The supervisory texts on indirect lending are old enough to predate the question people now ask about agents, and specific enough to answer it. NCUA's guidance for credit unions — Letter to Credit Unions 10-CU-15, Indirect Lending and Appropriate Due Diligence — says plainly that approval authority may not be delegated outside the institution, that documentation quality control is a named control rather than an administrative habit, and that exceptions must be rare, approved by named people and reported upward. The Comptroller of the Currency's installment lending handbook says the same things for banks in different words. Read together they do not forbid automation; they fix its shape. The machine may prepare, compare, compute and draft. A person decides. Indirect Auto Contract Funding is built that way on purpose, and this page shows where each limit comes from.
The programme, the people and the deals shown here are a fictional sample book inside the solution. The regulatory texts are real, quoted exactly and linked where they are used.
Regardless of the type of indirect lending relationship established, no credit union should delegate loan approval authority to a third party. Every credit union has the responsibility to perform its own due diligence, establish effective controls and monitoring systems to mitigate the risks to the credit union's earnings and net worth.
NCUA, Letter to Credit Unions 10-CU-15, August 2010
What NCUA Letter 10-CU-15 actually says
The letter is short, and its tone is not that of a technical rule. It opens from loss experience: "NCUA has seen seemingly healthy credit unions fail in a matter of months due to indirect lending programs that spun out of control." What follows is a due diligence programme in four parts — a written policy with limits, a vendor you have actually examined, a contract that says what both sides owe, and monitoring that keeps working after the first good quarter.
Three of its instructions bear directly on how a funding desk is built. The first is the one quoted above, on approval authority. The second is about documentation: a credit union needs "Quality control processes to ensure the credit union receives perfected liens, proof of insurance, and other necessary documentation, in addition to verifying the completeness, accuracy and validity of loan deals". The third is on standards: "Indirect lending standards should be consistent with the credit union's direct (internal) loan underwriting standards" — the paper a dealership hands you is not held to an easier test than the loan you would have written yourself.
Four numbers from the supervisory texts behind a funding desk
None
of a credit union's loan approval authority may be delegated to a third party
3
families every policy exception falls into: credit policy, credit scoring and documentation
Months
the time in which NCUA says it has seen seemingly healthy credit unions fail on indirect programmes that spun out of control
2
signatures on a wire batch above $1,000,000 in the fictional sample programme
The sentence that decides the design: who may approve
Everything else about an agentic funding desk follows from one sentence, and it is worth being precise about what the sentence does and does not say. It says approval authority may not be delegated to a third party, and that the institution must do its own due diligence and run its own controls. It does not say a person must personally read every document, and it does not say software may not reach a conclusion. The distinction matters because the two are often confused into a vague rule that nothing may be automated, which is both unsupportable and, in practice, an excuse for a desk that reads nothing carefully.
What the sentence rules out is a chain in which the authority to say yes sits anywhere but inside the institution. A dealership that can clear its own stipulation has approval authority. So does a system configured to fund whatever it finds clean. That is why the sample programme carries a setting — fund clean deals without an analyst — that is deliberately switched off, and why the limit is written as a setting at all: a control nobody can see the state of is not a control.
The honest way to state the inference is this. The guidance does not mention software, so it does not forbid it. It does forbid a third party holding the authority to approve. A design in which the machine prepares a verdict and a named person signs it is the design that can be shown to be inside that line. A design in which nobody can say whose decision it was is not.
One deal through Indirect Auto Contract Funding, and where the signatures sit
Agent
Deal jacket readerSorts and reads every document in the jacket and marks it complete when each required document is present.
Never: alters a submitted figure; every value cites its page and field.
Agent
Contract-to-approval checkerLays every term of the signed contract beside the credit approval and the dealer programme.
Never: changes a credit decision; anything off-approval goes to credit.
Agent
Stipulation clearerClears proof of income, residence, insurance and identity against the approval's conditions.
Never: clears a stipulation on a document that does not name the buyer.
Agent
Contract math and add-on checkerRecomputes the amount financed and the federal disclosure box; checks each add-on price against its cap.
Never: accepts an add-on priced above its cap.
Agent
Funding recommenderTurns the checks into a fund-or-pend recommendation and drafts the dealer notice with the exact fix.
Never: funds a deal.
A person decides
The funding analystFunds or pends every deal, clean or not, inside her own funding limit, with the meaning of the signature recorded.
Agent
Batch and booking agentBuilds the wire batch before each cutoff and the booking data for the loan system.
Never: releases a wire.
A person decides
The supervisorCo-releases a batch above the programme's second-release threshold, seeing every deal in it first.
The red flags in indirect lending, and which ones a funding desk can see
The letter has a list that examiners work from. "In addition to those obvious danger signs, examiners are also looking for other warning signs or 'red flags' that may require a credit union to slow down indirect lending", it says, and among them: "Insufficient loan documentation; or Poor dealer management including reliance on the dealer to obtain credit reports; accepting loan payments from dealers; dealer-created down payments through dealer incentives, inflated or fraudulent trade-in or purchase price; or continuous overdrafts in dealer reserve accounts."
Read that list from the funding desk and it sorts itself into two halves. Some of it is a treasury or relationship question that no amount of document reading reaches — overdrafts in a reserve account, payments arriving from the wrong party. The rest is visible in the jacket, every day, one deal at a time: documentation that is insufficient, a trade-in allowance that does not match the payoff, a down payment that appears on the contract and nowhere else.
The red flags, and where each one is actually visible
| Warning sign | Where it shows up | What a desk can do about it |
|---|---|---|
| Insufficient loan documentation | In the jacket, on the day — a missing signature, a stale pay stub, no lienholder named. | Pend with the exact fix, and count the reason so the pattern by dealership is visible. |
| Reliance on the dealer to obtain credit reports | In the process design, not in any one deal. | A policy question for the second line; the desk can only evidence what it received. |
| Accepting loan payments from dealers | In the payment stream, after booking. | Servicing and treasury; outside what a jacket shows. |
| Dealer-created down payments through incentives | On the buyer's order, where cash down is shown but never received. | Compare the price build to the funds actually collected; flag a down payment nothing supports. |
| Inflated or fraudulent trade-in or purchase price | Across the contract, the buyer's order and the book value at the contract's mileage. | Recompute the advance against book value; a cash price far above the market is a credit question, not a clerical one. |
| Continuous overdrafts in dealer reserve accounts | In the reserve account, monthly. | Relationship management; the desk contributes the pend and funding history that explains it. |
Documentation quality control as a named control
The phrase "quality control" tends to be heard as an audit function that samples after the fact. In both supervisory texts it is more than that. NCUA names it as something a due diligence programme must have — processes to ensure the credit union receives perfected liens and proof of insurance, and to verify the completeness, accuracy and validity of loan deals — which is to say, a control operating before and at funding, not a review six months later.
This is the point at which a funding desk and a control framework turn out to be the same object seen from two sides. Every check the desk runs to protect the money is also the evidence that the control exists and operated. The difference automation makes is not that the control gets stronger in principle; it is that it runs on every deal instead of on the ones a busy Monday allowed time for, and that each result is attributable to a rule and a document rather than to a person's memory of the programme.
A pend, with the reason, the fix and who did what, in Indirect Auto Contract Funding
Exceptions: infrequent, approved, reported
Both texts treat exceptions as the measure of whether a programme is still the programme. NCUA: "Exceptions to the indirect loan policy should be infrequent. All exceptions should be approved by credit union personnel responsible for administering the indirect lending program and reported to the board of directors for their review." The OCC handbook adds the quantitative half: "Banks should establish limitations for each type of exception, as well as a limit for aggregate exceptions, and monitor adherence to those limits."
Three things follow for the desk. Exceptions have to be countable, which means each one has to be recorded as an exception rather than resolved in conversation. They have to be attributable, so that a pattern at one dealership or one product can be seen. And the authority to grant one has to be somebody's, named in advance — which is the same rule about approval authority arriving from a different direction.
The practical consequence is a hard line between two things that look similar on a screen. A deal that is inside its approval but has a wrong price or a missing document is a documentation matter the dealership fixes. A deal that is outside its approval is a new credit decision, and it goes back to the analyst who made the first one. The sample programme writes that as a rule — off-approval always goes to credit — and never lets a stipulation waiver be granted at the funding desk. What each stipulation asks for, and when a waiver is even in question, is set out in the guide to stipulations.
What the dealer agreement has to contain
Due diligence does not end at the policy; it is written into the contract with the dealership. NCUA lists the minimum: "Written contracts should address at a minimum: Dealer compensation; Credit criteria; Documentation standards; Dealer reserves (a dealer reserve account is controlled by the credit union and provides for charging back non-performing loans to the dealer under certain circumstances); Dispute resolution; and Exit clauses."
Read that list as a funding desk's specification and it is almost complete. Dealer compensation is the participation arithmetic on every funded deal. Credit criteria and documentation standards are the tests each contract is measured against. Dealer reserves are what a chargeback runs through. Dispute resolution is what a pend escalates into when a dealership disagrees. The only item with no daily expression is the exit clause, and the evidence that would ever justify using it — a dealership's clean-first-time rate, its pend reasons, its trend — is produced by the desk whether anyone asks for it or not.
Six agents, and the sentence each one may not finish
The useful way to specify an agent is not to describe what it does. It is to write the sentence it is not permitted to finish, and then to make that sentence unwritable rather than discouraged. The six in this solution each carry one.
Each agent's limit, and the text it comes from
| Agent | What it does | What it may never do | Where the limit comes from |
|---|---|---|---|
| Deal jacket reader | Reads and sorts every document; marks the jacket complete. | Alter a submitted figure. | Documentation quality control: a control that edits its own evidence is not one (NCUA). |
| Contract-to-approval checker | Lays every term beside the approval and the programme. | Change a credit decision. | Approval authority stays inside the institution (NCUA). |
| Stipulation clearer | Clears income, residence, insurance and identity. | Clear a stipulation on a document that does not name the buyer. | Verifying the completeness, accuracy and validity of loan deals (NCUA). |
| Contract math and add-on checker | Recomputes the amount financed and the disclosure box; checks add-on prices. | Accept an add-on priced above its cap. | Programme limits on options financed set the maximum advance (OCC). |
| Funding recommender | Produces a fund-or-pend recommendation and drafts the dealer notice. | Fund a deal. | The decision is the institution's, and it is signed (NCUA). |
| Batch and booking agent | Builds the wire batch and the booking data. | Release a wire. | Separation of the person who prepares from the person who releases. |
Who signs, and when two people sign
A signature is only a control if it means something specific and the record says what. The sample programme records the meaning with the signature — the analyst signs I have reviewed the checks and fund these deals — and attaches it to a batch whose contents are listed on the same screen: the number of deals, the dealerships, the amount financed, and the checks that passed before the dialogue opened.
The second signature is a threshold rule rather than a supervisory requirement: above $1,000,000 a supervisor co-releases the batch. Thresholds like it are a policy choice, and the honest description of why they exist is concentration rather than distrust — one mistaken release of a large batch is a materially different event from one mistaken deal. What the texts do require is that the authority be somebody's and that exceptions to it be reported, which is why the threshold is a setting with a version history rather than a convention.
The release, with its meaning recorded, in Indirect Auto Contract Funding
What the second line should be able to get in one afternoon
- Who approved this deal, and under what authority
A name, a limit and a timestamp — not a system user that nobody can map to a person.
- Which rule produced each exception, and which version of it
A cap or a tolerance changes; the deal has to be readable against the rule that was in force when it funded.
- The document behind each cleared condition
Opened at the passage that proves the point, not merely attached to the file.
- Every exception, counted by type and by dealership
Both texts ask for limits by type and in aggregate; neither can be monitored from a list of free-text notes.
- What the machine recommended and what the person did
Where the two differ is the most useful page in the whole record, and it should be countable.
- The pends a dealership answered, and how quickly
The evidence behind a coaching conversation, and behind an exit clause if it ever comes to that.
None of this is an argument that software makes a programme safe. A programme is safe when its limits are written down, enforced the same way on a quiet Tuesday and a busy Monday, and visible to people whose job is to doubt them. What automation changes is the cost of that consistency — and, incidentally, what the people cost. Where the day currently goes, and what the funding seat is actually for, is the subject of the guide to the funder's job. To see the limits as settings with a version history, start from Indirect Auto Contract Funding.
Questions people ask
What does NCUA say about indirect lending?
Letter to Credit Unions 10-CU-15 sets out a due diligence programme: a written policy with portfolio limits and staffing, an examination of the third parties involved, a written contract covering compensation, credit criteria, documentation standards, reserves, disputes and exit, and ongoing monitoring. Its most quoted sentence is that no credit union should delegate loan approval authority to a third party. It opens by noting that NCUA has seen seemingly healthy credit unions fail in a matter of months on indirect programmes that got away from them.
Can a credit union let a dealer approve a loan?
No. NCUA's guidance states that regardless of the type of indirect lending relationship, approval authority should not be delegated to a third party, and that the credit union must perform its own due diligence and run its own controls. A dealership can take the application, assemble the documents and submit the contract; the decision to lend, and the decision that a signed contract matches that decision, stay inside the credit union.
Can software clear a stipulation or approve a deal?
Software can read the document, compare it against the condition and present the result with the evidence attached — that is preparation, and nothing in the supervisory texts prevents it. The authority to accept the result is a different thing, and it belongs to a named person inside the institution. In this solution that line is drawn as a setting: clean deals are not funded without an analyst, every deal is signed, and off-approval drift goes back to the credit analyst who made the original decision.
What are the red flags in indirect lending?
NCUA's list includes insufficient loan documentation and poor dealer management — reliance on the dealer to obtain credit reports, accepting loan payments from dealers, dealer-created down payments through incentives or inflated trade-in and purchase prices, and continuous overdrafts in dealer reserve accounts. Three of those are visible in an individual deal jacket; the rest need the programme's own books and monthly reporting.
Who has to sign off an exception?
NCUA's guidance says exceptions to the indirect loan policy should be infrequent, approved by the credit union personnel responsible for administering the programme, and reported to the board for review. The OCC handbook adds that limits should be set for each type of exception and in aggregate, and monitored. In practice that means an exception has to be recorded as one, attributed to a named approver, and counted — not settled in a hallway.
How do examiners test an indirect lending programme?
By reading the policy and the dealer contracts, then testing whether the programme behaves the way they say: sampling files for documentation and perfected liens, comparing exceptions against the stated limits, and looking at performance by dealership over time. The practical implication for a funding desk is that a sample pulled at random should be reconstructible — the rule in force, the document relied on, the person who signed — without anyone having to remember the deal.