Enterprise platforms · Banking
Credit approval workflow and delegated authority software
We build credit approval workflow and delegated authority software for banks and lenders: the matrix of who may approve what, routing to the right people in the right order, escalation when a step stalls, and a decision log that keeps the inputs behind every outcome. It works with your origination and servicing systems rather than replacing them, and you own the code.
RFP template · Banking
SME lending platform RFP template
Requirements to put in an RFP for an SME loan management system, from application intake to regulatory reporting, plus the questions to ask every vendor.- 01Eight requirement areas, each as a checklist you can paste into an RFP.
- 02Integration and data points your core banking and IT teams need to answer.
- 03Security, resilience and regulatory items that are easy to miss.
- 04Seven questions to put to any vendor or development partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Authority matrix
Approval limits by amount, product, risk grade, tenor, collateral cover and customer group, held as versioned tables that credit risk owns and can change without a release. - 02
Workflow engine
Serial, parallel and conditional routing, with the path calculated from the case itself rather than chosen by the person who submits it. - 03
Four-eyes and independence
Rules that stop the originator approving their own case, that require a second function for certain exceptions, and that block conflicted reviewers. - 04
Committee packs and sessions
Agenda, pack assembly, voting or sign-off, minutes and recorded conditions for each committee, whether it meets live or circulates papers. - 05
Policy exceptions
Exceptions raised as structured items with a reason code, an approver level and an expiry, so they can be reported and reviewed as a population. - 06
Delegation and absence
Temporary delegation with a validity window, automatic reassignment when an approver is away and a record of who acted on whose authority. - 07
Service-level timers
Clocks per step, reminders and escalation to a line manager, with queue and turnaround reports by team and product. - 08
Conditions of approval
Conditions attached to the decision and tracked to completion, so a drawdown cannot proceed while one is open. - 09
Decision log and evidence
Every decision stored with the inputs, rules and model versions, the people involved and the time, so it can be reproduced for audit or a regulator.
Reference architecture.
Standards and interfaces
What we design against.
- BPMN 2.0
- The notation for the approval paths, drawn so credit, risk and operations can read the same diagram that the engine runs.
- DMN 1.3
- Decision tables for authority and routing rules, owned by credit risk and testable before they go live.
- OpenAPI and webhooks
- How origination and servicing systems submit cases and receive decisions without polling.
- SSO with SAML or OpenID Connect
- Identity and role claims from the bank's directory, so authority follows the person's current position.
- Event streaming
- Decision and exception events published for risk reporting and audit data stores.
- Supervisory expectations on governance
- Clear lines of approval, independence and record-keeping that internal audit and regulators ask to see.
Data model
The core entities.
- Case
- The item to approve, its source system, requested terms, exposure, risk grade and documents.
- Authority rule
- Conditions, approver level, version, effective dates and the person who changed it.
- Approval step
- Assigned role, assignee, due time, outcome, comment and the authority under which they acted.
- Committee session
- Date, members present, cases heard, votes, minutes and recorded conditions.
- Exception
- Policy breached, reason code, approver, expiry and whether it has been closed or renewed.
- Delegation
- Delegator, delegate, scope, start and end, and the cases decided under it.
- Decision record
- Final outcome with the rule, model and data versions that produced the routing.
When custom development is the right call.
Controls designed in, not added later.
Separation of duties
The system enforces who cannot approve what, rather than relying on training or convention.Tamper-evident log
Decisions and rule changes are append-only, with the previous value, the user and the time.Change control on rules
Changes to the authority matrix need a maker and a checker, are tested against historical cases and take effect on a stated date.Role-based access
Case content is visible only to people on the route, with restricted cases hidden from everyone else.Availability
Queues and timers survive a restart, and a case never loses its place if a component fails.
From discovery to a system you run.
- 01
Authority and policy review
We read the credit policy and delegation documents with credit risk and compare them with how approvals really move today. - 02
Rules and workflow design
The matrix, routing and independence rules are written as decision tables and flow diagrams and signed off by the policy owners. - 03
Integration with lending systems
Submission, decision and condition interfaces are built and tested against each lending system's test environment. - 04
Replay against history
Last year's cases run through the new rules to show where routing would have differed, before anything goes live. - 05
Go-live and tuning
Teams move across in turn; timers, queues and reports are tuned with the people who use them.
Relevant work
Where to see our work.
Related
Keep reading.
Common questions.
- Can the authority matrix be changed without a software release?
- Yes. The matrix is data, not code. Credit risk edits it under maker-checker control, tests it against past cases and publishes it with an effective date.
- How does it work with several lending systems?
- Each system submits cases through an API and receives the decision and conditions back. The approval layer holds the matrix, the route and the evidence in one place.
- Can we replay past cases before go-live?
- Yes. Historical cases are run through the new rules and compared with what actually happened, so differences are explained before they reach a live case.
- Does it support committees that meet in person?
- Yes. Packs are built from the file, the committee records votes and conditions in the session, and minutes are attached to each case.
- Who owns the code and the data?
- You do. The code, the rules and the decision history stay yours.