MeridianLink

The Clearwater precedent applied straight. A platform in market since 1998 whose core is loan origination, account opening and workflow, with a genuine embedded inference line layered over it. Strip the models and a complete lending and deposit origination system remains, fully operational. The vendor makes the point itself, positioning its advantage as being the system of record into which intelligence is embedded rather than the intelligence itself.

The agent layer branded Millie was announced in May 2026 with the first agent reaching general availability in the fourth quarter of 2026, so the flagship agentic capability is largely forward dated. What is shipped now is automated underwriting and credit risk assessment, identity verification and fraud detection, investor pricing aggregation, predictive analytics, and the Credit Mountain capability integrated into the consumer product. Consistent with the two nearest peers in the lane, both graded C on the same reasoning.

A human in the loop posture is stated plainly and repeatedly, and it is the organising idea of the company brand rather than a line of reassurance: the published position is that the workflows work alongside staff rather than replacing them. The document agent is described as producing accept or reject feedback with extracted data validated against loan requirements before it reaches the application, which places a check between extraction and use.

Held off A because no approval gate is published, no confidence threshold routing a case to a person is described, and nothing states what the agent is prevented from doing or which actions require sign off.

Compliance logic is described as embedded in the workflow and decisioning is claimed to move faster without compromising accuracy, but no accuracy figure, validation approach, benchmark, monitoring cadence or drift policy is published for any model. Decision outcome monitoring is offered to the institution as an analytics feature, which lets a customer watch its own results, but that is a reporting capability rather than a vendor statement about how its models are validated.

The A bar met squarely and three times over, which this axis rarely sees. Named customers carrying quantified outcomes: Intrepid Credit Union at 15 minutes saved per mortgage loan file through the pricing engine, and 3Rivers Federal Credit Union at 25 percent more applications instantly approved through identity verification paired with automated decisioning. A third case study reports a 50 percent increase in automation on automated underwriting.

Each links to a full case study rather than sitting as an unattributed statistic. Caveat recorded for the reader: the outcomes are attributed to the platform rather than isolated to the inference layer.

The platform publishes no position on whether customer or borrower data is used to train or improve any model, whether tenants are isolated for inference, what is retained, or for how long. The gap is consequential given the volume of consumer credit application data flowing through the platform and the stated intention to build a suite of agents across every stage of lending on top of it.

A privacy policy and an opt out preference mechanism are published, but nothing located in this pass addresses the financial privacy obligations specifically, nor customer data handling in the context of the inference products. Notable because the company both serves consumer reporting agencies as a customer segment and operates lending origination touching consumer credit data, which puts it squarely inside the statutory perimeter for privacy and consumer reporting. Banked check that would move this: the full privacy policy and the information security programme page.

The fullest security disclosure this pocket has produced. An annual SOC 2 Type II audit is stated as undergone rather than aligned with, the chief information security officer is named, and the support answers publish exact controls: data at rest encrypted with AES 256, data in transit with TLS 1.3 and a stated floor of 1.2, passwords salted and hashed. Hosting providers, availability zone spread and the disaster recovery posture are disclosed.

A private bug bounty with a crowdsourced testing provider runs alongside a public status page, and due diligence documentation is available on self service to customers. One credential deliberately refused: the security programme is described as based on the National Institute of Standards and Technology cybersecurity framework and on ISO 27001, which is alignment language and not a claim to hold the certification, so no credit is taken for it.

Not licensed or supervised in its own right as a financial institution. Flagged as live rather than settled: the company operates hosted lending origination and account opening on behalf of supervised depositories, which places it on the performing side of the line drawn by the bank service provider check, the same open sub question raised on two other builds in this session and the previous one. Nothing located either way, and a confirmed examination history would move the grade here and on the peers.

Nothing published on fairness testing, disparate impact analysis, protected class monitoring or model governance. This is the third consecutive lending platform in this pocket with the identical gap, which makes it a property of the lane rather than one vendor's oversight.

Sharper here than on the peers for two reasons: automated underwriting runs across consumer, mortgage, auto and deposit account opening at institutions serving more than half of United States credit union members, and the company actively markets financial inclusion as an outcome of its automated origination without publishing anything that would let a buyer or a regulator verify the claim.

No liability terms, indemnity position or error remediation commitment published for the inference products. Recorded because it is the closest thing to a recourse product this lane has produced and it still does not qualify: the Pathway product, built on the Credit Mountain acquisition, replaces conventional adverse action communication with a digital experience that explains the lending decision to the declined applicant and sets out steps to improve their standing.

That is an explanation reaching the affected individual, which is rare. It is graded C because it offers no route to dispute the decision, no path to correct the underlying data and no explanation of the model, and because its stated purpose is to keep the declined applicant with the institution rather than to give them redress.

No model provider, model family or version named for any shipped capability or for the announced agent layer. The distinction matters and is worth applying consistently: two cloud providers are named, but as infrastructure hosting the vendor's servers, not as the source of any model. Naming the compute host is not naming the supplier of the inference, and only the latter tells a buyer whose model is deciding on a loan application.

The vendor is the system of record for lending and account opening at its customers rather than a layer integrating with one, which is the principle this axis follows. Data Connect exposes structured origination data back to the institution with data models and dictionaries, up to three years of history, and daily plus intraday refresh, so origination data can be combined with other enterprise sources. A Marketplace partner network carries third party identity, fraud and engagement integrations. The successor architecture spans lending and deposit account opening on one platform.

A real deployment disclosure rather than a corporate footprint. The hosting model is named as hybrid, with products running in the vendor's own colocation data centres as well as on Microsoft Azure and Amazon Web Services across multiple availability zones, and a disaster recovery site established in a separate region. Held off A because no customer selectable region is offered, no residency commitment is made for any jurisdiction, and the split of which products sit on which infrastructure is not published.

No price, no pricing page, no published starting figure or unit of charge. Every commercial route on the site terminates in a demo request or an interest form. As a listed company it reports revenue, but revenue disclosure is not price disclosure and tells a buyer of this record nothing about what the platform or the intelligence layer costs.

Five distinct institution types addressed separately rather than listed: credit unions, banks, mortgage lenders, auto lenders and consumer reporting agencies. Published scale includes 700 billion dollars of loan volume and a claim to serve more than half of all United States credit union members. Segment breadth is unusually wide for the lane, covering consumer lending, mortgage, digital account opening and deposits, indirect and auto, collections, analytics and background screening.

Held at A despite a materially United States only footprint, because the axis measures institution and segment breadth together and the segment coverage here is broader than the global peer graded A in the same pocket.