Concerns with Bill Granting NCUA Third-party Vendor Authority Outlined for House Task Force

The House Financial Services Committee Taskforce on Artificial Intelligence will convene a hearing today to address the growing number of data and cybersecurity attacks targeting the financial services industry. As policymakers seek to patch several cybersecurity policy holes, CUNA anticipates that legislation will be put forth that would extend to NCUA the authority to oversee credit union service organizations (CUSOs) and other third party vendors, and expand credit unions’ ability to invest in CUSOs.

As the financial services industry becomes increasingly reliant upon third-party vendors and their service providers to provide cutting-edge digital services, Congress has become increasingly concerned that bank regulators do not have sufficient authority to supervise these vendors. Congress is further concerned that the NCUA does not currently have any authority to regulate and supervise CUSOs. 

CUNA has several concerns with draft legislation that would grant NCUA direct supervisory authority over third party vendors and credit union service organizations, it wrote to leadership of the House Financial Services Task Force on Financial Technology Thursday.

“Despite our reservations with the proposal and our association policy to oppose extending this authority to NCUA, in the interest of ensuring that our nation’s information security apparatus is as strong as it needs to be to combat cyberattack and data breach, we are open to continued dialogue regarding proposed amendments to the BSCA that could augment NCUA’s current oversight of third-party vendors and CUSOs,” the letter reads. “We have discussed this topic in detail with our membership committees and look forward to working with all stakeholders on this issue.”

CUNA’s concerns with the draft legislation include:

  • NCUA has exercised very effective regulation of CUSOs and third-party vendors without the authority, rendering the change proposed in the draft legislation a solution in search of a problem;
  • Extending this authority to NCUA could result in the agency increasing its budget to hire personnel with appropriate expertise to supervise these organizations; and
  • NCUA has yet to develop a clear vision of the scope of this authority or how they would implement it. This has made it impossible for CUNA to assess the impact it would have on credit union operations.