Cash-Flow Underwriting: A Practitioner's Guide

The model was the easy part. In the private-credit years, the cash-flow work that ate actual weeks was operational. The applicant whose account connected on Tuesday and stopped returning transactions on Friday. The sole proprietor whose personal chequing account paid both his rent and his supplier. A categorizer that filed a rent debit as an internal transfer for eleven files running before anybody caught it.

Cash-flow underwriting derives a credit decision from an applicant's transaction history rather than from a summary of past borrowing. A cash flow underwriting guide has to cover five stages: acquiring the data, normalizing it, extracting signals, expressing a policy, and monitoring that policy in production. Most failures live in the first two stages, and almost none are modelling problems.

What does a cash flow underwriting guide have to cover?

Five stages, and the unglamorous ones carry the risk. Acquisition is how a transaction history reaches the lender. Normalization turns raw postings into categorized, deduplicated, dated records. Signal extraction computes the variables. Policy turns variables into an outcome. Monitoring tells the lender whether any of it still works next quarter.

The signals are the best-documented part of the method, catalogued separately in the cash-flow signals and what each one predicts. A well-specified variable computed on a file that lost three weeks of transactions to a broken connection is a wrong number wearing a right number's clothes.

How does the data actually get in?

Three routes, with very different reliability. A direct API connection to the institution returns transactions from the bank's own systems. Credential-based collection logs in as the applicant and reads the screen, an approach examined in what replaces screen scraping. Documents are the fallback when neither connection works.

Open Banking Limited's API performance report for June 2026 gives the cleanest published picture of a mature API route: 99.50% of 2.82 billion calls succeeded, average response time 349 milliseconds, and average availability of 99.80% weighted by call volume. The unweighted figure that month was 99.35%. That spread is the number to read, because volume weighting flatters the large institutions and hides the small ones.

Credential-based collection is still the volume route in North America. The Department of Finance Canada put the number of Canadians whose data is shared by screen scraping at roughly 9 million in a news release on 26 June 2026, announcing draft Consumer-Driven Banking Regulations that were pre-published in the Canada Gazette, Part I on 27 June 2026. FinRegLab's February 2020 policy overview named its operational cost plainly: with screen scraping, "accuracy and access can be reduced whenever banks change their systems."

Coverage has a floor underneath all of it. The FDIC's national survey released 12 November 2024 found 4.2% of US households, about 5.6 million, held no bank or credit union account in 2023, with a further 14.2% underbanked. Some share of every applicant population has nothing to connect, which makes the document route permanent.

What breaks after the connection works?

Consent, credentials, and the institution. A connection is a standing arrangement, and standing arrangements decay. Access ends when the applicant changes a password, when a bank alters its authentication flow, when a card is reissued, or when the permission reaches the end of its term and nobody renews it.

The UK made the size of that last problem visible by changing it. Open Banking Limited announced on 29 November 2021 that the Financial Conduct Authority had replaced the requirement for consumers to re-authenticate with their bank every 90 days with reconfirmation given to the data recipient directly. A re-authentication step falling due at day 90 of a facility is one that some meaningful share of people never complete.

The consequence for underwriting is that data age becomes a variable of its own. A file decisioned on a connection that last refreshed nineteen days ago is a different file from one refreshed this morning, and the difference appears nowhere in the transaction data. It lives in metadata most pipelines discard. Connection success, refresh success and median data age at decision, broken out by institution, cost nothing to compute and tend to surprise people the first time they are seen.

Why is transaction categorization the weakest link?

Because every ratio downstream inherits its errors silently. Categorization assigns each posting to a type, and published accuracy is good rather than excellent. A misfiled rent debit does not surface as a missing value. It surfaces as a slightly better applicant.

Ta, Ben Saad and Oh of Oney Bank's data science team, in an April 2025 paper classifying open banking transactions across 84 categories of French retail bank data, reported 94% precision and 94% recall on their best configurations. Sparse categories fared worse: their advance-salary class returned 77% precision on eleven samples.

Business data is harder. Aluffi and co-authors from the University of Warwick and SME Capital, in a 2025 paper on categorising SME bank transactions from UK open banking data, reported 73.49% accuracy overall, plus or minus 5.09, and 90.36%, plus or minus 6.52, where the classifier's confidence exceeded 0.8. They describe SME descriptions as "nonstandard and inconsistent across businesses and industries," and quote the raw strings: "biffa waste servic ltd b47391 bbp," "UTILTY ENERG PAY MAR2024 9876 FT."

Ninety-four percent sounds fine until it propagates. A rent debit read as an internal transfer removes a fixed obligation and improves every headroom ratio on the file. A loan payment read as a supplier payment hides existing debt service. The decision that follows is internally consistent and wrong.

The confidence score matters more than the accuracy headline. A pipeline that returns a category and drops the model's confidence in it has discarded the only field identifying which files deserve a human. The Warwick numbers make the point: the same classifier is a 73% system across everything and a 90% system on its confident subset, and the distance between those two is a routing rule rather than a better model.

How do joint and commingled accounts distort a cash-flow file?

They attribute one pool of money to one applicant when it belongs to two. A joint chequing account holds a household's flows, and no published method exists for splitting them between the holders. A sole proprietor's personal account holds the business and the person at once, in the same statement, under the same descriptors.

Small business credit already runs on that entanglement. The Federal Reserve Banks' 2026 Report on Employer Firms, released 3 March 2026 from 6,525 responses to the 2025 Small Business Credit Survey, found that among firms holding debt, 59% used a personal guarantee against 51% using business assets. For most small firms the two balance sheets are joined at the point of credit, so a pipeline treating them as separable is modelling a structure that is not there.

The workable move belongs at intake rather than in the model. Asking who else holds signing authority, and whether the account carries both personal and business activity, produces a field the pipeline can branch on. Inferring it afterward produces a guess.

Why does income recognition fail for irregular earners?

Because recurrence detection assumes a stable amount arriving on a stable cadence, and a large share of earners have neither. An income engine looks for repetition. Hourly work, shift work, commission and platform earnings repeat in neither amount nor date, so the pattern the engine searches for is not in the data.

The JPMorganChase Institute, in research published 30 September 2025 with fellows at the University of Chicago, found that for hourly workers, take-home pay changes in seven out of every ten months even while they stay in the same job, that the typical monthly change is 9%, and that one month in four brings a change of 21% or more.

Canada has counts but not distributions. Statistics Canada reported on 4 March 2024 that 468,000 people, 1.7% of those aged 15 to 69, worked through a digital platform and were paid by the platform in the twelve months to December 2023, and that 871,000 Canadians did gig work as their main job in late 2022.

Recognition fails in two directions and the second is worse. Missed income understates capacity, produces a decline, and is at least visible in the funnel. Deposits wrongly recognized as income overstate it, the classic case being a transfer between an applicant's own accounts counted as a paycheque. That one never appears in a decline report, because the file was approved.

Where a cash-flow pipeline breaks, what the failure looks like in the file, and the measurement that catches it.

Stage	Common failure	How it shows up downstream	What to measure
Acquisition	Institution unsupported, or applicant declines to connect	Coverage gaps concentrated in specific banks or regions	Connection attempt and success rate by institution
Refresh	Consent lapse, credential change, auth flow change	Stale balances presented as current	Refresh success rate; median data age at decision
Normalization	Recurring obligation miscategorized	Fixed obligations understated, headroom overstated	Share of transactions below the confidence threshold
Income recognition	Irregular cadence unrecognized, or transfers read as pay	Capacity misstated in both directions	Share of deposits unassigned to an income stream
Account scope	Joint or commingled account treated as single-party	A household or two entities read as one applicant	Share of files with a second signatory or mixed use
Policy	Undocumented threshold change	Past decisions cannot be reproduced	Policy version stamped on every decision
Monitoring	Input distribution drifts	Approval rate moves with no policy change	Monthly stability of each input distribution

How does a policy get expressed so it can be replayed?

As a versioned artifact separate from the model, with every decision recording what it read. Reproducing a decision from eight months ago takes three things: the thresholds in force that day, the feature values as computed then, and the data window behind them. A policy living inside model code cannot deliver that, because retraining moves it.

1. The policy is a named, versioned object. Thresholds, segment definitions and routing rules sit in it, and the version identifier is stamped on every decision it produces.
2. Each decision stores its inputs, not only its output: feature values, the transaction window, the age of the newest transaction, and that file's categorization confidence distribution.
3. Missing data gets its own branch rather than a default. Sixty days of history and four hundred are different populations, and treating a null as a zero is how a thin file becomes a good one.
4. Thresholds carry the date and the book they were fitted on. No published research establishes cut-offs for cash-flow variables, so every number in the policy is a house number, and recording its provenance matters more than its value.
5. Changes run in shadow before they run live. The new policy scores the same files as the old, and the disagreement rate is examined before anything switches.
6. Manual overrides are logged as overrides. An override rate climbing month over month is the earliest available signal that a policy has stopped matching the book.

What does monitoring a live cash-flow policy require?

Watching the inputs as closely as the outcomes, because the inputs arrive from outside the building. A cash-flow policy sits on a data connection, a categorizer and often a scoring layer that all belong to somebody else. Any of them can change without the lender receiving a release note.

OSFI's Guideline E-23 on model risk management, published 11 September 2025 and effective 1 May 2027 for federally regulated financial institutions in Canada, describes monitoring standards covering "changes in: model performance, model usage, input data, external dependencies," alongside model drift, thresholds for breaches, and contingency plans for "deterioration in model performance, or outright failure."

The Bank of England and Financial Conduct Authority's survey of artificial intelligence in UK financial services, published 21 November 2024 from 118 responding firms, found 33% of AI use cases were third-party implementations, up from 17% in 2022, and 46% of firms reported only partial understanding of the technologies they use. The gap sat in externally supplied models.

Four measurements catch most of what goes wrong, all of them monthly. Connection and refresh success by institution. The categorization confidence distribution, watched for shifts rather than levels. The distribution of each policy input against the population its thresholds were set on. Outcomes by policy version.

Approval rate is the noisiest of those metrics and the one most often read alone. It moves when the policy changes, when applicant mix changes, when a categorizer is updated upstream, and when one large institution's connection degrades. Read on its own, it produces a confident wrong explanation nearly every time.

What we couldn't verify

Several things, and the gaps are worth naming rather than filling. Cash-flow underwriting has a well-developed signal literature and almost no published operational benchmarks, so the figures below are ones this article went looking for, could not find, and will not estimate.

No published benchmark exists for bank data connection success rates by institution in North America. Open Banking Limited publishes availability and call success for the 20 CMA9 brands in the UK and excludes everyone else. No Canadian or US body publishes an equivalent series.

No source establishes a minimum length of transaction history for underwriting. FinRegLab described participating lenders using windows of roughly three to six months without evaluating that choice, a question taken up in how much history a lender actually needs.

No comparable accuracy benchmark exists for production categorization engines. The two papers cited here use different taxonomies, countries and data, so their numbers describe those systems rather than the field. No public dataset quantifies how often applicant accounts are joint or commingled, and no published method apportions joint-account flows between holders.

No Canadian equivalent of the JPMorganChase Institute earnings-instability research exists. Statistics Canada publishes counts of gig and platform workers, not distributions of month-to-month earnings variation.

The pipeline is describable and its failure modes are known. The numbers that would let a lender calibrate against anyone else are unpublished, which makes each book its own benchmark.

Common questions

What is cash-flow underwriting?
Cash-flow underwriting derives a credit decision from an applicant's transaction history rather than from a summary of past borrowing. The full method has five stages: data acquisition, normalization, signal extraction, policy expression and production monitoring. The signals are the best-documented stage, while acquisition and normalization produce most operational failures.

How accurate is transaction categorization?
Published research puts it in the low-to-mid nineties for consumer data and lower for business data. A 2025 Oney Bank paper reported 94% precision and recall across 84 consumer categories, while a 2025 University of Warwick and SME Capital paper reported 73.49% accuracy on SME transactions, rising to 90.36% on high-confidence predictions.

What causes a bank data connection to break?
Credential changes, altered authentication flows at the institution, and consent reaching the end of its term. Open Banking Limited reported for June 2026 that 0.50% of UK open banking API calls failed, and that unweighted availability of 99.35% sat below the volume-weighted 99.80%, meaning smaller providers performed worse than the headline suggests.

How much cash-flow history is enough?
No published research answers this. FinRegLab described participating lenders using roughly three-to-six-month windows without evaluating the choice, and no study compares decision quality across history lengths. Any window a lender runs is a house standard, and short-history files are better treated as a separate population than as a defaulted one.

Why does income detection fail for gig and hourly workers?
Because recurrence detection assumes stable amounts on a stable cadence. The JPMorganChase Institute found in September 2025 that for hourly workers, pay changes in seven of every ten months even while staying in the same job, that the typical monthly change is 9%, and that one month in four brings a change of 21% or more.

---

Carousel handles acquisition, refresh and normalization so the policy layer receives a clean transaction history. See how verification fits your flow