June is recognized as Elder Abuse Awareness Month, with June 15 designated as World Elder Abuse Awareness Day. The observance serves as a global call to action to raise awareness, prevent abuse and protect older adults from mistreatment. Throughout the month, organizations and communities focus on educating the public about the warning signs of physical, emotional and financial abuse, as well as neglect. Abuse can be perpetrated by caregivers, family members or strangers. Older adults who are physically frail or cognitively impaired are particularly vulnerable because they may be less able to advocate for or protect themselves.

Financial exploitation remains one of the fastest-growing forms of elder abuse. According to the FBI’s IC3 report, Americans reported losing $20.9 billion to internet crimes in 2025, with adults age 60 and older suffering the greatest losses at $7.7 billion — a 59% increase from 2024. The FBI’s 2025 Internet Crime Report provides a detailed analysis of these trends.

The Federal Trade Commission also reported a significant increase in fraud losses, with consumers reporting $15.9 billion in losses in 2025, compared with $12.7 billion in 2024. Adults age 60 and older accounted for 34% of all reported losses. However, the FTC’s Protecting Older Consumers 2023-2024 Report suggests these figures likely represent only a fraction of actual losses due to underreporting. The report estimates total fraud losses may have reached $158 billion, including $61.5 billion lost by older adults.

In a recent Operation Shamrock podcast episode, “$196 Billion Stolen in Scams — And We’re Still Blaming Victims,” Kathy Stokes of the National Elder Fraud Coordination Center emphasized the broader nature of today’s fraud landscape.

“It’s not the victim’s fault. It’s not a failure of the individual. It is a systemic failure,” Stokes said.

She explained that fraud and scams are no longer the result of isolated risky behavior. Instead, they are delivered through nearly every communication channel and are often orchestrated by sophisticated criminal enterprises using increasingly advanced tactics. Fraud is no longer a problem affecting only a few individuals — it is a challenge that impacts all of us.

To help combat this growing threat, the Carolinas Credit Union League’s Risk Management Resources team launched the Friends Against Fraud program in January 2026. Available through a turnkey toolkit developed for member credit unions, the program is designed to educate older adults about fraud and scams, including how to recognize warning signs, take preventive measures and access local resources if they become victims.

The toolkit includes everything needed for credit unions to go out into their communities and host interactive and educational sessions, from training videos and presentations to customizable marketing materials.

Programs such as Friends Against Fraud play a critical role in empowering older adults, preventing financial exploitation and reducing the devastating emotional and financial impact of fraud and scams.

For more information about Friends Against Fraud or assistance with fraud-related concerns, contact Fraud Risk Analyst Carol Boxall at cboxall@carolinasleague.org.

To support credit unions as trusted financial partners and a frontline defense against elder exploitation, the League System has launched a fully customizable Elder Exploitation Prevention Toolkit, a ready-to-use resource designed to strengthen credit union efforts to prevent fraud and protect members.

The toolkit is the second in a series of five member-focused toolkits that will be released throughout 2026. These complimentary resources are available for credit unions to customize and use in outreach initiatives that educate members on topics ranging from elder exploitation to credit union principles.

“The strength of the League System is a direct result of our intentional collaboration,” said Brad Miller, president of the American Association of Credit Union Leagues (AACUL). “By cooperating to underwrite the cost of these resources, Leagues are able to offer the toolkits to credit unions free of charge. Leagues know combatting financial elder abuse is a huge priority for credit unions, and we hope these resources will make it easy for credit unions of any size to educate members, equip staff, and inform their community.”

The Elder Exploitation Prevention Toolkit includes member-facing educational materials, social media and outreach resources, staff guides, checklists, conversation starters and practical tools designed to support frontline teams. Credit unions are encouraged to use the toolkit during Elder Abuse Awareness Month in June, or at any time throughout the year.

The Carolinas Credit Union League is proud to support this League System initiative, which helps credit unions strengthen their efforts to protect members from fraud and exploitation. This new toolkit also complements the League’s expanding Fraud Resources webpage, which includes Friends Against Fraud, a newer program designed to help credit unions and agency partners bring practical elder exploitation prevention education directly into their communities with ready-made event-hosting resources.

All of these resources are available at carolinasleague.org/fraud-resources. To locate AACUL’s toolkit, credit unions can visit the link listed under “Partners in Fraud Prevention.”

Spring is here and now is a great time for some spring cleaning and a refresher on record retention!

Credit unions have a responsibility to be able to reconstruct their records to protect their assets, as well as their members’, in the event of a disaster.  Additionally, in the case of litigation, record destruction may impact the credit union’s legal standing to collect on loans or defend itself in court.  It is also needed to document credit union’s evidence of compliance with laws and regulations.

Part 749 of the NCUA Rules and Regulations requires all federally insured credit unions to maintain a vital records preservation program.  The program must be in writing and contain procedures for maintaining duplicate vital records at a vital records center.

Designated staff responsible for carrying out the vital records duties will need to provide a schedule for the storage and destruction of records. Staff will also need to contain records preservation log detailing for each record stored. The log details will include its name, storage location, storage date, and name of the person sending the record for storage.

Under federal law and NCUA's record retention regulation, records can be preserved in any format that can be used to reconstruct the records, including in an electronic format.

The credit union should prepare an index of any records destroyed and retain the index permanently. Destruction of records should ordinarily be carried out by at least two people whose signatures, attesting to the fact that records were destroyed, should be documented.

Procedures for record destruction should include:

1. Expiration dates for documents
2. The designation of people responsible for handling the destruction of records
3. A list of destroyed records
4. When documents were destroyed, what documents were destroyed, and who destroyed them.

Record destruction may impact the credit union’s legal standing to collect on loans or defend itself in court. Since each state can impose its own rules, it is prudent for a credit union to consider consulting with local counsel when setting minimum retention periods.

Records that would support a credit union's position in the courts, or other claims, should be retained for the minimum period prescribed by the statute of limitations jurisdiction of the political subdivision(s) where the credit union does business or applicable law/regulation, whichever is greater.

A legal opinion from the credit union’s attorney, with respect to the application of the statute of limitations, is recommended and should be included in the credit union's records preservation program.

If no specific period is designated by federal or state law, use your state’s statute of limitations period.

Here you can view a sample record retention schedule for reference.

For additional information and resources on record retention, visit InfoSight360.

As artificial intelligence (AI) moves from isolated pilots to enterprise-wide deployment, boards and executives face growing pressure to manage not just the potential — but also the risk.

The 2026 Executive Perspectives on Top Risks and Opportunities report — developed by the ERM Initiative at NC State University’s Poole College of Management and global consulting firm Protiviti — identifies a critical shift: leaders are no longer viewing AI as a single risk or opportunity, but rather as a complex mix of risk categories requiring cross-functional attention.

This insight reframes how boards, CROs, CIOs, and other decision-makers should engage with AI in the year ahead.

AI risk categories

#1: Cybersecurity and data integrity

AI introduces new and rapidly evolving cybersecurity exposures. Survey respondents ranked “risks related to data required for AI use and cybersecurity exposure” as the top AI-related risk globally.

These concerns include:

• Model poisoning and data leakage during training or inference
• Insecure use of third-party AI tools
• Privacy vulnerabilities and compliance concerns
• Expanded attack surfaces not covered by existing frameworks

“No AI deployment can succeed without addressing the data lifecycle from acquisition to decommissioning.” — 2026 Top Risks Report

Tool: Are you asking the right questions about how AI is expanding our cybersecurity and data risk exposure?
Explore 3 key questions for executive teams ›

#2: Integration with systems and workflows

AI’s value can only be realized when integrated into core business operations — but that’s also where risks multiply. Poor integration leads to:

• Operational disruption
• Low adoption
• Poor ROI
• Uncoordinated governance

Across roles and industries, integration with existing technologies, processes, and the workforce was ranked among the most pressing AI risks.

Tool: Is your organization ready to scale AI in a way that aligns with enterprise systems, governance, and strategy?
Explore 3 key questions to assess AI integration risk ›

#3: Talent readiness

Without talent readiness, even the best AI systems will underperform. The report highlights several interrelated concerns:

• Lack of upskilling and reskilling
• Difficulty attracting and retaining AI-capable talent
• Resistance to change among employees
• Erosion of leadership pipelines due to shifting skill needs

“The bottom line: Properly implemented, AI becomes an extension of the workforce.”

— 2026 Top Risks Report

Tool: Do you have the right leadership, skills, and culture in place to support responsible AI adoption?
Explore 3 key questions on talent readiness for AI ›

A BSA/AML program should not be viewed as a burdensome regulatory requirement, but rather as an essential tool that helps protect a credit union’s reputation and assets, its members and the overall financial system.

January 2026, the National Credit Union Administration (NCUA) released Letter 26-CU-01: 2026 Supervisory Priorities, which outlines supervisory priorities for all federally insured credit unions. The priorities focus on areas posing the highest risk to the credit union industry, its members and the National Credit Union Share Insurance Fund. The guidance aligns with the NCUA’s policy against regulation by enforcement and aims to reduce BSA compliance burdens while improving program efficiency. Credit unions can also sign up to receive Financial Crimes Enforcement Network (FinCEN) updates.

Each credit union maintains a unique BSA/AML program designed around its specific products, services, member profiles and geographic locations. In addition to conducting a risk assessment, credit unions should consider several factors when building or updating a program, including:

• Previous audits
• Results of independent testing
• Conclusions from prior examinations
• Information gathered through ongoing monitoring
• Regulatory updates
• Information technology programs and services utilized
• Staffing requirements
• Existing systems and operational processes

The goal is to maintain a coherent, well-constructed document that remains current and relevant, meets regulatory requirements and serves as a comprehensive guide for the board of directors and staff.

It must be structured around five core pillars mandated by FinCEN as follows:

1. Conducting a risk assessment based on products and services offered, member profiles and geographic location.
2. Implementing internal policies, procedures and controls, including Customer Identification Program (CIP), Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD).
3. Designating a BSA/AML compliance officer responsible for managing the overall program.
4. Providing ongoing training for personnel to ensure understanding of BSA responsibilities.
5. Performing independent testing or audits to evaluate program effectiveness.

For more information and guidance you can refer to the FFIEC BSA/AML Examination manual https://bsaaml.ffiec.gov/manual and FinCEN’s BSA  Statutes https://www.fincen.gov/resources/statutes-and-regulations/bank-secrecy-act.  

The Carolinas Credit Union League Risk Management Resources team has launched Friends Against Fraud, a new program designed to help credit unions educate their communities about fraud prevention.

The program aims to raise awareness of common fraud schemes and scams, provide guidance on how to recognize and prevent fraudulent activity, and highlight available resources for individuals who may be impacted. While the program is primarily aimed at older adults—who are disproportionately targeted and experience some of the highest individual financial losses from fraud, the training is relevant for all age groups.

Before launching Friends Against Fraud broadly, the League ran a pilot phase last year with volunteering credit unions completing training to host community events. Building on that success, Truliant Federal Credit Union will welcome community members on January 28 for its event in Waxhaw, North Carolina.

“We developed this program with credit unions in mind, recognizing their longstanding commitment to community education and the credit union philosophy of people helping people,” said Carol Boxal, fraud risk analyst for the League.

To support this mission, the Friends Against Fraud program includes a turnkey toolkit that enables credit unions to easily deliver educational, interactive presentations at local community events.

The toolkit includes a training video, a customizable PowerPoint presentation, and editable marketing materials and handouts, allowing credit unions to tailor the program to their specific audience and outreach efforts.

Credit unions can access the Friends Against Fraud program from the League’s website, navigating to the “Risk” tab’s dropdown menu. The program is also accessible directly at https://carolinasleague.org/friends-against-fraud/.

For additional information or questions, members may contact the League’s Risk team at risk@carolinasleague.org.

Credit union professionals will have the opportunity to hear directly from the National Credit Union Administration (NCUA) on regulatory expectations and emerging risks during the 2026 Risk & BSA Conference, set for February 25–26 in Charlotte, NC.

A featured session, “NCUA Priorities,” will be led by Bill Hunter, the NCUA’s Southern Region director of specialist resources. Hunter will outline the agency’s 2026 examination priorities, with a focus on risks affecting credit union members, the credit union system and the National Credit Union Share Insurance Fund.

The session is designed to provide compliance, risk and operations professionals with insight into supervisory focus areas and regulatory trends that may shape upcoming examinations.

Hosted by the Carolinas Credit Union League, the conference will be held at Goodwill Industries of the Southern Piedmont in Charlotte and will cover a range of risk management, compliance and Bank Secrecy Act topics. Sessions will address fraud risk assessments, synthetic identity fraud, artificial intelligence risks, suspicious activity report best practices, vendor management and elder financial exploitation.

The event is intended for credit union staff responsible for compliance, risk management, auditing, lending, operations and finance.

Online registration for the conference is open through February 13. Additional details, including the full agenda and pricing options, are available on the event webpage.

As part of its focus on compliance this month, the Carolinas Credit Union League is encouraging credit unions to review required training and upcoming regulatory deadlines using InfoSight360 resources.

InfoSight360 offers a Required Compliance Training resource that outlines training obligations that must be completed annually, as well as those required on an ongoing basis. The training is designed to help credit unions meet federal and state regulatory requirements while supporting staff preparedness across compliance, operations and risk management functions.

In addition to training resources, InfoSight360’s 2026 Compliance Calendar provides a consolidated view of key regulatory deadlines and effective dates throughout the year. Credit unions are encouraged to incorporate the calendar into internal compliance planning to help ensure timely implementation of regulatory changes.

Several annual threshold adjustments take effect January 1, including updates issued by the Federal Housing Finance Agency (FHFA), the Consumer Financial Protection Bureau (CFPB) and the Internal Revenue Service (IRS). These adjustments, which are typically tied to inflation indexes, affect areas such as conforming loan limits, mortgage thresholds and health savings account contribution limits.

The calendar also highlights compliance dates throughout the year, including new and phased requirements under the National Automated Clearing House Association (NACHA) operating rules, CFPB regulations and Federal Communications Commission orders.

Among the key 2026 deadlines are CFPB requirements related to personal financial data rights for credit unions with more than $10 billion in assets, updated NACHA fraud monitoring and return requirements, and the submission of credit card agreements to the CFPB.

The full list of required compliance training resources and the complete 2026 Compliance Calendar are available through InfoSight360.

Twenty-five credit union professionals have successfully completed the Carolinas Credit Union League’s first Compliance Boot Camp, a yearlong program developed in partnership with CU Risk Intelligence. The 12-session hybrid program concluded this year, marking a milestone for CCUL’s ongoing efforts to strengthen compliance knowledge and culture within the industry.

Launched to meet the growing demand for practical, accessible compliance education, the Compliance Boot Camp provides monthly instruction on core compliance topics, emerging risks and regulatory updates. Sessions combined expert-led instruction with hands-on learning, allowing participants to immediately apply concepts to real-world credit union operations.

“Through the Compliance Boot Camp, I have become more knowledgeable and confident in understanding, applying and supporting compliance within an organization,” said Lynn Griffin, vice president of compliance for TRU Federal Credit Union. “I gained practical insight into the laws, regulations, policies and ethical standards that guide responsible business conduct, along with a stronger understanding of risk assessment, compliance monitoring and the role of audits, internal controls and documentation.”

For many attendees, the program also helped demystify compliance work and provided clarity on where to find trusted resources.

“Boot Camp is a great foundation to build upon, especially before taking more in-depth compliance courses,” said Rhonda Rosenberger, chief operations officer for Santee Cooper Credit Union. “Coming into compliance can feel overwhelming, but this program helps you get your footing and direction. I now know which resources to use, like InfoSight, PolicyPro, the Federal Register and NCUA, and what I’m looking at. Having practical tools, templates and the ability to connect with classmates has been incredibly valuable.”

Feedback like this underscores the program’s success and its role in supporting credit unions of all sizes.

Building on the success of the inaugural class, CCUL is offering the Compliance Boot Camp again in 2026. Registration is now open, with limited spots available. Credit union professionals interested in expanding their compliance expertise are encouraged to register.

Register today for the 2026 Compliance Boot Camp, registration deadline is December 31.

What the deduction requires

The OBBBA creates a new category of interest called “qualified passenger vehicle loan interest” (QPVLI) under Internal Revenue Code § 163(h)(4)(B). For tax years beginning after December 31, 2024, and ending before January 1, 2029 (i.e., tax years 2025–2028), QPVLI is excluded from the definition of “personal interest”—thus making it eligible for deduction under IRC § 163(a).

Key features for borrowers include:

• The loan must originate after Dec. 31, 2024.
• The vehicle purchased must be a new vehicle (original use begins with that taxpayer), for personal use (not business/commercial use), secured by a first lien on that vehicle.
• The vehicle must be an applicable passenger vehicle: car, minivan, van, SUV, pickup truck, or motorcycle (with at least two wheels), manufactured primarily for use on public roads, and undergoing its final assembly in the United States.
• The deduction is limited to up to $10,000 per year of interest paid on such eligible loans.
• The deduction phases out for taxpayers whose modified adjusted gross income (MAGI) exceeds $100,000 (single filers) or $200,000 (joint filers). It is fully phased out at $150,000 (single) or $250,000 (joint) under some analyses. Center
• The deduction is available whether the taxpayer itemizes or takes the standard deduction—i.e., it is an above-the-line deduction.

For credit unions, this means that loans made after January 1, 2025, to borrowers purchasing U.S.-assembled new personal-use vehicles can give those borrowers a potential tax benefit of up to $10,000 of interest deduction per year for 2025–2028 (subject to eligibility and income phase-out).

Why this matters for a credit union

Even though the deduction benefits the borrower, the credit union faces new obligations because of newly added section 6050AA of the IRC—added by the OBBBA (see Sec. 70203).
Under § 6050AA:

• Any person (including a credit union) engaged in a trade or business that receives interest of $600 or more in a calendar year from an individual on a “specified passenger vehicle loan” (S-PV L) must file an information return with the IRS.
• The return must include: borrower name/address; amount of interest received; outstanding principal as of Jan. 1; origination date of the loan; year/make/model/VIN of the vehicle securing the loan (or other vehicle description as prescribed).
• A statement must also be furnished to the borrower (payee) by January 31 of the year following the calendar year in which interest was received. That statement must include the same required information.

In short, credit unions that receive $600 or more interest in 2025 on loans that meet the “specified passenger vehicle loan” definition must begin preparing for both IRS filing and borrower statements.

Transitional Guidance for 2025

Recognizing that the law was enacted mid-year and that systems need to be updated, the Internal Revenue Service issued Notice 2025-57 (published November 3, 2025) to provide transitional relief for calendar year 2025.

Major points of transitional guidance:

• The credit-union may satisfy its § 6050AA reporting obligation for interest received in calendar year 2025 on a specified passenger vehicle loan by making a statement available to the borrower on or before January 31, 2026, indicating the total amount of interest received in 2025 on that loan.
• The IRS will not impose penalties under § 6721 (failure to file) and § 6722 (failure to furnish payee statement) for 2025 if the credit union satisfies this simplified statement requirement.
• The transitional relief is only for calendar year 2025. Starting with 2026, credit unions will need to comply fully with § 6050AA—file information returns and furnish full statements to borrowers once forms and instructions are issued.

What credit unions should do now

1. Identify eligible loans: For loans originated after December 31, 2024, secured by first lien on a new U.S-assembled personal-use vehicle (and all other criteria), flag those as potentially subject to the deduction and reporting rule.
2. Capture necessary data: Ensure your loan origination/servicing systems record and store the VIN, year/make/model, lien status, date of origination, vehicle assembly location (or note U.S. final assembly), and interest payments by calendar year.
3. Prepare reporting workflows for 2025: Even though full IRS forms may not yet be available, you must prepare to furnish statements to borrowers by January 31, 2026, showing total interest received in calendar year 2025. For 2025 only, this simplified format suffices to avoid penalties.
4. Plan for full compliance in 2026 and beyond: Prepare for IRS to finalized the information return to and full payee statements reflecting all required fields (borrower information, principal, origination date, vehicle details) under § 6050AA.
5. Educate borrowers and staff: While the borrower is responsible for determining whether the deduction applies (including their income phase-out, vehicle eligibility, etc.), ensure that your staff are aware of the new deduction and reporting rule—so they do not inadvertently offer the deduction or mis-advise eligibility.

In summary

For credit unions, 2025 is a pivotal year. The OBBBA’s new vehicle-loan interest deduction provides a noteworthy tax-benefit opportunity for borrowers—but at the same time introduces a new information-reporting burden for lenders. The information reporting regimen is not complete. Fortunately, the IRS’s transitional guidance gives lenders a one-year grace period to implement full reporting procedures. Credit unions should therefore use 2025 to sharpen their data systems, track qualifying loans, develop borrower-statement workflows (deliverable by January 31, 2026), and lay the groundwork for full compliance beginning in 2026.

C4CU is here to help….

______________

This article is for information and education purposes only and should not be relied upon as tax advice or legal advice. Consumers seeking to discover whether their vehicle loan qualifies for the OBBBA interest rate deduction should see advice from a qualified tax professional.

Phishing and smishing: A growing risk

These scams—commonly known as phishing and smishing—masquerade as legitimate messages from financial institutions, claiming suspicious activity on an account and prompting recipients to verify transactions or update login details.

Fraudsters often use familiar logos, language, and sender information to appear credible. By clicking on links or responding to these messages, victims risk disclosing personal information or downloading malware. Scammers may also use spoofing to make their phone numbers appear legitimate.

Criminals employ advanced technology and psychological tactics—such as urgency, fear, or trust—to manipulate victims into responding. As these tactics evolve, credit unions are strengthening safeguards and communication efforts to protect members.

Credit unions strengthening safeguards and member outreach

Georgetown Kraft Credit Union (GKCU) recently warned members about fake text alerts impersonating its fraud department. In a  July 8 Facebook post, GKCU assured members that no data breach had occurred and reminded them never to share personal information. “We have added additional operational and IT security measures to protect our members,” said Elizabeth Owens, GKCU’s chief operating officer. The credit union’s website now features a prominent alert banner warning members of the scam.

Similarly, Revity Federal Credit Union has seen a rise in fake fraud messages. “As technology gets better, so do the bad actors,” said COO Amie Wheeler. “We’ve had scammers impersonating credit union fraud departments and asking members to verify purchases they never made.” Revity responded quickly, sending multiple member alerts and placing prominent warnings on its mobile app and website.

At Telco Community Credit Union, member education remains a top priority. CEO David Burnette noted that the credit union’s website and mobile banking platforms regularly feature fraud prevention resources. Marketing Manager Carol Griffiths added, “By using a diverse, multi-channel approach—including email, social media, and web banners—we’re able to reach members across various platforms and help keep their information safe.” Telco Community Credit Union offers an insightful article on protecting members from fraud. An informative resource well worth the read.

Resources to stay ahead of scammers

The Federal Reserve defines a scam as “the use of deception or manipulation intended to achieve financial gain.” Its Scam Mitigation Toolkit provides detailed explanations of common fraud tactics and offers downloadable resources to help financial institutions and consumers recognize and prevent scams.

For credit unions, these scams can erode member trust, damage reputations, and result in financial or regulatory consequences. However, proactive staff training and consistent member education are key defenses. The Carolinas Credit Union League offers comprehensive Bank Secrecy Act (BSA) and fraud training to help credit union employees identify and address these threats.

Learn more about League training programs and fraud prevention resources at BSA/AML Resources - Carolinas Credit Union League.

The 12-month program begins January 21, 2026, and will be held on the third Wednesday of each month. Sessions will take place virtually, with one mandatory in-person session scheduled during the year. The in-person date and location will be announced soon.

Whether new to compliance or seeking a refresher, participants will gain valuable insight into key areas such as credit union operations, regulatory interpretation, fraud investigations, and more.

Program details:

• Duration: January–December 2026 (Third Wednesday of each month)
• Cost: $799
• Registration Deadline: December 31, 2025
• Format: Virtual sessions plus one in-person session (TBD)

To register, visit the 2026 Compliance Boot Camp event page. Space is limited and this program does sell out, so early registration is encouraged.

October is Cybersecurity Awareness Month, and the Carolinas Credit Union League is highlighting a valuable free resource for credit unions.

The Cybersecurity and Infrastructure Security Agency (CISA) partners with organizations nationwide to defend against today’s threats and strengthen infrastructure for a more secure and resilient future.

This year’s theme, “Building a Cyber Strong America,” emphasizes the need to strengthen the nation’s infrastructure against cyber threats while ensuring resilience and security.

Individuals and organizations can take these four essential steps to improve cybersecurity practices:

1. Update software: Install updates promptly on all devices. Avoid clicking “remind me later.” Updates patch vulnerabilities that attackers can exploit. Enable automatic updates whenever possible.
2. Use strong passwords and a password manager: Create passwords with at least 16 characters that include a mix of uppercase and lowercase letters, numbers, and symbols. Use a password manager to generate, store, and fill passwords securely.
3. Turn on multifactor authentication (MFA): MFA adds an extra layer of protection to accounts. Use it wherever available and select the most secure method, such as a passkey or authenticator app.
4. Recognize and report phishing: Stay alert for suspicious messages. Always verify the sender before clicking links or opening attachments. Report scams using the platform’s “Report Phishing” tool.

Free CISA resources for credit unions

CISA offers a range of free cybersecurity resources designed to help credit unions strengthen their defenses. Acclaim Federal Credit Union is one example of a credit union benefiting from this partnership.

“Working with Robert [Main] and the team at CISA has been an invaluable resource for Acclaim,” said President and CEO Christie Smith. “Their support with our IT Performance Goals and Situational Awareness training has strengthened our cybersecurity posture, and we are grateful for their responsiveness and guidance. CISA has truly helped us stay proactive in protecting our credit union, members, and community.”

 CISA has also conducted several free webinars for League members. Additional resources can be found at carolinasleague.org/enterprise-risk-management.

Learn more

For more information on how to stay secure online and access free cybersecurity tools, visit:

•  Cybersercurity Awareness Month
• CISA Free Resources and Tools
• Cybersecurity Awareness Month 2025 Toolkit
•  DHS & CISA Announce Cybersecurity Awareness Month 2025
•  CISA Fact Sheet

Contact information

• North Carolina Cybersecurity State Coordinator: Rob Main at robert.main@cisa.dhs.gov 
• South Carolina Cybersecurity State Coordinator: CL Clay at CL.CLAY@cisa.dhs.gov

October marks Cybersecurity Awareness Month, a timely reminder that staying ahead of fraud and cybercrime requires continuous learning and preparation. In recognition of the theme established by CISA, “Secure Our World,” the Carolinas Credit Union League’s Risk Management Resources team has compiled a list of recommended webinars from trusted providers, including CUWN.

This mix of live and on-demand sessions—some free and others offered at low cost—covers essential topics for credit union professionals at all levels. From practical strategies to prevent fraud to deeper dives into emerging cyber threats, each webinar is designed to help teams strengthen awareness and resilience.

Recommended Webinars:

• Securing Member Information: Authentication Best Practices, Vendor Vulnerabilities, and Fraud Prevention
  October 9, 2025 | 3 p.m. EST | Free to NASCUS members
  Provider: NASCUS
  Get equipped with practical tools and knowledge to strengthen security without sacrificing member convenience.
  Event details »
• Cybersecurity Incident Response & Mitigation Strategies
  On-Demand | $225 for League members ($139 for CUs ≤ $50M in assets)
  Provider: CUWN
  Interactive and informative, gain insights from one of the country’s leading experts on cybersecurity incident response and mitigation strategies. Plus, receive a sample incident response plan.
  Event details »
• Countering Ransomware
  On-Demand | Free on YouTube
  Provider: U.S. Chamber of Commerce – Now+Next
  Learn what businesses need to do to better protect themselves from ransomware and other cybersecurity threats. Published May 5, 2021.
  Event details »
• Looking Forward to What’s Next in Cybersecurity
  On-Demand | Free with form signup
  Provider: Deloitte & Touche LLP via CybersecurityWebinars.com
  Watch the highlights from the 2025 Deloitte Cyber House event, where experts talk about what’s next in cybersecurity—covering topics like agentic AI, how to modernize safely, changes in identity systems, and more.
  Event details »
• Exploring the AI Cybersecurity Landscape in 2025
  On-Demand | Free with form signup
  Provider: Darktrace via CybersecurityWebinars.com
  As the digital world continues to evolve, so do the emerging threats. In this 30-minute webinar, explore the anticipated evolution of AI and cybersecurity as experts share their predictions for 2025.
  Event details »

“Cyber threats are evolving every day, but through education and preparation, credit unions can stay a step ahead while continuing to protect members and their assets,” said Jeanne Couchois, senior vice president of risk management resources and general counsel for the League. “Not to mention, cybersecurity remains a top supervisory priority for the NCUA. No matter a credit union’s asset size, there is always more we can do to ‘secure our world.’”

While October offers an important spotlight, cybersecurity education is a year-round priority. These providers represent a strong starting point for credit unions seeking ongoing insight and resources to strengthen defenses at any time. The League will also share more Cybersecurity Awareness Month insights and articles throughout October—make sure to register as a League member on our website to receive newsletters, join compliance and fraud community groups, and stay in the know.

More Resources

• CCUL Enterprise Risk Management – Find model resources on cybersecurity, ERM, and vendor management
• CCUL Fraud Resources – Access national and state-specific fraud prevention resources beyond cybersecurity
• Knowbe4 Free Webinar Library – Offering free, on-demand webinars after completing a signup form, Knowbe4 is committed to empowering employees worldwide to make smarter security decisions everyday

Last year, I put out my article to dispel some myths surrounding compliance officers in order to celebrate and honor us on National Compliance Officers’ Day. Bring on 2025, and I still think there are a few of the same myths, but I have heard some new ones that I want to address. So again, let’s see if we can set the record straight on this fantastic day, a second year in a row!

NEW Myth 1: There are no new regulations; the compliance officer’s workload must be pretty light right now.

Yep, I know some of us just spit out our drink when we read that. Let’s consider that not everyone has an in-depth understanding of what exactly we do. For those reading this who want to be supportive of their Compliance Officer, just know that while we haven’t had a ton of new regulations become effective (yes, we still had a few), we have existing regulations to contend with.

While compliance responsibilities may be easing from a supervisory perspective, remember there is also legal risk and reputation risk that the credit union (and compliance team) needs to manage! In addition, with some previous guidance being rescinded by the Consumer Financial Protection Bureau (CFPB), we are also left in an interesting predicament of having to understand that impact.

We also have to keep a closer eye on lawsuits and how they are changing previously finalized laws. Did I mention the evolution of fraud sophistication, escalation of cybersecurity threats, and keeping pace with new and more complex products and services (artificial intelligence)?

Old, but still relevant, Myth 2: Compliance officers always try to limit business!

Au contraire, mon frère ! We really don’t like to limit business!! Those who believe this to be true, I would encourage you to think about when the compliance officer is typically brought into the process for a new initiative. When we can be included right at the beginning, in the discovery phase of a new product or service, we can iron out all the hiccups to implement a compliant program.

When we are brought in right before launch, chances are we are going to need changes and maybe even halt the program in order to review the necessary disclosures and processes to ensure compliance. Trust me, we don’t like doing this. It is way more work for us! Please, please, bring us in when you are just starting discussions for a new product or service; it’s better for all of us!

Old, but still relevant, Myth 3: The compliance officer tells us we can’t do something, even when there is no regulation that says we can’t!

Have you ever heard of a little something called Unfair, Deceptive, Abusive Acts or Practices? Keep in mind that something might be considered unfair, deceptive, or abusive and may not be a violation of a specific regulation! Compliance officers have a lot of information (letters to credit unions, legal opinions, etc.) to digest coming out of federal agencies like the NCUA, along with state agencies.

If your compliance officer tells you that something shouldn’t be done or advertised in a certain way and it’s not because of a specific regulatory requirement, chances are it’s in that subjective area of being perceived as unfair, deceptive, or abusive. I don’t personally like to gamble that much, but if I did, my bet would certainly be with the compliance officer.

Old, but still relevant, Myth 4: I don’t need to worry about compliance, that’s the compliance officer’s job!

I’ve said it numerous times, whether about parenting or about compliance, it doesn’t matter, “it takes a village!” Long gone are the days when compliance can be handled by just one person! Technology is evolving rapidly, and our regulations are not keeping pace. We need to work in conjunction with our department heads/experts in order to work together to determine applicability. Everyone in the credit union needs to take ownership of compliance; the job is just too big for one person, and there needs to be accountability! We are just the leader of the circus!

Old, but still relevant, Myth 5: Compliance officers are boring!

Well, that is just not true! Maybe because we make stressful decisions, or maybe because we do the things that people don’t always like to do, but certainly that doesn’t make us boring! In fact, I think folks who do compliance are a rare, interesting breed. If you take the time to get to know us, you will realize that we are pretty interesting and definitely like to have a good time (we need to unwind too)! Maybe you should take your compliance officer out for lunch to celebrate National Compliance Officer’s Day! You will see just how charming we can be!

NEW Myth 6: Compliance is a drain on resources, and my examiner hasn’t mentioned anything wrong.

Oh boy, there is a lot to dispel here. There are some pretty hefty fines for non-compliance. If we just look at the Bank Secrecy Act, fines can range from $25,000 per day to millions per violation, with criminal liability for willful misconduct. We can already make an argument that your compliance officer is preventing a drain on resources with just that one law.

As for waiting for the examiner to find something, you'd better hope it’s the examiner that finds something before a class action attorney or the Financial Crimes Enforcement Network (FinCEN). The truth is that examiners can’t look at everything when they come in for an exam. Are you really willing to take that risk?

Cheers to all the compliance officers out there! We see you! I hope your credit union celebrates you this week!

There were six sessions and to kick off the day, John Bredehoft from Kaufman & Canoles, PC led a litigation update. Some of the top issues he went over include:

• Employment claims

• Fair Credit Reporting Act: over 80% of consumer complaints are about credit reporting miscues.  There is a litigation trend where the credit reporting agencies are notified of a dispute, but the credit union is not.

• Overdraft and NSF charges: the key to prevention is clarity and plain language in disclosures

David Reed of Reed & Jolly PLLC presented virtually with a regulatory update. He spoke about the GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins), Artificial Intelligence, and NCUA's Succession Planning Rule, which is effective January 1, 2026.

Frank Drake of Smith Debnam Attorneys at Law went over fair lending issues. One of the biggest takeaways of his presentation is even with the uncertainty from the CFPB, do not stop what you are doing, "behave as if it is 2023." Credit unions should make sure they are still doing due diligence on third-party vendors and ask for a five-year breach history and continue to guard against disparate impact.

Ashley Rusher of Blanco Tackabery & Matamoros, PA led a discussion on Attorney Client Privilege for In-House Counsel. The group had a good discussion on various scenarios encountered in their own credit unions. This session gave all attorneys one hour of Ethics CLE credits.

Patti Ramseur and Alex Maultsby of Ramseur and Maultsby LLP presented on Employment Law.  They went over four DEI-specific executive orders and the effects of those. They ended the presentation with key takeaways, including:

• Focus on Inclusivity: ensure that all employees are respected and have opportunities to succeed. 

• Review company policies and other materials for language regarding demographically based "diversity" goals, targets or quotas that could be considered discriminatory.  

• Look at leadership programs, affinity groups, employee resource groups and mentorship groups to ensure they do not exclude individuals based on a protected characteristic.

• Document employee decisions carefully

CCUL's Director of Federal Affairs Nate Lane and NC Legislative Affairs Manager Carson Butts gave the group an update on advocacy efforts and what is happening federally and within the states.

Legal Update is great for attorneys or legal staff to come together, network and stay up to date with the latest industry trends, regulatory changes, and best practices. Credit unions with attorneys or legal staff that have not attended in the past are invited to email risk@carolinasleague.org to be added to the distribution list or register their profile on the League's website.

Tailored for legal professionals representing mid-size and large credit unions, the CCUL Legal Update offers a local and affordable opportunity to stay current on the latest in litigation, compliance, and regulatory matters. The event will run from 8:30 a.m. to 3:30 p.m. and features sessions led by respected attorneys and subject-matter experts in credit union law.

The $300 registration includes access to a full agenda of legal education and discussion, designed to help attendees better support their credit union clients and institutions.

Agenda highlights include:

• Litigation Update with John Bredehoft, Kaufman & Canoles, PC
• Regulatory Update with David Reed, Reed & Jolly PLLC
• Fair Lending Issues with Franklin Drake, Smith Debnam Attorneys at Law
• Attorney-Client Privilege for In-House Counsel with Ashley Rusher, Blanco Tackabery & Matamoros, PA
• Employment Law: The Trump Effect with Patti Ramseur, Ramseur Maultsby LLP
• CCUL Advocacy Update with Nathan Lane, Carolinas Credit Union League

This event offers attendees a chance to connect and collaborate with peers.

Register today to secure your spot.

For questions, contact the CCUL Risk Management Resources Department at risk@carolinasleague.org or call 800-822-8859, ext. 413 or 565.

InfoSight360 offers a clear breakdown of what’s changed and what credit unions must do to remain compliant.

Originally updated in 2019, Regulation CC ties its monetary thresholds to a consumer price index, triggering updates every five years. The current changes reflect inflation adjustments across key categories, including next-day availability, large deposits, and civil liability.

Credit unions must notify members of these changes no later than 30 days after implementation. Notifications can be issued via statement messages or similar communication channels. In addition to member notice, credit unions should have already reviewed and updated their internal procedures to align with the new thresholds.

Updated thresholds as of July 1, 2025, include:

For credit unions that need support navigating these changes, InfoSight360 provides a comprehensive breakdown of the regulation updates, as well as actionable guidance for maintaining compliance. This member-exclusive resource is available through the Carolinas Credit Union League, offering timely tools and insights to support credit unions in adjusting to new regulatory standards.

Credit unions that haven’t yet redeemed access to InfoSight360 are encouraged to do so to take full advantage of these compliance resources.

Financial abuse or exploitation involves the illegal, unauthorized or improper use of an elder’s funds, property or assets. The Federal Trade Commission stated that fraud losses reported by elder adults increased significantly from $0.6B in 2020 to $2.4B in 2024 and seniors reported losing more than $2.3B in 2024 alone.

 

Elder abuse is a serious issue and loss of seniors’ financial resources can lead to a diminished quality of life through poverty, homelessness and reduced access to healthcare. It may cause significant emotional distress resulting in depression, feelings of guilt and shame, health problems and loss of independence for victims. Sadly, many elderly people are victimized by someone they know and trust like a family member or caregiver. This erodes their sense of security, leading to anxiety and often causes them to socially isolate themselves. The North Carolina Department of Health and Human Services (NCDHHS) website provides a map defining the separate geographical areas throughout the state for Agencies on Aging (AAA) with a list of locations and contacts available to assist with elder abuse. Explore the map of AAA regions here.The South Carolina Department on Aging has a list posted to its website as well.

It is important to raise awareness about this issue within communities and encourage open discussions with family members and loved ones. Elders need to be educated about the different types of scams so that they are empowered with the knowledge to recognize the warning signs and avoid becoming victims. The Federal Trade Commission has introduced a “Pass It On” program containing fact sheets, bookmarks, online articles, video’s and ready-to-go presentations that can be viewed and downloaded for free. Printable materials for distribution can be ordered online and are also available for free. The FAQ page has a wealth of information and provides further guidance. These resources can be found at: www.ftc.gov/PassItOn.

Every credit union employee plays a vital role in mitigating elder abuse by ensuring that they follow their internal and regulatory reporting policies. As a best practice, a trusted contact can be added to every account. They may also suggest that a legal expert be consulted to explore the possibility of having a power of attorney appointed for added protection. Placing assets into a trust can also be a safeguard as oversight from a third party can be added that will prevent a potential abuser from accessing them through coercion or manipulation. The nonpublic confidential information contained in a trust also shields assets from public records thus adding an extra layer of protection.

Time remains one of the most valuable resources for compliance professionals, yet too often it is lost to inefficient research. The InfoSight360 platform streamlines access to regulatory guidance, providing credit unions with timely, reliable information.

The platform features clear, plain-language summaries, comprehensive checklists, and frequently asked questions designed to simplify compliance management. State-specific content covering all 50 states ensures tailored insights, while the AI-enhanced search function delivers accurate, detailed answers with speed and precision.

More information is available at InfoSight360.com.

Stay ahead of compliance changes with InfoSight360. Regulation CC is set to adjust its monetary thresholds on July 1, 2025, as part of its scheduled five-year update tied to inflation. These changes affect funds availability and member notification requirements, making it critical for credit unions to review and revise related policies and procedures. InfoSight360 offers a clear breakdown of what’s changing and what credit unions must do to remain compliant. If your credit union hasn’t yet redeemed access to this member-exclusive resource, now is the time to take advantage of the timely insights and tools available through the Carolinas Credit Union League.

Expedited Funds Availability - Regulation CC: Changes Effective July 1, 2025

Regulation CC was updated in 2019, impacting the monetary limits within the regulation, which are now tied to a consumer price index. These monetary limits will adjust every 5 years. The thresholds outlined in the table below will become effective on July 1, 2025.

Credit unions should note that they will be required to notify the membership of this change, no later than 30 days AFTER implementation of the change. Credit unions should be prepared not only to update their policies and procedures, but to send corresponding notification to their members in a statement message (or something similar).

Source: InfoSight360

As a participating association in League InfoSight, the Carolinas Credit Union League ensures its members have full, complimentary access to the InfoSight product within InfoSight360. This long-standing member benefit remains available as part of the League’s commitment to supporting credit unions with practical, day-to-day compliance resources.

At the heart of this brand-new platform is its artificial intelligence-enhanced search functionality. This advanced feature redefines compliance resources by intelligently analyzing all available content within the combined products, ensuring users receive accurate and thorough answers to their compliance questions within seconds, all derived from carefully reviewed and vetted content in a secure environment.

“…as our regulatory landscape continues to evolve, become more complex and uncertain, we must also rapidly evolve the technology we use to manage it,” said Glory LeDu, CEO of League InfoSight and CU Risk Intelligence. “We knew we had to start utilizing artificial intelligence now, to stay ahead in our strategic priority to be more progressive and deliver a seamless user experience for our credit unions.”

Credit unions will access InfoSight360 via the new website at www.InfoSight360.com, where they will be instructed to find and bookmark their credit union’s unique URL. No login credentials? Email 360support@infosight360.com for assistance in getting set up for access.

On March 2, 2025, the U.S. Treasury Department stated it was suspending the enforcement of the Corporate Transparency Act’s (CTA) Beneficial Ownership Information (BOI) Reporting rule as it applies to U.S. citizens and domestic reporting companies and issued a proposed rule narrowing the scope of the BOI rule. On March 25, 2025, the Financial Crimes Enforcement Network (FinCEN) adopted an interim final rule that modifies the current BOI Reporting rule.

The new BOI Reporting interim final rule (i) narrows the CTA reporting requirements to entities previously defined as “foreign reporting companies,” (ii) extends the earliest reporting deadline to April 25, 2025, and (iii) exempts foreign reporting companies from having to report the ownership information of any US person who is a beneficial owner.

The interim final rule amends the definition of a “reporting company” to legal entities formed under the law of a foreign country and registered to do business in any state or tribal jurisdiction by the filing of a document with a secretary of state or any similar office. The interim final rule did not eliminate any of the original 23 exemptions from the definition of reporting company.

Credit unions that have already changed their policy and procedures to incorporate BOI reporting should now review the policies and procedures to ensure that only foreign companies registered to do business in the U.S. must provide the required information.

FinCEN implemented the rule on March 26, 2025, and is accepting written comments through May 27, 2025.

Credit union attorneys and legal staff—mark your calendars for the 2025 CCUL Legal Update, taking place Wednesday, August 6 at Skyla Credit Union in Charlotte, NC.

This one-day event is designed for JD holders, in-house counsel, and legal professionals supporting credit unions across the Carolinas. The CCUL Legal Update offers a unique opportunity to explore current legal, regulatory, and compliance issues relevant to credit unions of mid-size and larger asset sizes.

In addition to timely topics focused on the credit union industry, the agenda will include broader legal and financial insights that enhance your ability to advise and serve your organization effectively.

Event Details:

Date: Wednesday, August 6, 2025

Time: 8:30 a.m. – 3:30 p.m.

Location: Skyla Credit Union | Charlotte, NC

Cost: $300

Thank you to Skyla Credit Union for hosting this event! View the event page to learn more.

InfoSight360 is a groundbreaking integration of League InfoSight’s flagship products—InfoSight, CU PolicyPro, and RecoveryPro, combining the best elements of these tools into one seamless solution designed to simplify compliance, policy management, and business continuity planning. Credit unions subscribed to any of League InfoSight’s three products will be automatically upgraded to the new platform when it launches on Monday, March 31, 2025.

As members of the Carolinas Credit Union League, professionals will continue to have complimentary access to the InfoSight product on the new platform, which will debut enhanced features including artificial intelligent search, state-specific content comparison, and customizable dashboards.

Credit unions are not required to subscribe to all three products on the InfoSight360 platform. However, should the benefits of one or more products be of interest, details on how to subscribe will be readily available.

How to Access InfoSight360

With a single sign-on, managed by InfoSight360, users will be able to toggle between the three product systems, ensuring that no critical information is overlooked. This enhancement means League members will no longer have single sign-on capability between the League’s website, carolinasleague.org, and InfoSight as logins will now be managed separately.

Next Steps for Existing Users

In the coming days, existing subscribers of InfoSight will get an email from the League, inviting them to pre-register on the new platform. This will allow them to set up their login credentials for continued access to the compliance library come March 31. Current subscribers to either CU PolicyPro or RecoveryPro will have their existing login credentials transferred automatically into the new system.

For questions about this exciting launch, contact any member of the CCUL Risk Management Resources team.