Consumer fintechLicence required
Consumer lending and credit marketplace testing
FintechAssuranceLabs tests consumer lending platforms and credit marketplaces, the category of products like SoFi, Upstart, and LendingTree. Test scope covers loan origination, credit decisioning, interest accrual, repayment schedules, servicing relief, and lead routing to partner lenders. FintechAssuranceLabs engineers test lending and marketplace flows and hand over evidence a regulator or partner bank can review.
What breaks in lending and loan marketplace money flows
A consumer lender earns interest and origination fees on each funded loan, and a credit marketplace earns a fee from partner lenders per lead or funded loan. Each defect below repeats on every loan or lead that takes the same path. Instalment plans sold at checkout are on the BNPL testing page.
- Military status lookup skipped on timeout. The call to the Department of Defense Military Lending Act database times out, and the application proceeds as not covered. For a covered borrower, the military annual percentage rate (MAPR) is capped at 36% (32 CFR 232.4(b)), and the MAPR counts finance charges and application fees even where Regulation Z excludes them (232.4(c)). A non-compliant contract with a covered borrower is void from inception (232.9(c)), which puts the interest, the origination fee, and collection of the principal at risk, and the lender is liable for damages of not less than $500 per violation (232.9(e)(1)(i)).
- Lead routed to a lender the consumer never saw. The consent screen lists partner lenders from a cache, a new lender joins the routing table, and leads go to it under consent text that does not name it. Autodialed telemarketing calls to a mobile number need prior express written consent (47 CFR 64.1200(a)(2)), a signed agreement that authorizes the seller (64.1200(f)(9)). The marketplace bills a fee on each such lead, and each autodialed call can carry $500 in statutory damages, up to three times that for a wilful or knowing violation (47 U.S.C. 227(b)(3)).
- Marketplace fee missing from the lender's rate. In the EU, a marketplace acting as a credit intermediary charges the consumer a service fee, but its offer API sends the lender only amount, rate, and term, so the annual percentage rate of charge (APRC) in the credit agreement omits the fee. The Consumer Credit Directive (EU) 2023/2225 (CCD2) requires intermediaries to communicate their fees to the creditor for the APRC calculation (Article 38(d)), and the APRC includes all charges (Article 30(1)). Every offer in that market understates the cost of credit.
- Canadian rate cap checked on the note rate only. A 12-month loan of CAD 1,000 at a 34.9% note rate carries a CAD 50 origination fee deducted from proceeds. The pricing check reads the note rate and passes, but on the CAD 950 advanced the annual rate is above 45%. Section 347(2) of the Criminal Code counts all charges for advancing credit as interest and sets the criminal rate above 35% on the credit advanced. Entering or offering to enter such an agreement is an offence punishable on indictment or on summary conviction (347(1)).
- Servicemember rate relief booked as a deferral. After a borrower sends military orders for a loan taken out before service, servicing lowers the rate to 6%, books the difference as a balance due at maturity, and keeps the payment unchanged. Under the Servicemembers Civil Relief Act, interest above 6% is forgiven (50 U.S.C. 3937(a)(2)), the periodic payment is reduced by the forgiven interest (3937(a)(3)), and relief runs from the date the servicemember is called to military service (3937(b)(2)). Each affected loan needs a new schedule and an interest refund.
Licence flag and the evidence regulators and partner banks ask for
Consumer lending carries a licence flag: the lender holds a lending licence or originates through a partner bank, and a marketplace that arranges loans can need its own licence. Sources on this page were checked on 2026-09-16.
United States
States license non-bank lenders and brokers. In California, no person engages in the business of a finance lender or broker without a licence (Financial Code 22100(a)), a broker includes anyone performing any act as broker on loans made by a finance lender (22004), and a wilful violation in making or collecting a loan voids the contract (22750(b)). A partner bank reviews the lender as a third party under the Interagency Guidance on Third-Party Relationships (88 FR 37920, 9 June 2023). Disclosure, adverse action, and privacy rules are on the Regulation Z, Regulation B, and GLBA pages. Evidence requested:
- covered borrower check records per application, kept for the 32 CFR 232.5(b)(3) safe harbor;
- MAPR recalculations per product with every charge in 232.4(c);
- lead routing logs with the consent text version and lender list shown to each consumer;
- servicemember relief records with the orders date, effective date, and recalculated payment;
- state annual report data, such as California's under 22159.
European Union
CCD2 applies from 20 November 2026 (Article 48(1), Directive (EU) 2023/2225). Creditors other than credit institutions, payment institutions, and e-money institutions, and all credit intermediaries, need admission, registration, and supervision by a competent authority (Article 37). AI systems that evaluate the creditworthiness of natural persons are high-risk under the AI Act (Annex III, point 5(b), Regulation (EU) 2024/1689). Regulation (EU) 2026/1744 of 8 July 2026 moved the application date of those high-risk requirements from 2 August 2026 to 2 December 2027. Evidence requested:
- intermediary fee agreements on a durable medium and the fee values sent to the creditor (Article 38(c) and (d));
- APRC recalculations per offer against the Annex III formula (Article 30);
- rejection notices that state when the assessment used automated processing and how to contest the decision (Article 18(9));
- early repayment compensation within 1% of the amount repaid, or 0.5% with one year or less left, in fixed-rate periods (Article 29(2)).
Canada
Section 347 of the Criminal Code caps the rate on credit agreements, and provinces license higher-cost lending. In Alberta, a person who offers, arranges for, or enters into a high-cost credit agreement needs a high-cost credit business licence; a fixed credit agreement is high-cost at an APR of 32% or more. Evidence requested:
- the annual rate on credit advanced per agreement, with every charge counted under section 347(2);
- products flagged against each province's high-cost threshold and licence status;
- records kept under section 22 of Alberta's High-Cost Credit Regulation.
Lending and marketplace test scenarios
- Origination timing. An application resubmitted 35 days after the covered borrower check runs the check again, because the 232.5(b)(3) safe harbor covers a check made up to 30 days before the consumer applies.
- Credit decision paths. Frozen files, thin files, and stated income that conflicts with bank data, with the decision and reason codes per path.
- Counteroffer acceptance. Origination fee, APR, and disclosures regenerate on the accepted amount.
- Daily interest accrual. Leap years, weekend payments, and payment dates that differ from posting dates, as in the interest accrual and day-count guide.
- Repayment schedules. Long first periods, rounding on the final payment, and due date changes, recalculated in an independent reference model by financial calculation testing.
- Early payoff. Payoff quotes with per-diem interest, and refunds on precomputed loans over 61 months at least as favorable as the actuarial method (15 U.S.C. 1615(b)).
- Missed payments and relief. Allocation across interest, principal, and fees, payments returned after posting, and backdated servicemember relief.
- Lead routing. Consent version per lead, lender eligibility by state licence, duplicate suppression, and funded-loan postbacks matched to the lead that earns the fee, reported in the lead routing and partner handoff test report from lending and credit decisioning testing.
Integrations and protocols to cover
- Credit data. Bureau inquiry APIs with soft and hard pulls, Metro 2 furnishing files, and the MLA database or the covered borrower indicator in consumer reports.
- Bank connections. Open banking and aggregator APIs for income verification, with consent expiry and token refresh.
- US rails. Nacha PPD credits and debits with return codes, and debit card repayments through a processor. Stored card numbers are cardholder data under PCI DSS; see how we handle cardholder data.
- EU and Canadian rails. SEPA credit transfers as ISO 20022 pain.001, SEPA Direct Debit as pain.008 with mandate data, and pre-authorized debits under Payments Canada Rule H1.
- Lead distribution. Ping-post lead APIs, lender offer APIs, and funded-loan postbacks with idempotent lead identifiers.
- Servicing and ledger. Loan management accrual jobs, payoff quote APIs, and loan sale files, reconciled to the general ledger.
- Documents and identity. E-signature and disclosure generation, KYC vendor APIs, and sanctions screening.
Related
Standards
- Truth in Lending Act and Regulation Z
- Equal Credit Opportunity Act and Regulation B
- Electronic Fund Transfer Act and Regulation E, including the remittance transfer rule
- Nacha Operating Rules for ACH
- GLBA and US state money transmitter requirements
- CFPB personal financial data rights rule (section 1033)
- PCI DSS 4.0
- GDPR for financial data
- Open Banking standards: UK OBIE, Berlin Group
- EU AML directives and regulation, KYC obligations
- European Accessibility Act, with WCAG 2.2 and EN 301 549
Services
- Lending and credit decisioning testing
- Financial calculation testing
- Bank transfers and payment rails testing
- Open banking API testing
- BaaS and partner bank integration testing
- KYC, AML and fraud testing
- Mobile banking and finance app testing
- Data and platform migration testing
- Data privacy and test data management
- Accessibility testing
- Test automation
- QA audit and test strategy
- Dedicated fintech QA team
Guides
- How to test the accrued interest formula and day count conventions
- How to test banker's rounding in payment and ledger code
- How to test Nacha return codes: ACH return entries, time frames, and ledger effects
- How to test 90-day reauthentication, consent expiry, and token refresh in open banking
- How to test payment idempotency
- How to test ledger reconciliation against settlement files and bank statements
- How to reduce false positives in sanctions screening: testing for false alerts and missed matches
Sample deliverable
Sample, synthetic data
| ID | Flow | Defect | Severity and status | Financial impact (XTS) and basis | Rule touched |
|---|---|---|---|---|---|
| DEF-101 | Instalment loan interest accrual | Daily interest uses a 360-day year while the loan agreement and the APR disclosure use a 365-day year, so a 20.00% nominal loan accrues at about 20.28% | Critical; fixed, retest passed | 1.14 overcharged per affected loan per 30 days at 5,000.00 principal | 12 CFR 1026.22(a)(2): APR accurate within 1/8 of 1 percentage point |
| DEF-102 | Credit line repayment | App payments received after 16:00 on the due date are credited the next day and trigger a late fee | Critical; open | 25.00 late fee charged in error per affected account per billing cycle | 12 CFR 1026.10(b)(2)(ii): payment cut-off no earlier than 5 p.m. on the due date |
| DEF-103 | Instalment loan early payoff | Payoff quote adds a prepayment fee while the loan disclosure states that no prepayment charge applies | Major; fixed, retest passed | 50.00 charged in error per affected early payoff | 12 CFR 1026.18(k)(1): prepayment charge disclosure |
| DEF-104 | Loan application decisioning | Applications declined after a decision service timeout stay in pending status and no adverse action notice is sent | Major; open | 0.00 direct loss per affected applicant; the exposure is regulatory | 12 CFR 1002.9(a)(1)(i): notice of action within 30 days of a completed application |
| DEF-105 | BNPL merchant fee calculation | Merchant fee at 5.99% is calculated on the order total including shipping, while the merchant fee schedule excludes shipping | Major; fixed, retest passed | 0.90 overcharged per affected order with 15.00 shipping | No regulation clause; merchant fee schedule |
| DEF-106 | BNPL partial refund | A 40.00 partial refund reduces the last instalment instead of the next instalments, so the next instalment is collected in full | Minor; deferred to the next release with a manual adjustment procedure | 40.00 collected early per affected order until the final instalment date | No regulation clause; customer instalment agreement |
| DEF-107 | Wallet peer-to-peer transfer | A transfer retried after a client timeout is sent with a new idempotency key, so the wallet balance is debited twice | Blocker; fixed, retest passed | 60.00 debited in error per duplicated transfer in the test case | 12 CFR 1005.11(a)(1)(ii): incorrect electronic fund transfer |
| DEF-108 | Wallet dispute handling | The provisional credit job skips disputes received on a weekend, so the credit posts on business day 11 | Critical; open | 150.00 held one business day too long per affected dispute | 12 CFR 1005.11(c)(2)(i): provisional credit within 10 business days |
Amounts use XTS, the ISO 4217 code reserved for testing. Loans, orders, wallets, and disputes are generated test records with no customer data.
Questions
What is credit decisioning?
Credit decisioning is the process a lender uses to approve, decline, or counteroffer a credit application and to set the amount, rate, and fees. A credit decisioning system combines application data, credit bureau reports, bank transaction data, and policy rules or a scoring model, and records the reasons behind each decision for adverse action notices.
How to calculate interest on a loan?
For a simple interest loan, interest for a period equals the outstanding principal multiplied by the annual rate and by the days in the period, divided by the day-count basis in the loan agreement. On a principal of 10,000.00 at 12% for 30 days on a 365-day basis, interest is 10,000.00 × 0.12 × 30 ÷ 365 = 98.63.
What is accrued interest?
Accrued interest is interest that has built up since the last payment or interest posting date and has not yet been paid. On a daily simple interest loan, the servicing system accrues interest each day on the outstanding principal, and the next scheduled payment or a payoff amount includes the interest accrued to that date.
Scope your lending platform testing
Send your loan products, markets, and lender or partner bank model, and we return a test scope covering origination, decisioning, accrual, servicing, and lead routing with the evidence each flow needs.
Scope your testing