract let you audit the vendor and take your risk data with you if you leave? Diligent's buyer's guide suggests a portable export clause giving at least 90 days to export risks, controls, evidence and findings [106].¹

What changed this year

The 2026 bank model risk guidance is framed for organizations over $30 billion in assets and excludes generative and agentic AI [30][59].²³ Examiners will review how credit unions build interest rate and liquidity risk into governance, contingency funding plans and strategic decisions, including fit with risk appetite [41].⁴ Comments on the National Credit Union Administration (NCUA) version of new vendor due diligence guidance were due November 16, 2026 [124].⁵ If your interest rate or liquidity models live in a spreadsheet, we'd move them into a tracked system before examiners ask.

Will it work with your systems?

We have not yet reviewed core fit for Domu, FairPlay or Quantexa [C].^C Until we do, ask your provider which core data feeds the risk tool and how often it refreshes. Also ask who fixes the feed when your core upgrades.

What other credit unions did

A press release on Allegacy Financial choosing Kobalt Labs names ORNL Federal Credit Union, InTouch Credit Union and Meriwest Credit Union among credit unions using Kobalt [69].⁶ We'd ask any vendor for credit union references, then ask those peers what their examiners wanted to see. The Federal Reserve's review found that Silicon Valley Bank did no back-testing, had limited sensitivity testing and lacked a second line to challenge decisions and model assumptions [127].⁷ It also failed its own liquidity stress tests and had no workable plan to reach liquidity under stress [126].⁸

What your examiner will ask

NCUA's examiner guide describes effective risk management as aggregating and evaluating risks across the institution rather than in silos [36].⁹ Its model risk page says credit unions should conduct model risk management [53].¹⁰ That may include model development, a validation process and a governance framework that defines roles and communicates model limitations and assumptions [53].¹⁰ Before the exam, have a model inventory, recent validation reports, an assumption change log and your vendor contracts ready.

What it costs

We have not found public pricing for the vendors we list, so expect a quote. Cyber Sierra puts a credit union governance, risk and compliance rollout at $150,000 to $450,000, taking 4 to 8 months [101].¹¹ Cyber Sierra adds that total cost over three years is typically three to five times the annual license fee [102].¹² RiskInMind, which sells risk software, says implementation can add up to 1.4 times the first-year license fee [99].¹³ It says sandbox and testing environments commonly cost $35,000 to $75,000 each when not bundled [100].¹⁴ NCUA guidance says contracts should cover performance standards, data security, confidentiality, audit rights and termination [109].¹⁵ AdvisorLabs notes that many software-as-a-service agreements include limited or no audit rights [118].¹⁶ Diligent's buyer's guide advises asking for the three-year total cost, including exit terms [121].¹⁷

Food for thought

The new bank guidance excludes agentic AI [59].³ We'd watch any agentic AI your vendors add, since you will need your own controls for it. We'd set your own review step for any new AI feature a vendor wants to turn on.