NCUA's 72-Hour Rule: Is Your Credit Union Ready to Make the Call?

A federally insured credit union must notify NCUA as soon as possible and no later than 72 hours after it reasonably believes it has experienced a reportable cyber incident, under 12 CFR 748 (NCUA). The notice is an early alert, not a full assessment. The credit unions that struggle are the ones that have not decided in advance who makes the call.

The rule has been in effect since September 1, 2023 (NCUA), and it is getting used. From May 1, 2025 through April 30, 2026, credit unions reported 588 cyber incidents to NCUA, including ATM jackpotting, phishing, email compromise, ransomware, and third-party provider incidents. Business email compromise reports rose to 40 from 27 the prior year (NCUA 2026 Cybersecurity and Credit Union System Resilience Report).

What starts the clock

The clock starts when the credit union reasonably believes a reportable cyber incident has occurred, not when the investigation finishes. NCUA's letter on the rule describes reportable incidents as those that lead to a substantial loss of confidentiality, integrity, or availability of a network or member information system, a disruption of vital member services, or a disruption of operations, including incidents at a third-party provider (NCUA).

That third-party piece is the one that catches people. If your core processor, online banking provider, or managed IT vendor has an incident that disrupts your members, it can be your reportable incident. Your contracts should require vendors to tell you fast enough to meet your 72 hours. Our post on vendor breach notification clauses covers the language.

How to notify

NCUA offers three channels (NCUA):

• The secure online Cyber Incident Report
• Phone: 1.833.CYBERCU (1.833.292.3728), leaving a voicemail if needed
• Secure email to cybercu@ncua.gov through NCUA's Secure Email Message Center

Provide, if known: the reporter's name and title, a callback number, the charter number without leading zeros, the credit union's name, when the incident is believed to have occurred, and a general description of affected services, whether member information was compromised, and the operational impact.

Do not include sensitive personal information, indicators of compromise, specific vulnerabilities, or attachments in the initial notice (NCUA).

Build the decision before you need it

1. Name the decision-maker and a backup who can declare an incident reportable, at any hour.
2. Write a one-page triage guide that maps common scenarios, such as BEC, ransomware, a vendor outage, or ATM jackpotting, to reportable or not, with examples.
3. Pre-fill the notice. Keep charter number, contacts, and callback numbers in the incident response plan.
4. Get 24/7 detection. Seventy-two hours from awareness only helps if you become aware quickly. Weekend detection is where small credit unions are weakest, which is why many use a managed SOC.
5. Test it. Run a tabletop where the incident starts Friday night at a vendor.
6. Remember other clocks. State breach notification laws, card brand rules, and cyber insurance policies all have their own timelines.

What examiners are watching

NCUA's 2026 report highlights AI-enabled attacks, ransomware, state-sponsored activity, and third-party risk, and notes that the ACET was updated to incorporate NIST CSF 2.0 in September 2025 (NCUA). Expect exam conversations to cover incident response readiness and vendor oversight together. We cover the threat side in credit unions in the crosshairs, and the credit union exam readiness checklist covers the evidence.

Cyberuptive supports credit unions with 24/7 monitoring and incident response that is built around the 72-hour rule. See our financial services practice.

Frequently asked questions

How long do credit unions have to report a cyber incident to NCUA?

As soon as possible and no later than 72 hours after the credit union reasonably believes it has experienced a reportable cyber incident, under 12 CFR 748.

How do I report a cyber incident to NCUA?

Use NCUA's secure online Cyber Incident Report, call 1.833.CYBERCU (1.833.292.3728), or send a secure email to cybercu@ncua.gov through NCUA's Secure Email Message Center.

What should not be included in the initial NCUA notice?

Sensitive personally identifiable information, indicators of compromise, specific vulnerabilities, and email attachments.

Do vendor incidents count under NCUA's rule?

They can. NCUA's guidance includes disruptions caused by third-party service providers, so an incident at a core processor or IT vendor that disrupts the credit union may be reportable.

How many cyber incidents did credit unions report to NCUA?

588 between May 1, 2025 and April 30, 2026, including 40 business email compromise incidents, up from 27 the prior period.