# Selling to Credit Unions: What 4,299 Call Reports Show

*Financial Services · Updated 2026-10-09T13:00:00+01:00 · 11 min read*

**There are 4,299 US credit unions, but the market is far more concentrated than the count suggests. 479 of them (11%) hold $1 billion or more in assets and between them carry 79% of all credit union assets and 76% of members, while 2,479 (58%) are under $100 million, with a median of 5 staff and 3% of assets. Sell to the top two bands as accounts with a buying committee, reach the 1,061 credit unions between $100 million and $500 million directly through the chief executive or the senior manager who owns the problem, and reach the smallest through the networks and service organisations they already buy from. Expect a filter before a person: 34% of credit union email domains sit behind a security gateway, rising to 52% between $1 billion and $10 billion.**

Selling software to credit unions starts with one fact most vendors miss. There are 4,299 credit unions in the United States, but 479 of them hold 79% of the assets, and more than half are so small that a typical one has 5 staff and one branch. A credit union is also a member-owned cooperative, examined by the NCUA or a state regulator, that buys much of its technology through shared networks and service organisations rather than alone. So the answer to how to sell to credit unions is different at each size: the same product needs a buying committee approach at a $3 billion credit union, a direct conversation with the chief executive at a $200 million one, and a network or partner route at a $40 million one.

This guide uses Provena's analysis of the NCUA call report data for June 2026, which covers every credit union that files a call report, 4,299 institutions with 147.4 million members and $2.52 trillion in assets, together with our [bank and credit union email census](/blog/bank-credit-union-email-census), which resolved the mail records of every credit union website domain in October 2026. All figures are aggregates; no individual credit union is named.

## How many credit unions are there to sell to, and where is the money?

4,299 credit unions filed the June 2026 call report. Counted by institution, the market is dominated by small ones: 2,479 (58%) hold under $100 million in assets. Counted by assets or members, it is dominated by large ones: the 479 credit unions at $1 billion and over hold 79% of assets and 76% of members, while the 2,479 under $100 million hold 3% of assets. A vendor whose price depends on members, accounts or loan volume should size its market in assets and members, not in logos.

| Total assets | Credit unions | Share of assets | Share of members | Median members | Median staff (FTE) | Median branches |
| --- | --- | --- | --- | --- | --- | --- |
| Under $100M | 2,479 | 3% | 4% | 1,916 | 5 | 1 |
| $100M to $500M | 1,061 | 10% | 11% | 13,230 | 40 | 4 |
| $500M to $1B | 280 | 8% | 8% | 41,964 | 126 | 8 |
| $1B and over | 479 | 79% | 76% | 121,815 | 330 | 18 |

*US credit unions by asset band, NCUA call report data, June 2026. Staff counts full-time employees plus half of part-time employees.*

The band between $100 million and $500 million is where the count and the money meet: 1,061 credit unions with a median of 13,230 members and 40 staff. They are large enough to buy software on its merits and small enough that the person you reach is usually the person who decides.

## Who makes the buying decision at a credit union?

Size decides who signs. The median credit union under $100 million in assets runs on 5 full-time-equivalent staff, so the chief executive is usually also the person responsible for compliance, technology and vendor contracts. Between $100 million and $500 million the median is 40 staff, with a chief executive and two or three senior managers who each cover several functions. Between $500 million and $1 billion it is 126, and at $1 billion and over 330, which is where you meet a full executive team, a chief information officer, an information security officer and a vendor management process that runs every new supplier through due diligence before a contract.

Two features of the credit union model change the sale at every size. Credit unions are owned by their members and governed by a volunteer board, so a vendor's case has to be framed around member outcomes (service, loan access, fees, fraud losses) rather than shareholder return. And credit union leaders talk to each other openly through leagues, networks and conferences, so a reference from a credit union of similar size and charter carries more weight than in most markets.

| Total assets | Credit unions | Typical size | Who usually decides | How to reach them |
| --- | --- | --- | --- | --- |
| $1B and over | 479 | 330 staff, 18 branches | Executive team with a CIO or CTO, an information security officer and a formal vendor management process | Account based, several contacts per institution, references from peers of the same size |
| $500M to $1B | 280 | 126 staff, 8 branches | Chief executive plus chief financial, operating and lending officers; IT is a small team | Direct to the function head, with the chief executive informed |
| $100M to $500M | 1,061 | 40 staff, 4 branches | Chief executive and two or three senior managers who each own several functions | Direct to the chief executive or the senior manager who owns the problem |
| Under $100M | 2,479 | 5 staff, 1 branch | The chief executive, often also the compliance and technology decision maker | Through leagues, networks and service organisations, or a self-serve offer |

*Buying structure by credit union size. Credit union counts and medians from NCUA June 2026 data; the decision maker and route columns are Provena's editorial guidance, not NCUA data.*

## Which credit unions already run the digital services your product plugs into?

Self-reported service data in the call report shows where digital products have a base to build on. 85% of credit unions offer online banking, 77% a mobile app and 72% person-to-person payments. The gap is at the small end: 61% of credit unions under $100 million offer a mobile app, against 98% between $100 million and $500 million and 99% at $1 billion and over. For a digital banking, payments or member experience vendor, the 957 small credit unions without an app are either a greenfield market or a sign that the budget is not there, and a discovery call should find out which.

| Total assets | Online banking | Mobile app | Person-to-person payments | Shared branching | Surcharge-free ATM network |
| --- | --- | --- | --- | --- | --- |
| Under $100M | 74% | 61% | 58% | 20% | 49% |
| $100M to $500M | 100% | 98% | 89% | 53% | 86% |
| $500M to $1B | 100% | 100% | 89% | 58% | 92% |
| $1B and over | 100% | 99% | 94% | 58% | 91% |

*Share of credit unions reporting each service, NCUA call report data, June 2026*

## How much do credit unions lend through car dealers?

Indirect lending is a loan written at a third party, most often a car dealer's finance office, and funded by the credit union. At 30 June 2026, 1,767 credit unions (41%) held indirect new and used vehicle loans: 17.3 million loans worth $270 billion, which is 78% of all indirect lending and 15% of every loan and lease credit unions hold. The share of credit unions lending through dealers rises from 16% under $100 million to 67% between $100 million and $500 million and 90% at $1 billion and over.

| Total assets | Credit unions | Hold indirect vehicle loans | Indirect vehicle loans | Amount outstanding | Share of all loans |
| --- | --- | --- | --- | --- | --- |
| Under $100M | 2,479 | 16% | 1,202,152 | $2.0B | 5% |
| $100M to $500M | 1,061 | 67% | 3,371,070 | $21.9B | 14% |
| $500M to $1B | 280 | 81% | 1,508,620 | $22.5B | 16% |
| $1B and over | 479 | 90% | 11,231,226 | $223.8B | 16% |

*Indirect new and used vehicle loans by credit union asset band, outstanding at 30 June 2026, NCUA call report data*

For software companies this cuts two ways. A vendor selling to dealerships, such as F&I, desking or digital retailing software, has credit unions as a second buyer group with the same deals flowing through both. And a vendor selling loan origination, decisioning or collections software to credit unions should ask early how much of the target's book comes through dealers, because the lending team at a credit union with a large indirect book will judge the product on dealer turnaround time. Provena's [automotive SaaS lead generation guide](/blog/automotive-saas-lead-generation) covers the dealer side of that market.

## How do credit unions share infrastructure and buy through networks?

Credit unions cooperate on infrastructure that banks usually buy alone. 35% of credit unions take part in a shared branching network, which lets members of one credit union transact at another's branches, and 66% belong to a surcharge-free ATM network. When they name the network, CO-OP dominates: 937 name it for shared branching and 1,069 for ATMs, followed for ATMs by Allpoint (363), Alliance One (240) and MoneyPass (227). [Velera](https://www.velera.com/), which offers shared branch and ATM network services to credit unions, is named by 119 for shared branching and 109 for ATMs.

The same cooperative habit extends to technology buying. Credit unions own and use credit union service organisations (CUSOs) for lending, payments, technology and back office work, and state leagues run their own service companies. For a vendor, a partnership with one network, league or service organisation can put a product in front of hundreds of credit unions at once, and for the smallest credit unions it is often the only route that pays for itself. Map which networks and service organisations your best accounts already use before you build a direct list.

## What does vendor due diligence look like at a credit union?

Expect diligence before a contract, scaled to how critical the service is. The NCUA's letter [Evaluating Third Party Relationships](https://ncua.gov/regulation-supervision/letters-credit-unions-other-guidance/evaluating-third-party-relationships) (07-CU-13) gives examiners a standard framework for reviewing third party relationships and says the planning, due diligence and controls required depend on the credit union's risk profile and the type of relationship. At a minimum, it says, the review should consider the critical nature of the service, the vendor's expertise, staffing changes, economic and regulatory changes, and risk mitigation. Electronic services such as data processing, internet banking, credit cards and bill pay are among the relationships it names.

In practice a credit union will ask for financial statements, security testing and certifications, business continuity and incident response plans, data handling and subcontractor details, insurance and references. Larger credit unions run this through a vendor management function; at a small credit union the chief executive may do it personally, with help from the league or an outside examiner-facing consultant. Have the evidence ready before the first meeting, because a small credit union cannot afford a long review and a large one will not start without it. The [guide to selling fintech to financial institutions](/blog/how-to-sell-fintech-to-financial-institutions) sets out the full assurance pack and how to run a contained pilot.

## Can you cold email credit unions, and what happens to the email?

Business email to credit union staff is legal in the United States when it follows CAN-SPAM, and the [FTC's compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) is explicit that the law makes no exception for business-to-business email: identify yourself, do not mislead, and honour opt-outs. The practical constraint is the filter. Of 3,590 credit union domains that receive mail, 34% route it through a dedicated email security gateway and 46% point straight at Microsoft 365. The most common gateways at credit unions are Proofpoint (33% of them), Barracuda (22%) and Mimecast (18%).

| Total assets | Domains | Security gateway | Microsoft 365 direct | Publish DMARC | Enforce DMARC |
| --- | --- | --- | --- | --- | --- |
| Under $100M | 1,826 | 23% | 47% | 64% | 30% |
| $100M to $500M | 1,028 | 40% | 48% | 92% | 55% |
| $500M to $1B | 274 | 56% | 38% | 97% | 70% |
| $1B to $10B | 438 | 52% | 42% | 98% | 78% |

*Receiving mail provider and DMARC for credit union website domains, October 2026. Source: Provena bank and credit union email census.*

Filtering rises with size. 23% of credit unions under $100 million sit behind a gateway and 30% enforce DMARC; between $1 billion and $10 billion the figures are 52% and 78%. So the credit unions with the largest budgets are also the hardest to reach by email, and the ones easiest to reach have the least to spend. Classify the list by receiving gateway before the first send, authenticate your own sending domain with SPF, DKIM and an enforced DMARC policy, keep the first message plain and short, and use phone, events and referrals alongside email for the largest accounts. The full tables, by charter and state, are in the [email census](/blog/bank-credit-union-email-census).

## Which credit unions should a software company target first?

Start with the band your product fits, not the whole list. A product priced on members or loan volume earns most from the 479 credit unions at $1 billion and over, but each of those is a long, multi-person sale. The 1,061 credit unions between $100 million and $500 million are the strongest direct-sales segment for most vendors: almost all already run online and mobile banking (100% and 98%), 67% lend through car dealers, they have 40 staff, and the chief executive still takes vendor meetings. The 2,479 under $100 million are best reached through partners.

Then narrow by what the product needs. A lending product needs a lending book (indirect vehicle loans are 5% of all loans under $100 million and 14% to 16% above it). A digital product needs a digital base. A security, fraud or compliance product has its clearest need where DMARC is weakest: only 64% of credit unions under $100 million publish DMARC at all, and 30% enforce it. Charter matters too: state-chartered, federally insured credit unions have a median of 7,260 members against 3,873 for federal charters, and they are supervised by a state regulator as well as the NCUA.

## How should the first message to a credit union read?

Write it to one person at one size of credit union. Name the member outcome the product changes, in the credit union's own terms (members served, loans funded, losses avoided, staff hours saved), and give one piece of proof from a credit union of similar size. Leave out attachments, tracking-heavy links and claims you cannot document, because the reader will forward anything promising to a colleague who checks it. Ask one question that is easy to answer, such as whether the problem is on this year's plan. For the smallest credit unions, say how little of their staff's time the product takes, because time is the scarcest thing they have.

## How Provena helps software companies sell to credit unions

Provena builds lead generation for software companies selling into specific markets, including financial institutions. For a credit union list that means segmenting by asset band, charter, digital services and receiving mail gateway before anything is sent, writing to the person who decides at each size, and routing the largest accounts to multi-contact and phone sequences. See [how Provena runs SaaS lead generation](/solutions/saas-lead-generation), compare other options in the [fintech and financial services lead generation agency comparison](/blog/best-fintech-lead-generation-agencies), or read published results, with their limits, in the [case study library](/case-studies).

## How was the credit union market measured?

Credit union data comes from the [NCUA quarterly call report data](https://www.ncua.gov/analysis/credit-union-corporate-call-report-data/quarterly-data) for the quarter ending 30 June 2026: 4,299 credit unions, with total assets (account 010), current members (083), total loans and leases (025B), full-time and part-time employees (564A and 564B, counted as full-time plus half of part-time), branches (566), outstanding indirect loans (617A and 618A), indirect new and used vehicle loans (IN0001 and IN0002) and the yes or no service fields for online banking, mobile application, person-to-person payments, shared branching and surcharge-free ATM networks. Network names are free text in the filing and were grouped by name (for example CO OP, COOP and CO-OP Shared Branching count as CO-OP). Officer and contact name fields were not read. The call report's credit union service organisation name fields are blank in the public June 2026 file, so service organisation membership is not measured here.

Limits: service fields are self-reported by each credit union and say whether a service is offered, not how many members use it or which vendor provides it. Indirect vehicle loans are the call report's own category for new and used vehicle loans written through a third party; it does not name the dealer. Email figures come from the separate email census, which measured each credit union's website domain on 7 October 2026 and excludes domains that do not receive mail. The decision maker and route guidance in the buying structure table is Provena's editorial judgement from selling into financial institutions, not NCUA data. The aggregate tables are available to download below.

## Sources for the credit union data

[NCUA credit union and corporate call report data](https://www.ncua.gov/analysis/credit-union-corporate-call-report-data/quarterly-data); [NCUA Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships](https://ncua.gov/regulation-supervision/letters-credit-unions-other-guidance/evaluating-third-party-relationships); [FTC CAN-SPAM Act compliance guide for business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business); [Velera](https://www.velera.com/). Companion study: [the US bank and credit union email census](https://www.provena-ai.com/blog/bank-credit-union-email-census). More studies and guides for this market are in the [financial services library](/blog/category/financial-services) and the [research hub](/research).

## Frequently asked questions

### How many credit unions are there in the US?

4,299 credit unions filed the NCUA call report for June 2026, with 147.4 million members and $2.52 trillion in assets. 479 of them hold $1 billion or more and carry 79% of the assets; 2,479 are under $100 million.

### Who is the decision maker at a credit union?

It depends on size. At a credit union under $100 million in assets, with a median of 5 staff, the chief executive usually decides. Between $100 million and $500 million it is the chief executive or the senior manager who owns the problem. At $1 billion and over, with a median of 330 staff, expect an executive team, an information security officer and a formal vendor management review.

### How do you sell software to credit unions?

Segment by asset band first, frame the product around member outcomes, prepare the due diligence evidence the NCUA expects credit unions to review, use references from credit unions of similar size, and reach the smallest credit unions through leagues, networks and service organisations rather than direct sales.

### Do credit unions lend through car dealers?

Yes. 1,767 credit unions (41%) held indirect new and used vehicle loans at 30 June 2026, 17.3 million loans worth $270 billion, rising to 90% of credit unions at $1 billion in assets and over. Vehicle loans are 78% of all indirect lending.

### Can you cold email credit unions?

Yes, business email to credit union staff is legal under CAN-SPAM when it identifies the sender, is not deceptive and honours opt-outs. But 34% of credit union email domains sit behind a security gateway, rising to 52% between $1 billion and $10 billion, so authenticated sending, a verified list and a plain first message matter.

## Sources

- [NCUA credit union and corporate call report data](https://www.ncua.gov/analysis/credit-union-corporate-call-report-data/quarterly-data)
- [NCUA Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships](https://ncua.gov/regulation-supervision/letters-credit-unions-other-guidance/evaluating-third-party-relationships)
- [FTC CAN-SPAM Act compliance guide for business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)
- [Velera](https://www.velera.com/)
- [the US bank and credit union email census](https://www.provena-ai.com/blog/bank-credit-union-email-census)

---
Source: https://www.provena-ai.com/blog/selling-to-credit-unions