What's the Dilly-o with integration & APIs: a buyer's guide for credit unions

The Dilly-o

Start with the integrations your core and digital banking platform already support, and buy middleware only where it fills a gap you can name. The CFPB's Section 1033 rule is enjoined, but data sharing goes on through bank-aggregator agreements and the Financial Data Exchange (FDX) standard.²³

How we'd size up a vendor

1. Platform fit - is the connector already listed or certified with your core and your digital banking platform? We'd treat a listing as a starting point and still test the connector with your own data.
2. Standards - does it send and receive member data over the FDX API, or does it still lean on screen-scraping? We'd raise any reliance on screen-scraping as a question before you sign.
3. API security - how does it handle authorization, authentication, encryption, logging and monitoring for every call? We'd ask each vendor to walk you through these controls before you sign.
4. Exit terms - what will it cost to leave, and how is every deconversion and early termination fee calculated? We'd ask for a clear formula for each of those fees, written into the contract.

What changed this year

A federal court in Kentucky enjoined the CFPB from enforcing its Section 1033 rule on October 29, 2025.² The CFPB sent a new proposed rule for review on August 6, 2026, and it was still under review in October.⁴ The NCUA's third-party risk guidance followed on September 15, 2026, with comments due November 16.⁵⁶

Will it work with your systems?

Alkami announced an FDX API integration with the aggregator Yodlee in June 2026.⁷ Q2 says Stablecore integrates through the Q2 Innovation Studio.⁸ Jack Henry's network lists Narmi Open under digital banking for credit unions on Symitar.^C Ask your core and digital banking provider which connectors they certify, and what they charge to turn one on.

What other credit unions did

The CFPB's October 2024 consent order found a platform conversion was rushed to an unrealistic deadline despite warnings from the institution's own team.⁹ The CFPB called the harm to members foreseeable and preventable.¹⁰

What your examiner will ask

The FFIEC examination procedures expect you to assess API security needs, including authorization, authentication and encryption.¹¹ They also look for API gateways with request and response controls, plus API logging and monitoring.¹² Interagency authentication guidance calls for an inventory of your information systems, including APIs.¹³ The FFIEC booklet also expects you to maintain representations of your IT environment, such as blueprints and network diagrams.¹⁴ NCUA guidance expects due diligence on providers, security terms in the contract, and monitoring where your risk assessment calls for it.¹⁵ Have your API inventory, diagrams and vendor contracts ready to hand over.

What it costs

Ask every vendor for a written quote that separates setup fees from monthly fees. FI Grow lists $10,000 plus $1,000 a month to connect one system to HubSpot, and $20,000 plus $1,500 a month for core and loan origination system (LOS).¹⁶ It puts the build at four to six weeks for one system and six to eight for both.¹⁷ One credit union web blog lists Plaid at $0.42 per connection plus usage.¹⁸ One estimate says older core versions may need custom API development, adding four to eight weeks.¹⁹ A Barclay Damon article for credit unions notes that early termination fees sometimes reach seven figures.²⁰ The NCUA notes that early termination, escape clause and default terms are negotiable in many cases.²¹

Food for thought

Section 1033 is meant to move the market from screen-scraping toward permissioned, API-based access.²² In January 2025 the CFPB recognized FDX as the first Section 1033 standard-setting body, through January 2030.²³ We'd ask each vendor how and when its connections will move from screen-scraping to permissioned APIs.