Skip to content
Dilly Labs

What's the Dilly-o with online & mobile banking: a buyer's guide for credit unions

In November 2026, dozens of SecurCommunity Federal Credit Union members said they lost access for three days during a move to a new online banking system.1 They could not use debit cards, write checks or check balances online.1 A large Florida credit union's rushed 2022 platform launch ended in a CFPB order with member redress and a $1.5 million penalty.2

The Dilly-o

Most credit unions should pick on how well a platform connects to their core and how safely it converts, ahead of demo polish. Plan for most of a year, test the cutover with real member accounts, and write your exit terms before you sign. A platform your members can't log in to is worse than the one you have today.

How we'd size up a vendor

  1. Core fit - is the platform's connection to your core listed or certified by your core provider, and how many credit unions on your core run it? We'd ask to see the platform's listing in your core provider's partner network.
  2. Conversion plan - how will members keep access to balances, cards and bill pay during cutover, and what is the rollback plan? Ask for the date-by-date plan and a reference who converted in the last year.
  3. Fraud controls - what tools does the platform give you to spot account takeover and scam payments, and to support your yearly fraud review?
  4. Exit terms - what will it cost to leave, and are deconversion and data return fees capped in the contract? We'd get those fee caps written into the contract itself.

What changed this year

Nacha says its fraud monitoring rule is neutral on the methods or technologies you use to spot fraud.3 It does not require monitoring credit entries before they post.4 Covered institutions must review and update their fraud monitoring procedures at least once a year, with documented evidence.5 On open banking, the CFPB sent a new Section 1033 proposal to the Office of Information and Regulatory Affairs (OIRA) on August 6, 2026.6 As of October 2026, it was still under OIRA review.78 One report says the proposal would reverse the original ban on banks charging for data access.9 On September 15, NCUA and the three bank regulators proposed third-party risk guidance that includes insured credit unions.10 We'd ask each platform how it supports your fraud monitoring, data sharing and vendor oversight under these changes.

Will it work with your systems?

Mitek's mobile deposit is listed among Alkami's partner integrations.C So ask your provider which features run natively and which go through a partner.

What other credit unions did

TEN Credit Union chose Bankjoy and will launch it alongside its move to Corelation's KeyStone core, and Metro Credit Union chose Tyfone's nFinia platform.111213 Alkami says more than half of Texoma Community Credit Union's members adopted its platform within two weeks of launch.1415 An Alkami announcement says Texans Credit Union grew its active digital users by 42%.16 In an Alkami case study, Raiz Federal Credit Union's monthly digital login rate rose from 30% to 49%.17

What your examiner will ask

NCUA's 72-hour cyber incident notification rule took effect September 1, 2023.1819 A failed system upgrade that causes widespread unplanned outages for members is reportable under it.20 So is a denial of service attack that cuts off member account access.21 NCUA's rules require you to use due diligence in choosing providers and to require security measures by contract.22 You must also monitor providers where your risk assessment indicates.22 When an incident happens at a provider, your credit union is still responsible for notifying members and the regulator.23 One report found that 742 of the 1,072 incident reports in the rule's first year came from 13 vendor events.19 Have your due diligence file, the contract's security terms and a tested outage plan ready.

What it costs

One industry guide puts digital banking suite implementations at 6 to 12 months.24 Early termination fees sometimes reach seven figures, and vendors may add deconversion and data migration charges.2526 Negotiate capped deconversion fees, service level remedies and price increase caps up front.2728 We'd also ask each vendor for a written quote that shows what its price is based on.

Food for thought

Ask each vendor now how it will handle open banking, and get the answer in writing.

Dilly Labs research, written from our catalog and cited sources · updated . Credit unions pay nothing. Vendors pay a referral fee only when a contract is signed through us. It never changes rankings or this guide. How we work

Sources

  1. Members of SecurCommunity FCU Complain of Account Access Issues as Conversion is Underway - Credit Union Dailythecudaily.com
    — Dozens of SecurCommunity Federal Credit Union members say they have been unable to use debit cards, write checks or check balances online for three ...
  2. CFPB Faults Financial Institution for Rushed Core Conversionwww.gfrlaw.com
    The consent order requires the credit union to come into compliance with applicable law, establish a governance committee to ensure proper management ...
  3. Credit-Push Fraud Monitoring Resource Centerwww.nacha.org
    The Rules are neutral regarding specific methods or technologies used to identify fraudulently initiated credit transactions.
  4. RISK MANAGEMENT TOPICSwww.nacha.org
    - The rule does not require pre-posting monitoring of credit entries.
  5. ACH Fraud Rules Are Shifting: What Nacha 2026 Means for Banks and Credit Unions - ThreatMarkwww.threatmark.com
    6 · Annual Review Requirement · All covered entities must review and update fraud monitoring procedures at least annually, with documented evidence.
  6. Where Section 1033 Actually Stands: A Plain-Language Guide for Financial Institutionsbloomcredit.io
    ## Where the rule sits right now On August 6, 2026, the CFPB submitted a new Notice of Proposed Rulemaking to the Office of Information and Regulatory...
  7. Where Section 1033 Actually Stands: A Plain-Language Guide for Financial Institutionsbloomcredit.io
    As of October 2026, the proposal is still under OIRA review.
  8. Where Section 1033 Actually Stands: A Plain-Language Guide for Financial Institutionsbloomcredit.io
    As of October 2026, the proposal is still under OIRA review.
  9. CFPB 1033 Rule in 2026: Where US Open Banking Standsfintechly.com
    02 The CFPB sent a revised Section 1033 proposal to the White House's OIRA for review on 6 August 2026, reportedly reversing the original ban on banks...
  10. Your Shred Company Isn't Your Core Processor, and the Agencies Agree — CU Risk Advisorsmycurisk.com
    This time NCUA signed on, and footnote 1 defines "banking organizations" to include insured credit unions.
  11. TEN Credit Union selects digital banking platformwww.atmmarketplace.com
    TEN Credit Union has selected Bankjoy as its new digital banking platform, according to a press release.
  12. TEN Credit Union selects digital banking platformwww.atmmarketplace.com
    TENCU, a Nashville-based credit union founded in 1950, will launch Bankjoy simultaneously with its conversion to Corelation's KeyStone core processor,...
  13. Metro Credit Unionwww.metrocu.org
    — March 30, 2026 — Digital banking solutions provider Tyfone, today announced that Metro Credit Union (Metro) has selected the nFinia® Digital Banking...
  14. Texoma Community Credit Union to Build a More Connected Member Experience with Alkami's Digital Sales & Service Platformwww.prnewswire.com
    The credit union is live with the Alkami Digital Banking Platform and is implementing MANTL Onboarding & Account Opening and Alkami's Data & Marketing...
  15. More than half of Texoma credit union members adopted its new online banking service in two weekswww.stocktitan.net
    Within two weeks of launching the new experience, more than 50% of the credit union's members had adopted the Platform.
  16. Texans Credit Union Grows Active Digital Banking Users by 42% with Alkamiwww.prnewswire.com
    - **Increased digital engagement:** Grew active digital banking users by 42% following implementation while achieving a 4.8-star App Store rating. - *...
  17. Raiz Federal Credit Union Transforms Community Banking with Alkami's Digital Sales & Service Platformwww.prnewswire.com
    - **Increased digital engagement:** Monthly digital login increased from 30% to 49%.
  18. cyber-incident-notification-requirements-final-rule- ...ncua.gov
    **DATES:** The effective date of this final rule is September 1, 2023.
  19. The Credit Union Cyber Incident Landscape: 2026 Editionwww.principlesec.com
    Those 742 third-party reports collapse into just **13 distinct vendor events**. The largest single event generated reports from **234 credit unions**;...
  20. cyber-incident-notification-requirements-final-rule- ...ncua.gov
    However, a failed system upgrade that causes widespread unplanned outages for members would be reportable under this final rule.
  21. cyber-incident-notification-requirements-final-rule- ...ncua.gov
    For example, a distributed denial of service (DDoS) attack that disrupts member account access will be reportable under this prong.
  22. NCUA’s Regulations and Guidancencua.gov
    - Exercise appropriate due diligence in selecting its service providers; - Require its service providers by contract to implement appropriate measures...
  23. NCUA Part 748: What the Security Program Rule Requiressaseadvisors.com
    ** Where the incident is at a service provider, Appendix B says it is the credit union's responsibility to notify members and the regulator, although ...
  24. Top 7 Credit Union Tech Strategies for 2026blog.flexcutech.com
    ## Comparison table: Top credit union technology strategies for 2026 · Strategy · Core Integration · Implementation Timeline · Direct Member Impact · ...
  25. Strategies for Credit Unions to Navigate Vendor Terminationswww.barclaydamon.com
    These fees – sometimes reaching seven figures – can seem like insurmountable barriers, the early termination compelling credit unions to remain tet...
  26. Strategies for Credit Unions to Navigate Vendor Terminationswww.barclaydamon.com
    Vendors might retract previously offered incentives and impose additional charges for deconversion and data migration.
  27. FEAR OF COMMITMENT Negotiating core contracts and the importance for banks ofresources.gabankers.com
    •Deconversion fees capped or limited •Delay of conversion hold-over costs TERMINATION FEES & PENALTIES •Advance written notice •Right to cure •Ri...
  28. How to Evaluate a Core Banking RFP: A Buyer's Guide for Credit Unionsblog.flexcutech.com
    - Negotiate SLA remedies, price escalation caps, conversion accountability, and exit terms.
See the 14 online & mobile banking vendorsSorted by fit with your core, with the evidence behind each.