lending.dotdata.comCredit decisioning software:
a buyer's guide for auto
lending risk leaders.
Four products are sold under one category name. This guide separates them, supplies the 12 questions that discriminate between them, and gives you a scoring instrument that produces a defensible number.
Fraud filters, decisioning engines, BI dashboards and Signal Intelligence solve different problems. Scoring them against each other produces a winner by accident.
Prime 60+ DPD sits at 0.42% while subprime hit 6.90% in January 2026 — a record in an index dating to the early 1990s.
Most lenders rebuild models every 6 to 12 months while roll rates move weekly. What a product does in between decides its column.
The CFPB withdrew roughly 70 guidance documents in May 2025. ECOA, Regulation B and SR 11-7 were not among them.
What is credit decisioning software?
Credit decisioning software automates the approval, decline and pricing decisions for a loan application, applying scorecards, rules and models to applicant and bureau data. In practice the term is also applied to fraud filters, portfolio dashboards and signal discovery platforms — separate purchases with different lifecycle coverage, output and cost.
Why most evaluations fail at the start
Auto loan balances reached $1.69 trillion in Q1 2026, and lenders originated $182.1 billion in new paper in that quarter alone. Every one of those originations was priced by a system somebody bought — and most evaluation matrices place four fundamentally different products in one comparison, apply the same criteria to all of them, and produce a ranking that means nothing.
Which of the four products are you actually shopping for?
Pick one. The comparison matrix below isolates that column so you can see exactly where its coverage ends before you score a single vendor.
Assign the column first
The fastest way to fix a broken evaluation is to assign each vendor to a column before scoring anything. Select a column to isolate it and see where its coverage ends.
| Dimension | ||||
|---|---|---|---|---|
| Primary function | Verifies application inputs | Automates approve, decline, price | Reports what happened | Discovers why performance changed |
| Lifecycle coverage | Application only | Application to booking | Retrospective, all stages | Origination through charge-off |
| Answers "why did this change?" | No | No | Shows the change, not the cause | Yes |
| Refresh cadence | Vendor rule updates | Model rebuild, 6 to 12 months | Manual, analyst-driven | Continuous against registered KPIs |
| Needs its own data estate | Yes, vendor-hosted | Sometimes | Yes, warehouse dependent | Varies — ask |
| Typical output | Fraud flag | Score and decision | Chart or report | Ranked drivers and production SQL |
| Coverage | ApplicationCharge-off | ApplicationCharge-off | ApplicationCharge-off | ApplicationCharge-off |
A decisioning engine optimizes a model against a portfolio-level objective. It has no mechanism for explaining why a segment inside that portfolio began deteriorating, because explaining deterioration is not an optimization problem.
Business intelligence tooling has the opposite limitation. Dashboards make deterioration visible, sometimes within days. They cannot identify which combination of variables produced it — which is why the follow-up lands on a data science team as a multi-week manual investigation.
One label, four purchases
Origination fraud filters, decisioning engines, BI dashboards and Signal Intelligence platforms are sold under a single category name and solve different problems. Scoring them against each other produces a winner by accident. A fraud filter and a portfolio analytics platform do not compete; they are complementary purchases with almost no functional overlap.
Blended averages hide risk
Prime 60+ day delinquency sits at 0.42% while subprime hit 6.90% in January 2026 — a record in an index dating to the early 1990s, and a gap of more than 15x. A vendor demonstration built on portfolio-wide averages is running on data where the two populations cancel each other out.
The obligation moved, not the borrower
Average new-vehicle payments reached $770 in Q1 2026, and nearly 19% of new-vehicle loans carry a payment of $1,000 or more — roughly three-quarters of them on non-luxury vehicles. Terms stretched to about 69 months to hold payments down. A system that cannot construct payment-to-cash-flow relationships from raw relational data keeps scoring the wrong thing accurately.
Collateral no longer covers the balance
29.6% of new-vehicle trade-ins carried negative equity in Q2 2026, up from 26.6% a year earlier, with an average deficit of $6,884. Buyers rolling that debt forward average $944 a month against a $777 industry average. Loss severity is fixed months before the account appears in a delinquency report.
What happens between rebuilds
Most lenders rebuild models every 6 to 12 months while roll rates move weekly. What a product does in that gap decides which column it belongs in. If the answer is "nothing until the next release," the product cannot respond to a segment that deteriorates inside a quarter.
The 12 questions that decide it
Twenty-eight of the 40 questions in the appendix are hygiene. These 12 are the ones where a weak answer is diagnostic rather than merely disappointing. Ask them live, where the answer cannot be edited.
Does it do what we need?
Names a specific function outside the engine's design: explaining post-booking performance change, surfacing segments below the model's resolution, or generating rules for post-model adjustment. Accepts that the engine keeps the decision.
"We're more accurate," "we use more advanced AI," or a claim to replace the engine outright. An accuracy claim against a model you have already validated is unfalsifiable inside a demonstration.
"If we keep our engine exactly as it is, what is your product still worth to us?" A vendor whose value depends on displacement will not have a clean answer.
Names the ingestion pattern precisely: reads raw relational tables, handles one-to-many relationships internally, no pre-flattening. Should describe what happens with a tradeline table at account-month grain without hesitating.
"We work with your existing warehouse tables." That often means your analysts do the joining, which relocates the work rather than removing it.
"Who writes the joins, and how many hours is that on our side before first result?" It is a line item in the first-year cost, usually larger than the license fee.
Describes a systematic search over a defined candidate space with a stated ranking method, and offers to run against held-out data where your team has already documented its own hypotheses.
"Our models find hidden patterns." Every supervised model finds patterns in the features it is given. The question is whether the feature space itself is generated or supplied.
"Who defines the candidate variables — you, us, or the system?" If the answer is "us," it is a modeling tool rather than a discovery tool.
Can we defend it?
Produces reasons tied to identifiable attributes at the individual decision level, in language that maps onto an adverse action notice. Distinguishes reasons the model used from reasons a compliance team can send.
SHAP values, feature importance charts or a ranked contribution list offered as if they were the same thing. These are diagnostic outputs; the translation into notice language is real work.
"Walk me from your output to the text on the notice. Who performs each step?"
Emits the derivation itself — SQL, code, or an equivalent specification — so a variable can be recomputed independently from source data.
A natural language explanation layer sitting over a model whose internals stay opaque. Fluent description of a black box is still a black box.
"Can our validation team recompute one variable from raw tables without your software running?"
The same artifact runs in both environments, or the deployment step generates production code from the development specification with no manual re-implementation.
"Our data scientists hand off to your engineering team." That hand-off is precisely where development and production diverge.
"What is the re-implementation step between development and production, and who performs it?"
Does it keep working?
Names a mechanism and a trigger: continuous re-ranking against designated KPIs, or a scheduled cadence measured in days rather than quarters.
"We retrain quarterly," or "as part of your model governance cycle." Both describe rebuilding a model, a different activity from noticing that the drivers changed.
"If a segment deteriorates in week three of a quarter, what in your product notices?" Listen for whether the answer names a system or a person. The single most diagnostic question in the set.
A number, in hours or days, with assumptions stated: table count, row count, whether the source needs cleansing first.
"It depends on your data." Everything depends on your data. The vendor should still have a distribution from prior implementations.
"Give me the fastest and the slowest of your last five, and what made the difference."
Describes a resolution floor — the smallest population it can produce a defensible result on — and explains how it avoids overfitting at that size.
Any answer implying the product monitors portfolio-level metrics and flags deviations. Small segments do not affect portfolio-level metrics until they are no longer small.
"What is the smallest population you have produced a validated result on, and what was the outcome count?"
What will it cost, and what can it prove?
Names supported platforms and distinguishes certified from merely compatible. If it can run in place, it is specific about what stays where.
"We'll ingest your data into our environment," presented as a benefit. It may be the right architecture — it is still a cost rather than a feature.
"What is the annual storage and egress cost of the architecture you are proposing?"
Yes, with exact recomputation over the actual overlap. Demonstrable live, on real records.
Any method that combines drivers by multiplying individual lifts. Overlapping populations do not compose that way, and the error compounds with every additional driver.
"Stack two drivers, then show me the exact record count in the intersection." Small intersections are where concentrated risk lives.
A named metric, a stated baseline, match volume as a share of records, and lift expressed against that baseline. Out-of-sample validation identified explicitly.
Area under the curve, Gini, accuracy improvement, or a lift figure with no baseline attached. Lift without a baseline is not a number.
"What was the baseline, and was this in-sample or out-of-sample?"
Organizational Maturity Diagnostic
Four questions. Your stage and its gaps update as you answer.
How is your current vendor shortlist organized?
Weight, score, calculate
Score each vendor within its column, never across columns. Weights must total 100, and they belong to the problem that started the evaluation — equal weighting is the same as no weighting. Score against the 1 / 3 / 5 rubric; the weighted total recalculates live and travels with your saved results. Rename the vendor columns to the vendors you are actually evaluating.
| Criteria | Weight | |||
|---|---|---|---|---|
Lifecycle coverage Name the exact point where the product stops being useful.
| 20 | |||
Explainability Principal reasons for a single adverse action, reproducible by internal validation.
| 25 | |||
Refresh cadence What happens between model rebuilds.
| 20 | |||
Data estate cost Storage and integration bill that rarely appears on the pricing sheet.
| 15 | |||
Demonstrated lift Match volume and lift against a specific business metric, validated out of sample.
| 20 | |||
| Weighted total | 100 | 3.00 | 3.00 | 3.00 |
Disqualifiers
Five answers end an evaluation regardless of the score, because each one represents an exposure no weighting can offset.
- 01
The vendor cannot produce decision-level reasons in a form your compliance team can send.
- 02
The production model is manually re-implemented from the development model.
- 03
Lift is quoted without a baseline, and the vendor cannot supply one on request.
- 04
The architecture requires duplicating a data estate you already operate, with no alternative offered.
- 05
The vendor will not run a bounded proof on your own historical data before contract.
Where dotData sits
dotData does not issue credit approvals or declines and does not replace a decisioning engine. It discovers and ranks the drivers behind a lender's own KPIs, then emits the rules in a form existing systems can execute.
A Data Catalog and Data Lake, either hosted by dotData or running against the client's existing Snowflake, Databricks, Azure or AWS estate. Lenders with a mature data platform do not pay for storage twice.
dotData Core reads every table in the lake, evaluates relational combinations across them, and ranks the Driver Signals behind each Registered Metric. Signals land in the governed, versioned Signal Library — continuously re-ranked rather than regenerated on a release calendar, so the gap between model rebuilds stops being a blind spot.
Purpose-built mini-apps, each anchored to one metric. Four ship pre-built: Portfolio Pulse on 90 days past due, Charge-off Post-mortem on net charge-off, Missed Opportunities on look-to-book, and Scorecard on rank ordering.
Platform services — Workspace, Orchestration, AI Agent, Security and Governance, and Infrastructure — span all three layers. Ask the AI Agent “What's driving our 90DPD increase?” and it returns the ranked drivers directly, collapsing a multi-week analyst cycle into a working session.
The platform emits production SQL, which drops into existing post-model adjustments, knock-out rules and scorecard updates. No loan origination system rebuild is required. Deployment runs self-hosted behind the firewall or dotData-hosted in a single-tenant SOC 2 Type II environment, and PII is not required for statistical pattern discovery.
When this category is the wrong purchase
If early defaults trace to falsified income or identity rather than credit performance, an origination verification product addresses that directly and more cheaply.
Defensible results require a minimum of 10,000 funded loans and at least 1,000 documented outcome examples of the target event. Below that, buy the data foundation first.
A staffed quant team, documented feature pipelines, a governed warehouse and a sub-quarterly refresh cycle mean the marginal gain is throughput, not capability. Price it as an efficiency case.
Driver stacking, live
Run in Portfolio Pulse against 90DPD_Target on a portfolio with a 20% baseline default rate. Toggle drivers on and off to build a Precision Impact Segment — the concentrated population a portfolio-level model is designed to average away.
Single drivers and the Driver 01 + Driver 02 stack are exact recomputations over the actual overlap.
Discovered drivers run in both directions. Vehicle model is 4Runner matches 13% of records and lifts default risk by 11.5 points. No 30 days past due in the previous 6 months matches 32% of records and reduces it by 11.4 points — a yield signal rather than a risk signal, and the reason signal discovery expands a credit box as often as it tightens one.
Conclusion
Category confusion around credit decisioning software is not a vocabulary problem. It produces capital misallocation, because a lender who buys a decisioning engine to answer a portfolio deterioration question has spent the budget and still has the question.
Separating the four columns before scoring anything is the highest-return step in the process, and it costs nothing but the discipline to do it first. The lenders who get this right in 2026 will have bought the product that matched the problem, while their competitors are three quarters into an implementation that was never going to answer it.
Frequently asked questions
No. Discovered drivers feed existing models and rules as additional inputs, or operate as post-model adjustments layered over current scorecards. The primary model, its governance and its validation record all stay in place.
SR 11-7 requires that a model's logic be documented, its performance monitored, and its results independently reproducible. A platform that emits the exact mathematical logic and production SQL for every variable provides direct documentation and reproducibility. Independent validation remains the lender's responsibility.
The statutory obligation is to give applicants specific, accurate principal reasons for adverse action. That duty attaches to the lender regardless of model complexity, and it did not change when the CFPB withdrew roughly 70 guidance documents in May 2025. Model opacity is not a defense. It is an unresolved compliance exposure.
One thing. That the platform surfaces a driver that your current stack did not, with match volume and lift measured against a named KPI on your own historical data, validated out-of-sample. Anything broader is a demonstration rather than a proof.
Appendix A — the full 40-question checklist
Category fit
- 01Which of the four categories does this product occupy, and which does it not?
- 02Does the product decide, explain, or display? State the primary function in one sentence.
- 03At what point in the loan lifecycle does the product cease to generate value?
- 04If we already run a decisioning engine, what does this product do that the engine cannot?
- 05Does the product replace an existing system or sit alongside one? Where is the overlap?
- 06What is the smallest unit of output — a score, a rule, a chart, or a signal?
Signal discovery and methodology
- 07How many candidate patterns does the system evaluate before ranking, and across how many tables?
- 08Does the system read unaggregated relational data directly, or require pre-joined tables?
- 09Can it surface a driver no analyst hypothesized, and how would we verify that it did?
- 10How is a discovered driver ranked — by predictive lift against a named KPI, or by feature importance inside a model?
- 11What happens to a driver that is statistically strong but proxies for a protected class?
- 12Can two drivers be combined and the resulting population volume and lift recomputed exactly?
Explainability and model governance
- 13For a single decision, can the product produce specific principal reasons in the form ECOA requires?
- 14Does the product output the mathematical logic behind each variable, or a narrative over a black-box result?
- 15Is the model running in production provably identical to the one built in development, and how is that shown?
- 16What documentation does the product generate toward SR 11-7 validation without analyst rework?
- 17Can our validation team reproduce a result independently using the product's outputs alone?
- 18If the vendor relationship ended tomorrow, what could we still defend to an examiner?
Refresh cadence and drift
- 19How often does the product re-evaluate which drivers matter, and is that a release event or a continuous process?
- 20When the portfolio mix shifts, does the system surface the change or wait to be asked?
- 21What is the elapsed time between a new data source arriving and a usable driver being available?
- 22What mechanism supports adjustment between full model refreshes?
- 23Is drift benchmarked against our KPIs or against an industry baseline?
- 24How does the product handle a segment that is small but deteriorating quickly?
Data estate and deployment
- 25Does the product require its own data lake, or run against our existing warehouse?
- 26Which host platforms are certified, as distinct from merely compatible?
- 27Does implementation require any change to our loan origination system?
- 28What data cleanliness is assumed at onboarding, and what happens with messy production tables?
- 29Is personally identifiable information required for the product to function?
- 30What is the minimum portfolio size and outcome count for a statistically defensible result?
Proof and validation
- 31Show one driver discovered in a portfolio like ours, with match volume and lift against a named KPI.
- 32What was the baseline, and what was the lift measured against it?
- 33Was the result validated out of sample, and by whom?
- 34What is the smallest segment on which the vendor has demonstrated a defensible result?
- 35Can we run a bounded proof on our own historical data before signing, and at what cost?
- 36What did the last three implementations fail to deliver?
Commercial
- 37What is the fully loaded first-year cost including integration, storage, and internal headcount?
- 38Is pricing per seat, per record, per model, or per KPI?
- 39What happens to discovered signals if we leave?
- 40Who owns the output — the rules, the SQL, and the documentation?
Get your personalized guide
Your maturity stage, diagnostic answers, weighted vendor index and the 12 questions, assembled into a PDF addressed to you and downloadable on the spot.
Results are stored privately for your evaluation