Credit scoring with open banking: how to assess thin-file borrowers

Who are thin-file borrowers?

A thin-file borrower is someone with little or no credit history in bureau data: young people, people who recently moved to a country, self-employed workers or customers who simply never borrowed.

Traditional scorecards often decline them, not because they are risky, but because there is not enough information. Lenders lose good customers, and customers are pushed to more expensive alternatives.

How open banking works in lending

Under the EU payment services rules (PSD2), licensed account information service providers can access a customer's payment account data with explicit consent. In a loan application this usually takes a minute: the customer selects their bank, logs in with strong authentication and approves sharing.

• The lender receives transactions for a defined period, typically several months.
• Transactions are categorised: salary and other income, rent, utilities, loan repayments, gambling, cash withdrawals and so on.
• The results feed affordability calculations and scoring rules in the decision engine.

What can be measured from account data?

Account data shows actual behaviour rather than self-declared numbers. Useful indicators include:

• Income stability – regularity and level of salary or business income.
• Committed expenses – rent, utilities, existing loan and leasing repayments.
• Disposable income – what remains after essential and committed spending.
• Account conduct – overdraft usage, returned payments and balance patterns.
• Risk signals – for example frequent payday loans or significant gambling spend.

Building a fair and explainable model

Start with clear policy rules – affordability thresholds and knock-out rules – and add scorecards or machine-learning models once you have outcome data. Every input and reason should be stored with the decision.

Under the EU Consumer Credit Directive (CCD2), creditworthiness must be assessed on relevant and accurate information about income and expenses, and consumers can request human review of automated decisions. Under the EU AI Act, AI systems used to evaluate creditworthiness of individuals are high-risk, with obligations applying from 2 December 2027 after the 2026 AI Omnibus amendment.

Data protection and consent

Transaction data is sensitive. Collect only what is needed, explain clearly why it is used, keep it only as long as necessary and avoid deriving special categories of data, such as health or religion, from transactions.

• Separate consent screens for account access and for the credit check.
• Retention periods for raw transactions and for derived indicators.
• Access restricted by role, with logging of every view.

Implementation checklist

Open banking scoring is a product decision as much as a technical one. A short pilot on one product is the best way to learn.

• Choose an account information provider that covers your target banks and countries.
• Integrate it into the application flow as an optional or required step.
• Define categorisation rules and affordability formulas with the risk team.
• Run decisions in shadow mode first and compare with actual repayment behaviour.
• Monitor approval rates, defaults and customer drop-off, and adjust.

Frequently asked questions