nCino

The established platform shape, and the fifth graded this way in one session, which is worth noting as a consistency check rather than a coincidence. The company now describes itself as the platform for agentic banking, but the residue test does not follow the branding: strip every model out and the loan origination, credit workflow, deposit account opening, mortgage and portfolio management platform that has been sold since 2012 continues to work, and the orchestration layer has nothing left to orchestrate. That the marketing has moved further than the architecture is the point of grading this axis by residue rather than by self description.

A governance layer is named and placed squarely in the path: every AI action is described as passing through an orchestration system that deploys, coordinates and governs it, carrying identity, execution, memory, observability and compliance. Structurally that is the right shape for a high grade. Held off A on the distinction this ladder exists to draw: the architecture is named and not one control is.

Banking specific guardrails names no guardrail, compliant and controlled names no rule, and no threshold, approval gate or escalation route appears anywhere. That is the same failure recorded against a much larger collections vendor whose agent adjusts to regulatory requirements without naming a single requirement, and it should be graded the same way even when the surrounding architecture is more convincing.

Held at C deliberately, and the reasoning is worth keeping because the temptation ran the other way. The company states its intelligence is engineered with audit trails, explainability and rule anchored logic, and lists observability among the orchestration layer's properties.

That is three nouns and a category, not a mechanism: no model documentation, no accuracy or performance figures, no validation approach, no benchmark, no stated failure modes and no drift policy, for models operating inside credit workflows. A vendor that names explainability without describing what is explained, to whom, or at what point in the decision has published a value rather than a control.

Meets the bar cleanly and with the strongest single deployment account in this session. A named United States commercial bank is running two custom agents comprising sixteen skills in production, its chairman and chief executive is quoted by name, the configuration is described specifically, and one agent using document intelligence to maintain relationship records is reported to have cut task time by sixty percent, with a stated target of making frontline commercial bankers substantially more productive.

Two further institutions are named live, one a large Norwegian bank running international corporate lending. Named institution plus quantified outcome plus a named executive on the record is the A bar as written.

The pooled corpus is disclosed and quantified rather than hinted at: the intelligence is stated to be informed by more than 1,800 institutions and over fourteen years of banking outcomes, meaning other institutions' real lending decisions, portfolios and workflows. Held off A because no terms accompany the disclosure, with nothing on consent, contribution as a condition of use, opt out, use limits or treatment on exit.

Worth recording a rhetorical move that recurs across this index in other forms: the reassurance offered is that the corpus is not the open web, which answers a question about provenance quality while directing attention away from the question of whose data it is and on what basis it is there.

No published privacy posture located: no data processing terms, no subprocessor list, no retention or deletion commitments and no position on any financial privacy regime, for a platform that holds borrower financial detail, credit files and account opening records across thousands of institutions.

No certification or trust portal located in this pass, and an unverified credential earns nothing even where one is near certain. Banked check, cheap and likely to move this: a listed platform holding lending systems of record for thousands of supervised institutions will hold service organisation control reporting at minimum, and quite possibly reporting over controls relevant to financial reporting given that loan data feeds the allowance and the accounts. Look for a dedicated trust or compliance page.

A listed company rather than a licensed or supervised financial firm. Banked check, and this is the second vendor in the same session where it applies: whether a provider hosting and processing lending systems of record on behalf of banks and credit unions falls inside examination authority for bank service providers.

The standing rule from an earlier correction in this index is that the authority attaches to performing the service rather than to licensing software the institution runs itself, and a hosted platform of this kind sits on the performing side of that line.

No fairness testing, no protected class analysis, no governance disclosure on this axis, and the exposure is the largest of any vendor built in this session. This is a lending platform. Agents operating inside commercial and consumer credit workflows sit closer to fair lending obligations than almost any other application in this index, and disparate impact in credit is the one area where supervisors have decades of enforcement history and explicit expectations. A company marketing role based agents into that workflow while publishing nothing on fairness leaves its customers to answer a question the supervisor will certainly ask.

No recourse route and no allocation of responsibility. The chain is short and consequential: an agent maintains relationship and credit records, those records inform a lending decision, and a borrower declined on the strength of them has no visibility of the agent's contribution and no route to contest it. As throughout this index, the regulatory exposure lands on the institution rather than on the platform that supplied the intelligence.

Four named intelligence layers, five named role based agents, a named orchestration system and a named protocol for connectivity, and not one model, provider, architecture or version named anywhere. The naming energy goes entirely into the vendor's own product vocabulary, which is a pattern worth watching: an elaborate proprietary taxonomy can read as technical disclosure while answering none of the questions a model risk function would ask.

It is the system of record for lending at thousands of institutions rather than a layer integrating into someone else's, which is the structural condition this grade describes, and it reaches outward from that position through interfaces and protocol servers to the systems an institution already runs.

The delivery model reinforces it: a forward deployed engineering team builds agents inside the institution's own environment alongside its staff, which is integration depth demonstrated by how the work is done rather than asserted in a datasheet.

Cloud delivered, with European deployments implying regional infrastructure that is never stated. Nothing published names a region, a residency commitment, a tenancy model or a hosting option, which is a real gap for a platform holding loan files and credit decisions for institutions supervised on both sides of the Atlantic.

No price, tier or unit published for the platform or for the agentic products. Enterprise sold through direct engagement, with a listed parent reporting subscription revenue at group level rather than by product.

More than 2,700 institutions spanning the full size range, from community banks and credit unions through independent mortgage banks to the largest global entities, with named live deployments in North America and Europe. Product coverage runs across commercial lending, small business, consumer lending, mortgage, deposit account opening, portfolio management, risk and compliance. Few vendors in this index cover that many institution types and lending lines from one platform.