How can NBFCs use AI in underwriting without losing auditability?
The short answer
By separating assembly from decision. An agent can ingest the file, ground every claim in a cited page and recommend a review tier, which is where most of the elapsed time sits. The credit decision stays a human action, and the log retains model version, prompt version, retrieved evidence and the officer's decision together.
Reviewed by Branemind engineering team. Last updated .
Auditability is a storage problem before it is a model problem
The examination question is not whether a model was used. It is whether the file as it stood on the decision date can be reconstructed: what documents were present, what the summary claimed, what evidence supported each claim, and who decided.
That is achievable, and it is mostly a matter of storing the right things together at the right moment. What breaks auditability is a system that keeps the output and discards the inputs, the model version and the retrieval context.
The pattern that works
- Ingest and normalise the pack, surfacing quality gaps as items to chase rather than interpolating them.
- Ground every claim in the summary with a page citation, so a reviewer verifies rather than re-reads.
- State the case for and against the file, then assign a review tier.
- Hand the assembled file and the recommendation to a credit officer, who decides.
- Retain model version, prompt version, retrieved evidence, recommendation and human action as one record.
Why the decision stays human
Partly because the accountability is a person's and the trail has to name them. Partly because the elapsed time being complained about is assembly, not deliberation, so automating the decision buys little and costs a great deal in defensibility.
Where this stops being true
- Grounding reduces fabrication, it does not eliminate it. Citation accuracy needs sampling against human review as an ongoing control, not a one-off acceptance test.
- Poor scan quality propagates. An agent that cannot read a statement reliably should say so rather than produce a confident summary of a bad OCR.
- This describes an engineering pattern, not regulatory advice. Your compliance team owns the position, and the applicable rules change.
The human control point
The credit decision itself, plus a named compliance reviewer who samples files to check that reviewers are opening the evidence rather than rubber-stamping recommendations.
Primary sources
Related questions
Does an underwriting copilot need to run in our own cloud?
Not necessarily, but it is a decision to make before the build. Constraining processing location and provider choice afterwards is expensive, and it is a question your compliance team will ask early.
How do we know the summary is not inventing facts?
Require a citation for every claim and treat an uncited claim as a defect rather than a low-confidence result. Then sample summaries against human review continuously, because grounding is a control you monitor, not a box you tick.