As part of Invela\u2019s broader effort to encourage greater collaboration among regulators to align open finance and risk management, Invela submitted a formal comment letter responding to the NCUA\u2019s proposed updates to its Guidelines for Safeguarding Member Information and its Guidance on Response Programs for Unauthorized Access. The proposals acknowledge something practitioners have known for years: the line between regulatory obligations and non\u2011binding guidance has become blurred – and that blur has consequences.<\/p>\n\n\n\n
The problem: TPRM is being misapplied to open finance<\/strong><\/p>\n\n\n\n Third\u2011party risk management (TPRM) is essential to a safe financial system. But when TPRM frameworks designed for vendor relationships are applied wholesale to open finance data access, the result is predictable: confusion, friction, and unnecessary barriers to innovation.<\/p>\n\n\n\n We\u2019ve seen this firsthand. Invela\u2019s team has spent decades building fintechs, navigating supervisory expectations, and helping institutions unlock consumer\u2011permissioned data. The mismatch between TPRM and open finance is persistent – and avoidable.<\/p>\n\n\n\n Last year, we published a white paper outlining this issue. And in January, we submitted a comment letter to the OCC urging regulators to formally distinguish between TPRM and open finance risk management. Invela echoed that call in our letter responding to the NCUA\u2019s recent proposal, and will continue to encourage interagency collaboration to promote open finance innovation with appropriate risk management.<\/p>\n\n\n\n The fix: regulators should align – publicly and explicitly<\/strong><\/p>\n\n\n\n The NCUA rightly notes that guidance is not regulation. That distinction matters, especially when statutory obligations like Section 1033 of the Dodd\u2011Frank Act require institutions to enable consumer\u2011directed data access.<\/p>\n\n\n\n To avoid conflicting interpretations, prudential regulators and the CFPB should issue a unified interagency statement clarifying:<\/p>\n\n\n\n The OCC\u2019s 2020\u201110 FAQs – particularly FAQ 4 – offer a strong foundation. The 2019 Interagency Statement on Alternative Data shows how coordinated guidance can unlock innovation. It\u2019s time for a similar moment for open finance.<\/p>\n\n\n\n The bottom line<\/strong><\/p>\n\n\n\n Open finance is accelerating. Institutions want clarity. Consumers expect access. And regulators have an opportunity to modernize the supervisory framework in a way that supports innovation while maintaining safety and soundness.<\/p>\n\n\n\n Invela welcomes the NCUA\u2019s leadership and looks forward to continued engagement as the agency considers next steps.<\/p>\n\n\n\n\n