A credit union runs the same Bank Secrecy Act program, the same Regulation E clock and the same identity checks as a much larger bank, usually with a smaller compliance team. That gap is where AI employees can help. This guide covers which back-office jobs fit, what stays with staff, and what the NCUA expects when you bring in an outside vendor. For the full banking picture, see our pillar guide to AI employees in banking and financial services.
What can AI employees do for a credit union's back office?
Who regulates a credit union, and what rules apply?
Federal credit unions are chartered and regulated by the NCUA, which also insures them through the National Credit Union Share Insurance Fund. State-chartered credit unions are regulated by the state supervisory authority where the main office is located, and they may or may not carry NCUA insurance (MyCreditUnion.gov). If you are state-chartered, confirm with your state regulator whether it adds expectations on top of the federal ones below.
The substantive rules are the same ones banks follow:
- BSA program.
Under 12 CFR 748.2, every federally insured credit union needs a written BSA compliance program approved by its board. The program needs internal controls, independent testing, a designated individual who coordinates day-to-day compliance, and training. The same section requires a customer identification program under 31 CFR 1020.220. - Customer due diligence.
FinCEN's program rule at 31 CFR 1020.210 expects risk-based procedures for understanding the nature and purpose of member relationships and for ongoing monitoring that identifies and reports suspicious transactions. - Suspicious activity reports.
12 CFR 748.1(d) requires a credit union to file a SAR within 30 calendar days of initial detection, with up to 30 more days if no suspect has been identified. It also requires management to promptly notify the board of any SAR filed. See our glossary entries on the SAR and the Bank Secrecy Act. - Currency transaction reports.
A report is due for currency transactions of more than $10,000 (31 CFR 1010.311), filed within 15 days (31 CFR 1010.306). Our glossary covers the CTR. - Regulation E.
The rule's definition of "financial institution" names credit unions (12 CFR 1005.2(i)).
Credit unions do get one thing banks do not: the NCUA's third-party guidance says smaller or less complex credit unions may develop alternative methods of accomplishing due diligence, scaled to their size and risk profile. The rules do not shrink with your headcount, but the expected depth of vendor review can.
What does the Reg E clock require?
Under 12 CFR 1005.11(c), a financial institution must investigate promptly and determine whether an error occurred within 10 business days of receiving a notice of error. If it cannot finish in that time, it may take up to 45 days, provided it provisionally credits the account within the 10 business days and tells the member within two business days after crediting. Results go to the member within three business days of completing the investigation, and any error is corrected within one business day of the determination. The periods stretch to 20 business days and 90 days for some cases, including point-of-sale debit transactions and accounts less than 30 days old.
Credit card billing errors run on a different rule. Under 12 CFR 1026.13(c), the creditor acknowledges a billing error notice within 30 days and resolves it within two complete billing cycles, never later than 90 days. Your dispute queue probably holds both kinds, so the procedure the AI employee follows has to branch on product type first. Our guide to Reg E dispute investigation automation walks through the case steps.
Which jobs fit an AI employee, and who signs off?
The best candidates are jobs with a written procedure, structured evidence and a clear point where a person must decide.
Job | What the AI employee does | Who signs off |
|---|---|---|
Reg E dispute casework | Logs the notice date, starts the 10-business-day clock, pulls the transaction record, checks prior claims, drafts the finding and the member letter | Disputes analyst approves denials and provisional credit exceptions |
BSA alert triage | Gathers account history and member profile, documents why an alert looks benign or concerning, escalates the rest | BSA officer or analyst decides which alerts become cases |
CTR and SAR prep support | Assembles the facts, flags aggregation, drafts a SAR narrative from case notes | BSA officer decides whether to file and files |
Member onboarding exceptions | Checks CIP data against the application, chases missing items, packages the file when verification fails | Member services or BSA officer approves or declines |
Card disputes and chargebacks | Collects transaction and merchant evidence, classifies by product, assembles the representment packet | Card operations lead approves submission |
Loan document checks | Compares the package to the checklist, flags missing signatures or stale documents | Loan officer or underwriter clears the file |
Reconciliations | Matches ledger to settlement and core records, clears routine breaks, lists the unexplained ones | Accounting lead approves adjustments |
Triage is the place most credit unions start. Our posts on AML alert triage with AI and SAR narrative drafting cover those two jobs in depth.
What stays with your staff?
Three kinds of decisions stay with people. Filing decisions belong to the BSA officer: the AI employee can assemble facts and draft language, but it does not decide that activity is suspicious and it does not file. Member conversations stay with staff, which matters most for denied disputes and declined accounts, where tone and judgment count. Credit decisions stay with your lending team and credit committee. An AI employee can check that documents are complete, but it should not approve or deny a loan.
How should a credit union evaluate an AI vendor?
The NCUA is direct about this. Its page for companies that serve credit unions says the agency does not approve or endorse vendors or products, does not certify a vendor's compliance, and does not review or approve vendor contracts. Credit unions "remain fully responsible for third-party due diligence, vendor monitoring, cybersecurity considerations, contract oversight, and ensuring compliance with applicable laws and regulations" for outsourced activities (NCUA, Doing Business with Credit Unions).
The NCUA also keeps an AI resources page. It points credit unions to two letters when doing due diligence on AI vendors: 07-CU-13, Evaluating Third Party Relationships, and 01-CU-20, Due Diligence Over Third Party Service Providers. The accompanying supervisory letter groups expectations under risk assessment and planning, due diligence, and risk measurement, monitoring and control. It also advises less experienced credit unions to start with small, well-defined goals and expand as experience grows.
We found no NCUA rule or letter written specifically for AI employees, so these older letters and the page above are the sources we can cite. A practical checklist drawn from them:
- Document why the work is being outsourced and how it fits your strategic plan.
- Review the contract with counsel, including data location, audit rights and exit terms.
- Check how the vendor performs for other institutions, and ask for evidence rather than assurances.
- Decide who monitors the vendor after go-live, and how often.
- Check incident duties. Under 12 CFR 748.1(c), a reportable cyber incident includes a disruption or unauthorized data access caused by a compromise of a credit union service organization, cloud service provider or other third-party data host, and the NCUA must be notified within 72 hours.
Our guide to third-party risk management for AI vendors goes deeper on the questions to ask.
How a Zamp AI employee runs a credit union dispute (or BSA) queue
Everything in this section describes how we run AI employees today, not a credit union deployment.
Each AI employee follows an agent operating procedure, or AOP. For a Reg E queue, the process owner writes into it the 10-business-day and 45-day clocks, the product branch between debit and credit card, the sources of truth when the core and the card processor disagree, approval limits on provisional credit, and what the agent's identity may not do. It cannot deny a claim without sign-off, and it cannot contact the member directly. A BSA triage AOP works the same way: the agent can assemble evidence and draft, but it cannot file a SAR or CTR.
When a case breaches a tolerance, lacks data or looks unfamiliar, the agent marks it Needs Attention and routes it to a person with the context already assembled. Before any case closes, the validate step of the PEV loop checks the agent's own output against the AOP.
The reasoning goes into the team's own case system. In a biopharma procurement deployment, the agent wrote its full reasoning for every purchase request inside SAP Ariba, so reviewers read it in the system they already audit. The same pattern applies to a credit union's own dispute or case platform.
When a reviewer corrects the agent, the correction becomes a change to the AOP: a branch, evals against a golden set, review and merge, with no engineering ticket. In that same deployment, the agent sent 64% of requests to manual review in week one. As reviewed corrections accumulated, its decision rate rose from 36% to 85% and manual review fell to 15%. A high review rate at launch is how the safety mechanism works.
Zamp offers SaaS, bring-your-own-cloud on AWS, Azure or GCP, and on-premises deployment. A credit union with data residency requirements can choose the bring-your-own-cloud or on-premises model.
How should a credit union start?
Pick one queue with a written procedure, such as Reg E disputes or first-line alert triage. Run the AI employee alongside staff, review every disagreement, and write down the thresholds. Expand only when the reviewers trust the output. Our guide to onboarding an AI employee covers the steps.
Two sibling guides cover adjacent audiences: a roundup of AI agents for banks and credit unions and a piece on AI employees for fintechs and sponsor banks.
