License Loan Underwriting and Credit Decision Data for AI

Can a lender license loan underwriting data for AI?

Yes, in a narrow form. AI developers building agents for financial work want to see how credit decisions are made and how they turn out. Mercor lists "Finance & Insurance Statements, underwriting files, claims" among the data it seeks (Mercor), and micro1 lists finance workflows including "reconciliations, approvals, reporting workflows" (micro1).

The reason is the shape of the record. Springbolt Group, an advisory firm, describes the most valuable category as "Data that captures a real decision, the context around it, and what happened afterward." (Springbolt). A loan file is exactly that: an application, an analysis, a decision with conditions, and years of payment history that show whether the decision was right.

Which lending records are useful for AI

Lenders hold several record sets. The table shows what each teaches and what has to come out first.

GLBA and Regulation P: what they say

Regulation P implements the privacy rules of the Gramm-Leach-Bliley Act for most lenders. It "applies only to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family, or household purposes", and it "does not apply to information about companies or about individuals who obtain financial products or services for business, commercial, or agricultural purposes." (12 CFR 1016.1). So consumer and mortgage files sit inside it; commercial and equipment-finance files mostly do not, though loan agreements and confidentiality clauses still apply.

What it protects is broad. Personally identifiable financial information includes information "About a consumer resulting from any transaction involving a financial product or service between you and a consumer" (12 CFR 1016.3). Before disclosing such information to a nonaffiliated third party, "you may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless" notice and opt-out conditions are met (12 CFR 1016.10). Section 1016.11 sets "Limits on redisclosure and reuse of information." (12 CFR 1016.11).

The definition also marks the way through. Personally identifiable financial information does not include "Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses." (12 CFR 1016.3). Separately, section 1016.12 bars disclosing "an account number or similar form of access number or access code for a consumer's credit card account, deposit account, share account, or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing" (12 CFR 1016.12). Whether a given data set counts as blind data is a question for your counsel.

• Account numbers, card numbers and access codes never go in, in any form.
• Names, addresses, Social Security numbers, tax IDs, dates of birth, phone numbers and emails come out of fields and free text.
• Property addresses and exact loan amounts can identify a borrower; generalize them.
• Replace borrowers with stable tokens so one borrower's history still links across years.

ECOA and fair-lending concerns

Regulation B, which implements the Equal Credit Opportunity Act, states: "A creditor shall not discriminate against an applicant on a prohibited basis regarding any aspect of a credit transaction." (12 CFR 1002.4). It reaches business lending too; section 1002.9 sets rules "For business credit" notifications (12 CFR 1002.9).

The CFPB has said the requirements "apply equally to all credit decisions, regardless of the technology used to make them", and that "ECOA and Regulation B do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions." (CFPB Circular 2022-03). These rules bind creditors that use models, not the lender licensing past records. But a buyer training a credit model on your decisions inherits any pattern in them, and your name may be attached to the data set. Questions to settle with counsel and the buyer:

• Remove demographic and monitoring fields collected for fair-lending reporting.
• Remove proxies that could stand in for a protected characteristic, such as exact address, where possible.
• Ask how the buyer will use the data: to build agents that do underwriting work, or to train a credit scoring model.
• Ask for a contract term limiting use to the purposes you agree.

Examination findings and supervisory information stay out

Exam reports and supervisory letters are not the lender's to license. For the Federal Reserve, "All confidential supervisory information and other nonpublic information, including but not limited to information made available under this subpart, remains the property of the Board", and no one holding it "may use any such information for an unauthorized purpose or disclose any such information without the prior written permission of the General Counsel" (12 CFR 261.20). For national banks, "All non-public OCC information made available pursuant to this paragraph is OCC property", and possession of it "does not constitute a waiver by the OCC of its right to control, or impose limitations on, the subsequent use and dissemination of the information" (12 CFR 4.37).

The FDIC, NCUA and state regulators have their own rules; ask counsel which apply to you. In practice, search credit memos, committee minutes and board packs for references to exam findings, matters requiring attention and regulator correspondence, and take them out.

What lending records are worth

No buyer publishes a price for lending records specifically. General company data programs publish ranges: micro1 "payments typically ranging from $100K to over $3M" (micro1) and Handshake AI "$100K to $4M+ payouts" (Handshake AI). These are published ranges, not offers.

How to prepare

Related: mortgage lenders in the United States, transaction data, insurance claims and which training data holds its value.

• Pick one product, such as equipment leases or small-business loans, and one span of years.
• Count files, and note what share have a known outcome.
• List where identifiers sit: core system fields, scanned documents, memo text.
• Check loan agreements, participations and servicing agreements for confidentiality terms.
• Flag any file that references supervisory findings.
• Ask counsel whether your consumer files can meet the Regulation P blind data standard.

Next step

This page states what each rule says and where to read it. It is not legal advice: your counsel decides how the rules apply to your records.

Does your company hold records like these? See what your data is worth.

Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes (how Origin is paid). See what your data is worth.