Approved Corporate CUSO Activities

Approved corporate CUSO activities are presented in matrix form, under the following headings: Category (general class of service), Activity (specific service), Description of Service (explanation of service), and Activity Conditions (limitations or requirements on conducting the activity). All corporate CUSOs, when engaging in approved CUSO activities, must comply with all applicable laws and regulations, even if not specifically discussed in the matrix.

In addition to the Activity Conditions listed in the matrix, all corporate CUSOs engaged in a particular approved activity must provide NCUA with the following reports by the 25th of the first month after the quarter-end or year-end, unless indicated otherwise:

Quarterly: Financial statements and performance reports;
Annually: Annual report to Owners, audited financial statements (30 days after receipt), strategic plan, list of current owners with percentages of ownership, and descriptive list of all products and services provided by the CUSO.

Required reports should be uploaded to the CUSO Registry using the “Reports” upload function. Questions concerning report upload requirements should be directed to the Office of National Examinations and Supervision by email at onesmail@ncua.gov or by telephone at 703.518.6640.

Category – Clerical, Professional, & Management

Category – Clerical, Professional, & Management Approved Activities
Activity	Description of Service	Activity Conditions
Activity Business Consulting Services	Description of Service Offering consulting services in support of business development, strategic planning, industry analysis, and operational efficiency.	Activity Conditions Other Conditions: None
Activity Human Resources Services	Description of Service Services addressing human capital needs, reporting, and management considerations to include development of policies, procedures, and employee manuals.	Activity Conditions Other Conditions: None
Activity Insurance Brokerage or Agency Referrals	Description of Service Making third party insurance services or products available. This may include endorsing a product or service, negotiating group discounts and making referrals.	Activity Conditions Other Conditions: None
Activity Marketing and Research Services	Description of Service Systematically gathering, recording, and analyzing data about issues relating to marketing credit union products and services to identify and assess how changing elements of the marketing mix affect member behavior. Producing reports of research, making recommendations for marketing strategies, and other similar market and research services.	Activity Conditions Other Conditions: None
Activity Payroll Services	Description of Service Management of payroll processing, reporting, and tax filing.	Activity Conditions Other Conditions: None
Activity Training Services	Description of Service Furnishing pre-packaged training products, developing new or customizing existing training products/modules, and facilitating education and training of credit union staff.	Activity Conditions Other Conditions: None
Activity Audit & Compliance Consulting Services	Description of Service Performing, as requested and agreed upon in predetermined scope arrangement, audits (internal, operational, financial, or compliance). Providing education and consultation services for developing statutory and regulatory compliance programs related to the Bank Secrecy Act, Anti Money Laundering provision, Office of Foreign Asset Control, and U.S. Patriot Act.	Activity Conditions Other Conditions: None
Activity Product Development Services	Description of Service Research and development of products and services specific to the needs of credit unions and their members/consumers.	Activity Conditions Other Conditions: None

Category – Currency Services

Category – Currency Services Approved Activities
Activity	Description of Service	Activity Conditions
Activity Coin and Currency Services	Description of Service Providing replenishment or deposit of excess coin and cash. This may include vault cash orders, ATM replenishments, and other similar services. Coin and currency services may be offered through agreement with another financial institution, direct with the Federal Reserve, through an armored car service agreement, or other similar arrangement.	Activity Conditions Other Conditions: Maintain bond/liability insurance as appropriate. Annually provide OCCU copy of bond/liability insurance.

Category – Data Processing

Category – Data Processing Approved Activities
Activity	Description of Service	Activity Conditions
Activity Electronic Document Management	Description of Service Providing document and record management systems which may allow for document archival, reporting, secure remote access, and similar services.	Activity Conditions Other Conditions: None
Activity Core processing	Description of Service Offering a back-end system in a service bureau environment used to process and record daily transactions, and post updates to accounts and other financial records. This typically includes deposit, loan and credit-processing capabilities, with interfaces to general ledger systems and reporting tools, and may allow for or integrate with front-end member access platforms.	Activity Conditions Other Conditions: Maintain business recovery plan ensuring uninterrupted operations. Maintain bond/liability insurance appropriate for activity. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, business contingency plans & test results.

Category – Lending/Deposit

Category – Lending/Deposit Approved Activities
Activity	Description of Service	Activity Conditions
Activity Business Banking - Consulting and Turnkey Services	Description of Service Provide either in-house, or through turnkey operation, suite of financial products. Products may include loan products, risk monitoring, and consulting services for business loan, deposit, payment and cash management products.	Activity Conditions Other Conditions: Comply with the Member Business Loan Regulation - Part 723 of the NCUA Rules and Regulations.
Activity Business loan origination	Description of Service Provide business loan consulting and origination services. Examples of business loan origination include commercial real estate, term loans, lines of credit, construction, agriculture, SBA loans, and loan participation servicing and brokering.	Activity Conditions Other Conditions: Comply with the Member Business Loan Regulation - Part 723 of the NCUA Rules and Regulations.
Activity Business Loan Support Services	Description of Service Provide business loan processing and sales to include pre- and post closing underwriting, risk monitoring reports, document preparation, and servicing. Loan support services may also include debt collection services and sale of repossessed collateral.	Activity Conditions Other Conditions: None

Category – Payments and Electronic Transaction Services

Category – Payments and Electronic Transaction Services Approved Activities
Activity	Description of Service	Activity Conditions
Activity Automated Clearing House (ACH)	Description of Service Providing services for the receipt, processing, distribution, and settlement of electronic credits and debits among financial institutions for final posting to business entities, credit unions and members/consumers. Activities include receipt of ACH files; file distribution; receipt and processing of returned items and notification of change files; offering and/or processing ACH origination files; assisting with ACH exceptions and transaction disputes; providing settlement of ACH files; and other similar ACH services.	Activity Conditions Other Conditions: Restrict CUSO ownership to one corporate unless approved by NCUA. Comply with NACHA rules. Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results. Utilize distributed settlement model if providing services to other corporate credit unions.
Activity Wire Transfer Services (Domestic and International)	Description of Service Electronically transferring funds through the Federal Reserve Bank, other financial institution, or other similar third-party funds transfer agent (i.e., Western Union, etc.) directly to a domestic or foreign financial institution or receiving transfer agent with final credit to business entities, credit unions, and member/consumers.	Activity Conditions Other Conditions: Restrict CUSO ownership to one corporate unless approved by NCUA. Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Prefund transactions prior to processing. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results.
Activity Forward Check Collection / Remote Deposit Capture Services	Description of Service Offering a suite of image, electronic, and paper forward check processing, collection, clearing, settlement, adjustment, and reporting services. Deposit processing may occur as either “traditional” paper processing, electronic truncation, or image capture, processing, and transmission of check images from remote or centralized locations. Remote deposit capture services may include branch, teller, merchant, ATM, and consumer capture, and other similar forward check collection services. Activities may include resale of equipment through negotiated agreement, bundled services, and support agreements.	Activity Conditions Other Conditions: Restrict CUSO ownership to one corporate unless approved by NCUA. Comply with Federal Reserve Operating circulars and/or image clearing house operating agreements. Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results. Utilize distributed settlement model if providing services to other corporate credit unions.
Activity Share Draft (Check) Processing	Description of Service Offering inclearing services for the receipt and processing of share drafts (checks) either as electronic images or physical checks received from the Federal Reserve Bank, image exchange networks, or through direct presentment arrangements with other financial institutions. Services include receipt and processing of inclearing checks for file distribution, processing of return files, adjustments, dispute resolution assistance, financial settlement of files, and other similar services.	Activity Conditions Other Conditions: Restrict CUSO ownership to one corporate unless approved by NCUA. Comply with Federal Reserve Operating circulars and/or image clearing house operating agreements. Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results. Utilize distributed settlement model if providing services to other corporate credit unions.
Activity Share Draft, Check Imaging, and Archival Services	Description of Service Providing services for capturing and storing images of physical share drafts or checks for the purpose of facilitating forward check collection, maintaining electronic archives, and facilitating electronic access to check images for consumers’ statements, integration with internet banking websites, and other similar purposes. Service may also include creating copies of archival history to facilitate “in-house” storage or transfers to new third-party service providers.	Activity Conditions Other Conditions: Restrict CUSO ownership to one corporate unless approved by NCUA. Comply with Federal Reserve Operating circulars and/or image clearing house operating agreements. Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results.
Activity Share Draft Fraud and Risk Management Services	Description of Service Offering complementary services for share draft processing designed to identify and prevent checking account fraud and losses during the share draft clearing process.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results.
Activity Official Check Services	Description of Service Offering business share drafts (checks), official checks, and money order programs to include processing, clearing, and settlement of items, maintaining list of issued drafts, and providing daily reports for reconciliation.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results.
Activity Lockbox & Remittance Services	Description of Service Providing wholesale or small batch retail remittance processing services. Service includes receiving and processing payments, providing reports or files of activity, depositing of funds, and forward collection of items.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results.
Activity Online & Mobile Banking	Description of Service Offering internet-based technological services which may provide real-time, 24/7 access to consumers’ financial information. This includes the ability to manage a variety of transactional and non-transactional activities within and between accounts which may include electronic transfers, payments, on-line loan applications, and other similar banking activities. Access to accounts may be through internet web applications and/or portable electronic devices.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results.
Activity Bill Pay and Electronic Bill Presentment and Payment (EBPP) Services	Description of Service Offering services to allow consumers to send money to a creditor or vendor to be credited against a specific account. Bill payments may be executed electronically, via paper check or banker's draft, or other similar electronic payment means. Services may also include electronically presenting bills and/or billing statements.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, report on controls at a service organization, business continuity plans and test results.
Activity Electronic Statements/Paper Statements	Description of Service Providing electronic and paper delivery of periodic account statements.	Activity Conditions Other Conditions: Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain bond/liability insurance as appropriate. Annually provide OCCU copy of bond/liability insurance, business continuity plans and test results.
Activity Credit Card, Debit Card, and Gift or Prepaid Card Program Services	Description of Service Offering debit, credit, and gift or prepaid card programs and processing to include: access to card networks and gateways, authorization and settlement of signature debit transactions, including settlement of related funds; fraud monitoring, risk management, and case support services to include neural networks and charge-back processing services; back office card support and management, reconciliation of daily settlement and adjustment processing; card maintenance, issuance, and transaction reports; card program project management and implementation; and other similar services. Gift or prepaid cards may be reloadable or non-reloadable.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Maintain bond/liability insurance as appropriate. Maintain and certify compliance with current PCI/DSS (Payment Card Industry/Data Security Standards). Maintain neural network or other industry standard fraud detection system. Comply with network processing agreements and standards. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, business continuity plans and test results, report on controls at a service organization, and PCI/DSS compliance certification.
Activity Automated Teller Machine (ATM), Electronic Funds Transfer (EFT), and Point of Sale (POS) Services and Networks	Description of Service Offering programs that allow access to a network of EFT terminals and ATMs to initiate PIN-based debit or ATM card transactions. ATM services include utilizing a shared ATM network, setting up a private ATM network, monitoring of ATM connectivity and availability, including the management of telecom circuits and modems, assisting with the implementation of new ATMs, ensuring data security and integrity, providing network access, authorization of PIN transactions completed at ATMs, including settlement of related funds. Other services include fraud monitoring of PIN transactions, adjustment and dispute resolution processing to include card blocking, chargeback processing, related research and other similar services.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Maintain bond/liability insurance as appropriate. Maintain and certify compliance with current PCI/DSS. Maintain neural network or other industry standard fraud detection system. Comply with network processing agreements and standards. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, business continuity plans and test results, report on controls at a service organization, and PCI/DSS compliance certification.
Activity Shared Branching Services	Description of Service Providing for the sharing of infrastructure to establish a private, secure, cooperative processing network that accepts transactions from members of participating credit unions. Shared branching functionality includes conducting deposits, account balance inquiries, and check cashing, and requesting funds transfers, official checks, or other similar services.	Activity Conditions Other Conditions: Maintain Business Continuity/Disaster Recovery plan ensuring uninterrupted operations. Comply with the Security Program Requirements – Part 748 to safeguard consumer information. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain and certify compliance with current PCI/DSS network standards or other similar shared network security standard, if applicable. Maintain bond/liability insurance as appropriate. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, business continuity plans and test results, report on controls at a service organization, and PCI/DSS compliance certification, if applicable.

Service Category – Information Technology Services

Service Category – Information Technology Services Approved Activities
Activity	Description of Service	Activity Conditions
Activity Web Development, Hosting, & Content Management	Description of Service Developing and designing non-transaction public web sites, private or internal web sites, and web applications. Web site hosting to include maintaining the servers and html code for public and private web sites, intranets, and Web applications used on customer websites. Offering web content management (WCM) systems to simplify the publication of web content and updates to web sites and mobile devices.	Activity Conditions Other Conditions: Maintain business recovery plan ensuring uninterrupted operations. Maintain bond/liability insurance appropriate for activity. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, business contingency plans & test results.
Activity Web Authentication & Security Monitoring	Description of Service Web security and monitoring services such as authentication and encryption of passwords and other similar techniques for secure member login to intranets, extranets, and private websites; host based intrusion protection and detection; log monitoring; hacker-safe monitoring programs; and configuration and daily administration web security and other similar monitoring services.	Activity Conditions Other Conditions: Comply with the Security Program Requirements - Part 748 of the NCUA Rules and Regulations. Comply with NCUA and FFIEC Guidance for Authentication in an Internet Banking Environment as applicable. Maintain bond/liability insurance appropriate for activity. Adhere to AICPA audit standards for reporting on controls at a service organization. Annually provide OCCU copy of bond/liability insurance, business contingency plans & test results
Activity Software Systems Development / Application Programming Interface (API) Development	Description of Service Designing, coding, testing and updating custom software system data programs and other code (e.g., scripts). Application Programming Interface (API) development includes developing, testing, and updating custom applications which interface with other existing systems and applications such as core processing systems.	Activity Conditions Other Conditions: Comply with the Security Program Requirements - Part 748 of the NCUA Rules and Regulations. Conduct independent code review for custom software systems and applications. Adhere to audit standards for third-party service providers. Maintain source code for custom developed software systems in escrow or in similar arrangement.
Activity Secure Collaboration Services	Description of Service Programs, systems, or sites for establishing secure communication channels for private document storage and distribution, and dissemination of confidential or sensitive information for the purpose of collaboration between authorized parties.	Activity Conditions Other Conditions: Comply with the Security Program Requirements - Part 748 of the NCUA Rules and Regulations.
Activity Information Technology (IT) Consulting and Management Services	Description of Service Consulting and management services for IT infrastructure design and architecture, system security, administration, support, resource management and monitoring. Services include offering Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and planning and management, and the provisioning () of hardware and software for business continuity planning to include online data backup and recovery services. () Providing or supplying the actual IT hardware/software necessary for Business Continuity/Disaster Recovery.	Activity Conditions Other Conditions: Comply with the Security Program Requirements - Part 748 and Records Preservation Program and Records Retention Appendix – Part 749 of the NCUA Rules and Regulations. Maintain bond/liability insurance appropriate for activity. Annually provide OCCU copy of bond/liability insurance, vendor due diligence reports, security program, business contingency plans & test results.

Service Category – Investment/ALM

Service Category – Investment/ALM Approved Activities
Activity	Description of Service	Activity Conditions
Activity Asset Liability Management (ALM) Consulting, Advisory, and Reporting Services	Description of Service Consulting, advisory, and reporting services for balance sheet and interest rate risk management. This includes ALM interest rate risk modeling, measurement, and reporting; ALM model validation services; consulting services for ALM policy development, core deposit studies, lending pool analysis and valuations, and other similar services.	Activity Conditions Other Conditions: None