The federal banking regulators have proposed new third-party risk management guidance. It replaces the checklist with something closer to a judgment call, and the NCUA has signed on, which puts credit unions inside the same framework as banks. That sounds like a break for small shops. Rafael DeLeon, senior vice president of industry engagement at Ncontracts, sees it differently. Flexibility doesn’t lighten the load, he says. It moves the work from proving you followed a list to proving your judgment was reasonable, and the proof has to be on paper. Comments on the NCUA’s version are due November 16.
I asked Rafael how a three-person credit union decides how much vendor due diligence is enough, and what the proposal means when the NCUA never had direct vendor authority to begin with. We also dug into PHP2Shell and a run of vendor failures at Ongoing Operations, ShareTec, Fiserv and TruStage, which hit many credit unions at once. He didn’t address the NCUA’s silence on PHP2Shell, but he did point to what New York told its regulated firms to do, and every credit union can take that step today.
1. Principles-based guidance and the NCUA’s missing authority
Sarah Snell Cooke: The NCUA has only had third-party oversight authority during Y2K, and that sunset. It’s been the only agency without it, although it can access CUSOs through their credit unions. What does the shift toward more principles-based regulatory guidance by the banking regulators mean for FIs and particularly credit unions when the NCUA never had it to begin with?
Rafael DeLeon: Banks and credit unions carry the same duty. Assess your vendors in proportion to the risk, decide what you will accept, and write it down. Having a regulator who can examine the vendor helps. It never replaced that duty.
NCUA’s vendor authority was granted in 1998 for Year 2000 readiness and later sunset. Whether it comes back is a debate for Congress. What matters here is that NCUA signed on to this proposal. It defines covered institutions to include insured credit unions, so credit unions work inside the same framework as banks.
Credit unions were never covered by the 2023 TPRM guidance, but some used it as their standard. I know of one large credit union that did. The new proposal takes away the detail they were relying on.
Here is what the shift means. The guidance is less of a checklist. That helps credit unions spend less time on low-risk vendors. It also puts more of the judgment on the credit union.
The real difference is verification. Banks can use agency exam reports on certain large providers as one input, though the proposal says they are no substitute for the bank’s own diligence. Credit unions mostly cannot. So they verify another way: written answers from vendors and/or audit and notice rights in contracts.
The mistake would be to treat lighter guidance as lighter responsibility. The accountability ceiling has not changed for banks or credit unions.
2. Why flexibility does not make compliance easier
Sarah: Why doesn’t this flexibility make compliance easier?
Rafael: Flexibility moves the work. It does not remove it.
Under a checklist, you prove you followed the list. Under principles, you prove your judgment was reasonable. That is harder to document and harder to defend, especially with a small team. The agencies say they will give due consideration to an institution’s reasonable decisions. Due consideration is not a guarantee.
In my opinion, examiners will stop asking whether you checked the boxes. They will ask whether you understood the risk. A documented process is how you show it.
Here is where the work increases.
- Set your own risk appetite. Write it down, have the board approve it and apply it consistently. The proposal does not expect institutions to eliminate third-party risk, and it treats accepting residual risk as part of managing it, within the institution’s risk appetite and tolerances. That only holds if the appetite is on paper.
- Document why your decisions were reasonable. Reasonable has to be provable. If it is not written down, it is hard to defend.
- Define “higher risk” yourself. The proposal ties higher risk to the magnitude and likelihood of harm and gives examples, not a definition. Set your own criteria now, so an examiner does not set them for you later. The agencies have asked whether the final guidance should list characteristics of high-risk relationships, so keep your criteria easy to adjust.
Flexibility is not a safe harbor. It is a standard you set for yourself, and then have to meet.
3. Right-sizing vendor due diligence at a small credit union
Sarah: How can smaller institutions, especially credit unions, many of which are under $100M in assets, determine the appropriate level of vendor due diligence and ongoing compliance without overburdening their teams and increasing costs? Is it more confusing not to have specific goals to hit?
Rafael: Yes, it is more confusing. A principle with no number leaves a three-person shop guessing how much is enough. A checklist tells you when you are done. Principles do not. So you have to set your own finish line.
The proposal’s method is to rate each relationship by a two-part test of evaluating the magnitude of potential harm and the material likelihood it will occur. Risk assessments commonly weigh both, and no single method is required. That works for a small credit union if you keep it simple. It is much harder to evaluate a core provider on that same two-part test.
For a small credit union, start with the vendors you already know would hurt most if they failed or were breached: your core provider, online banking, card processing, loan origination and whoever hosts your website. For those, find out what member data they hold, what breaks for members if they go down, how long you can operate without them and what technology they run.
One warning. Low-risk by category can be high-risk by data. PHP2Shell showed that. Hosting companies and web developers run most credit unions’ websites. A vendor that looks like marketing can sit on member data.
4. Fraud, cyber risk and the wrong time for deregulation
Sarah: It seems to me that, with all the fraud and cybersecurity concerns, this is the exact wrong time and area for deregulation. Discuss the PHP threat; the agency has said nothing about its process, and the deadline set by its oversight was yesterday, I think. TruStage is a perfect example (not PHP-related, that I know of) of needing oversight. It has relationships with nearly all credit unions. Companies like Fiserv have had plenty of issues on the platforms credit unions use, Ongoing Operations went down a couple years ago and just recently ShareTec was down. Thoughts? Please answer generally and specifically to the PHP threat and the examples given.
Rafael: I agree. It is counterintuitive to lighten guidance while fraud and cyber risk are rising.
The companies you name are not one problem. A ransomware attack at Ongoing Operations hit about 60 credit unions. A cooling failure at ShareTec took 23 offline. An outage at Fiserv. An attack at TruStage whose cause is still not public. As far as public information shows, none involved PHP. They failed in different ways, and each reached many credit unions at once. No single rule would have prevented all of them.
Every one of these happened in the middle of a vendor relationship, long after the contract was signed. That is why oversight cannot end at onboarding, and why assessing likelihood and magnitude is not a one-time step. Likelihood moves with events. Word of the PHP flaws began circulating October 20, and six days later they were on CISA’s exploited list. Magnitude moves with dependence.
Concentration is high, dependence is deep, and many credit unions carrying that risk are small, with thin teams and little leverage. Vendor oversight cannot stop an attack. You know who your vendors are and what they touch, so when something breaks you can tell quickly whether you are exposed. You agreed on notice and patch terms before anything went wrong, so the vendor owes you answers and you are not asking for favors in a crisis. You planned for the vendor to be down, so members keep banking while it recovers.
Lighter guidance is not lighter responsibility.
5. The NCUA’s silence on PHP2Shell
Sarah: Additionally, related to the PHP vulnerability and the NCUA’s silence (I’ve contacted them and not heard back), nor advised credit unions publicly, as far as I’ve seen. Have you? What’s going on? Is this silence deafening?
Rafael: I cannot address this. What I can say is that New York told its regulated firms to find PHP, patch it, take unpatched systems offline and confirm with their vendors. That last step is the one every credit union can take today.