How to authorize alternative data in a fintech credit product
A thin-file segment sits beyond the bureau’s score, and a telco partner offers extra data. Compliance says GDPR rules it out. With the customer's explicit authorization, a lender can access almost any data a third party holds, including telco, utility, tax and spending data. Compliance's objection is to access the customer does not know about.
The customer's authorization opens access to data
The customer's explicit authorization opens access under GDPR, PSD2 and ePrivacy. For consent to support processing under GDPR, it must be freely given, specific, informed and unambiguous. Consent tied to a service the customer cannot refuse may not be freely given. The lender must be able to prove consent, and the customer must be able to withdraw it as easily as they gave it.
The lender must check restrictions on each source and use. For consumer credit, the EU Consumer Credit Directive excludes special category data and places social networks outside the external sources for creditworthiness assessment. The modelling risks are a separate question, covered in alternative data in credit scoring.
For bank account information, PSD2 provides a route through an account information service with explicit consent. For relevant telco traffic data, ePrivacy requires the subscriber’s prior consent for the specified processing.
Consumer data can help fill gaps in the bureau file
For consumer lending, start with what the data can help you assess: income, spending, cash flow, regular payments or address verification. Then identify who holds it and how the customer can authorize access.
| Data | Held by | Helps with | Route |
|---|---|---|---|
| Bank account transactions | The customer's bank | Income, spending, cash flow, income or expense shocks | Account information service on explicit consent |
| Card and consumer spending | Bank, card issuer, spending app | Spending pattern, essential costs, affordability | Account information service, or a partner on the customer's authorization |
| Telco bill payments and usage | Mobile operator | Payment record without a credit file, usage stability, how long the number has been held | The operator or its data provider, on prior consent |
| Utility bills | Energy, water or gas company | Monthly payment record, address verification | The utility or a data provider, on the customer's authorization |
| Tax returns and income statements | Tax authority, the customer | Declared income, self-employed income | The customer's own authorization or a document the customer provides |
| Rent and insurance payments | Landlord, insurer, payment provider | Regular payment record | A provider or partner on the customer's authorization |
| Earnings on a gig platform | Ride-hailing or delivery platform | Income for gig workers, how regular it is | The platform, or the customer's own data export |
These sources add evidence where the bureau file is thin. Each source has its own access route, so verify the holder and authorization for every source.
Business data can show how a small firm is trading
In micro and SME lending, the question is how the business is performing: cash flow, sales, payouts and payment patterns. Platform sales can be useful when the business trades on that platform, but the platform or the business still has to provide an authorized route to the data.
| Data | Held by | Helps with | Route |
|---|---|---|---|
| Business account transactions | The business's bank | Cash flow, revenue, the run of payments in and out | Account information service on explicit consent |
| Sales on a marketplace or e-commerce platform | The platform | Sales volume and trend, how the business is doing on the platform | The platform as a partner, on the owner's authorization |
| Card acquiring and POS terminal data | Acquirer, payment provider | Daily takings, seasonality | The acquirer as a partner |
| Delivery and ride platform payouts | The platform | Turnover of a restaurant, courier or driver business | The platform as a partner, or the owner's data export |
| Telco and utility payments of the business | Operator, utility | Payment record, site address and usage | Provider on consent |
| Tax filings | Tax authority, the business | Declared turnover and profit | The owner's authorization or filed documents |
Keep consumer and business sources separate in the product plan. The holder, authorization and relevant restrictions can differ.
Choose the access route before signing with a provider
Choose a route for each source. Check how the data reaches you and what authority the provider has to supply it.
- Bank accounts. Use an account information service for online account information, based on the customer’s explicit consent. Check the provider on its home state’s public register or the EBA’s central register. Only designated accounts and associated transactions fall within the service, and personalized security credentials remain with the customer.
- Telco and utility data. Approach the operator, utility or its provider. For relevant telco traffic data, check how the operator obtains and records the subscriber’s prior consent.
- Platform data. Use a platform partnership or the customer’s own export where available. Keep the customer’s platform credentials with the customer. Uber’s U.S. terms of use prohibit authorizing a third party to use the account. Check the terms for each platform and account type.
- Provider processing for your lender. Where a provider processes personal data on your behalf, check that the processor contract and provider guarantees meet the applicable requirements.
When a source is unavailable, define the fallback. A data source waterfall sets the order of sources and the fallback when one returns nothing.
Put the partner’s price against the value to the book
Agree the price per request or per hit and any revenue share before you commit. Then compare that cost with what the data can save or change in the decision.
A source may identify more applicants to reject, but it can also flag good applicants. Those false positives have a cost, just as rejected bad loans may avoid losses. Test any approval or loss improvement on the lender’s own book. Use the alternative data payoff tool to test the price against hit rate, rejected good and bad applicants, and the expected savings.
Make authorization separate, clear and provable
Ask for authorization as its own part of the application, in plain language that names the source, the data and the purpose. If the loan can be assessed without that data, the customer must be able to refuse the authorization and still access that loan. Explain withdrawal before the customer agrees, and make withdrawal as easy as giving consent.
A second action, such as an SMS code, can confirm the customer’s authorization, and the customer still needs to see what they agreed to. The EDPB consent guidelines say the record should make it possible to show how and when consent was obtained and what information the customer saw at the time. The record must be kept for as long as processing continues, and both lender and partner must be able to produce it after a complaint.
For an EU consumer creditworthiness assessment, exclude social network data and special category data. That limit applies even when the customer consents.
Check the authorization before calling the provider
The lender captures the authorization in its own application system, outside Decisimo. Pass the record with the application, check that it exists and names the source before the data call, and stop the call if it is missing or names a different source. The data call can be set up as a source in a decision flow.
Keep the run’s decision trace beside the provider’s response so the team can investigate what happened when a complaint arrives. A failed provider call must remain distinguishable from a result that contains no match. This article offers general information, and the lender’s own counsel can provide legal advice on its setup.
Return to the thin-file segment and the telco partner’s offer. The offer is not a dead end, provided the customer sees and confirms the access and the record exists. Before the plan goes live, work through the access decision in order:
- List the data needed, who holds it and what it helps decide. Keep consumer and business lending separate.
- Choose the route for each source: an account information service for bank accounts, the holder or its provider for telco and utility data, and a platform partnership or customer export for platform data.
- Check the provider’s status and practices: verify an account information provider on the relevant register, check the subscriber-consent process for telco data, and review processor guarantees where a provider processes on the lender’s behalf.
- Agree the commercial terms, including price per request or hit and any revenue share, then test the price against expected savings and the cost of false positives.
- Write a separate authorization in plain language that names the source, data and purpose, and make withdrawal as easy as giving consent.
- Confirm the authorization, for example with an SMS code, and retain evidence of when and how it was given and what the customer saw. Make the record available to both lender and partner.
- Pass the record into the decision, stop the data call if it is missing or names the wrong source, and keep the run trace beside the provider response.
Questions about alternative data authorization
Is customer consent enough to use alternative data under GDPR?
No. Consent must be freely given, specific, informed and unambiguous, and the lender must be able to prove it. It does not override other legal limits. Keep the authorization separate from loan terms when the data is not necessary for the loan, and check the restrictions that apply to the source and use.
What should a record of the customer’s authorization contain?
It should show when and how authorization was given and what information the customer saw at the time. Keep evidence of the confirmation for as long as the processing continues, and make it available to the lender and partner.
Can a lender read a customer’s bank account data under PSD2?
Yes, through an account information service for online account information, with the customer’s explicit consent. Only designated accounts and associated transactions fall within the service, and personalized security credentials remain with the customer. Check the provider’s registration or exemption on the relevant public register.
Can a lender use telco data for credit decisions?
Yes. Under ePrivacy, an operator may process traffic data to provide a value-added service with the subscriber’s prior consent, which the subscriber can withdraw. Check the route and the restrictions that apply to the data before using it in a credit decision.
Can a data provider log in to the customer’s platform account for the lender?
Do not use that route. Uber’s U.S. terms of use prohibit authorizing a third party to use the account, and they do not establish the terms for other platforms or account types. Use a platform partnership or the customer’s own data export instead.
What data must not be used in a consumer creditworthiness assessment in the EU?
Do not use GDPR special category data or social network data for the assessment. The EU Consumer Credit Directive excludes special category data and says social networks are not an external source for this purpose. Check the applicable requirements for the product and market.
What alternative data helps in micro and SME lending?
Business account transactions can help assess cash flow and revenue. Platform sales, payouts, acquiring data, telco and utility payments, and tax filings can help assess business activity and payment patterns. Choose the route based on who holds each source.
Does the customer have to agree to an automated credit decision?
Not in every case. GDPR provides an exception for solely automated decisions with significant effects when they are based on explicit consent or are necessary for entering into a contract, and it requires safeguards including human intervention, the chance to express a view and the right to contest the decision. Build those safeguards into the decision process and check the applicable consumer-credit rules.
