It is pretty standard for loan origination systems to have the ability to pull credit bureaus. Whether by integrating directly with the big three bureau providers or with a bureau re-seller, loan origination systems are built for accessing and utilizing the credit bureau.
Identity compromise has the potential to ruin an organization, not to mention the lives of those whose identities have been compromised. It is the number one attack vector for hackers and online criminals. Because of this, many companies are considering the implementation of more stringent security measures such as MultiFactor Authentication (MFA).