Credit was the first place finance let algorithms decide. Agentic systems now push further, into real time limits and dynamic pricing. The law, however, still demands a reason a human can understand.
In Summary
Creditworthiness assessment is classified as high risk in the EU. Those obligations now apply from 2 December 2027 after the AI Omnibus deferral.
US guidance moved the other way. The CFPB withdrew its circulars on algorithmic adverse action notices in May 2025.
The underlying duty survived. Regulation B still requires specific reasons when a lender takes adverse action on an application.
Supervisors refreshed the model rulebook. The Federal Reserve issued SR 26-2 in April 2026, replacing guidance that had stood since 2011.
Speed is the real change. Dynamic limits and continuous reassessment mean a customer’s terms can move between logins, not between annual reviews.
Credit scoring taught finance to trust statistics. Decades before generative AI, lenders already let models approve or decline applications. The decision was automated. The logic, however, was documented and stable.
Agentic systems change that balance. They pull fresh data, adjust limits continuously, and reprice risk in the background. As a result, the decision becomes a moving target.
Small business lending shows the shift most clearly. An agent can read invoices, bank feeds, and accounting exports in minutes. Work that once took a relationship manager a fortnight now finishes before lunch.
What alternative data really adds
Traditional underwriting depends on repayment history. That works well for people who have borrowed before. It works badly for young applicants, migrants and small firms with thin files.
Cash flow data changes the picture. Salary regularity, rent payments, and account volatility describe the capacity to pay directly. Consequently, some applicants who look invisible in a bureau file look perfectly creditworthy in a bank statement.
Yet every new variable carries a risk of proxy discrimination. Postcode data can stand in for ethnicity. Device data can stand in for income. Therefore, testing matters as much as prediction.
Consent adds another layer. Using transaction data usually requires the customer to share it, often through open banking. Access, therefore, depends on rules about data rights as much as on modelling skill.
The explainability problem
When a lender declines an application, many jurisdictions require a reason. In the United States, Regulation B requires a statement of specific reasons for adverse action. That duty sits in law, not in guidance.
The CFPB spelled out the implications for machine learning in Circular 2022-03. Complexity, it said, does not excuse a lender from giving accurate and specific reasons. A model no one can explain is therefore a compliance problem, not merely a technical one.
That guidance is no longer in force. The Bureau withdrew both circulars on 12 May 2025 as part of a wider rollback. The statute, however, remains. Lenders still owe borrowers a reason.
Explainability also protects lenders. Reason codes reveal when a model has latched onto something absurd, such as a browser type. Without them, a portfolio can drift for months before anyone notices.
Europe took the opposite turn
The European Union classified creditworthiness assessment as a high-risk use of AI. Under the current framework, obligations for those Annex III systems apply from 2 December 2027, following the AI Omnibus that entered into force on 27 July 2026.
High-risk status brings real duties. Risk management systems, data governance, technical documentation, human oversight, and post-market monitoring all become mandatory. In effect, the model must be able to defend itself.
Divergence creates practical headaches. A group lending in Frankfurt and Chicago cannot easily run two philosophies of documentation. Most large lenders, therefore, adopt the European standard as the internal baseline.
Supervisors rewrote the model rulebook
Banking supervisors did not sit still either. On 17 April 2026 the Federal Reserve issued SR 26-2, replacing model risk guidance that had stood since 2011. It sets a risk-based approach tailored to a bank’s model risk profile.
Internationally, the direction is similar. IOSCO published an AI supervisory toolkit in May 2026, and the FSB consulted on twelve sound practices covering the AI lifecycle. Governance, not prohibition, is the common theme.
Vendor models complicate this further. When a bank buys a scoring model, the documentation duty does not transfer with the licence. Supervisors expect the bank to understand what it has deployed.
Dynamic limits change the customer experience
Traditional lending reviews a customer annually. Agentic lending can review continuously. A limit might rise after a salary increase and fall after a run of irregular income.
Borrowers may find that unsettling. A credit line that shrinks without warning can turn a manageable month into a difficult one. Firms should therefore treat notice periods and reason codes as product features rather than paperwork.
Regulators are already watching this space. The FCA’s AI Live Testing cohort includes consumer credit score insights, alongside agentic payments and financial crime detection.
Corporate credit faces a quieter version of the same shift. Agents can read filings, covenants, and news continuously, then flag deterioration early. Analysts gain time, although the final judgement still needs a signature.
Who is accountable
Accountability sits with the lender, not the vendor. That principle appears repeatedly in supervisory material, and the FCA survey found that 84% of firms already name someone accountable for AI.
Practical governance, therefore, comes down to four artefacts. A documented model. A tested fairness assessment. A reason code library. An override log showing when humans intervened.
Credit decides who gets money. Fraud decides who takes it. In the next part, we turn to the arms race between AI defences and AI-enabled crime.
