How to Sell to Credit Unions as a Vendor or Supplier

To sell to credit unions, pick the ones that look like your current clients in NCUA's quarterly data, write to the executive who owns the problem your product solves, and have your vendor due diligence pack ready before the first meeting. Each deal needs two yeses. The executive who wants your product gives one. The risk or vendor management team gives the other.

If many credit unions buy your category as a shared service, a credit union service organization (CUSO) that already delivers it may be the better first door.

Who decides a vendor purchase at a credit union?

The buyer is whoever owns the problem your product solves. A lending platform, a core integration and a member marketing service land on three different desks inside the same credit union.

After years of running outbound for B2B companies, I never build the target from an org chart. I take the vendor's closed credit union deals and ask who made the call on each one. If a chief lending officer drove your last few contracts, that title goes first on the list, whatever the sales deck assumes.

The obvious title is often not the one that signs. In Bank Director's 2025 Technology Survey of 141 US bank leaders, 54% said a management-level team or steering committee gives final approval on technology investments, and 48% said a C-level executive other than the CIO or CTO does.

That sample is banks only. Use it as a warning and confirm who signs at each credit union before you write.

Bare labels like Assistant, Manager or Associate say nothing about what a person approves. I search with the titles credit unions really use and strip those labels out.

At a large credit union, each row is a separate person with a separate budget. If you are unsure whether to go straight to the top executive, weigh the CEO against the department head by who owns the problem.

Take a mid-sized credit union buying a new lending platform as an example. The VP of lending wants it. The CIO checks how it connects to the core. The CFO signs off the budget. Vendor management runs the review. That's 4 people and 4 chances to hear no, so plan a message for each of them.

Decision rule: for each credit union, name the one row whose decision your product needs. If you cannot name it, the account is not ready for outreach.

Which NCUA data should you pull before outreach?

NCUA publishes quarterly call report data collected from all federally insured credit unions. Its hub offers summarized accounts and a list of active federally insured credit unions with membership, assets and loans. It also has a search for one credit union or a group, and a Custom Query tool (NCUA call report data).

That active list also answers how many federally insured credit unions there are right now. NCUA's first-quarter 2026 data, released June 9, 2026, put the count at 4,250, down from 4,411 a year earlier. Total assets in those credit unions reached $2.48 trillion, up $117 billion, or 4.9 percent, over the same year.

So fewer credit unions now hold more money. Treat that count as a snapshot. Download the current file and count the rows.

For list work, use the quarterly data files: ZIP files of comma-delimited text that open in a spreadsheet (NCUA quarterly data).

Sort by total assets first and mark where your current clients sit. Pull the files again every quarter, because the change column is where new prospects show up.

How do you build a credit union prospect list?

Your current credit union clients' asset size, state and lending mix describe your next customer better than any industry report. So I build every list from those clients outward: the credit unions already paying for the product first, then lookalikes.

Each credit union serves a defined field of membership, the group of people it is chartered to serve. Name those members in your message. A pitch written for generic bank customers lands wrong, and the executive reading it notices in one line. Keep one offer for one segment, because a message written for "all financial institutions" speaks to nobody in particular.

Filter in this order:

1. The asset band where your best current clients sit
2. The states you can actually serve and support
3. Field of membership, where it changes what members need
4. Loan growth over the last quarter, if you sell anything tied to lending
5. The core processor (the main banking system the credit union runs on), if you must integrate with it
6. Two or three real buyer titles per credit union

A made-up example: a vendor of a loan decisioning add-on that works with two cores keeps the credit unions in its clients' asset band and supported states whose loan balances rose last quarter. It drops every credit union on a core it cannot integrate with, then adds the chief lending officer and the head of IT at each one that stays.

If the segment that survives these filters is small, decide early whether to work it as named accounts or a broad list.

What does NCUA third-party guidance mean for vendors?

NCUA's letter on evaluating third-party relationships says a credit union stays responsible for safeguarding member assets and ensuring sound operations, whether or not a third party is involved (NCUA). You are that third party.

That tells you what to prepare. The same NCUA letter says audited financial statements or ratings from a nationally recognized statistical rating organization (NRSRO) can be used to check a vendor's financial health.

It also says officials may use independent auditor reports, audit results or regulatory reports to judge your internal controls. The letter dates from 2001, so it names SAS 70 Type II reports, an independent auditor's report on a service provider's controls. Have your current equivalent, today usually a SOC 1 or SOC 2 report, ready before interest turns into a contract.

The letter walks through the whole relationship:

1. Before signing: the credit union assesses credit risk, rate risk, liquidity risk, transaction risk, compliance risk and strategic risk.
2. Due diligence on you: it looks at your organization, finances, model and risk profile, asks your clients for referrals and checks for lawsuits involving you or your principals.
3. In the contract: scope, service level agreements, data security and member confidentiality, plus default, termination and escape clauses.
4. After signing: it measures your performance and receives periodic reports from you.

A companion NCUA letter to credit unions lists what a due diligence review should weigh at a minimum: how critical the service is, the vendor's expertise, staffing changes, economic and regulatory changes, and the risk mitigation tied to vendor oversight. Have a plain answer for each one before the review starts.

This is a summary of NCUA guidance, not legal advice.

Put this pack together before the first demo:

1. A one-page profile of your company, owners and principals
2. Recent financial statements, or the strongest summary you can share
3. Client references willing to take a call, ideally credit unions of similar size
4. A plain statement on any litigation
5. A draft service level agreement
6. A data security and member confidentiality summary
7. Termination terms, including how member data is returned
8. A sample of the periodic report you would send

Treat the risk team as a second buyer. Send the pack early and the review becomes a checklist you already filled in. If you also sell to banks, selling to banks involves a different set of deciders and its own due diligence checks.

When should you sell through a CUSO?

A CUSO is a company that delivers services to credit unions. NCUA notes that a credit union may be a CUSO's sole owner, investor, lender or customer, and that the credit union's risk depends on which role it plays (NCUA).

NCUA keeps a CUSO registry. You can search it by name, city, state, zip code, registry number or services, and export the results to Excel, CSV or PDF (NCUA CUSO data). Search by your service first and see who already delivers it.

Decision rule:

1. Sell direct when one credit union uses your product on its own, the buyer title is clear and the decision sits inside that credit union.
2. Start with a CUSO when many credit unions buy your category as a shared service and the registry shows CUSOs already delivering it. One supplier deal with a CUSO can open the door to many of the credit unions that buy through it.
3. Work both when a CUSO serves the credit unions on your list. Close the commercial deal with the CUSO and drive adoption with each credit union's own team.

The CUSO route does not remove the review. The credit union still answers for the service, so expect the same due diligence pack to be requested.

What should the first outreach message say?

My first message sells the meeting, not the product. Pitch the product in message one and it gets ignored. One email does not close a vendor, because a credit union runs a formal vendor review before it signs anything.

My team opens on LinkedIn and follows with email, so a chief lending officer has already seen your profile when the email lands. A financial advisory firm in Canada, selling to a different buyer but under the same kind of trust check, used this sequence. Month 1 brought 19 booked sales meetings. Month 2 brought 26. Month 3 brought 32.

A plain message sent from a strong profile will beat a perfect one sent by a ghost. We once sent the same message for two clients. One got 2% replies. The other got 7.5%. Same words, nearly 4 times the replies, so I look at who is sending it before I touch the copy.

Plan 5 or 6 touches across both channels. One "buy or die" message to a chief lending officer is a lottery ticket, and nobody on the other side owes you a reply. The third follow-up is usually the one that earns the reply in our campaigns. Leave real time between sends.

A made-up first email, for illustration only, to a chief lending officer at an invented credit union:

Subject: Riverbend's loan growth and your core

Hi Maria, Riverbend's loan balances grew again in the last NCUA quarter. Growth like that tends to put pressure on the lending workflow sitting on your core. Worth 20 minutes next week to compare how yours is holding up? If it goes further, I can send the details your vendor management team will ask for.

How do you qualify a credit union that replies?

Answer four yes or no questions:

1. Matching use case? They have the problem your best clients had.
2. Reachable decision-maker? You are talking to the person whose decision it is, or you can reach them.
3. Manageable risk review? Your pack covers what their vendor management will ask.
4. Reason to talk now? A growth number, a renewal, a new executive or a project makes this quarter different.

Four yes answers: book the call. Three: fix the missing one first, usually by reaching the real decision-maker or finishing your pack. Two or fewer: thank them, log the reply and move on. Move on too if the credit union is too small for your price or has no one in the buyer role.

I set the monthly goal at 50+ conversations started and let the booked calls follow from them. For scale, in our campaigns a reply rate around 1% is normal, closer to 0.5% at thousands of emails a day, and usually 10% to 50% of replies turn into booked meetings. The bigger the volume, the lower they run.

Those are ranges, never a promise.

If your current credit union meetings are not closing, more outreach will only push the closing rate lower. Booking a call and closing a contract are two different things. Fix the call before you add volume.

Win the executive with a message about their members and their numbers. Win the risk team by sending the pack before anyone asks for it.

Preparing to sell to credit unions and not sure your pack or target list holds up? Book a call and we can check both.