Do you want to know a secret? Roughly three in 10 small creditunions do not maintain their core systems in-house, instead using“hosted” or “service bureau” solutions where the core is in factmaintained off-premises by a third-party vendor.

According to numbers provided to Credit Union Times byCallahan and Associates, 2,272 credit unions presently have hostedcores.

In institutions with under $20 million, 777 have hosted cores.There are 3,313 institutions in that asset category. Of the 208credit unions with assets over $1 billion, nine have hosted cores.“For smaller credit unions, a hosted core is where most will windup,” said David Gibbard, an executive with Birmingham, Ala., core providerEPL. 

“The primary reason is because an in-house solution requires ateam of IT professionals. The smaller credit unions have less moneyso they cannot afford that expenditure and, therefore, they embracea hosted core,” Gibbard added.

They also save money, said Gibbard. “I estimate that an in-housecredit union could reduce between 25% to 50% of their IT budgetwith a hosted solution.”

But the question is, will shifting to a hosted core hurt? Willit stymie a credit union's ability to protect its data and serveits members?

Delaware State Police Federal Credit Union, a $122million institution based in Georgetown, in July 2011 shifted to ahosted version of the same Symitar core, Episys, that it had beenrunning in-house.

“We thought we would never go to an online solution” saidBlanche Jackson, an executive vice president. But the credit unionhad been on Episys since 2000, and the hardware needed substantialupgrades. “We were looking at large expenses. Going hostedeliminated the need to buy that new equipment, saving us easily$100,000 to $200,000,” said Jackson.

As for running monthly costs, that's about the same, saidJackson. But she also indicated that the credit union now gets­services, she pointed to disaster recovery as a for instance, thatit wanted but couldn't afford. Now it can afford such upgrades or,as with disaster recovery, it is included with the hostedservice.

“Our biggest issue with the conversion was fear,” said Jackson.But in the end, “if we hadn't told the staff we were doing it, theynever would have known.”

“We did not tell our members. The change had no impact on them,”she added. “We converted over a weekend. We had no down time.”

Many processes got simpler with the move to a hosted core. ACHand share-draft processing, for instance, had been done in-house.Now the host handles those chores for the institution. A lot of ITdrudgery, applying patches and quick fixes, also stopped, as thatwork got outsourced to Symitar.

Delaware State Police FCU elected to keep its IT staff countunchanged. Said Jackson: “We moved them around. One is managing thecall center. We could put more bodies into services that touch themember.”

At least some experts believe Delaware State Police FederalCredit Union may be a trailblazer. And it won't be alone.

Theresa Benavidez, president of Corelation, which has three clientsrunning on a hosted version, said, “Security threats will forcemany credit unions to go hosted.”

That is, in an environment where savvy IT staff has to work 24/7to keep pace with ever inventive cybercriminals, the onlydependable solution for many institutions will be to outsource thecore to a company that can invest in the security that isrequired.

The other factor that may prod more credit unions to embracehosted cores is pressure from regulators, said Scott Hodgins, a core expert with Cornerstone Advisors. He explainedthat banks have been quicker to rush into hosted cores, in partbecause of regulator pressures.

“Credit unions have not had the regulatory scrutiny that bankshave. They are pushing the risk onto the vendor. The regulatorshave not put pressure on the credit unions,” Hodgins said. Werethat to change, suggested Hodgins, the stampede into hostedsolutions would be on.

Kirk Drake, CEO of Maryland CUSO Ongoing Operations, is still moreoptimistic. Over the next 10 years, he said, there will be a steadymarch into hosted cores as credit unions. especially those below$500 million in assets, struggle to cope with mounting security andregulatory issues. “They are already feeling a lot of pressure,”said Drake, and his strong belief is that many will decide theirshrewdest move is to turn a growing number of IT services,including the core, over to third-party hosts. “We believe hostedsolutions will be huge,” said Drake. “It will get much bigger,sooner, than many now expect.”