Top 10 AI Agents forCredit Unions in 2026

The CFPB's 2023 issue spotlight on chatbots in consumer finance and the Government Accountability Office's GAO-25-107197 cite the same source for the economics of conversational AI in banking: a Juniper Research press release dated 24 July 2017.

It appears at footnote 14 in the CFPB spotlight and at footnote 22 in the GAO report. It is not a study. It is a forecast, and it says so in its own first line:

Juniper forecasts that chatbots will be responsible for cost savings of over $8 billion per annum by 2022, up from $20 million this year.

— Juniper Research press release, 24 July 2017 — the Wayback capture GAO itself cites

The underlying report is paywalled and no methodology is published anywhere. And the figure that travels furthest from it — roughly seventy cents saved per interaction — does not appear in the release text at all. Both agencies present the economics as settled. Neither measured anything.

That is this article's thesis, proven at the highest level available: a vendor produces a number, a credible institution repeats it with the attribution intact, and every downstream writer drops the attribution. By the time it reaches a board packet it looks like a federal finding. The same pattern is the reason this ranking scores contract terms, attestations and documented integrations rather than performance — the approach we take across our whole AI agent ranking series, and one you can apply to any vendor pitch that lands on your desk this quarter.

The CFPB's other headline figures are equally derivative, and worth knowing because they turn up constantly. The claim that over 98 million users, roughly 37 percent of the US population, engaged with a bank's chatbot in 2022 is itself sourced to Insider Intelligence, a paid research firm, writing about one bank's assistant — attribute it that way. The claim that 80 percent of consumers who interacted with a chatbot left feeling more frustrated traces to a Forbes contributor column reporting a survey by a contact-centre vendor, with no sample size published. What the CFPB document does verify in its own voice is narrower and more useful: each of the top 10 largest commercial banks has deployed chatbots.

This is not a hypothetical failure mode. A US regulator has already found that exactly this kind of number was materially misleading. In the Matter of Presto Automation Inc., Securities Act Release No. 11352 and Exchange Act Release No. 102177, decided 14 January 2025, is believed to be the SEC's first AI-washing enforcement action against a public company. Presto told investors its drive-thru voice AI delivered over 94% accuracy even in noisy environments. The SEC found the product lacked the capability to take orders on their own and required substantial human involvement, with human order takers located abroad, primarily in the Philippines and India, who processed the vast majority of drive-thru orders.

The framing matters and is routinely mangled. Presto consented without admitting or denying the findings. The remedy was a cease-and-desist order with no civil penalty — nobody was fined. The findings are against Presto only; the order's Supplier A is a separate company against which the SEC made no findings whatsoever. And Presto Automation Inc. is not Presto Phoenix Inc. Read narrowly, the order still says the thing that matters here: the one time a US regulator actually audited a vendor's published AI performance metrics, the metrics did not survive contact.

So the ranking below scores nothing that a vendor published about its own performance. No containment rate, no deflection rate, no approval lift, no hours saved, no ROI. Those are the columns every competing listicle fills, and not one cell in any of them is checkable by you.

Everything scored below is something you can re-check yourself in about thirty minutes, from public sources, without an NDA. Everything refused is something only the vendor can assert.

Date checked: 23 August 2026. Vendor pages change without notice, and several in this set changed materially during 2026. Re-check before you sign, not before you shortlist.

Never scored:accuracy, containment, deflection, resolution rate, approval lift, ROI, time saved, hours returned, CSAT lift. Every published figure in this market is vendor marketing about itself. Where a vendor number appears in this article it is labelled as the vendor's claim and used as evidence about the vendor, not about the product.

For that reason the integration column below is headed documented integration programme, never certified or approved — Jack Henry expressly declines to endorse. A missing entry means not in that directory as of 23 August 2026; it does not mean the vendor works with no core at all. And we checked the core providers' own directories rather than the vendors'. That surfaced three findings worth the exercise on its own: zero of seven major AI lending and service vendors appear in the Fiserv DNA AppMarket, so a credit union on Fiserv DNA has no listed DNA integration from any of the best-known names; Corelation applies an explicit KeyBridge Certified badge that neither interface.ai nor Posh carries even though both are listed, so the core itself distinguishes listed from certified; and Q2 states that it performs code reviews, tests the app deployment and completes an integration review of every app, which is the most substantive published verification standard we located anywhere.

One more scoring rule, and it is the one that decides most of the table: every row needs a citation or the literal words not publicly disclosed. We never estimate a price. If pricing is gated, the cell says so — and in this market that cell says so eleven times out of twelve.

Ten vendors, six columns, every cell either citable or marked not publicly disclosed. Checked 23 August 2026.

Read the ownership column first. Four of the best-known names in this category changed hands or changed names during the last twelve months, and a five-year core-adjacent contract signed into an unresolved ownership question is a governance problem before it is a technology one.

The pricing column is the fastest read in the table. Of twelve vendors examined, exactly one publishes a price. The only other verifiable commercial term located anywhere in the market is a co-operative purchasing arrangement — the Cooperative Credit Union Association offers specially priced Posh solutions to credit unions under $300 million in assets — and even that publishes no figure.

The ordering reflects one thing: how much of what matters to a $100 million to $5 billion credit union this vendor lets you verify before you sign. It is not a quality ranking, because nobody can produce one.

Ten more names appear in competing 2026 rankings and should not. Six are dead names, acquisitions or roadmaps; four are excellent companies that are simply not AI agents.

The Scienaptic residency language deserves a second read, because it is the finding on this list most likely to matter to your board. Your obligation under 12 CFR Part 748 Appendix A follows member information maintained by or on behalf of the credit union. Four words that put the vendor inside your obligation. A privacy policy that permits processing in any country around the world under the law of another jurisdiction, with no DPA, no subprocessor list and no retention period published, is not a policy you can reconcile with that scope in a board report. There is a caveat worth stating fairly: a website privacy policy may not govern the customer master agreement. But nothing customer-facing is public, and you cannot put an unread agreement in a vendor file.

NCUA is the only federal banking regulator that cannot examine the technology vendors its institutions depend on — and 12 CFR 748.1(c) still requires the credit union to report the vendor's breach within 72 hours of being told about it.

The federal banking agencies can examine a bank's technology service providers directly under the Bank Service Company Act at 12 U.S.C. 1867(c). NCUA cannot. Its equivalent authority came from the Examination Parity and Year 2000 Readiness for Financial Institutions Act of March 1998, and NCUA's own March 2022 white paper puts the date on it flatly: this authority expired on December 31, 2001. As of 23 August 2026 no enacted statute restoring it was located, and legislative vehicles have repeatedly stalled — with credit-union trade groups themselves among the opponents. Do not write that Congress has never acted; write that as of the date you checked, no such authority had been enacted.

The most revealing passage in that white paper is about what happened when NCUA asked nicely:

Until 2013, the NCUA conducted third-party vendor reviews on a voluntary basis. Several vendors declined the NCUA's examination requests for voluntary examinations, and other vendors rejected the NCUA's recommendations to implement corrective actions to mitigate identified risks.

— NCUA, Third-Party Vendor Authority white paper, March 2022

The same document records that in 2016 the federal banking agencies discontinued NCUA's participation in significant service provider examinations, because NCUA is not statutorily authorised to conduct them. So when a bank buys the product in the table above, its regulator can go and look at the vendor. When a credit union buys the same product, nobody can — except the credit union. One hundred percent of the diligence burden is yours.

Two documents that are frequently handed to credit unions and do not apply. The Interagency Guidance on Third-Party Relationships published at 88 FR 37920 on 9 June 2023 was issued by the Federal Reserve, the FDIC and the OCC. NCUA was not an issuing agency — and that omission is meaningful, because NCUA islisted as an issuing agency on other interagency documents when it participates. A federally insured credit union's obligations run through NCUA Letter to Credit Unions 07-CU-13 and 12 CFR Part 748 instead. The practical expectations overlap heavily, but citing the wrong document in your vendor file is exactly the sort of thing an examiner notices. A community bank reader supervised by the FDIC or OCC is covered by the 2023 guidance; say which applies to which.

And the CFPB is probably not your examiner. Bureau supervisory authority over depositories starts above $10 billion in assets under 12 U.S.C. 5515(a); at $10 billion or less, 12 U.S.C. 5516 puts the examination with the prudential regulator, with the Bureau able to include examiners on a sampling basis. So for a credit union under $10 billion, the CFPB writes the rules and NCUA runs the exam. The rules bind you either way — Regulation B applies to a $300 million credit union exactly as it applies to a $300 billion bank; only the examiner changes. Any article framing CFPB retrenchment as the rules relaxing is wrong twice over.

GAO's May 2025 report puts the supervisory gap in sharper terms than NCUA does. It found that NCUA's model-risk guidance addresses only interest rate risk modeling and was last updated in October 2016, and concluded that it could not compare that guidance against the NIST AI Risk Management Framework because the guidance's limited scope did not allow for a meaningful comparison. It also records that NCUA has issued one document of resolution related to AI use since fiscal year 2020, plus a regional director letter to a credit union for insufficient governance, reporting and risk mitigation for an AI-driven program that instantly approved loans without traditional underwriting steps such as income verification. That is the shape of the enforcement risk: not the AI, the governance.

The commercial half of the constraint has a federal regulator behind it too. In a Request for Information published at 90 FR 54882 on 28 November 2025, the OCC wrote that consolidation in the core service provider market can result in reduced competitive pressure, reduced negotiating power for many community banks vis-a-vis their core service providers, resulting in potentially burdensome contractual provisions and bundled products that raise fees, and a sense that many community banks do not believe their core providers are partners committed to their long-term success. Citing Federal Reserve Bank of Kansas City research, it noted that the three largest core service providers served more than 70 percent of depository institutions in 2022, with the largest alone serving 42 percent. It also named the increasingly high capital costs associated with switching core service providers. Whether an AI agent can read and write to your core is therefore controlled by a third party with no contractual obligation to your project — the constraint we work through in detail in our guide to integrating agents with legacy core systems.

One live dispute is worth a sentence, stated precisely. A coalition of credit unions is suing Fiserv over what the complaints describe as improper early-termination and deconversion fees, and the court denied Fiserv's motion to dismiss on 18 June 2026. Dollar amounts are not public. A denied motion to dismiss is not a finding of liability — it means the claims survive to be litigated. If the case proceeds, it may produce the first credible deconversion figures anyone has put on the record.

Regulation B no longer contains the disparate-impact effects test. The final rule at 91 FR 21620, published 22 April 2026, took effect on 21 July 2026 — five weeks before this article. It is in force, it is being challenged, and it has not been enjoined.

Quote the amendatory text, not a law-firm summary. 12 CFR 1002.6(a) now reads, in full as adopted: except as otherwise provided in the Act and this part, a creditor may consider any information obtained, so long as the information is not used to discriminate against an applicant on a prohibited basis. The Act does not provide that the effects test applies for determining whether there is discrimination in violation of the Act. That final sentence is the change. What it replaced was language pointing to ECOA's legislative history and the Supreme Court's employment-law effects-test cases. The same rule also narrowed the discouragement provision at 1002.4(b) and added conditions on special purpose credit programs at 1002.8.

Three framings are all wrong and all circulating: enjoined, struck down, and citing the old effects test as current. The correct sentence shape is the boring one — in force, under challenge, not enjoined. Confirm the docket and posture yourself before printing a case caption; ours comes from legal press reporting rather than a docket pull.

What did not change is the part that governs an AI lending agent day to day. 12 CFR 1002.9(b)(2) was not amended by the 2026 rule. It says the statement of reasons for adverse action must be specific and indicate the principal reasons, and that statements that the action was based on the creditor's internal standards or policies, or that the applicant failed to achieve a qualifying score on the creditor's credit scoring system, are insufficient. Read that twice. A score-based denial with no specific reason is insufficient on the face of the regulation — no interpretive guidance required. The credit union is the creditor. The model is proprietary and the vendor will not tell us are not defences available under that text.

Two housekeeping facts, because both are commonly got wrong. CFPB Circular 2022-03, on adverse action notification in connection with credit decisions based on complex algorithms, was withdrawn on 12 May 2025as item 14 in a batch of 67 guidance documents at 90 FR 20084; Circular 2023-03 was item 7 in the same notice. Withdrawn is not repealed, vacated or overruled — it removes the Bureau's interpretive gloss, not the statutory duty. Anyone writing that the CFPB dropped the AI adverse-action rule has inverted the law.

There is a genuine irony here worth one sentence, and no competing listicle will have it. Vendor marketing in this category has leaned for years on disparate-impact-style fairness testing across protected classes. The federal regulatory theory that made that framing commercially compelling was narrowed on 21 July 2026 — while the adverse-action obligation that explainability actually serves was left completely intact. The compliance case for model explainability got stronger relative to the marketing case for fairness dashboards, not weaker.

An independent fair-lending monitorship of one AI lender exists, it was adversarial and methodologically explicit, and it ended without agreement. No independent benchmark of any commercial AI agent product in banking exists at all. Hold that distinction precisely — a blanket denial would be false.

Start with the claim that made AI lending respectable in this industry. The figures — 27 percent more approvals and 16 percent lower average APRs — are cited across the trade press, in vendor decks and in board packets as a CFPB finding. The CFPB disclaimed them in writing, in the same blog post that published them. Its 6 August 2019 post states that the No-Action Letter recipient agreed to allow the Bureau to share key highlights from simulations and analyses that it conducted, and that the simulations and analyses were not separately replicated by the Bureau. The independent monitor confirmed the same point at footnote 83 of its Initial Report of 14 April 2021: the CFPB did not separately replicate these analyses.

Then check the one document where a securities lawyer reviews every sentence. Upstart's FY2025 Form 10-K, filed 10 February 2026, contains zero occurrences of no-action letter, of 27 percent, of 16 percent lower, and of access to credit. The claim is absent precisely where liability attaches for saying it. That is the cleanest possible demonstration of the through-line in this article: a number that is fine for marketing and not fine for the SEC.

The No-Action Letter is also dead, and it died at the recipient's request. The CFPB terminated it on 8 June 2022, at Upstart's own request, because Upstart wanted model changes that would not be possible if the Bureau conducted the appropriate level of monitoring and review. No replacement exists. And the Bureau's current No-Action Letter policy, applicable 10 January 2025, narrates the episode in its own words: outside observers appear to have interpreted the NAL as an endorsement that Upstart's model did not violate the ECOA. It records that the independent monitor ended the relationship after coming to an impasse with Upstart about how to assess compliance with ECOA, and that the monitor detected that the model caused statistically and practically significant adverse approval and denial disparities for Black applicants. The policy then draws the operational conclusion: the Conditions also prevent firms from advertising the receipt of a NAL, which can create the false appearance of endorsement or favored regulatory status. The regulator has now banned the marketing use of the thing your vendor may still be citing.

The monitorship itself is the genuinely independent work, and it is unflattering in a way no vendor whitepaper ever is. Relman Colfax, with Sentrana Inc. and BLDS, LLC, conducted a fair-lending examination of Upstart's model under a December 2020 agreement among Upstart Network, the NAACP Legal Defense Fund and the Student Borrower Protection Center. Four public reports ran from April 2021 to a Final Report dated 27 March 2024. It found no evidence that variables acted as close proxies for race, national origin, sex or age. It also identified approval disparities for Black applicants and a likely viable less discriminatory alternative model, and raised concerns that educational criteria can lead to discriminatory lending outcomes, particularly for communities of color. And then it stopped:

the Parties remain at an impasse over the appropriate and legally required methodology for assessing whether the performance of a potential less discriminatory alternative model would be comparable to the performance of an existing model.

— Relman Colfax, Upstart fair-lending monitorship, Final Report, 27 March 2024

Quote it carefully. This is a monitorship report, not a regulator's finding and not an enforcement action. Upstart was never found to discriminate and was never fined. What it is, is the only time anyone independent has examined one of these models adversarially and published the result — and the result was an unresolved methodological dispute between serious people. That is what genuine scrutiny of these systems looks like, and it is the honest answer to any vendor that tells you fairness is a solved engineering problem.

Two further notes on figures in this corner of the market. Zest AI's approval-lift claim has drifted while the phrasing stayed fixed: its 8 September 2021 press release said a 15 percent increase in approval rates with no added risk; its 2026 site says lift approval rates 25 percent without additional risk and lift approvals by 30 percent on average across protected classes. Same construction, 15 to 25 or 30 percent over five years, and the methodology was published at no point in between. And Upstart's current headline comparison is built on a baseline of its own construction — a small Cox model Upstart itself built, trained on Upstart's own loan book and run on Upstart's own applicant pool. It is not a comparison against any credit union's actual underwriting. We do not quote Upstart's 2026 marketing figures here because upstart.com returns HTTP 403 to every automated request and we could not verify the current page text; treat any figure you see attributed to it as a vendor claim until you have loaded the methodology page yourself.

The last thing to say about Upstart is structural rather than statistical. On 23 July 2026 the OCC granted conditional approval for Upstart Bank, N.A., with FDIC and Federal Reserve applications pending. A company whose lending platform many credit unions rely on has taken the first regulatory step toward becoming a competing depository. That belongs in your concentration analysis, not just your vendor file — and it is a useful reminder that a five-year contract is a bet on a counterparty's strategy, not only on its software.

Only one vendor in this market lets you do arithmetic before signing an NDA. So we do the arithmetic on that one, and label the rest as unknowable — which is itself the finding.

The one calculation you can actually run. Hapax publishes pay-as-you-go at $2.50 per credit with no monthly fee, and Pro at $150 per user per month including 85 credits, with additional credits at $1.50. Take a credit union with 40 staff you would put on an internal knowledge agent. At Pro, that is 40 x $150 = $6,000 a month, or $72,000 a year, with 3,400 credits a month included. If half those users exceed their allowance by 20 credits a month, add 20 x 20 x $1.50 = $600 a month, or $7,200 a year — a total of roughly $79,200. You can build a board paper from that today, without a call. For every other vendor in the table, the same paragraph cannot be written at all, because the input does not exist in public. When you are comparing options, that asymmetry is real information: one vendor has decided you may plan, and eleven have decided you may not.

The second calculation, and it is the one that actually protects you. Your 72-hour clock under 12 CFR 748.1(c) starts when the third party notifies you. If the vendor contract says notice within a reasonable period, assume five business days — and your filing window has closed before you knew anything. Negotiate a defined figure. A 24-hour vendor notification SLA leaves you 48 hours to triage, confirm scope and file. A 48-hour SLA leaves you 24. Anything vaguer than a number in hours is a term that transfers regulatory risk to you for free.

Not a loud outage. Silent, plausible wrongness under load — output that looks exactly like correct work, produced at a volume no one is sampling.

Prompt injection is unsolved, and every agent here reads untrusted input. Member messages, uploaded pay stubs, emailed statements, dispute documentation, vendor remittance advices — any of those can carry instructions aimed at the model rather than at the reader. There is no reliable defence at the model layer, so treat this as blast-radius reduction rather than prevention: separate identities per agent instead of a shared service account, least-privilege scopes bound to the specific operations a workflow needs, no write credential live in a session that is reading untrusted content, reversible writes wherever the core allows them, per-action audit logging that names both the agent and the human it acted for, and a kill switch that revokes the credential rather than pausing the code. Be sceptical of any vendor advertising a detection rate for injection attempts.

Four failure modes with a detection signal for each. Reason-code drift — adverse-action notices start converging on two or three generic reasons; detect by sampling denials monthly against the underlying decision data. Escalation collapse — the agent stops handing off, because handing off scores badly on containment; detect by tracking the escalation rate as a floor, not a ceiling, and alarm when it falls. Third-party model change — your vendor's underlying model provider ships an update and behaviour shifts overnight; detect by running a fixed regression set of real historical cases weekly, which is only possible if you built one on day one. Vendor incident — you learn from the vendor, on their timetable, and your 72-hour clock is already running.

Rollback has to be a contract term, not a hope. Before go-live, confirm in writing: who can disable the agent, how fast, without the vendor's help; whether decisions made during the failure window can be identified and re-run; and what happens to your data and your logs on termination. A vendor that cannot answer the termination question in the contract is a vendor whose exit you have not priced.

For calibration, the most useful non-vendor data point available: the Bank of England and FCA's November 2024 survey of 118 firms found 75 percent using AI — and only 2 percent running it fully autonomously. The gap between adoption and autonomy is where the whole market actually sits, whatever the product naming suggests.

An agent may prepare and queue a credit decision; a human must adjudicate it, and the adverse-action notice must state the actual principal reasons — a score alone is insufficient under 12 CFR 1002.9(b)(2).

Every line below traces to a citation in this article rather than to an opinion. Put it in the vendor file and in the procedure document, and make the vendor initial it.

Two of these are more commonly breached than the others. The BSA line matters because the independent-testing pillar at 12 CFR 748.2(c)(2) is where an alert-triage agent gets audited: if an agent suppresses, ranks or closes alerts, its behaviour is inside the tested program and you must be able to reconstruct why any given alert was dispositioned. Model opacity is a BSA problem, not only an ECOA problem. And the UDAAP line matters because there is no AI-specific safe harbour and no AI-specific guidance — the exposure under 12 U.S.C. 5531 and 5536 is ordinary UDAAP exposure applied to a new speaker. If the agent tells a member a product is suitable, the credit union said it.

If you build rather than buy, these are our bands. They are the same bands we publish everywhere, and we do not vary them by vertical.

Senior-led delivery at $150–$225 per hour; retainers $2,500–$9,500 per month; a 30-day post-launch warranty; and a fixed-price phased proposal within 5 business days of the discovery call. Full source-code and IP ownership transfers to you — which for a regulated institution is not a nicety, because it is the difference between an exit you control and a deconversion you litigate. We are a senior-led Black-owned Los Angeles agency, and you can reach us on +1 (424) 272-5601 or book directly at calendly.com/frenchydigital/discovery-call.

The honest comparison against buying is rarely price. It is whether the workflow you want automated is one of the four or five that vendors have productised — member service, dispute handling, alert triage, onboarding, internal knowledge — or something specific to how your institution actually runs. If it is the former, buy, and spend the saved effort on the diligence file. If it is the latter, nobody is going to build it for you, because the addressable market is one credit union.

Every red flag below was observed during this research, in this market, on a named vendor's own public materials. None of it is generic advice.

Each of these was chased to origin. Where the origin does not support the claim, we say so and print nothing — and your vendor should be held to the same standard.

Also refused, per this series' standing list: the MIT-attributed claim that 95 percent of GenAI pilots fail, which rests on 52 interviews and 153 conference surveys of custom tools; the claim that 85 percent of AI projects fail, which misquotes a 2018 prediction about output quality; the claim that 87 percent never reach production, which originates in a sponsored post's rhetorical question; and the Gartner figure that 40 percent of agentic projects will be cancelled by 2027, which measured investment posture rather than project outcomes. We also do not print credit-union-specific core market-share percentages, because none could be verified to a primary source — the 70 and 42 percent figures above describe depository institutions, which is what the OCC actually said.

A ranking that refuses vendor claims and then hides its own uncertainty has learned nothing. Everything below is a gap in this article, stated plainly, checked on 23 August 2026.

• There is no independent evaluation of any product ranked here. We scored disclosure quality, which is a proxy for institutional seriousness — not for whether the software will do your work well.
• Whether Congress has enacted NCUA third-party vendor examination authority as of your reading date. Re-check congress.gov; this is the fact on this page most likely to move.
• The CFPB's current institutional condition — funding-cap figures, staffing levels, reduction-in-force litigation and the current Director. Both gao.gov and consumerfinance.gov block automated fetching, so we built no argument on any of it. The load-bearing facts here are the $10 billion supervisory threshold and the Regulation B amendments, both of which are verified.
• The FinCEN AML/CFT program rule's final status and compliance date, the Corporate Transparency Act beneficial-ownership regime in 2026, and any CDD rule revision. All unverified. NCUA's own letter says only that significant developments and changes in the regulatory system are expected in 2026, which is a safe way to describe the landscape without asserting a status.
• The docket number and current posture of the Regulation B challenge come from legal-press reporting rather than a docket pull. Confirm on PACER or CourtListener before printing a case caption.
• The Federal Reserve Bank of Kansas City core-concentration briefing was not read directly — the host blocks automated fetching — so the 70 and 42 percent figures are cited as quoted by the OCC in the Federal Register, which is itself a primary source.
• Upstart's current 2026 marketing figures could not be verified; upstart.com returns HTTP 403 to automated requests and no 2026 archive capture was available. We describe the comparison structure and quote nothing.
• Two findings from the Relman Colfax Final Report — the absence of close proxies and the approval disparities for Black applicants — come from the monitorship record rather than a direct read of the full PDF. The two passages we quote verbatim were verified at source.
• Unit21's current chief executive. Two sources conflict and we printed no name.
• Alkami's partner directory could not be checked at all; alkami.com/partners returns HTTP 403 to every method including a real browser. Those cells are unverifiable rather than absent, and we say so.
• Credit-union-specific core market-share percentages. None verified to a primary source; we print the depository-institution figures the OCC actually published.
• Adoption, customer-count and scale figures throughout this article are vendor-published without exception and are attributed in text wherever they appear.

Two cross-ties belong here rather than in the vendor entries, because they are structural rather than damning. A former Acting Comptroller of the Currency sits on one vendor's board and advises another in this table. And a credit-union-owned venture fund has money in two of these vendors and gave one of them an award. Neither is a scandal — the CUSO structure exists precisely so credit unions can invest in their own infrastructure, and two of the decisioning vendors discussed here are CUSOs with credit-union investors. But it does mean several of the awards and strategic investments these companies cite are not arm's-length, and should not be read as third-party validation.

The honest closing position. Most of the products above are eighteen months old or less, in a market that has watched one leader acquired in June, one rename itself in February, one delisted in October and one of its best-known lending platforms apply to become a bank in July. The constraints, by contrast, are between five and twenty-five years old and are not moving: NCUA cannot examine your vendor, you must still report its breach in 72 hours, your adverse-action notice must state real principal reasons, and your core provider controls whether any of this connects to anything. Buy against the constraints, not against the roadmaps — and treat every performance number in this category as marketing until somebody publishes a methodology, which in this vertical nobody yet has.