Jack Antonini, president/CEO of the National Association of Credit Union Service Organizations, expressed concern that the small steps that the NCUA is taking to increase regulation of CUSOs will lead to even more measures that will further stifle innovation.

"CUSOs are already heavily regulated, their securities activities are regulated by the SEC and their insurance products are regulated by state insurance departments. CUSOs have been formed by credit unions to spread out the risks and limit costs. If they are too heavily regulated, their products will be more expensive and credit unions may go outside the credit union family to buy certain products and services," he said.

John McKechnie, a former NCUA official and CUNA executive who is now a lobbyist, said the proposals are "completely consistent with the approach that all regulators are taking to risk since the financial crisis."

But there are limits to what the agency can do by regulation. And Matz has said the agency will ask Congress for the power to directly examine third-party vendors, including CUSOs.

The agency had the power to examine them in the lead up to Y2K, when there were concerns about computer adaptability, but that authority ended in 2001. Currently, if the agency has a specific concern, it can request access to a CUSO through the credit union that governs it.

On June 16, Matz told the Senate Banking Committee that the NCUA is the only banking regulator that doesn't have the power to examine and regulate third-party rules.

She said this would enable the agency to "properly identify and mitigate risks inherent to, or introduced by, vendor products for federally insured institutions."

In the meantime, the agency is using its existing powers and partnering with others.

According to NAFCU's compliance blog, there are an increased number of NCUA examiners who are asking credit unions with CUSOs if those CUSOs have a business plan, a Bank Secrecy Act risk assessment and  an anti-money laundering program.

The agency's examiners' manual states that credit unions' relationship with CUSOs should be scrutinized for the following types of risks: interest rate, liquidity, reputational, strategic, transactional, credit and compliance.

The NCUA has also been increasing its collaboration with state regulators to detect risks earlier.

NCUA Board Member Gigi Hyland told the NACUSO in April that these efforts provide an "overall picture of systemic risk."

According to NASCUS, 32 states give their regulators the power to examine CUSOs. However, among those states there is considerable diversity in how closely they can and do examine CUSOs.

Alabama examiners can examine the financial viability of CUSOs; Florida allows regulators to examine CUSOs they believe are engaging in unsafe and unsound practices; and Michigan regulators can examine CUSOs based on the risk they present to their parent organization.

Texas has proposed changing its regulations to give the state's credit union commissioner the power to limit or refuse to permit any CUSO activity or service based upon supervisory, legal or safety and soundness reasons.

Texas is acting in part because of the problems of Texans Credit Union.

When the NCUA conserved the $1.6 billion financial institution in April, it determined that the problems were mostly triggered by losses in its business loan portfolio.

According to NCUA Call Report data, the Richardson, Texas-based credit union suffered a net income loss of $20.7 million through its wholly owned commercial lending CUSO, Credit Union Liquidity Services Inc., as of December 2010. More than $15 million in business loans were charged off last year. Another $22 million in participation loans met the same fate. At the end of 2010, the NCUA deemed the credit union "significantly undercapitalized" with a net worth ratio of 2.75%.