← All rollout articles

Credit union: core-adjacent de-risking before a vendor swap

Problem

Leadership signed a new core contract with a firm conversion date. Internal teams knew the institution’s “special” products and fee logic would not map cleanly. Fear of silent balance errors dominated board conversations.

Constraints

Regulator expectations around member communications, NCUA-style operational resilience norms, and a small IT team without mainframe depth. Vendors had incentives to declare “config complete” early.

Approach

We built a reconciliation plane that compared legacy ledger outputs to the new core’s shadow postings at the transaction grain where possible—and at controlled aggregates elsewhere. Exceptions were triaged with accounting, not only engineering.

Rollout

Member-facing channels moved in slices: deposits first, then loans without complex participations, then the long tail. Each slice had a defined rollback that did not require re-educating members.

Risks mitigated

• Silent financial drift: daily signed reconciliation reports for audit committees
• Vendor optimism: independent test portfolios sourced from production distributions
• Staff burnout: explicit pause weeks and on-call caps

Outcomes (illustrative)

Material discrepancies discovered in shadow mode dropped to near-zero before the first member-visible slice. Member complaints related to posting errors stayed below internal thresholds through conversion weekend.

Lessons

Boards fund confidence, not microservices. The reconciliation plane was the product that unlocked the migration—not the prettiest architecture diagram.