Underwriting then
and now.

Sit with an experienced bank credit officer for thirty minutes and you will hear a particular kind of nostalgia about the pre-2010 small business credit file. The reverence isn't for the speed — files routinely took two to three weeks — but for the depth. An underwriter in 2008 made a decision the way a doctor makes a diagnosis: by working through a thick stack of documents, cross-referencing for inconsistencies, talking to the borrower, walking the property, and forming a holistic judgment over days. The decision was slow because it was supposed to be slow.

The pre-2010 file

A standard small business credit application package in 2008 contained roughly the same documents at every bank and most non-bank lenders. The bedrock was two years of business tax returns plus the year-to-date interim P&L and balance sheet. The tax returns gave the underwriter a verified historical revenue and profit picture. The interims showed the current trajectory. Together they answered the first underwriting question: does this business actually generate the cash flow it claims?

Layered on top were the personal financial statements of every guarantor — typically anyone with 20% or more equity. The personal financial statement showed real estate holdings, investment accounts, other liabilities, and contingent guarantees on other obligations. Two years of personal tax returns confirmed the numbers. Personal credit reports from all three bureaus rounded out the guarantor profile.

The collateral package was its own exercise. Real estate collateral required an appraisal, an environmental review, and a title search. Equipment collateral required an equipment schedule and often a USPAP appraisal for items over a threshold. Inventory and receivables financing required aging schedules updated weekly during the underwriting period. The underwriter wasn't just deciding whether to lend — they were deciding what to lend against and how much of it would survive a stress scenario.

The cash flow analysis was done in spreadsheets by hand, line by line. Debt service coverage ratio — the ratio of available cash flow to all debt obligations — was calculated to two decimal places and had to clear a hard threshold (typically 1.25 or 1.35 to one) before the file could go to committee. The underwriter's narrative memo to committee often ran four to eight pages and included a section called "secondary repayment sources" describing exactly what would be liquidated if the primary cash flow failed.

The role of personal credit and collateral

Personal credit and personal collateral were doing a lot of work in this framework. Most small business credit decisions in the pre-2010 era were effectively personal credit decisions wrapped in a business loan package. The principal guarantor's FICO score, debt-to-income ratio, and personal real estate equity often mattered more to the final decision than the business's own financial profile, especially for businesses under five years old.

This had a clear consequence: businesses owned by operators with good personal credit and home equity got funded; businesses owned by operators without those assets, even if the businesses themselves were strong, often didn't. The system systematically favored older, wealthier, real-estate-owning principals. The MCA industry's emergence in the early 2000s was partly a direct response to the population of operators this framework excluded.

What changed: the rise of bank-statement underwriting

The first crack in the pre-2010 model came from the MCA industry's adoption of bank statement analysis as the primary underwriting input. The insight was simple: a business's deposit pattern across three to six months of bank statements showed exactly how much cash was actually moving through the operation, at what cadence, with what volatility. It did not require a tax return, it did not require interim financials, and it could not be easily fabricated.

By the early 2010s, the MCA underwriting model had matured into a relatively standardized read of a bank statement file: average monthly deposits, number of deposits per month, ending balances, negative day counts, and existing daily ACH commitments to other funders. An experienced underwriter could read a three-month bank statement set in under fifteen minutes and arrive at a working credit decision. The traditional underwriting binder was replaced by a four-document file.

The online lenders that came of age after 2008 — OnDeck, Kabbage, Bluevine, Fundbox, and others — pushed this further. Their value proposition wasn't just fast funding; it was a structurally different underwriting philosophy. Instead of asking "what is this business's three-year financial history," they asked "what does the last 90 days of this business's actual cash flow look like, and how does it compare to similar businesses we have funded?" The shift from historical financials to recent cash flow as the dominant signal happened during this period.

The data infrastructure that made it possible

None of this would have scaled without the data infrastructure that came online between 2011 and 2018. The most consequential piece was the bank account aggregator layer — Plaid (founded 2013), Yodlee (older, but in widespread lending use by the mid-2010s), MX, Finicity. These services provide a secure API connection between a borrower's bank account and a lender's underwriting system. With the borrower's consent, a lender can pull verified transaction-level data directly from the bank in under a minute.

The implications go well beyond convenience. Direct bank reads eliminate the possibility of doctored PDFs — a problem that consumed meaningful underwriter time in the early days of statement-based lending. They provide categorized transactions that feed automated underwriting models. They expose existing competing daily debits (the signature of stacking) at intake. And they enable ongoing monitoring of an active borrower's account in ways that PDF intake never could.

Alongside the aggregators, several other data layers matured during the 2010s. Business identity verification services confirm that the entity applying is actually registered with the secretary of state, at the address provided, with the principals named. UCC search services reveal existing liens against the business's assets in seconds. Court record databases surface judgments, tax liens, and litigation in real time. Processing data feeds from card processors confirm reported credit card volume. Each of these used to be a phone call or a fax request taking hours or days.

Fraud detection: from intuition to pattern matching

The other major shift is in fraud detection. Pre-2010, fraud detection in small business lending was an experience-driven exercise. An underwriter who had seen five hundred files spotted the sixth file with falsified bank statements because the deposit pattern didn't match the claimed revenue, or the tax return margins didn't reconcile with the financials, or the personal financial statement listed real estate that didn't appear in public records.

Modern fraud detection runs in parallel with the credit decision and looks at dozens of signals automatically. Bank account ownership verification confirms the applying business actually controls the deposit account. Device fingerprinting identifies repeat applicants using different identities. Velocity checks across the lender's own database, and increasingly across industry-wide consortia, surface applications submitted to multiple lenders within hours of each other. Address-of-business validation against state registration filings catches paper companies. Pattern matching against known fraud rings blocks coordinated attacks before they reach an underwriter.

The result is that the gross fraud rate — high-volume schemes, falsified statements, identity theft attempts — is materially lower than it was in 2015. What remains is more sophisticated: the marginal merchant who exaggerates a deposit pattern by 15%, or the broker who soft-edits an application to get a file approved. Those still get through, but the headline-grade fraud has moved from a regular occurrence to a rare event.

Business credit bureaus: useful, not central

The business credit bureaus — Dun & Bradstreet, Experian Business, Equifax Business — sit somewhere in the middle of the modern underwriting stack. They are pulled on most files above $100,000 and almost universally above $250,000. A strong business credit profile, particularly a high PAYDEX score from D&B showing on-time payment history with trade vendors, can move pricing meaningfully on borderline files.

But for the typical sub-$250,000 working capital decision, the bureau pulls are a secondary signal. The primary inputs are bank statement performance, personal credit on the principal guarantor, time in business, and industry. The bureaus tend to lag — they reflect trade behavior six to twelve months in arrears — and they have spotty coverage for businesses outside conventional B2B sectors. A restaurant that pays its food suppliers on time may have no bureau profile at all, and that is not a credit problem.

What the modern file looks like

A working capital file in 2021 typically consists of a one-page online application, four months of bank statements pulled directly through Plaid or uploaded as PDFs, a soft credit pull on the principal guarantor, automated fraud and identity checks, and a UCC search. The underwriter receives all of this as a structured file in their queue, usually within an hour of the merchant clicking submit.

The underwriter's job has shifted accordingly. Less time is spent collecting and reconciling documents. More time is spent on the judgment layer: does the deposit pattern match the claimed business model, is there hidden stacking that the bank statements don't fully reveal, does the industry mix support the requested structure, are there flags in the personal credit profile that warrant a follow-up call. The decision happens in hours or a day, not weeks.

What remains constant across both eras is the underlying question. Every credit decision, then and now, is a judgment about whether this specific business will produce the cash flow needed to support this specific obligation under conditions that are at least somewhat stressed. The data has gotten richer. The speed has compressed. The fraud filters have improved. The fundamental question hasn't changed.