NCUA Rewrote Part 749 in June. The Appendices Your Program Cites Are Gone.

NCUA republished 12 CFR Part 749 at 91 FR 36073 on June 16, 2026, with the current text effective July 16, 2026. The part has a new name, a new structure, and two fewer appendices.

If your vital records preservation program cites Appendix A or Appendix B, it cites material that no longer exists in the regulation.

The timing is worth noting. The rewrite landed roughly two months before a cooling failure at a third-party data center took core processing offline at credit unions in 14 states, and while a major service provider was still rebuilding from a cyberattack. Part 749 is the rule that governs what you can reconstruct when systems you do not control stop working.

What changed

The part is now titled Vital Records Preservation Program. It was Records Preservation Program and Appendices, Record Retention Guidelines; Catastrophic Act Preparedness Guidelines.

Appendix A, the record retention guidelines, and Appendix B, the catastrophic act preparedness guidelines, are both gone from the current text.

Section 749.3 was Vital records center. It is now Vital records center and third-party service providers, and the text carries a new obligation that matters more than the heading suggests. A credit union must maintain, or contract with a third-party service provider to maintain, any equipment or software for its vital records center necessary to access its records. Where a credit union contracts that out, it must maintain effective oversight of the provider to ensure the records meet the requirements of the section.

The rest of the structure holds. Section 749.0 states the purpose and adds that the part does not supersede records preservation requirements applying under other law or regulation. Section 749.1 carries the definitions. Section 749.2 sets the program requirement. Sections 749.4 and 749.5 govern format.

The definitions themselves are the part to read closely, because two of them are load-bearing elsewhere in the regulations.

Vital member services means the essential financial services a credit union provides to its members, with member access to accounts, share withdrawal and deposit facilities, and loan payments and disbursements named as examples.

Vital records means the most recent and current versions of the records needed to restore vital member services, and the rule enumerates them: member share, deposit, and loan balances as of the close of the most recent business day with information sufficient to locate each member; a financial report current as of the most recent month end; bank reconciliations current as of the most recent month end; a list of accounts at financial institutions, insurance policies, and investments with contact information; and emergency contact information for employees, officials, regulatory offices, and vendors used to support vital records.

That last item is easy to skim past. Vendor emergency contacts are a vital record. During a multi-day core outage, the credit unions that could reach someone at the provider had a materially different week than the ones that could not.

The part that is easy to misread

Removing an appendix from a regulation does not remove the underlying obligation from the rule text. It removes guidance about how to meet it.

Section 749.2 still requires the board to establish a written vital records preservation program, with procedures for maintaining duplicate vital records at a vital records center, designated staff responsible for preservation, a schedule for storage and destruction, and a records preservation log in whatever format the credit union determines. Section 749.2(b) still treats a credit union as compliant on storage where an off-site data processor maintains its vital records and the service agreement specifies safeguards against simultaneous destruction of production and backup information.

Read that last provision against what happened to TruStage, where attackers reached backups the company would ordinarily have relied on. The regulation contemplates simultaneous destruction of production and backup. It asks whether your agreement addresses it. That is a contract question you can answer this quarter.

What the removal does change is your documentation. A program that says it follows Appendix B now points at nothing. An examiner reading that program will see a citation to removed material, which is a poor signal about whether anyone has looked at the document recently.

What to do now

Search your program document for "Appendix A" and "Appendix B" and fix what you find. This is a fifteen-minute task and it is the difference between a current program and one that visibly has not been reviewed since before July.

Confirm your vendor emergency contact list is current and stored where you can reach it when systems are down. It is an enumerated vital record. A contact list that only exists inside the system that went offline does not satisfy the purpose of the rule.

Pull your core and data processing agreements and find the simultaneous destruction language. Section 749.2(b) conditions compliance on the service agreement specifying safeguards against simultaneous destruction of production and backup information. Either that language is there or it is not, and knowing which is better than assuming.

Document your oversight of any third party maintaining your vital records center. The new 749.3 language requires effective oversight where the function is contracted out. If your file contains a signed agreement and nothing else, that may not demonstrate oversight.

Map your vital records list against systems you do not control. For each enumerated record, note where it lives and who can produce it if your primary provider is unavailable. Several credit unions spent the September outage unable to see member balances. That is the scenario the rule exists for.

One related item to track. NCUA proposed amending the catastrophic act report at 748.1(b) on December 29, 2025 under RIN 3133-AF77. The proposal would extend the reporting deadline from five business days to 15 calendar days, change the recipient from the regional director to NCUA, and replace the prescriptive recordkeeping list with a requirement to maintain the basic facts of the event. Comments closed February 27, 2026 and the proposal has not been finalized. The definition of catastrophic act, and its reference to the Part 749 definition of vital member services, is not proposed to change.

Source note

This article is based on 12 CFR Part 749 as republished at 91 FR 36073 on June 16, 2026, with current text effective July 16, 2026, as published in the eCFR; the prior version of Part 749 including its appendices; 12 CFR 748.1(b); the proposed rule that preceded it, published at 91 FR 11934 on March 11, 2026 under RIN 3133-AF61, which followed an advance notice of proposed rulemaking published at 89 FR 31117 on April 24, 2024; and NCUA's separate proposed rule on Catastrophic Act Reporting, RIN 3133-AF77, published at 90 FR 60591 on December 29, 2025. The comparison of current and prior structure is drawn from the regulatory text itself.

This article describes the structure of the current rule and the removal of the appendices. It does not attempt a provision-by-provision comparison of every change. Read the final rule preamble at 91 FR 36073 for NCUA's own explanation.

Disclaimer

This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.