Credit union compliance communications means governing every message your staff exchanges with members, including email, texts, social posts, website content, chat, and calls, so it meets NCUA, CFPB, and GLBA rules. It also means you can produce any of those messages quickly when an examiner, auditor, or court asks for them.
NCUA’s final rule on Part 749 took effect on July 16, 2026, and removed the Appendix A retention guidelines that many credit unions treated as their schedule. Retention decisions now sit with each board, and examiners will expect to see that the board made them.
If you already run archiving for financial services, use this guide to check whether your setup covers every channel your members actually use.
Which Credit Union Compliance Rules Reach Member Communications
No single NCUA rule covers “communications.” Credit union compliance in this area comes from several rules, and each one reaches a different part of what your staff sends and publishes.
| Rule | What it covers | Communications it touches | Evidence to keep |
| NCUA Part 740 | Accuracy of advertising and notice of insured status | Rate ads, social posts, website pages, branch signage | Approved versions of each ad and page, with dates |
| Part 707 (Truth in Savings) | Share account disclosures and dividend advertising | Rate pages, account opening disclosures, member notices | Evidence of compliance for at least two years (707.9(c)) |
| Regulation Z and Regulation E | Lending and electronic fund transfer disclosures | Loan offers, card and EFT notices, error resolution messages | Evidence of compliance for at least two years, longer for some mortgage records |
| UDAAP (Dodd-Frank Act) | Unfair, deceptive, or abusive acts or practices | Anything a member could say misled them, including texts and DMs | Full message history around complaints and disputes |
| GLBA and NCUA Part 748 | Safeguarding member information and cyber incident notice | Any message that carries account numbers, SSNs, or loan data | Logs showing who sent what data, and where |
| NCUA Part 749 | Vital records preservation program | Records the board classifies as vital | A written program, designated staff, and a storage and destruction schedule |
State-chartered credit unions also answer to their state regulator and state law, which can add privacy, advertising, or retention rules on top of this list. The CFPB enforces UDAAP and federal consumer financial law for credit unions with more than $10 billion in assets, and NCUA or the state regulator handles it below that line.
In December 2025, NCUA also proposed removing the official advertising statement in 740.5, and the rule is still listed as a proposal, so keep using the statement until a final rule is published.
If your credit union runs a broker-dealer program through a CUSO or third-party partner, those communications also fall under SEC and FINRA rules.
What NCUA’s 2026 Records Preservation Rule Changed
NCUA’s final rule, published on June 16, 2026, and effective July 16, 2026, removed the Appendix A record retention guidelines and the Appendix B catastrophic act guidance from Part 749. It also simplified the vital records log and spells out that a credit union stays responsible for records kept by outside vendors.
What Part 749 still requires after Appendix A
Appendix A was always a set of suggested guidelines, yet many credit unions followed it as if it were a requirement. NCUA said it had become an obstacle to sound retention, because it led some credit unions to keep unused and obsolete records.
Your board must still keep a written records preservation program with designated staff and a schedule for storing and destroying vital records. Part 749 also says it doesn’t replace retention periods set by other laws, so your periods now come from the rules in the table above, your counsel’s advice, and a schedule your board documents and approves.
Your archive vendor is now part of your exam
Under the current Part 749, a credit union that uses a third-party vendor to keep records must maintain effective oversight of that vendor. You also need the equipment or software that lets an examiner access the records.
In practice, ask your archive vendor for a current SOC 2 Type II report, the region where your data is stored, the export formats it supports, and what it charges to get your data out when the contract ends. Keep those answers in your vendor file, because an examiner can now ask for them.
Where Credit Union Compliance Communications Slip Through the Cracks
Most gaps in credit union compliance communications show up in channels that grew without a policy behind them. Email is usually archived, while texts, social media, website changes, and internal chat often aren’t.
Loan officers and MSRs texting members
Members expect a quick text about a loan payment or a document they need to sign, so loan officers and member service representatives often reply from personal phones over iMessage, WhatsApp, or SMS.
Those messages become evidence the moment a member files a UDAAP complaint or disputes a collection, and a credit union can’t produce texts it never captured.
Jatheon’s text message archiving captures iMessage and WhatsApp natively, with no wrapper app for staff to install, and keeps edited and deleted messages. Carrier SMS and MMS can be captured too, so a member’s texts and emails sit side by side in one search.
Social media posts, comments, and DMs
Rate promotions on Facebook or Instagram are advertising under Part 740, and member complaints often arrive as comments or direct messages. Credit union marketing compliance depends on being able to show what a post said when it went live and whether anyone edited or deleted it later.
Social media archiving from Jatheon captures Facebook, Instagram, and X content, tracks edits and deletions, and exports the version history as PDF or HTML.
Website rate pages and disclosures
Rate pages and disclosures can change every week.
When an examiner or a plaintiff’s lawyer asks what the page said on a specific date, a screenshot folder rarely answers the question. It helps to archive past versions of your website automatically, with full-text search across every capture.
Why a Data Breach Turns Communications Into Evidence
Since Sept. 1, 2023, every federally insured credit union must notify NCUA no later than 72 hours after it reasonably believes a reportable cyber incident occurred, according to NCUA’s cyber incident notification guidance.
After the notice, investigators, outside counsel, and plaintiffs in member class actions will ask who sent member data, to whom, and through which channel. If a compromised mailbox or a staff phone held SSNs or card numbers, you need to know how many members are affected before you can scope the incident or send notices.
A searchable archive lets your team run that search across every channel at once. Searching for patterns that match SSNs, card numbers, and account numbers across email and texts shows where member data actually traveled.
Jatheon recognizes card numbers, SSNs, and phone numbers in search, and it records every search and export in a tamper-proof audit log, so the investigation itself is documented. Pair this with the safeguards in your GLBA compliance checklist, so the archive supports both prevention and response.
How to Build a Credit Union Compliance Communications Program
A working program has six parts, and each one gives an examiner something concrete to review. Use these steps as a checklist for your compliance, IT, and marketing teams.
1. Inventory every channel members and staff use
List every channel that carries member communications, including personal phones used for business, social accounts run by individual branches, marketing agencies that post on your behalf, and internal chat such as Teams.
Note who owns each channel, since that person will answer for it in an exam.
2. Write an approved-channels policy and get staff attestations
State which channels staff may use to contact members, and have every employee sign off once a year. Then check whether staff actually follow the policy, because a policy without monitoring won’t satisfy an examiner.
3. Set retention by record type and get board approval
Build your schedule from the rules that set specific periods, and let the board set the rest. Confirm every period with counsel before the board approves it.
| Record type | Rule | Starting retention |
| Share account disclosures and related communications | Truth in Savings (707.9(c)) | 2 years minimum |
| Loan and credit disclosures | Regulation Z (1026.25) | 2 years minimum, 3 to 5 years for some mortgage records |
| EFT and card disclosures | Regulation E (1005.13) | 2 years minimum |
| BSA records | 31 CFR 1010.430 | 5 years |
| Marketing, social media, chat, and general correspondence | No set federal period | Board-set |
Your data retention policy should document who approved each period and when.
4. Capture every channel into one tamper-proof archive
Immutable storage and full audit logs show that records weren’t changed, which makes them defensible in an exam or in court. Broker-dealers must meet WORM compliance requirements under SEC Rule 17a-4, and credit unions can use the same standard as a benchmark when they choose an archive.
5. Supervise with sampling and lexicons
Review a random sample of messages each month, and add keyword and pattern rules that flag account numbers, rate claims, and words like “guaranteed.”
A documented communication surveillance program shows NCUA compliance in practice, since it proves someone reviews what staff sends. In Jatheon, you can set the sample rate anywhere from 0.001% to 100% and get daily or hourly alerts when a policy is triggered.
6. Rehearse exam and legal production
Run a timed drill in which you find every message with one member over a set date range, place a legal hold on it, and export it in a format counsel can use. If the drill takes days, fix the process before an examiner or your supervisory committee tests it.
What to Look for in Credit Union Compliance Software for Communications
Credit union compliance software for communications falls into two groups. Marketing-review tools check ads and posts before they go out, while archiving and recordkeeping communications compliance tools capture what was actually sent and keep it ready for production. Both have a place, but an examiner or a court will ask for the record, so start your evaluation there.
| Criterion | Why it matters for a credit union | Question to ask the vendor |
| Native iMessage and WhatsApp capture | Loan officers and MSRs text members from their phones | Do staff need a separate app, and are edits and deletions kept? |
| Social and website capture with version history | Rate posts and pages fall under Part 740 and Truth in Savings | Can you show what a page or post said on a given date? |
| Retention by record type, plus legal hold | The board now sets most periods after Part 749 | Can retention differ by channel, user, or tag, and does a hold override it? |
| Immutable storage and audit logs | Proves records weren’t changed | Is every search and export logged? |
| Security certifications and U.S. data residency | Gives the board evidence for vendor oversight under Part 749 | Can we see current SOC 2 Type II and ISO 27001 reports, and which region stores our data? |
| Export formats and exit fees | Counsel needs usable files, and you need to leave without losing records | Which formats and load files do you support, and what does it cost to take all our data out? |
How Jatheon Supports Credit Union Communications Compliance
Jatheon brings email, texts, social media, chat, files, and website captures into one archive, and Unified Search finds every message with a member in a single query.
When an exam or lawsuit starts, Cases and Legal Hold preserve the relevant records and override retention. Exports include PST, EML, PDF, HTML, and CSV, plus RSMF and Relativity load files, with non-destructive redaction for ediscovery and export.
To follow the schedule your board approves, you can create as many retention policies as you need and scope them by channel, user, group, or tag. Records are deleted automatically when they expire unless a legal hold applies, and longer retention doesn’t cost more.
For vendor oversight under Part 749, Jatheon holds SOC 2 Type II and ISO/IEC 27001:2022 certifications and runs on single-tenant AWS with a U.S. region option. It includes a 99.9% monthly uptime SLA and charges no ingestion, migration, or egress fees, so you can review the evidence your board needs and know your exit costs upfront. Jatheon supports Part 749 recordkeeping and GLBA safeguards, while your policies and board decisions remain your own.
Conclusion
The rules that govern member communications are spread across NCUA, the CFPB, and state regulators, and the records they require are the messages your staff sends to members every day. After the Part 749 change, your board’s retention schedule and your oversight of the archive vendor are the first things an examiner will check.
