Why Subprime Lenders Are Moving to Cash Flow Underwriting

For most of its history, consumer lending ran on the credit score. You pulled a bureau file, read a three-digit number, and made a decision. In subprime, that model has always strained at the edges, because the people applying often have thin files, damaged files, or no recent file at all. The score tells you they’ve struggled before. It doesn’t tell you what’s happening in their account this week. Increasingly, subprime lenders are answering that second question directly, by underwriting on the borrower’s actual bank-account data. Having spent years in consumer lending operations, I’d argue this shift is one of the most consequential changes in the space, and it’s driven by something most coverage misses: it’s not really about risk. It’s about getting paid.

The credit score answers the wrong question

A credit score is a backward-looking summary. It’s built from how someone handled credit in the past, and the data behind it can be weeks or months stale. For a prime borrower buying a house, that’s fine; the score is predictive enough and the loan is secured. For a subprime borrower taking a small, short-term, unsecured loan repaid out of their next few paychecks, it’s close to the wrong tool. The question that actually determines whether that loan performs isn’t “how did this person treat a credit card three years ago.” It’s “will there be money in this account on Friday, and can I reach it.”

Cash flow underwriting answers that. By connecting to the applicant’s bank account, usually through an internet banking verification or open-banking connection the applicant authorizes, the lender sees the things a score can’t: when income actually lands, how large and how regular the deposits are, the velocity of money moving through the account, the current balance trend, and how previous obligations have been paid. That’s a live picture of capacity, not a historical summary of behavior.

In subprime, underwriting is really about collectability

Here’s the part I think gets undersold, and it’s the heart of why this matters. In the subprime world, the loan is typically collected by ACH debit pulled from the borrower’s bank account on or just after payday. The lender’s ability to actually get repaid is mechanically tied to its ability to debit a funded account at the right moment. So underwriting a subprime loan well isn’t only about creditworthiness in the abstract; it’s about collectability in the concrete.

That reframes what the bank data is for. Income timing tells the lender when to schedule a debit so it lands on funds rather than an empty account. Deposit regularity tells the lender whether there’s a dependable payday to align to at all. Balance trends tell the lender whether this is an account that routinely runs dry mid-cycle. From the operations side, the difference between a debit timed to the morning after payday and one timed three days later is the difference between a successful pull and a returned one. Cash flow data is what makes that timing possible, and timing is most of the game.

Why failed debits got more expensive

If you could attempt a debit endlessly at no cost, none of this would matter much; you’d just keep trying until something stuck. That world is gone, on two fronts, and both push lenders toward understanding cash flow before they lend rather than discovering it through failed attempts.

The first is regulatory. The CFPB’s payment provisions for covered payday, vehicle-title, and certain high-cost installment loans took effect March 30, 2025, and they impose a two-strikes rule: after two consecutive attempts to withdraw payment fail for insufficient funds, a lender generally cannot try again without new authorization from the borrower. The mechanism the rule targets, repeatedly hammering an empty account, is precisely the brute-force approach cash flow underwriting makes unnecessary. It’s worth being precise about the rule’s status, because it’s been turbulent: the provisions are in effect, but the CFPB announced in March 2025 that it would not prioritize enforcement or supervision and was contemplating narrowing the rule. That federal posture, though, does not make the rule safe to ignore, because state attorneys general can enforce it directly and consumers can invoke it in private litigation. The exposure is real even where federal enforcement is paused.

The second front is the payments network itself. NACHA, which governs the ACH network, sets return-rate thresholds that an originator has to stay under. The unauthorized-return rate must stay below 0.5% of debits originated, and that one is an enforceable threshold: breach it and you face inquiry and potential penalties. There are two further levels, a 3% administrative return rate and a 15% overall return rate, that trigger a review process rather than an automatic violation. A lender that runs a sloppy debit operation, attempting pulls that bounce, generates returns that push it toward these thresholds, and the consequences run from corrective-action demands to losing ACH origination access entirely. For a subprime lender, ACH access is the business. Losing it is existential.

Put those together and the incentive is unambiguous. Each failed debit now carries regulatory and network cost, not just an operational annoyance. So it’s squarely in the lender’s interest to understand a borrower’s cash flow up front, time debits intelligently, and be confident the limited attempts available will succeed. Internet banking verification at the point of underwriting is one of the more useful tools for doing exactly that, because it turns “let’s try and see” into “we know when the money is there.”

The fraud signal hiding in the transactions

There’s a second payoff to seeing the account directly, and it’s one of the earliest and clearest signals available: first-party fraud. This is the applicant who takes a loan with no intention of ever repaying it, a different animal from someone who falls behind because life went sideways. From the operations side, that distinction matters enormously, and it’s notoriously hard to catch with traditional checks because a first-party fraudster’s stated information can be entirely accurate; it’s the intent that’s fraudulent.

Cash flow data surfaces the tells early. An account opened days before the application with no genuine income history. Deposits that don’t look like real wages. Money that moves out the moment it arrives. A pattern of behavior that doesn’t match the story the application tells. None of these is proof on its own, but in combination they’re a far earlier warning than waiting for the first debit to fail and the borrower to vanish. Catching the no-intent-to-pay applicant before funding, rather than chasing them after, is one of the quieter but more valuable things bank-transaction visibility provides.

Where this is heading

The direction of travel is clear. As the regulatory and network cost of failed collection rises, and as the tooling to connect to bank accounts gets cheaper and more reliable, the case for underwriting subprime loans on real cash flow rather than a stale score only strengthens. The 2026 NACHA rules push further in the same direction, layering in risk-based fraud-monitoring requirements on originated ACH transactions, phased in through 2026. The throughline is that lenders are being pushed, by both regulators and the payments network, toward knowing more about an account before they lend against it and debit from it.

For borrowers, this is a genuinely mixed picture worth understanding. Cash flow underwriting can expand access for people whose credit scores understate them but whose actual income and account behavior are sound, which is a real benefit for the thin-file and credit-damaged borrowers subprime serves. It also means that when you apply for one of these loans, the lender may be looking at your real-time banking activity, not just your credit report. That’s the trade, and it’s better to understand it going in than to discover it after.