Credit union policies and procedures: the written list, by asset size

Credit union policies and procedures start from a short list that NCUA rules require in writing: a board-approved BSA compliance program, a written security program, an information security program, written loan and investment policies at a federal credit union, a vital records program and, above set asset sizes, written interest rate risk and liquidity plans. Everything else in a credit union's library, the hold procedures, teller quick cards and call scripts, exists because the work needs it rather than because a rule names it. The difficulty is size. Half of the 4,214 federally insured credit unions had less than $67.7 million in assets in mid-2026, yet the funds availability, electronic transfer and lending rules their procedures carry are the same ones a $6 billion credit union follows. Botminds' Policy & Procedure Management is an agentic solution that finds every procedure a rule change touches and drafts the redline for its owner, so the work of keeping a library current does not scale with the number of documents.

The asset figures come from the NCUA's call report summary; the rule text from the Code of Federal Regulations. Where the guide shows the solution at work, it is on a fictional sample credit union.

What policies does a credit union need?

A credit union needs the written policies and programs that NCUA rules name, plus the operating procedures its own services require. The named list is shorter than most policy manuals suggest, and it is precise about who approves each item. The table collects the main ones; it is not a complete restatement of the rules, and state-chartered credit unions follow their state's law where the NCUA rule applies only to federal credit unions.

Does NCUA require written policies?

Yes, for the items its rules name, and the rules say so in plain terms. The BSA rule wants the compliance program in writing, approved by the board and recorded in the minutes (12 CFR 748.2(b)(1)), and the training that program owes each role is worked through in BSA training requirements. The lending rule says "the board of directors of each Federal credit union shall establish written policies for loans and lines of credit" (12 CFR 701.21(c)(2)). The investment rule goes further and dates the review: the board "must establish written investment policies" and "must review the policy at least annually" (12 CFR 703.3).

For everything else the expectation is that the procedures exist and work, not that a rule names them. The FDIC, writing for the banks it examines, puts the balance well: "The formality of the consumer compliance program is not as important as its effectiveness. This is especially true for small institutions where the program may not be in writing but an effective monitoring system has been established that ensures overall compliance" (FDIC Consumer Compliance Examination Manual, II-3.1). That latitude covers how a small institution runs compliance; it does not excuse the written programs a rule requires.

Which requirements depend on asset size?

Three NCUA thresholds change what a credit union must keep in writing. At $50 million in assets a credit union must adopt a written interest rate risk policy and an effective program, and must replace its basic liquidity policy with a documented contingency funding plan; at $250 million it must also document access to a contingent federal liquidity source and test it (12 CFR 741.3(b)(5); 12 CFR 741.12). The liquidity rule counts assets on two consecutive call reports and then allows 120 days to comply.

The thresholds are about balance sheet policies. The operating procedures a member meets at the counter do not scale with assets at all: a credit union with $16 million in assets places the same check holds under the same Regulation CC amounts as one with $6 billion, and Regulation CC's definition of a "bank" expressly includes an insured credit union (12 CFR 229.2(e)).

Do credit unions follow the same rules as banks?

For most of what a branch or contact center does, yes; for governance and a few disclosures, no. The consumer rules on funds availability, electronic transfers, lending disclosures and the Bank Secrecy Act apply to credit unions as they do to banks. Where the two differ, the NCUA has its own rule: credit unions keep a security program under part 748 rather than the Bank Protection Act rules banks follow, and they give account disclosures under the NCUA's own Truth in Savings rule, part 707, rather than Regulation DD (12 CFR 707.1).

The flow of new rules is therefore not much smaller for a credit union than for a bank. Our count of the Federal Register's final rules from the three agencies whose rules reach every credit union, the NCUA, the CFPB and FinCEN, with each joint rule counted once, comes to 46 in 2024, 35 in 2025 and 29 in 2026 up to October 25 (Federal Register search, 2025). The count includes technical entries such as civil penalty adjustments and, in 2025, a run of FinCEN orders aimed at specific foreign institutions. It also leaves out rules the Federal Register files under the Federal Reserve alone, such as the 2024 Regulation CC adjustment, though that rule binds every credit union.

The mix shifted. The CFPB published fewer final rules each year, many of them in 2025 rescissions and extensions, while the NCUA published 17 in 2026 by late October, more than in 2024 and 2025 together. For a credit union's procedure owners the source of the next change is moving from the consumer bureau toward its own regulator.

How many policies and procedures does a credit union have?

No public survey counts them, and the number says less than it seems. A small credit union may run on a few dozen documents; the fictional sample credit union in the solution, with $6.8 billion in assets and 38 branches, has 1,240 procedures and job aids kept by 96 owners. What matters is not the size of the library but how many of its documents quote a number or a rule that can change.

In the sample, one Regulation CC change reached 17 of the 1,240: 7 that cite the rule, 7 that quote one of its amounts without naming it, and 3 that depend on a changed document. A credit union one-hundredth the size still has a hold procedure, a teller quick card, a script or an FAQ for the phones, and a funds availability disclosure. Its library is smaller; the ripple from one rule change is nearly the same shape. Where those numbers end up, and why a quick card is where they hide, is the reason.

One rule change and the library it touches, in one line

Who writes credit union policies?

Management drafts them and the board answers for them. The NCUA's rule on directors' duties says the board "is responsible for the general direction and control of the affairs of each Federal credit union", and that while it "may delegate the execution of operational functions to Federal credit union personnel, the ultimate responsibility ... for that Federal credit union's direction and control is non-delegable" (12 CFR 701.4(a)). In practice that means the board approves the policies its rules name and management writes and owns the procedures that carry them out.

At a small credit union the owners are few: the CEO, an operations manager, a lending manager and whoever holds the compliance role, often alongside another job. That concentration is the risk. When one person owns most of the library, a departure or a busy quarter leaves dozens of documents without anyone watching the rules under them; what a procedure owner is responsible for applies with more force when there are only four of them.

What does policy management cost a small credit union?

No public study prices it, so the honest answer is an estimate of hours, and most of those hours are fixed per rule change, not per member. Our estimate for one rule change that touches procedures, done by hand, is about 24 working hours before any owner edits a sentence: reading and logging the rule, deciding whether it applies, searching the drive and intranet for every document it touches, chasing owners, checking their edits and rebuilding the history for the exam.

The sample credit union logged 47 rule changes between January 1 and May 20, 2025, and 19 of them touched at least one document. At the estimate above, those 19 would take about 456 hours by hand, our arithmetic on fictional data. A small credit union will see fewer changes that reach its documents, but each one costs nearly the same search and the same chase, which is why the burden falls hardest on the smallest library and the fewest owners.

Every rule change logged, and Compliance confirms whether it applies

Where Policy & Procedure Management fits a small credit union

It fits where the hours are: the search, the chase and the check. The Watch agent reads the Federal Register, NCUA letters to credit unions, CFPB rules and the board's own minutes every morning and proposes whether each change applies; only Compliance confirms. The Impact agent finds every document a confirmed change touches, including the job aids that quote a number without naming the rule, and the Drafting agent writes each redline for its owner. The Review clock agent keeps every document owned and on its review cycle.

It is not a reason to grow a library. A credit union with a few dozen documents and one compliance officer may find that a disciplined spreadsheet and a careful search are enough, and should test that honestly against a change it has already handled. The case for the solution rises with the number of documents that quote a regulated number and the number of owners who must act on the same date. How often credit union policies should be reviewed is the other half of the workload, and Policy & Procedure Management can be run on a sample of your own procedures against a past rule change.

Questions people ask

How often should credit union policies be reviewed?

Only a few NCUA rules set a cycle: the investment policy at least annually, the succession plan at least every 24 months, and an information security report to the board at least annually. For everything else the sound practice is to review on a schedule the board sets and whenever a rule, product or process changes, which in practice means more often than once a year for procedures that quote regulated amounts.

Which credit union policies must the board approve?

Those a rule assigns to it, including the BSA compliance program (12 CFR 748.2), the written loan and investment policies at a federal credit union (701.21 and 703.3), the commercial loan policy (723.4), the liquidity framework (741.12), the information security program (part 748, appendix A), the initial identity theft program (717.90) and the succession plan (701.4). Operating procedures are management's.

Can a credit union buy policy templates?

Yes, and many do, but a template is a starting point, not a library. It cannot know your look-alike amounts, your branch job aids or which version is in force, and it ages like any other document: a template written before July 1, 2025 quotes Regulation CC amounts that are now wrong. Whatever the source, each document needs an owner and a link to the rules it carries.

Do state-chartered credit unions follow NCUA policy rules?

Federally insured state-chartered credit unions follow the NCUA rules written for all federally insured credit unions, such as the BSA program, security program, liquidity and interest rate risk requirements, plus their state's law. Some rules, such as the investment policy rule in part 703, apply to federal credit unions; a state-chartered credit union's investments follow state law under 12 CFR 741.3(b)(3).

Does a small credit union need a policy management system?

Not necessarily. The FDIC itself notes that formality matters less than effectiveness at small institutions. The test is whether, when a rule changes, every document that quotes it is found and corrected by the effective date with a record of who did what; if that already happens reliably by hand, software adds less than it would at a credit union with hundreds of documents and dozens of owners.