Yesterday’s commentary argued the core wars moved upstairs - that the ledger is settled ground and the competition is for the layers above it. This Spotlight maps the ground itself, because settled does not mean static: in the past eighteen months one of the four major bank cores announced a consolidation of three platforms into one, a global vendor sold its US core business to a Canadian consolidator that has already relaunched it under a new name, an AI-native core startup went from launch to incumbent ownership in a season, and the credit union market’s independent challenger signed thirty-eight institutions in a single year. We apply the same discipline as every Spotlight: confirm every vendor is active, verify who owns them today, note who they serve - banks, credit unions, or both - and name only the clients we can substantiate. And this time the map is organized the way our research organizes the market: by generation - because in core processing, the architecture you buy determines the options you keep.

A core processing system is the bank’s system of record: the ledger that holds accounts and balances, posts transactions, accrues interest, and feeds everything else this series has covered - digital banking, account opening, payments - which all ultimately read from and post to it. Two facts frame every core decision. First, replacement risk is existential and customer-invisible, which is why the market’s dominant modernization path is wrapping the core with modern layers rather than replacing it, per the Kansas City Fed’s framework. Second, the contract now matters more than the code: integration fees, certification schedules, and exit terms determine what an institution may buy from everyone else in this series.

What Moved in This Market

The pattern is the story here too. Our team at CCG Catalyst summarizes the moves that reshaped the core landscape:

Four Generations: How to Read This Map

Our research organizes core systems by generation - a framework we have published in full, from the evolution of core banking technology through generation-by-generation Sector Spotlights on the first, second, third, and fourth generations:

Three cautions before the roster. First, generation describes architecture, not quality - a first-generation core is not automatically old in any way that matters to your strategy, and more than fifty first-generation cores remain supported in the US because they work. Second, the boundary between the third and fourth generations is blurry by our own published admission; the honest differentiator is that third-generation systems are less “choose your own adventure.” Third - and this is the trap - a generation cannot be bought cosmetically: a first-generation product can gain a browser, APIs, and a cloud hosting contract without becoming new technology, because the test is where transaction authority, business logic, product configuration, and data ownership actually live. Put most concretely: a core that has never been rewritten - whose posting engine is still the original COBOL, RPG, or Progress code - is still a first-generation core, whatever the interface, the hosting contract, or the marketing says. The code is the generation; everything layered on top is access. Where our published research has classified a product, we say so below; other placements are our architectural assessment and are marked as such.

Landscape at a Glance

This list is not exhaustive and does not include all vendors in the space - if you are a vendor not featured here, please contact us so we can consider updates.

Generation One: Installed Majority

This is where most US institutions bank today, and it is not going anywhere soon - which is precisely why the majors' strategies are consolidation and modernization-in-place rather than replacement.

Fiserv (NYSE: FI) - the market leader by installations and owner of four of the ten first-generation cores in our research: Premier, Precision, Cleartouch, and Signature. CoreAdvance modernizes the portfolio in place - introduced April 2025, Premier as the foundation with the best of Cleartouch and Precision folded in, positioned as an upgrade for Premier banks rather than a conversion. First clients were “live” by late 2025, but our advisory work indicates phase one was infrastructure consolidation - merging Premier's split IBM DB2/AS400 and Unisys environments and Precision's Progress-based code onto common plumbing, invisible to users - not yet a new data model. Named adopters include Home Federal Bank, West Coast Community Bank, and United Prairie Bank; OceanFirst Bank ($14.5 billion) extended Premier and committed to deploy CoreAdvance. The diligence: get the migration path, timing, cost - and what “live” means for your bank - in writing. Fiserv's second- and fourth-generation offerings appear below.
Website: www.fiserv.com

Jack Henry - SilverLake and CIF 20/20 are named first-generation cores in our research, joined by Core Director for banks and Symitar’s Episys - the largest single credit union core franchise, first-generation by the same architectural definition - on the credit union side. Jack Henry has the most transparent modernization posture among the majors: a multi-year rebuild toward cloud-native components, and platform documentation stating it is working toward third-party core integration alongside its own - the open-ecosystem bet, consistent with its marketplace strategy across this series.
Website: www.jackhenry.com

FIS - HORIZON, IBS, and Systematics are its first-generation bank cores per our research, serving community through enterprise tiers, with AffinityEdge (the Miser heritage lineage) serving credit unions. FIS was also the year’s most aggressive buyer of the layers - Dragonfly, Amount, OpenCoreOS - and its 2026 momentum - the $100 billion M&A-created institution, five de novos, and Mercury’s charter build - shows where core growth comes from. Profile and the Modern Banking Platform appear in the second- and fourth-generation sections.
Website: www.fisglobal.com

CSI - privately held (Centerbridge/Bridgeport), the fourth name in bank core conversations: NuPoint, a named first-generation core in our research, delivered service-bureau style, with Meridian as the materially installed legacy line. The most acquisitive per dollar of revenue - Apiture, Qolo, and Velocity Solutions in under three years, pitched explicitly across other vendors' cores - so for a community bank, CSI is now as much a cross-core stack vendor as a core.
Website: www.csiweb.com

DXC Technology (Hogan) - the enterprise end of the first generation, by our assessment: the Hogan systems run on client-operated IBM mainframes at some of the largest deposit bases in the country, with a hybrid-cloud modernization path rather than a replacement pitch. If you are inheriting Hogan in a merger, the diligence is the modernization roadmap and the skills pipeline, not the sales deck.
Website: dxc.com/platforms/hogan

Independents and cooperatives - This tier is where small independent bank cores are being absorbed by long-hold software owners. Constellation’s CORA Group took Phoenix (now PhoenixWorx); Vencora holds Datapro; Banyan took ASI. Separately, Finovifi bought Modern Banking Systems—an add-on by a growth-oriented fintech, not a classic perpetual consolidator. For banks on these systems the processor usually changes without a conversion, so diligence shifts from “will they be acquired?” to “what does the roadmap look like under this owner?” Client-owned cooperatives are a different case. Architectures in this tier run from first- to later-generation product by product—ask, don’t assume.

COCC - the Northeast's client-owned cooperative, serving both banks and credit unions - Metro Credit Union and Workers' Credit Union on the CU side, MCS Bank a named April 2026 selection on the bank side - and, properly read, an operator as much as a vendor: COCC's INSIGHT platform is built on Fiserv's DNA core, which COCC has developed on and operated for two decades, with roughly 140 client institutions running DNA through COCC today. The ownership is the pitch - clients are the shareholders, and the model has carried COCC past $224 million in annual revenue - but the roadmap behind the code is written at Fiserv, not in Southington. See the delivery note below.
Website: www.cocc.com

DCI (Data Center Inc.) - Hutchinson, Kansas; iCore360, delivered hosted or in-house - and the governance is the pitch: DCI is privately owned by the community banks it serves, several of whom sit on its board. Best fit: a community bank that wants a voice in its vendor's direction and relationship-grade service, and is willing to trade the majors' ecosystem breadth for it.
Website: www.datacenterinc.com

FPS GOLD - Provo, Utah; one bank core (GOLD), banks only, delivered from its own data center with an integrated digital banking suite and an active partner ecosystem. Best fit: a community bank that wants a single accountable vendor running core and digital together, stable and long-tenured - price the trade: a smaller roadmap budget than the majors, so confirm investment plans and take references at your asset size.
Website: www.fps-gold.com

ASI - Automated Systems, Inc. (Banyan Software) - Lincoln, Nebraska; the Insite Banking System, acquired by Banyan Software in August 2024 to anchor Banyan’s new Financial Institutions Group, which then added American Bank Systems in January 2025. Banyan is a buy-and-hold-forever acquirer - the roadmap-under-new-economics question applies in full.
Website: www.insitebanking.com

Modern Banking Systems (Finovifi) - Kearney, Nebraska; the small-bank core acquired by Finovifi in early 2025 along with Modern Banking Systems of Alabama as part of a fintech roll-up strategy. Same question, new owner.
Website: www.modernbanking.com

IBT Apps - Cedar Park, Texas; banks only. The roots matter: IBT began as a layer and service bureau whose Integrated Bank Environment ran on top of an FIS legacy core - today's i2Suite (IBT Core, teller, digital) is its own cloud-based, open-API platform, historically strongest with banks in the $100 million to $500 million range. Best fit: a small community bank that wants a modern, single-vendor cloud suite with high-touch conversion support - and ask in diligence which components are IBT-authored versus partnered.
Website: www.ibtapps.com

Smiley Technologies - Little Rock, Arkansas; founder-led community bank specialist running SIBanking as a vendor-operated service bureau. The smallest of the independents by footprint, and the reference-call discipline applies at full strength.
Website: www.sibanking.com

Datapro - Miami-origin core with an international and US foreign-bank-office base, now under Vencora, Constellation Software’s financial software arm - the permanent-hold pattern’s second appearance in this tier.
Website: www.datapromiami.com

The credit union heritage and small-institution tier. The same architectures, the same questions, plus a clear credit union pattern: cooperative ownership as the counterweight to consolidation.

CU*Answers - the cooperative CUSO model: CU*BASE, owned by the credit unions it serves, now delivered through the browser-based CBX environment, with a live 2025-26 conversion pipeline (York Educational FCU and African Diaspora FCU among recent names). The interface has moved to the browser; the family's longevity - and the ownership structure - is the point: your core vendor's exit horizon is your own.
Website: www.cuanswers.com

Fiserv (heritage credit union estate) - Portico remains an actively marketed hosted CU core, but the wider heritage estate - DataSafe, Spectrum, Galaxy, XP2, CUSA, and others - is materially installed with no public end-of-sale or end-of-support schedules. If your credit union runs one of these, the single most valuable diligence item is the roadmap and migration obligation in writing, because the public record will not tell you.
Website: www.fiserv.com

Sharetec - under Evergreen Financial Technology Group, with a long-tenured small-CU base and a new flagship, Velocity - centrally hosted, browser-based SaaS. Cloud-delivered, which is not the same claim as cloud-native; ask which one the contract describes.
Website: www.sharetec.com

Deda Sphere - Dedagroup’s North American CU arm, consolidating two core families under one owner: i-POWER (the former EPL platform) and Share One’s NewSolutions, with the VisiFI base folded in. A European industrial owner rather than a permanent-hold fund - but the two-cores-one-owner roadmap question is the same.
Website: www.dedasphere.com

FLEX Credit Union Technology - Sandy, Utah; one continuously modernized FLEX System, in-house or hosted, moving from desktop to browser without a rip-and-replace. Best fit: a small-to-midsize credit union that wants full functionality from a single vendor, steady ownership, and a migration path that never forces a conversion event.
Website: www.flexcutech.com

CompuSource Systems - Pittsburgh; CompuShare 5.0, an in-house Windows core with a remote-managed option. Best fit: a small credit union that wants its core in the building, local control, and predictable cost - the deliberate counterexample to the assumption that every specialist is marching to mandatory cloud delivery.
Website: www.css4cu.com

FedComp - Fairfax, Virginia; Platinum, in-house or service bureau, serving the very smallest credit unions - the single-sponsor, faith-based, and association shops the larger vendors no longer price for. Best fit: a micro credit union that needs core, share drafts, and compliance basics at a survivable cost. The base is material but aging, and reported Trellance ownership is unconfirmed on current first-party pages - which is itself a diligence finding.
Website: www.fedcomp.com

Aurora Advantage CU (CSPI / Embrace Software) - the former Jack Henry CruiseNet core, acquired by CSPI in 2020, rebranded Aurora Advantage, and now under Embrace Software with CSPI since 2025 - three owners in a decade, so lineage is the diligence. Best fit: a small credit union that wants core, digital, and back-office from one Midwest-based team - and the questions are roadmap investment under the new owner and references from credit unions that made the CruiseNet-to-Aurora transition.
Website: auroradigitalbanking.com

Generation Two: Real Time Before the Cloud

Product-centric, client-server origins, real-time functionality - and the proof that generation is not destiny, because the most successful conversion franchise in today’s market is winning with an architecture from this era.

Fiserv DNA - a named second-generation core in our research: the relational, real-time core Fiserv acquired with Open Solutions in 2013, serving banks and credit unions on both sides of the house. It sits outside the CoreAdvance consolidation, which makes the DNA roadmap question a live one for banks and credit unions alike: where does a core outside the consolidation sit in a strategy organized around it?
Website: www.fiserv.com

PhoenixWorx (CORA Group) - the former Finastra Phoenix core and Malauzai digital, relaunched under CORA on September 14, 2026 as PhoenixWorx: 200-plus organizations served, Bank Midwest and Community Choice Credit Union among named clients, a 130-partner integration ecosystem, and a NOVA Banking offering pairing Malauzai with a lighter Phoenix variant for digital brands. Phoenix is a named second-generation core in our research, and the relaunch is the first real evidence of what a permanent-hold owner does with one - invest and rebrand, at least so far. For Phoenix institutions the question has moved from “what happens to us” to “what does the investment level look like in year three.”
Website: www.phxworx.com

Corelation - San Diego, privately held, and the momentum story of the entire core market: 38 new credit union signings in 2025 - a record for the third straight year - totaling $50.9 billion in assets, with 28 conversions completed in the year, and the $59 billion State Employees' Credit Union, the nation’s second-largest, selecting KeyStone. KeyStone is person-centric and real-time, institution-operated on IBM Power or x86 - by our assessment an architecture of this generation, not a cloud-native one, which is exactly the point: conversions are won on fit, service, and references, not on generation labels.
Website: www.corelationinc.com

FIS Profile - a named second-generation core in our research: real-time, high-availability, with a material global base; large production proof is mostly non-US, so the standing question applies for a domestic shortlist.
Website: www.fisglobal.com

Infosys Finacle - a named second-generation core in our research with a deep installed base abroad; verified 2025-26 named US community wins are absent from the public record, so for a US community or regional institution this is an enterprise conversation, with the burden of proof on the vendor.
Website: www.edgeverve.com/finacle

Generation Three: Built for the Cloud, Sold as a Suite

Real-time operation, cloud-built, modern RESTful APIs - delivered as a fuller-stack, vendor-led suite. As our research puts it, third-generation systems are less “choose your own adventure” than the fourth generation: more turnkey, more vendor support, less composition left to the buyer.

Temenos Transact - the strongest recent US wins among the internationals: Regions Bank’s deposit system modernization and a “leading US regional bank” SaaS core deal, alongside its payments hub at Commerce Bank - plus a standalone deposits domain for component buyers. Component replacement at the regional tier is its US lane.
Website: www.temenos.com

TCS BaNCS - now carrying the most important completion proof in the US market: Zions Bancorporation finished its eleven-year FutureCore program in July 2024 when the deposit platform went live - consumer lending in 2017, commercial and construction lending in 2019, deposits last, with thirty teams working in parallel on the final phase. Phased component replacement can finish at the regional tier; it costs a decade, and Zions' leaders say the honest lessons out loud. That is the reference story to study before any full replacement.
Website: www.tcs.com

Oracle FLEXCUBE - a named third-generation core in our research, with Oracle also selling modular account services for component buyers; disclosed current US community deployments are sparse, so the enterprise-conversation rule applies.
Website: www.oracle.com

Nymbus Core - a named third-generation core in our research, and the challenger with the cleanest recent community proof: PeoplesBank converted to Nymbus Core in June 2025 - one of the few genuine US community whole-bank conversions to a challenger in the recent record - with MSUFCU running the core conversion plus a small business bank-in-a-box.
Website: www.nymbus.com

SAP Fioneer (Transactional Banking) - named in our third-generation research; the enterprise end of this generation, with a European center of gravity and no named US community deployment in the public record.
Website: www.sapfioneer.com

Generation Four: Composable and Cloud-Native - Where Replacement Actually Happens

Process-centric, composable, modular, cloud-native - and the section where the ledger-replacement record deserves precise reading, because the pattern of where it happens is the finding.

Thought Machine - London-based, valued at $2.7 billion with Temasek, Morgan Stanley, and Intesa Sanpaolo among its investors, and the fourth-generation challenger with genuine named US clients - read carefully: JPMorgan Chase selected Vault to replace its US retail core, and Arvest Bank, the Walton-family regional, is live on Vault at the product level - an equipment-financing lending line launched in 2023 - with the whole-bank conversion phased, while USSFCU and Pathward are announced transformations without a publicly confirmed production cutover. Internationally the roster keeps growing at the top: Deutsche Bank’s Private Bank selected Vault in August 2026 to consolidate core systems, alongside Lloyds, Standard Chartered, ING Poland, Kiwibank, and SEB. The client list is the thesis in data: ledger replacement is real at institutions with money-center and large-regional budgets and engineering staff, it arrives one product domain at a time, and no US community-scale conversion is in the named record.
Website: www.thoughtmachine.net

Finxact (Fiserv) - the US-born fourth-generation ledger, and the one that took the acquisition exit: now Fiserv’s sidecar strategy - launching products and brands beside a legacy core - with Flagstar Bank’s phased core migration, begun August 2026, as the category-defining evidence that the sidecar path can end at the ledger, one contained domain at a time.
Website: www.finxact.com

FIS Modern Banking Platform - the incumbent-built fourth generation: componentized, cloud-deployed, sold at the top of the market, and the existence proof that an incumbent can build new rather than only buy. First deployments run enterprise-scale; community relevance is downstream.
Website: www.fisglobal.com/products/fis-modern-banking-platform

10x Banking - founded by former Barclays chief Antony Jenkins, with UK scale heritage, and the most telling strategic pivot in the category: it now leads with a “meta core” that wraps legacy cores rather than replacing them, with Zafin as a partner for the product layer. No named US client yet - but when the core challengers themselves start selling wrapping, yesterday’s thesis has been conceded by the people with the most incentive to deny it.
Website: www.10xbanking.com

Mambu - Amsterdam-based SaaS ledger, fifteen years old, composable and cloud-native by our assessment, with a global base that runs to fintechs, lenders, and European banks (Western Union’s European operations, Germany’s OYAK ANKER Bank among named customers). It is explicitly targeting US credit unions - but its public customer roster names no US financial institution, so the standing question applies in full: who, exactly, is live here?
Website: www.mambu.com

Open Banking Solutions (OBS) - Boca Raton-based, with the most instructive founder credential in the tier: chairman Louis Hernandez Jr. built Open Solutions - the company behind the DNA core Fiserv acquired in 2013 - and his private equity firm, Black Dragon Capital, assembled OBS from a Miami-based international core provider (ASI Group, renamed Ladonware in 2021, then Open Banking Solutions in 2022; no relation to the Nebraska ASI above). CloudCore is classified as a fourth-generation system in our published research, with an international operating history the company puts at 25 years across 15 countries, brought to the US market in 2023 and expanded with a full digital services suite in January 2025. Now the adoption reading, precisely: the named implementation in the record is BANDEX, a Dominican development bank, announced as an implementation start rather than a completed cutover; the named US credit unions around the company are investors and strategic partners, not customers - and an investor is not a customer. No named US bank or credit union core conversion appears in the public record yet, so the reference call is the entire diligence.
Website: www.openbankingsolutions.com

Q2 (Helix) - the banking-as-a-service lane of this generation: a cloud core that is the explicit system of record for sponsor-bank and embedded-finance programs (Bangor Savings Bank, 2025), with the CorePro lineage behind it. It is bought as a program platform, not a whole-institution conversion - which is a different contract and a different risk model.
Website: helix.q2.com

Technisys Cyberbank Core (SoFi) - cloud-native core acquired by SoFi in 2022 and now sold through SoFi’s technology arm. The architecture is this generation’s; the diligence is commercial: your core vendor’s parent owns a bank that competes for your customers.
Website: tech.sofi.com

Blossom - the credit union side’s cloud-native entrant, which acquired the CUProdigy core estate (roughly 19 credit unions at the source date) and names Blackhawk Federal Credit Union as live on its combined core and digital platform - a vendor-stated claim without a customer-side confirmation yet, so weigh it accordingly.
Website: www.blossom.net

Finzly - BankOS, payments-led with account infrastructure; strongest as the payments and sidecar layer, as covered in our September payments Spotlight - riding beside the core rather than replacing it.
Website: www.finzly.com

Watch List: Real Cores, No US Landing Yet

Five names with genuine core products and no named US production conversion - kept separate because a selection is not a go-live, a sponsor-bank program is not a core client, and bounded foreign production is not US proof.

Pismo (Visa) - live in bounded Brazilian digital-bank programs (BTG Pactual, Itaú's iti), and selected by Citi Treasury and Trade Solutions for corporate demand deposit accounts with initial US scope - a future-tense selection at a money-center, worth watching for exactly that reason.
Website: www.pismo.io

Tuum - Estonian-built, with named European primary-core production (LHV Bank, Multitude) and one US-adjacent foothold: Zenus Bank in Puerto Rico, live on bounded accounts and payments modules.
Website: www.tuum.com

Mbanq - Nebula, with named European core operations, and US business that runs through sponsor-bank BaaS programs - none of whose sponsor banks are shown to run Mbanq’s core.
Website: www.mbanq.com

Engine by Starling - Starling Bank’s own core, licensed as managed SaaS, with live overseas clients (Salt Bank in Romania, AMP in Australia) - and the most deliberate North American entry among the European challengers: a dedicated North American subsidiary and Tangerine, Scotiabank’s Canadian digital bank, as its first client on this side of the Atlantic. Canada is not the US - but a bank-built core with a tier-one North American reference is the entry pattern to watch.
Website: enginebystarling.com

Finastra Universal Banking (Essence) - the part of Finastra’s core franchise that did not go to CORA, and it is changing hands too: Pollen Street Capital agreed in September 2026 to acquire the Universal Banking unit, Essence’s home. Essence has credible overseas production, and the one named US selection - Delta National Bank, 2022 - has no public go-live. Essence is not Phoenix, and by next year neither will be Finastra’s; do not let the name blur any of the three.
Website: www.finastra.com

The rest of the UK and EU core field, for completeness, mostly stops at the water’s edge - worth knowing because these names surface in analyst coverage and RFP long lists. Avaloq (NEC-owned, private banking and wealth) has no named US core client; ERI’s OLYMPIC Banking System signed a US distribution partnership in 2023 with no named US conversion since; SBS (the former Sopra Banking Software, now under 74Software) does its US business in auto and equipment financing, not core processing; and Skaleet, Banqsoft, Profile Software’s Finuevo, and CR2 (a digital and payments layer, not a core, now owned by Morocco’s HPS) show no US regulated-institution evidence at all. For a US buyer, none of these belongs on a shortlist today - and a systems integrator who suggests otherwise should be asked the standing question: who, exactly, is live here?

Delivery: Who Actually Runs Your Core

More of this landscape than the industry's shorthand admits is delivery rather than authorship - companies that host, operate, and service another vendor's core, and nowhere more than in the credit union market. The distinction doubles the diligence: one company wrote the code and owns the roadmap; another runs it and owns your uptime, your integrations, and a second contract. Under the Bank Service Company Act the operator is examinable either way, and under the agencies' September functional definition, both are core providers. The names below are the ones a community institution most often actually buys from:

Navanta - the delivery-channel entry: UFS and BankOnIT united as Navanta in March 2026, serving more than 700 community financial institutions with hosted core banking - including operated Fiserv Premier and Precision environments - private cloud, cybersecurity, and advisory. Navanta is not a core author - it is how many community banks actually receive and run their core, which makes it part of the landscape and part of the diligence: when your core is hosted, the host’s capabilities and contract are a second vendor decision.
Website: www.navanta.com

COCC - see the independents tier above: the INSIGHT platform is Fiserv's DNA, operated and developed by COCC for two decades for both banks and credit unions - the client-owned cooperative delivery model applied to another vendor's core.

Member Driven Technologies (MDT) - the CUSO that hosts and operates Jack Henry's Symitar core for credit unions nationwide, a Jack Henry business partner across two decades - for many Symitar credit unions, MDT is the vendor they actually call.
Website: www.mdtmi.com

Synergent - the Maine Credit Union League's service organization, hosting Jack Henry's Symitar for credit unions across New England and beyond, with a steady public record of named renewals.
Website: www.synergentcorp.com

The pattern extends further: CU*Answers' CU*BASE also reaches many credit unions through its network of partner CUSOs, and across the small institution market a large share of cores are delivered by a processor rather than by the company that wrote them. The practical test belongs in every renewal: identify who owns your core's roadmap and who runs its daily operations. When they are two different companies, you are managing two contracts, two exit clauses, and two sets of service levels - and the September joint statement's factor list applies to each.

Layer Above the Core

Yesterday’s commentary mapped the four floors; here is the roster, floor by floor, with the evidence.

Product and pricing hubs - define, price, and bundle products outside the core:

Zafin - Toronto-based, majority-owned by Nordic Capital since 2024; the category’s reference name, with Wells Fargo, PNC, and Navy Federal among company-stated clients, partnerships spanning Microsoft Azure AI, 10x Banking, and Fiserv’s Finxact - and the new floor under construction: AIOS, an agent operations platform to govern AI agents doing banking work. Founder Al Karim Somji’s departure for OpenCoreOS - and FIS - is the story yesterday’s commentary told in full.
Website: www.zafin.com

SunTec (Xelerate) - private, founder-led, the enterprise relationship-pricing and billing specialist, with a US-specific account analysis product and a Curinos data partnership. No named US clients in the public record - anonymized enterprise deals are the norm here, but the reference question stands.
Website: www.suntecgroup.com

Oracle Revenue Management and Billing - the installed-base enterprise pricing engine, actively maintained but not an active US mid-market seller; relevant when you inherit it, rarely when you shop.
Website: www.oracle.com

FintechOS - the community-market entrant with fresh momentum: $28 million raised in September 2026 for US expansion, profitable in the first half, US revenue up 130% year over year, with ESL Federal Credit Union, Vibrant Credit Union, Hanscom FCU, and Farmers Bank of Willards among named US clients - plus the Finastra origination partnership noted in our account opening Spotlight. The product-lifecycle layer arriving at community scale.
Website: www.fintechos.com

Servicing orchestration - run account servicing and case workflows across systems:

Savana - Malvern, Pennsylvania; banker and customer servicing workflows across cores, with Woodforest National Bank and Primis Bank as named clients. Its public cadence has been quiet since the 2022 Georgian-led round - the flag is an analyst-call question, not a red one.
Website: www.savanainc.com

Pega (NASDAQ: PEGA) - the enterprise end of the same floor: packaged banking service and onboarding applications atop its workflow engine, competing with Savana only at the top of the market, and now shipping the agentic compliance CLM covered in our account opening Spotlight.
Website: www.pega.com

Kinective - the community-FI operations consolidator: formed in 2023 from CFM, NXTsoft, and IMM under OceanSound Partners, then acquired Janusea (core connectivity) and ESQ (ATM operations) in 2025. A strong community bank and credit union installed base, counts not public.
Website: www.kinective.io

Integration middleware - managed connectivity between digital, fintech, and core:

PortX - Seattle-area integration platform whose October 2025 growth round tells you who wants it to exist: backed by Allied Solutions and the American Bankers Association, alongside BankTech Ventures and the credit union fund Curql - the industry funding its own escape from integration lock-in. Listed in Jack Henry’s VIP program and Fiserv’s AppMarket.
Website: www.portx.io

Sandbox Banking (Glyue) - acquired by nCino in February 2025 for $52.5 million plus earnout; 75-plus institutions across 14-plus cores, company-stated, now serving as nCino’s integration layer. The middleware floor’s proof that the consolidation pattern reaches every story of the building.
Website: www.sandboxbanking.com

CU NextGen - the credit union CUSO on this floor, which acquired Constellation Digital’s platform in January 2026; 90-plus credit unions, company-stated - the surviving CU-side middleware entrant.
Website: www.cunextgen.com

Launch sidecars - covered in the fourth-generation section above, with one update worth elevating: Flagstar Bank began a phased core migration to Finxact in August 2026 - the category-defining sidecar-to-core win of the year, and evidence that the sidecar path can end at the ledger after all, one contained domain at a time. Nymbus adds MSUFCU (core conversion plus a small business bank-in-a-box), and Q2’s Helix (Bangor Savings Bank, 2025) runs the banking-as-a-service variant of the same model.

The consolidation warning from yesterday applies to every independent above: Fiserv bought Finxact, FIS bought OpenCoreOS, nCino bought Sandbox, Kinective bought Janusea, CU NextGen absorbed Constellation. The layer built to abstract the incumbents keeps becoming their property - price your contracts, and your exit rights, accordingly.

Series Tied Together: The Regulators Moved First

This Spotlight closes the series, so step back and read the whole arc - because it started somewhere specific, and it was not with a vendor. On September 11 the federal banking agencies released a proposed rewrite of the interagency third-party risk management guidance and a joint statement on community banks' engagement with core service providers, covered in our September 15 commentary, “The Regulators Answered,” where I called it the most meaningful rebalancing of the bank-vendor relationship the agencies have put on paper in many years. The agencies did not write a list of companies; they wrote a functional definition - transaction processing, account management, payments processing, compliance and reporting, online banking, and “other material functions.” Read against this series, that definition is a table of contents. The payment rails we mapped in September, the digital banking vendors of October 7, the account opening stack of October 14, the architecture of October 21, and every core and layer in this Spotlight - under the agencies' one-sentence test, can your institution operate without this vendor tomorrow, nearly every company named this month is standing inside the circle they drew.

What has happened since then says the window is real. The proposal was published in the Federal Register on September 15, with comments due November 16 - which means as you read this, the comment window is open for less than three weeks. File. The joint statement’s factor list - unsupported deconversion fees, back-billing windows, benchmarking restrictions, service levels without measurable standards, integration friction - now informs how intensively the providers are examined, and the law firms have spent the weeks since briefing every vendor general counsel in the market. Read this Spotlight’s news in that light and some of it looks like early answers: a consolidator relaunching an acquired core with named clients and a public integration count, the largest incumbent putting migration paths in front of three cores' worth of customers, marketplaces hosting competitors in their own storefronts. We do not claim the September documents caused any single move - the timing is too tight for that - but the standard paper always moves first where the spotlight is brightest, and in our September commentary we predicted contracts would move on exactly these factors over 12 to 24 months. The clock on that prediction started six weeks ago.

Which makes the negotiating consequence the series' bottom line. Yesterday’s commentary told you to price both risk books - the risk of acting and the risk of standing still. The agencies just handed you the pen: a citable federal document listing, factor by factor, the contract practices the examiners themselves consider obstacles to sound risk management - substantially the same items as the checklist below. If your core, digital banking, account opening, or payments renewal falls in 2027 or 2028, the providers' standard paper will never be more negotiable than it is right now. Start the work.

What to Look in a Core Vendor

If you are a buyer, start where yesterday’s commentary ended: you are carrying two risk books - the risk of acting on your core and the risk of standing still - and the institutions that get hurt are the ones that never wrote down which risks they were accepting. The ledger is the utility; the access rights are the product; price both books at the same table.

Buy the generation, not the brochure: A generation is an architecture, not a badge - and it cannot be bought cosmetically. Ask where transaction authority, business logic, product configuration, and data ownership live, because a first-generation core with a browser, APIs, and a cloud hosting contract is still a first-generation core. Make the vendor place its product in the framework, in writing, trait by trait. If the original code was never rewritten, the generation never changed - make the vendor say, in writing, what the posting engine is written in and when it was last re-architected.

The integration fee schedule is the real price: Demand the current fee schedule for connecting third-party digital banking, account opening, and payments vendors - per vendor, per interface, per year - before you compare license costs. A cheap core with expensive doors is an expensive core.

Certification and release discipline: Get in writing which third-party vendors are certified on the release you will run, how long certification takes for a new one, and what the marketplace commitment obligates the core to do. Fiserv’s AppMarket and Jack Henry’s marketplace make these claims checkable.

Migration paths, named and priced: On a consolidating platform - Premier, Precision, Cleartouch toward CoreAdvance - the migration path, timeline, and cost belong in the contract you sign now. On a platform outside its vendor’s consolidation - DNA, PhoenixWorx under CORA - the investment commitment does.

Wrap before you replace: The Kansas City Fed’s three paths are a decision framework, not a menu of equals. For most community institutions the evidence favors wrapping - modern layers over a stable ledger - and a full replacement should carry the burden of proof, quantified against the sidecar alternative. Zions is the honest benchmark: phased replacement finished, and it took eleven years.

Fund the retirement: Every phased migration runs a straddle - a period when old and new both operate - and the straddle is only safe while every account, transaction, and data element has exactly one authoritative writer at every stage. Demand the retirement plan with dates and budget: a modernization that never turns the old core off is not a strategy, it is two cores at double the cost and double the reconciliation risk.

Real-time posting and API depth tested: The instant rails and the task-layer future both assume the core can post and expose state in real time. Test it in the demo against your actual transaction mix, and ask what the API call volume pricing does to the economics at scale.

Ownership, horizon, and exit: This roster spans public companies, private equity, client-owned cooperatives, CUSOs, and permanent-hold consolidators. Each answers “who owns the roadmap” differently. And everywhere: deconversion fees capped and defined, data extraction in standard formats, and transition assistance in the contract - because in a market consolidating this fast, the vendor you sign with is not necessarily the vendor you will leave. The agencies' joint statement now names unsupported deconversion fees and back-billing among the factors informing how providers are examined - put the document on the table.

For expert guidance on selecting and implementing these solutions, consider consulting with firms like CCG Catalyst, who specialize in navigating the financial services ecosystem to match your unique requirements.

Read yesterday’s companion commentary, “The Core Wars Moved Upstairs,” at CCG Insights, along with the rest of the series it closes: “The Regulators Answered” on the September third-party risk and core provider documents, our September payments coverage, our generation-by-generation core research, and the October digital banking series - the state of digital banking, the digital and account opening vendor landscapes, and the future of both. Reach our team at www.ccgcatalyst.com.

By: Paul Schaus | Founder & Managing Partner, CCG Catalyst Consulting

CCG Catalyst’s Sector Spotlights highlight third-party solutions, products, and the companies that offer them. They provide a snapshot of the innovations, trends, and key players in the financial services ecosystem.