What's the Dilly-o with vendor (third-party) risk: a buyer's guide for credit unions

The Dilly-o

NCUA has no general statutory authority to supervise your vendors directly.³ Most credit unions should tighten their own program now: a current vendor inventory, risk tiers and contracts with clear incident notice. We'd put those basics in place first, then look at software to save your staff time.

How we'd size up a vendor

1. Data retention: what member data do you still hold from us, and when will you delete it?
2. Incident notice: how fast will you tell us about an incident affecting our members' information, and will you send notices on our behalf?
3. Fourth parties: which subcontractors touch our data, and will you tell us when that list changes? Your risk does not stop at the vendor you signed with.
4. Ongoing monitoring: what evidence will you send us each year, and what triggers a fresh review? We'd plan that review for each critical vendor at least once a year.

What changed this year

In September 2026, NCUA and the other federal regulators proposed new third-party risk guidance that would replace the existing guidance once final.⁴ Comments are due November 16, 2026.⁵ America's Credit Unions notes the proposal does not give NCUA authority over vendors.⁶ Separately, Rep. Bill Foster has reintroduced a bill that would give NCUA authority to examine and regulate vendors serving credit unions.⁷ It would also require new service relationships to be reported within 30 days, though its odds are called "iffy at best."⁷⁸

Will it work with your systems?

We haven't yet reviewed core fit for any vendor in this category.^C One comparison found that neither Ncontracts nor Venminder advertises deep native integrations with cores such as Fiserv, Jack Henry or Finastra.⁹ So ask your core and digital banking providers which vendor risk tools they feed, and what data moves without manual exports.

What other credit unions did

A Venminder case study describes Meriwest Credit Union, with $1.6 billion in assets, using Venminder software and assessments.¹⁰ A ProcessUnity case study on VyStar Credit Union says implementation began in August 2017 and the platform was fully operational by June 2018.¹¹¹² We'd use timelines like these as a rough guide, and ask each vendor for its typical rollout range.

What your examiner will ask

NCUA lists Letter 01-CU-20 under its third parties guidance.¹³ An NCUA supervisory letter says risk assessments should be a dynamic, ongoing process.¹⁴ NCUA's security program rule lets a credit union authorize or contract with its service provider to notify members or regulators on its behalf.¹⁵ NCUA did not issue the 2023 interagency guidance for banks, so it does not formally apply to credit unions.¹⁶ Have your inventory, risk tiers, contracts, monitoring reports and board reporting ready to show.

What it costs

Pricing follows a few models: vendor-count bands, admin seats plus inventory, or a fee per assessment, as Venminder charges.¹⁷ VendorRisk lists a Starter plan at $8,000 a year.¹⁸ A 2026 ranking reports annual medians of $10,790, $21,700 and $22,500 for three tools, and one tool's range reaches $133,725.¹⁹²⁰²¹ Broader suites with vendor risk, audit and policy modules commonly take six to nine months to roll out at mid-size and regional banks.²² Most vendors don't publish contract terms, so ask about term length and exit rights early.

Food for thought

We think AI inside the tools you already use deserves a place in your vendor reviews. We'd start by asking each critical vendor where it uses AI on your members' data.