WASHINGTON—Both credit union trade groups are expressing concern following an anouncement by a House Financial Services Task Force on Financial Technology tit will consider draft legislation that would grant NCUA direct supervisory authority over third-party vendors and credit union service organizations.
“Despite our reservations with the proposal and our association policy to oppose extending this authority to NCUA, in the interest of ensuring that our nation’s information security apparatus is as strong as it needs to be to combat cyberattack and data breach, we are open to continued dialogue regarding proposed amendments to the BSCA that could augment NCUA’s current oversight of third-party vendors and CUSOs,” CUNA stated in a letter to the task force. “We have discussed this topic in detail with our membership committees and look forward to working with all stakeholders on this issue.”
Specific Concerns
CUNA said its concerns with the draft legislation include:
- NCUA has exercised very effective regulation of CUSOs and third-party vendors without the authority, rendering the change proposed in the draft legislation a solution in search of a problem
- Extending this authority to NCUA could result in the agency increasing its budget to hire personnel with appropriate expertise to supervise these organizations
- NCUA has yet to develop a clear vision of the scope of this authority or how they would implement it. “This has made it impossible for CUNA to assess the impact it would have on credit union operations,” the trade association said.
NCUA has said it supports having third-party vendor authority, stating it would provide parity with other financial regulators and help to address risk, especially related to cybersecurity.
NAFCU Response
Meanwhile, NAFCU CEO Dan Berger said, “NAFCU supports a strong NCUA and appreciates their focus on cybersecurity, but we support the NCUA remaining focused on credit unions. Giving NCUA authority over third parties will provide no clear benefit to credit unions and their members, but will result in duplicative regulation as other federal agencies already compile and can share this information with the NCUA.”