Each year, the NCUA Supervisory Priorities outline what credit unions should expect in their examinations. Some priorities from previous years remain, including credit risk, liquidity, and compliance.

Keep an eye on familiar themes, such as rising delinquencies, liquidity concerns, cybersecurity threats, and evolving consumer protection rules.

However, in 2025, new themes emerge, along with a shift in focus to new economic conditions, regulatory changes, and emerging risks. Here are the highlights:

Credit Risk Is Back Again

Loan performance is slipping. Credit card delinquencies are at their highest levels since the Great Recession, and used auto loans aren’t far behind. The NCUA is concerned about underwriting practices, collections strategies, and whether credit unions are prepared for continued deterioration.

Examiners will be looking at Allowance for Credit Losses (ACL) reserves and how credit unions are managing risk in high-delinquency categories. For credit unions that rely on indirect lending, expect questions about third-party oversight and underwriting standards.

This isn’t a new problem, but it’s getting worse. Credit unions that haven't already adjusted lending strategies will need to do so before examiners come knocking.

Liquidity Risk Makes an Encore

Loan growth has outpaced deposit growth for several years. Many credit unions have turned to borrowings and wholesale funding to fill the gap. That’s not inherently bad, but it introduces new risks, especially if rates fluctuate unpredictably.

The NCUA will be taking a closer look at liquidity risk management, specifically contingency funding plans and stress testing. Credit unions relying heavily on borrowed funds should be ready to explain their strategy and demonstrate how they’ll manage liquidity if market conditions shift.

Cybersecurity Might as Well Be a Permanent Fixture

Cybersecurity remains a top concern, but the conversation is shifting from prevention to response. Examiners will be looking at how credit unions detect and handle cyber threats, not just how they try to prevent them.

The Information Security Examination and Cybersecurity Assessment Program (don’t say that five times fast, just say ISECAP) will continue to guide NCUA evaluations. That means credit unions should be prepared to show how quickly they can identify, contain, and recover from incidents.

Vendor risk is also on the radar. Fintech partnerships introduce security risks, and examiners will want to see how credit unions are managing those relationships.

Consumer Compliance (Again)

The regulatory environment around overdraft programs is shifting, and the NCUA wants credit unions to take note. Expect examiners to review whether overdraft fees are transparent, fair, and in line with evolving CFPB expectations.

Beyond overdraft, fair lending remains a focus. Credit unions should be able to demonstrate that their lending practices are consistent and non-discriminatory.

Other concerns include:

• Home Mortgage Disclosure Act and Regulation C
• Military Lending Act
• Electronic Fund Transfer Act and Regulation E.

Balance Sheet Management and Interest Rate Risk

The interest rate environment remains uncertain, and credit unions need to be ready for multiple scenarios. Examiners will focus on balance sheet management, interest rate stress testing, and risk exposure assessments.

Over the last year or so, net interest margins have barely kept ahead of operating expenses; increased expenses or declining loan performance may put earnings and net worth at risk.

Additionally, examiners will review liquidity sources to ensure credit unions can safely meet short-term obligations.

Some credit unions have already adjusted their strategies in response to rate changes. Those that haven’t should take a closer look at how different scenarios could impact financial performance.

The Big Takeaways

The NCUA’s 2025 priorities don’t introduce major surprises, but they reflect growing concerns across the industry. Credit unions should:

• Reassess credit risk strategies, especially for high-delinquency loan categories.
• Ensure liquidity plans are well-documented and funding sources are diversified.
• Strengthen cybersecurity response plans and tighten vendor risk management.
• Review overdraft and fair lending policies in light of increased scrutiny.
• Prepare for interest rate fluctuations with solid risk management practices.

For most credit unions, the exam process won’t look drastically different in 2025. But the pressure points are clear, and credit unions that proactively address them will be in a far stronger position when examiners arrive.

Read the full 2025 Supervisory Priorities here: https://ncua.gov/regulation-supervision/letters-credit-unions-other-guidance/ncuas-2025-supervisory-priorities

Get a head start on preparation with our checklist here: https://www.redboard.com/credit-union-audit-checklist