Credit Scoring

Traditional credit scoring models assess a borrower based on their past. But what about the 1.4 billion adults worldwide with no credit history at all? Alternative data is no longer experimental, and the regulatory landscape is catching up, with the EU AI Act classifying credit scoring as high risk and demanding explainability that most black-box models cannot provide.

What is credit scoring?

Credit scoring is the process of evaluating a borrower's likelihood of repaying a debt. The output, typically a numerical score, determines whether a lender extends credit, how much, and at what interest rate. It is the single most consequential automated decision in consumer finance: it determines access to mortgages, business loans, credit cards, and increasingly, non-financial services like rental agreements and insurance. The accuracy of credit scoring depends on robust data governance and increasingly intersects with fraud detection, as synthetic identity fraud can distort the data that models rely on.

Traditional models rely on bureau data: payment history, outstanding balances, length of credit history, types of credit used, and recent applications. These inputs have been refined over decades and are well understood by regulators. The limitation is coverage: bureau data only captures formal credit activity. Consumers who pay rent reliably, maintain consistent utility payments, and manage household finances responsibly but have never taken out a loan are invisible to the model.

The real-time decisioning battleground is where competitive advantage now sits. A lender that can assess creditworthiness at the point of purchase, whether that is an e-commerce checkout, a car dealership, or a mortgage application, captures business that a lender requiring 48 hours of manual underwriting cannot. Speed and accuracy are no longer trade-offs; they are both table stakes.

The landscape

The EU AI Act classifies credit scoring as a high-risk AI application. From August 2026, any AI system used for creditworthiness assessment must meet requirements for transparency, data quality, human oversight, and documentation. Models must be explainable, not just to the regulator, but to the consumer who is denied credit. This effectively prohibits opaque ensemble models that optimise for accuracy without regard for interpretability.

Open banking and open finance regulations are expanding the data available for credit assessment. The UK's open banking framework, the EU's PSD3, and the US CFPB's Section 1033 rules all create regulated pathways for lenders to access transaction data directly from the borrower's bank, with consent. This is the most significant expansion of credit-relevant data since the creation of credit bureaux. Cash flow data, income patterns, spending behaviour, and savings habits become inputs to a credit decision, supplementing or replacing traditional bureau scores.

The tension between inclusion and risk is real. Alternative data sources can extend credit to underserved populations, but they can also introduce new forms of discrimination. A model that uses postcode as a proxy for risk may correlate with ethnicity. A model that penalises irregular income patterns may disadvantage gig economy workers. The FCA's expectations on fair lending, and the Equality Act's prohibitions on indirect discrimination, apply to AI models as much as to human underwriters.

How AI changes this

Machine learning models incorporate alternative data sources, transaction history, cash flow patterns, employment stability, and rental payments, to score borrowers who would be invisible to traditional models. This is not speculative. Several UK challenger banks and fintechs use cash-flow-based credit assessment as their primary decisioning tool, and their default rates are comparable to or better than traditional bureau-based models.

Real-time decisioning is the operational shift. AI models that can process an application, assess risk, and return a decision in under a second enable embedded lending at the point of need. The mortgage application that takes three weeks could, for many borrowers, be assessed in minutes. The technology exists; the regulatory and operational infrastructure to support instant mortgage decisioning is what lags.

Risk assessment models are evolving from point-in-time scores to continuous monitoring. Rather than assessing a borrower once at origination, AI systems track behavioural signals throughout the life of the loan, identifying early warning signs of financial distress before a payment is missed. This benefits both the lender, who can intervene earlier, and the borrower, who can receive support before they default.

The connection to predictive analytics is direct. Predictive models that forecast macroeconomic conditions, sector-specific risks, and regional economic shifts feed into portfolio-level credit risk management. An AI-powered credit function does not just score individual borrowers; it continuously reassesses portfolio concentration risk against changing economic conditions.

What to know before you start

Explainability is not optional under the EU AI Act and it is not a bolt-on. If your model cannot produce a human-readable explanation for why a specific applicant was declined, it does not meet the regulatory requirement. Design for explainability from the architecture stage, not as a post-hoc interpretation layer. Intrinsically interpretable models, gradient-boosted trees with carefully engineered features, for example, often outperform neural networks on this dimension without sacrificing meaningful accuracy.

Bias testing must be continuous, not a one-time exercise. Credit models drift as the population changes, as economic conditions shift, and as the training data ages. A model that was fair at launch can become discriminatory within months if the underlying data distribution changes. Build automated fairness monitoring into your model operations pipeline and define thresholds that trigger retraining or human review.

Alternative data requires consent infrastructure. Open banking APIs provide a regulated mechanism for accessing transaction data, but the consent flow, customer communication, and data retention policies must be designed carefully. The ICO's guidance on legitimate interest does not straightforwardly apply to credit decisioning; explicit consent is the safer path, and it requires a user experience that builds trust rather than confusion.

Start with augmentation, not replacement. Use alternative data to score applicants who would otherwise be declined due to thin bureau files. This is the use case with the clearest ROI, the lowest regulatory risk, and the most defensible consumer benefit. Once you have validated the model's performance on this segment, you can expand its role in the broader credit decision. For the CFO perspective on measuring enterprise AI returns in lending, our leadership guide covers cost structures and timelines.