A bank or credit union should evaluate a banking intelligence platform by testing it on the institution’s own risk, compliance, lending and operational records against seven criteria, and by keeping the third-party and model risk records the purchase creates.
This guide covers the scope of the purchase, the evaluation steps, a scorecard, those supervisory records and the Predict360 Data Intelligence Layer.
What a Banking Intelligence Platform Purchase Covers
A banking intelligence platform loads an institution’s risk, compliance, lending and operational records into one linked model and runs analytics or AI across them. It is the working layer behind banking intelligence.
The criteria apply to banks supervised by the OCC, the Federal Reserve and the FDIC, and to NCUA-supervised credit unions. The chief data officer holds architecture and data quality. The chief risk and chief compliance officers hold the records examiners review, while security, third-party risk and, where models are present, model risk management assess their parts.
Running the Evaluation on the Institution’s Own Data
Choosing a banking intelligence platform follows four steps, in order:
- Requirements
Each requirement starts from a question the institution answers for examiners or the board and names the records the answer needs.
- Data inventory
Systems the platform must reach are listed with each one’s owner and known data quality issues.
- Proof of concept
Each candidate loads records the institution selects from its own systems and is rated on the scorecard below. The proof of concept includes tracing an already reported finding back to its source record.
- Due diligence and contract
Third-party due diligence and contract negotiation finish before signing.
The institution sets the proof-of-concept duration, record volume and pass criteria in its own procurement policy.
Banking Intelligence Platform Scorecard
The scorecard rates each candidate on seven criteria, including human review of AI outputs, at three levels: Not demonstrated, Partly demonstrated, or Demonstrated with evidence. The institution sets any weighting in its own policy.
| Criterion | Demonstrated with evidence when | Record to keep |
|---|---|---|
| Data coverage | Selected records load and link to shared customers, loans, partners and controls | Systems loaded and not reached |
| Data lineage and audit trail | A reported figure traces to its source record and document version; changes and approvals carry user and date | Lineage trace for a known finding; audit log |
| Explainable AI with human review | Each AI output shows its sources, and a named reviewer approves it before it enters the record | Reviewed output with sources and approver |
| Security and access control | Role-based access limits who sees customer data; the vendor’s security program is assessed | Independent security assessment |
| Integration | The platform reaches the inventoried systems and returns or destroys institution data at exit | Integration list; data-return clause |
| Vendor due diligence | The vendor evidences financial condition, information security, operational resilience and subcontractors | Due diligence results and recommendations |
| Model risk treatment | The vendor documents each model’s design, development data and performance, and flags generative or agentic AI | Model inventory entry or out-of-scope determination |
Third-Party Risk Records the Purchase Creates
For banks, the Federal Reserve, the FDIC and the OCC issued the Interagency Guidance on Third-Party Relationships in June 2023. Its due diligence factors include legal and regulatory compliance, financial condition, information security, operational resilience and reliance on subcontractors.
Four of its contract topics bear directly on a data platform:
- Whether data generated by the third party becomes the bank’s property.
- Limits on the use and disclosure of bank and customer information.
- Periodic independent audits, and the bank’s right to conduct its own.
- Timely return or destruction of the bank’s data at termination.
Planning and risk assessments, due diligence results and executed contracts appear on the agencies’ list of documentation observed in effective third-party risk management, and examiners may perform transaction testing.
A proposal from the OCC, the Federal Reserve, the FDIC and the NCUA, published on 15 September 2026, would replace the 2023 guidance. It is not final as of publishing this article.
Connected Banking Data in the Predict360 Data Intelligence Layer
The Predict360 Data Intelligence Layer is the shared data foundation for Predict360 capabilities and Ask Kaia agents. It links customers, deposits, transactions, loans, partners, risks and controls using common definitions, and traces derived findings through their source data and transformations.
Document findings are bound to the passage and version they came from, conflicting source values are recorded for reviewers to resolve, and history is retained for point-in-time review.
Frequently Asked Questions
Is a Banking Intelligence Platform a Third-Party Relationship?
Yes. The 2023 Interagency Guidance addresses any business arrangement between a banking organization and another entity, by contract or otherwise, and a vendor contract for a data platform is an arrangement of that kind.
What Data Does a Banking Intelligence Platform Use?
The platform draws on the institution’s risk and compliance records (obligations, policies, controls, issues and examination findings), lending and deposit data, partner and vendor records, and the documents behind them. The data inventory decides which systems load first. Banking data intelligence depends on shared definitions, so a customer, loan or partner carries the same identity in every source.
How Do Credit Unions Evaluate Data Analytics Platforms?
Credit unions can use the same scorecard, with NCUA frameworks for the third-party rows. Part 748 Appendix A asks each credit union to exercise appropriate due diligence in selecting service providers, require safeguards by contract and, where its risk assessment indicates, review their audits.
The Predict360 Enterprise Risk Management Software ensures managers have complete visibility of enterprise risk on a single dashboard.
Request Demo- Cloud-Based
- Risk Repository
- Assess Risks
- Real-time Monitoring