What Risks Should Credit Unions Prioritize?

NCUA’s 2026 Supervisory Priorities: What Changed

The 2026 priorities letter differs meaningfully from 2025. Cybersecurity is referenced in a footnote rather than as a standalone section, reflecting the NCUA’s expectation that cybersecurity governance is now a baseline operational requirement. In its place, three new areas enter as named priorities:

• Earnings and Capital Adequacy
• Payment Systems
• Fraud Prevention and Detection

The overarching tone reflects Chairman Kyle Hauptman’s emphasis on right-sized, risk-focused examination and the agency’s “No Regulation by Enforcement” policy. This means examiners are expected to tailor their scope to each institution’s actual risk profile.

Top Credit Union Risks Under NCUA’s 2026 Lens

Here are the top risks and their subsections as detailed by the NCUA for credit unions’ consideration.

Balance Sheet Management

Lending and Credit Risk

Loan quality remains the most acute concern. The overall delinquency rate and rolling 12-month loss rate within federally insured credit union loan portfolios are at their highest point in over a decade, according to the NCUA’s 2026 priorities letter.

The overall loan delinquency rate closed 2025 at 1.02%, the highest level since the third quarter of 2013, per NCUA quarterly data. Loan delinquency rates are projected to decline modestly to approximately 0.85% in 2026, but charge-offs are forecast to remain above their long-run average of 0.50% through at least 2027.

Examiners will focus on the sufficiency of credit administration, including:

• Loan underwriting standards
• Loss mitigation and workout programs
• Allowance for Credit Losses (ACL) reserves and methodologies
• Charge-off practices
• Portfolio concentration monitoring

When lending, servicing, or collection functions are outsourced, examiners will also assess third-party risk management practices.

Sensitivity to Market Risk and Liquidity

Interest rate risk (IRR) and liquidity risk remain closely linked supervisory priorities. Elevated funding costs, asset quality challenges, and structural liquidity constraints continue to affect earnings and balance sheet resilience.

The NCUA notes that replacing defaulted or lower-yielding assets has become more difficult, increasing reliance on higher-yielding loans and heightening sensitivity to both upward and downward rate movements.

Examiners will review credit unions’ ability to identify, measure, monitor, and control IRR and liquidity risk through:

• Sound modeling practices
• Reasonable assumptions
• Appropriately tiered scenarios

They will assess how these risks are incorporated into governance frameworks, contingency funding plans (CFPs), and strategic decision-making. The 2026 letter explicitly emphasizes forward-looking analysis.

Earnings and Capital Adequacy

New as a named priority in 2026, earnings and capital adequacy reflect the compounding pressures of asset quality deterioration, elevated funding d IRR volatility.

The NCUA also notes that equity capital continues to reflect unrealized losses associated with long-duration securities acquired during the low-rate environment, which may constrain balance sheet flexibility under stress.

Examiners will assess whether current and prospective earnings are sufficient to support capital targets across a range of stress scenarios. Reviews may cover:

• Policies
• Procedures
• Risk limits
• Capital planning practices

Operational Risk Management

Payment Systems

The payments environment continues to evolve, and the NCUA has elevated payment systems to a named supervisory priority in 2026. Consumer expectations have driven adoption of real-time and instant payment rails, while simultaneously introducing new operational and security risks.

Payment systems now depend on increasingly complex integrations of applications, information systems, interfaces, and internal controls. The risks of fraudulently induced payments, illicit use of consumer data, and cybersecurity breaches targeting payment infrastructure continue to grow.

Examiners will assess whether credit unions have effective:

• Governance
• Risk assessments
• Vendor management
• Security frameworks

These need to be in place to support payment system operations, protect member data, and ensure resilience against fraud and cyber threats.

Fraud Prevention and Detection

Fraud is named as a standalone priority for the first time in the 2026 letter. The NCUA characterizes fraud as a “pervasive and elevated risk in the U.S. financial system” and signals that it will review examination procedures in 2026 to ensure internal control frameworks keep pace.

Examiners will review the adequacy of internal controls and separation of duties to guard against insider abuse, in addition to member-facing fraud vectors.

Compliance Risk Management

BSA/AML/CFT Compliance

Bank Secrecy Act and Anti-Money Laundering/Countering the Financing of Terrorism compliance returns as a named priority in 2026. FinCEN and federal regulators are continuing to implement provisions of the Anti-Money Laundering Act of 2020 while simultaneously evaluating ways to reduce compliance burden.

The NCUA’s 2026 emphasis is on evaluating each credit union’s risk-based approach to BSA compliance and how well AML/CFT programs are tailored to the institution’s specific risk profile.

Examiners will assess whether resources are directed toward the areas of greatest money laundering and terrorist financing risk and whether controls effectively mitigate illicit financial activity.

How to Mitigate Credit Union Risks in 2026

Credit unions can strengthen their frameworks by aligning proactively with the NCUA’s 2026 priorities across each of the named areas.

Credit Risk Management

• Enhance underwriting criteria and implement early warning systems for at-risk loan segments.
• Strengthen collection programs and member-focused workout strategies.
• Maintain ACL reserves calibrated to current portfolio performance.
• Ensure robust oversight documentation for third-party vendors in lending, servicing, or collections.

Market Risk and Liquidity Management

• Apply tiered, forward-looking ALM stress scenarios covering both upward and downward rate movements.
• Diversify the funding base.
• Monitor liquidity ratios.
• Test contingency funding plans against adverse conditions.
• Ensure balance sheet structure aligns with the stated risk appetite.

Earnings and Capital Planning

• Maintain capital planning processes that incorporate IRR, credit, and liquidity stress scenarios.
• Account for unrealized losses on long-duration securities in flexibility assessments.

Payment Systems Governance

Document governance frameworks for all payment rails in use, covering:

• Risk assessments
• Vendor management
• Security controls
• Incident response plans specific to payment fraud

Fraud Controls

• Review internal controls and separation of duties against the current fraud landscape, including account takeover, synthetic identity, and check fraud.
• Monitor NCUA for updated examination procedures expected in 2026.

BSA/AML/CFT Programs

• Ensure AML/CFT programs reflect a current, institution-specific risk assessment.
• Calibrate policies and controls to the credit union’s actual risk exposure.
• Monitor FinCEN actively.

As credit unions respond to the NCUA’s 2026 Supervisory Priorities, having a scalable, AI-powered risk management system is critical. Software like Predict360 offers a right-sized solution tailored specifically for U.S. community banks and credit unions.

Its capabilities support credit unions in managing credit, market, liquidity, earnings, payment system, fraud, and compliance risks while meeting regulatory requirements such as the NCUA’s 72-hour cyber incident notification rule.