US credit unions usually support their CRM through one of six models: an in-house administrator, a CUSO or league service, the CRM vendor's own professional services, a consulting retainer or block of hours, a full managed services contract, or offshore staff augmentation. Many smaller credit unions end up with a blend, typically one internal owner plus an outside partner on a monthly retainer or managed services plan. Whichever model you pick, NCUA expects the credit union to keep responsibility for due diligence and oversight of that provider, so the contract, the SLA and the compliance split matter as much as the hourly rate.
If you're still choosing a platform, start with our guide to CRM for credit unions. This post picks up after go-live.
What CRM managed services do US credit unions typically hire?
After go-live, most CRMs degrade gradually: fields multiply, a core integration breaks after a vendor update, the member service team builds workarounds, and three Salesforce releases a year land on an org nobody has time to test. Managed CRM support exists to absorb that run work: user administration, small changes, integration monitoring, release readiness, reporting and a steady roadmap of improvements.
Credit unions buy that work in six common shapes.
In-house administrator. One or more employees own the platform. It suits credit unions with enough volume for a full-time admin, but one person rarely covers configuration, integrations, security and data quality, and the platform stalls when they leave.
CUSO or league service. Credit union service organizations and leagues offer shared technology services, peer groups and sometimes CRM help. Coverage varies a lot, so ask which platform skills they staff and whether CRM is a core service. NCUA can review CUSOs but, as covered below, it can only make recommendations to them.
The CRM vendor's own professional services or success plans. Salesforce, HubSpot and credit union specialist CRMs sell premium support or success plans. They're strong on product questions and platform incidents but generally don't configure your org, maintain your core integration or attend your compliance meetings.
Consulting retainer or prepaid block of hours. A partner sells a fixed number of hours per month, or a bank of hours used as needed. Good for credit unions with a capable internal admin who needs a senior bench for integrations, automation and design. We compare the two in retainer vs block of hours.
Full managed services. A partner takes ownership of run work under a monthly agreement with a named lead, response targets, health checks and release management. Best when you don't have, or don't want to hire, a full admin team.
Offshore staff augmentation. Lower-cost admins or developers, billed by the hour or month, directed by your team. It shifts direction, quality review and oversight back to the credit union, and raises data access questions your information security officer will want answered.
Comparison of credit union CRM support models
| Model | What it usually covers | Who directs the work | Typical commercial shape | Watch for |
|---|---|---|---|---|
| In-house admin | Users, reports, small changes, first-line support | Credit union | Salary plus benefits and training | Single point of failure, limited integration depth |
| CUSO or league service | Shared services, peer knowledge, some CRM help | Shared | Membership or service fees, varies | Platform depth varies by provider |
| CRM vendor support or success plan | Product questions, platform incidents, guidance | Vendor | Annual plan, often tied to licence spend | Doesn't change your configuration |
| Consulting retainer or block of hours | Senior configuration, integrations, design | Credit union with partner | Fixed monthly hours or prepaid hours | Unused hours, unclear priorities |
| Full managed services | Run work, releases, health checks, roadmap | Partner, approved by credit union | Monthly fee, 12-month term is common | Scope exclusions, after-hours coverage |
| Offshore staff augmentation | Ticket execution | Credit union | Hourly or monthly per person | Oversight burden, data access controls |
Which SLA terms matter in a CRM managed services contract?
Severity levels. A sound agreement defines three or four levels. P1 usually means the CRM is down or a critical process such as member onboarding or the core sync has stopped for many users. P2 is a major function degraded with a workaround. P3 and P4 cover minor defects and change requests. Ask for written examples of each, using your own processes.
Response vs resolution. Response time is how fast a qualified person starts working the issue. Resolution time is how fast it's fixed. Most CRM partners commit to response targets only, because a root cause may sit with Salesforce, HubSpot, the core provider or your digital banking vendor.
Business hours vs 24/7. Most CRM managed services run in business hours. True 24/7 coverage costs considerably more and is usually only needed when the CRM sits in a round-the-clock member service path.
Release management. Salesforce ships three major releases a year. HubSpot releases continuously. Your agreement should say who reviews release notes, who tests in a sandbox, and who signs off before features switch on.
Monthly health checks. A useful health check reports on login activity, failed integrations, data quality, storage, permission changes and open risks.
Change control. Every change should be logged, risk-rated, built and tested outside production, and approved by a named person at the credit union before deployment. Changes that touch member data, permissions or member communications should route to compliance or information security.
Who owns compliance when a credit union outsources CRM management?
The credit union does. NCUA's own guidance for vendors says credit unions are "fully responsible for third-party due diligence, vendor monitoring, cybersecurity considerations" when they adopt a technology or service. Outsourcing moves the work, and the accountability stays with your board and management.
NCUA third-party guidance. Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships (December 2007), and its enclosed supervisory letter set out the expected framework: planning, due diligence on the provider's reputation, financials and controls, contract review with independent counsel, and ongoing monitoring by staff with enough expertise to oversee the arrangement. It builds on 01-CU-20, Due Diligence Over Third Party Service Providers (November 2001). Both remain listed on ncua.gov. The 2023 interagency guidance on third-party relationships was issued by the Federal Reserve, FDIC and OCC; NCUA wasn't one of the issuing agencies, though many credit unions borrow from it.
NCUA's limited vendor authority. NCUA's authority to examine third-party vendors and CUSOs lapsed at the end of 2001. Today it can review CUSOs but can only make recommendations, and it has no direct authority over other vendors. Bills to restore that authority have come up repeatedly. The latest we found, H.R. 10230, was introduced on September 2, 2026 and referred to the House Financial Services Committee. Until something passes, your own due diligence is the main control examiners will look at. NCUA also states that it doesn't approve, certify or endorse vendors, so treat any provider claiming "NCUA approved" as a red flag.
GLBA safeguards and NCUA Part 748. Credit unions meet GLBA safeguarding duties through 12 CFR Part 748. Appendix A expects you to exercise due diligence in selecting service providers, require them by contract to implement appropriate safeguards, and monitor them where your risk assessment calls for it, for example by reviewing audits and test results. Under Part 748.1(c), you must report a reportable cyber incident to NCUA within 72 hours, and the clock can start when a third party notifies you. Your CRM provider's contract should commit it to notify you fast enough to meet that deadline.
BSA/AML data. Part 748.2 requires a written, board-approved BSA compliance program. If your CRM holds CIP data, case notes or member risk flags, your provider must not change those fields, validation rules or permissions without your BSA officer's approval.
Member privacy. Privacy notice and information-sharing rules under GLBA (Regulation P, 12 CFR Part 1016) apply to credit unions. Marketing automation built in HubSpot or Salesforce Marketing Cloud must respect opt-outs that originate in your core or digital banking platform.
A practical split looks like this:
| Responsibility | Credit union | Managed services partner |
|---|---|---|
| Vendor due diligence and board reporting | Owns | Supplies SOC reports, policies, insurance, references |
| Risk assessment of CRM data | Owns | Documents data flows and integrations |
| Access reviews | Approves | Runs quarterly user and permission reports |
| Change approval | Approves through named approver | Logs, builds, tests and deploys |
| Incident notification to NCUA | Owns | Notifies the credit union within contract terms |
| BSA/AML field and permission changes | BSA officer approves | Implements approved changes only |
| Member opt-out and consent logic | Compliance approves | Configures and tests |
How do core and digital banking integrations affect support?
Most credit union CRM support tickets trace back to an integration. The core is the system of record for members, shares and loans, and the CRM depends on a reliable sync. Jack Henry's Symitar (Episys), Corelation KeyStone, Fiserv DNA and the CU*Answers core (CU*BASE, now branded CBX) each expose data differently, through vendor APIs, middleware or batch files. Digital banking platforms such as Alkami, Q2 and Jack Henry's Banno add a second stream of events: logins, applications, transfers and messages.
Ask any provider:
- Which of these cores have you integrated with or supported, and through which method?
- Who monitors the sync, and how quickly will you know if a nightly file fails?
- How do you handle a core conversion or a merger, where two cores feed one CRM for months?
- Who holds the integration credentials, and how are they rotated?
After a merger, the CRM may have to match members across two cores and keep both consent histories, so budget extra support hours for that year.
How to evaluate a CRM managed services provider
Score each provider against criteria you can verify:
- Financial services depth. Have they supported regulated institutions, and can they describe a credit union or bank engagement in detail?
- Who delivers the work. Will senior consultants do the work, or will tickets go to a junior pool? Ask to meet the named account lead.
- Platform and core coverage. Do they support your CRM and your core integration method today?
- Documented change control. Can they show a sample change log and approval record?
- Security posture. SOC 2 report or equivalent, background checks, MFA, least-privilege access and where staff are located.
- Pricing transparency. Published or clearly quoted rates, overage terms and what's excluded.
- Exit terms. Documentation handover, credential transfer and a defined transition period.
For a provider-by-provider view, see Best CRM Managed Service Providers for Credit Unions. Our broader guide to choosing a CRM managed services partner covers the same criteria for other financial firms.
Buyer checklist: questions for credit union CRM providers
- Which credit unions or banks of our size have you supported, and may we speak with one?
- How will you document your controls so our examiner can see our oversight of you?
- What is your P1 definition, response target and support hours, in writing?
- How do you test each Salesforce release, or each HubSpot change, before it reaches our members?
- Who at our credit union approves changes touching member data, BSA fields or permissions?
- How fast will you notify us of a security incident, given our 72-hour NCUA reporting duty?
- What happens to our documentation, credentials and backlog if we leave?
What do credit union CRM managed services cost?
Costs vary by platform, org complexity and number of integrations. Some reference points:
- In-house admin. PayScale puts the average US Salesforce administrator base salary at about $81,500, with a 10th to 90th percentile range of roughly $59,000 to $111,000 (March 2026). Add benefits, training and backfill when the person is out.
- Retainers and blocks of hours. Vantage Point's published retainers start at $2,000 a month for 10 Salesforce hours or $1,650 for 10 HubSpot hours, on a six-month minimum. Prepaid blocks start at $2,500 for 10 Salesforce hours.
- Full managed services. Our published tiers, billed monthly on a 12-month term with licences not included, run from $5,850 a month (Essentials, 30 senior hours, Salesforce or multi-platform) or $4,800 (HubSpot), to $9,500 Salesforce or $7,750 HubSpot for Professional (50 hours). Enterprise (80+ hours) is $12,000 for HubSpot and quote-based for Salesforce. Overage is $225 an hour for Salesforce and $175 for HubSpot, approved in advance. See current terms.
Every tier we offer includes a named account lead, a 2-hour P1 response target during business hours with P1 issues worked the same day, monthly health checks, release readiness for each Salesforce release, a quarterly roadmap and governance review, user administration, documentation, and monitoring of AI agents we built. Support runs in US Central or Eastern European business hours. We don't offer 24/7 coverage, so a credit union that needs round-the-clock CRM support should look elsewhere or pair us with an after-hours provider.
When comparing quotes, check whether health checks, release testing and roadmap reviews sit inside the hours or are billed separately.
A 30-60-90 day plan for moving to a managed services provider
Days 1-30: inventory and access. Sign the contract and complete due diligence. Grant least-privilege access. The provider documents the org: objects, automations, integrations, user roles, open tickets and known risks. Agree severity definitions and the change approval path, naming approvers in compliance, information security and BSA.
Days 31-60: stabilize. Run the first health check. Fix failed integrations and high-risk permission gaps. Set up a sandbox release process and test the next scheduled release. Start a monthly report to management on tickets, changes and risks.
Days 61-90: improve. Hold the first quarterly roadmap review. Pick two or three improvements tied to member outcomes, such as faster loan follow-up or onboarding journeys triggered by core events. Confirm the vendor oversight file is ready for your next exam: contract, due diligence, SOC report, monitoring evidence and change logs.
How Vantage Point supports credit unions
Vantage Point is a senior-led Salesforce, HubSpot and AI consulting firm for financial services, founded in 2018 and employee-owned, with headquarters in Dallas and a practice in Sofia, Bulgaria. We've completed 700+ engagements for 175+ clients, and 79 clients work with us on managed services or retainers. We configure the controls and your compliance team approves them. Work we've done for a credit union league serving member institutions is one example. See our banking and credit union practice, and if you're still planning, our list of CRM roadmap consulting firms for credit unions.
Frequently asked questions
What do CRM managed services for credit unions include?
They typically cover user administration, small changes, integration monitoring, release testing, reporting, documentation and a roadmap review. Licences, large new projects and after-hours coverage are usually priced separately.
Does NCUA approve CRM vendors or managed services providers?
No. NCUA states that it doesn't approve, endorse or certify vendors, and it currently lacks direct examination authority over most third parties. Your credit union is responsible for due diligence and ongoing monitoring under guidance such as 07-CU-13 and the service provider expectations in Part 748, Appendix A.
Is 24/7 CRM support necessary for a credit union?
For most credit unions, no. CRM issues mostly affect staff workflows, so business-hours coverage with a fast P1 response is usually enough. If your CRM drives a round-the-clock contact center or real-time fraud workflows, price 24/7 coverage separately.
How much should a credit union budget for managed CRM support?
As one published reference, Vantage Point's retainers start at $1,650 to $2,000 a month, and our full managed services run $4,800 to $12,000 or more a month depending on platform and hours. Other providers quote after discovery, so ask what's inside the hours.
Can a managed services provider support our core integration?
Many can, but experience varies by core. Ask which cores the provider has supported (Symitar, KeyStone, DNA, CU*Answers), which integration method they used, and who monitors the sync day to day.
How long does it take to switch CRM support providers?
Plan on about 90 days to reach a steady state: a month each for access and documentation, stabilization, and the first roadmap cycle.
Get a second opinion on your credit union CRM
If you're weighing support models or renewing a contract, we'll review your org, integrations and change controls and tell you which model fits. Book a free CRM assessment, or compare our managed services and retainer pricing.
