Cash Flow Underwriting: How It Works for CDFIs and Community Lenders

Cash flow underwriting means judging a loan application by the money moving through the borrower's bank accounts. The lender looks at what comes in, what goes out, and what is left over, month by month, and asks whether the new payment fits. A credit score tells you how someone handled past debt. Bank data tells you whether they can pay this loan now. CDFIs are certified to serve "people who lack access to financing," and many of their borrowers have a thin credit file (only a few accounts on record) or no file at all. For those borrowers, the second question is often the only one with a usable answer.

Federal regulators described the method in a 2019 interagency statement on alternative data from the Federal Reserve, CFPB, FDIC, OCC, and NCUA. Cash flow analysis, they wrote, "generally focuses on assessing whether a borrower is able to meet new or existing recurring obligations by evaluating income and expense activity over time." Judging repayment from income and expenses is old practice. The newer part is doing it with electronic bank data instead of a stack of paper.

How cash flow underwriting works, step by step

1. The borrower gives permission to share bank account data, by connecting the account or uploading statements.
2. The data comes in, usually several months to two years of transactions, set by your policy.
3. Transactions get sorted into deposits, payroll, rent, loan payments, owner draws, and transfers between the borrower's own accounts.
4. Metrics get calculated: average inflows and outflows, net cash flow, low balances, and overdraft counts.
5. The underwriter compares the metrics to policy, such as whether net cash flow covers the new payment by a set margin.
6. The decision and its reasons go in the loan file.

What bank data a cash flow underwriter looks at

In a 2025 study of more than 38,000 small business loans, FinRegLab found that account deposits and balances were the most predictive cash flow measures. Withdrawals, swings in balance, and times the account ran low or negative also signaled risk. In practice, underwriters tend to track these:

The 2019 regulator statement adds that cash flow data can help people who show "reliable income patterns over time from a variety of sources rather than a single job." That describes a lot of CDFI borrowers: a food truck owner, a home health aide working for two agencies, a contractor paid by the job.

Bank connections vs. uploaded statements

Borrower-permissioned bank connections. The borrower logs in through a data aggregator (a company that connects to banks and pulls transaction data) and grants access. The transactions arrive structured, so every file gets sorted and scored the same way. The regulators noted that this kind of express permission "enhances transparency and consumers' control over the data."

Uploaded PDF statements. Some borrowers will not connect an account. PDFs still work, but staff must read or extract them and check for signs of editing. In FinRegLab's pilot with five mission-based lenders, including Allies for Community Business, Ascendus, and LiftFund, the lenders weighed "potential tradeoffs with regard to inclusion and efficiency" when keeping manual backup processes. Dropping the manual path saves staff time. It can also turn away the borrowers least comfortable sharing a bank login.

Federal open banking rules are unsettled. The CFPB finalized its Personal Financial Data Rights rule under Section 1033 in October 2024. It gives consumers a right to send their transaction data to third parties they authorize. As of late September 2026, it is not being enforced. A federal court in the Eastern District of Kentucky blocked enforcement, so the first compliance date of April 1, 2026 passed without binding anyone. The CFPB began reconsidering the rule in August 2025 and, in August 2026, sent a new proposal for White House review before public comment. Do not plan around the 2024 rule applying as written. It is also written for consumer accounts, so it says little about small business accounts.

Cash flow underwriting vs. credit score underwriting

The two methods answer different questions, and the research favors using both where you can.

FinRegLab's 2019 review of six lenders found cash flow scores and attributes were "generally at least as strong as the traditional credit scores" at predicting who would repay. Cash flow data also helped sort borrowers whom a credit score rated as the same risk. In the 2025 small business study, adding cash flow data to the owner's personal credit score improved predictions most "for low-score owners whose businesses are young (less than five years old)."

A credit report still earns its place. It shows past defaults, collections, and debts paid from other accounts. A practical approach is to read both and let cash flow carry more weight when the credit file is thin.

A cash flow underwriting example

This example uses made-up, round numbers to show the math. It does not describe a real borrower.

A catering business applies for a $30,000 term loan. The owner has a thin personal credit file. Under the lender's assumed terms, the new loan payment is $1,000 a month. The owner connects the business checking account, and the lender pulls 12 months of data.

Say the policy asks for coverage of at least 1.25 times and no more than 3 NSF events in 12 months. This file passes both. The underwriter still asks about January, when catering slows, and might set the first payment in March or require a small reserve.

For a line of credit, the same data can size the limit as a share of average monthly deposits, and a fresh pull at renewal shows whether the business grew or slipped.

What you need in place before you start

FinRegLab's pilot lenders reported "persistent staffing and capacity challenges in selecting and managing technology platforms and vendors." Before launch, confirm you have:

• Written consent. A plain disclosure of what you pull, for how long, and why, saved in the loan file.
• One place for the data. The metrics should land on the loan record next to the application and credit report, not in a shared drive.
• Written policy. Define each metric, time window, and threshold so two underwriters reach the same answer.
• Decision records. Save the metrics and the policy version used, so you can show an examiner or funder how you decided.
• Specific adverse action reasons. Regulation B requires specific reasons for a denial, and says "failed to achieve a qualifying score" is not enough. Map each cash flow test to a plain reason a borrower can act on, such as "insufficient cash flow to cover the requested payment" or "frequent overdrafts in the last 12 months." These rules also cover business applicants with gross revenues of $1 million or less.

Fair lending risks to watch

The Equal Credit Opportunity Act and Regulation B bar credit discrimination on a prohibited basis, which includes race, color, religion, national origin, sex, marital status, age, and income from a public assistance program. Those rules apply to cash flow models the same way they apply to credit scores. FinRegLab's 2019 analysis found the cash flow data "appeared to provide independent predictive value across all groups rather than acting as proxies for demographic group." That was one study of six lenders, so test your own model. Review these with your compliance lead:

• Spending categories. Scoring what a borrower buys or where they shop can stand in for a protected trait. Stick to income, fixed costs, balances, and overdrafts.
• Income sources. Because public assistance income is a prohibited basis, your transaction categories should count it as income and never treat it as a warning sign.
• Uneven access. Check who chooses the PDF path and whether they are approved at lower rates.
• Outcome testing. Compare approval rates and reasons across groups on a schedule, and record the results.

Where to start

Pick one product, such as microloans under a set dollar amount. Write its cash flow policy, run it alongside your current process for a few months, and compare the decisions. Your credit committee then has real files to review before anything changes.

If your team works in Salesforce, Fundingo's community lending platform keeps documents, mission criteria, and credit data on the deal record. Underwriting checks then run against the targets you set, with each result and flag shown to the team. Our guide to CDFIs covers how certification works. To walk through a cash flow policy with our team, contact us.