Small-dollar loans, alternative data and the governance attached

The week

On May 20, 2020, the Federal Reserve, the FDIC, the NCUA and the OCC issued interagency lending principles for offering responsible small-dollar loans to consumers and small businesses. The principles described loan structures, underwriting and risk management practices the agencies considered consistent with safe and sound lending and fair treatment of consumers. They said institutions could use data and analytical methods, including new technologies, to underwrite applicants who might fall outside traditional criteria, consistent with consumer protection law. The principles followed a March 26, 2020 joint statement encouraging small-dollar lending to people affected by the pandemic. The OCC rescinded its 2018 bulletin on short-term installment lending at the same time.

Small-dollar credit is a product many banks and credit unions abandoned because the economics did not work with traditional underwriting and manual processes. The 2020 principles signaled supervisory support for another approach: fast decisions, sized to the borrower’s ability to repay, often using information beyond a credit score. The most useful extra information was deposit account cash flow. Using it responsibly required three disciplines that sit with data and risk teams rather than product teams: consented and complete data access, model risk management, and fair lending controls built for automated decisions.

Consented and complete data access

For many small-dollar borrowers, the most predictive data is the history of their own deposit account: income regularity, balance patterns and overdraft frequency. For an institution’s existing customers, that data is already held. Using it for credit decisions still requires checking privacy notices and internal governance rules on secondary use. For applicants who bank elsewhere, it requires consented access through account aggregation. In 2020 that often meant credential-based screen scraping, with its own security and liability questions.

Each data element therefore needs a record. Where did it come from, what did the customer agree to, how is it protected, and how long is it kept? Lenders also need to know whether the data is complete. An applicant paid into two accounts can look riskier than they are if only one is visible. Underwriting rules should treat partial visibility as a known limitation, perhaps by inviting applicants to connect additional accounts, rather than as evidence of low income.

Data quality deserves the same attention. Transaction categorization, such as deciding which deposits are wages and which are transfers, drives most cash-flow features. Categorization errors become underwriting errors. Testing categorization accuracy on a labeled sample, and repeating the test when a vendor changes its methods, is a basic control many programs skipped.

Model risk management

An automated small-dollar underwriting model is a model in the supervisory sense. It falls under the model risk management guidance the Federal Reserve and the OCC issued in 2011, which the FDIC later adopted. That means documented development, independent validation, ongoing performance monitoring and controlled changes. Vendor models are included. The institution remains responsible for understanding and validating them, which requires enough access to the vendor’s methodology, data and performance results to do so.

Cash-flow models also drift. Pandemic-era income patterns, including stimulus payments and enhanced unemployment benefits, distorted the very signals such models relied on. A borrower’s balances could look healthier than their underlying earnings. Monitoring needed to watch input distributions and the relationships between inputs and outcomes, not only default rates. By the time defaults rise, the losses are already booked. Monitoring thresholds that trigger a review, with a named model owner, turn drift from a surprise into a scheduled task.

Change control is the other half. Small-dollar programs tend to iterate quickly, with new features, adjusted cutoffs and revised loan amounts. Each change can alter who is approved and on what terms. A lightweight but written process helps: each proposed change gets an impact estimate on approval rates and losses, a fair lending check and sign-off from the model owner. It lets a program move fast without losing the audit trail examiners will ask for. Champion-challenger testing, where a small share of applications runs through a new version before full rollout, gives evidence instead of assumptions.

Fair lending controls for automated decisions

The Equal Credit Opportunity Act and Regulation B apply whatever data or method a lender uses. Lenders must avoid discrimination, including disparate impact, and must give applicants specific reasons for adverse action. Complex models make both harder. Variables can act as proxies for protected characteristics. The principal reasons for a decision can be hard to state accurately when many features interact.

The controls are concrete. Disparate impact testing runs before deployment and at intervals afterwards. Where disparities appear, the lender searches for less discriminatory alternatives that meet the same business need and documents the search. A reliable method generates adverse action reasons that reflect the model’s actual drivers, tested on sample declines. Product terms also matter for consumer protection, including fees, repayment structure and the product’s interaction with overdraft programs. Counsel should review both model and product before launch.

Fair lending testing needs data that lenders often lack. Outside mortgage lending, institutions generally do not collect applicants’ race or ethnicity, so testing relies on statistical estimates from names and addresses. Those methods are imperfect, and their limits should be documented alongside the results.

For community banks and credit unions, the practical route was often a technology partner. Partnership brings speed but does not transfer responsibility. Third-party risk management, model validation and fair lending testing stay with the institution, and contracts should give it the data and access needed to perform them. A simple readiness test applies before launch: could the institution explain to an examiner, in plain terms, how the model decides and why a given applicant was declined? If that explanation depends entirely on the vendor, the program is not ready.

With hindsight

Several large banks launched small-dollar products in the following years, and many institutions reduced or eliminated overdraft fees, partly under supervisory and public pressure. Cash-flow underwriting gained ground, supported by research and industry data-sharing efforts. The CFPB also made clear that existing fair lending law applies to complex models, including the requirement to give specific and accurate adverse action reasons.

Consented data access began moving from screen scraping toward APIs. The CFPB finalized a personal financial data rights rule under Section 1033 of the Dodd-Frank Act in late 2024. It was challenged in court and reopened for reconsideration in 2025, leaving the long-term framework unsettled. Cash-flow data kept gaining ground as a credit input regardless. The three disciplines above apply whichever access rule finally prevails.