NCUA's New Report to Congress Does Not Ask for Vendor Authority. That Is Two Reports Running.
NCUA published its 2026 Cybersecurity and Credit Union System Resilience Report in June, and updated the page on September 25. It runs the length of its predecessors and covers the same statutory ground required by the Consolidated Appropriations Act, 2021.
It contains no request for third-party vendor examination authority.
Neither did the 2025 report. The June 2024 report did, in direct terms, paired with a statement from the then-Chairman about a regulatory blind spot.
Meanwhile H.R. 10230, which would restore that authority by striking the sunset in 12 U.S.C. 1786a, sits in the House Committee on Financial Services. GAO continues to recommend the authority. The agency that would receive it has now gone two reporting cycles without asking for it in writing.
What replaced the ask
Third-party risk still appears in the 2026 report. It appears as one bullet in the current and emerging threats section, describing the problem rather than requesting a remedy.
The report notes that credit unions rely on third-party service providers for critical member services and back-office operations, and that this reliance may leave a credit union without visibility into vendor controls and cybersecurity posture. It frames the answer as stronger risk management practices by credit unions.
That is a different position from the June 2024 report, which described vendors declining examination requests and refusing to implement recommended actions, and asked Congress to close the gap.
Nothing in the 2026 report says NCUA has abandoned the position. Agencies do not usually announce that. What the document shows is that the request is no longer being made in the vehicle where it was made for years.
If you are assessing whether H.R. 10230 is likely to move, the sponsor's position is only half the picture. GAO restated its recommendation in May 2025 in GAO-25-107197, and that same report records the NCUA Chairman acknowledging the recommendation while raising risks in granting the authority, including a possible reduction in the quality and quantity of services available to credit unions. The recipient agency has been publicly ambivalent and has now stopped asking in its annual report.
The number that gets misread
The 2026 report states that credit unions reported 588 cyber incidents from May 1, 2025 through April 30, 2026.
The 2025 report gave 539 incidents from May 1, 2024 through April 30, 2025. The June 2024 report gave 892 incidents from September 1, 2023 through May 1, 2024.
Comparing 892 to 588 and concluding that incidents fell by a third would be wrong. The 892 figure covers eight months. The other two cover twelve. On a monthly basis the first period runs at roughly 112 reports per month, the second at about 45, and the third at about 49.
The honest reading is that the first eight months after the cyber incident notification rule took effect produced a reporting rate far above what followed, and that the two full years since have been roughly flat with a modest increase in the most recent one. Whether that reflects actual incident volume or reporting behavior settling after a new rule is not something the reports answer.
The 73 percent third-party involvement figure that circulates widely comes from the June 2024 report and belongs to that eight-month window. The 2025 and 2026 reports do not restate it. Using it as a current figure attributes a two-year-old measurement to a period it does not cover.
What is actually in the 2026 report for you
A year-over-year comparison NCUA chose to make. Forty known instances of business email compromise were reported between May 1, 2025 and April 30, 2026, against 27 in the previous period. BEC is the one category the report gives a directional comparison for.
An AI framing with a cited source. The report attributes to CrowdStrike's 2026 Global Threat Report a finding that attacks involving AI-enabled techniques increased by nearly 90 percent, and links an IMF analysis on AI and cyberattack-driven financial stability risk. That is NCUA citing outside work rather than reporting its own data.
An internal audit deadline that lands this week. NCUA's Office of Inspector General audited the agency's cyber threat information sharing practices in 2025, producing eight recommendations due for completion by September 30, 2026. As of March 31, 2026, five were complete, implemented, or resolved.
Confirmation of the assessment tool position. The report confirms the FFIEC Cybersecurity Assessment Tool retirement and records that NCUA's own ACET was updated in September 2025 to incorporate NIST Cybersecurity Framework 2.0 content.
What to do with this
Stop citing the 73 percent figure as current. If it appears in your board materials, risk register, or vendor management justification, date it to the September 2023 through May 2024 window or replace it. A number presented as current that is two years old is the kind of thing an examiner or a board member catches.
Do the vendor inventory work anyway. The case for knowing which vendors perform which authorized services does not depend on whether NCUA asks Congress for anything. If H.R. 10230 moves, you are ready. If it does not, you still have the inventory your own examination needs.
Use the BEC comparison in your payment controls conversation. It is the only year-over-year figure NCUA published, it moved in the wrong direction, and it points at a control set you already own.
Read the threats section for what your examiner read. The current and emerging threats list is short, specific, and published by your regulator. AI-enabled attacks, business email compromise, quantum and cryptographic risk, ransomware, state-sponsored activity, and third-party risk. That list is a reasonable starting point for the risk assessment your examiner will ask to see.
Source note
This article is based on NCUA's 2026 Cybersecurity and Credit Union System Resilience Report, published June 2026 and last modified September 25, 2026; the 2025 report published April 2026; the Cybersecurity and Credit Union System Resilience Annual Report to Congress of June 2024; GAO-25-107197, published May 2025; GAO-15-509; the text of H.R. 10230 as introduced and its bill status record; and 12 U.S.C. 1786a as it stood before its December 31, 2001 sunset. The monthly rate comparison is arithmetic applied to figures and date ranges published in those reports. The CrowdStrike figure is reported here as NCUA cited it and has not been verified against the underlying report.
Disclaimer
This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. H.R. 10230 is pending in committee and is not law. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.