Can AI approve loans? For small consumer and small-business loans, a scoring system can approve within limits a bank sets, and some banks let it. For commercial credit at a regulated US bank, AI loan approval in the literal sense does not happen: the authority to approve is delegated by the board, through the lending policy, to named officers and committees with set limits, and examiners reviewing a decision check that the person or committee who approved it held that authority. What AI can do is prepare the decision, and that is where most of the time between a finished memo and a vote goes. Botminds' Loan Approval Workflow uses six agents to add up exposure, route each deal by the bank's matrix, list policy exceptions, answer committee questions from the file, keep the clock and draft the minutes; the approving officer decides within their limit, and above it the committee votes.
How rarely banks let a system approve a loan today
1 in 10
banks have a scoring system that can partly or fully automate underwriting of some non-card lending
<1 in 30
banks use a scoring system to auto-approve loans
<1 in 100
banks will auto-approve a loan of $250,000
11%
of US banks used AI in some form, on average, from 2017 to 2022
Census Bureau working paper
Can AI approve loans? Authority belongs to people the board names
A loan approval is an exercise of delegated authority, so the question is not whether a system is accurate enough but whom the board has authorised. The OCC's 2026 handbook treats lending authorities as a list of the people and committees allowed to approve loans, change their terms and grant exceptions, each with a limit set as a dollar amount or a share of capital (OCC, 2026). The Federal Reserve expects an officer's limit to reflect that officer's experience, tenure and record of following the loan policy. Those are attributes of people. Regulation O goes further for insiders: above its thresholds, credit to a director, executive officer or principal shareholder needs advance approval by a majority of the whole board (12 CFR 215.4).
Automated approval does exist, and the same handbook describes it: "Many banks automate approval processes for certain loan types (e.g., automobile loans, credit cards, or small business loans)." Those systems sit inside the bank's policy, with limits the board approved, and the OCC adds that "models used for credit underwriting and decisioning should be subject to sound model risk management". Nothing in that framework contemplates a commercial loan committee whose vote is cast by software, and none of the regulators' 2026 statements moves in that direction.
What does the 2026 model risk guidance say about AI?
It leaves generative and agentic AI outside its scope, and it keeps simple arithmetic and fixed rules outside its definition of a model. On 17 April 2026 the OCC, Federal Reserve and FDIC replaced the 2011 model risk guidance. The new text says "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." The agencies said they plan to issue a request for information on banks' use of AI, including generative and agentic AI; none had been published in the Federal Register by late October 2026. The guidance also says it is most relevant to banking organisations with over $30 billion in assets.
The same guidance excludes from its definition of a model "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes". That distinction matters for an approval workflow. Adding up a relationship and applying a board-approved matrix is arithmetic and rules. Reading an agreement to answer a member's question is not, and it is where the design has to carry the controls the guidance does not yet spell out.
Banks are taking a measured approach to the adoption of generative AI (genAI) and agentic AI, with usage generally limited to specific use cases with guardrails and human-in-the-loop accountability to manage risk.
OCC, Semiannual Risk Perspective, Spring 2026
The Federal Reserve's Vice Chair for Supervision drew the line by impact. AI used "in a way that has more direct impact on credit decisions affecting individual customers—presents more substantial legal compliance challenges than other AI use cases". The 2023 interagency guidance on third parties applies to any vendor's tool: using one "does not diminish or remove banking organizations' responsibilities". And the adverse-action duty in Regulation B still applies to business credit, with lighter notice rules for firms above $1 million in revenue, so a system that shapes a decline must leave reasons a person can state.
What the 2026 rules say, and what it means for Loan Approval Workflow's design
| Source | What it says | Design consequence |
|---|---|---|
| OCC lending booklet, 2026 | Examiners check the approver held authority under the bank’s limits. | Only named officers and committees approve; the agents route and record. |
| Model risk guidance, April 2026 | Generative and agentic AI are outside its scope; rule-based processes are not models. | Keep routing as visible arithmetic and rules; put reading and answering under citations and human review. |
| OCC risk perspective, spring 2026 | Use is limited, with guardrails and human-in-the-loop accountability. | Every agent output ends in a person’s decision, not an action. |
| Fed supervision, July 2026 | AI with direct impact on credit decisions is the harder compliance case. | No agent scores, recommends approval or votes. |
| Third-party guidance, 2023 | A vendor’s tool does not move responsibility off the bank. | Rule changes need the CCO and are versioned on the audit trail. |
| NIST AI RMF | Human roles in decisions must be clearly defined and differentiated. | Each agent has written limits; each decision has a named person. |
Is AI credit decisioning the same as AI loan approval?
No, and buyers searching for one often find the other. "AI credit decisioning" usually means a scoring engine that approves or declines applications against a cut-off, built for high-volume, small-ticket lending where the bank has accepted model risk in exchange for speed. "AI loan approval" for commercial credit, where a committee decides, means something different: software that does the preparation around a human decision. A third category, AI for underwriting, reads statements and drafts the memo before any of this starts.
Three things sold as AI for loan approval
| Category | What it does | Who decides | Where it fits | What governs it |
|---|---|---|---|---|
| Scoring or decisioning engine | Scores an application and approves, declines or refers it against a cut-off | The system, within limits the board set | Cards, auto, small-business loans | Model risk management; fair lending testing |
| Underwriting assistant | Spreads statements, drafts the credit memo, proposes a rating | The analyst and the approver | Any commercial loan | Model risk where it estimates; review of every draft |
| Approval workflow agents | Adds up exposure, routes, lists exceptions, answers questions, drafts minutes | The officer or committee in the matrix | Commercial loans above individual limits | Bank policy, third-party risk, written limits per agent |
The distinction matters for governance as well as fit. A scoring engine's output is the decision, so its accuracy and fairness are tested as a model's. A workflow agent's output is an input to a person's decision, so what has to be tested is that the input is traceable and that a person, not the agent, made every call. Mixing the two, an engine that "recommends approval" to a committee, takes on the governance burden of the first without its speed.
What should an AI loan approval system do?
Prepare every decision, make none, and leave evidence an examiner can test without trusting the vendor. That is the practical reading of the 2026 statements, and it gives a buyer a concrete list to test before signing.
What to ask of any AI loan approval system for commercial credit
- Does it route by your matrix, visibly?
The relationship sum facility by facility, the authority it lands on, and the matrix version applied, as rules a credit officer can read.
- Does every answer cite its page?
And does it say “not in the file” when the file is silent, instead of filling the gap?
- Are its limits written down?
For each agent, what it may never do: route below the matrix, waive an exception, rule on a recusal, cast a vote.
- Does every decision have a named person?
Approval, exception, reassignment, condition and signature each recorded against someone with the authority for it.
- Can you change the rules, and see who did?
Clocks, quorum, routing rules: changed by the CCO, versioned, on an audit trail.
- Will the vendor run it on your own deals first?
Last quarter’s committee files, scored against what your people found, before anything goes live.
- What does the vendor give your third-party review?
Data handling, model sources, change notices and the evidence your examiners will ask you for.
Where this solution fits, honestly: it is built for banks whose commercial loans above individual limits go to a credit officer or committee, and whose pain is the waiting, the side questions and the minutes between a finished memo and a decision. It does not score credit, approve small loans automatically or replace the analyst's memo. How a committee comes to rely on it, rung by rung, is set out in what to look for in loan approval workflow software.
Step by step: who prepares, who decides
Between a finished memo and signed minutes there are about nine steps, and each ends with a person. Mapping each step to who prepares it and who decides it is the clearest way to see where the line sits. In the solution the line is not a policy statement layered on top; each agent's limits are part of what it is.
From finished memo to signed minutes: agent or person, step by step
What an agent does: Sums every facility with related interests, line by line, and flags a difference from the memo.
What a person decides: The analyst checks the sum; the CCO answers for it.
What an agent does: Applies the board’s matrix; never routes below it.
What a person decides: The approver or committee named by the matrix decides.
What an agent does: Tests the structure against the policy and lists each exception with its section.
What a person decides: The approver accepts or rejects each exception, with a reason.
What an agent does: Answers only from the file, cited; says “not in the file” otherwise.
What a person decides: Members judge whether the answer is enough.
What an agent does: Suggests a condition where the file shows a gap.
What a person decides: A person adds it, or does not.
What an agent does: Flags insiders, related interests and members’ conflicts before the vote.
What a person decides: The chair rules who may vote.
What an agent does: Reminds the approver and offers reassignment when a clock runs out.
What a person decides: The CCO decides whether to move the deal.
What an agent does: Nothing.
What a person decides: Each voting member votes, with a reason for a decline or a condition.
What an agent does: Drafts them from what was recorded.
What a person decides: The secretary checks; the chair signs.
The pattern in the right-hand column is that every decision has a named person and a recorded reason. That is what makes the line testable: an examiner can check from the file that no approval, waiver or reassignment happened without one. NIST's framework states the requirement in general terms: "Human roles and responsibilities in decision making and overseeing AI systems need to be clearly defined and differentiated."
The six things the agents may never do
Each agent carries limits written as prohibitions, not preferences. The deal router never routes below the matrix. The policy exception checker never waives or softens an exception. The committee question answerer never answers beyond the file. The insider and conflict checker flags but never rules. The approval clock keeper never reassigns a deal itself. The minutes drafter never records a vote or a reason nobody gave.
Loan Approval Workflow: the six agents, and where people take over
Agent
Deal routerAdds up the relationship with related interests, applies the matrix, books the agenda and starts the clock.
Never: routes below the matrix
Agent
Policy exception checkerLists every exception with its section, its size and the proposed mitigant.
Never: waives or softens an exception
Agent
Committee question answererAnswers members’ questions from the file, every sentence cited.
Never: answers beyond the file
Agent
Insider and conflict checkerChecks Regulation O insiders, related interests and members’ conflicts.
Never: rules who may vote
Agent
Approval clock keeperWatches every clock, reminds, and offers reassignment.
Never: reassigns a deal itself
A person decides
Approver or committeeDecides within authority; members vote with reasons; the chair rules on recusals.
Agent
Minutes drafterDrafts the minutes from recorded attendance, questions, exceptions, votes, reasons and conditions.
Never: records a vote or a reason nobody gave
A person decides
Secretary and chairThe secretary checks the draft against the record; the chair signs it.
The vote, live: seats fill as members speak
Who is accountable when AI recommends a loan?
The bank and the people who voted, which is exactly why a recommendation from a system with no authority is the wrong design. It adds a voice to the decision without adding anyone accountable for it. The OCC already warns that committees can dilute accountability, and asks that approval processes "provide appropriate accountability for the credit decision". A committee that approves because the software recommended it has diluted that further. If the recommendation was wrong, the minutes will show a vote whose real reason was a score nobody in the room can explain.
The useful alternative is to give members verifiable facts rather than a verdict: the relationship total with its working, the exceptions with their sections, answers with their pages, gaps stated as gaps. Members still disagree. On the sample deal at a fictional bank, the vote was five to one, and the dissent was recorded with its reason. That is the record of a committee doing its job, and it is told in how to record dissent in the minutes.
What examiners can test
A line between agents and people is only real if someone outside can check it. Four tests work on any approval file. Was every decision taken by someone with the authority for it, under the matrix version in force that day? Does every figure an approver relied on trace to a document? Was every exception named, and accepted by a person with a reason? Do the minutes show who voted how and why, including abstentions and dissent?
The solution keeps the evidence for each test: the route with its sum and matrix version, citations on every answer, the exception register with the decision that approved each line, votes with reasons, and the minutes' trail from draft to signature. Rule changes, from a clock to a quorum, need the chief credit officer and are versioned on the audit trail. How those pieces come together for an examiner is in what examiners check in loan committee minutes.
Questions people ask
Is an AI loan approval workflow a model under the 2026 guidance?
Parts may not be. The guidance excludes simple arithmetic and deterministic rule-based processes from its definition of a model, and puts generative and agentic AI outside its scope pending a request for information. A bank still needs to govern the tool under its own policies and third-party risk management.
Can an AI tool vote on a loan committee?
No. Committee members are named in the charter and approved through the lending policy, and their votes are their own. A tool can count votes against the number needed and draft the minutes; it should never cast one.
Does the EU AI Act treat credit decisions as high risk?
For people, yes: Annex III of the EU AI Act lists AI used to evaluate the creditworthiness of natural persons or set their credit score as high-risk, with fraud detection excepted. Loans to companies are not in that listing, though a guarantor's personal credit can bring a person back into scope. US rules have no equivalent list.
How many banks use AI today?
Fewer than headlines suggest. A Census Bureau study of bank technology found that on average 11 percent of banks used AI in some form between 2017 and 2022, and the OCC described 2026 use as limited to specific cases with human-in-the-loop accountability.
Does a person still have to review every agent output?
Every output that leads to a decision ends with a person: the approver, the members, the chair or the secretary. A reminder needs no review, but anything that changes a deal's route, its conditions or its record does.