By Doug Wadsworth
This morning I logged into NMLS for a routine administrative task—checking the status of a privilege change for one employee. Even before the latest changes, the process was already significantly more complicated than logging into a corporate credit union to move millions of dollars.
It required a lengthy password (20 characters?!), emailed PIN codes, and a special VIP desktop encryption pin, all on a website so non-intuitive that almost nothing can be done without calling the help desk. The new Criminal History Record Information (CHRI) identity-verification steps have now made it even worse: I also had to photograph the front and back of my driver’s license and upload a live snapshot of my face, after inputting my personal information and private residence from a texted link! There goes another hour of my time.
That extra identification is related to the new third-party remote identity verification that NMLS began requiring in May 2026, for federal-institution account administrators and users with access to criminal-history data, under an FBI/CJIS mandate. Endangered Small Credit Union Defense (ESCUD) flagged the impending requirement in an April letter to the NCUA and CFPB, noting that it added yet another layer of time and administrative work on top of an already burdensome system.
A 2008 Solution Still Searching for a Problem
The SAFE Act and NMLS were created after the 2008 housing crisis to track and deter fraudulent practices by high-volume mortgage brokers and originators. Small credit unions played no role in that crisis, and we almost never even sell loans into the secondary market, and we do not employ competitive, high-volume mortgage brokers. As small credit unions, we usually only originate a modest number of portfolio loans, maybe a few first mortgages plus small home equity loans per year that we underwrite and hold ourselves.
Yet we face the full suite of requirements: institutional and individual registration, fingerprinting, annual renewals, NMLS numbers on every mortgage-related document, annual SAFE Act audits, and of course, the ever-growing administrative burden of the NMLS platform itself.
For a single-office credit union with 5–15 employees, where the CEO is frequently a primary (or only) mortgage loan originator, these requirements consume scarce staff time with essentially zero consumer-protection or safety-and-soundness benefit.
The NMLS website itself remains the most non-intuitive platform I have ever used in nearly 25 years of credit union management. It almost feels like a joke when I am trying to use it; I’m tempted to look for the hidden “candid camera!” Multiple separate menus in different spots on the same website, interacting in unpredictable ways- I counted five different menus in different places on the same webpage, it’s like some kind of impossible cipher or combination lock to even find the page you need.
‘Nearly Impossible’
Without calling the help desk (and waiting on hold) or consulting lengthy manuals, routine tasks are nearly impossible. Adding biometric-style identity verification and multi-factor hurdles on top of that platform simply multiplies the friction for institutions that already operate with the thinnest staffs.
The burden does not stop at the NMLS website. Examiners routinely scrutinize whether the unique NMLS number tied to each individual employee appears on every single application, disclosure, and signing document—including the Deed of Trust. Configuring loan systems and document packages to pull the correct employee-specific number on every form is complicated and error-prone at a small credit union with limited technology resources.
Yet examiners often treat a single missing number as a serious finding, even when the institution is healthy, low-volume, and the item poses no realistic risk. The result is more wasted time for both the small credit union and the NCUA on a technical compliance detail that was never even designed for our business model. It is absolutely pointless.
What ESCUD Has Asked For
ESCUD has pressed both the NCUA and the CFPB for relief since summer 2025, recently in letters that explicitly reference President Trump’s March 13, 2026, Executive Order “Promoting Access to Mortgage Credit.” That order directs the agencies to consider eliminating duplicative or unnecessary licensing and registration requirements for smaller lenders and to shift supervisory focus toward prudent underwriting rather than technical compliance items.
Our requests have been practical and tailored. What do small credit unions want?
- Immediate supervisory guidance from the NCUA directing examiners to cease all review, enforcement, or findings related to NMLS/SAFE Act requirements for credit unions under $500 million in assets or originating fewer than 500 mortgages annually.
- Parallel interpretive guidance or rulemaking from the CFPB under the SAFE Act and Regulation G to provide more durable relief for low-volume institutions.
From what I can tell, these steps are fully within existing agency authority. They do not require new legislation. They simply recognize that a system built for high-volume mortgage brokers does not fit single-office credit unions, it’s a completely different ecosystem. The new CHRI identity-verification requirements—and the examiner focus on perfect NMLS number placement—make the case for that relief even stronger.
A Long Game That Should Have Started in 2009
Over past decades, large credit union trade associations and state leagues have understandably focused most of their advocacy energy on the priorities of larger institutions – because they show up at the advocacy table (and sometimes dominate the leadership boards).
When the SAFE Act was written and implemented, the distinctive character of small, portfolio-lending credit unions was not considered, let alone protected. The result is that the smallest institutions have carried a regulatory burden designed for an entirely different business model for nearly two decades, and the burden continues to grow.
Even if a full statutory exemption remains a longer-term legislative project, work on it anyway!
At the same time, there is immediate supervisory and regulatory work that can be done. ESCUD’s January 2026 survey of small-credit-union CEOs (primarily under $100 million in assets) ranked regulatory compliance burden as the second-most significant challenge to operating a financially healthy credit union, right behind competitive pressure.
NMLS is one concrete, measurable example of a rule that imposes high costs and delivers essentially no safety-and-soundness or consumer benefit at our size, whatsoever.
A Call for Advocacy Partnership
ESCUD is not a competing trade association. We exist solely to amplify the voice of credit unions under $500 million in assets and to secure targeted regulatory relief that recognizes the fundamental differences between simple, hyper-local institutions and large, complex ones. We are officially endorsed by dozens of small credit unions nationwide (representing well over 250,000 members and more than $2 billion in assets), with new endorsements added regularly.
We stand ready to share detailed compliance-cost data, CEO testimonials, and low-volume mortgage examples with any league or association that wants to elevate this issue. For small credit unions that have not yet formally endorsed ESCUD, this is precisely the kind of practical, high-impact priority that benefits from a louder, more focused voice.
Never Designed for Us
Every hour a small-credit-union CEO spends fighting the NMLS website or completing another round of identity verification, every dollar spent on an unnecessary SAFE Act audit, every document package reconfigured or re-examined for a missing NMLS number, and every employee pulled away from member service is a resource that cannot be returned to the members and communities we were created to serve.
This NMLS system was never designed for us; it is an irrelevant time-waster. Can we please join advocacy efforts, and exempt small credit unions?
Doug Wadsworth is president of the Endangered Small Credit Union Defense and president of the $75 million Tri-CU Federal Credit Union in Kennewick, Wash. He can be reached at [email protected] or at www.endangeredsmallCUdefense.org.
