TLDR: A recent Government Accountability Office (GAO) report, ‘Artificial Intelligence: Use and Oversight in Financial Services’ (GAO-25-107197), has highlighted significant gaps in the National Credit Union Administration’s (NCUA) ability to oversee the use of artificial intelligence by credit unions. The report, published on May 19, 2025, recommends that Congress grant the NCUA authority to examine third-party technology providers and that the NCUA update its model risk management guidance to cover a broader range of AI models. While NCUA Chairman Kyle Hauptman acknowledged the need for updated guidance, he expressed reservations about expanding the agency’s authority over vendors, citing potential financial and operational risks for credit unions.
Washington D.C. – The integration of artificial intelligence (AI) into the financial sector, particularly within credit unions, is under increasing scrutiny from Congress, driven by a new report from the Government Accountability Office (GAO). The report, titled ‘Artificial Intelligence: Use and Oversight in Financial Services’ (GAO-25-107197) and released on May 19, 2025, identifies critical shortcomings in the National Credit Union Administration’s (NCUA) current oversight capabilities regarding AI technologies.
The GAO’s findings indicate that the NCUA, unlike other federal banking regulators, lacks two essential tools for effective AI oversight. Firstly, its model risk management guidance is deemed ‘limited in scope and detail,’ failing to adequately address the diverse array of AI models now being deployed by credit unions for tasks such as automated trading, credit decisions, and customer service. This deficiency leaves both NCUA staff and credit unions without sufficient direction on managing AI-related risks.
Secondly, the report reiterates a decade-old recommendation for Congress to grant the NCUA the authority to examine third-party technology service providers. Despite credit unions’ growing reliance on these providers for AI-driven services, this authority has not yet been granted. The GAO argues that such power would significantly enhance the NCUA’s ability to monitor and mitigate third-party risks, including those associated with AI service providers.
AI offers substantial benefits to financial institutions, including improved efficiency, reduced costs, and enhanced customer experience, such as more affordable personalized investment advice. However, the GAO also highlighted significant risks, including potentially biased lending decisions, data quality issues, privacy concerns, and new cybersecurity threats.
NCUA Chairman Kyle Hauptman, in his response to the GAO report, acknowledged the validity of the criticism regarding model risk management guidance. He stated that the agency would review contemporary sound practices and provide clearer information to examiners and credit unions. However, Hauptman expressed caution regarding the GAO’s recommendation to grant the NCUA enforcement authority over third-party vendors. He noted that while it is ultimately Congress’s decision, such an expansion could lead to a ‘reduction in the quality and quantity of services provided to credit unions’ and impose ‘financial and operational risks.’ Hauptman emphasized that banks hold ten times the deposits of credit unions, making vendors naturally prioritize the larger bank market.
Credit union leaders have echoed skepticism about granting the NCUA new, broad powers. Concerns include the potential for redundant oversight, as the NCUA already accesses interagency reports from other banking regulators. There are also worries about an ‘expertise gap’ within the NCUA and the substantial cost implications for credit unions, whose funds entirely finance the agency’s budget. Expanding the NCUA’s reach would necessitate increased training and hiring, directly impacting credit unions’ balance sheets during an already uncertain economic period.
Also Read:
- Agentic AI Revolutionizes Financial Services: A Deep Dive into Autonomous Finance
- Akuvo Secures Strategic Investment from Vista Equity Partners to Propel Agentic AI in Collections
Instead of new powers, a more practical path forward suggested by industry observers includes the NCUA first expanding its existing model risk guidance to cover real-world AI applications in areas like underwriting, member engagement, and cybersecurity. Additionally, federal banking agencies with existing oversight could formalize sharing their findings with the NCUA. The report also underscores the importance of credit unions proactively establishing robust AI governance policies that address ethical considerations, vendor accountability, and member transparency, rather than solely waiting for regulatory mandates.
