The NCUA Vendor Due Diligence Checklist Every Credit Union Should Have

NCUA doesn't publish a fill-in-the-blank vendor due diligence checklist. What it does publish — mainly Letter to Credit Unions 01-CU-20 and the “Evaluating Third Party Relationships” guidance — is specific enough that you can build one from it. Here's that checklist, organized the way examiners actually think about it.

1. Planning, before you sign anything

Before a vendor relationship starts, NCUA expects credit unions to weigh it against their overall business strategy and risk tolerance — not just whether the price is right. Ask: what's the real impact if this vendor fails, is breached, or simply underperforms — on capital, on members, on operations? And just as important: who inside the credit union owns this relationship once the contract is signed? A vendor with no internal owner is a vendor nobody is really watching.

2. Background check

Talk to the vendor's existing clients, not just the references they hand-pick. Check complaint history and reputation through resources like the Better Business Bureau. This step gets skipped more than any other, usually because it feels like extra work for a vendor everyone already trusts — which is exactly when it matters most.

3. Legal review

Have counsel review the actual contract — not a vendor-provided summary. The two things that matter most operationally: the notice period and the auto-renewal terms. NCUA's guidance is direct that credit union officials need to clearly understand rights, responsibilities, and cost allocation between both parties. Once you know the notice period, write down the actual decide-by date — renewal date minus notice period — somewhere you'll see it with enough lead time to act, not the week after it's passed.

4. Financial review

Request and review audited financial statements. The question isn't just “can they deliver today” but “will they still be a viable company in three years.” A vendor's financial instability becomes your operational risk the moment they can't deliver.

5. Insurance review

Confirm the vendor carries adequate cyber liability, errors and omissions, and fidelity bond coverage — and get certificates, not verbal assurance. This is one of the more commonly overlooked items in NCUA's guidance, and one of the easiest to document once you ask for it.

6. Risk tiering and return on investment

Not every vendor carries the same risk. A core processor and an office supply vendor don't belong in the same review cadence. Classify vendors by how critical they are to operations, and project the real cost versus value of the relationship — then revisit that projection periodically rather than assuming it still holds.

7. Ongoing monitoring — the step most credit unions skip

This is where NCUA's language gets blunt: failing to maintain documented, ongoing due diligence controls is called out as an unsafe and unsound practice, not a best practice suggestion. That means a written policy defining who reviews what and how often, a designated staff member responsible for each vendor relationship, and regular reporting to senior management and the board — not just when a contract happens to come up for renewal.

The honest part

Most of this checklist doesn't require software. A spreadsheet can hold every field on this list. What it requires is that someone actually revisits it before the decide-by date arrives, not after — and that when an examiner asks for your vendor list, risk tiers, and last-reviewed dates, you can produce them in minutes, not days.

That's the specific gap VendorSteward's Risk & Due Diligence report is built to close.