NCUA Third-Party Vendor Oversight Authority, Redlining, VyStar, All Addressed In HFSC Hearing

By Ray Birch

WASHINGTON—During his testimony before the House Financial Services Committee Wednesday, NCUA Chairman Todd Harper did not miss an opportunity to press Congress for the agency receiving third-party vendor oversight authority and eliminating restrictions on the NCUSIF’s equity ratio.

The HFSC Wednesday held a hearing on oversight of prudential regulators. Along with Harper, also testifying were OCC Acting Comptroller Michael Hsu, Federal Reserve Vice Chairman Michael Barr and FDIC Chairman Martin Gruenberg.

Patrick McHenry

Harper, who largely escaped fire from reps, faced tough questions regarding VyStar’s botched digital banking platform rollout and redlining within the CU movement. The regulators, collectively, fielded many questions regarding overregulation.

At the meeting’s outset, HFSC Chairman Patrick McHenry (R-NC) blasted Gruenberg for the well-publicized problems within his organization. Gruenberg has hung onto his position amid a great deal of controversy. As CUToday.info extensively reported, late last year a Wall Street Journal report exposed widespread misconduct at the FDIC.

McHenry told Gruenberg that as a result of his agency’s problems, the FDIC’s power will be reduced in the coming years.

“Rest assured, no one who sits in your seat can take the type of actions that you've taken that have led to the abuse that you've rendered to your employees,” McHenry said. “Resigning in January is too little too late.”

As CUToday.info reported, Gruenberg plans to retire from the agency, effective Jan. 19.

Overall, McHenry had stern words for regulators, zeroing in on banks. He chastised banking regulators for oversight that “led to three of the largest bank failures in American history that occurred last year. Again, your agencies have also worked to stifle the beneficial role that innovation and technology play in our financial system. It's clear our banking regulators, under Democratic leadership, have been busy fighting the last war. It's clear our banking regulators, under Democrat leadership, are working in a different way than hill Democrats are about these subject matters and you're backward-looking approach to regulations has harmed our financial system.”

Harper: ‘System Is Strong’

“Overall, the credit union system remains strong, although there are some warning signs of potential weaknesses that the NCUA is closely monitoring,” Harper stated. “Namely, the agency is seeing growing signs of weak loan performance, declining capital levels, rising delinquency rates, and lower earnings across the system and at specific institutions.”

Harper added that consumer financial stress continues to flow through credit unions’ loan performance data.

“The delinquency rate for total loans and leases rose to 0.84% in the second quarter of 2024, nearing the level last observed in December 2014,” Harper told the Committee. “Meanwhile, the rolling 12-month net charge-off rate climbed to 0.79%, marking the highest rate since mid-2012, when consumers were recovering from the Great Recession. Despite the deterioration in loan performance and earnings, net worth levels indicate the credit union system generally remains resilient and liquidity appears to have stabilized during 2024.”

Harper said that NCUA continues to see the effects of consumer financial stress across the system, pointing to CAMELS ratings.

“Approximately one in five federally insured credit unions has a composite CAMELS code rating of 1,” he said, adding that growth in the number of CUs with CAMELS rating of 3, 4, or 5 is concerning, especially among complex credit unions with $500 million or more in assets falling into the troubled category of CAMELS code 4 or 5.

“The number of troubled complex credit unions, those with $500 million or more in assets, tripled in the second quarter of 2024 alone, and the amount of assets at these institutions grew by more than fivefold,” he said.

Harper credited NCUA for its efforts to protect and strengthen the credit union system.

“The NCUA over the last year has worked to enhance cybersecurity, promote the prudent adoption of new financial technologies, enforce consumer financial protection laws and regulations, support minority depository institutions, advance diversity within the agency and industry, and strengthen the resiliency of the credit union system,” he told the Committee.

Overall, 442 credit unions with more than $1 billion in assets hold 77.2% of the CU industry’s assets, Harper noted.

“As a result of this concentration, a cybersecurity vulnerability at a large credit union may threaten the safety and soundness of the entire system. Moreover, cybersecurity threats within the interconnected financial services industry remain high and show no signs of abating. The NCUA, therefore, is fully committed to enhancing its cybersecurity examination program and related activities,” Harper said.

Third-Party Vendor Authority

Harper emphasized the NCUA’s lack of third-party vendor oversight remains a “significant regulatory blind spot” that has led to vulnerabilities in the credit union system and obstacles to effective collaboration amongst all financial regulatory agencies.

“Credit unions holding approximately 90% of industry assets use key services provided by unregulated third-party service providers, posing potential risks to financial stability,” Harper said. “Last November, a single third-party vendor’s cybersecurity incident disrupted the daily operations of 60 credit unions. In June, a large credit union with $9.5 billion in assets reported the personal information of more than one million current and former members and employees had been accessed during a ransomware attack. The breach initially occurred on May 23, but the ransomware hackers did not shut down most of the credit union’s online and mobile banking systems until June 29.”

Harper said these incidents highlight a significant vulnerability to the $2.3-trillion credit union industry and have the capacity to “debilitate” the nation’s critical infrastructure if left unchecked.

“At a minimum, this lack of visibility impacts credit union safety and soundness and the Share Insurance Fund,” he said.

As CUToday.info reported, Harper said NCUA may consider adjusting the normal operating level of the NCUSIF due to the growing risk third-party cyber incidents present to the fund.

“If Congress were to restore vendor authority, the NCUA would implement this oversight through a risk-based examination program focusing on services related to safety and soundness, information security, cybersecurity, BSA/AML compliance, consumer financial protection, and areas posing significant financial risk for the Share Insurance Fund and national economic security,” Harper said. “Having this oversight would reduce NCUA’s requests to credit unions for intervention when vendors are experiencing problems. It would also provide credit unions with access to NCUA examination summaries to aid in their due diligence of vendors. This ability is currently available to commercial banks, not credit unions, which places the industry at a competitive disadvantage.”

Amend FCU Act

Harper urged Congress to amend the Federal Credit Union Act to eliminate restrictions on the Share Insurance Fund’s equity ratio and on the agency’s ability to levy premiums.

“Such changes would improve fund management and align the NCUA’s authority to manage the Share Insurance Fund with the FDIC’s authority in maintaining its Deposit Insurance Fund,” Harper said. “Specifically, proposed changes should remove the restrictions on levying Share Insurance Fund premiums when the fund’s equity ratio is equal to or greater than 1.30%, and when the premium charged exceeds the amount needed to restore the equity ratio to 1.30%. A statutory change should also eliminate the 1.50% ceiling from the current statutory definition of the normal operating level for the Share Insurance Fund, which limits the board’s ability to increase the size of the fund above this level.

“Together, these amendments would bring the NCUA’s statutory authority over the Share Insurance Fund more in line with the FDIC’s authority as it relates to administering the Deposit Insurance Fund,” continued Harper. “These amendments would also better enable the NCUA board to proactively manage the Share Insurance Fund by building reserves during economic upturns so that sufficient money is available during economic downturns.”

Reps Hammer Gruenberg

During the Q&A portion of the hearing, which was dominated by tough questions largely directed to banking industry regulators and the FDIC’s Gruenberg, Harper’s toughest questions came from reps concerned about VyStar’s botched digital banking platform rollout and redlining within the CU movement.

Emanuel Cleaver (D-MO) said he is concerned about redlining practices identified by media reports and the Department of Justice at the $1.9-billion Citadel FCU and $181-billion Navy FCU. Cleaver pointed out Navy is larger than some banks and should be placed under the  Community Reinvestment Act (CRA).

“If Congress were to move forward on CRA and applying it to credit unions, I would ask for flexibility given there are many different types of federal credit union charters,” Harper said.

Brad Sherman (D-CA) asked Harper if he intends to remain in his seat after the expected shift in power on the board when President-Elect Trump takes office.

“I am committed to serving through 2027,” Harper responded. “I remain committed to doing just that.”

Sherman also said he hopes that NCUA will allow volunteers who serve on credit union boards to get reimbursed for their child care expenses, as well as their travel expenses.

Harper said that matter is on NCUA’s rulemaking agenda.

“And it’s more than just childcare. We're also looking at elder dependent care,” he noted.

Monica De La Cruz (R-TX) hammered Gruenberg for the problems within his agency and asked each regulator if they intend to have strong anti-harassment policies.

Harper said NCUA has a strong anti-harassment policy in place, adding “we aim to have no discrimination or harassment whatsoever.”

Bryon Donalds (R-FL) asked Harper how NCUA is going to address the CFPB’s new overdraft opt-in policies and if the agency intends to direct examiners to apply the new expectations outlined in the CFPB’s recent circular.

“We'll be taking a look at that and providing appropriate guidance to our examiners,” Harper said.

Section: Standard
Word Count: 1843
Copyright Holder: CUToday.info
Copyright Year: 2026
Is Based On:
URL: https://cuto-admin.flux5.ccplatform.net/THE-feature/NCUA-Third-Party-Vendor-Oversight-Authority-Redlining-VyStar-All-Addressed-In-HFSC-Hearing