Early payment default review, explained.

What a loan that misses its first payments tells a lender about the approval

The life of one early default, in five steps

1. The loan is approved and fundedAugust 11: $18,500, approved automatically through a lead partner on a score of 702 and a stated income of $96,000.
2. The first payment falls dueSeptember 11: nothing arrives. Calls on the 14th, 18th and 25th go unanswered; the number is disconnected on the 29th.
3. It crosses 30 days late and is reviewedOctober 11 it is an early default. The review rebuilds the file, finds the cause and links it to other loans. This guide is about this step.
4. The cause goes to its ownerA ring goes to fraud strategy and the BSA team, who file suspicious activity reports under the Bank Secrecy Act; a rule to credit policy; a setup error to servicing; a partner breach to the partner manager.
5. The fix changes the next vintageThe partner source is paused, the rule amended, the app repaired. Next month's early defaults show whether it worked.

Step 3 is the subject of this guide. The bank, borrower and figures in the example are fictional.

Early payment default facts that catch lenders out

EPD, FPD, vintage and root cause, defined

Fourteen terms are defined in the one-page summary.

FPD, EPD-90, sixty days in six payments: how lenders, investors and agencies define an early default

In shortThere is no single definition. A lender's own monitoring usually starts the day a loan is 30 days late on one of its first payments; investors and dealers write windows of 30 to 120 days into contracts; FHA uses 60 days late within the first six payments. Pick one definition, write it down, and keep it, because a vintage rate means nothing when the window moves.

Experian puts the narrow version plainly: a first payment default "occurs when a consumer fails to make their initial payment on a loan or credit agreement". It adds that such a default may signal "misrepresented income, overextension across multiple credit lines", or synthetic identity and first-party fraud (a real person borrowing with no plan to repay) that got past the lender's checks at origination.8

The wider versions count any serious delinquency in the first months. The window matters because the two catch different problems: a fraudster who never meant to pay shows up at the first payment, while a borrower who was stretched thin may pay twice and then stop.

How the clock runs on one loan

The suspicious activity report clock starts at detection: a bank must file "no later than 30 calendar days after the date of initial detection", and never more than 60 days when no suspect is identified.14 A review that takes six weeks spends the whole clock before anyone decides.

The rules an early-default review answers to, and the six that moved between 2025 and 2026

In shortFor consumer loans, no rule says "review every early default". The review exists because other rules need what it finds: examiners want first payment defaults reported and policy exceptions analyzed, the Bank Secrecy Act puts a 30-day clock on suspected fraud, the credit reporting law makes the lender correct its own errors, and credit rule changes need fair-lending review. Six of these texts changed between July 2025 and October 2026.

Which early-default rules moved in 2025–2026, and which held

Who pays when a new loan never pays: repurchase, recourse and charge-back clauses

In shortWhen loans pass from one party to another, the contract says who carries an early default. A buyer of loans may make the seller repurchase them; a lender buying contracts from dealers or merchants may charge back what it paid; a lead partner may lose its fee. The clauses only pay out if the lender can show what happened, which is one more reason to know the cause of each early default quickly.

The marketplace lender's form and the annual report are named in the sources for readers who want the text; they are examples of published clauses. We found no survey of how the market writes them.

How common dealer buy-backs are in auto lending

Personal loans reach lenders through different doors: direct online, branches, lead partners who sell applicant traffic, and merchants who offer financing at the point of sale, such as home-improvement contractors. Each partner contract can carry its own early-default trigger, a rate above which fees are clawed back or the partner is reviewed. No public survey measures how personal lenders write those triggers.

What the auto data shows is the general pattern: contracts move part of the early-default loss back to whoever brought the loan, but only on evidence the lender can produce, inside a window the contract sets.

Fraud, a loose rule, the lender's own slip or hardship: four causes that look identical at 30 days late

In shortEvery early default ends up in the same column of a delinquency report. Underneath, it has one of four causes, each with its own evidence and its own owner. Sorting them is the purpose of the review: the fix for one does nothing for the others, and the wrong fix can make things worse.

How the four split in one vintage

The split is fictional. It shows the method; no lender should read these shares as a rate to expect.

In the example, the 34 fraud loans include 19 from one ring, 9 borrowers who inflated their income and emptied the account, 4 stolen identities whose real owners have since disputed the loans, and 2 synthetic identities. The 29 credit losses include 21 approved only because a July rule raised the debt-to-income limit for one score band. The 16 onboarding cases are 13 borrowers whose autopay a phone app release never saved and 3 merchant loans with a first due date that contradicted the signed contract.

Where the evidence for each cause shows up

The grid explains why a sampled review misses patterns. Reading 25 files out of 87 at random finds individual causes. A ring, a loose rule or a broken app release shows only when the loans that share it are read together, and a random sample of a third of the files will usually catch only a third of the ring.

The evidence that separates a ring from first-party fraud and a stolen identity

In shortOne odd detail proves little; a household shares a laptop. A ring shows the same details again and again across loans that claim to be strangers: devices, receiving accounts, document templates, phone numbers. First-party fraud shows a real person with inflated income who emptied the account. A stolen identity shows a real person who disputes the loan. A synthetic identity shows a credit file built for the purpose.

What fraud looks like in the government's own data

Which signals to check first

Why fraud gets booked as bad credit

The Federal Reserve's synthetic identity toolkit describes the problem from the loss side: "a loss generated by a synthetic identity generally does not show indicators that fraud occurred, but rather, the customer appears to be unable to pay off the credit balance." When that loss is written off as credit, the toolkit warns, the account is "presumed to belong to real people who simply defaulted", and the same invented details can be used again.3

A first-payment default is the cheapest moment to catch it: nothing was ever paid, so there is no history of good behavior to explain away. The example's pay stub shows how much a document can say when someone reads it against the calendar. A stub dated July 31 for an employee paid twice a month can show at most 14 pay dates for the year. At $4,000 a period that is $56,000, and the stub says $60,000. The same error on 18 other stubs from two "employers" is a template, and a template is a ring.

Tracing a credit miss to the rule that let it in, with the numbers worked through

In shortCredit early defaults cluster where the rules changed. Replay each decision under the policy in force and the version before; the loans that would have been declined before are the change's work. Compare their early-default rate with the same band under the old line, and price any fix in loans declined as well as defaults avoided.

The OCC's Retail Lending booklet groups policy exceptions into three kinds: credit policy (loan-to-value, debt-to-income, pricing, verification and the like), credit scoring (high-side and low-side overrides) and documentation. It expects lenders to follow how loans approved with exceptions perform, and says management may require stricter adherence to policy when an exception segment performs worse over the long term than expected, or than the bank's risk appetite allows.2 Early defaults are the first performance any new rule or exception produces.

One rule change, worked through

In the example, rule CP-26-07 took effect July 14, 2026: for credit scores of 640 to 679, the maximum debt-to-income ratio (monthly debt payments as a share of monthly income) rose from 40% to 45%. In August the bank booked 412 loans in that band with debt-to-income between 40% and 45%, loans the old rule would have declined. Twenty-one of them became early defaults: 21 ÷ 412 = 5.10%. The same score band below 40% defaulted early at about 1.6%.

Then price the fix. Going back to 40% avoids all 21 early defaults and gives up all 412 loans. In the example, a 42% cap with a monthly residual-income floor of $1,800 (income left after debt payments) declines 268 of the 412, $3,210,640 of loans, avoids 17 of the 21 early defaults, and keeps 144 loans that default early at 4 ÷ 144 = 2.8%. Whether that trade is right is a credit committee decision; the review's job is to put both sides of it on one page.

One exception path behind both the fraud and the credit losses

Sorting by cause hides one thing: a single weak control can let in fraud and credit losses alike. In the example, the bank's instant-decision path accepted stated income up to $100,000 with a pay-stub image and no payroll or bank-data check, for applicants with a score of 640 or more and a low fraud score. 1,108 of the 4,812 August loans went through it. Thirty-six of the 87 early defaults did: the 19 ring loans, the 9 first-party frauds, and 8 of the credit losses.

No federal rule requires a lender to verify income on an unsecured personal loan; the federal ability-to-repay rule with third-party verification covers mortgages.32 Waiving verification is a credit policy choice, which is why its performance belongs in the exception reports examiners read.2

Autopay that never saved and due dates that disagree: when the lender causes the late payment

In shortSome early defaults start inside the lender: a payment instruction lost between the app and the servicing system, a first due date set from the funding date instead of the contract, a statement sent to the wrong address. The borrower did everything asked. The fix has three parts: set up what was chosen, waive what was charged, and correct what was reported to the credit bureaus.

These cases are easy to miss because the borrower's file is clean. Income checks out, the account is years old, the credit report is healthy. The evidence sits in the lender's own logs: an authorization request that never completed, a due date that does not match page 1 of the signed contract, a welcome letter returned.

In the example, a phone app release in use from August 3 to 21 showed borrowers that autopay was on and saved no debit authorization. Thirteen borrowers were never drafted and went 30 days late on a payment they believed was automatic; nine paid as soon as someone called them.

What the law asks once the lender knows

These loans also distort the numbers. Left in the early-default count, they inflate the credit-risk story and dilute the fraud share. In the example, the 19 ring loans and the 16 onboarding loans together lift the August rate from 52 ÷ 4,812 = 1.08% to 1.81%. Without them, August sits in line with the six months before, and the remaining excess is in the score band the July rule touched.

What published studies say about early defaults and fraud, and how far each one reaches

In shortEvery widely quoted figure linking early defaults to fraud comes from a fraud-score vendor or a lender survey, and most are about auto loans or mortgages. Read each with its scope. Taken together they agree on direction: early defaults carry far more misrepresentation than later ones, and loans with fraud markers default far more often. None of them is a personal-loan benchmark.

A record personal-loan market growing fastest in its riskiest tier

In shortUnsecured personal loan balances reached a record $281 billion in mid-2026, originations rose by a fifth, and subprime originations grew fastest. Serious delinquency rose at the borrower level. More new loans in riskier tiers, through more partners, means more early defaults to explain, and less time to read each one.

Charge-offs are the end of the story, a year or more after funding; early defaults are the beginning. A vintage whose first-payment rate moves from 1.06% to 1.81%, as in the example, will not show in the bank's charge-off rate for months. That lag is the case for reading early defaults as they happen.

What a misread early default costs: the wrong fix, a missed clock, a wrong credit record, a fair-lending question

In shortEach wrong cause has its own cost. Fraud read as credit leaves the door open and tightens credit for good applicants. Credit read as fraud wastes investigators' weeks and leaves the rule in place. A lender error read as the borrower's leaves a wrong mark on a credit report. A rule changed without review raises a fair-lending question. And slow causes miss the clocks the law and the contracts set.

Regulators and investors see the same failures from the outside. The OCC asks for first payment default reports and for analysis of exceptions that finds their causes, their impact and any corrective action needed.2 Loan buyers and dealer agreements set cure windows of 15 to 30 days.12,13 The Federal Reserve's toolkit notes that fraud written off as credit is often "never known to be fraudulent", so the same identities come back.3

Software in early-default review: what it can assemble, link and replay, and what the 2026 rules leave with you

In shortSoftware can pull every file together the day a loan crosses the line, read the documents against each other, link loans that share details, replay each decision under the policy that made it, check the lender's own setup, and propose a cause with its evidence. People confirm the cause, own the fix, decide on a suspicious activity report and approve any rule change. The new model guidance covers the scores; generative AI falls to the bank's own controls.

SR 26-2, issued April 17, 2026 by the Federal Reserve with the OCC and FDIC, replaced SR 11-7. Credit and fraud scores remain models under it, with monitoring and outcome analysis; early defaults are often their first measurable outcome. A footnote leaves generative AI, and AI that acts on its own, outside the guidance and points to the bank's own risk management for their controls.18,19,20 Software bought from a vendor sits under third-party guidance, and the responsibility stays with the bank.23

Who still signs: causes, fraud calls and credit rule changes

• Confirming each cause. A proposed cause is a judgment from evidence, and a person signs it.
• Calling anything fraud in front of a customer, blocking accounts, and filing suspicious activity reports.
• Changing a credit rule, after fair-lending review and the credit committee.
• Waiving fees and correcting credit bureau data, on evidence the lender caused the late payment.
• Talking to partners and merchants about a breached trigger or a claw-back.

How you would know the software works: run it on a past vintage whose causes your team already settled, and count agreements, disagreements and patterns it found that the team missed. Section 22 sets out a pilot.

How credit risk teams review early defaults today: who reads, who acts, and where the weeks go

In shortA credit risk analyst reports the vintage rate, picks a sample, and spends weeks pulling and reading files from five or six systems. Fraud, credit policy, servicing and the partner team each hear about it at a monthly or quarterly meeting. Most of the time goes into gathering and reading; the fixes wait for the meeting.

Six roles in an early-default review, from credit risk analyst to BSA officer

Five teams between the vintage report and a fix

Where a sampled vintage review spends its six weeks

Sampled spreadsheets, QC firms or fraud scores: early-default reviews today

Lanternfield's August vintage: 87 early defaults re-read in under two minutes and traced to four fixes with owners

In shortThis is the example from the top of the page, inside the product. Six agents re-read all 87 files in under two minutes and grow a root-cause tree. Priya Rajanath, the senior credit risk analyst, sees one thread run through three causes, confirms the causes, and sends a fix to each owner. Daniel Oyelaran, the Consumer Credit Risk Director, signs the report for the credit risk committee.

1

A rate that nearly doubled, and only the channel to go on

Monday, November 2. The August vintage has 87 early defaults, $1,268,450, against 4,812 loans: 1.81%. Before anyone has read the files, the tree can only branch by what the systems already know. By channel, the lead partner Fernway Lending Network stands out: 13% of the loans and 38% of the early defaults, 33 of its 642, or 5.14% against a 3.0% contract trigger.

Every leaf reads "Not explained yet". The channel says where the defaults came from; it cannot say why.

2

One branch thickens: income taken as stated

Priya presses "Re-read the 87 files". The early default monitor has already assembled each file: application, documents, verification results, the decision record with its policy version, fraud checks, channel and every payment attempt. The other five agents read them and grow the tree, finishing in 1 minute 52 seconds.

Branched by underwriting exception, one branch carries 36 of the 87: loans approved on the instant-decision path that accepts stated income with a pay-stub image. Those loans defaulted early at 3.25%; loans with income checked, at 1.38%. The waived branch splits into the ring, first-party fraud and credit losses alike.

3

Tyler R. Quinlan: $18,500 and not one payment

The first loan in the ring leaf opens on its timeline. Applied August 10 through Fernway sub-source FW-2207, approved automatically on a score of 702, debt-to-income 31.0% and a fraud score of 412, under the review threshold of 600. The timeline flags what the decision did not weigh: device DV-7F3A on six other applications, a pay stub from the same template as 18 others, an employer phone that is an internet line registered July 9, a receiving account opened July 23.

Proposed cause: fraud, ring R-0926, 96% confidence, with credit at 3% as the runner-up. "A borrower in trouble usually pays once."

4

Ring R-0926: 19 loans on four devices

The link map ties the 19 loans to 4 devices, 3 receiving accounts at two online banks, and 2 "employers" whose pay stubs share one layout. All 19 came through FW-2207 between August 4 and 19; together they owe 38 payments and have made none. Four September loans carry the same signals, and two applications for $41,000 are still in the pipeline, ready to hold.

The report clock reads 30 days from detection on November 2: the BSA team decides by December 2. The link analyst prepares the referral; it never files a report or blocks an account.

5

The rule, the fix and its price

Marcus Ballantree's rule CP-26-07 raised the debt-to-income cap from 40% to 45% for scores 640 to 679 on July 14. August booked 412 loans above the old cap; 21 defaulted early, 5.10%. In the what-if, a 42% cap with an $1,800 monthly residual-income floor declines 268 of the 412, $3,210,640, and avoids 17 of the 21; the 144 loans kept default at 2.8%.

Priya confirms the 79 causes at 90% confidence or more in one step and reads the other 8 one by one. Four fixes go out, each to its owner, and Daniel Oyelaran signs the October report on November 2, the first business day after the last August loan crossed 30 days late on October 30.

The solution's design target is every early default re-read, and a confirmed cause and an owner within five business days of a loan reaching 30 days late. They are targets, to be measured on your own vintages.

The root-cause tree by fraud signal and partner, the pay stub that exposed a ring, and the signed committee report

In shortOne vintage is the story. These screens show the rest: the same tree branched by cause, by fraud signal and by partner, the run log and patterns, the pay stub that gave the ring away, the board, a borrower the bank itself made late, the fixes, the report and its signatures, and the bank's own settings.

Select any screen to open it larger. The bank, partner, merchants, borrowers, people and figures are fictional.

The credit risk analyst confirms every early-default cause, each fix's owner accepts or declines it, and the director signs the report

In shortEach agent has one job and limits it does not cross. None of them contacts a borrower, calls anyone a fraudster, changes a rule, blocks an account, waives a fee, alters credit reporting or files a report. The credit risk analyst confirms or changes every cause; each fix's owner accepts or declines it; the Consumer Credit Risk Director signs the monthly report.

Early default monitor to cause and fix writer: the six agents

Three sign-offs on every early-default review

Every agent finding, every confirmed or changed cause, every fix sent and accepted and every signature is recorded with who and when. Settings changes are versioned. The analyst who confirms causes and the director who signs the report are different people.

Priya Rajanath's credit risk team at Lanternfield Bank

What early-default review reads from application to last payment attempt, and the evidence-backed cause it records per loan

In shortIt reads what the lender already holds about each loan, from application to the last payment attempt, under the lender's own definitions and owners. It leaves behind a cause for every early default with its evidence, the patterns that link them, a fix for each owner with its cost, and a signed monthly report. Your systems of record stay where they are.

Origination, documents, fraud checks and servicing: the loan systems to connect

For each, check whether it has an API, a file feed, or only screens, and who owns it.

Your early-default window, credit policy and fraud rules, kept as they are

Every early default read, every cause evidenced, every decision signed

What a sampled, six-week early-default review costs you in losses, declined customers and missed clocks

In shortThe cost of a slow or partial review is mostly the next month's loans: a ring keeps funding, a loose rule keeps approving, a broken app keeps making borrowers late. A few published figures frame it. The numbers that decide your case are yours, and most can be found within a week.

Price your own sampled early-default review in a week

Returning rings, wrong late marks and committee debates without causes

Fraud rings and loose rules stopped weeks sooner: the return from reading every early default

In shortPut in your own numbers. The main lever is time: a cause confirmed weeks sooner stops the loans a ring or a loose rule would otherwise approve in the meantime. The second is analyst time. The calculator starts from the example bank's figures, marked as such, and a published analyst wage; replace every default with yours.

Sooner fixes, every file read, claims inside the window

Estimate the return on your own early defaults

Try your own book. A lender with 10,000 loans a year and a 1% early-default rate has about 100 early defaults; at the same balance and shares, a month sooner is worth about $59,000 a year, and reading every file by hand takes about 300 hours, a few weeks of one analyst. At that size the case rests on the patterns a full read finds; the hours saved are small.

Scoring your credit risk team on early-default definitions, decision records, cause owners and data access

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

From one hand-read vintage to every file, every month

Seventeen vendor checks on how early-default software reads files, proves causes and links loans

In shortAsk every vendor the same questions, us included. The answers show whether every file is read, how causes are proven, how loans are linked, whose definitions and rules apply, what stays with people, and how you could test it on vintages you already understand.

We found no published independent test of any early-default review tool, as of October 2026. Replaying a vintage your team already reviewed is the fairest test, and the same exercise measures your current process.

Replay two or three settled vintages blind, then read one live month of early defaults in full

In shortMeasure your current review, replay two or three settled vintages blind, then read one live vintage in full beside your normal process. Decide on four numbers. None of these steps commits you to a vendor.

1. Write down your definition, causes and owners, and time your current review of one vintage.
2. Choose two or three past vintages whose causes your team settled, including one with a known ring or rule problem.
3. Replay them blind and compare causes, patterns and days to a cause.
4. Read one live vintage in full, in parallel, with your analysts confirming every cause and owners receiving fixes.
5. Decide with four numbers: cause agreement, patterns found that the sample missed, false patterns, and days to a confirmed cause.

Cause agreement, patterns found and false patterns in the replay

First payment default, EPD clauses, fraud and SAR filing: the questions credit risk teams search

In shortThe questions credit risk teams and buyers search for most, each answered on its own.