The National Credit Union Administration (NCUA) – the Federal regulatory agency that supervises credit unions – does not have some key tools it needs to oversee AI use, according to a new report from the Government Accountability Office (GAO).
In the report, GAO explains that financial institutions are using AI for a range of purposes, presenting both benefits and risks for businesses and consumers. However, GAO notes that “unlike the other banking regulators,” the NCUA lacks two key tools that could help its oversight of credit unions’ AI use.
“First, its model risk management guidance is limited in scope and detail and does not provide its staff or credit unions with sufficient detail on how credit unions should manage model risks, including AI models,” the report says.
GAO recommended that the agency enhance its guidance to be more detailed and cover more models.
“Second, NCUA lacks the authority to examine technology service providers, despite credit unions’ increasing reliance on them for AI-driven services,” the report adds.
In a podcast accompanying the report, Mike Clements, a director in the Financial Markets and Community Investment team at GAO, broke down this challenge.
“In many instances, a credit union or even smaller banks, they’re not developing AI models, right? They’ll rely on a third-party vendor to do that,” Clements said.
“In the case of banks, the banking regulators have the authority to monitor and oversee those third-party service providers. NCUA does not,” he explained. “So, we think that’s been an area of risk we’ve, in the past, recommended to Congress consider giving NCUA that authority. And we’ve recommended that again this time.”
NCUA generally agreed with the first recommendation. As for the second recommendation, GAO said that NCUA believed there are risks to such an authority, “including a possible reduction in the quality and quantity of services provided to credit unions and financial and operational risks for credit unions.”
Nevertheless, GAO maintained that the authority would enhance NCUA’s ability to monitor and address third-party risks and ensure the safety of credit unions.
The bottom line of the report, according to Clements, is that “AI has a lot of potential benefits in this space in terms of lowering costs, … enhancing customer service, and really getting at perhaps creating more accessible financial services. But there are risks associated with it.”
“What we’ve seen at this point is that both the firms and the regulators are moving forward with it, adopting it, but doing so in a cautious manner,” he concluded.