NCUA
Letter 01-CU-20 — Evaluating Third-Party Relationships
Credit Union Services
Financial Statement Audits
Independent financial statement audits tailored to credit union accounting and reporting requirements.
TPRM - Vendor Management Program
Program design, gap assessment, and ongoing monitoring for core system, payment, and digital banking vendors.
SOC Report Review Program
Ongoing tracking, reading, and documentation of vendor SOC 1 / SOC 2 reports.
Tax Services for Credit Unions
Federal and state tax compliance specific to credit union structures.
NCUA Regulatory Compliance Advisory
Advisory aligned to NCUA Letter 01-CU-20 and evolving third-party guidance.
IT & Cybersecurity Vendor Risk Assessment
Risk review of core system vendors (Symitar, Corelation, DNA), digital banking, and payment vendors.
Supervisory Committee Support
Direct support for Supervisory Committee audit obligations and reporting.
CAAS / Outsourced CFO
Senior-level financial leadership without the cost of a full-time hire.
Key Focus Areas
• NCUA Letter 01-CU-20 and third-party guidance compliance
• Core system vendors — Symitar, Corelation, DNA
• Digital banking and payment vendor risk
• BSA/AML vendor compliance assessments
• Exam preparation — TPRM documentation readiness
• Board and Supervisory Committee TPRM reporting
Our TPRM Engagement Process
1
Discovery & Inventory
Build or validate a complete vendor inventory and identify undocumented dependencies.
2
Risk Tiering & Prioritization
Apply a risk-based tiering methodology aligned with NCUA guidance.
3
Gap Assessment
Compare current TPRM practices against NCUA expectations.
4
Program Build or Enhancement
Close identified gaps with policies, templates, and reporting frameworks.
5
Vendor Assessments & AUPs
Independent due diligence on critical and high-risk vendors.
6
Ongoing Monitoring & Advisory
Annual program reviews, board reporting, regulatory update advisory.
Critical Vendor Categories We Assess
Technology & Operations Vendors
Core banking platforms — FIS, Fiserv, Jack Henry
Digital and online banking providers — Q2, Alkami, NCR
ATM and debit card processors
Item processing and check imaging vendors
Loan origination and servicing systems
Wire transfer and ACH processing providers
Compliance & Risk Vendors
BSA/AML software and transaction monitoring vendors
OFAC screening and sanctions compliance providers
Credit reporting agencies
Fraud detection and prevention service providers
Cybersecurity monitoring and SOC service providers
Why Credit Unions Choose R&C
✦ Independence — Our advice is never conflicted by product sales or ancillary commissions
✦ Integrity — We hold ourselves to the highest professional and ethical standards
✦ Accountability — When we commit to a deadline or deliverable, we deliver
✦ Service — Shaped by our veterans, service is not a value we adopted. It is who we are
✦ Expertise — We continuously invest in credentials, certifications, and industry knowledge
