What the assessment actually delivers.
A written sovereignty-posture document, organized the way your next IT examination team will organize their findings. Three to six pages on the short cycle, six to twelve pages on the long cycle. Named observations, sourced to your environment, with a remediation order written for a credit union's procurement reality (board approval cycles, supervisory committee oversight, NCUA letter compliance) and not a sales-cycle reality.
Lens 1: Exam-readiness posture.
What document trails exist today for your information security program, vendor management, third-party risk, business continuity, incident response, and member-data handling? Where would your last exam's open findings re-surface in the next cycle? What is the gap between what is true in your environment and what you can produce on demand for an FFIEC IT examiner or an NCUA examiner?
This lens reads your environment the way an examination team would, organized around the FFIEC IT Examination Handbook booklets that apply to your size and complexity. State-chartered NY credit unions also fall under 23 NYCRR Part 500. Most CUs in this asset band are full covered entities under that part; the limited exemption at 500.19 (which requires fewer than 20 employees, less than $7.5M in gross annual revenue, and less than $15M in year-end total assets, all three at once) only reaches very small institutions and most state- charter NY CUs sit well above those thresholds. We call the multi- regulator overlap out separately in the deliverable so the posture is readable on its face.
Lens 2: Core-banking and ancillary vendor sovereignty.
What do your core processor and your ancillary vendors actually claim in their current contracts, data processing addenda, AI feature activation defaults, and renewal-rate escalators? Where does your member data live, who has subpoena authority over it, and can you produce a clean export of the member master, the share-account ledger, and the loan portfolio without the vendor's active cooperation?
This lens names every named vendor in your stack: core processor, online-banking provider, bill-pay processor, card-services vendor, remote-deposit-capture vendor, loan-origination platform, ACH provider, CRM, marketing automation, and any AI or fintech overlay introduced in the last 24 months. It surfaces the contractual reality (not the relationship manager's reassurance) and flags where the AI clauses added in recent amendments have changed what you signed up for.
The deliverable is yours. Keep it, share it with your supervisory committee, drop it into your next exam workpaper file, or hand it to your board's risk committee. There is no obligation to engage Sterling for any remediation work. If we can help, you will know. If you do the work in-house from the assessment alone, that is also a good outcome.
The threat surface, named.
Four exposures sized specifically for a credit union in the $50 million to $500 million asset band, NY state-chartered or federal-charter. None of these are hypothetical. All of them are showing up in current FFIEC and NCUA examinations and in the industry trade press.
Threat 1: Core-processor lock-in is the largest single sovereignty exposure on your balance sheet.
A handful of vendors (Symitar, Corelation, Jack Henry, FIS, Fiserv) hold the core-processing market for credit unions in your asset band. Their contracts are typically five years, with auto-renewal language, price-escalator clauses, and data-portability terms that make migration a multi-year project. Published research on credit union core conversions consistently puts total cost (license, conversion services, internal labor, parallel-running, training, opportunity cost) in the high six to seven figures for a credit union in the $100M to $500M asset band, with the dominant share landing in internal labor and opportunity cost rather than the vendor's quoted line item. The longer you stay, the harder leaving gets, and the renewal terms know it. Migration is rarely a real option, which is exactly why every additional integration the vendor sells you tightens the lock further. Your board cannot show in the minutes when the structural decision to continue was reviewed against alternatives, because the review usually does not happen.
Sources: Cornerstone Advisors annual "What's Going On In Banking" and credit union core conversion case studies; Callahan and Associates core processor market share data 2024 to 2025; Datos Insights (formerly Aite-Novarica) core banking research; CUNA Mutual Group operational risk publications; NCUA Letters to Credit Unions on third-party relationships and vendor management (notably 07-CU-13 and successors).
Threat 2: AI vendor training-on-your-data clauses collide with member fiduciary duty and FFIEC GLBA expectations.
OpenAI, Anthropic, and Google's enterprise terms each contain provisions for using customer prompts and outputs to improve their systems unless you opt out, and the opt-out is typically only available on annual contracts above a price floor most credit unions in this asset band do not negotiate to. For a member-owned cooperative, this collides directly with the board's duty to members and with the Gramm-Leach-Bliley Act Safeguards Rule expectations the FFIEC examines you against. Member loan applications, account narratives, branch service notes, and call-center transcripts are not training material you have the authority to provide. Your information security program will not show where you got member consent for it.
Sources: OpenAI Enterprise Terms 2026; Anthropic Acceptable Use Policy 2026; FFIEC IT Examination Handbook, Information Security booklet; Gramm-Leach-Bliley Act Safeguards Rule; NCUA Letter to Credit Unions on cybersecurity and incident reporting.
Threat 3: Your next FFIEC IT exam will look hardest at third-party risk and ancillary integrations, not just your core.
The FFIEC IT Examination Handbook (Outsourcing Technology Services booklet, Information Security booklet, and Business Continuity Management booklet) sets the standard against which examiners evaluate your third-party relationships. State-chartered NY credit unions also fall under 23 NYCRR Part 500. A credit union in this asset band is almost always a full covered entity; the small-business limited exemption at 500.19 has narrow thresholds (under 20 employees, under $7.5M revenue, under $15M assets, all three) that the $50M-and-up CU does not meet. The exam expects a written third-party risk management program, named risk tiers, due diligence files, contract reviews, and ongoing monitoring evidence. The bolt-on integrations (RDC, bill-pay, card services, loan-origination platforms, AI overlays) are exactly where most credit unions in this band have the thinnest documentation. That is also where the examiner looks first.
Sources: FFIEC IT Examination Handbook, multiple booklets; 23 NYCRR Part 500 (amended November 2023, including 500.19 limited exemption); NCUA Supervisory Letter on Third-Party Risk; published NCUA enforcement actions on vendor management 2022 to 2025.
Threat 4: Merger and shared-services conversations are when vendors lock you in for the next decade.
Credit union consolidation has accelerated. The number of federally insured credit unions declines every quarter. If your CU is in or near a merger, a shared-branching expansion, a CUSO arrangement, or a back-office consolidation, the vendor selection you make in the next 12 months will shape your operational reality through 2035. The mainstream core processors and AI vendors all know this. Their enterprise sales motion is built around the consolidation moment. The contract terms offered to a consolidating group are tighter, longer, and harder to exit than the contract terms offered to a standalone credit union. The cooperative form's strongest historical defense, suspicion of outside dependency, is exactly what tends to lapse during a merger push when everyone is focused on the deal narrative rather than the vendor terms underneath it.
Sources: NCUA quarterly call report data on credit union consolidation 2020 to 2025; National Credit Union Foundation merger research; industry observation, recent NY state-charter merger filings; Sterling Solutions cooperative-structures research stream (Q2 2026, in progress).
The hybrid cycle, sized to your reality.
The general success.build/risk evaluation runs a two-hour cycle. The mutual-carrier /risk/mutual evaluation runs a ten-business-day cycle. A credit union sits between those two shapes more often than not: the small NY state-charter that runs lean enough for a fast cycle, the mid-size CU heading into an FFIEC IT exam that needs the full ten-day treatment.
So the credit-union assessment is scope-selectable on the discovery call. Both options are free. The shorter option is the right fit more often than CEOs initially expect.
- Short cycle (about two hours of your time, roughly one week elapsed). Thirty-minute discovery call. Homework on your side: vendor list, contract excerpts, last exam letter if you are comfortable sharing. One sixty-minute evaluation session. A three-to-six page written sovereignty-posture document delivered within five business days. Best fit when the question is narrow: "are our core renewal terms as bad as we think," "is our AI vendor exposure a real issue," "what is on a typical FFIEC IT exam workpaper that we have not documented."
- Long cycle (about ten business days, examiner-shaped deliverable). Forty-five-minute discovery call. One week of homework on our side: we read your most recent published exam letter if accessible, pull current terms for every named vendor, and structure the evaluation around the FFIEC booklets that apply to your size and complexity. One ninety-minute evaluation session with the CEO, COO, IT lead, and one or two functional leads. A six-to-twelve page written deliverable within five business days of the evaluation session. Best fit when the question is comprehensive: full third-party risk posture, full core-and-ancillary stack review, board-shaped reporting.
The choice is made on the discovery call, not before. Bring the questions, we will help size the cycle. Either option is free. Either option produces a written deliverable that is yours to keep, share, or file.
Who this is for.
The fit is clearest for credit unions in the $50 million to $500 million asset band, either New York state-chartered (with NYDFS plus NCUA oversight) or small federal-charter (NCUA only), with staff between 15 and 150 people. That sizing is not arbitrary: it maps to the credit union's procurement reality and to the Sovereignty Maturity Assessment's deliverable shape.
- NY state-chartered credit unions sitting in the multi-regulator overlap (NYDFS plus NCUA), where 23 NYCRR Part 500 cybersecurity expectations stack on top of NCUA examination scope.
- Small federal-charter credit unions in the same asset band where NCUA is the single regulator but FFIEC IT exam expectations are identical.
- Credit unions in or approaching a merger, shared-services arrangement, or CUSO consolidation where vendor selection in the next 12 months will shape the next decade.
- Credit unions with a recent or imminent FFIEC IT examination cycle where vendor management, third-party risk, or information security findings are on the table.
- Community development credit unions (CDCUs) and low-income designated CUs serving underserved communities, where the mission-fit and the regulatory exposure both run hot.
- Single-county and statewide CUs with an independent operations team and one or two IT generalists but no dedicated CIO.
Adjacent structures we also work with
- Smaller credit unions below $50M in assets where the engagement scope is typically narrower and oriented toward a single named exposure (one core renewal, one AI vendor question, one exam-readiness gap).
- Credit union service organizations (CUSOs) providing shared back-office services to multiple credit unions, where the vendor sovereignty question is structural to the CUSO itself.
- Other cooperative financial institutions (community development financial institutions with cooperative charters, mutual savings banks) where the member-fiduciary frame applies even though the regulatory regime differs.
- Mutual carriers and cooperative insurers (covered separately at /risk/mutual) where the cooperative form is the same but the regulator is DFS rather than NCUA.
- Fraternal credit unions and federal credit unions sponsored by fraternal organizations (Knights of Columbus Federal Credit Union and analogous structures) where the credit union itself sits inside a larger fraternal 501c8 or 501c10 cluster. The credit-union-specific vendor and FFIEC IT exam questions are treated here; the cluster-stewardship questions across the fraternal entities sponsoring the CU route to the fraternal 501s assessment.
- Fraternal benefit societies with savings products regulated under state fraternal codes where the member-fiduciary frame is identical but the regulatory regime differs. Cluster-form variants route to the fraternal 501s assessment.
Why us.
Sterling Solutions is a Westchester-based small firm. We do not run on venture capital. We do not have a sales team pretending to be your friend. We do not have an exit horizon. We have published values (success.build/ethos) and a written anti-lock-in doctrine, and the architecture of our own platform proves it: every layer is swappable, every export is clean, your data is yours from day one and on the day you leave.
We are not a core processor and we are not pitching one. The assessment is not a stalking horse for a system conversion engagement. If the conclusion is "your core terms are bad and you should renegotiate seriously at the next renewal," that is the conclusion. If the conclusion is "your stack is fine, here are three ancillary vendors worth a closer look," that is the conclusion. We have no commission structure with any of the vendors we evaluate.
And we are researching member-ownership and cooperative structures for our own firm. The goal is that as Sterling grows, the people we serve benefit alongside us, rather than the opposite (which is what every venture-backed SaaS model produces by structural necessity). A formal recommendation on the structure will publish later this year. We mention it here because if you run a member-owned cooperative, the question of whether your vendors are structurally aligned with you is the question. We take it seriously enough to ask it of ourselves.
What this page is not.
This is not a pitch for a six-figure modernization engagement disguised as a free assessment. The assessment is the deliverable. If you read it, file it, do the work in-house, and never speak to us again, that is a good outcome and we are not chasing you for a sales call.
This is not a sovereignty audit you could order from a Big Four firm. Those exist and they cost six figures and they are shaped for institutions with internal procurement teams large enough to receive them. This assessment is shaped for the CEO, the COO, or the operations leader who is reading their own vendor contracts on a Sunday because no one else will.
This is not a generic financial-services consulting offer. The lens is specifically credit-union-shaped, with cooperative member-fiduciary duty and FFIEC IT exam posture as the organizing frame. A community bank would get a different evaluation and probably should look at the general success.build/risk page instead.
Tire-kickers, briefly.
The evaluation is honest work. We do the homework on our end. We read your most recently available exam material. We pull your vendors' current terms. We come to the evaluation session prepared. We ask the same of you: bring the CEO or operations leader who actually owns the vendor relationships, and bring a real intent to read what we deliver. Curiosity is fine. Performative curiosity is not what this offer is for.
One discovery call.
Forty-five minutes for the long cycle, thirty for the short cycle. The next examination team is going to ask the questions in this assessment whether or not you have written answers ready. The next core renewal is going to land on your desk on the vendor's preferred timeline rather than yours. The asymmetry between "having a written posture document on the shelf before the exam or the renewal" and "scrambling during it" is large, and it is not in your favor by default. Sterling is happy to help close it.
Heads-up on the booking page: the booking widget currently shows 30-minute slots. For the short cycle, thirty minutes is the right length. For the long cycle, once you pick a time we will extend it to forty-five minutes on our end, provided the fifteen minutes before or after your selected slot are open on our calendar. If the adjustment does not work for you, email [email protected] and we will find a slot that fits.
success.build/risk/credit-union · [email protected] · scope-selectable on the discovery call