What does a credit union board ask before approving a financial wellness vendor?

Before a credit union board approves a financial wellness vendor, it wants clear answers to five questions. Does this fit our strategy and our members? Will member data be safe? Can this vendor stay in business and support us? How will we know it worked? And what does it cost, including the way out? These questions track the framework NCUA has published for third party relationships: planning, due diligence and ongoing monitoring. Walk into the meeting with a solid answer to each one and you turn a long debate into a vote.

Here is what sits behind each question, and what to bring.

1. Does this fit our strategy and our members?

Boards approve programs, not products. NCUA's letter to credit unions on due diligence over third party service providers puts planning first in any review: does the activity fit the credit union's overall business strategy and risk tolerance?

For financial wellness, your board wants to hear which members you are trying to reach, what problem you are solving for them, and how the program connects to goals already in the strategic plan. Common anchors are growth among younger members, deeper relationships with existing members, and commitments to the communities you serve.

Bring: one paragraph that ties the program to a goal the board has already approved. Name the member group you are serving and the problem you are solving for them.

2. Will member data be safe?

This is often the longest part of the discussion, and it should be. Under NCUA's Guidelines for Safeguarding Member Information (Appendix A to Part 748), your credit union should exercise appropriate due diligence in selecting service providers, require them by contract to protect member information, and monitor them where your risk assessment calls for it. The same guidelines ask the board to approve the information security program and to receive a report on it at least once a year. That makes vendor security a board question, not only an IT question.

Expect these follow up questions:

• What member data does the vendor receive, and is any of it more than the program needs?
• Where is the data stored, and who at the vendor can see it?
• What independent security review can the vendor show you?
• How fast will the vendor tell us about an incident? NCUA's cyber incident rule requires a federally insured credit union to notify NCUA within 72 hours of reasonably believing it has a reportable incident, and that clock can start when a third party notifies you. Your contract needs a notice window shorter than yours.
• What happens to member data when the contract ends?

If the program serves members under 18, add a question about how the vendor handles information about minors.

Bring: the vendor's security documentation, a plain language summary of what data moves where, and your information security officer's sign off.

3. Can this vendor stay in business and support us?

Many financial wellness vendors are young companies, and boards know it. The same NCUA due diligence letter asks you to review a third party's financial statements, check its track record with other clients, and look hard at companies that are weakly capitalized. NCUA calls contacting other credit unions or clients "essential."

A young vendor is not disqualified. Your job is to show the board the evidence: financial statements or a funding summary, references from other institutions, proof of insurance, and a plan for what happens to the service if the vendor is acquired or shuts down.

Bring: two references you have actually called, with a sentence on what each one told you.

4. How will we know it worked?

Plenty of boards have approved education programs that produced a binder of attendance sheets and little else. They want outcomes they can track, so agree on the measures before launch, not after.

Useful measures include:

• How many members enroll, and how many finish
• What they learned, measured with a short check before and after
• What members do next, such as opening a savings account, using a credit builder loan, or lowering their credit utilization (the share of their available credit they are using)

Ask the vendor how often you will get reports and whether you can see results as they happen. NCUA's 2008 questionnaire on third party relationships names risk measurement, monitoring and control as one of the three elements of an effective program, alongside risk assessment and planning and effective due diligence. Regular reporting is how you show the board that monitoring is actually happening.

Bring: three to five measures and a date for the first report to the board.

5. What does it cost, and how do we get out?

Your board wants the full cost over the whole term, not only the monthly fee. That means implementation, staff time, member marketing, and any rewards or incentives you plan to fund. NCUA's due diligence letter also tells you to scrutinize the results a vendor projects rather than take them as given.

Then comes the exit. Have counsel review the contract, as that letter recommends, and confirm the term length, renewal terms, your termination rights, and how member data is returned or destroyed at the end. A board that knows it can leave is far more comfortable saying yes.

Bring: a total cost summary for the full term and the contract's termination clause.

Put it on one page

Before the meeting, turn your answers into a single page memo with five headings that match the five questions. Attach the security documentation, the reference notes and the contract summary behind it. Directors will read the page. Your examiner may ask for everything behind it. Have both ready and you will rarely be sent back for more.

If you are weighing Kredit Academy for your members, you can see how the program works for credit unions, including the reporting your board will ask about, on our page for organizations.