What's the Dilly-o with consumer loan origination: a buyer's guide for credit unions

The Dilly-o

For most credit unions, we'd pick an LOS that already connects to your core, keep the credit rules in your own hands, and settle exit terms before you sign. NCUA says no credit union should hand loan approval authority to a third party.³ Its guidance also says credit unions should set an exit strategy with all third-party and CUSO loan origination relationships.⁴

How we'd size up a vendor

1. Core fit - is the system listed in your core provider's partner program, and for which products? We'd also ask for a reference credit union of your size that boards loans to the same core today.
2. Decision control - can your own lending staff change the approve, decline or refer rules without a vendor ticket? We think rules that only the vendor can change make it harder to show an examiner that approval stays with you.
3. Fair lending proof - can the vendor show which factors drove each decline and how it tests its models for disparate impact? Ask to see a sample adverse action notice built from a real decision.
4. Exit terms - what will it cost to leave, and how fast do you get your data back in a usable format? Get that answer in writing, priced, before you sign.

What changed this year

On September 11, 2026, NCUA joined the FDIC, Federal Reserve and OCC in proposing principles-based third-party risk management guidance.⁵ Rules on member-permissioned data that could feed loan applications remain unsettled, so keep any data integration module flexible.

Will it work with your systems?

MeridianLink is on Corelation's KeyStone preferred partner list under lending.^C Narmi is KeyBridge certified on KeyStone, but for digital and member experience rather than lending.^C Q2's product overview calls CL Originate a loan origination and underwriting product for banks, credit unions and fintechs.⁶ TurnKey Lender announced a partnership with Alkami.⁷ Ask your digital banking provider and your core provider which LOS they already connect to.

What other credit unions did

MeridianLink announced that A+ Federal Credit Union, with 193,000+ members and more than $2.6 billion in managed assets, selected MeridianLink One to update its loan origination system.⁸ In March 2025, Credit Union 1 said it would implement nCino across commercial, consumer and indirect lending.⁹ MIT Federal Credit Union began a personal lending partnership with Upstart in 2024.¹⁰ For the downside, one NCUA Inspector General review tied a $4.24 million loss to poor underwriting, weak monitoring and a troubled core conversion.¹¹

What your examiner will ask

NCUA lists what third-party contracts should cover at a minimum.¹²¹³ The list runs from service levels and audit rights to data security, business resumption and termination clauses.¹²¹³ It also says it is prudent to have qualified outside counsel review the contract.¹⁴ The new Regulation B rule did not change adverse action notice requirements, so your notices need to be right.¹⁵ Have ready your due diligence file, the signed contract, your exit plan and the vendor's fair lending test results.

What it costs

One buyer's guide says every cost figure has to come from a written proposal.¹⁶ For credit unions of $250 million to $1 billion, it gives a range of $80,000 to $300,000 or more a year.¹⁷ It puts implementation at $40,000 to $150,000 for credit unions under $250 million.¹⁸ At $250 million to $1 billion, it says complex multi-product, multi-core migrations can reach $500,000 to $750,000.¹⁹ Per-seat pricing is common for platforms such as nCino.²⁰ One review puts nCino at about $50,000 to $150,000 a year, plus Salesforce costs.²¹ Watch annual escalators: a 3% escalator on a $150,000 base adds $24,000 by year five.²² Model any per-loan fee at 100%, 150% and 200% of today's volume, and price de-conversion help at signing.²³²⁴ NCUA says early termination, escape clause and default terms are often negotiable.²⁵ A talk on negotiating core contracts notes that most require non-renewal notice at least 180 days in advance.²⁶

Food for thought

FinCEN warned in November 2024 that criminals use generative AI to make deepfake ID documents, images, video and audio to beat identity checks.²⁷ We think the next question for any LOS vendor is how its identity checks hold up against a deepfake ID or a fake face.