NCUA Stopped Using the Words "Reputation Risk." It Did Not Stop Examining the Things.
Executive Order 14331, signed August 7, 2025 and published at 90 FR 38925, gave federal banking regulators 180 days to remove the use of reputation risk and equivalent concepts from the guidance documents, manuals, and materials their examiners use.
That deadline was February 4, 2026.
NCUA moved earlier. Letter to Credit Unions 25-CU-05, issued in September 2025, states that the agency ceased using reputation risk and equivalent concepts in the examination and supervisory process effective September 25, 2025. Examiners will not base supervisory concerns on reputation risk or discuss it during examinations.
In February 2026, according to NCUA's own report to Congress, the FFIEC released updates to the IT Examination Handbook removing references to reputational risk, consistent with the executive order. NCUA states those updates did not establish new requirements.
If you read that sequence as a reduction in what examiners look at, read the NCUA letter again.
What the letter actually says happens next
NCUA's letter is explicit that the underlying subject matter survives the label. It states that the agency will continue examining key review areas historically classified under reputation risk, giving financial liability associated with active litigation and insider abuse as examples, as part of an examination as necessary.
The letter also says NCUA is reviewing and updating regulations, manuals, guidance, and training materials to remove references to reputation risk, and that until that work is complete, the letter supersedes prior guidance on the topic.
The category was removed. The examination areas that sat inside it were redistributed, not retired. Litigation exposure and insider abuse are named in the letter itself as things examiners will still look at. If your enterprise risk framework had a reputation risk heading and you deleted it, the items underneath needed somewhere to go, and NCUA has told you they are still in scope.
That is the practical problem this creates. Most institutions did not maintain a clean mapping from the reputation risk category to the concrete exposures inside it. When the heading disappeared, some of those exposures lost their owner.
A scope point worth getting right
The executive order directs federal banking regulators, which it describes to include the Small Business Administration and federal member agencies of the Financial Stability Oversight Council with supervisory authority over banks, savings associations, or credit unions.
NCUA is not named explicitly in that description. It is an FSOC member agency with supervisory authority over credit unions, so it falls inside the functional definition, and it acted accordingly and early.
The distinction matters if you are reading the order itself and looking for your regulator by name. Reading a coverage summary that says the order named NCUA would be reading something the text does not say.
The order also directs that reputation be considered only in the context of reasonable and apolitical risk-based assessment. The policy target is politicized or unlawful debanking. The effect on examination practice is broader than that target, which is why the letter covers ground unrelated to account closures.
What the order was aimed at
The policy target is politicized or unlawful debanking. The order directs that reputation be considered only in the context of reasonable and apolitical risk-based assessment, and requires regulators to give examiners formal guidance to that effect.
That framing matters if your institution makes decisions about member accounts or about which businesses you will serve.
The order does not say you cannot decline a relationship. It addresses the use of a reputation-based rationale as a supervisory concept. Decisions grounded in documented, articulable risk remain decisions you can make and defend.
The practical shift is in how you record them. A file note reading "reputational concerns" was never strong documentation. It is now a phrase your regulator has removed from its own vocabulary. Whatever the underlying reason was, credit quality, fraud history, BSA risk, operational capacity, that is what belongs in the record.
The same logic reaches vendor and CUSO relationships. If you have declined or exited a third party, the documented basis should be the specific risk rather than a general concern about association.
What to do
Find where the category went in your own framework. Pull whatever your risk register, ERM framework, or board reporting called reputation risk as of mid-2025. List the concrete exposures that sat under it. Litigation, insider conduct, vendor conduct, member complaints, adverse media, whatever you had. Then confirm each one has a current owner and a current category. This is a one-afternoon exercise that closes a gap an examiner can open in one question.
Do not delete controls because the label was retired. The executive order addressed how regulators classify and discuss risk. It did not establish that litigation exposure or insider abuse stopped mattering, and NCUA's letter says the opposite in plain terms.
Check your board materials for the orphaned heading. Board reporting templates tend to outlive the frameworks they were built from. A reputation risk section that now says "not applicable" is worse than either keeping it or reallocating it properly.
Expect examiner language to have changed, not examiner interest. If an examiner asks about active litigation or an insider matter, that is the letter operating as written rather than a reputation risk question in disguise.
Watch for the rest of the update. NCUA said in September 2025 that it was still working through regulations, manuals, guidance, and training materials. Until that finishes, the letter controls, and documents you rely on may still carry the old language.
Source note
This article is based on Executive Order 14331, Guaranteeing Fair Banking for All Americans, signed August 7, 2025 and published at 90 FR 38925 on August 12, 2025; NCUA Letter to Credit Unions 25-CU-05, Elimination of Reputation Risk, September 2025; and NCUA's 2026 Cybersecurity and Credit Union System Resilience Report, which describes the February 2026 FFIEC IT Examination Handbook updates and states they did not establish new requirements. The FFIEC handbook changes are described here as NCUA characterized them in its report to Congress rather than from the handbook text.
Disclaimer
This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. NCUA has stated that its review of regulations, manuals, guidance, and training materials was ongoing, so documents in circulation may not reflect current supervisory practice. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.