Why transaction data can add information to bureau scoring — and how a GCC lender tests whether that information is worth acting on.
Cash flow is not a better bureau. It is a different observation of the same customer, and the value is in what the two together support that neither supports alone. The objective is not a better score. It is a better decision.
A credit officer is not ranking a customer. They are deciding whether to extend an exposure, at what price and limit, to someone whose ability to repay may change over its life. The bureau is very good at one part of that — what has happened in the customer's credit relationships. Transaction data addresses another: what is happening in their financial position now.
A bureau file records reported credit behaviour, and it carries a good deal: balances, utilisation, limits, account age, enquiries, status. Its strongest deterioration signals, though, are generally realised credit events — the missed payment, the delinquency — and those arrive after the financial deterioration that produced them. A customer whose income is becoming less regular and whose month-end buffer is disappearing can remain current until the day a payment fails. The payment failure is the bureau event. The deterioration came earlier.
So the economic question is not whether cash flow beats the bureau. It is narrower and more answerable: does cash flow contain information the current decision does not? If it does, it has to show up somewhere a credit officer already recognises — more approvals at the same loss, fewer bad approvals at the same approval rate, better limits and prices, earlier deterioration signals.
Neither signal is the whole picture, and neither is the only alternative to the other. A consumer lending decision in this region draws on at least four observations of the same person.
This paper is about the second layer, and it matters more as the file thins. Cash flow does not solve thin files automatically — transaction data can be incomplete, fragmented or misleading — but it may be the richest observable signal available where credit history is not.
Three propositions sit underneath it, and they are not equally proven.
One — cash-flow data carries information the bureau does not. Well supported by published research, and the basis of everything that follows.
Two — it can signal deterioration earlier than delinquency-based reporting. Strongly supported in principle and in adjacent evidence: a signal defined by the credit event lags the financial deterioration that produces it.
Three — it materially improves decisions on a Gulf consumer portfolio. Untested in public. A hypothesis, and the last sections of this paper are how a lender tests it on its own book rather than taking our word for it.
Underwriting a customer on the movement of money through their bank account, rather than on a record of how they have repaid credit elsewhere.
One build, seven uses. The business case should not rest on a single underwriting application. The same constructs, from the same feed, run across the credit lifecycle.
| Application | What changes | Constructs | Economic effect |
|---|---|---|---|
| Income verification and affordability | A declared figure and a salary certificate are replaced by observed inflow. Variable, multi-source and self-employed income becomes describable. | Continuity · Volatility | Approvals the policy was declining on documentation rather than on risk |
| Debt burden ratio | Obligations the customer is actually servicing enter the calculation, including commitments no bureau reports and no form asks about. | Coverage | Fewer over-limit approvals; fewer wrongly capped good customers |
| Thin-file and new-to-credit approval | A decision becomes possible where credit history does not exist. | All four | Addressable population |
| Limit and price at origination | Exposure is sized against demonstrated surplus and cover rather than a percentage of a declared income. | Coverage · Buffer | Expected loss per account; return on capital assigned |
| Early warning on the existing book | Deterioration becomes visible while the account is current, ahead of any days-past-due bucket. | Buffer · Coverage, as directions | Intervention time, which is what makes treatment cheaper |
| Collections prioritisation | Cannot-pay is separated from will-not-pay before a treatment is chosen. | Buffer · Coverage | Cost to collect; cure rate per contact |
| First-payment-default screening | Circular transfers and one-off top-ups staged ahead of an application are visible in the ledger. | Continuity · Volatility | Early-vintage loss |
Five sit at origination and two on the existing book, and they can be built from the same underlying transaction-data layer. A lender that scopes cash flow as an underwriting project buys one of the seven and pays for all of them.
Early warning is the one most often left on the table. Refreshed monthly on accounts you already hold, the same four constructs produce a deterioration signal ahead of the first missed payment. That is not a better score. It is time, and time makes every downstream treatment cheaper.
The objective is not a better score. It is a better decision.
Three kinds of evidence get used interchangeably here and are not interchangeable. Adoption says a technique is institutionally accepted. Predictive evidence says it ranks risk. Complementarity evidence says it adds something to what you already run — and only the third justifies paying for a second signal.
Adoption. This is not frontier practice. The most conservative underwriting infrastructure in the United States runs it, as do the bureaus that sell the scores it supplements.
Not fintechs taking a position: the agency mortgage system, the score vendors and the bureaus themselves. It establishes acceptance, not performance — and certainly not performance here.
Predictive power. The primary study is FinRegLab's 2019 work across six non-bank lenders: Accion, Brigit, Kabbage, LendUp, Oportun and Petal. In the populations and products studied, cash-flow variables and scores were "generally at least as strong as the traditional credit scores and credit bureau attributes studied."
The qualification matters and we will not drop it: six US non-bank lenders, specific products, specific populations. It establishes that cash-flow data is a serious signal, not a transferable performance figure.
The finding with commercial consequences is the second. Cash-flow data "frequently improved the ability to predict credit risk among borrowers that are scored by traditional systems as presenting similar risk of default." That is the credit officer's actual question: among customers my system treats as the same, does this tell me who is different?
Complementarity. The clearest quantification of why a second signal pays does not come from cash-flow data at all. Berg, Burg, Gombović and Puri studied digital footprints — not transactions — across 254,808 customers of a German e-commerce lender. Bureau score alone: 68.3 percent AUC. Digital footprint alone: 69.6. Both together: 73.6. The correlation between the two scores was approximately 10 percent.
We cite it with the distinction intact. This is not evidence about cash-flow underwriting. It is evidence for the principle underneath it: a new signal does not need to be stronger than the incumbent to create value — it needs to contain information the incumbent does not. That is why correlation matters, and why a weaker but different signal can improve a decision.
On deterioration, the nearest published support is BIS Working Paper 834: a model on machine learning and non-traditional data was "better able to predict losses and defaults than traditional models in the presence of a negative shock to the aggregate credit supply," with a comparative advantage that "tends to decline for borrowers with a longer credit history." The advantage is largest where history is shortest.
There is no published body of evidence demonstrating the performance of transaction-based cash-flow underwriting across a representative UAE or Saudi consumer-credit population. None.
Which means the following are hypotheses to test, not facts to declare: that cash flow will outperform bureau scoring; that it will produce higher approval rates at constant loss; that it will predict deterioration months earlier in every portfolio; that it will work equally well across all GCC segments.
The absence of Gulf evidence is not an argument against the technique. It is the reason to run the experiment. The Gulf question is empirical, not philosophical — and it is answerable, on your own book, in a quarter.
That gap is also the opportunity. The advantage in this technique does not sit in the model, which is replicable. It sits in the performance data a lender accumulates by originating and monitoring against it — data that cannot be bought and that compounds. The first institution here to build it owns it.
And an AUC gain is not an economic result. Three points of discrimination tells you nothing about where the improvement sits relative to your cut-off, whether it moves any decision at all, whether the additional customers are profitable at your price, or what the integration costs to run.
A model can rank better and change nothing.
Cash-flow underwriting fails most easily in construction. The data permits thousands of variables; that is not a reason to put thousands into a decision. The standard failure is four hundred attributes built because the feed allows it, no economic intuition behind any of them, and noise fitted across ninety days.
Build four. Not because four is a magic number, but because these are the dimensions on which a repayment obligation actually fails: the income stops, the obligations outgrow it, the pattern becomes unreliable, or the reserve runs out. Each is measured twice — as a level and as a direction. The level underwrites an application; the direction monitors a customer. A healthy buffer today can still be deteriorating; a modest one can be entirely stable.
The construction problem is classification, and it is a credit question rather than a data-science one. A transaction feed does not arrive labelled. Is an inbound transfer salary, or a movement between the customer's own accounts? Is a recurring remittance discretionary or effectively committed? Is a large cash withdrawal ordinary spending, or income leaving the observable system? Is the account you can see the primary one? A credit committee can answer those. A feature-selection routine cannot.
Four constructs with a stated economic intuition also clear a governance bar four hundred features do not. CBUAE Model Management Standards require economic intuition behind variables, independent validation and ongoing monitoring.
The model is then proved forward, not backward: windows fixed and recorded before the data is examined, scored on an application population rather than a booked one, and tested for stability as well as discrimination. Both challenger and incumbent face that test.
A credible proposition describes where its signal breaks. Cash flow degrades in specific and predictable ways, and a lender that cannot name them has not built it yet. Six matter here.
None of these is an argument against the technique. They are the reason a controlled test on a local population is not optional, and the reason an off-the-shelf vendor score is a weaker proposition here than an attribute layer built on the lender's own data.
The rails exist. Coverage does not yet follow. The UAE Open Finance Regulation, now Circular 03/2025, licenses and mandates access — and onboards mandated participants in phases, beginning with banks and insurers, with later phases announced by the Central Bank. SAMA announced the commencement of licensing fintechs to provide open banking services on 26 March 2026. The question has moved from whether a lender can access the data to whether it can obtain enough coverage, quality, consent and refresh to make it useful — an implementation question, not a policy one.
Affordability is already a regulatory requirement. SAMA's Responsible Lending Principles require a clear, transparent and documented scientific method for evaluating creditworthiness and ability to repay. Nothing in that needs changing. The open question is whether the data used to answer it is observed, current and complete — and a salary certificate plus a bureau pull is a thin answer.
A debt burden ratio is only as good as the income and obligations underneath it. CBUAE caps DBR at "50 percent of gross salary and any regular income from a defined and specific source," and the same article instructs institutions not to apply that maximum automatically but to assess each borrower's circumstances. Both halves are hard to satisfy on a declared figure: a salary certificate states an income number, but not the standing remittance, the informal obligation or the variable second income. The opportunity is not to replace the affordability framework. It is to improve the information used inside it.
Representativeness has moved the compliance burden. The CBUAE AI and Machine Learning Guidance of 11 February 2026 requires training data to be "sufficiently accurate, relevant and representative of the customer populations to which the models will be applied." Against a thin-file applicant pool, an imported vendor scorecard is the harder position to defend.
Which inverts the usual committee conversation: the cash-flow model is the newer object in the room and attracts the scrutiny, but it is the one trained on the population it will be applied to.
The Wage Protection System is a distinctive Gulf asset. For customers paid through WPS, income continuity can be partly anchored against a formal payroll rail rather than inferred entirely from account behaviour. Payroll plus transaction behaviour plus bureau plus internal relationship data is a stronger stack than cash flow alone, and that advantage is going unused.
And income here stops discontinuously, because it stops with residency. A customer can be financially healthy today and face an abrupt change if the employment relationship ends. The bureau may not see it. The transaction account may not see it until the salary stops. The employer axis therefore belongs alongside cash flow rather than beneath it, and it is the subject of Paper III.
This is where the conversation should land. The chain runs in one direction, and the last link is the only one that appears in a set of accounts.
Transaction data becomes income continuity, obligation coverage, volatility and buffer. Those combine with the bureau into a decision; the decision becomes an action — approve, decline, limit, price, monitor, collect — and the action resolves into expected loss, revenue, capital and customer value. A measurement framework that stops at discrimination has stopped three links early.
Then by segment — thin-file, new-to-credit, expatriate, self-employed, variable-income, high-remittance. The value of cash flow should differ across those populations. That is not a problem with the technique; it is the reason for measuring it.
None of this requires a programme. It requires a controlled experiment.
One — run the swap set on your declines. Take twelve months of declined applications where transaction data is held or obtainable with consent, build the four constructs, and count how many sit in the same bureau band as approved accounts that subsequently performed. Then run it in reverse: which existing approvals would the combined signal have flagged? The objective is not to prove the model, but to establish whether the incumbent decision contains measurable room.
Two — rank the existing book by trajectory, not by score. Refresh the four constructs monthly and look at customers who are current, not yet delinquent, and deteriorating on buffer or coverage. Then measure how far the signal leads the first missed payment. The question is not whether the model predicts delinquency; it is how much time it gives the credit function to act. Time is an economic variable.
Three — set the validation windows before you look. Observation window, performance window, application population, outcome definition, exclusions, missing-data treatment — written down and dated before the result is examined. Otherwise validation becomes a search for a favourable window after the fact.
Four — put the incumbent and the challenger on the same terms. The bureau score is a decisioning input; the existing credit policy is a decisioning system. Both should face the same population, performance window and economic outcomes. A challenger should not have to clear a bar the incumbent never faced.
Five — price the incremental signal. The first four test whether the signal ranks. This one tests whether it pays, and most evaluations skip it.
Build three decisions on the same population — incumbent, challenger, combined — then ask the question that carries the money:
At your existing loss threshold, what proportion of declined applications can the challenger move across the decision boundary — and what is that worth?
The answer has a fixed shape, and every term is observable on your own book:
incremental value
= (accounts moved across the boundary × contribution per account)
− incremental expected loss
− incremental acquisition and servicing cost
− cost of capital on the incremental exposure
The controlled test establishes the first term; the economics of the other terms should already be observable on the book. The count of accounts that clear the boundary — not the statistic that identified them — is what reaches the P&L. If the figure is negative, a three-point AUC gain is irrelevant. If it is strongly positive, discrimination was never the argument.
What you do with a deterioration warning — limit action, repricing, pre-delinquency treatment, retention — is Paper IV. The prerequisite is having the warning at all.
Cash-flow underwriting is often presented as a technology question. It is a credit question enabled by better data.
The bureau answers: what has this customer done with credit? Cash flow: what is happening in their financial position? Employer data: how durable is the income? Internal behaviour: what is changing in the relationship with us?
The credit function's job is not to choose one, but to decide which combination produces the best decision for the exposure in front of it. Which is why the strongest implementation will not be a standalone cash-flow score. It will be a decisioning layer in which each signal has a defined economic role.
The question is not whether cash flow works. Published evidence and institutional adoption have largely settled that elsewhere. The question is whether it contains information your current decision does not, and whether acting on it creates value on your book. Both are measurable.
Run the test.
If a number in your book is moving and nobody can tell you why, that is usually the right moment for a conversation.