“The Council supports the granting of examination and enforcement powers to (the) NCUA and FHFA to oversee third-party service providers, including information technology, and more broadly, other critical service providers engaged respectively with credit unions and the GSEs,” the FSOC wrote.

NCUA Chairman Rick Metsger, an FSOC board member, said he is pleased that the council is again asking Congress to give the NCUA oversight powers.

“While other federal financial institution regulators already have third-party authority, [the] NCUA's lack of vendor authority with respect to cybersecurity and other threats creates a vulnerability within the financial system and limits the agency's ability to better protect credit unions, their members and the Share Insurance Fund,” Metsger said.

Credit union trade groups have said the additional oversight is not needed.

Credit union vendors generally fall into two categories – companies that also serve banks and therefore are investigated by banking regulators, and CUSOs that are already examined by the NCUA, according to CUNA Chief Advocacy Officer Ryan Donovan.

“We believe that between the two, risks can be appropriately identified and addressed,” Donovan said. “Any additional authority would only add cost and burden to credit unions.”

NAFCU also opposed the plan.

“We believe such authority would be costly and unnecessary since [the] NCUA already requires credit unions to ensure the vendors they work with provide reports directly to the agency,” NAFCU Director of Regulatory Affairs Director Alexander Monterrubio said. “NAFCU recognizes the importance of cybersecurity and risk management, but we firmly believe that cybersecurity and third-party vendor examination authority for [the] NCUA do not go hand in hand.

The FSOC also said potential concentration risks exist for certain credit unions. It said 46 federally chartered credit unions with $8 billion or more in assets are exposed to the petroleum refining business. However, the total exposure cannot be measured in part because state chartered credit unions are not required to report their field of membership routinely.

The committee also said eight credit unions have close member ties to the taxicab industry, adding that competition from ride-sharing companies has affected the taxi business. Those credit unions are affiliated with about $3.5 billion in loans backed by taxi medallions, the FSOC said.