Your VP of Lending swears by ChatGPT. Your marketing coordinator uses Gemini. Someone on the IT team just sent a Slack message about Perplexity. And your Microsoft rep is calling—again—about Copilot.

So which one should your credit union actually use?

The short answer: it depends on what you're trying to do. But that's not a dodge. These tools have genuinely different strengths, and picking the wrong one for the wrong job costs you time, money, and sometimes trust. Here's a plain-English breakdown so you can make a smarter call.

What Are These Tools, Really?

All five are AI assistants built on large language models. You type something in; they respond in natural language. But they're built on different underlying models, trained on different data, woven into different software ecosystems, and priced differently.

Think of them less like interchangeable apps and more like five contractors who all know how to build—but each has a specialty, a day rate, and a preferred tool belt.

ChatGPT: The Swiss Army Knife

Best for: General drafting, brainstorming, member-facing content, custom workflows

ChatGPT, made by OpenAI, is the name most people think of when they hear "AI." It's versatile, widely documented, and has the largest community of users sharing prompts and use cases.

For credit unions, ChatGPT shines when your team needs to produce content quickly: member newsletters, board memo summaries, job postings, social media copy. The Custom GPTs feature (available on paid plans, as of 2025) lets you build a version of ChatGPT trained on your own instructions, tone guidelines, and uploaded documents. Your member services team could use a Custom GPT pre-loaded with your product FAQs so every response stays on-brand and accurate.

The main limitation: ChatGPT doesn't connect to your live systems. It works on what you give it in the conversation window or pre-load into a Custom GPT. It is not pulling data from your core in real time.

Pricing: Free tier available. ChatGPT Plus runs approximately $20 per user per month. Team and Enterprise plans are available—verify current pricing at openai.com.

Claude: The Careful Thinker

Best for: Long documents, policy analysis, board materials, anything requiring nuance

Claude, made by Anthropic, handles long documents exceptionally well. You can paste in an entire vendor contract or a 40-page NCUA exam report and ask it to summarize key risks, flag unusual language, or draft a response memo. Many credit union executives who use both ChatGPT and Claude describe Claude as "the one you trust with the serious stuff."

Claude tends to reason through complexity rather than pattern-match to a quick answer. For credit union work involving regulatory language, vendor agreements, or board presentations, that extra care matters.

Claude is also generally seen as more cautious about making things up—though no AI tool is immune to errors. Always verify specific claims before acting on them.

Claude offers an enterprise tier with stronger data privacy commitments. If your board or examiners ask how you're protecting member data when using AI, Anthropic's data-use terms are worth reviewing with your compliance team before you expand use.

Pricing: Free tier available. Claude Pro runs approximately $20 per user per month (as of 2025)—verify current pricing at anthropic.com.

Gemini: The Google Integration Play

Best for: Teams already living in Google Workspace—Docs, Sheets, Gmail, Meet

Gemini is Google's AI, and its strongest argument is ecosystem fit. If your credit union runs on Google Workspace, Gemini integrates directly into the tools your team already uses. Draft a loan officer job description in Google Docs with Gemini's help. Summarize a long email thread in Gmail. Build a quick data model in Sheets.

For your marketing team or ops team that spends the workday inside Google's suite, Gemini can reduce friction because you're not switching apps. The AI is already inside the document you're working on.

The limitation is similar to ChatGPT's: it doesn't have live access to your core, your digital banking platform, or your member data. It works within the scope of what's in your Google environment.

Pricing: Gemini is included in some Google Workspace tiers; Gemini Advanced is available as an add-on. Verify current pricing at workspace.google.com.

Microsoft Copilot: The Microsoft 365 Bet

Best for: Teams already on Microsoft 365—Word, Excel, Teams, Outlook, SharePoint

Copilot is Microsoft's answer to Gemini, built on OpenAI's models and woven into Microsoft 365. If your credit union runs on Teams, Outlook, SharePoint, and Word, Copilot can be genuinely useful: summarize a Teams meeting you missed, draft a Word document from a bullet-pointed outline, pull insights from a SharePoint-stored policy document.

One real advantage for larger credit unions: Copilot for Microsoft 365 can reference documents stored across your Microsoft environment. In practice, that means it can draft a memo and pull context from your SharePoint policy library without you copying and pasting.

The cost has historically been higher than the other tools on this list. Early enterprise pricing ran approximately $30 per user per month on top of existing Microsoft 365 licensing (as of 2025)—verify current pricing at microsoft.com. For smaller credit unions with tighter budgets, that math may not pencil out right now.

Perplexity: The Research Tool

Best for: Current-events research, market scans, quick factual lookups with citations

Perplexity is different from the others. It's less of a "help me write" tool and more of a "help me know" tool. It's an AI-powered search engine that pulls from live web sources and shows you citations alongside its answers.

For credit union executives, Perplexity is useful for three kinds of tasks:

1. Scanning competitor rates. Ask what the average high-yield savings rate looks like today and it pulls current data from live sources.
2. Researching a vendor. Get a quick overview of a fintech you're about to meet with—recent news, funding rounds, customer reviews.
3. Following regulatory updates. Search for recent NCUA guidance or CFPB rulemaking commentary without wading through search results manually.

It's not the right tool for drafting a board memo or building a member-facing chatbot. But as a research accelerator for your leadership team, it earns a seat at the table.

Pricing: Free tier available. Perplexity Pro runs approximately $20 per month (as of 2025)—verify current pricing at perplexity.ai.

How Do You Actually Pick One?

Start with the questions your team is trying to answer most often. Then work through this sequence:

1. Audit your most common AI use cases. Ask three or four department heads: "What tasks do you wish took less time?" Loan officer letter drafting, exam prep summaries, member complaint responses, board report formatting—these are all legitimate AI candidates.
2. Check your existing software contracts. If you're already paying for Microsoft 365 or Google Workspace at scale, the built-in AI tools may cost far less than adding a standalone subscription. Talk to your current reps before buying something new.
3. Run a 30-day pilot with one team. Don't roll out five tools at once. Pick one use case, one department, one tool. Measure time saved and quality of output. Then decide whether to expand.
4. Get your compliance team involved early. Any AI tool that touches member data—even indirectly—warrants a review of the vendor's data handling policies. Consult your compliance team before expanding use beyond internal, non-member-data tasks.
5. Set a simple acceptable-use policy. Before your staff experiments on their own, give them a one-page guide on what's allowed. Member data does not go into free-tier AI tools. Anything AI-generated gets a human review before it goes out.

A Quick Side-by-Side

No single tool wins across every category. Many credit unions end up using two: one for drafting and one for research. That's a reasonable place to land.

What's the risk?

The risk profile here varies by tool and by how you use it. The biggest exposure isn't the AI itself—it's what your staff puts into it. Member names, account numbers, loan details, and any other non-public personal information should never go into a free consumer-tier tool. Most major providers offer enterprise or team plans with stronger data handling commitments and, often, a promise not to train their models on your inputs. That matters a great deal if examiners ever ask how you're managing AI-related data risk. Before you expand any of these tools beyond internal, non-member-data tasks, loop in your compliance team and review the vendor's data processing terms. Consult your legal counsel on anything that touches member NPI.

The second risk is accuracy. Every tool on this list will occasionally produce confident-sounding information that is simply wrong. For low-stakes work—marketing copy, internal training material, first drafts of meeting agendas—the risk is low and the upside is real. For anything that informs a regulatory response, a board decision, or a member-facing policy, treat AI output as a starting point, not a finished product. A human reviewer who knows your credit union's situation needs to be in the loop before anything goes out the door. On vendor concentration: if your team becomes deeply dependent on a single provider, watch for pricing changes and have a rough contingency plan. The AI market is moving fast, and today's pricing is not guaranteed tomorrow.

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

Frequently Asked Questions

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

The post ChatGPT vs. Claude vs. Gemini vs. Copilot vs. Perplexity: Which AI Tool Should Your Credit Union Actually Use? appeared first on CU 2.0.

ASHLAND, Ore. — CU 2.0 launched its AI coaching program for credit unions, a hands-on engagement built to help credit union teams gain real skill and confidence with AI. The program puts people before tools, and early clients are already building and using AI in their everyday work.

The early results back that up. Every team in the program is now building and using its own custom GPTs, Skills, and workflow improvements. Clients have tried several new tools and found the ones that fit their work. Most have begun experimenting with simple automations. And several credit unions are going further, building custom, AI-coded solutions of their own with CU 2.0’s guidance and toolkit.

That progress comes from a deliberate order of operations. CU 2.0 helps credit unions level up their people before their tools. Teams learn how AI actually works, from the way tokens and prompts shape results to how to judge whether a tool is worth adopting. As comfort grows, so does what a team is willing and able to build.

“A lot of AI projects stall because a credit union buys a tool and hopes the team figures it out. We start with the people instead. Once a team understands how this really works, they stop waiting and start building. That is when the tools start to pay off.”

— Kirk Drake, CEO, CU 2.0

Credit unions interested in the AI coaching program can schedule a free AI Discovery Call with the CU 2.0 team to see where their people are today and where coaching could take them.

Additional information is available at cu-2.com/credit-union-ai-coaching/

ABOUT CU 2.0

CU 2.0 is a consultancy embedded in the credit union and financial technology ecosystem, helping credit unions find and adopt the right technology and helping fintechs navigate the credit union market. Based in Ashland, Oregon, CU 2.0 works with institutions across the country through its Fintech Call Program, strategic planning services, and—most recently—AI Coaching and Platform.

The post CU 2.0 Launches AI Coaching Program That Puts People Before Tools appeared first on CU 2.0.

Ever pasted a long vendor contract into Claude, gotten a sharp answer, then asked a follow-up question and watched the AI completely lose the thread? Or noticed your member communications suddenly sound off-brand after a long editing session—and couldn't figure out why?

You're not imagining it. There's a simple, mechanical explanation. Once you understand it, you'll get better results and stop blaming the tool when it's really just a workflow problem.

What Is a Token?

AI models don't read words the way you do. They break text into small chunks called tokens. A token is roughly four characters of English text—sometimes a whole short word, sometimes just part of a longer one.

"Member" is probably one token. "Creditworthiness" might be three or four. Spaces, punctuation, and numbers all count too.

This matters because AI models have a hard limit on how many tokens they can process at once. That limit is called the context window—and it explains most of the strange behavior your team runs into.

Think of it like a whiteboard in your conference room. Everything the AI knows about your current conversation has to fit on that whiteboard. Once it's full, something gets erased to make room for new content.

What Is a Context Window?

The context window is the total amount of text an AI model can "see" at one time. That includes your prompt, the AI's previous responses, and any documents you've pasted in. It's measured in tokens.

As of 2025, context windows vary widely by model and pricing tier. Claude's larger models support windows in the hundreds of thousands of tokens. GPT-4o sits in a similar range. Smaller or older models cap out much sooner. Verify current limits directly with each provider—these numbers change frequently.

The context window is the AI's entire working memory for your conversation. Once it's full, older content doesn't get archived. It disappears.

Here's the key mechanism: every time you send a new message, the model re-reads the entire conversation from the top, up to the context window limit. It's not like talking to a colleague who remembers your chat from last week. It's more like handing someone a printed transcript of the conversation every single time you ask a question—and once that transcript gets too long, pages start falling off the beginning.

When the conversation exceeds the window, older messages drop off silently. The AI doesn't warn you. It just loses access to whatever fell off the edge.

That's why Claude "forgets."

Why Does This Matter for Credit Union Work?

Your loan ops team is using Claude to review a core conversion proposal. The document is 40 pages. They paste in the whole thing, ask a few solid questions, get useful answers. Then, 20 messages deep, someone asks about the exit clause language from the opening section. By that point, the early pages may have scrolled out of the context window. Claude gives a vague or wrong answer—not because it's broken, but because it literally can't see that section of the document anymore.

Or your CMO sets up a long ChatGPT session with detailed brand voice instructions at the top, then works through several member email drafts over an hour. At some point, the brand guidelines fall out of context. The outputs start sounding different. Nobody knows why.

Understanding context windows turns those confusing moments into diagnosable, fixable problems instead of reasons to distrust the tool.

How Do I Work Around Context Window Limits?

You don't need a developer for this. A few habits make a real difference.

1. Start fresh conversations for separate tasks. Don't try to handle your board memo, your member survey analysis, and your examiner prep in one long thread. Each task gets its own conversation. Clean context, better answers.

2. Paste only what's relevant. If you're reviewing a 50-page vendor proposal, don't dump the whole thing in at once. Pull the sections that matter for your specific question—pricing, SLAs, exit clauses—and paste those. Focused context gets sharper answers.

3. Restate key instructions in long sessions. If your team is working through an extended editing session and the AI starts drifting from your original guidelines, re-paste the key instructions. It's not a bug. It's just how the whiteboard works.

4. Use tools built for long documents. NotebookLM, for example, is designed specifically to let you upload documents and ask questions across them without running into the same context window pinch. For use cases like summarizing board packets or comparing core vendors, it's worth a look. (There's a dedicated post on NotebookLM elsewhere in this series.)

5. Break big tasks into smaller prompts. Instead of asking Claude to "review this entire lending policy and flag every compliance concern," ask it to work section by section. You'll get more reliable answers and a cleaner audit trail.

What About Hallucinations? Is That the Same Problem?

Not exactly—though both can look the same from the outside.

Context window issues show up as the AI forgetting something specific you already provided. Hallucinations show up as the AI inventing facts it was never given at all—a made-up regulation, a statistic that sounds plausible but isn't real, a policy that doesn't exist.

The fixes are different. Context window problems call for better conversation structure. Hallucinations call for verification, especially for anything regulatory or member-facing. Your compliance team should always review AI-generated content that touches member communications, loan disclosures, or examiner-facing documents. Consult your compliance team before using AI-drafted content in any of those contexts.

Tokens Also Affect Your Budget

Most AI platforms charge by token—both what you send and what the AI generates back. If your team is pasting enormous documents into every prompt, that adds up.

This becomes a real budget conversation if your credit union is evaluating an enterprise AI license or building any internal tool on top of an AI API. Pricing models vary by provider and tier—verify current pricing directly with your vendor before you build token costs into a budget. As of 2025, pricing structures are still shifting across the major platforms.

Understanding tokens isn't just an intellectual exercise. For credit unions thinking about AI at scale, it's a cost management conversation your CFO will eventually want to have.

What's the risk?

For the workflows described in this post—understanding how AI works, structuring prompts, managing conversation length—the risk is low. You're not exposing member data to get value from these concepts. The main risks emerge when your team starts pasting real member information, NPI, or sensitive financial data into a general-purpose AI tool without a clear data handling agreement in place. If your loan ops team is feeding actual member records into Claude or ChatGPT to test these techniques, stop and talk to your compliance officer first. Consumer AI tools are not designed for NPI handling, and your examiners will ask.

Hallucination risk is real and worth naming plainly: AI models can generate confident-sounding wrong answers, and context window exhaustion can make that worse by silently removing the source material the model needed to get it right. For internal brainstorming, first-draft writing, and training materials, the risk is manageable with human review. For anything member-facing, regulatory, or loan-related, treat AI output as a first draft that requires a qualified human sign-off—not a finished product. The good news is that the workflow habits described above (shorter sessions, focused context, fresh conversations per task) reduce both cost and accuracy risk at the same time.

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

Frequently Asked Questions

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

The post How Does AI Actually Work? Tokens, Context Windows, and Why Claude “Forgets” appeared first on CU 2.0.

What does a credit union lobbyist do?  On the show to answer that question is Ibby Dickson, manager of federal advocacy at the League of Credit Unions, a multi-state league representing credit unions in Alabama, Georgia, Florida, Virginia and there’s a merger in the works with the League of Maryland and the District of Columbia.

Can credit unions get their message across in today’s Washington DC?  Spoiler alert but Dickson emphatically believes many on the Hill are indeed receptive to credit union messaging.

A case in point is how the League communicates its messages around the housing affordability crisis, a topic Dickson explored in a recent CUInsight article.

The post CU 2.0 Podcast Episode 421 Ibby Dickson on Lobbying Today’s Congress appeared first on CU 2.0.

Someone on your team mentioned a "Custom GPT." A vendor demo showed a "Claude Project." Now your CTO is talking about a "Gemini Gem." Are these three different technologies — or just three companies using different names for the same thing?

Mostly the same thing. Each major AI platform — OpenAI, Anthropic, Google — lets you take their general-purpose model and give it a specific job. You write instructions, upload a few documents, and save the configuration. From that point on, everyone who opens that version of the tool gets a focused, pre-briefed assistant instead of a blank chat window. That's the whole idea. Once you see it, all three click into place at once.

What Is a "Configured AI Assistant," Anyway?

You write instructions that tell the AI who it is, what it knows, how it should sound, and what it should never do. You might upload your member handbook, your loan policy, or your brand style guide. Save it. Anyone on your team who opens that configured version gets the same focused assistant every time.

Think of it like a new hire who's already read your policy manual, knows your brand voice, and has been told which questions to escalate — except it scales to your whole team overnight.

The jargon varies by platform. The concept is identical. Here's how each one works, and what that means for your credit union.

OpenAI's Version: Custom GPTs

A Custom GPT lives inside ChatGPT. You build it using the GPT Builder — a plain-English form where you describe the assistant's purpose, paste in instructions, and upload reference files. Once it's built, you can keep it private, share it with your team via a link, or (on enterprise plans) publish it in an internal store only your staff can access.

A credit union example: Your member services team gets a Custom GPT that knows your current rate sheet, your membership eligibility rules, and your brand tone. A rep types a member question in plain English and gets a draft response — consistent, on-policy, and ready to review in seconds. No more digging through SharePoint for the right disclosure.

Custom GPTs are available on ChatGPT Plus and Team plans. Verify current pricing and plan details at openai.com.

Anthropic's Version: Claude Projects

Claude Projects work similarly but live inside Claude.ai. You create a Project, write a system prompt that sets the assistant's role and rules, and upload documents that Claude should treat as its source of truth.

Many credit union teams who've used both report that Claude follows nuanced instructions with particular care. That makes it well-suited to tasks where precision and tone matter — drafting board memos, summarizing vendor contracts, or helping your marketing team write member communications that stay on the right side of Reg E language. (Whatever tool you use, always have your compliance team review any member-facing content before it goes out.)

Claude Projects are available on Claude.ai Pro and Team plans. Verify current pricing at anthropic.com.

Google's Version: Gemini Gems

Gems live inside Google's Gemini platform. Setup is nearly identical to the others — name your Gem, write instructions, upload documents. The practical edge: if your credit union runs heavily on Google Workspace, Gems can pull directly from shared Drive files without manual uploads. For a team already living in Google Docs and Sheets, that's a real convenience.

Gems are available on Gemini Advanced, which is included in Google One AI Premium and Google Workspace plans. Verify current pricing and availability at workspace.google.com.

How Do I Choose the Right Platform for My Credit Union?

This is the question executives actually need answered. Here's a straightforward way to think about it:

1. Start with where your team already works. If your staff lives in Microsoft 365, ChatGPT Team integrates more naturally. A Google Workspace shop will find Gems and Drive integration familiar. No strong platform lean? Claude Projects are worth a close look for document-heavy work like policy analysis or exam prep.

2. Match the tool to the task. All three handle general drafting and Q&A well. For structured document analysis — summarizing a long core conversion proposal, for example — Claude tends to get strong reviews from credit union teams. For web-connected research and broad lookups, Gemini has an edge. For a wide library of community-built assistants you can borrow and adapt, ChatGPT's GPT store is hard to beat.

3. Check your IT and security posture first. Before uploading internal documents, confirm your plan does not use your data to train the model. All three vendors offer this at paid business tiers as of 2024 — but verify the specific plan with your IT or compliance team before uploading anything sensitive, and consult your information security policies.

4. Run a pilot, not a committee. Pick one use case — a loan officer FAQ assistant, a board meeting prep tool, a first-draft generator for member newsletters — and build it in whichever platform your most curious team member already has access to. If it saves an hour a week, you'll know fast.

5. Don't over-engineer the first one. A good system prompt is two or three tight paragraphs. Upload two or three core documents. Launch. Iterate. The credit unions making real progress with configured assistants aren't the ones who planned the perfect tool for six months. They're the ones who built a rough version, saw what broke, and fixed it.

Why This Matters for Credit Union Executives Right Now

The real risk isn't picking the wrong platform. It's letting the naming confusion stall you while peers build institutional knowledge with these tools.

Many executives who've gone through this process say the biggest surprise isn't the technology — it's how fast a configured assistant reduces the "where do I find that?" friction for frontline staff. Your loan ops team stops hunting for the right disclosure. Your marketing team stops starting every member email from scratch. Small wins, repeated daily, compound into real efficiency.

All three platforms are evolving fast. Features that separate them today may be table stakes by next quarter. The durable advantage isn't picking the "best" one — it's getting your team comfortable with the idea of configured AI assistants so you can adapt as the tools mature.

What's the Risk?

The risk profile here is low to moderate, depending on what you upload. The concept itself — configuring an AI assistant with instructions and documents — is not inherently dangerous. The exposure comes from what goes into that configuration. If you upload anything containing member NPI (names, account numbers, loan details), you need to be confident your plan's data handling terms meet your information security policy and comply with GLBA obligations. Talk to your compliance team before that step. This isn't a reason to wait indefinitely — it's a reason to spend 30 minutes confirming your plan terms before you upload sensitive files.

For lower-risk starting points — your rate sheet, your brand voice guide, a generic member FAQ, publicly available policy language — you can move quickly with minimal exposure. Hallucination risk is real on all three platforms: any configured assistant can confidently produce a wrong answer. That's why human review stays in the workflow, especially for anything member-facing or compliance-adjacent. Examiners are increasingly aware these tools exist; being able to explain your review process is more important than which platform you chose.

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

Frequently Asked Questions

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

The post Custom GPT vs. Claude Project vs. Gemini Gem: Same Idea, Three Names appeared first on CU 2.0.

Casap was the best of show winner at Finovate fall 2025 and its business is this: building AI Agents for Disputes ‍and Fraud resolution and it now has 50+ clients that it won with attention grabbing claims: Resolve claims in minutes, not weeks. Earn lasting loyalty. Cut fraud losses.

This is a universe undergoing immense change, mainly due to the rise of so-called first party fraud which has surged globally. This is in contradistinction to third party fraud and that of course is when a third party has hijacked another’s credit card or debit card and made fraudulent purchases.

First party fraud is when the cardholder denies the legitimacy of a charge he or she in fact actually made.

What? You go out on a date.  It’s a bad date.  With a bad meal that you put on your credit card and when you see that charge pop up on your statement you call the issuer and say, wasn’t me.

And card issuers are struggling to contain and minimize this first party fraud.

Which is where Casap enters.

On the show are Shanthi Shanmugam, CEO of Casap, and Rob Keatts, EVP of Chartway  Credit Union in Virginia, a $3.1 billion institution. The show opens with only Rob on the line and we take advantage of that to ask him to tell the whole truth about the pain point that prompted Chartway to bring Casap on board and how it was working with a startup – and understand Chartway was Casap’s second customer!

Of course Shanthi joins a few minutes later and she’ll tell you what you need to know about containing credit card and debit card fraud – and how agentic AI, Casap’s forte, makes the process work more smoothly.

Filene seconds that motion, as noted in this press release headline: Chartway Credit Union Saved an Estimated $875K in One Year, Testing a Fraud Dispute Automation Fintech.

Shanthi by the way is a return guest.  She stars in Episode 359 and Casap has taken huge strides in the year since.  Its client count is now 50+ and she has enormous ambition for what she believes the AI agents Casap is building can accomplish.

The post CU 2.0 Podcast Episode 420 Casap’s AI Agents Tame Fraud at Chartway Credit Union appeared first on CU 2.0.

ASHLAND, Ore. — CU 2.0, a consultancy specializing in the intersection of financial technology and the credit union industry, today announced the formation of a Credit Union Service Organization (CUSO) dedicated to helping credit unions adopt and advance their use of artificial intelligence. The CUSO serves as a coaching, consulting, and development partner for credit unions that are ready to put AI to work but are not sure where to begin.

The formation reflects real momentum. CU 2.0 already has multiple credit union clients actively building their AI skills and is adding new engagements at a steady pace. The CUSO structure lets CU 2.0 deepen those partnerships and bring credit union voices directly into the organization’s governance and direction, which is the cooperative model at work.

“Credit unions are at an inflection point. The institutions that figure out AI in the next two years will be fundamentally better positioned than those that don’t — not just operationally, but in how they serve members. We’ve been in the trenches building and deploying real AI tools for real institutions, and we want to formalize that work in a way that lets credit unions shape it alongside us.”

— Kirk Drake, CEO, CU 2.0

The CUSO’s services include AI coaching and education for leadership teams, workflow automation, application development, and strategic AI planning, all tailored to the credit union’s culture, capacity, and member base. Early engagements have shown that meaningful AI adoption is more accessible than most credit union leaders expect.

Credit unions interested in learning more about the CUSO or exploring a coaching engagement can schedule a free AI Discovery Call with the CU 2.0 team. In a single 60-minute conversation, CU 2.0 will look at where the institution is using AI today, identify early wins that fit its capacity, and give an honest picture of where it makes sense to go next.

Additional information is available at cu-2.com/credit-union-ai-coaching/

ABOUT CU 2.0

CU 2.0 is a consultancy embedded in the credit union and financial technology ecosystem, helping credit unions find and adopt the right technology and helping fintechs navigate the credit union market. Based in Ashland, Oregon, CU 2.0 works with institutions across the country through its Fintech Call Program, strategic planning services, and—most recently—AI Coaching and Platform.

The post CU 2.0 Announces Formation of AI-Focused CUSO to Help Credit Unions Navigate the Future of Artificial Intelligence appeared first on CU 2.0.

Have you ever clicked "Allow" on a third-party app without reading what it could access? Now imagine doing that with your AI assistant—and the thing on the other end can read files, send emails, and query your database.

That's the conversation credit union executives need to have about MCP servers. Not because they're dangerous by default, but because most people connecting them don't fully understand what they've agreed to.

What Is an MCP Server?

MCP stands for Model Context Protocol. It's an open standard—published by Anthropic—that lets AI assistants like Claude connect to external tools, data sources, and services in a structured way.

Think of it like a plugin system, but more powerful. When you connect an MCP server to Claude Desktop (or another compatible host), you're giving the AI a live connection to something outside itself. That "something" could be:

• Your local file system
• A database or spreadsheet
• A third-party app like Slack, Google Drive, or your CRM
• A custom internal tool your IT team built

Before MCP, AI assistants were mostly one-way: you pasted information in, they gave you a response. MCP changes that. The AI can now reach out, pull data, and in many configurations, take actions.

MCP doesn't just give AI a bigger window to look through. In many setups, it hands the AI a key to the front door.

That's worth pausing on before you connect anything.

What Permissions Are You Actually Granting?

When you install and activate an MCP server, you are granting the AI model access to whatever that server is configured to touch. The scope depends entirely on how the server is built and what you authorize during setup.

Here are three common MCP server types and what they can actually do:

File system servers. These let Claude read—and sometimes write—files on your local machine or a shared network drive. If your loan operations team stores member documents in a folder, and you connect a file system MCP server, Claude could read those files during a session. That's useful for summarizing a vendor proposal. It's also something your information security policy probably has an opinion about.

Database connectors. Some MCP servers connect directly to a database—say, a reporting database fed by your core. Claude can query it, summarize results, and in write-enabled configurations, modify records. Before you connect one of these, your compliance team and IT security lead need to be in the room.

Third-party service integrations. These connect Claude to external platforms: your email, your calendar, your ticketing system. Granting access here means Claude can potentially read messages, create calendar events, or open support tickets on your behalf. Understand the OAuth scopes before you click through.

In all three cases, the AI is not acting on its own initiative during normal use—it responds to prompts. But what it can access during a session is defined by what the MCP server exposes, and that scope is set at configuration time, not at prompt time.

How Do I Evaluate an MCP Server Before Connecting It?

This doesn't require a computer science degree. It requires the same due diligence instincts you already use for vendor reviews. Here's a practical starting point:

1. Read the server's documentation. Every reputable MCP server should clearly list what resources it can access and what actions it can perform. If that documentation doesn't exist or is vague, stop there.

2. Check whether access is read-only or read-write. Read-only connections carry lower risk. Read-write connections—where Claude can modify or create data—need stricter review. Ask explicitly: can this server write, delete, or transmit data?

3. Identify where data goes. Some MCP servers route your data through third-party infrastructure. Others operate entirely locally. If member data could touch an external server you don't control, that's a vendor relationship that triggers your third-party risk management process.

4. Review the authentication model. How does the MCP server authenticate to the underlying resource? Is it using your credentials, a shared service account, or its own API key? Shared credentials with broad permissions are a flag.

5. Test in a sandboxed environment first. Before connecting any MCP server to a production environment—or to any machine that holds member data—run it in isolation. Your IT team can set up a test environment with dummy data. Verify what the server actually does before trusting it with real information.

6. Loop in compliance before you go live. Connecting AI to systems that touch member data isn't just an IT decision. It has implications under NCUA examination expectations, your information security program, and potentially your state regulator. Consult your compliance team before any production deployment. What's appropriate for your credit union will depend on your charter, your examiner relationships, and your existing policies.

Why Does This Matter More at a Credit Union?

You're not running a startup. You're running a federally insured financial institution with fiduciary responsibilities to your members, oversight from NCUA or your state regulator, and an exam cycle that will eventually ask questions about your AI usage.

And MCP is genuinely exciting. Being able to ask Claude to pull last month's delinquency trends directly from a reporting database—and get a plain-English summary in seconds—is a real productivity gain for your lending team. Having Claude draft a response to a member complaint by referencing your policy documents automatically saves your member services team real time.

But the same connectivity that makes those things possible also creates exposure. An MCP server connected to the wrong data source, or configured with broader permissions than intended, can create a situation your examiner will have questions about.

The question isn't whether to use MCP servers. It's whether you know exactly what you said yes to when you connected one.

Most of the risk here is manageable. It just requires the same governance instincts you already bring to technology decisions: document what you've connected, know who authorized it, and review it on a schedule.

A Simple Framework to Start Safely

You don't need a 40-page policy to get started. A one-page internal guideline covering three things will get you most of the way there:

• What MCP servers are approved for use, and by whom
• What data environments they're permitted to connect to (member PII should be a restricted category until your compliance team has reviewed the full setup)
• Who reviews and reauthorizes connections on a defined schedule (annually is a reasonable starting cadence)

Treat MCP server connections the way you'd treat any other third-party data access grant. Because that's exactly what they are.

What's the Risk?

For most internal, read-only use cases—summarizing board materials, pulling publicly available rate data, or querying a reporting database with no member PII—the risk profile of MCP servers is manageable and comparable to other third-party integrations you already run. If your IT team controls the server, it runs locally, and access is scoped tightly, you can move with reasonable confidence.

The risk rises sharply when MCP servers connect to systems that hold member NPI (non-public personal information), when access is read-write rather than read-only, or when data routes through external infrastructure you don't control. Those scenarios implicate your information security program, your third-party risk management obligations, and potentially NCUA examination expectations around vendor oversight and data governance. If your MCP setup touches any of those conditions, involve your compliance team before you go live—not after. For marketing copy, internal training materials, or board prep work that doesn't touch member data, the risk is low and you can move freely. For anything that reaches into the core, your loan origination system, or member account data, get compliance in the room first.

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

Frequently Asked Questions

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

The post What You’re Actually Granting When You Connect an MCP Server appeared first on CU 2.0.

There are times when credit union discussions about AI and how it’s transforming their operations detour into a reprise of the classic Wendy’s commercial: Where’s the beef?

That is: where are the measurable benefits arising from AI use?

And then into my email box pops an email from Christian Klacko, CEO of Kintera AI, who says his tools can be integrated into a credit union’s backoffice operations in 10 days and that the results come quickly.

What results?  In a case study Kintera clicks off results attained by an anonymous $3.5 billion credit union:

• A 90% reduction in file review time – from 20 minutes to two
• Big savings result for credit unions: $250,000 in the first year at the anonymous credit union

There are still more plusses ticked off by Klacko in the show.

Skeptical?  Also on the show is Kris VanBeek, now CEO at Massachusetts based Rockland Federal Credit Union, soon to be renamed Arise Financial as of August 1.  Rockland has been using Kintera tools for some months and VanBeek sings the praises of these AI tools – and he also talks about the reactions of employees as they put AI into action.

Understand it’s considered rude to ask a credit union exec if his institution is the anonymous one and of course I didn’t ask.

For the record, Arise Financial (nee Rockland Federal Credit Union) is a $3.7 billion institution.

Longtime listeners will recall that VanBeek is a past guest.  He was in episode 172 in 2021 talking about Bank Dora, an innovative neo bank created by USAlliance, where VanBeek was CEO, and three other institutions.  

The post CU 2.0 Podcast Episode 419 AI Working Miracles in Arise Financial’s Backoffice Operations appeared first on CU 2.0.

Does Your Team Know Where That Data Is Going?

You’ve seen it happen. Someone on your loan ops team gets a great idea: paste a member’s application details into ChatGPT, ask it to summarize the risk profile, and get an answer in ten seconds. Fast, useful, done.

Except it’s not done. That data just left your building.

This isn’t a hypothetical scare story. It’s a pattern happening at credit unions right now, usually without any malicious intent. Staff discover that AI tools save them time, they start experimenting, and nobody told them where the line is. That’s a data governance problem—and as the executive, it lands on your desk.

What Actually Happens When You Paste Data Into ChatGPT

OpenAI’s consumer product—ChatGPT Free and Plus tiers—has historically used conversation data to improve its models. Settings have changed over time, and users can opt out, but “opt out if you remember to” is not a compliance posture.

More importantly, the moment member data leaves your network and enters a third-party system without a proper data processing agreement, you have a problem. That’s true whether or not the data ever gets used for training. NCUA examiners and your own data security policies care about where member data travels, not just what happens to it at the destination.

Member data includes more than most people expect: names, account numbers, loan amounts, income figures, and even the combination of a ZIP code and a credit score can constitute nonpublic personal information (NPPI) under Gramm-Leach-Bliley. Consult your compliance team before deciding what does or doesn’t qualify—the line moves depending on context.

The risk isn’t that ChatGPT is malicious. The risk is that you’ve shared member data with a third party under terms you probably haven’t read, without a signed agreement, and without your members’ knowledge.

What to Do Instead

The good news: you don’t have to choose between AI productivity and data safety. You have real options, and none of them require a technical background to understand.

Option 1: Use the Enterprise Version With a Data Processing Agreement

OpenAI offers ChatGPT Enterprise (verify current pricing and terms at openai.com). Anthropic offers similar enterprise tiers for Claude. Microsoft 365 Copilot sits inside your existing Microsoft tenant. These enterprise products typically include a data processing agreement, a contractual commitment that your data won’t be used for model training, and admin controls so you can manage what your team accesses.

Before signing anything, have your compliance and legal team review the agreement. “Enterprise” on the label doesn’t automatically make it compliant for your specific situation.

Option 2: Anonymize Before You Prompt

If your team wants to use a general AI tool for analysis or drafting, teach them to anonymize first. Replace the member’s name with “Member A.” Swap the account number for a placeholder. Strip the ZIP code if it isn’t relevant to the task. What’s left is usually enough for the AI to do useful work—summarizing a loan narrative, flagging inconsistencies, suggesting follow-up questions—without sending actual member data anywhere.

This takes thirty extra seconds and meaningfully reduces your exposure.

Option 3: Build a Private AI Environment

This is the longer-term play, and it’s more accessible than it sounds. Tools like Microsoft Azure OpenAI Service or a self-hosted model let you run AI inside a controlled environment. Your data doesn’t leave your infrastructure (or your vendor’s dedicated, contracted infrastructure).

Some credit unions are exploring RAG—Retrieval-Augmented Generation—a setup where the AI can search your internal documents without those documents being baked into a public model. Think of it as giving the AI access to your policy manuals and procedure guides, but only within your walls. We’ll cover RAG in depth in a separate post.

Option 4: Use AI for Work That Doesn’t Touch Member Data

A lot of AI value has nothing to do with member data. Your team can use general AI tools freely right now for tasks like these:

1. Drafting board memos. Give the AI your bullet points; it writes the narrative. No member data required.
2. Summarizing vendor proposals. Paste in the vendor’s own document—no NPPI there.
3. Writing member-facing FAQs. The AI drafts, your team edits and approves. Clean.
4. Preparing for examiner conversations. Use AI to anticipate questions and draft talking points from public regulatory guidance.
5. Creating training materials. Policy summaries, quiz questions, onboarding scripts—all fair game.

Redirect staff AI energy toward these use cases while you build the infrastructure for safe member-data workflows. You get the productivity wins now without the compliance exposure.

How Do You Set a Policy Your Team Will Actually Follow?

A policy that lives in a SharePoint folder nobody visits isn’t a policy—it’s a document. Here’s a practical approach:

1. Name the categories explicitly. Write down what counts as member data in plain language: names, account numbers, SSNs, loan amounts, income, balances, and combinations thereof. Don’t make staff guess.
2. Create a short approved-tools list. One page. Which AI tools are approved for which use cases. If it’s not on the list, it’s not approved.
3. Train with examples, not abstractions. Show your loan ops team a before-and-after: here’s what the original prompt looked like, here’s the anonymized version. Make it concrete.
4. Build an easy escalation path. Staff will find edge cases. Give them a name to call or a channel to ask—not just a policy to reread.
5. Review quarterly. AI tool terms of service are changing fast. What’s true today may shift in six months. Put it on the calendar.

Your compliance team should sign off on the final version. This framework is a starting point, not legal advice.

Why This Is an Executive-Level Issue

You might be tempted to hand this off to IT and move on. Resist that instinct.

AI adoption is happening on your team right now, whether you’ve sanctioned it or not. Many employees at most organizations have already used a general AI tool for work tasks. At credit unions, where trust is the product, a data incident tied to an unsanctioned AI tool doesn’t just create regulatory exposure—it creates a member trust problem that’s much harder to fix.

The executives who get ahead of this aren’t the ones who ban AI. They’re the ones who build a safe path to use it well.

What’s the Risk?

The data privacy risk here is real and specific. Consumer-tier ChatGPT—Free and Plus—was not designed with GLBA compliance in mind. Pasting NPPI into those products without a data processing agreement in place puts your credit union in a difficult position with examiners, and potentially with your members. If your team is already doing this, treat each instance as a potential data incident and loop in your compliance team now. That’s not alarmism; that’s your existing incident response policy doing its job.

The path to lower risk is clear: enterprise agreements, anonymization habits, or private AI environments for any workflow that touches member data. For everything else—board memos, vendor summaries, examiner prep, training content—the risk is low and you can move freely. The main thing to avoid is a blanket “AI is fine” culture where staff assume all tools are equivalent. They’re not. Draw the line clearly, train to it, and review it every quarter as the tools evolve.

Frequently Asked Questions

This post was drafted with AI assistance and reviewed by a human at CU 2.0. AI makes mistakes; verify any specific claim before acting on it.

The post Never Paste Member Data Into ChatGPT — And What to Do Instead appeared first on CU 2.0.