NCUA officials are defending their decision to forward asupervisory letter on FISto credit unions, noting that it's routine for the agency to sharematerials from other regulators and observing that credit unionswhich process with FIS needed to read the letter.

“It is a longstanding inter-agency practice to share reports, inthis case produced by one of the banking agencies, with clients ofrecord,” said Larry Fazio, Director of Examination and Insurance for theagency.

“The Federal Deposit Insurance Corporation, the Office of theComptroller and the Federal Reserve Bank have all released thisreport, like other vendor reports, to their regulated institutions.NCUA, like the other agencies, is providing the report informationfor the sole purpose of facilitating vendor due diligence,” Faziosaid.

Sources familiar with the agency's actions said officials hadconsidered forwarding the letter “routine” and argued that theagency risked leaving credit unions unwarned if it had not sentit.

The sources, who spoke on background, pointed out that theagency had little choice but to share the letter and would have hadto bear some degree of responsibility had credit unions sufferedlosses from risk of which the agency was aware but credit unionswere not.

The sources also denied as “ridiculous” the idea that the agencywas trying to drive credit unions away from using FIS when itwarned credit unions to evaluate their relationship with theprocessor.

They pointed out that the decision to change payment processorswas large enough and complex enough that neither the agency norcredit unions would be served by large numbers of credit unionsgoing through that process at the same time.

Rather, the officials said the agency hoped that providinginformation to the credit unions would help bring market pressureon the processor to correct the security deficiencies as well asalert credit unions to the risk.