Is it compliant for credit unions to use transaction data for retention?

It can be, when handled carefully. Use member data in line with GLBA and your privacy notice, apply FCRA rules if credit bureau data is involved, price rate matches consistently under Reg B, and respect TCPA and CAN-SPAM. Retention systems should be designed to log every outreach for examiner review.