Small-dollar loans, alternative data and the governance attached

The week

On May 20, 2020, the four main federal regulators of banks and credit unions issued interagency lending principles for offering responsible small-dollar loans to consumers and small businesses. They were the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA) and the Office of the Comptroller of the Currency (OCC).

The gap they addressed is easy to describe. Take a hospital cleaner in the spring of 2020 whose hours have just been cut. Her car needs a $400 repair or she cannot get to work. Her credit score is thin, because she has rarely borrowed. Her own bank, the one that has watched her paycheck arrive every two weeks for six years, does not offer loans that small. So she does what many people in her position do: she goes to a payday lender or lets her account slide into overdraft, and pays dearly for it. Mainstream lenders had largely stopped offering a few hundred dollars quickly to people like her.

What the document said

The principles were short, four pages, and deliberately general. They began by stating that the existing regulatory framework already allowed supervised institutions to offer responsible small-dollar loans. They covered several structures: open-end lines of credit with minimum payments, and closed-end loans repaid in a single payment or in installments. They described what a responsible program generally looks like. A high share of borrowers repay on the original terms, which the agencies called a key indicator of affordability and sound underwriting. Terms and safeguards minimize cycles of debt from rollovers and reborrowing. And the program should leave borrowers better able to manage their finances.

The core of the document described loan structures, pricing, underwriting, marketing and disclosures, and servicing practices the agencies considered consistent with safe and sound lending and fair treatment of consumers. Underwriting is the process a lender uses to decide whether to lend, how much and on what terms. “Safe and sound” is regulators’ shorthand for lending that will not put the institution itself at risk. Pricing was to comply with state and federal law and reflect returns reasonably related to the institution’s risks and costs. Servicing was to help borrowers repay without continuous reborrowing, including workouts for borrowers in distress and, where appropriate, converting a single-payment loan or credit line into installments.

Most strikingly, the principles said underwriting could use internal or external data sources, naming deposit account activity, to assess creditworthiness. They added that such analysis could support lending to customers outside the mainstream or hit by disasters, emergencies or downturns. They also said institutions could use new processes, technologies and automation to lower the cost of these loans, consistent with fair lending and consumer protection law. Lenders, in effect, no longer had to rely on credit scores alone. They could look at other information, such as the flow of money through a person’s bank account, and use software to make faster decisions. They still had to follow the rules that protect borrowers from unfair treatment.

The principles also said what a well-run program’s new-product process should cover: clear disclosure of terms, the risk profile of the customers who would use the product, the use of new technologies, the use of alternative underwriting information and the use of third parties. Each item on that list later became a workstream for the institutions that took up the invitation.

Three boundaries mattered. The principles applied to supervised banks, savings associations and credit unions, and expressly not to nonbank lenders, including those affiliated with banks. They did not address overdraft programs or credit cards. And institutions could, but were not required to, discuss their plans with supervisors before launch.

What came before

The principles followed a March 26, 2020 joint statement encouraging small-dollar lending to consumers and small businesses affected by the pandemic. That statement was an emergency message, issued as lockdowns began; the May principles turned it into lasting supervisory expectations. The OCC, which supervises national banks, rescinded its own May 2018 bulletin on short-term installment lending at the same time, clearing away older guidance in favor of the shared approach. The document also pointed back to a December 2019 interagency statement on the use of alternative data in credit underwriting. In it, five agencies, including the Consumer Financial Protection Bureau, had recognized that data such as cash flow could improve the speed and accuracy of credit decisions. Credit unions already had a dedicated product, the NCUA’s payday alternative loan, which the agency had expanded in late 2019 to allow loans of up to $2,000 with terms of up to a year.

The market had been moving too. By 2020, credit bureaus and scoring firms had launched products that let consumers add bank-account data to their credit files, and a handful of large banks offered small installment loans to existing customers. Most institutions, however, still did not.

For bank and credit union leaders, the message was an invitation, but not a blank check. Regulators were saying that small loans could be good business and good service, built with modern data and technology. They were also signaling that those tools came with the same responsibilities as any other lending, and some new ones besides.

Small-dollar credit is a product many banks and credit unions abandoned because the economics did not work with traditional underwriting and manual processes. The 2020 principles signaled supervisory support for another approach: fast decisions, sized to the borrower’s ability to repay, often using information beyond a credit score. The most useful extra information was deposit account cash flow. Using it responsibly required three disciplines that belong with data and risk teams rather than product teams: consented and complete data access, model risk management, and fair lending controls built for automated decisions.

Those disciplines belong with data and risk teams for a reason. A product team naturally focuses on the customer experience, the pricing and the launch date. Other questions decide whether a small-dollar program survives an examination, a lawsuit or a newspaper story. They concern where the data came from, whether the model works as claimed, and whether its decisions are fair and explainable. Those questions need owners who are not measured on how quickly the product ships.

The sections below first explain why small loans were hard and what changed, then take the three disciplines in turn. They then look at the partner route most smaller institutions take and follow a hypothetical credit union through its launch. The last sections set out the business cases on both sides and list the controls and questions that hold up.

Why small loans were hard, and what changed

Making a $500 loan costs a lender much of what it costs to make a $5,000 loan: someone has to take the application, check the applicant, decide, document and service the account. With traditional manual processes, the interest a small loan earns rarely covers that work. Many institutions concluded the product was not worth offering, and the gap was filled by higher-cost lenders.

The economics

Pricing limits sharpen the problem. Several limits constrain what a regulated lender can charge. They include state usury laws, the NCUA’s rate limits for federal credit unions, and the Military Lending Act’s 36 percent cap on loans to active-duty servicemembers and their families. A bank or credit union that wants to price a small loan at a level its customers and supervisors will accept has to cut costs, not raise prices. That points directly at automation and at underwriting data the institution already holds.

Losses matter as much as costs. A small-dollar program with a high default rate fails both tests the agencies set. It harms borrowers, whose accounts are drawn down or sent to collections. It also fails the institution, whose returns no longer cover its risks. The principles’ emphasis on a high share of borrowers repaying on original terms is an economic test as well as a consumer protection one.

Who the principles reached

The four agencies divide the field by charter. The OCC supervises national banks and federal savings associations. The Federal Reserve supervises state banks that are members of the Federal Reserve System, and the FDIC those that are not. The NCUA regulates federal credit unions and insures most state-chartered ones, which also answer to state regulators. A federal credit union making payday alternative loans must follow the NCUA’s specific rules for those loans, which the principles left in place. Nonbank lenders, including fintech lenders operating under state licenses, fell outside the principles and answered instead to the CFPB and state regulators. A fintech that partners with a bank is a different case: the bank’s supervisor expects the bank to apply the principles to the program it offers through the partner.

Why credit scores fall short here

Traditional underwriting also struggles with the people who most need small loans. A credit score summarizes how someone has handled borrowing in the past, drawn from records held by credit bureaus. People who have borrowed little, or whose history includes a hard patch, may have a thin or low score that says little about whether they can repay a small loan today.

Credit files also lag. A bureau record shows how a person handled credit over months and years. It shows little about whether their income changed last month. For a loan repaid over a few pay cycles, the recent past matters more than the distant one.

Automation and cash flow

Two things changed the calculation. Automation meant a decision could be made in seconds, inside a mobile app, with no staff time at all. And cash-flow data, the record of money moving in and out of a person’s bank account, offered a more current view of ability to repay than a credit score alone. If a lender can see that wages of a steady amount arrive every two weeks, and that the account rarely runs dry, it can make a reasonable judgment about a small loan even for someone with a thin credit file.

Independent research supported the idea. A 2019 study by FinRegLab, a nonprofit research center, analyzed data from several lenders that used cash-flow information. It found that the data was predictive of credit risk and could help evaluate applicants with limited credit histories. The evidence was strongest when cash-flow data was used alongside traditional data, not in place of it.

The decision itself is made by a model: a set of rules or a statistical formula, increasingly built with machine learning, that takes in data about an applicant and produces a decision or a score. A model applies its judgment the same way thousands of times a day. That consistency is its strength, and also the reason any flaw in it is repeated just as often.

Consented and complete data access

For many small-dollar borrowers, the most predictive data is the history of their own deposit account: income regularity, balance patterns and overdraft frequency. For an institution’s existing customers, that data is already held. Using it for credit decisions still requires checking privacy notices and internal governance rules on secondary use. Secondary use means using data for a purpose other than the one it was originally collected for; a customer who opened a checking account did not necessarily expect their transactions to be used to decide on a loan.

Data the institution already holds

Using its own deposit data is the simplest route, and it suits banks and credit unions with long customer relationships. The privacy question is usually manageable. The Gramm-Leach-Bliley Act governs sharing of customer data with outside parties, and an institution using its own records for its own credit products is generally not sharing. The harder questions are internal. The customer may not understand that account behavior affects credit decisions. Deposit data collected for servicing may not be accurate enough for a credit decision. And someone in the institution has to decide, in writing, which account data the model may use.

Some data should be excluded by design. Transaction descriptions can reveal health care spending, religious donations, union dues or payments to political causes. Even when such data is predictive, using it invites fair lending and reputational risk. A written list of excluded categories, enforced in the data pipeline, is easier to defend than a case-by-case judgment.

Data from other institutions

For applicants who bank elsewhere, it requires consented access through account aggregation, services that, with the customer’s permission, gather their account data from other institutions. In 2020 that often meant credential-based screen scraping, with its own security and liability questions. Screen scraping means the customer hands over their online banking username and password, and software logs in as them to copy the information. It works, but it is a little like lending a stranger your house keys so they can read your mail. The alternative is an API, an application programming interface: a controlled doorway between two computer systems through which one can request specific data from the other, with permission, without ever seeing the customer’s password.

The access method changes the risk profile. With screen scraping, the data provider’s security team sees an unusual login pattern and may block it, which breaks the lender’s data feed without warning. Credentials stored by an aggregator are a target in their own right. With APIs, the data arrives in a defined format with a defined consent scope, and the customer can revoke access without changing a password. A lender relying on aggregated data should know which method each source uses and plan for feeds that break.

Aggregated data also raises a credit reporting question that institutions should take to counsel. Under the Fair Credit Reporting Act, a company that assembles consumer information for others to use in credit decisions can become a consumer reporting agency, with duties on accuracy and disputes. Whether a given aggregator or analytics vendor falls into that category depends on what it does with the data. The answer affects what notices the lender owes the applicant and how disputes are handled.

Provenance, consent and completeness

Each data element therefore needs a record of where it came from, what the customer agreed to, how it is protected and how long it is kept. Lenders also need to know whether the data is complete. An applicant paid into two accounts can look riskier than they are if only one is visible. Underwriting rules should treat partial visibility as a known limitation, perhaps by inviting applicants to connect additional accounts, rather than as evidence of low income.

Consent needs the same discipline. A consent screen that says the lender will “review your account information” is weaker evidence than one that names the accounts, the period covered, the purpose and how long the data is kept. If the customer later disputes a decision, the consent record is the first document anyone will ask for.

Categorization quality

Data quality deserves the same attention. Transaction categorization, such as deciding which deposits are wages and which are transfers, drives most cash-flow features. A feature, in modeling language, is one of the specific measurements fed into the model, such as average monthly income or the number of overdrafts in the past quarter. Categorization errors become underwriting errors. If a transfer from the applicant’s own savings account is mistaken for wages, income looks higher than it is. Testing categorization accuracy on a labeled sample, and repeating the test when a vendor changes its methods, is a basic control many programs skipped.

Errors are rarely random. Gig workers paid through several platforms, people paid in cash and deposited irregularly, and households that move money between family members all produce patterns that categorization software handles less well. Those groups overlap with the borrowers small-dollar programs aim to serve. A categorization test should therefore oversample them, not rely on an average accuracy figure dominated by salaried customers.

Model risk management

An automated small-dollar underwriting model is a model in the supervisory sense. It falls under the model risk management guidance the Federal Reserve and the OCC issued in 2011, which the FDIC later adopted. That means documented development, independent validation, ongoing performance monitoring and controlled changes. Independent validation means that someone who did not build the model examines whether it is sound, whether it does what its builders say and whether its limitations are understood.

Proportion by institution

The guidance scales with size and complexity. A large bank has a model risk function with its own staff and an inventory of hundreds of models. A community bank or credit union may have one person responsible for models part-time and rely on outside validators. Federally insured credit unions are examined by the NCUA, which was not a party to the 2011 guidance. Many credit unions still use it as their benchmark, and examiners expect sound oversight of any model that drives lending decisions. Whatever the size, the minimum is the same: a model inventory entry, a named owner, documentation someone other than the builder can follow, and a validation before use.

Vendor models

Vendor models are included. The institution remains responsible for understanding and validating them, which requires enough access to the vendor’s methodology, data and performance results to do so. “The vendor says it works” is not an answer an examiner accepts.

Vendors often resist sharing methodology on intellectual property grounds. There are workable compromises. The vendor can provide documentation under confidentiality terms, give the validator access to a test environment, or supply outcome data on the institution’s own applicants so the institution can test performance directly. Outcome testing on the institution’s own portfolio is often more useful than reviewing the vendor’s code, because it shows how the model performs for the people the institution actually serves.

Drift

Cash-flow models also drift. Drift is what happens when the world changes so that the patterns a model learned no longer hold. Pandemic-era income patterns, including stimulus payments and enhanced unemployment benefits, distorted the very signals such models relied on. A borrower’s balances could look healthier than their underlying earnings. Monitoring needed to watch input distributions and the relationships between inputs and outcomes as well as default rates. By the time defaults rise, the losses are already booked. Monitoring thresholds that trigger a review, with a named model owner, turn drift from a surprise into a scheduled task.

The 2020 case also shows why feature design matters. A feature that counts all deposits as income would have treated one-time stimulus payments and temporary federal unemployment supplements as earnings. A feature that separates recurring wages from one-time and government deposits would have been far more stable. Designing features around the sources of income, not their totals, makes a model less sensitive to the next shock, whatever form it takes.

Measures that show whether it works

Default rate is the measure everyone watches, and it is the least informative on its own. The principles pointed to a better one: the share of borrowers who repay on the original terms, without extensions or reborrowing. Other measures fill in the picture. Reborrowing frequency shows whether the product is becoming a habit. The share of borrowers who overdraw their account within a few days of a repayment shows whether the repayment schedule is affordable. Losses tracked by vintage, meaning loans grouped by the month they were made, show whether a change in the model or the economy is affecting new loans before the whole portfolio shows it. Approval and repayment rates by segment show whether the program serves the people it was built for.

Change control

Change control is the other half. Small-dollar programs tend to iterate quickly, with new features, adjusted cutoffs and revised loan amounts. Each change can alter who is approved and on what terms. A lightweight but written process helps: each proposed change gets an impact estimate on approval rates and losses, a fair lending check and sign-off from the model owner. It lets a program move fast without losing the audit trail examiners will ask for. Champion-challenger testing, where a small share of applications runs through a new version before full rollout, gives evidence instead of assumptions. The current model is the champion; the proposed one is the challenger; the results decide.

The evidence an examiner will look for is predictable. It includes the model inventory, the development documentation, the validation report and the institution’s response to its findings, the monitoring reports with any threshold breaches, and the change log with approvals. A program that can produce those within a day of being asked is in good shape. One that has to assemble them from email is not.

Fair lending controls for automated decisions

The Equal Credit Opportunity Act and Regulation B apply whatever data or method a lender uses. The Act is the federal law that prohibits discrimination in lending on grounds such as race, sex, age and national origin, and Regulation B is the detailed rulebook that implements it. Lenders must avoid discrimination, including disparate impact, and must give applicants specific reasons for adverse action. Disparate impact means a practice that looks neutral but falls disproportionately on a protected group without adequate business justification. Adverse action is a decision against the applicant, such as a decline, and the law requires telling them the main reasons why.

Proxies and explanations

Complex models make both harder. Variables can act as proxies for protected characteristics: a model that never sees race can still reproduce racial patterns if it relies on data, such as location or certain spending patterns, that correlates with race. The principal reasons for a decision can be hard to state accurately when many features interact.

Cash-flow data brings its own proxies. Receipt of certain public benefits can correlate with age, disability or national origin. The Act also protects applicants whose income derives from public assistance, so treating such income as less reliable than wages needs careful justification. Spending at particular merchants can correlate with neighborhood or religion. Each of these needs review before it enters a model, not after a disparity appears.

Testing and alternatives

The controls are concrete. Disparate impact testing runs before deployment and at intervals afterwards. Where disparities appear, the lender searches for less discriminatory alternatives that meet the same business need and documents the search. A reliable method generates adverse action reasons that reflect the model’s actual drivers, tested on sample declines. Product terms also matter for consumer protection, including fees, repayment structure and the product’s interaction with overdraft programs. Counsel should review both model and product before launch.

The search for alternatives is where modern tools help. A team can retrain the model without a suspect feature, or with constraints that reduce disparity, and compare predictive power. Often the loss in accuracy is small. Documenting what was tried, what each version cost in accuracy and what each gained in fairness is the evidence that shows the institution took the obligation seriously.

The data problem

Fair lending testing needs data that lenders often lack. Outside mortgage lending, Regulation B generally prohibits lenders from asking applicants about race or ethnicity, so testing relies on statistical estimates from names and addresses. The CFPB itself has used one such method, which combines surname and geography. Those methods are imperfect, and their limits should be documented alongside the results. Regulation B does allow voluntary self-testing, and the results of a properly designed self-test have some protection from use against the lender. Counsel should advise on how to structure the program to obtain that protection.

Product terms and unfair practices

The principles named the consumer protection laws that apply beyond fair lending: the Truth in Lending Act, the Federal Trade Commission Act’s ban on unfair or deceptive practices, and the Dodd-Frank Act’s ban on unfair, deceptive or abusive practices. For small-dollar loans, the risky practices are usually structural. One example is collecting repayment from the borrower’s deposit account on a date that leaves too little for rent. Another is fees that make the effective cost far higher than the stated one. The principles warned specifically against structures that rely on immediate collectability in the event of default. A bank that can repay itself from the borrower’s account has a strong position, and the reason to use it sparingly is that it can leave the borrower with nothing.

Decline reasons that are true

Regulation B requires the principal reasons for a decline, and the model should be built so that it can produce them. Common methods rank each feature’s contribution to an applicant’s score. The ranked features then map to plain reason statements, such as irregular income deposits or a short balance history. The mapping should be tested on real declines: a reviewer takes a sample, examines what the model weighed, and checks the letter matches. Generic reasons from a standard form list, chosen because they are familiar, do not meet the requirement when the model weighed something else.

Partners, and the readiness test

For community banks and credit unions, the practical route was often a technology partner. Partnership brings speed but does not transfer responsibility. Third-party risk management, model validation and fair lending testing stay with the institution, and contracts should give it the data and access needed to perform them. Third-party risk management is the discipline of assessing and overseeing the outside companies an institution relies on, from due diligence before signing to monitoring throughout the relationship.

Partnership models

Partnerships take different shapes, with different risks. In one, the partner supplies software and a model, and the institution makes and holds every loan. In another, the partner also handles marketing, servicing and collections in the institution’s name. The more the partner does, the more the institution’s oversight must cover: complaints, collection practices, disclosures and data security as well as the model. The 2020 principles noted that products offered through third parties should also meet the core principles, including returns reasonably related to the institution’s risks and costs. A partnership in which the partner earns most of the revenue while the institution bears the compliance risk deserves a hard look.

Oversight after launch

Due diligence before signing is the easy part. Ongoing oversight means reviewing the partner’s complaint logs, testing a sample of its customer communications, checking that disclosures match the product as delivered, and confirming that data security commitments are met. Complaints are an early warning: a rise in complaints about payment timing or unexpected debits often shows a problem months before losses or examination findings do. The institution should receive complaints directly, not a monthly summary written by the partner.

The readiness test

A simple readiness test applies before launch: could the institution explain to an examiner, clearly, how the model decides and why a given applicant was declined? If that explanation depends entirely on the vendor, the program is not ready.

Contract terms

Contracts are where this is won or lost. Before signing, an institution should know whether it will receive the model’s documentation, the data used to build it, regular performance reports and the results of the partner’s own fair lending testing. It should know whether it can commission its own independent validation, and whether it will be told before the partner changes the model. It should also know what happens to its customers’ data if the relationship ends. A partner confident in its model will usually agree to these terms. One that resists them is telling the institution something important about the risk it would be taking on.

Exit terms deserve particular care. A small-dollar program that relies on one partner’s model and data feed cannot easily switch if the partner fails, is acquired or changes terms. The contract should give the institution its loan-level data in a usable format, a transition period, and the right to keep servicing existing loans. Without those, the institution can find itself forced to choose between a bad partner and closing the program.

A credit union delays its launch

Consider a hypothetical community credit union whose members keep asking for help with emergency expenses. Its leadership reads the 2020 principles and decides to offer small installment loans through its mobile app, with decisions in seconds, using members’ own account history.

The four requests

A fintech partner offers a ready-made cash-flow model. The product team is keen to launch within weeks. The chief risk officer asks for four things first. A data inventory: which account data feeds the model, what members were told about its use, how long it is kept. A categorization test: the partner’s software labels a sample of a thousand transactions, and staff check how many it gets right. Transfers between a member’s own accounts turn out to be miscounted as income often enough to matter, and the partner fixes it. A validation: an outside reviewer examines the model and the contract is amended so the credit union can see the partner’s performance data. And a fair lending review: compliance staff estimate approval rates across groups, find that one feature tied to location drives a gap, test an alternative without it that performs almost as well, and adopt it.

The product decisions

The review also changes the product. The credit union caps how often a member can borrow in a year, so the loan does not become a monthly habit. It sets repayment in three installments timed to paydays, rather than a single lump sum. It decides that a loan payment will never trigger an overdraft fee, so the loan does not feed the problem it was meant to solve. It sets its target measure as the share of loans repaid on original terms, the indicator the principles named, and reports it to the board each quarter alongside losses.

The outcome

The launch slips by two months. In return, the credit union can explain to its examiner exactly how a decision is made. It can show sample decline letters whose reasons match what the model actually weighed, and point to a named model owner who reviews monthly reports for signs of drift. When stimulus payments start inflating members’ balances, that owner sees the input patterns shift and tightens the review before losses appear.

The delay has a cost, and it should be counted honestly. Two months is two months of members borrowing elsewhere at higher prices. A credit union that delays indefinitely in pursuit of perfect governance fails its members as surely as one that launches carelessly. The four requests were chosen because each could be completed in weeks, not quarters.

Customer, revenue, regulatory and risk cases

Small-dollar lending sits where several things a board cares about meet. There is a customer case: members and customers who need small amounts quickly will borrow somewhere, and a responsible product from their own institution can save them money and build loyalty. There is a revenue case, made possible by automation. There is a regulatory case, because supervisors explicitly invited the activity in 2020. And a risk case runs the other way: a model that discriminates, misreads data or drifts unnoticed exposes the institution to examination findings, legal action and reputational damage among exactly the communities it set out to serve.

Interaction with overdraft revenue

The revenue case has an awkward side. Many institutions earned significant income from overdraft fees paid by the same customers a small-dollar loan would serve. A good small loan can reduce overdraft use and the fee income that comes with it. Boards should see both lines together, because a program judged only on its own revenue may look weak while it is reducing a riskier and more criticized income stream.

The counter-argument

The strongest objection to the whole approach is that cash-flow underwriting gives lenders an intrusive view of customers’ lives, and that the governance described here is too heavy for a $500 loan. The first point has force; it is why consent, exclusions and retention limits matter. The second underestimates the scale. A small-dollar model makes thousands of decisions, and its errors compound across them. The governance is proportionate to the number of decisions, not the size of each loan.

Automation raises the stakes in both directions. A good model serves thousands of people quickly and fairly. A flawed one harms thousands quickly and consistently. That is why the governance attached to the model matters as much as the model itself.

The controls that hold up

A program that holds up has:

• A record for every data element: source, consent, protection and retention.
• A written list of data categories excluded from underwriting by design.
• Rules that treat incomplete account visibility as a limitation, not as low income.
• Regular testing of transaction categorization on labeled samples, oversampling irregular earners.
• Independent validation of every model, including vendor models, with contractual access to what validation needs.
• Monitoring of inputs and relationships, with thresholds and a named owner.
• A written change process with impact estimates, fair lending checks and champion-challenger testing.
• Disparate impact testing, a documented search for less discriminatory alternatives, and adverse action reasons tested against real declines.
• Product terms that limit reborrowing and avoid fee interactions with overdraft programs.

The shortcuts that cause trouble:

• Assuming data the institution already holds can be used for any purpose.
• Treating a vendor model as the vendor’s responsibility.
• Watching only default rates, which move after the damage is done.
• Changing cutoffs or features informally, leaving no audit trail.
• Generating generic decline reasons that do not reflect what the model actually weighed.
• Signing a partnership without exit terms or access to loan-level data.

Before the model goes live

The questions below are meant for a launch committee that includes risk, compliance, data and the product owner, with answers written down before the first loan is made.

1. What data does our small-dollar model use, where does each piece come from, and what did customers agree to?
2. Who validated the model independently, and do we have the vendor data needed to do it again?
3. Who owns the model, and what would trigger them to review it?
4. What did our disparate impact testing show, and what alternatives did we consider?
5. Could we explain to an examiner, without the vendor in the room, how a decision is made?

A committee that cannot answer one of these has found its next piece of work, and should schedule it before launch rather than after the first examination.

With hindsight

Several large banks launched small-dollar products in the years after the principles, among them Bank of America, Wells Fargo and Huntington. They typically offered small amounts to existing checking customers, with decisions based on their account history. Many institutions also reduced or eliminated overdraft fees, partly under supervisory and public pressure. Cash-flow underwriting gained ground, supported by research and industry data-sharing efforts.

The consumer protection backdrop shifted as well. In July 2020, weeks after the principles, the CFPB rescinded the mandatory underwriting provisions of its 2017 payday lending rule, which would have required lenders to assess borrowers’ ability to repay. Federal policy thus relied more on encouraging banks and credit unions to compete than on restricting higher-cost lenders. In December 2024 the CFPB finalized a rule on overdraft fees at the largest institutions, and in 2025 Congress overturned it under the Congressional Review Act. Overdraft and small-dollar credit remained linked, as the principles’ exclusion of overdraft had left them.

Supervisory attention to models grew. In 2021 five federal agencies, including the CFPB and NCUA, issued a joint request for information on financial institutions’ use of artificial intelligence, asking among other things about explainability, data quality and fair lending. The OCC published a revised model risk management booklet for its examiners that year. In June 2023 the Federal Reserve, FDIC and OCC issued final interagency guidance on third-party relationships, replacing their separate earlier guidance. It made clear that a bank’s use of a partner does not reduce its responsibility for the activity.

In 2022 the CFPB, the Consumer Financial Protection Bureau, issued a circular saying that fair lending law applies to complex models, including the requirement to give specific and accurate adverse action reasons. It withdrew that circular in May 2025, though the underlying requirements of the Equal Credit Opportunity Act and Regulation B did not change. Guidance comes and goes; the statute and its rulebook remained, and so did the obligation to tell a declined applicant the real reasons. Federal enforcement priorities also moved: an April 2025 executive order directed agencies to deprioritize enforcement based on disparate impact. State enforcement did not stop. In 2025 the Massachusetts attorney general settled with a student lender over allegations that its automated underwriting produced unlawful disparate impact.

Consented data access began moving from screen scraping toward APIs. The CFPB finalized a personal financial data rights rule under Section 1033 of the Dodd-Frank Act in late 2024. That rule addressed consumers’ right to have their financial data shared, with their permission, with other providers. It would have required covered institutions to provide the data through dedicated developer interfaces, barred fees for that access, phased in compliance by institution size and exempted the smallest depository institutions. For lenders, that promised a cheaper and more reliable route to cash-flow data than screen scraping. Banks challenged it in court the day it was finalized, and the CFPB reopened it for reconsideration in 2025, leaving the long-term framework unsettled.

Cash-flow data kept gaining ground as a credit input regardless. The three disciplines above apply whichever access rule finally prevails, because each one is about how an institution uses data, not about the pipe the data arrives through.

What held up from May 2020 was the core idea: deposit data can support small loans that mainstream lenders had abandoned. What proved fragile was every layer of guidance around it. Circulars were issued and withdrawn; data-access rules were finalized, challenged and reopened; federal and state enforcement diverged. Some institutions built their small-dollar programs around the governance basics: knowing their data, validating and monitoring their models, testing for fairness and explaining their decisions. They did not need to rebuild each time the guidance moved. Institutions that had relied on the guidance of the moment, or on a vendor’s assurances, found themselves exposed whenever the ground shifted. Durable controls are the cheapest way to live with unsettled rules.