Alternative Data in SMB Lending: What OCC Guidance Means for Community Banks

Why the Regulatory Landscape Shifted

Community bank compliance officers have watched the alternative data conversation evolve over several years with a mixture of interest and caution. Interest, because alternative data — particularly bank statement and transaction-level cash flow data — offers a way to serve creditworthy borrowers who score below traditional thresholds. Caution, because the ECOA (Reg B) and FCRA frameworks were written before this category of data existed in structured form, and exam risk follows ambiguity.

The landscape became meaningfully clearer in 2024, when the OCC, Federal Reserve, FDIC, CFPB, and NCUA published joint interagency guidance on the use of alternative data in credit underwriting. This document does not represent new law. It is interpretive guidance, and it carries the weight of the agencies' shared position. For community banks and credit unions that have been waiting for a regulatory signal before formalizing cash flow analysis in their underwriting policies, the 2024 guidance provides that signal — with conditions attached.

What the 2024 Interagency Guidance Actually Says

The guidance addresses four categories of alternative data: bank account data (cash flow and transaction history), rent and utility payment history, employment and income data, and buy-now-pay-later repayment data. For community bank SMB lenders, bank account data is the most directly applicable category.

On bank account data, the agencies' position is substantively as follows. Such data may be used in credit underwriting if: (1) it is accurate and verified; (2) it is predictive of creditworthiness and the lender can articulate how; and (3) its use does not result in illegal discrimination under ECOA. The guidance also specifies that lenders must maintain documentation of how alternative data was used in any given credit decision — a requirement with direct implications for loan file content and credit policy design.

Critically, the guidance affirms that bank account data can improve credit access for underserved borrowers — specifically borrowers with limited or no credit history, recent immigrants, and small business owners whose personal credit files do not reflect their business financial performance. That language matters for CDFIs and community banks with mission-lending programs, and for credit unions expanding member business lending.

OCC Bulletin 2017-43 and the Model Risk Dimension

Separate from the 2024 guidance, any community bank considering an automated bank statement analysis tool should be familiar with OCC Bulletin 2017-43 on model risk management. The bulletin was originally issued in the context of quantitative models used for loan pricing and risk stratification, but its scope explicitly extends to "models used in credit underwriting," which includes tools that parse bank statements and compute cash flow metrics.

The 2017-43 framework calls for three things from banks using analytical models in credit decisions: model validation by qualified personnel, ongoing monitoring against benchmarks, and documented model governance. For community banks using a vendor-provided cash flow analysis tool, these requirements translate into specific procurement questions:

• Has the vendor conducted independent validation of the model's output accuracy? Can they provide a validation report?
• How does the vendor define and test for false positives and false negatives in cash flow categorization?
• What documentation does the vendor provide that a community bank can retain in its model inventory?
• How frequently is the categorization logic updated, and how are changes communicated to bank clients?

Creditfern's platform is designed to support OCC examiner expectations under Bulletin 2017-43, including structured output documentation that can be retained in the credit file as evidence of model governance. This is not the same as OCC certification or approval — no such certification exists for credit decisioning tools — but it reflects how the regulatory expectation should shape product design for tools used in federally supervised banks.

The ECOA and Disparate Impact Question

Reg B (ECOA) prohibits credit discrimination on the basis of race, color, religion, national origin, sex, marital status, age, or receipt of public assistance. The CFPB and DOJ have extended this prohibition through disparate impact theory to practices that are facially neutral but have a statistically discriminatory effect on protected classes.

This is where the alternative data conversation gets genuinely difficult for compliance officers. Bank account behavior patterns — including overdraft frequency, average daily balance, and deposit volatility — can correlate with demographic characteristics. A lending model that heavily weights NSF frequency in low-income neighborhoods could produce disparate impact even without any discriminatory intent.

We're not saying community banks should avoid cash flow data because of disparate impact risk. We're saying that any formalized cash flow underwriting policy should include a documented fair lending analysis component. That means reviewing the distribution of approvals and denials against census-tract demographic data, maintaining exception logs, and periodically testing whether cash flow thresholds are producing systematically different outcomes across protected class proxies.

The 2024 interagency guidance explicitly calls for this kind of ongoing fair lending monitoring when alternative data is used. Community banks that have a written cash flow underwriting policy but no fair lending audit process are carrying regulatory risk they may not be aware of.

FCRA Applicability and Bank Statement Data

One question that surfaces often in bank compliance circles is whether bank statement data obtained through a data aggregator — such as Plaid, MX, or Codat — constitutes a consumer report under FCRA. If so, the aggregator would need to be a permissioned consumer reporting agency, adverse action notices would be required, and dispute procedures would apply.

The regulatory position as of early 2025 is that bank statement data obtained directly from the borrower (via upload or permissioned API connection authorized by the borrower) does not generally constitute a consumer report under FCRA, because it is first-party data provided by the borrower themselves. However, if a third-party provider applies analytical scores or classifications to that data and furnishes the result to a lender for use in a credit decision, the regulatory analysis becomes more complex. The CFPB has signaled interest in this area, and at least one enforcement action has touched on data aggregator classification questions.

For community banks, the practical implication is this: obtain written authorization from the borrower for any data accessed through an aggregator API, retain documentation of that authorization, and ensure that the vendor's legal terms specifically address FCRA applicability and indemnification.

Building a Compliant Alternative Data Policy

The compliance path for community banks that want to use cash flow and bank statement analysis is not simple, but it is navigable. The key components of a compliant policy are: (1) a written credit policy amendment that specifically authorizes cash flow analysis and defines the metrics used; (2) a fair lending impact assessment conducted before rollout; (3) model governance documentation for any vendor tool used; (4) loan file documentation standards for how cash flow data is recorded; and (5) ongoing monitoring of approval rates and fair lending indicators.

Community banks that have already built this policy framework — often with assistance from a compliance consultant or their state banking association — report that the examiner response has been positive. Examiners at the OCC, FDIC, and state banking departments are generally supportive of thoughtful use of alternative data when the bank can demonstrate that it has done the fair lending work and maintains appropriate documentation.

For credit unions operating under NCUA supervision, the same principles apply with NCUA as the primary supervisor. NCUA has published its own guidance on alternative credit data that is substantively consistent with the 2024 interagency statement.

If you're evaluating how cash flow analysis tools fit into your institution's credit risk framework, or assessing integration options with your existing LOS, our team works specifically with community bank compliance and lending leadership.