SUPPLEMENTARY INFORMATION:

I. Introduction

On October 21, 2025, the Board issued its Notice of Proposed Rulemaking to codify the elimination of reputation risk from its supervisory framework.^[1] Among other things, the proposed rule would also have prohibited the agency from requiring, instructing, or encouraging an institution to close an account, to refrain from providing an account, product, or service, or to modify or terminate any product or service on the basis of a person or entity's political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely on the basis of politically disfavored but lawful business activities perceived to present reputation risk.^[2] The proposed rule further would restrict the NCUA from taking any supervisory action or other adverse action against a credit union, a group of credit unions, or the institution-affiliated parties of any credit union that is designed to punish or discourage an individual or group from engaging in any lawful political, social, cultural, or religious activities, constitutionally protected speech, or, for political reasons, lawful business activities that the agency or its personnel disagree with or disfavor. Interested readers may refer to the proposed rule preamble for a more detailed overview of the background on this rulemaking. The Board is now finalizing the proposal.

II. Legal Authority

The Board is issuing this final rule pursuant to its authority under the Federal Credit Union (FCU) Act. Under the FCU Act, NCUA is the chartering and supervisory authority for FCUs and the federal supervisory authority for federally insured credit unions (FICUs).^[3] The FCU Act grants NCUA a broad mandate to issue regulations governing both FCUs and all FICUs. Section 120 of the FCU Act is a general grant of regulatory authority and authorizes the Board to prescribe rules and regulations for the administration of the FCU Act.^[4] Section 207 of the FCU Act is a specific grant of authority over ( printed page 38271) share insurance coverage, conservatorships, and liquidations.^[5] Section 209 of the FCU Act is a plenary grant of regulatory authority to issue rules and regulations necessary or appropriate to carry out its role as share insurer for all FICUs.^[6] Accordingly, the FCU Act grants the Board broad rulemaking authority to ensure that the federally insured credit union industry and the National Credit Union Share Insurance Fund (Share Insurance Fund) remain safe and sound.

Based on the legal authorities set forth previously, the subjectivity of reputation risk, the limited value of reputational risk at identifying risks to safety and soundness or other statutory mandates, and the potential for distracting examiners and institutions from examining or managing core financial and operational risks, the agency now codifies the removal of reputation risk from its supervisory framework and NCUA's regulations.

III. Notice of Proposed Rulemaking and General Summary of Comments

The notice of proposed rulemaking preceding this rule affirmed the agency's commitment to eliminating subjective considerations from its extensive supervisory framework ^[7] following the issuance of Letter to Credit Unions 25-CU-05 “Elimination of Reputation Risk.^[8] In response, the NCUA received 56 comments from individual FICUs, state and regional credit union organizations, credit union trade organizations, credit union consulting services providers, and individuals.^[9] Approximately 21 of the comments were form letters sharing identical first paragraphs and similar supports to those made in the non-form comment letters agreeing with the Board's decision to remove reputation risk from the NCUA's supervisory program.^[10]

The agency received three comments opposing the NPRM. Two were non-responsive,^[11] while one comment was in direct substantive opposition to the proposed rule, citing extreme weather events, a current consideration for reputation risk, as an early warning system for emerging stress on credit unions.^[12]

The Board believes NCUA's supervisory framework is comprehensive without speculation on whether weather-related risks will create safety and soundness issues. By removing reputation risk as a subjective component of the examination, NCUA is focusing its exams on objective risk factors, like financial indicators and trends and compliance with laws and regulations.^[13] The Board is focused on the availability of existing objective frameworks for operational or transactional risks unrelated to an institution's operational condition and reorienting financial supervision toward measurable realities—credit, liquidity, and earnings risk—rather than speculation surrounding public perception.

On balance, the comments received were largely in favor of the removal of reputation risk from the NCUA's supervisory framework. The Board believes that reputational considerations are inherently subjective and rarely manifest in objective risk. The Board views objective risks as those that, based on objective facts and sound reasoning, have or could result in financial losses, an unsafe or unsound condition, or a violation of a banking or credit union-related law or regulation. Agency policies require examiners to complete exams that are tailored to focus on identifying and addressing those objective material risks.

NCUA is responsible for regulating and supervising all FICUs, including for safety and soundness principles.^[14] In furtherance of these objectives, the agency's supervision should focus on concrete, material risks and more objective criteria directly related to applicable statutory and regulatory requirements. In the agency's experience, using reputation risk in its supervisory process does not further this mission.

Commenters recommended that the Board consider amending proposed 12 CFR 791.22(g) to prohibit supervisory actions motivated by the disagreement or disapproval of any agency official or employee, not merely the views of the assigned supervisor. Proposed paragraph (g) stated that the agency will not “take any supervisory action or other adverse action against an institution, a group of institutions, or the institution-affiliated parties of any institution that is designed to punish or discourage an individual or group from engaging in any lawful political, social, cultural, or religious activities, constitutionally protected speech, or, for political reasons, lawful business activities that the supervisor disagrees with or disfavors.” Some commenters requested that this prohibition be expanded to cover all agency personnel, not just supervisors. Similarly, another commenter suggested that the prohibition should be extended to prohibit any attempt to discourage lawful political or religious activity regardless of what the supervisor thinks about the activity.

The Board did not intend this provision to be read so narrowly as to only cover the views of supervisory staff as compared to the views of other agency staff. In response to the concerns expressed by commenters, and to ensure the agency's standards remain aligned with those of other financial regulators, the NCUA is changing the wording in the final rule to cover lawful political, social, cultural, or religious activities, constitutionally protected speech, or, for political reasons, lawful business activities that are disfavored by the agency or any of its personnel. This wording is to clarify that it does not matter whether the bias comes from the head of the agency or from an individual examiner, the bias is not a permissible basis for agency action.

The Definition of Reputation Risk

The Board proposed to define “reputation risk” as the risk, regardless of how the risk is labeled by the ( printed page 38272) institution or by the agency, that an action or activity, or combination of actions or activities, or lack of actions or activities, of an institution could negatively impact public perception of the institution for reasons unrelated to the current or future financial and operational condition of the institution.^[15] The NCUA received comments on whether the definition of “reputation risk” should include the phrase “operational” in the phrase “for reasons not clearly and directly related to the financial condition of the institution.” Some commenters believed that the phrase could be used to evade the intention of the rule to allow some consideration of reputation risk, while others believe the proposed definition could create supervisory blind spots.

Several commenters recommended that the proposed definition of reputation risk be altered to remove the phrase “for reasons not clearly and directly related to the financial condition of the institution.” However, the agency believes this phrase is necessary to maintain NCUA's ability to address public concerns that directly relate to an institution's financial condition and solvency because those concerns can lead to runs or losses to the Share Insurance Fund. Unlike public concerns about an institution doing business with politically controversial people or entities, concerns about an institution's financial condition have been shown repeatedly to lead to a direct negative impact on the institution that can cause failure.

The Board believes the NCUA's supervisory framework is comprehensive without speculation on event-specific risks creating safety and soundness issues. By removing reputation risk as a subjective component of the examination, NCUA is focusing its exams on objective risk factors, like financial indicators and trends and compliance with laws and regulations. The Board acknowledges that operational risk is a significant concern for institutions. Public perception that a credit union could be susceptible to a breakdown in the provision of services due to operational issues could have a direct impact on members' willingness to do business with a credit union and thus on the institution's financial solvency.

Acknowledging the comments received, and to ensure the agency's standards remain aligned with those of other financial regulators, the Board decided to add “operational” into the final rule such that the definition of “reputation risk” will be “any risk, regardless of how the risk is labeled by the institution or regulators, that an action or activity, or combination of actions or activities, or lack of actions or activities, of an institution could negatively impact public perception of the institution for reasons not clearly and directly related to the financial or operational condition of the institution.”

The Definition of Adverse Action

“Adverse action,” as defined by the proposed rule, included the provision of negative feedback, including written feedback in a report of examination, a document of resolution, oral feedback, or an enforcement action. This definition would only apply to NCUA-initiated adverse actions. NCUA will often jointly examine federally insured, state-chartered credit unions (FISCUs) along with the state regulator. In these instances, the state regulator generally will take the lead in issuing the report of examination and any corrective action. If the state regulator elects to examine for reputation risk, NCUA examiners will not participate in these discussions or enforce any resulting supervisory actions taken by the state regulator. A commenter noted the need for close consultation and coordination with state-regulators in order to minimize the burden to FISCUs and assure mutual understanding of this rule's impact. The NCUA has communicated its prohibition on examining for reputation risk and related concepts both publicly, including with state supervisory authorities, and internally.^[16]

Furthermore, adverse action encompassed any NCUA-led action of any agency employee, including any communication characterized as informal or preliminary. A downgrade (or contribution to a downgrade) of any supervisory rating, including a rating assigned under NCUA's CAMELS ratings system,^[17] also would constitute an “adverse action” under the proposed rule. Further, an approval or denial of a filing, or an imposition of a discretionary supervisory action under prompt corrective action, on the basis of “reputation risk” would constitute an “adverse action” under the proposed rule, except where federal law requires consideration of reputation-related criteria. This includes any burdensome requirements placed on an approval, the introduction of additional approval requirements, or any other heightened requirements or emphasis on an activity or change.

The agency also included a general “catch-all” for any other actions, including approval or denial of applications, waivers, and other agency actions or decisions for any party, that could impact the party. This catch-all is meant to include actions such as decisions on applications for waivers, applications to engage in certain business activities for which supervisory permission is required, or other regulatory decisions affecting institutions. The Board adopts these definitions without change.

The Definitions Regarding Associated Business Relationships

The Board proposed, “doing business with” in the rule to be construed broadly and to include both business relationships with credit union members, accountholders, and with third-party service providers. It is also intended to include the relationship of an institution with organizations or individuals that the institution is providing with charitable donations or services. This term is intended to include both existing business relationships and prospective business relations. It is worth noting that one commenter suggested clarifying that this prohibition applies to Credit Union Service Organizations (CUSOs). The NCUA conducts reviews of CUSOs in accordance with 12 CFR part 712.^[18] The Board believes the expanded definition of reputation risk and prohibitions of 12 CFR 791.22 communicate that the prohibition on the consideration of reputation risk applies to all agency personnel and to the examination of their service providers.^[19] Thus, the intended scope of the rule is broad. However, to avoid doubt, the Board ( printed page 38273) further clarifies that adverse actions against CUSOs on the basis of reputation risk, and examination for or consideration of reputation risk, as defined herein, are all prohibited for all agency personnel and service providers. The term “institution-affiliated party” was proposed to be identical with the definition at 12 U.S.C. 1786(r). Commenters accepted this definition; however, several commented that a distinction should be drawn between using the supervisory process to conclude a reputation risk exists and a supervisor's expectation that a credit union itself evaluates the potential for reputation risk and make informed decisions as to how to manage those risks. One suggested the NCUA continue to affirm credit unions must have the flexibility to enter and exit relationships as their member-owners see fit. The Board affirms that credit unions retain the ability to act as their member-owners see fit, provided the person (or institution-affiliated party) is not prohibited or the action doesn`t otherwise violate a law or regulation, and adopts this definition without change.

Finally, as noted in the proposed rule, regulations codified in 12 CFR part 717 refer to reputation risk concerning certain identity theft prevention programs required by the Fair and Accurate Credit Transactions Act of 2003. However, by statute, guidelines and regulations for these programs must occur jointly across certain federal agencies, so no conforming amendment is being made for 12 CFR part 717 at this time. Any changes will be addressed in a separate, joint rulemaking in the future. Until that separate, joint rulemaking occurs, the NCUA expects to exercise discretion in enforcing 12 CFR part 717 by using agency resources to assess compliance without regard to reputation risk.

IV. Final Rule

The Board believes the prohibitions included in this rulemaking are comprehensive and as specified in this final rule, is making minor modifications to the proposed definitions as referenced in the above summary comment response. This final rule does not impose any additional expectations or requirements on credit unions. This rulemaking establishes an internal agency policy. The Board now publishes this final rule to codify the elimination of reputation risk from the NCUA's supervisory framework, having explained above the regulatory text changes made in consideration of the public input received following publication of the proposal on October 21, 2025.

V. Regulatory Procedures

A. Executive Orders 12866, 13563, and 14192

Pursuant to Executive Order 12866 (“Regulatory Planning and Review”), a determination must be made whether a regulatory action is significant and therefore subject to review by the Office of Information and Regulatory Affairs (OIRA), within the Office of Management and Budget (OMB) in accordance with the requirements of the Executive Order.^[20] Executive Order 13563 (“Improving Regulation and Regulatory Review”) supplements and reaffirms the principles, structures, and definitions governing contemporary regulatory review established in Executive Order 12866.^[21]

Expected Effects

As previously discussed, to improve the efficiency and effectiveness of the supervisory framework, the NCUA is establishing a regulation codifying the removal of reputation risk from its examination and supervision programs.

NCUA Regulated Entities Affected by the Rule

NCUA currently supervises 2,740 FCUs and 1,630 federally insured, state-chartered credit unions (collectively referred to as FICUs). (16) Because all FICUs are subject to supervision by NCUA, this rule affects all 4,370 institutions.

Other Parties Affected by the Rule

Because the rule aims to remove the influence of the agency's reputation risk assessments on institutions' member and business relationships, NCUA concludes that the rule will potentially affect all FICUs' current and future members and business partners. It will also affect any other institutions over which the NCUA has or may be granted supervisory authority.

Current Legal and Regulatory Baselines

On September 25, 2025, the NCUA issued Letter to Credit Unions 25-CU-05 wherein the agency notified supervised institutions that it was ceasing to use reputation risk in the examination and supervisory process.^[22] The NCUA also sent a memo to staff on that same day, instructing staff that they may no longer base supervisory concerns on reputation risk. NCUA employees were notified that they may not refer to or engage in discussions about reputation risk or similar concepts as part of examinations and supervision contacts or other regulatory or supervisory actions (such as waivers, application decisions, or enforcement actions) for a credit union or credit union service organization. The agency is in the process of removing reputation risk from its regulations, policies, manuals, and training materials. Therefore, the NCUA has already discontinued the use of reputation risk in its supervision program as of September 25, 2025.

This final rule creates a formal, legal mandate to remove reputation risk from NCUA's supervision framework. Effectively, there is no additional burden, and therefore no associated compliance costs.

Costs and Benefits

This regulation prohibiting the use of reputation risk in the examination and supervision program removes uncertainty and the potential for misuse, which inherently benefits FICUs. The removal of reputation risk ensures greater consistency and objectivity in supervisory decisions, increasing the predictability for regulated institutions to understand and manage regulators' supervisory expectations. The rule further benefits credit unions and their members by formally eliminating actual or perceived reputation risk-related regulatory restrictions and constraints on member services that would otherwise be permissible.

Other than the inherent benefits described above, the NCUA cannot quantify the number of institutions, or the associated costs, where an institution was criticized for activities because of reputation risk. Nor does the NCUA have the information necessary to quantify the number of institutions that might make changes to their operations based on this change.

Significance

This final rule was drafted and reviewed in accordance with Executive Order 12866 and Executive Order 13563. OIRA, within the Office of Management and Budget (OMB), has determined that this final rule is a “significant regulatory action” as defined by section 3(f) of Executive Order 12866. Executive Order 14192 (“Unleashing Prosperity Through Deregulation”) requires that any new incremental costs associated with new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least 10 ( printed page 38274) prior regulations.^[23] This final rule is considered a deregulatory action under Executive Order 14192.

B. Regulatory Flexibility Act

The Regulatory Flexibility Act ^[24] generally requires an agency to conduct a regulatory flexibility analysis of any rule subject to notice and comment rulemaking requirements, unless the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities. If the agency makes such a certification, it shall publish the certification at the time of publication of either the proposed rule or the final rule, along with a statement providing the factual basis for such certification.^[25] For purposes of this analysis, NCUA considers small credit unions to be those having under $100 million in assets.^[26] The Board fully considered the potential economic impacts of the regulatory amendments on small credit unions. This final rule creates a formal, legal mandate to remove reputation risk from NCUA's supervision framework. Effectively, there is no additional burden, and therefore no associated compliance costs. Accordingly, NCUA certifies the final rule will not have a significant economic impact on a substantial number of small credit unions.

C. Paperwork Reduction Act

The Paperwork Reduction Act of 1995 (PRA) generally provides that an agency may not conduct or sponsor, and not withstanding any other provision of law, a person is not required to respond to a collection of information, unless it displays a currently valid OMB control number. The PRA applies to rulemaking in which an agency creates a new or amends existing information collection requirements. For purposes of the PRA, an information collection requirement may take the form of a reporting, recordkeeping, or a third-party disclosure requirement. As stated in the proposal, the NCUA determined this rule does not create any information collection or revise any existing collection of information and invited comment on any PRA implications. Having not received public comments to indicate otherwise, NCUA maintains that there are no OMB Control Numbers that exist or require revision with respect to this final rule that amends the Code of Federal Regulations.

D. Executive Order 13132 on Federalism

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests.^[27] NCUA, an agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the executive order to adhere to fundamental federalism principles. This rule will affect how NCUA examiners cite or use certain risks in the supervisory process, including for federally insured, state-chartered credit unions. But the rule will not constrain how state regulators apply these same concepts or otherwise change the relationship between NCUA and the state regulators. The rulemaking will therefore not have direct effect on the states, the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government.

E. Assessment of Federal Regulations and Policies on Families

NCUA has determined that this final rule will not affect family well-being within the meaning of Section 654 of the Treasury and General Government Appropriations Act, 1999.^[28] While the changes in NCUA's supervision of institutions could expand access to services, the effect would be indirect and not easily quantifiable.

F. Congressional Review Act

Subtitle E of the Small Business Regulatory Enforcement Fairness Act of 1996, also known as the Congressional Review Act (CRA) generally provides for congressional review of agency rules.^[29] NCUA must submit a report to Congress and the Comptroller General when it issues a final rule, as defined by the CRA.^[30] An agency rule, in addition to being subject to congressional oversight, may also be subject to a delayed effective date if the rule is a “major rule.” The Office of Information and Regulatory Affairs (OIRA), within the Office of Management and Budget (OMB), has determined that this rule is not a “major rule” within the meaning of the relevant sections of the CRA. Specifically, the rule will not (i) have an aggregate economic impact greater than or equal to $100 million, (ii) produce an increase in prices/costs for consumers or other industry stakeholders/regulators, or (iii) adversely affect domestic competition or the ability of U.S. enterprises to compete in foreign markets. NCUA also will file appropriate reports with Congress and the Comptroller General so this rule may be reviewed.

For the reasons stated in the preamble, the NCUA Board amends 12 CFR parts 702 and 791 as follows: