“The primary reason is because an in-house solution requires a team of IT professionals. The smaller credit unions have less money so they cannot afford that expenditure and, therefore, they embrace a hosted core,” Gibbard added.

They also save money, said Gibbard. “I estimate that an in-house credit union could reduce between 25% to 50% of their IT budget with a hosted solution.”

But the question is, will shifting to a hosted core hurt? Will it stymie a credit union's ability to protect its data and serve its members?

(Click on graphic above from Callahan & Associates to see an expanded view.)

Delaware State Police Federal Credit Union, a $122 million institution based in Georgetown, in July 2011 shifted to a hosted version of the same Symitar core, Episys, that it had been running in-house.

“We thought we would never go to an online solution” said Blanche Jackson, an executive vice president. But the credit union had been on Episys since 2000, and the hardware needed substantial upgrades. “We were looking at large expenses. Going hosted eliminated the need to buy that new equipment, saving us easily $100,000 to $200,000,” said Jackson.

As for running monthly costs, that's about the same, said Jackson. But she also indicated that the credit union now gets services, she pointed to disaster recovery as a for instance, that it wanted but couldn't afford. Now it can afford such upgrades or, as with disaster recovery, it is included with the hosted service.

“Our biggest issue with the conversion was fear,” said Jackson. But in the end, “if we hadn't told the staff we were doing it, they never would have known.”

“We did not tell our members. The change had no impact on them,” she added. “We converted over a weekend. We had no down time.”

Many processes got simpler with the move to a hosted core. ACH and share-draft processing, for instance, had been done in-house. Now the host handles those chores for the institution. A lot of IT drudgery, applying patches and quick fixes, also stopped, as that work got outsourced to Symitar.

Delaware State Police FCU elected to keep its IT staff count unchanged. Said Jackson: “We moved them around. One is managing the call center. We could put more bodies into services that touch the member.”

At least some experts believe Delaware State Police Federal Credit Union may be a trailblazer. And it won't be alone.

Theresa Benavidez, president of Corelation in San Diego, which has three clients running on a hosted version, said, “Security threats will force many credit unions to go hosted.”

(Click on graphic at right to see expanded view.)

That is, in an environment where savvy IT staff has to work 24/7 to keep pace with ever- inventive cybercriminals, the only dependable solution for many institutions will be to outsource the core to a company that can invest in the security that is required.

The other factor that may prod more credit unions to embrace hosted cores is pressure from regulators, said Scott Hodgins, a core expert with Cornerstone Advisors in Scottsdale, Ariz. He explained that banks have been quicker to rush into hosted cores, in part because of regulator pressures.

“Credit unions have not had the regulatory scrutiny that banks have. They are pushing the risk onto the vendor. The regulators have not put pressure on the credit unions,” Hodgins said. Were that to change, suggested Hodgins, the stampede into hosted solutions would be on.

Kirk Drake, CEO of Hagerstown, Md., CUSO Ongoing Operations, is still more optimistic. Over the next 10 years, he said, there will be a steady march into hosted cores as credit unions. especially those below $500 million in assets, struggle to cope with mounting security and regulatory issues.

“They are already feeling a lot of pressure,” said Drake, and his strong belief is that many will decide their shrewdest move is to turn a growing number of IT services, including the core, over to third-party hosts. “We believe hosted solutions will be huge,” said Drake. “It will get much bigger, sooner, than many now expect.”