Credit union sourcing: what's different from banks in 2026.

Credit unions look adjacent to community banks from the outside. From the inside they are not. A $500M–$5B credit union that copies a bank's technology playbook loses the specific advantages of the charter — the CUSO structure, the tax-exempt cost base, the member-driven governance, and access to a payments cooperative (Velera) serving more than 4,000 financial institutions. The 2026 sourcing map decomposes cleanly: cores that split by asset tier, payments and cards that default to Velera unless a specific product gap forces otherwise, digital banking overlays that split again by asset tier, and a regulatory posture that treats the 72-hour cyber incident rule as live compliance rather than guidance. Buyers that assume symmetry with community bank sourcing end up with the wrong vendor in half the categories.

The tier-one credit union core map splits by asset tier, not aggregate market share.

Three names hold the credit union core market in 2026. Fiserv leads on aggregate share (approximately 25.9 percent per 2026 industry surveys) across DNA, Portico, Charlotte, and Spectrum. Jack Henry's Symitar is dominant above $1B in assets, with 212 credit unions above that threshold on the platform and a 15.7 percent combined share per Jack Henry investor communications — plus a 95 percent retention rate that makes displacement rare above the tier line. Corelation's KeyStone is the fastest-growing at roughly 4.7 percent share and passed 300 total clients in Q1 2026 after 12 new signings covering $9.4B in cumulative assets and 501,784 members. Aggregate market share is the wrong sizing variable at the RFP stage. A $600M community-common-bond CU and a $3B community-charter CU do not have the same shortlist. Symitar dominates above $1B and holds leader position in the $250M–$1B tier per Jack Henry's own tiered disclosures; KeyStone accelerates through the middle; Fiserv is wide across tiers. The correct question is which core fits the credit union's asset tier, charter type, and roadmap horizon — not which vendor has the biggest aggregate share.

Payments and card processing default to Velera — because that is what happened operationally on January 1, 2024.

PSCU and Co-op Solutions began operating as one company on January 1, 2024. The rebrand to Velera was announced May 7, 2024. The combined CUSO serves more than 4,000 financial institutions across North America for debit and credit processing, card programs, and adjacent payments services. Chuck Fagan (previously PSCU CEO) leads the combined entity; the Co-op Solutions brand survives only for the consumer-facing ATM Network and Shared Branching services. RFPs that still list PSCU and Co-op Solutions as two separate vendors are naming an entity that has not existed since January 2024. The practical sourcing rule: score every payments and card RFP against Velera as the default unless there is a documented product gap that forces routing elsewhere. Velera's CUSO governance also matters — it is owned by its credit union clients, which changes both the pricing conversation and the roadmap-influence conversation compared with an investor-owned processor.

The CUSO structure under 12 CFR Part 712 is a procurement path a bank cannot use.

Credit union service organizations are governed by NCUA under 12 CFR Part 712. Corporate CUSO activities require pre-approval; every CUSO must register annually with the NCUA CUSO Registry, with the registration window running February 1 through March 31 each year and new CUSOs required to register within 60 days of formation. Two operational realities flow from the structure. First, credit unions can co-invest in a CUSO and jointly own capability that no single credit union could sustain alone. Second, services delivered through a CUSO can be sold to non-member credit unions, which changes the unit economics of any shared platform. Vendors pitching “shared services” without a CUSO structure may create indirect regulatory exposure for the credit union investor; Part 712 pre-approval requirements are not optional. The single most common non-CU-vendor misstep is assuming CUSO governance is a marketing label rather than a live regulatory boundary.

NCUA's 72-hour cyber incident notification rule has been in force since September 1, 2023 — treat as compliance.

NCUA's final rule under 12 CFR Part 748 requires a federally insured credit union that experiences a reportable cyber incident to notify the NCUA as soon as possible and no later than 72 hours after the credit union reasonably believes it has experienced a reportable cyber incident. The rule became effective September 1, 2023. The Federal Register preamble defines the threshold for what qualifies as a “reportable cyber incident” and describes the mechanics of the notification. FINRA and industry press updates through 2025 and 2026 continue to reinforce the 72-hour clock. Contracts written before September 2023 that reference “as soon as commercially reasonable” or “in accordance with industry practice” notification windows no longer clear regulatory expectation. Every material technology vendor — core, digital banking, payments, servicing, video banking — should have SLAs and an incident-notification runbook aligned to the 72-hour clock, and the runbook should be requested during due diligence rather than after an incident.

Digital banking overlays segment by asset tier — and the Alkami acquisition of MANTL changed the account-origination map in 2025.

The digital banking overlay category segments by asset tier. Alkami and Lumin Digital compete hard at the top of the mid-market — Alkami is a public company reporting 29 percent revenue growth and 23 million digital banking users in its Q1 FY2026 earnings, and Lumin Digital (originally spun from PSCU) positions on cloud-native architecture and cites NPS near 90 and 2x growth on assets and deposits from clients. Q2 Holdings runs across banks, credit unions, and fintechs. Bankjoy targets the community end with a conversational-AI-forward positioning. In February 2025 Alkami acquired MANTL (deposit account opening), collapsing what used to be two separate integrations into a single roadmap for Alkami customers. Buyers signing Alkami digital banking in 2026 should sequence the MANTL rollout explicitly — product unification varies by module. Corelation KeyStone shops evaluating account opening should score the Cotribute integration announced in May 2026, which unified account opening and consumer loan origination on KeyStone, as the parallel option. The mistake worth avoiding: treating the digital banking overlay decision as separate from account origination when the vendor has already integrated the two.

Video banking and member service split between Eltropy (CU-focused) and Glia (Jack Henry-distributed AI).

The video banking and member service category consolidated for the credit union segment. Eltropy acquired POPi/o in June 2022 and has since built the Unified Conversations platform, folding video, text, secure chat, eSign, and eNotary onto one product with more than 400 credit union clients. Glia acquired Finn AI in June 2023 and distributes AI virtual assistants through Jack Henry — a distribution advantage for CUs already on Symitar. Coconut Software adds appointment scheduling, in-branch queuing, video, and (as of June 10, 2026) AI-powered Branch Workforce Management. Choose against the core: Eltropy leads for CU-focused footprint and Unified Conversations depth; Glia leads where Jack Henry-platform distribution matters. The pairing question — scheduling upstream of video — is the same as on the bank branch side; without an appointment-scheduling front end, video utilization stays under any reasonable threshold.

CDFI funding is real but Treasury's 2025 policy changes narrowed permissible activities — vendor pitches need to match current policy.

446 of the 1,383 CDFI-certified organizations are credit unions per the CDFI Fund's current disclosures. The FY 2025 program and NACA application round from the CDFI Fund carried a $348M planned award pool ($155M FA/TA for the CDFI Program). FY 2026 appropriation figures (roughly $324M per America's Credit Unions coverage of the Consolidated Appropriations Act) should be verified against the exact Treasury line item at publication. The material policy shift for CDFI-certified credit unions is Treasury's 2025 press release (JL0160) removing climate financing and DEI activities from the CDFI Fund's permissible activity list. Vendors pitching climate-finance-oriented CDFI workflows in 2026 are relying on stale policy — every CDFI-related technology procurement should be scored against Treasury's current award conditions, not the pre-2025 list.

The MBL cap makes commercial lending technology procurement a runway problem, not a shortlist problem.

The Credit Union Membership Access Act of 1998 caps aggregate member business lending at the lesser of 1.75 times net worth or 12.25 percent of assets, excluding 1–4 family dwellings and government-guaranteed loans, per NCUA's Examiner's Guide. The cap is not a shortlist filter — every commercial lending origination system in serious contention will run at any credit union — but it is a sizing filter. A credit union with MBL utilization at 8 percent of assets has a very different runway before the cap constrains growth than one at 3 percent, and a full loan-origination-system procurement pencils differently against each. Score the runway before scoring the vendor. Also worth checking: NCUA's rulemakings and proposals page continues to publish deregulatory proposals under Executive Order 14192, some of which (announced December 2025) affect commercial and MBL treatment; the queue is live and worth monitoring.

Run the credit union vendor selection rubric before writing the RFP.

The ten-item rubric below is the shortest usable pre-RFP work product for a mid-market credit union sizing 2026 procurement across cores, payments, digital banking, member service, and compliance. It is deliberately anchored to charter type and asset tier first, then to vendor capability.

What breaks: five failure modes visible in every 2026 mid-market CU sourcing cycle.

RFPs still name PSCU and Co-op Solutions as separate vendors. Since January 2024 they operate as one company; the entity has been Velera since May 2024. The ATM Network and Shared Branching brands survive on the consumer side; the vendor entity does not.

Cyber incident SLAs from 2022-era contracts miss the 72-hour clock. The NCUA rule is 72 hours from reasonable belief. “As soon as commercially reasonable” language no longer clears regulatory expectation and should be repapered at renewal.

Alkami and MANTL overlap in mid-migration deals. The acquisition closed February 2025 but product unification varies by module. Buyers should sequence the MANTL rollout explicitly rather than assuming a single-integration outcome on day one.

CUSO structure is misunderstood by non-CU vendors. A vendor pitching a “shared platform” without CUSO structure may create indirect regulatory exposure for the credit union investor; Part 712 pre-approval requirements are enforceable, not aspirational.

CDFI-related technology procurement assumes the old permissible-activity list. Treasury's 2025 policy change is live. Vendors still pitching climate-finance-oriented CDFI workflows are relying on stale policy — buyers should recheck against current Treasury guidance before signature.

What this means for procurement in 2026.

The 2026 credit union sourcing discipline is narrow and executable. Anchor to charter type and asset tier before scoring vendors. Default payments and card RFPs to Velera unless documented otherwise. Require CUSO structure disclosure and Part 712 posture on every shared-services pitch. Repaper any cyber-incident SLA that predates September 2023. Sequence the MANTL rollout explicitly for any Alkami digital banking deal; score Cotribute integration for KeyStone shops. Score CDFI-related procurement against Treasury's current permissible-activity list. Model MBL cap headroom before scoping commercial LOS. The credit union charter is a set of specific advantages; the 2026 procurement plan either uses them or gives them up.

This is the fifth piece in the Financial Services Analyst Note series. The anchor is How mid-market financial services operators should source technology contracts in 2026. Related pieces: Bank branch of 2026 technology stack, PCI DSS 4.0 for mid-market merchants, FFIEC IT booklet mapping. Every vendor named here is in The Cardinal Source's active supplier pool.

Sources

• NCUA, 12 CFR Part 712 — Credit Union Service Organizations (eCFR). ecfr.gov
• NCUA, CUSO Registry instructions. cusoregistry.ncua.gov
• NCUA, Cyber Incident Notification Requirements page. ncua.gov
• Federal Register, Cyber Incident Notification Requirements for Federally Insured Credit Unions (March 2023 final rule). federalregister.gov
• NCUA, Field-of-Membership Expansion resource page. ncua.gov
• NCUA, Chartering and Field of Membership Manual (Appendix B to Part 701). ecfr.gov
• NCUA Examiner's Guide, Aggregate MBL Limit. publishedguides.ncua.gov
• NCUA, Rulemakings and Proposals for Comment. ncua.gov
• CDFI Fund (Treasury), FY 2025 Program & NACA Application Round. cdfifund.gov
• U.S. Treasury press release JL0160, CDFI Fund new award conditions. home.treasury.gov
• Velera, “PSCU/Co-op Solutions Enters its Next Era as Velera.” velera.com
• Corelation, “Corelation Surpasses 300 Total Clients” (Q1 2026 press release). corelationinc.com
• Jack Henry investor relations, Symitar “Solidifies Position” press release. ir.jackhenry.com
• Alkami Technology, Q1 FY2026 earnings release (SEC 8-K). sec.gov
• Eltropy, Video Banking / Unified Conversations press release. eltropy.com

All linked sources were live at time of publish (July 2026). Verify before quoting in a procurement document.