The second-largest credit union in the country picked a collections vendor in September, and PenFed’s CEO read automation savings off a script on Salesforce’s earnings call. Normally one of those would lead this briefing. Both got bumped by a September 15 Federal Register proposal that most trade coverage treated as a footnote, because it decides how every AI vendor contract you sign gets supervised for years. Past editions are archived on the executive briefing pillar.
Top 3 vendor developments
1. SECU handed collections to AKUVO. State Employees’ Credit Union, $60 billion and north of 3 million members, selected AKUVO as its collections technology provider on September 9 for playbook automation, portfolio analytics, and digital member outreach. We covered the selection in the September 17 roundup, and the detail we keep coming back to is who gave the quote: SECU’s chief credit and revenue officer, not its CIO, because collections tooling gets bought by the credit side of the house. Vendor sales teams know what a logo this size is worth, so expect AKUVO and its competitors in your inbox before budget season closes. None of that changes what you ask on the demo call.
2. PenFed put numbers on Agentforce, on the record. James Schenck went on Salesforce’s earnings call with specifics: $1.6 million in annual savings, handle time down 10 percent, after-call work down 50 percent, held calls down 40 percent, all alongside a consolidation from roughly 400 platforms to 12 strategic partners. The $1.6 million is what everyone will quote, but the part worth copying is a workflow choice buried in the coverage: the Agent Wingman tool transcribes the call in real time, then a human agent approves the content before anything touches the member record. An earnings call is a venue where no customer number ever gets challenged, so apply the discount we applied in the snapshots. Keep the approval step even if you doubt the savings figure.
3. CU 2.0 launched a shared AI platform. The Ashland, Oregon consultancy announced the CU 2.0 AI Platform on September 30: prebuilt tools for member service, lending, and compliance work, NCUA data pulls with peer benchmarks, and a sharing model where a credit union that builds something useful can offer it to the rest of the platform. The cooperative framing is genuinely aligned with how this industry already behaves, and we like that part. What a launch release cannot tell you is whether anyone is using it yet, and we could not find a named credit union in the announcement. Our vendor contract guide has the questions we would bring to the discovery call, starting with data rights and what happens to a tool you built if you exit the platform.
Top 2 regulatory and policy developments
1. The agencies want to replace the 2023 third-party guidance, and NCUA is in. On September 15 the OCC, Federal Reserve, FDIC, and NCUA published proposed third-party risk management guidance that would rescind and replace the 2023 interagency version; Cooley’s summary is the fast read. Risk tiering by magnitude and likelihood of harm replaces the critical activities framework, a residual risk acceptance concept concedes that some third-party risk stays on the books after mitigation, and the text says outright that the guidance is nonenforceable on its own. Credit unions were never formally inside the 2023 guidance, so NCUA joining this one puts every AI vendor relationship you hold under the same framework the banking agencies use. Comments close November 16.
2. Congress reopened the NCUA vendor authority fight. Representative Bill Foster’s Strengthening Oversight for the Financial Sector Act of 2026 would restore NCUA’s authority to examine third-party vendors directly, authority Congress let lapse in 2001, and the July TruStage cyberattack handed the bill its exhibit A. CUToday’s feature lays out the split, and former NCUA Chairman Dennis Dollar’s objection reads better than the word overreach implies: most credit union vendors, the ad agencies and lawn care companies, never see member data, and the core processors that do already get examined by the banking agencies. On the other side sits that TruStage outage, which knocked out claims, payments, and call centers across the industry for weeks. No prediction from us on passage; a September introduction this late in the congressional calendar usually means the bill is a marker for next year.
One deployment pattern that is emerging
September’s money went to plumbing. Collections at SECU and MessagePay, balance sheet work in the Delfi CUSO that Members 1st invested in, call documentation at PenFed. We went looking for a counterexample, a big September check written for member-facing AI, and did not find one. The deployments that published numbers this quarter also share a shape: the automation sits next to the decision rather than inside it, the way PenFed’s tool writes a record a human approves, and that shape is most of why they shipped in weeks. Background is in the September 17 roundup and the deployment snapshots, and the control-tier mapping is in our model risk piece.
One thing to watch next month
H.R. 10184 heads for the House floor. The House Financial Services Committee approved the CFPB overhaul on September 16 by a 28 to 21 vote, which we covered in last week’s Compliance Watch. For credit unions the live provisions are the supervision threshold rising from $10 billion to $30 billion and the option to elect consumer compliance exams by your prudential regulator, per Credit Union Daily. The advocates quoted in that coverage doubt it passes in what remains of 2026, and rebuilding a compliance roadmap on a committee vote would be premature. If your assets are anywhere near $10 billion, have someone watch the floor calendar.
One thing that mattered less than the headlines suggested
The White House Accord on Super Intelligence. Executives from Meta, Nvidia, Google, OpenAI, xAI, and Anthropic signed a voluntary pact at the White House on September 29 pledging internal safety controls, outside auditors, and board-level review. Al Jazeera’s explainer is the fastest honest read on what it lacks: penalties, public audit disclosure, any government enforcement role. The accord generated a week of coverage and changes nothing about how a credit union gets examined. Your AI obligations still run through vendor management, model risk, and fair lending, and the document that actually moves those this quarter is the third-party proposal above, which drew a fraction of the attention.
If September surfaced more decisions than your team has bandwidth to evaluate, Advisor Labs runs a 45-minute AI readiness audit for credit unions: book a conversation.
Get this briefing and the weekly roundup in your inbox: subscribe to the AiForCU newsletter. And if a peer at another credit union would find it useful, forward it along; that is how this publication grows.