Change the credit policy this week, not next quarter
The whole credit lifecycle runs on decisions: who to approve, at what limit, what to offer next, and who to chase first. Automate them, change them without a release, and explain any one of them months later.
Applicationdecisioning
Credit limitpolicy
Collectionsscoring
Bureau & frauddata
Four decisions, one system
They are four different policies, and they should be. What they should not be is four different systems, built at four different times, drifting apart from each other.
Application underwriting
Score the application, pull bureau and fraud data in parallel, apply the policy and return approve, decline or refer - with the reasons attached.
Credit limits
Initial limits at origination and limit changes over the life of the account, run in the same system rather than a separate spreadsheet.
Cross-sell selection
Decide who to offer what, on the customer data you already hold, without an offer engine that disagrees with your risk policy.
Collections scoring
Rank and route accounts by recovery probability, and rescore the portfolio nightly through the same decision flow that made the original decision.
Straight through, or referred to a person
The dividing line is not the product. It is whether the decision can complete without a person in it.
- Real time when it goes straight through. Unsecured applications, limit changes and cross-sell decisions that complete without human intervention answer in milliseconds through real-time decisioning, with bureau and fraud lookups running in parallel inside the flow.
- Batch for the portfolio. Nightly rescoring over the same decision flow, so the account-level view and the application-time decision cannot say different things.
- Case work wherever a person has to look. Mortgages and secured lending, affordability referrals, vulnerable customer cases, disputes and restructuring: documents arrive over days, a valuation lands late, and someone has to record a view. That is case work.
Creditworthiness is a high-risk AI use
Assessing the creditworthiness of a person is named in Annex III of the EU AI Act, with obligations from 2 December 2027: logging, technical documentation and meaningful human oversight. GDPR Article 22 already gives a declined applicant the right to human intervention and a meaningful explanation. Both are answered with the same trace.
Questions we get asked
Can we use this for mortgages and secured lending?
Yes, though a mortgage is rarely straight-through. The eligibility, affordability and policy rules run as decision logic exactly as they do for an unsecured application; the documents, the valuation and the manual underwriting run as a case, calling those same rule sets from inside it.
What decides whether something is real time or case work?
Whether a person has to be in it. If the policy can complete on data you already have, it is a real-time decision. If it waits on a document, a valuation or a human view, it is a case - and the same rules apply in both.
Can we change a cut-off without an engineering release?
Yes. A risk analyst changes the threshold in the portal, runs the regression suite, sees the impact analysis across a scenario set, and puts it through approval. Your engineers integrated once.
How do we explain a decline to a customer or the regulator?
Open the decision and read it back: which rules fired, on which values, what each model scored, against the exact version of the policy that was live at the time.
Can we test a new policy on live traffic first?
Yes. Run it as a challenger alongside the champion, compare the outcomes, and promote it when the numbers justify it.
Do collections and origination share logic?
They can, and should. Both run as decision flows on the same platform, so a definition of risk used at origination is the same one used in collections.
Can we use our own scoring models?
Yes. Import the trained model and call it inside the flow, with your cut-offs, policy rules and manual overrides around it.