Credit union compliance departments are routinely one or two people carrying an obligation load that looks a lot like a bank's — BSA, consumer regulations, vendor oversight, IT security — plus a layer of credit-union-specific rules on top. When the NCUA exam letter arrives, that small team has to produce a year of evidence on short notice. Credit union compliance software exists to make that production automatic instead of heroic, and this guide covers what it should actually do.
Key Takeaways:
- NCUA runs a risk-focused exam program, and well-run federal credit unions can qualify for an extended examination cycle — but the evidence expectations do not shrink
- Examiners request BSA program evidence, board minutes and policy review dates, complaint records, vendor due diligence, and information security documentation
- Credit unions carry unique obligations including share insurance advertising rules under Part 740 and federal credit union lending rules under Part 701
- Software should turn obligations into recurring owned work, capture evidence each cycle, feed board reporting, and assemble the exam package
How NCUA Examinations Work
The NCUA runs a risk-focused examination program: examiners scope each exam around the areas of greatest risk at that credit union rather than working a fixed checklist uniformly. Well-run federal credit unions — smaller institutions with strong ratings — can qualify for an extended examination cycle, stretching the time between exams. The NCUA publishes its examination priorities and program details in its supervision resources.
Federally insured state-chartered credit unions answer to two supervisors: the state regulator conducts or participates in exams, and the NCUA maintains insurance-related oversight. In practice this can mean alternating or joint exams, and it always means the compliance record needs to satisfy both audiences.
An extended cycle is a mixed blessing. Less frequent exams mean more time between checkpoints — and more accumulated history to produce when the exam finally happens. A credit union that only organizes its evidence in exam years will find the extended cycle made the problem bigger, not smaller.
What NCUA Examiners Request
The request list varies by scope, but a consistent core shows up in nearly every exam:
- BSA program evidence — the risk assessment with its review date, training records with completion rosters, independent testing reports and remediation status, SAR and CTR filing processes
- Board minutes and policies — with visible evidence that required policies were reviewed and approved on schedule, not just that they exist
- Complaint handling records — intake, categorization, resolution timelines, and trend reporting to management
- Vendor due diligence files — risk assessments, contract reviews, and ongoing monitoring for material third parties
- Information security documentation — the NCUA's Information Security Examination (ISE) procedures structure the IT review, and many credit unions use the ACET maturity assessment to benchmark their cybersecurity posture
Every item on that list is recurring work that happened (or didn't) during the cycle. The exam is essentially an audit of whether the credit union can prove its own routine operation.
The Compliance Load Credit Unions Carry That Banks Don't
Beyond the shared federal consumer regulations, credit unions manage a distinct rule set. Field of membership requirements constrain who the credit union may serve, and membership eligibility documentation is examinable. Share insurance advertising rules under 12 CFR Part 740 govern the official sign and how insured status is represented across branches, websites, and marketing — a perennial source of findings when marketing moves faster than compliance review.
Federal credit union lending rules under 12 CFR § 701.21 impose requirements including the interest rate ceiling that do not apply to banks. Credit unions serving military communities also carry a heavier Military Lending Act load, since a large share of their membership are covered borrowers and their dependents.
None of these obligations is individually crushing. The problem is the aggregate: dozens of recurring requirements, each with its own cadence, owner, and evidence expectation, tracked by a team that also handles day-to-day member issues.
Why Small Compliance Teams Feel This Hardest
When findings land, the NCUA's Documents of Resolution (DOR) process turns them into mandated corrective actions with deadlines and follow-up verification. For a two-person compliance shop, a DOR is a second job: remediation work, progress documentation, and board reporting layered on top of the routine load that caused the finding in the first place.
The pattern that produces DORs is rarely ignorance. It is capacity — the policy review that slipped two quarters, the vendor file that never got its annual refresh, the training campaign that ran but whose roster nobody exported. Manual tracking in spreadsheets fails silently, and the failure surfaces at the worst possible moment. We covered the economics of this in what manual compliance workflows really cost at exam time.
What Compliance Software Should Do for a Credit Union
For a credit union, the buying criteria reduce to four capabilities:
- Recurring obligations with owners. Every requirement — policy reviews, BSA training, vendor refreshes, Part 740 advertising checks — becomes a scheduled task assigned to a person, with visibility when anything slips
- Evidence per cycle. Each completed task captures its proof at completion: the approved policy version, the training roster, the signed vendor review. Evidence accumulates continuously instead of being reconstructed
- Board reporting. Program status, overdue items, findings aging, and complaint trends flow into board materials without manual re-assembly, since examiners read minutes for substance
- Exam package assembly. When the request list arrives, the response is retrieval — filtered by area, exported with the evidence attached
On budget: credit unions should price software against the realistic alternative, which is not "free spreadsheets" but staff hours spent tracking and reconstructing, plus the remediation cost when something slips into a DOR. Tools priced for regional bank budgets are the wrong comparison set; the right question is whether the platform replaces the tracking-and-reconstruction work a small team cannot sustainably do by hand. Our guide to compliance exam preparation shows what the prepared version of this looks like in practice.
How Credit Unions Stay NCUA-Ready with Canarie
The credit unions that handle NCUA exams smoothly run compliance as a calendar, not a filing cabinet. Obligations are loaded once with their cadences, every cycle produces its evidence automatically, and the compliance officer's job shifts from chasing status to reviewing exceptions.
Canarie was built for exactly this operating model: it converts the obligation load — BSA pillars, policy review schedules, Part 740 checks, vendor oversight, BSA exam prep items — into recurring work with owners, captures evidence as work completes, and assembles board reports and exam packages from the record that already exists.
See how credit unions keep every cycle evidenced →
Frequently Asked Questions
How often does the NCUA examine credit unions?
The NCUA operates a risk-focused program in which exam frequency depends on the credit union's size, condition, and charter type. Well-run federal credit unions can qualify for an extended examination cycle, while institutions with weaker ratings or elevated risk see examiners more often. Federally insured state-chartered credit unions are also examined by their state regulator, which can mean alternating or joint exams.
What do NCUA examiners ask for in a compliance exam?
The consistent core includes BSA program evidence (risk assessment, training rosters, independent testing), board minutes showing policy reviews and approvals on schedule, complaint handling records, vendor due diligence files, and information security documentation under the ISE procedures. Examiners are testing whether the credit union can prove its routine compliance work happened throughout the cycle, not just describe it.
What is a Document of Resolution (DOR)?
A DOR is the NCUA's mechanism for requiring corrective action on exam findings: it documents the problem, the required remediation, and the deadline, and examiners verify completion at follow-up. For small compliance teams, DORs are expensive because remediation and progress reporting stack on top of the routine workload. Most DORs trace back to recurring work that slipped rather than to unknown requirements.
Do small credit unions really need compliance software?
The smaller the team, the less slack exists to absorb tracking failures, which is the opposite of how most credit unions think about the purchase. A 1-2 person shop managing dozens of recurring obligations in spreadsheets has no early warning when something slips. The evaluation should compare software cost against the staff hours spent on manual tracking and exam reconstruction, plus the remediation cost of findings that better tracking would have prevented.