Your vendors already embed AI. Examiners will ask what governs it. Fraud budgets are rising. Most CUs have no inventory, no policy, and no named owner. AI pilots don't move credit unions — leadership and AI strategy do.
Synthesized from NCUA supervisory priorities, Cornerstone Advisors industry research (January 2026), and credit union CEO commentary. These are the questions behind closed-door meetings — not vendor slide decks.
Loan delinquencies and losses are at a 10+ year high. Higher-cost funding limits margin recovery. CEOs report widening stress in member affordability and portfolio quality — not abstract macro risk.
“Can we grow loans without blowing up credit quality — and still fund it?”
Half of credit unions saw higher fraud losses in 2025. First-party fraud now accounts for more than 40% of total fraud losses. NCUA examiners are sharpening focus on payment-system governance and insider controls.
“Are we losing more to fraud than we’re saving with efficiency projects?”
NCUA has no AI-specific rule, but existing vendor management, security, and fair-lending expectations apply. Use cases are easy to spot; governance and implementation gaps leave institutions over-reliant on vendors.
“We already have AI in our stack — what governs it, and can I explain that to the board?”
Technology budgets are rising, but many institutions still miss planned deployments. 2026 is the year to operationalize GenAI — not experiment indefinitely.
“We bought Copilot — why isn’t anyone using it safely?”
Deposit growth, member experience, and fintech competition remain top strategic priorities. Digital banking vendors are shipping AI features faster than institutions can govern them.
“Our digital vendor is rolling out AI — are we ready to turn it on?”
Letter 26-CU-01 emphasizes lending quality, liquidity and IRR, earnings and capital, payment-system risk, fraud prevention, and risk-based BSA/AML programs — all while AI use grows inside vendor stacks.
“What will the examiner ask that we can’t answer today?”
Credit unions are not holding cash — they’re allocating it. The gap is sequencing: fraud and vendor AI get funded first; governance and workforce adoption often lag until the board or examiner asks.
| Spend category | Why now | Typical motion |
|---|---|---|
| Fraud / BSA / AML | Rising losses; 75% increasing prevention budgets; NCUA BSA emphasis | Alert triage tools, staffing, sanctions modules, vendor upgrades |
| Cybersecurity & payments | NCUA payment-systems priority; deepfake and wire-fraud exposure | MFA, wire controls, vendor security reviews |
| Digital banking & core-adjacent tech | 80%+ raising tech spend; member experience competition | Mobile features, AI in digital channels, payments modernization |
| GenAI licenses | 59% CU genAI deployment rate | Microsoft Copilot, contact-center AI, vendor-embedded assistants |
| AI governance | NCUA vendor diligence expectations; no dedicated AI rule | Often underfunded until board vote or exam — Seiche’s entry point |
| Automation pilots | Agentic AI plans in fraud, lending, contact center, finance | 90-day POCs with scale/stop criteria — not enterprise transforms |
The investments above each carry a primary risk your board — and your examiner — will ask about. NCUA now reviews AI inside existing frameworks (BSA/AML, fair lending, vendor management, ERM): the use cases don’t change, the controls around them do. This is the layer Seiche makes examiner-ready.
| The AI move | Primary risk | Control that makes it examiner-ready |
|---|---|---|
| Growth & deposits — conversational onboarding; predictive deposit / balance-migration models | Model risk & data quality — biased targeting, weak predictions, privacy of behavioral data | Model inventory + validation; GLBA review of data use; human review of targeting |
| Fraud & cybersecurity — GenAI fraud detection; behavioral biometrics | Adversarial AI — deepfakes / voice clones defeat controls; false positives hit good members | Step-up auth that assumes synthetic media; red-team testing; SAR quality control |
| Member experience — contact-center & member-facing chat automation | Hallucination & UDAAP — wrong answers, unfair statements, member-data leakage | Retrieval guardrails + human escalation; AI-use disclosure; log every AI-influenced interaction |
| Efficiency & talent — back-office & compliance automation | Over-automation & opacity — unexplainable BSA/AML decisions; staff skills erosion | Human-in-the-loop on filings; retrievable audit trail; staff change management |
| Lending & credit — AI credit decisioning; loan-memo drafting | Fair lending & explainability — ECOA / Reg B adverse-action, disparate impact | Specific adverse-action reasons (CFPB Circular 2022-03); fair-lending testing; documented model validation |
The balanced view a board needs before it votes: the headwinds to manage, the gains that justify the work, and the moves that turn AI from exposure into advantage.
Headwinds to manage in 2026.
The gains that justify the work.
Moves that turn risk into advantage.
AI isn’t only a tool for credit unions — it’s a tool for criminals. It compresses the time, skill, and cost an attacker needs. When attacks were expensive, criminals went after large institutions; at pennies per attempt, every institution and every member with an email address is worth attacking. This is why an AI strategy has to account for cyber-resilience, not just productivity.
In U.S. deepfake fraud losses in 2025 — roughly 3× the 2024 total.
Year-over-year rise in voice-cloning fraud; 149% more banking fraud calls using deepfake audio.
In annual losses — the fastest-growing financial crime in the U.S., projected to reach $23B by 2030. Most of it never gets counted as fraud; it books as credit loss.
Entry-level subscription for turnkey fraud tooling; $220 buys lifetime access with source included. No technical skill required.
Success rate of AI-crafted phishing against humans — 4.5× traditional attacks, which land around 12%.
A synthetic identity is a real Social Security number — often a child’s or an elderly member’s — attached to a fabricated name, aged into a good credit score, then busted out. It hits the balance sheet once and the relationship once. A member who gets defrauded doesn’t distinguish between fraud you caused and fraud you failed to catch.
Two layers are moving at once. Domestically, oversight is fragmenting — fifty states writing their own rules at different speeds and in different directions. Internationally, foreign regimes reach U.S. credit unions through two doors: members moving money across borders, and technology built or hosted overseas. A U.S.-only reading of AI law leaves you exposed on both the member side and the vendor side.
| Date | What changes | Why it matters to a credit union |
|---|---|---|
| March 11, 2026 | FTC AI Bias Policy Statement | May preempt or reinforce state bias requirements — the direction is not yet settled |
| June 30, 2026 | Colorado AI Act (SB 24-205) | Impact assessments and transparency obligations for high-risk AI |
| August 2, 2026 | EU AI Act high-risk deadline | Credit scoring is classified high-risk; reaches any EU-touching operation or vendor |
| Ongoing 2026 | Executive order on state AI laws | DOJ challenging state AI laws; federal preemption is possible but unresolved |
| 2026 (draft) | NIST AI Cybersecurity Profile | Voluntary framework harmonizing regulatory expectations — a defensible reference point |
Twenty-four elements across six domains — the same frame for every credit union we work with, which is what makes the scoring mean something. An AI strategy sets direction; it is not a procedure manual. The framework fixes your position on each element: what you believe, who owns it, and where the guardrail sits. Procedures, validation protocols, and vendor checklists are written downstream, against that direction.
| Stage | What it means | What you typically see |
|---|---|---|
| 1 · Absent | No position exists. AI may already be in the building through vendor products, and no one owns it. | Nothing written; no named owner |
| 2 · Ad Hoc | Activity exists, driven by individuals or by vendors. No shared rule, so the outcome depends on who is in the room. | Pilots, emails, individual judgment |
| 3 · Defined | A position is written down and approved. Application is uneven and evidence is thin. | Policy or statement exists; practice varies |
| 4 · Governed | The position is applied consistently, owned by name, and can be evidenced to a board or an examiner. | Decision records, inventory, review cadence |
| 5 · Compounding | The practice improves itself. Results from one decision feed the next, and the capability becomes a competitive asset. | Measured outcomes changing the next decision |
One CEO-focused engagement, five steps. Light-touch by design: insight for the CEO without a burden on the organization.
Our assistance concentrates in the early phases. After that, you lead the organization forward — that is the point of the engagement, not a limitation of it.
The strategic summary of the assessment, built so the CEO can lift it into a board meeting without translation.
The comprehensive record of the engagement — the rationale behind each recommendation, not just the conclusion.
Three templates that let you maintain, measure, and manage progress against your own strategy after we leave.
Each concern a CEO raises maps to specific elements of the framework. That mapping is what turns “we should do something about AI” into a scored position with a named owner.
| C-suite concern | Framework domain | What the assessment produces |
|---|---|---|
| Examiner asks about AI | Governance & Trust | A scored regulatory and compliance posture, a named governance owner, and an AI inventory you can evidence |
| Fraud / BSA losses rising | Governance & Trust | A documented position on fraud, security, and AI threats — and where human review stays mandatory |
| Copilot deployed, low adoption | People | Change management and adoption scored honestly, with reskilling and workforce allocation addressed |
| Digital vendor shipping AI | Capability | A build / buy / partner rule and vendor oversight standard — set before the feature switches on |
| Board wants “our AI strategy” | Direction | An AI Strategy Statement and documented board–executive alignment, in words everyone can repeat |
| Pilots everywhere, nothing scaled | Portfolio | Use-case intake rules, portfolio balance, and the discipline to redesign the process rather than layer AI on it |
| Earnings pressure / unclear ROI | Economics | A funding model, total cost of ownership, and — the half most institutions skip — value validation after the fact |
| Peers and regulators moving faster than us | Direction | An external forces posture: member expectations, peer moves, and regulation translated into implications for you |
Most credit unions are on the left-hand column today. That isn’t a failure — it’s where AI adoption naturally starts. The work is moving across.
| Tool-driven — where most credit unions are today | Strategy-driven — what future-proofing looks like | |
|---|---|---|
| Adoption | Teams experiment freely. No framework, no guardrails, no shared results. Fear inhibits employees from using the tools openly. | Problems first, tools second. Deliberate, sequenced rollout. Change management actively encourages employee use. |
| Governance | IT owns AI decisions — or no one does. The board has never reviewed it. Budget is unclear. The AI roadmap cuts across business goals rather than serving them. | Holistic and outcome-driven. Compliance built in from day one. Budget managed. The AI roadmap aligns to business goals. |
| Outcomes | Demos deployed and pilot purgatory. No measured value. Capacity and resources absorbed with nothing to show a board. | Fraud caught. Regulatory findings avoided. Members retained. Measurable gains in productivity and efficiency. |
The board’s job is governance and strategy. Give them the framing and the questions, and they can lead the organization rather than pressure it.
Four things a board should hold as settled before it debates any specific tool.
What a board should be asking management, at every meeting until the answers are boring.
Without a strategy there is no way to know whether AI spending is working.
Credibility matters with C-suite buyers. We set the direction that governs the fraud and technology spend you’re already making.
AI in banking is not a technology decision. It’s a strategic decision. The institutions that win won’t be the ones that adopt AI first — they’ll be the ones that adopt it wisely. You don’t need to be JPMorgan and you don’t need to be Chime. You need to be a better version of your own institution.
Request an engagement outlineSources 8–12 are carried forward from the Seiche AI Strategy webinar deck and are pending URL-level verification before external distribution.