Plus: A Free Compliance Readiness Checklist from Comply-YES!
As we step into the second month of 2026, credit unions across the country are reviewing the newly released NCUA Priorities, and for good reason: these guidelines will shape examiner expectations and influence risk-based reviews for the year ahead.
At Comply-YES!, we’re breaking it down in plain language. Below, we outline key themes from the NCUA Priorities and share a downloadable checklist to help you evaluate your compliance posture, identify gaps, and plan your next steps with clarity.
What the NCUA Said:
Interest rate risk (IRR) is back in the spotlight. Examiners will be looking closely at how well credit unions are modeling, measuring, and managing IRR. This is particularly important in today’s volatile economic environment.
What That Means for You:
Be ready to show your methodology. Examiners will expect clear documentation on assumptions, scenario testing, and how results are shared with management and the board. Tools should be commensurate with the size and complexity of your CU.
From the Checklist:
Evaluate whether your IRR policies were reviewed in the past 12 months. Confirm you have evidence of periodic board-level discussion. Use the gap column to assess how well your practices align with NCUA expectations.
What the NCUA Said:
Credit unions should demonstrate robust risk management across lending types, especially as loan performance shifts. Credit risk modeling, loan loss reserves, and portfolio monitoring are in scope.
What That Means for You:
Be prepared to walk through your process. Examiners want to understand how you evaluate underwriting criteria, review delinquency trends, and adjust your Allowance for Credit Losses (ACL) in real time.
From the Checklist:
Make sure your credit risk review policies are updated and tested. Have documentation ready to show data-driven adjustments to risk assessments and loss provisioning.
What the NCUA Said:
Cybersecurity is a standing priority. But this year, expect even more scrutiny! Especially if you haven’t opted into the ACET (Automated Cybersecurity Evaluation Toolbox).
What That Means for You:
Cybersecurity is no longer an IT-only concern, it’s a compliance concern. Examiners will want to see board engagement, clear response protocols, third-party vendor oversight, and evidence of ongoing monitoring.
From the Checklist:
We include a section that maps your current protocols to the ACET domains, identifies gaps in incident response plans, and evaluates how cybersecurity responsibilities are assigned across your organization.
What the NCUA Said:
The agency plans to increase consumer protection reviews, with special attention to fair lending, overdraft programs, and complaint handling. Smaller CUs are not exempt.
What That Means for You:
You’ll need to demonstrate that policies are fair, fees are disclosed, and marketing and lending practices aren’t unintentionally discriminatory.
From the Checklist:
Check whether you’ve conducted a fair lending review in the past 18 months. Also, confirm whether complaint logs are being analyzed for trends and action.
What the NCUA Said:
The focus in 2026 will be on the effectiveness of Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) programs, not just whether they exist.
What That Means for You:
Examiners want to see risk-based decision making, timely reporting, training records, and how well your systems detect anomalies based on your CU’s unique risk profile.
From the Checklist:
Use this section to document recent independent testing, employee training records, and updates to your Customer Identification Program (CIP) or SAR protocols.
To help you prepare, we’ve created a free downloadable PDF checklist inspired by the 2026 NCUA priorities, but with a focus on lending oversight. This practical tool will help your team assess preparedness in the key area of credit risk. Each section includes:
It’s important to remember that this is a lending-focused resource, and not a full supervisory assessment. The 2026 NCUA priorities also cover areas like interest rate and liquidity risk, operational resilience, cybersecurity, fraud, BSA, and more; all of which deserve a dedicated review.
Think of this checklist as a strong starting point, not a standalone solution. To be truly exam- ready, reach out to our team for a thorough assessment that covers the full supervisory scope.
Pro tip: Share the checklist at your next internal compliance meeting or board session; it’s a great conversation starter!
Regulatory shifts can feel overwhelming, but they don’t have to derail your team. With the right focus and support, your compliance program can feel less like a fire drill and more like a well-oiled machine.
Looking for a deeper dive into these priorities? Join us for our February 24th webinar with Sara Cottle, where we’ll walk through each of these topics in more detail and answer your questions live. Click here to register for the webinar!
