Credit union compliance is the body of federal and state rules that govern how a credit union verifies members, makes loans, protects data, holds capital, reports suspicious transactions, and answers to examiners. The National Credit Union Administration is the primary federal regulator, but the Consumer Financial Protection Bureau, the Financial Crimes Enforcement Network, and state regulators all have a piece of the picture. Getting it wrong exposes the institution to per-violation penalties, forced management changes, and in the worst cases conservatorship or liquidation.
Who Regulates Credit Unions
The Federal Credit Union Act at 12 U.S.C. § 1751 et seq. is the foundational statute for federally chartered credit unions.1Office of the Law Revision Counsel. 12 USC 1751 – Short Title It created the NCUA, authorized chartering and examination, set lending limits, and established the member-owned cooperative structure. The NCUA supervises federal credit unions directly and coordinates with state regulators on federally insured state-chartered credit unions.
The NCUA also administers the National Credit Union Share Insurance Fund, which protects member deposits up to $250,000 per ownership category, mirroring FDIC coverage on the bank side.2MyCreditUnion.gov. Share Insurance Credit unions fund the NCUSIF through a deposit equal to one percent of insured shares, plus periodic premiums when the fund’s equity ratio drops below its statutory floor.
Credit unions with more than $10 billion in total assets pick up a second direct supervisor. The CFPB handles federal consumer financial law examinations at that size, while the NCUA continues to run the safety-and-soundness side.3Consumer Financial Protection Bureau. Institutions Subject to CFPB Supervisory Authority The CFPB can bring its own enforcement actions for violations of laws like the Truth in Lending Act or the Equal Credit Opportunity Act.
Anti-Money Laundering Obligations
Bank Secrecy Act compliance is where examiners are least forgiving. Under 31 CFR Chapter X, every credit union must maintain a formal program with five elements: written internal controls, a designated BSA compliance officer, ongoing staff training, independent testing, and customer due diligence procedures.
Currency Transaction Reports and SARs
A Currency Transaction Report is required for any cash transaction exceeding $10,000, whether it’s a deposit, withdrawal, or currency exchange.4FFIEC BSA/AML InfoBase. FFIEC BSA/AML Assessing Compliance With BSA Regulatory Requirements – Currency Transaction Reporting Breaking a transaction into smaller pieces to duck the threshold is structuring, and it’s a separate federal crime.
Suspicious Activity Reports work off different triggers. Under 12 CFR Part 748, a credit union must file a SAR for insider abuse in any amount, suspected criminal activity aggregating $5,000 or more where a suspect can be identified, or suspected criminal activity aggregating $25,000 or more even without a suspect.5National Credit Union Administration. Suspicious Activity Report The obligation extends to transactions that look designed to evade BSA reporting, even when the evasion is the only suspected wrong.6Federal Reserve. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
Member Identification and Ongoing Due Diligence
A written Customer Identification Program must verify each new member’s identity before or during account opening, using risk-based procedures and documents like a government-issued photo ID and a taxpayer identification number.7FFIEC BSA/AML InfoBase. FFIEC BSA/AML Assessing Compliance With BSA Regulatory Requirements – Customer Identification Program After onboarding, ongoing due diligence requires the credit union to understand the purpose of each relationship and monitor for activity that doesn’t fit the member’s profile. Most BSA exam findings land here: the CIP paperwork looked clean, but nobody flagged the pattern that should have generated a SAR.
Lending Rules
Lending carries the densest stack of consumer-protection rules the credit union has to follow.
Truth in Lending and Mortgage Disclosures
Regulation Z, which implements the Truth in Lending Act, requires disclosure of the annual percentage rate, finance charges, and total cost of credit before a member commits to a loan.8Consumer Financial Protection Bureau. 12 CFR Part 1026 – Truth in Lending (Regulation Z) For mortgages, Regulation X under the Real Estate Settlement Procedures Act adds disclosures covering settlement costs, loan estimates, escrow, and servicing.9National Credit Union Administration. Real Estate Settlement Procedures Act (Regulation X) Most residential mortgages combine the two into a single Loan Estimate and Closing Disclosure, but the underlying obligations remain distinct.
Fair Lending
Regulation B, implementing the Equal Credit Opportunity Act, prohibits discrimination in credit decisions on the basis of race, color, religion, national origin, sex, marital status, age, or receipt of public assistance. Similarly situated applicants must be evaluated on creditworthiness alone. Compliance typically involves statistical analysis of loan data to detect disparities in approval rates, pricing, or terms across protected classes. Fair-lending violations carry both civil liability and lasting reputational damage.
Flood Insurance
Any loan secured by improved real property in a special flood hazard area needs flood insurance for the full term of the loan. The credit union can’t make, extend, or renew the loan without confirming coverage. If a borrower’s policy lapses, the credit union has to force-place coverage and refund any overlapping premiums once the member reinstates their own policy. Under the 2026 adjusted schedule, flood insurance noncompliance runs $2,730 per violation.10eCFR. 12 CFR 747.1001 – Adjustment of Civil Monetary Penalties
Member Business Loan Cap
Under 12 CFR 723.8, aggregate member business loans are capped at the lesser of 1.75 times the credit union’s actual net worth or 1.75 times the minimum net worth required under prompt corrective action.11eCFR. 12 CFR 723.8 – Aggregate Member Business Loan Limit Waivers exist, but approval requires demonstrating both experience and adequate risk management.
Deposits and Electronic Transfers
Truth in Savings
The Truth in Savings Act requires clear disclosure of fees, interest rates, and annual percentage yield on deposit accounts. For credit unions, the NCUA implements this through 12 CFR Part 707, not the CFPB’s Regulation DD that applies to banks. The two regulations are required by statute to be substantially similar, but the citation matters when a compliance officer is pulling the right reference.12National Credit Union Administration. Truth in Savings Act (NCUA Rules and Regulations Part 707) Periodic statements have to show the annual percentage yield earned, dividends paid, fees charged, and the reporting period.13eCFR. 12 CFR Part 1030 – Truth in Savings (Regulation DD)
Regulation E Error Resolution
Regulation E covers electronic fund transfers, including debit card transactions, ATM withdrawals, direct deposits, and peer-to-peer payments. When a member reports an unauthorized transfer or account error, the credit union has 10 business days to investigate and resolve it, then three business days to report the results.14eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors If the investigation can’t finish in 10 days, the timeline extends to 45 days, but only if the credit union provisionally credits the member’s account within the initial 10 business days and lets the member use the funds while the investigation continues.15Office of the Law Revision Counsel. 15 USC 1693f – Error Resolution
Some situations get longer windows. Transfers involving a new account (within 30 days of the first deposit) allow 20 business days for the initial investigation and 90 days extended. Point-of-sale debit transactions and international transfers also qualify for the 90-day extension. Missing these deadlines exposes the credit union to treble damages, which is why Regulation E gets close attention during exams.
Privacy and Data Security
The Gramm-Leach-Bliley Act requires credit unions to disclose their information-sharing practices and let members opt out of having nonpublic personal information shared with nonaffiliated third parties.16Federal Trade Commission. Gramm-Leach-Bliley Act The privacy provisions are implemented for most financial institutions through Regulation P at 12 CFR Part 1016. The NCUA’s former privacy regulation at 12 CFR Part 716 has been republished under that consolidated framework.17eCFR. 12 CFR Part 716 – Privacy of Consumer Financial Information
One common point of confusion: the FAST Act amended the GLBA in 2015 to carve out an exception to the annual privacy notice requirement. A credit union that shares nonpublic personal information only within the permitted statutory exceptions and has not changed its privacy policies since the last notice does not need to send a new notice every year.18Federal Register. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act (Regulation P) Many credit unions qualify, but they still need to document their eligibility and update the notice when practices change.
The GLBA Safeguards Rule adds administrative, technical, and physical protections for member data: encrypted systems, restricted access to sensitive records, employee training on data handling, and incident response plans.
Third-Party Vendor Responsibility
Outsourcing a function doesn’t outsource the compliance obligation. The NCUA holds the credit union fully responsible for safeguarding member assets and maintaining sound operations regardless of whether a third party performs the work.19National Credit Union Administration. Evaluating Third Party Relationships Before signing, the credit union should assess whether the arrangement fits its strategic plan and evaluate credit, compliance, liquidity, and strategic risks. Examiners look for three things: that risks were assessed before the contract was signed, that adequate due diligence was performed on the vendor’s finances and security, and that ongoing monitoring is in place.
How Examinations Work
The NCUA sets exam frequency by size and risk. Credit unions with a CAMELS composite rating of 3, 4, or 5, or those less than well capitalized, subject to an outstanding enforcement action, or holding more than $10 billion in assets, face exams every 8 to 12 months. Well-rated credit unions between $1 billion and $10 billion in assets with no CEO change can go 12 to 16 months. Smaller federal credit unions in good standing sit on a 14- to 18-month cycle, and federally insured state-chartered credit unions in good condition may be examined as infrequently as once every five years.20National Credit Union Administration. Exam Scheduling Policy Changes The NCUA can examine any institution more frequently if trends or emerging risks warrant it.
Examiners apply the CAMELS rating system, evaluating Capital adequacy, Asset quality, Management, Earnings, Liquidity, and Sensitivity to market risk.21National Credit Union Administration. Appendix A – NCUA CAMELS Rating System A low CAMELS composite triggers more frequent exams and can set escalating supervisory action in motion.
Internally, every federal credit union has a supervisory committee responsible for oversight. The committee has to obtain an annual audit and verify member accounts at least once every two years.22National Credit Union Administration. Examiner’s Guide – Supervisory Committee If it identifies violations of law, the charter, or the bylaws, or any practice it considers unsafe, it can call a special meeting of the membership by majority vote.23Office of the Law Revision Counsel. 12 USC 1761d – Supervisory Committee; Powers and Duties
Capital Categories Under Prompt Corrective Action
The NCUA’s prompt corrective action framework, at 12 CFR Part 702, sorts credit unions into capital categories based on their net worth ratio:24eCFR. 12 CFR Part 702 Subpart A – Prompt Corrective Action
- Well capitalized: net worth ratio of 7% or greater (complex credit unions also need a risk-based capital ratio of 10% or greater).
- Adequately capitalized: net worth ratio of 6% or greater (complex credit unions need an 8% or greater risk-based capital ratio).
- Undercapitalized: net worth ratio of 4% to less than 6%, or a complex credit union with a risk-based capital ratio below 8%.
- Significantly undercapitalized: net worth ratio of 2% to less than 4%.
- Critically undercapitalized: net worth ratio below 2%.
A credit union that drops below well capitalized has to submit a net worth restoration plan. At significantly undercapitalized, the NCUA can restrict growth, require management changes, and prohibit certain transactions. Critically undercapitalized triggers conservatorship or liquidation within fixed statutory timelines.
Enforcement Actions and Penalties
When compliance failures are serious, the NCUA’s enforcement authority under 12 U.S.C. § 1786 is broad. The agency can issue cease and desist orders, remove or prohibit individuals from participating in the credit union’s affairs, and assess civil money penalties.25Office of the Law Revision Counsel. 12 USC 1786 – Termination of Insured Credit Union Status; Cease and Desist In emergencies where continued operation threatens insolvency or significant member harm, the NCUA can issue temporary cease and desist orders without the usual hearing.
Civil money penalties follow a three-tier structure under the 2026 adjusted schedule:10eCFR. 12 CFR 747.1001 – Adjustment of Civil Monetary Penalties
- Tier 1: up to $12,567 per violation for violations of law, regulation, or an order or agreement.
- Tier 2: up to $62,829 per day for recklessly engaging in unsafe or unsound practices or breaching fiduciary duty.
- Tier 3: up to $2,513,215 for knowingly committing Tier 1 or 2 violations. For institutional violations, the cap is the lesser of $2,513,215 or 1% of total assets.
The figures are adjusted annually for inflation. At the extreme end, the NCUA can place a credit union into conservatorship, taking over operations while attempting rehabilitation, or into liquidation, closing the institution and paying out insured deposits through the NCUSIF. The path from an exam finding to conservatorship is shorter than many board members realize, especially when the initial deficiency goes unaddressed through multiple examination cycles.