Even when it’s the only banking regulator that has not set detailed AI guidance
The Government Accountability Office’s (GAO’s) latest report—Artificial Intelligence: Use and Oversight in Financial Services (GAO-25-107197)—calls out the NCUA for limited oversight of artificial intelligence (AI) in credit unions. But before anyone rushes to hand the agency more authority (and more of your members’ money), is that the right move?
The report’s conclusions state:
- The NCUA should have oversight over third parties to protect credit unions and their members from bad actors. That said, leaving credit union use of AI at the political whim of whichever part is in charge every few years would stifle innovation and give the agency oversight on what should be credit unions’ business decisions.
- The GAO comes down on the NCUA because, “unlike the banking regulators, NCUA does not have detailed model risk management guidance that covers a broad variety of models, including AI models. Developing such guidance would strengthen NCUA’s ability to address risks to consumers and the safety and soundness of credit unions arising from the use of AI.”
The path forward isn’t as simple (or justified) as the GAO suggests.
What the GAO Got Right
There’s no question that AI in credit unions is accelerating. Tools that once felt experimental, like machine learning-powered underwriting or AI-powered member service chatbots, have been deployed in many credit unions. The GAO points out that the NCUA’s model risk management guidance is currently limited, primarily focused on interest rate risk, and does not fully address the growing variety of AI-driven tools.
Current NCUA Chairman Kyle Hauptman acknowledged in his response that it’s a fair criticism. “The agency will review contemporary sound practices on model risk management and provide information and clarity to examiners and credit unions,” he wrote. “This process will include assessing the efficacy of existing information about model risk management issued by our fellow financial regulators and any possible benefit of providing similar information to credit unions.”
In other words, credit unions need more tailored guidance on validating, monitoring and governing AI systems. Can the NCUA accomplish that with one board member and a significantly reduced staff?
Where the GAO misses the mark
However, the GAO’s conclusion recommending that Congress grant the NCUA authority to examine third-party technology providers is wrong.
Chairman Hauptman acknowledged the GAO’s conclusion, writing: “While it is ultimately up to Congress to provide NCUA with enforcement authority over third-party vendors, there are risks to increasing NCUA’s power over vendors, namely a possible reduction in the quality and quantity of services provided to credit unions. Any policy should be mindful that banks hold ten times the deposits held at credit unions, and as such, vendors understandably focus on the larger bank market. I am mindful that enforcement authority over third-party vendors may come with financial and operational risks for credit unions.”
Credit union leaders are correct to be skeptical
Why? Because…
- Redundant oversight already exists. The NCUA has access to interagency reports and regulatory findings from the other banking regulators. Duplicating that work would add cost without improving outcomes.
- The expertise gap is real. The GAO previously supported “interagency development of expertise to analyze and monitor potential systemic risks associated with the use of AI in the financial services sector and engagement with international counterparts on the risks and benefits of AI in financial services,” in its report, Financial Stability Oversight Council, Annual Report 2023 and Annual Report 2024.
- It would come at a HUGE cost to credit unions. Expanding the NCUA’s reach means increasing its budget, which is funded entirely by credit unions with credit union member funds. Necessary training and hiring for expertise would directly hit all credit unions’ balance sheets when the current economic environment is already primed with uncertainty.
- Back-door supervision for CUSOs already exists. The NCUA already uses its authority over credit unions to sneak a peek into CUSOs, which many credit unions use.
Clearing a practical path forward
Rather than granting the NCUA new powers, a more effective approach would be for the agency to first expand existing model risk guidance to cover the real-world applications of AI in credit unions, including underwriting, member engagement and cybersecurity. In addition, the federal banking agencies that do have oversight can operationalize sharing their findings with the NCUA in a more formal manner.
Finally, getting AI right for their members is absolutely in credit unions’ best interests. Supporting a voluntary framework or industry standards can help credit unions manage AI and its benefits and risks in a scalable, practical way.
That’s great, but what can credit unions do today?
As I said, it’s in credit unions’ best interests to examine and monitor AI appropriately because it’s just good business. Don’t wait for the NCUA or Congress to tell you what to do with your members’ business!
- Establish AI governance policies that go beyond tech. It should include brand considerations, ethical questions, vendor accountability and member transparency.
- Leverage your entire team to bring fresh ideas and test, test, test and test again. Ensure the humans in the loop still know how the decisions are made.
- Never stop learning and sharing with NCUA and your state regulators, your business partners and among your team and colleagues. The entire credit union movement must ask itself, ‘What does responsible, sustainable use of AI look like?’ Then, distill that idea further into your credit union and its membership.
Bottom Line
Artificial intelligence in credit unions is here to stay. Still, the way forward doesn’t mean the NCUA can run carte blanche over all vendors, its authoritative boundaries and credit unions’ allocated funds that pay the bills. Credit union leaders can take it upon themselves to create expert guidance, collaborate as only credit unions can, and innovate. You balance technology and trust daily, and AI won’t change that.
Access the GAO Report here