Signing a New Vendor Agreement? Consider This First

Credit unions are constantly entering into agreements with third-party vendors ranging in criticality from vendors that implement a new core processor to vendors that provide custodial services. Regardless of the vendor, credit unions have a regulatory obligation to protect confidential member information. This regulatory obligation has come under increased scrutiny by the NCUA considering the ever-present threat of cybersecurity data breaches. Therefore, in addition to credit unions’ regulatory obligation to maintain the security and confidentiality of member information, it is also imperative for credit unions to address the data breach threat by ensuring there are adequate protections incorporated into their vendor agreements to avoid potential liability resulting from unauthorized access or use of their confidential information.

Despite the fact that each third-party vendor agreement includes different contractual terms, credit unions should make sure that the following five provisions are addressed in some capacity. First, the agreement must state what information the parties consider to be “confidential.” If member information will be shared with the vendor, member information should be explicitly listed as the confidential information of the credit union. It must also be clearly stated that any and all confidential information of the credit union is and will continue to be the exclusive property of the credit union.