Cybersecurity and Vendor Authority Unrelated: Letter to the Editor

NCUA Chairman Debbie Matz noted in the Feb. 20 CU Times article, “NCUA Ramps Up Vendor Oversight,” that NCUA third-party vendor examination authority was necessary now more than ever due to cyber threats.  While cybersecurity is an extremely important issue, NAFCU does not believe that cybersecurity and third-party vendor authority go hand in hand. As we have consistently maintained, NAFCU believes the agency’s bid for third-party vendor examination authority is unnecessary given that the NCUA is already authorized to thoroughly regulate credit unions and their third-party relationships. Further, NAFCU questions the NCUA’s choice to prioritize this request on its legislative agenda, and we firmly disagree with the NCUA’s assertion that such authority would provide any regulatory relief for credit unions.

If the NCUA were granted this authority, it would only increase credit unions’ already excessive regulatory burden and would do nothing to enhance credit unions’ safety and soundness or provide any regulatory relief.  In all of its recent pushes for third-party vendor authority, the NCUA has yet to state what additional resources would be required, and how much these would cost credit unions. NAFCU believes such authority will require considerable expenditure of the agency’s resources and time.