A CUSO relationship is easy to enter and expensive to leave. The service starts, your processes reshape around it, your data moves into their systems, and eighteen months later the question of switching involves migrating loan records, retrieving documents, and retraining staff you no longer have.
So the diligence that matters isn’t the diligence of a purchase. It’s the diligence of a dependency.
This guide covers what to examine before signing: the entity itself, its financial condition, its regulatory standing, the contract, its operational depth, and — the part almost nobody does at the outset — how you would leave. For the CUSO model itself, start with our guide to what a CUSO is.
Key Takeaways
- NCUA treats CUSO arrangements as third-party relationships requiring diligence proportionate to how critical the service is.
- Confirm the CUSO is sufficiently bonded or insured for its specific operations. This is a regulatory condition, not a nice-to-have.
- A CUSO must give NCUA and the relevant state supervisory authority complete access to its books and records — including where your relationship is only a services contract.
- Exit terms decide your leverage for the life of the relationship. Negotiate transfer assistance and data return before you sign, not when you want out.
- Ask for references from credit unions that went through a problem, not just an onboarding.
Start From the Service, Not the Vendor
The depth of diligence should match what you’re handing over. NCUA’s guidance on third-party relationships asks you to weigh the critical nature of the service, the provider’s expertise, staffing changes, economic and regulatory change, and your oversight strategy.
Applied here, that means a CUSO doing your marketing collateral is not the same diligence exercise as a CUSO underwriting and servicing your commercial portfolio. Scope the work first, then scale the review.
Write down, before you start: what functions are moving, what decisions remain yours, what data leaves your building, and what would happen operationally if the provider stopped tomorrow. Those four answers determine everything that follows.
The Entity
Legal structure. Is it a corporation, LLC, or limited partnership? If you’ll be investing rather than contracting, this determines what’s permissible, and an LLC brings a written-legal-advice requirement covered in our guide to what Part 712 requires.
Ownership. Who owns it. Whether other credit unions have invested, and whether any of them sit on the board. A CUSO owned by credit unions you know is a reference source in itself.
Customer base. A CUSO must primarily serve credit unions or their members. Ask what share of revenue comes from credit unions. A provider whose credit union business is a small side line has different incentives from one built around it.
Tenure and history. How long it has operated, and through which conditions. A CUSO that has only operated in benign credit conditions hasn’t been tested where it counts.
Financial Condition
You are taking counterparty risk whether or not you invest a dollar. A provider under financial stress delivers worse service before it delivers none.
Request audited financial statements, ideally three years. Look at revenue concentration — a CUSO dependent on two or three large clients is fragile, and losing one changes their economics and possibly their staffing.
Ask about capitalization relative to obligations. Regulation expects a CUSO to be adequately financed as a separate unit in light of the normal obligations reasonably foreseeable for a business of its size and character; that is a sensible commercial test as well as a compliance one.
Confirm bonding and insurance. An FCU may invest in, lend to, or contract with only those CUSOs that are sufficiently bonded or insured for their specific operations. Ask for certificates, check the coverage is appropriate to the services you’re buying, and diarise the renewal dates.
Regulatory Standing
Reporting. CUSOs are required to submit an annual report to NCUA, and newly formed ones within 60 days of becoming subject to the rule. Ask whether they report and whether they’re current.
Examination history. CUSOs are subject to NCUA review. Ask whether they’ve been reviewed and whether anything arose. A provider that answers this openly is telling you something useful; one that deflects is also telling you something.
Access obligations. A CUSO must give NCUA — and the state supervisory authority with jurisdiction over any federally insured state-chartered credit union that has a loan to, investment in, or contractual agreement for products or services with the CUSO — complete access to its books and records and the ability to review internal controls. Confirm the provider understands this applies to a services relationship, not only to investors.
Permissible activities. Confirm the services you’re buying fall within preapproved CUSO activity categories.
Operational Depth
This is where a polished sales process and a thin operation diverge.
People. How many staff perform the function you’re buying, how long they’ve done it, and what their workload looks like. Ask what happens when the person who knows your portfolio leaves — and whether the answer is a documented process or a name.
Systems. What platform, whether you get direct visibility, what reporting is standard versus custom, and how data is secured.
Business continuity. Disaster recovery arrangements, tested or theoretical, and recovery time objectives. Servicing that stops for a week is a member-facing failure.
Capacity. How much room they have to take on your volume without degrading, and what their growth has looked like against their hiring.
Problem experience. For lending services, ask specifically about workouts: how many, what types, what outcomes. Competence with performing loans is common; competence with failing ones is not.
The Contract
Read it as the document that governs the relationship’s worst day.
| Term | What to confirm |
|---|---|
| Scope of services | Exactly what’s included, and what is billed separately |
| Standard of care | The obligation the provider is actually held to |
| Service levels | Measurable, with consequences rather than aspirations |
| Reporting | Content and cadence, contractual not discretionary |
| Data ownership | That your data is yours, in a usable format, on demand |
| Confidentiality | Permits disclosure to your regulator, auditors, and counsel |
| Regulator access | Explicit acknowledgement of NCUA and state access rights |
| Subcontracting | Whether the provider may delegate, and whether you’re told |
| Liability and indemnity | Caps, carve-outs, and what survives termination |
| Term and termination | Notice periods, termination for cause and convenience |
| Transfer assistance | What they must do to help you leave |
| Insurance | Coverage maintained for the life of the agreement |
Two rows deserve emphasis. Data ownership determines whether leaving is possible. Transfer assistance determines whether it’s affordable.
Plan the Exit Before the Entry
The uncomfortable truth about outsourcing arrangements is that leverage is highest before signature and declines steadily afterwards.
Settle three things now.
What you get back, and how. Loan records, payment histories, borrower files, original documents, and reporting data — in what format, within what period, at what cost.
What they must do to help. A transition assistance obligation with a defined duration, surviving termination, including for termination for cause.
What happens if they fail. Not merely if you’re dissatisfied, but if the provider becomes insolvent or exits the business. Where original loan documents are held matters enormously here, and so does whether your data sits somewhere you can reach.
Then keep a live answer to one question: if this relationship ended in ninety days, what would we do? A credit union that can answer it is negotiating from a different position than one that can’t.
Red Flags
Some findings are negotiable. These justify walking away.
Reluctance to provide financials. A provider asking you to depend on it, while declining to show whether it can be depended on, has answered the question.
No workout experience, presented as no workouts having been needed. Every commercial servicer of any tenure has seen loans deteriorate. A clean record usually means a short one.
Contract with no exit. No transfer assistance, no defined data return, or termination rights available only to them.
Resistance to regulator-access language. This is a regulatory requirement, and a provider hesitant to acknowledge it in writing either doesn’t understand its obligations or doesn’t intend to meet them.
Key-person dependency with no succession. One person who knows the work, and no documented process behind them.
Pressure to sign before diligence completes. The same pressure that produces funding-before-agreement in participation deals, applied to a longer commitment.
References that are all onboardings. If nobody will speak to you about a difficult period, consider why. Ask the provider directly for a client who has been through a loan workout with them, and treat an inability to produce one as a finding rather than an inconvenience.
Ongoing Monitoring
Diligence at onboarding is a snapshot; the relationship is a film.
Set a schedule: annual review of financials and insurance, periodic service-level review against what the contract promises, confirmation that reporting is arriving complete and on time, and a check that key staff haven’t turned over without notice. Re-confirm regulatory reporting status annually.
Decide in advance what a deteriorating trend triggers. Monitoring that produces observations no one acts on is a filing exercise, and it will not satisfy an examiner asking how you supervise a critical provider.
Frequently Asked Questions
What due diligence does NCUA expect before using a CUSO? Diligence proportionate to the service: how critical it is, the provider’s expertise, staffing changes, economic and regulatory change, and your oversight plan. Critical services such as underwriting and servicing warrant deeper review and documented ongoing monitoring.
Do we need to diligence a CUSO if we’re only buying services? Yes. The investment-specific requirements don’t apply, but third-party oversight does, and the regulator’s access rights extend to CUSOs with a contractual services relationship.
What financial information should we request? Audited financial statements, ideally three years, plus evidence of bonding and insurance appropriate to the services. Look at revenue concentration and whether capitalization is adequate to foreseeable obligations.
What contract terms matter most? Data ownership, transfer assistance, reporting obligations with a defined cadence, regulator access, and termination rights. Those five determine whether you can monitor the relationship and whether you can leave it.
How often should we review a CUSO relationship? At least annually for financials, insurance, and service levels, with more frequent performance reporting for critical services, and an immediate review on any material change in the provider’s condition or staffing.
Choosing Well
The best predictor of a good CUSO relationship isn’t the sales process. It’s how the provider answers hard questions before there’s a contract: whether they volunteer what they can’t do, whether they tell you about the loan that went wrong, and whether they’re comfortable with an exit clause that works.
Three things to insist on. Scope the service before you scope the diligence. Get the contract reviewed for the day the relationship ends, not the day it starts. And ask for a reference who had a problem — the reference list of happy onboardings tells you very little.
AVANA CUSO partners with credit unions on commercial real estate lending — origination, credit administration, servicing, participation, and portfolio management, à la carte or together. AVANA Companies, our parent organization, has closed $6.5 billion+ in loans across all 50 states.
POWERFUL PARTNERSHIPS. DIVERSE OPPORTUNITIES. INCOMPARABLE SERVICE.
This article is general information, not legal or compliance advice. Confirm your own obligations with counsel and your examiner.