NCUA Chairman Todd M. Harper used his February 27, 2023 State of the Credit Union remarks to address the condition of the credit union system and several risks facing federally insured credit unions. His subjects included credit, interest rate, liquidity, consumer compliance, minority institutions, and community development.

For your information security and strategic planning work, three areas stand out: cybersecurity, third-party oversight, and financial technology. Those issues remain connected. A cyber incident may begin at a service provider, and a fintech relationship can create operational and compliance dependencies your credit union still has to manage.

Cybersecurity Risk and Incident Notification

Ransomware, social engineering, phishing, and attacks that exploit new weaknesses remain central cybersecurity concerns. Your credit union needs a repeatable way to assess threats, evaluate control maturity, and show leadership where the program needs attention. The NCUA continues to make the Automated Cybersecurity Evaluation Toolbox and other assessment resources available for that work.

Cyber incident reporting is now a defined NCUA compliance responsibility. Since September 1, 2023, a federally insured credit union must notify the NCUA as soon as possible and no later than 72 hours after it reasonably believes a reportable cyber incident occurred. The same timeframe can apply when your credit union receives notice from a third party about a reportable incident.

Your response plan should identify who decides whether an event is reportable, who submits the notice, and how third-party notifications reach that person. Waiting until an incident to settle those responsibilities adds delay when the timeline is already running.

Third-Party Vendor Authority and Your Oversight

Chairman Harper has repeatedly called the NCUA’s lack of direct examination authority over credit union service organizations and third-party vendors a regulatory blind spot. The banking regulators can examine significant technology service providers under their authorities. The NCUA does not have the same reach over vendors serving credit unions.

That gap does not reduce your credit union’s responsibility for a vendor relationship. NCUA guidance expects due diligence, contracts that address appropriate safeguards, and monitoring based on the risk of the service. Your oversight should show what the provider does, which data and operations depend on it, how performance is monitored, and what happens if the relationship fails.

A provider’s audit report or security package is part of the evidence, not the entire review. Your institution still needs to decide whether the controls, resilience, incident obligations, and recovery capabilities support its own risk tolerance and member commitments.

Fintech Decisions Are Governance Decisions

Fintech relationships can extend services and add capabilities that would be difficult to build internally. They can also introduce new data flows, subcontractors, cloud dependencies, compliance obligations, and concentration risk.

Chairman Harper’s concern was that critical fintech providers may operate without the direct supervisory oversight applied to other significant service providers. For your credit union, that makes the governance around the relationship more important. The business case, due diligence, contract, implementation, ongoing monitoring, and exit plan should connect to one another.

The technology may move quickly. Your approval and oversight process still needs enough time to understand where member information goes, who can access it, how incidents are reported, and how the service can be replaced or discontinued.

Supervision Based on Size, Complexity, and Risk

The NCUA has continued to describe supervision as risk-focused and aligned with a credit union’s size, complexity, and risk profile. That approach should make an examination more relevant to your institution, but it does not make a material risk disappear because your institution is smaller.

Size and complexity can shape how a control is implemented, how much documentation is reasonable, and how deeply an examiner reviews a subject. Your records should still explain the decisions made, the risks accepted, and the controls relied upon. That is especially important for critical vendors and newer technology relationships where responsibilities can be spread across several parties.

The 2023 remarks pointed toward expectations that now show up in day-to-day NCUA compliance work. Cyber incident reporting has a defined deadline. Third-party oversight remains your credit union’s responsibility even without direct NCUA vendor authority. Fintech decisions need to be treated as risk and governance decisions, not only product decisions. Keep those areas visible in your strategic plan, information security reporting, and examination preparation.