Census fetched 2026-09-30 · population: NCUA 5300 call report data, cycle 2026-06 (credit unions reporting a website address in account 891) · datasets (CC BY 4.0)

The US credit union web census, September 2026: what 3,834 credit unions that file NCUA call reports publish for members, security researchers and AI agents

Every credit union that reported a website address in its June 2026 NCUA 5300 call report (3,834 credit unions) was fetched once over HTTPS on 2026-09-30, with robots.txt, security.txt (both locations), llms.txt and the A2A agent card. 3,502 answered with a website. Lists and lookup pages are ordered by total assets from the call report.

Reachable over HTTPS

91.3%

3,502 of 3,834 credit unions

security.txt

5.4%

190 of reachable sites; 180 complete and current

Accessibility statement linked

29.1%

1,018 homepages

Privacy policy linked

68.2%

2,387 homepages

Block GPTBot

35 block ChatGPT-User; 39 ClaudeBot

llms.txt

275

0 publish an A2A agent card

What we found

security.txt: 190 of 3,502 reachable sites (5.4%) publish one; 180 are complete and current (a Contact line and an unexpired Expires line, RFC 9116); 4 have expired; 4 serve it only at /security.txt instead of /.well-known/security.txt.
Accessibility: 29.1% of reachable sites link an accessibility statement from the homepage.
Privacy: 68.2% link a privacy policy from the homepage.
HTTPS: 3,502 of 3,834 domains (91.3%) answered over HTTPS; 99 answer only over plain HTTP; 53.2% of reachable sites send HSTS; 87 homepages redirect to a different domain.
AI crawlers and assistants: 2,748 sites serve a robots.txt; 45 block GPTBot, 39 ClaudeBot and 35 ChatGPT-User; 32 disallow every bot; 32 block both ChatGPT-User and Claude-User; 13 block GPTBot while leaving OAI-SearchBot allowed; 470 name an AI crawler explicitly; 19 carry a Content-Signal line.
Machine-readable surfaces: 275 publish an llms.txt and 0 an A2A agent card; 1,437 homepages carry schema.org structured data.

By charter type

Charter type	In list	Reachable	security.txt	valid	privacy link	accessibility link	HSTS	blocks GPTBot	blocks ChatGPT-User	llms.txt
federal credit union	2,330	2,075 (89.1%)	106 (5.1%)	101	67.1%	26.7%	49.2%	30	25	141
federally insured state-chartered credit union	1,429	1,356 (94.9%)	80 (5.9%)	75	69.7%	32.4%	59.4%	13	9	124
state-chartered credit union, not federally insured (NCUA type 3)	75	71 (94.7%)	4 (5.6%)	4	69.0%	33.8%	50.7%	2	1	10

By state

States with at least 20 credit unions in the list; percentages are of reachable sites.

State	In list	Reachable	security.txt	privacy link	accessibility link	HSTS	blocks GPTBot
TX	339	314 (92.6%)	10	67.8%	24.8%	53.2%	3
PA	240	213 (88.8%)	3	65.7%	30.0%	37.6%	2
NY	232	208 (89.7%)	6	66.3%	23.1%	48.1%	5
CA	228	210 (92.1%)	8	63.8%	33.3%	56.7%	0
OH	173	161 (93.1%)	9	72.0%	28.0%	49.7%	0
MI	166	157 (94.6%)	44	76.4%	25.5%	66.2%	0
IL	154	140 (90.9%)	7	70.7%	37.9%	59.3%	3
TN	111	107 (96.4%)	3	63.6%	29.0%	52.3%	1
MA	110	92 (83.6%)	4	73.9%	37.0%	54.3%	1
IN	108	102 (94.4%)	7	74.5%	32.4%	47.1%	3
FL	102	96 (94.1%)	11	78.1%	59.4%	64.6%	2
LA	102	88 (86.3%)	4	60.2%	22.7%	52.3%	2
NJ	94	81 (86.2%)	4	65.4%	27.2%	33.3%	2
WI	91	89 (97.8%)	3	75.3%	44.9%	60.7%	0
VA	81	76 (93.8%)	5	71.1%	38.2%	60.5%	0
MO	77	64 (83.1%)	3	67.2%	21.9%	46.9%	2
MN	76	73 (96.1%)	2	74.0%	24.7%	50.7%	1
AL	75	72 (96.0%)	5	79.2%	26.4%	59.7%	3
WA	73	67 (91.8%)	2	62.7%	32.8%	49.3%	1
WV	62	55 (88.7%)	1	52.7%	14.5%	41.8%	0
CO	57	52 (91.2%)	1	69.2%	25.0%	59.6%	0
GA	56	52 (92.9%)	1	67.3%	26.9%	44.2%	0
IA	56	52 (92.9%)	0	80.8%	25.0%	55.8%	0
CT	55	53 (96.4%)	1	64.2%	26.4%	66.0%	1
NC	55	52 (94.5%)	2	61.5%	38.5%	61.5%	0
MD	53	46 (86.8%)	5	78.3%	43.5%	69.6%	0
KS	52	46 (88.5%)	0	69.6%	21.7%	58.7%	1
OK	50	47 (94.0%)	2	61.7%	25.5%	61.7%	0
MS	48	41 (85.4%)	0	48.8%	22.0%	36.6%	2
NE	48	45 (93.8%)	6	84.4%	31.1%	57.8%	1
ME	47	37 (78.7%)	3	86.5%	40.5%	54.1%	0
AR	45	41 (91.1%)	2	61.0%	22.0%	48.8%	1
OR	45	41 (91.1%)	1	70.7%	24.4%	51.2%	1
KY	45	41 (91.1%)	3	61.0%	24.4%	56.1%	0
UT	42	38 (90.5%)	0	50.0%	15.8%	52.6%	1
HI	42	39 (92.9%)	4	74.4%	25.6%	64.1%	1
SC	41	40 (97.6%)	1	50.0%	37.5%	40.0%	0
NM	36	33 (91.7%)	5	72.7%	27.3%	57.6%	0
MT	35	31 (88.6%)	1	71.0%	22.6%	45.2%	0
AZ	32	29 (90.6%)	2	72.4%	13.8%	69.0%	1
SD	31	29 (93.5%)	2	51.7%	6.9%	44.8%	2
ND	25	21 (84.0%)	3	71.4%	28.6%	71.4%	0
ID	24	22 (91.7%)	0	45.5%	18.2%	36.4%	1
DC	21	19 (90.5%)	0	57.9%	26.3%	63.2%	0

Named lists

Homepages that redirect to another domain (first 60 of 87)

navyfcu.org → www.navyfederal.org · vystarcu.org → validate.perfdrive.com · sccu.com → validate.perfdrive.com · gecu-ep.org → www.gecu.com · pmcu.org → colorado.meritrust.org · nuvisionfederal.org → nuvisionfederal.com · trumarkonline.org → www.trumark.com · blackhillsfcu.org → www.bhfcu.com · cefcu.org → www.caltechefcu.org · selfrelianceny.org → srffcu.com · vibecu.com → www.vibecreditunion.com · usffcu.com → www.usfcu.com · figfcu.com → figfcu.org · c1stcu.com → www.c1stcreditunion.com · marinefederalhb.org → www.marinefederal.org · tropicalfcu.org → www.tropicalfcu.com · pelicanstatecu.com → pelicancu.com · cinfed.org → www.cinfed.com · aafcu.com → www.aacu.com · oklahomacentral.org → www.oklahomacentral.creditunion · coreplus.org → waypointcu.org · acutx.org → www.openlandcu.com · cunj.org → www.cunj.com · massmutualfcu.org → www.massmutualfcuhb.org · pahofcu.org → www.bienestarfcu.org · redcrown.org → redcrowncu.org · okfcu.com → oklahomafederalcreditunion.org · gefcuaustin.org → www.gefcu.org · ironworkersfcu.org → ironworkerscu.org · rcityfcu.org → bitly.com · mwcfcu.com → www.stmaryscu.org · bflometrocu.org → bufmet.org · riverwaysfcu.com → riverwaysfcu.org · ahcu.cc → adventhealthcreditunion.org · onecommunityfcu.net → www.onecommunityfcu.org · kpcu.org → truneighborcu.org · freedomunitedfcu.com → freedomunitedfcu.org · sspfcu.com → sunsetcu.com · mymercycu.com → www.mymscu.com · calcomcu.org → www.calcom.org · harvesterfcu.org → originscu.org · oliveviewfcu.com → oliveviewfcu.net · jeepcountryfcu.com → jeepcu.com · urmycu.com → www.urmycu.org · hcffcu.org → www.unityfincu.org · gm-fcu.org → tru-fcu.org · oswegoteacherscu.org → otfcu.com · usafedcu.com → www.southalabama.edu · bmcu.com → bmcu.net · inlandvalleyfcu.com → www.ivfcu.org · 697fcu.org → www.local697fcu.org · jacksoncountytcu.com → jacksoncounty1st.com · carolinacu.com → www.carolinacoopcu.com · hcsecu.org → hockleycountycu.org · energypluscu.org → originscu.org · nyteamfcu.org → teamfcu.org · hvcu-tn.com → hvcu-tn.net · canals-trailscu.org → canalstrails.com · tangiteachers.com → www.tptcu.com · riverforkfcu.com → www.riverforkfcu.org

Sites with a Content-Signal line in robots.txt (19)

comfedcu.org · steubencitizensfcu.com · dynamicfcu.com · srfcu.org · friendlyfcu.org · brewsterfcu.org · pbafcu.com · wsfcunion.com · frickfin.org · tworiversfcu.com · advantagefcu.org · mtfcu.org · spiritofamericafcu.org · macu.com · superiorcu.org · heritagehubfederal.org · onecreditunion.org · rctcu.com · gtkycu.com

Largest credit unions without an accessibility link on the homepage (first 60 of 300)

americafirst.com · macu.com · suncoast.com · alliantcreditunion.org · lmcu.org · iccu.com · fourleaffcu.com · vystarcu.org · globalcu.org · greenstate.org · esl.org · redwoodcu.org · pffcu.org · ecu.org · desertfinancial.com · patelco.org · logixbanking.com · psecu.com · wpcu.coop · sdccu.com · broadviewfcu.com · sccu.com · msufcu.org · summitcreditunion.com · hvcu.org · landmarkcu.com · vacu.org · bfsfcu.org · citadelbanking.com · gesa.com · uwcu.org · bcu.org · stcu.org · coastal24.com · tinkerfcu.org · trustonefinancial.org · traviscu.org · secumd.org · statefarmfcu.com · applefcu.org · truliantfcu.org · visionsfcu.org · ccu.com · americanheritagecu.org · tvacreditunion.com · kfcu.org · canvas.org · foundersfcu.com · nymcu.org · affinityplus.org · nusenda.org · robinsfcu.org · eecu.org · gecu-ep.org · sfcu.org · myconsumers.org · gosunward.org · nwfcu.org · jovia.org · oneazcu.com

What credit unions are expected to publish

Gramm-Leach-Bliley privacy notice (Regulation P, 12 CFR Part 1016): Credit unions must give members a clear notice of what nonpublic personal information they collect and share and, where sharing is optional, how to opt out (15 U.S.C. 6801-6809). Posting the notice online is one accepted delivery method; the census checks for a privacy link on the homepage. Source
ADA Title III and website accessibility: Credit unions are public accommodations under Title III of the Americans with Disabilities Act, and the Department of Justice's position is that their websites must be accessible to people with disabilities. The census checks only whether the homepage links an accessibility statement. Source
NCUA official sign on internet pages (12 CFR Part 740): Federally insured credit unions must display the official NCUA insurance sign on their internet pages where they accept share deposits or open accounts, and their advertising must carry the official statement that accounts are federally insured. Source
Vulnerability disclosure: security.txt (RFC 9116): No credit union regulator requires a security.txt, but a published contact for vulnerability reports is the standard way researchers reach a security team. RFC 9116 defines the /.well-known/security.txt location and requires Contact and Expires fields; the census marks a file complete when both are present and unexpired. Source
robots.txt and AI crawlers (RFC 9309): robots.txt is voluntary and only tells well-behaved crawlers what to fetch. The census records what each credit union asks of GPTBot, ClaudeBot, ChatGPT-User, Claude-User, Perplexity-User and Googlebot. Source

Look up any credit union

Questions

How many US credit unions publish a security.txt?

190 of the 3,502 reachable credit union websites (5.4%) publish a security.txt; 180 are complete and current and 4 have expired.

How many credit unions block AI crawlers and assistants?

45 credit union websites block GPTBot, 39 block ClaudeBot and 35 block ChatGPT-User in robots.txt; 32 block both ChatGPT-User and Claude-User, so those assistants cannot open the credit union's pages for a member who asks. 275 publish an llms.txt.

Do credit union websites link a privacy notice and an accessibility statement?

68.2% of reachable credit union homepages link a privacy policy and 29.1% link an accessibility statement. 53.2% send an HSTS header.

Which credit unions are included?

Federally insured credit unions that reported a website address (account 891) in the June 2026 NCUA 5300 call report: 3,834 on 2026-09-30, ordered by total assets. Banks are covered by the separate US bank web census.

Can I reuse the data?

Yes. The findings, the CSV and every per-credit-union JSON record are published under CC BY 4.0; cite Agent Exchange and link the report.

Method and limits

Population: NCUA 5300 call report data, cycle 2026-06 (credit unions reporting a website address in account 891) with each credit union's charter type, city, state and total assets in dollars as reported to the NCUA.. Fetch: one HTTPS request to the apex (then www.), following redirects, 8-second timeout, user agent agentexchange-census/1.0; then robots.txt, /.well-known/security.txt, /security.txt, /llms.txt and /.well-known/agent-card.json on the final host. "Reachable" means any HTTP response over HTTPS, including 403s from bot protection. Homepage links are detected from anchor targets and visible text, so a policy that exists but is not linked from the homepage is not counted. A robots.txt "blocked" verdict means the agent's own group (or the * group) disallows the whole site; "partly blocked" means some paths are disallowed. One snapshot per domain; slow sites and sites that block automated requests are counted as unreachable or reachable-with-error as the server answered. Per-domain records: lookup; downloads: CSV, NDJSON and JSON (CC BY 4.0).

Run one of these sites?

Instant AI visibility report for your credit union: $9 · $49 full report or $99 monthly monitoring · Hosted accessibility feedback and privacy request desk

Other censuses

US bank web census · Government web census (.gov) · US college web census · US school district web census · US public library web census · Top 100,000 websites census · AI crawler census (top 10,000 sites)