# NCUA Letter 07-CU-13: Evaluating Third Party Relationships Source: https://www.bankingnewsai.com/ai-regulation/documents/ncua-letter-07-cu-13 Last updated: Aug 26, 2026 Letter to Credit Unions 07-CU-13, issued in December 2007, is the NCUA's foundational third-party risk guidance and the framework examiners apply to AI vendors today. It requires risk assessment and planning, due diligence (financial condition, controls, contract review), and ongoing monitoring of third-party relationships, with the credit union's board retaining responsibility for outsourced activities. ## At a glance | Field | Value | | --- | --- | | Authority | [NCUA](https://www.bankingnewsai.com/ai-regulation/ncua) | | Type | Letter | | Status | In force | | Published | Dec 1, 2007 | | Effective | Dec 1, 2007 | | Applies to | All federally insured credit unions | | Official text | https://ncua.gov/regulation-supervision/letters-credit-unions-other-guidance/evaluating-third-party-relationships | ## Key points - Three-stage framework: risk assessment and planning, due diligence, and risk measurement, monitoring, and control - Due diligence covers the vendor's background, business model, financial condition, legal review, accounting, and internal controls - Contracts should address performance standards, data security, confidentiality, audit rights, and termination - Board and management remain responsible for outsourced activities; outsourcing does not outsource accountability - The NCUA's 2025 AI resource page points credit unions back to this due-diligence standard for AI service providers - Because the NCUA cannot examine technology vendors directly, this letter is the primary lever over AI supplied by third parties ## What changed for banks Nothing about AI specifically, but in 2025-2026 this 2007 letter is what NCUA examiners cite when asking how a credit union vetted an AI underwriting model, chatbot, or fraud tool bought from a vendor. Its due-diligence checklist (understand how the product works, what the risks are, what safeguards the vendor has) has become the de facto AI vendor standard for credit unions. ## Use cases it governs - [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors) - [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general) ## FAQ ### Is 07-CU-13 still the NCUA's third-party guidance? Yes. It remains posted as current guidance, supplemented by the 2023 Financial Innovation rule that codified due-diligence expectations for indirect lending and loan participations. The NCUA did not join the June 2023 interagency third-party guidance issued by the OCC, Fed, and FDIC. ### What does the NCUA expect before a credit union deploys a vendor AI tool? The 07-CU-13 process: a risk assessment, due diligence on the vendor and the tool (how it works, its risks, the vendor's safeguards), a contract with data-security and audit terms, and ongoing monitoring reported to the board. ## Related documents - [Hauptman Senate testimony (Feb 2026)](https://www.bankingnewsai.com/ai-regulation/documents/ncua-hauptman-senate-testimony-2026) — Written Testimony of NCUA Chairman Kyle S. Hauptman before the U.S. Senate Committee on Banking, Housing, and Urban Affairs (Feb 12, 2026) - [NCUA Letter 26-CU-01](https://www.bankingnewsai.com/ai-regulation/documents/ncua-letter-26-cu-01) — NCUA's 2026 Supervisory Priorities (Jan 14, 2026) - [NCUA AI Compliance Plan (2025)](https://www.bankingnewsai.com/ai-regulation/documents/ncua-ai-compliance-plan-2025) — NCUA Artificial Intelligence Compliance Plan (Sep 1, 2025) - [NCUA Credit Union AI Resource Center](https://www.bankingnewsai.com/ai-regulation/documents/ncua-credit-union-ai-resource-center) — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page (Aug 1, 2025) - [NCUA Board AI briefing (Jul 2025)](https://www.bankingnewsai.com/ai-regulation/documents/ncua-ai-board-briefing-2025) — Board Briefing: Artificial Intelligence and Its Use Within the Credit Union Industry and the NCUA (Jul 24, 2025) - [NCUA Financial Innovation Rule (2023)](https://www.bankingnewsai.com/ai-regulation/documents/ncua-financial-innovation-rule-2023) — Financial Innovation: Loan Participations, Eligible Obligations, and Notes of Liquidating Credit Unions (final rule) (Sep 21, 2023) - [NCUA testimony to House AI Task Force (2022)](https://www.bankingnewsai.com/ai-regulation/documents/ncua-ai-task-force-testimony-2022) — Written Testimony of Kelly Lay, Director of the Office of Examination and Insurance, before the House Financial Services Task Force on Artificial Intelligence (May 13, 2022) - [2021 Interagency AI RFI](https://www.bankingnewsai.com/ai-regulation/documents/ncua-interagency-ai-rfi-2021) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021) Last reviewed Aug 26, 2026. Cite the official text (https://ncua.gov/regulation-supervision/letters-credit-unions-other-guidance/evaluating-third-party-relationships) for the rule and this page for the summary and dates. --- Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/ncua-letter-07-cu-13 Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.