nCino Mortgage Solution

• Discovery & scoping

  • Stakeholders: IT, MoM (Mortgage operations management), Compliance, Risk, Loan Officers, Customer Experience.

  • Activities: process mapping, current-state vs. future-state, data readiness assessment, integration requirements, success metrics, high-level risk/controls review.

  • Duration: 2–6 weeks (highly variable by complexity and number of products).

• Solution architecture and design

  • Activities: define target workflows (origination to closing), data model alignment, return-to-workflow rules, security model, roles, and access controls, reporting framework.

  • Duration: 2–6 weeks.

• System integration and data migration

  • Activities: connect to core banking platforms (core systems like core banking, CRM, document management, eSign, credit bureaus, pricing engines), map data, cleanse/normalize data, plan for data migration cutover.

  • Duration: 6–16 weeks depending on number of integrations and data quality.

• Configuration and development

  • Activities: configure nCino modules for mortgage lifecycle (pre-qualification, application, underwriting, closing, funded status), build custom fields, workflows, dashboards, reports, and any required customizations.

  • Duration: 6–12 weeks for standard configurations; additional time for complex customizations.

• Workflow and process configuration: loan lifecycle steps, task routing, SLA tracking, escalation rules.

• Data model customization: custom fields, forms, and data capture points aligned to your product set.

• Role-based access: granular permissions and security profiles for different user groups.

• UI/UX customization: screen layouts, dashboards, and reporting views tailored to roles.

• Automation rules: business rules, approvals, triggers, and notifications.

• Integrations: connectors and middleware to core banking systems, CRM, document management, eSign, pricing and eligibility engines, credit bureaus, and LOS/CRM systems.

• Compliance controls: configuration of regulatory checks, policy rules, and audit trails.

• Reporting and analytics: customizable dashboards, operational metrics, and regulatory reports.

• Digital channels: borrower portal, agent/mobile access, and e-sign workflows can be tailored.

• Licensing (subscription) fees

  • Typically priced per user/seat and/or per loan volume, with tiered pricing for modules (Origination, Digital, Data & Analytics, Reporting, etc.). Mortgage-specific modules may have separate sub-licensing.

  • Volume-based components may apply if you exceed a threshold of annual mortgage originations or active users.

• Setup/implementation fees

  • One-time services fees for discovery, design, integrations, data migration, configuration, and project management.

  • Can be a fixed price or time-and-materials based, depending on scope and partner involvement.

  • Often 6–12% of the first-year licensed value in large deployments; smaller engagements may be lower.

• Integration costs

  • Fees for connecting to core banking systems, LOS, CRM, document management, eSign, credit bureaus, pricing engines.

  • May involve middleware or API usage charges.

• Data migration and cleansing

  • Costs to map, cleanse, and migrate data from legacy systems, plus ongoing data cleansing efforts during stabilization.

• Role-based curricula: training tailored to different user roles (loan officers, underwriters, processors, closers, managers, IT/admins, and support/helpdesk).

• Multi-format delivery: a mix of virtual instructor-led sessions, self-paced e-learning modules, hands-on sandbox labs, and job aids.

• Core topics typically covered:

  • Mortgage origination lifecycle in nCino (application, underwriting, conditions, closing, funding)

  • System navigation, data entry, and form templates

  • Workflow and task management, SLAs, and escalation rules

  • Compliance controls, audit trails, and regulatory checks

  • Document management, e-sign, and borrower portal usage

  • Reporting dashboards and performance metrics

  • Security best practices and access management

• Certification or proficiency checks: some programs include knowledge checks, simulations, or a formal certification upon completing required modules.

• Role-based access control (RBAC): granular permissions by user role, with the ability to limit access to data, actions, and features.

• Single sign-on (SSO) and multifactor authentication (MFA): integration with corporate identity providers (e.g., SAML/OIDC) for stronger authentication.

• All data access is governed by policies, with least-privilege principles applied.

• Separation of duties (SoD) controls to prevent conflicting transactions.

Data protectio

• Data encryption at rest and in transit: TLS for data in transit; AES-256 or equivalent for data at rest.

• Data masking and redaction where appropriate, especially in non-production environments.

• Encryption keys management: integration with customer-managed keys or cloud KMS options as available.

Compliance and governance

• Audit trails and immutable logging: comprehensive event logging for user activity, data changes, and system events.

• Regulatory controls: support for SOX-type controls, compliance workflows, and retention policies as needed by the bank or region.

• Data residency options: regional hosting choices where applicable, to meet local regulatory requiremen

Update frequency

• Regular product updates: nCino typically releases software updates multiple times per year, including feature enhancements, security fixes, and regulatory compliance improvements.

• Major releases vs. minor updates: major releases may introduce new modules or substantial UI/UX changes; minor updates often include incremental improvements and patches.

• Platform-wide upgrades: customers are typically upgraded on a controlled cadence, with planning and testing windows.

Release management process

• Planning and communication: advance notice of upcoming releases, feature deprecations, and required testing.

• Impact assessment: review of how changes affect existing processes, integrations, and customizations.

• Testing in staging/sandbox: customers validate critical scenarios in a non-production environment before going live.

• Change management: rollout plans, training updates, and updated documentation aligned with each release.

• Back-out options: predefined rollback strategies if a release causes issues.

Upgrade logistics

• Compatibility and prerequisites: guidance on system requirements, integration compatibility, and data migration considerations.

• Training updates: release notes and, if needed, short refresher sessions to cover new features or changes.

Data ownership

• Customer data ownership: In typical SaaS arrangements for nCino, the bank or financial institution owns the data it uploads or creates within the system. nCino acts as a data processor/host for that data.

• Data rights upon termination: Contracts usually include provisions granting the customer access to their data for a defined period after termination, allowing export or safe-keeping of data before final deletion, subject to any data retention or regulatory requirements.

Data portability

• Data export capabilities: Customers are generally entitled to export their data in commonly used formats (CSV, JSON, or other agreed data models) for offline use or migration to another system.

• Timing for data access post-termination: There is typically a defined window (e.g., 30–90 days) during which data export is allowed after termination, after which data may be archived or securely destroyed per policy.

• Data formats and mapping: Portability requests are typically supported with data dictionaries or schema mapping to ease migration to another platform. Some data may be archived in non-reusable formats per legal/regulatory retention needs.

• Burden and cost: Some contracts outline that basic data export is included, while complex or large-volume extractions beyond standard exports may incur professional services charges or an associated data extraction fee.

• Flexible licensing: pricing and licensing typically scale with user counts, loan volumes, or modules, enabling increases or decreases as needs change.

• Seasonal or tranche-based scaling: some customers use tiered or modular scaling to accommodate peak origination periods or product launches.

• Term and notice requirements: scaling changes usually require advance notice to adjust licenses, infrastructure, and support plans.

Renewal terms

• Auto-renewal vs. manual renewal: many SaaS contracts auto-renew for fixed periods (e.g., 12 months) unless canceled within a notice window.

• Price escalation: renewal terms often include annual price adjustments (e.g., fixed percentage or CPI-based) and may require renegotiation for significant scope changes.

• Renewal notice period: contracts specify how far in advance a party must notify of intent not to renew (e.g., 60–90 days).

• Performance and service levels: renewal discussions may reference SLA performance, support responsiveness, and uptime metrics

• SOC 2 Type II: for controls around security, availability, processing integrity, confidentiality, and privacy (often requested for SaaS providers serving financial services).

• ISO 27001: information security management system (ISMS) certification is a frequent expectation for enterprise-grade security posture.

• PCI DSS considerations: relevant if handling cardholder data; nCino may rely on third-party integrations for payment handling with PCI scope defined accordingly.

• GDPR/CCPA and regional privacy laws: data processing agreements outlining data handling, subject rights, cross-border transfers, and regulatory compliance.

• data residency/localization: regional hosting options to meet data sovereignty requirements; some deployments offer data centers in specific regions.