Banking · lending
SME credit · two delegates: renew Facility 5302, €220,000
A commercial bank reviews 36,000 SME credit facilities a year. A credit agent runs the renewal: it calls a spreading agent to turn the borrower’s delivered accounts into the bank’s standard spread, calls a covenant agent to test the facility’s covenants against that spread, runs the approved rating model, and drafts the memo. Within a mandate owned by the Head of SME Lending it decides renewals of existing facilities; the two delegates act under sub-mandates of that mandate and decide nothing. New lending, increases, and waivers it only recommends, and a credit officer decides.
Follow it through the essentials (part two)Turn the map to this firm (part four)Walk its pathway on the explorer
Today, with a person
An analyst spreads the delivered accounts into the bank’s template, reconciles the spread to the audited totals, tests the covenants, rates the borrower, and writes the memo; a junior analyst often does the spread and a senior one checks it. A credit officer signs within a personal lending authority, recorded in the credit system; above it, a senior signatory or the committee decides. Credit risk review samples the files and can move the authority.
The question for the room
Would you let this chain of three agents renew a €220,000 credit line without individual human approval?
The day, in the record
- 09:00 Facility 5302 due for renewal · borrower B-5102, a regional logistics company · current limit €220,000 · the credit agent opens the file and calls the spreading agent
- 09:04 Spreading-agent-02, under LC-07/S, returns spread SP-5302-1 from the audited accounts FY2025/26: EBITDA €412,000, net debt €1.1m, debt service cover 1.7 · reconciled to the audited totals · covenant-agent-01, under LC-07/C, returns CV-5302-1 at 09:09: covenants met · approved model rating 5 of 10 at 09:10
- 09:12 Renewal proposed in the memo · €220,000 for 12 months to 31.10.2027 · pricing, security, and covenants unchanged · declared basis: accounts FY2025/26, spread SP-5302-1, covenants CV-5302-1 · operation F5302-R1
The mandate LC-07 · version 07.1 · since 01.09.2026
| Owner | Head of SME Lending |
| Agent | credit-agent-07, acting for SME Lending |
| Action | decide renewals of existing SME facilities and request the booking through the core banking system; call the two delegates; recommend new lending, increases, and waivers |
| Level | decide for renewals at the same or a lower limit; recommend new lending, increases, and waivers · the delegates decide nothing |
| Limit | €250,000 per facility · €300m a month across the deployment · a delegate inherits the parent’s limits |
| Conditions | borrower a legal person · audited accounts delivered · the spread reconciled before it counts · no covenant breached · rating from the approved model, 6 of 10 or better, down no more than one notch, no override · no arrears over 30 days · not on the watch list, not forborne, IFRS 9 stage 1 · group exposure within €500,000 · sector not restricted · terms unchanged |
| Review trigger | three referrals for one reason in thirty days (R-07); a renewal booked on an unreconciled spread or a breached covenant narrows at once |
| Revocation | the owner, or a revocation rule; the sub-mandates go with LC-07 |
| Challenger | Chief risk officer, credit risk as the second line |
| Restore | after 40 clean renewals from a test chosen for the cause, sampled by credit risk, on the owner’s signature; after a serious defect, credit risk signs as well; sub-mandates with the parent |
| Expiry | 31.03.2027, or the next release of any agent in the chain; renewed on the evidence of the quarter |
| Deputy | the Head of Business Banking Credit signs in the owner’s absence, within the same limits |
| Delegates | spreading-agent-02 under LC-07/S: produce the spread of the facility the call names, counting once it reconciles · covenant-agent-01 under LC-07/C: test the covenants against it · each with its own identity, a token bound to the call, and no act on the world |
The knowledge that applies
Which spread applies, and does it count? the spread of the borrower’s latest audited accounts, produced by the spreading agent and reconciled to the audited totals before it counts; fixed by the day of the decision, reconciled; owned by the credit data team, who own the spread rule.
- SP-5316-1 spread 09:28 by spreading-agent-02 · EBITDA €413,000 · unreconciled
- SP-5316-2 reconciled by C-044 at 13:50 · EBITDA €318,000 · signed
What applies: decision · 15.10.2026 → the reconciled spread applies; an unreconciled spread is not a basis
The spreading agent reads the adjusted EBITDA in the management accounts’ note where a borrower delivers both sets. In good faith the covenant agent tests against it, and the memo reads well. Only the reconciliation rule at the check, read from the delegate’s record, catches it before the limit is booked.
The check, at the act
| Identity | credit-agent-07, acting for SME Lending · its delegates spreading-agent-02 and covenant-agent-01, each with its own identity, tokens bound to calls D-5302-S and D-5302-C |
| Release | chain CH-07: credit agent v2.1, spreading agent v2.2, covenant agent v1.4 · validated together for this workflow |
| Applicable basis | accounts FY2025/26, delivered 28.09.2026 · spread SP-5302-1 reconciled to the audited totals · covenants CV-5302-1 met · each delegate’s record read as part of the basis |
| Mandate | LC-07.1 active · renewal of €220,000 within €250,000 · rating 5 from the approved model, no override · LC-07/S and LC-07/C called inside the facility the parent holds open |
| Exact action | limit €220,000 on F5302 to 31.10.2027 · pricing, security, and covenants unchanged since declared |
| Current state | at 09:12: no arrears · no covenant breach · not on the watch list · not forborne · IFRS 9 stage 1 · group exposure €460,000 of €500,000 · not booked before |
Outcome: permit · booked once
The act, and the customer
The core banking system executes the act: limit booked and renewal letter issued. The agent cannot book the limit: the core banking system holds the credential. Its delegates cannot reach the booking at all.
The agent can say what it still needs from the client and when the bank will answer. The customer asks: “Will you renew my credit line?”
The loop: The same mistake, three times, in a delegate
Rule R-07, within thirty days. Restored after 40.
- 15.10 Facility 5316 referred: the spread SP-5316-1 did not reconcile, a disposal gain of €95,000 in the adjusted EBITDA REFER · 1
One referral. It counts against the parent’s trigger, though a delegate made the figure. - 22.10 Facility 5338, the same spreading agent: a lease remeasurement in the adjusted figure, €61,000 above the audited REFER · 2
Two referrals for the same reason, from the same delegate. - 27.10 Facility 5351 has the same mismatch, and on the reconciled spread the leverage covenant is breached. R-07 is triggered: three referrals for one reason in thirty days NARROW
Three referrals, and the third hides a breach: the rule narrows renewals to recommend and the spread to prepare. The releases do not change. - 28.10 Review CR-023: spreading agent v2.2 reads the adjusted EBITDA in the management accounts’ note wherever a borrower delivers both sets. The reconciliation becomes a hard stop inside the delegate, release v2.3, and model risk validates the chain again on 60 spreads CAUSE: THE DELEGATE
The cause is fixed in the delegate, by the team that owns the spread rule, and the chain is validated again. - 12.11 After 40 clean renewals from a test chosen for the cause, the mandate, renewed on chain CH-07.1 as its expiry clause asks, and both sub-mandates are restored, and R-07 is re-armed. The three referrals remain in the record RESTORE
Forty clean renewals from a test chosen for the cause, and a signature, restore the parent and its sub-mandates together. The mandate changed twice; the chain once, under validation.
One record, every reader
| Who | Asks | Reads |
|---|---|---|
| CISO security and resilience | Who acted, and was it contained? | Three identities, one call chain, booked once. |
| CTO architecture | Which models, and which releases? | Three releases, validated as one chain. |
| CFO finance | What did this review cost? | €1.80 in tokens across three agents, €66.67 in review. |
| Business owner Head of SME Lending | Who decided, and under whose mandate? | Referred, then renewed by a credit officer; the delegates acted under LC-07’s sub-mandates. |
| CRO credit risk and the supervisor | Which figure did it rest on, and where from? | The spread, by record id, with its warrant. |
| Compliance conduct and the credit policy | Was it decided on the policy in force, and can we explain it? | Renewed on the reconciled spread, with all eight policy checks. |
The record of the two acts, field by field
The fields of the record line, as part three gives them, filled for the clean act and for the referral. A field with two lines gives the agent’s line and the person’s, marked R1 and R2.
| Field | Facility 5302 · the clean act 15.10.2026 · permitted at 09:12, booked in the 22:00 batch | Facility 5316 · the referral 15.10.2026 · referred at 09:31, renewed by a credit officer at 14:20, booked 17.10 |
|---|---|---|
| Before the act · what the check read | ||
| whenthe second the check decided, and the second the act committed | decided 15.10.2026 09:12:40 · committed 22:00:05, the booking batch | R1 referred 15.10.2026 09:31:08R2 decided 15.10.2026 14:20:30 · booked 17.10 in the 22:00 batch · letter issued 19.10 |
| the agent and its identitywhich agent, acting for whom, under its own identity, and how long its credential lived | credit-agent-07, acting for SME Lending · its own identity · token 09:00:11 · called spreading-agent-02 (D-5302-S, 09:03) and covenant-agent-01 (D-5302-C, 09:08), each with its own identity and a token bound to the call | R1 credit-agent-07, acting for SME Lending · its own identity · called spreading-agent-02 (D-5316-S, 09:26) and covenant-agent-01 (D-5316-C, 09:29) under LC-07/S and LC-07/CR2 credit officer C-044, SME Lending · her own login · lending authority €500,000 |
| the releasethe release id, each model by version and hash, the prompt set, the validation report | chain CH-07 · credit agent v2.1 (tier-1 model 2026.07.1 a17f5c, tier-2 model 2026.05.2 e9a3b7, prompt set credit-chain 2.1) · spreading agent v2.2 (tier-1) · covenant agent v1.4 (a rules engine) · validated as one chain, MRV-061, 28.08.2026 | R1 chain CH-07 · credit agent v2.1 · spreading agent v2.2 · covenant agent v1.4R2 none · a person’s decision in the credit system |
| the basiseach claim the act relied on, its version, and its standing at that second on both axes: evidential warrant, and authority | Latest accounts FY2025/26, audited · the credit file · delivered 28.09.2026 · warrant validated · current · uncontradicted · authority: the borrower · the credit data teamThe spread: EBITDA €412,000, net debt €1.1m, cover 1.7 · spreading-agent-02 · SP-5302-1 · 09:04 · reconciled to the audited totals · warrant validated by the reconciliation · model-derived, corroborated · the weakest premise · authority: delegated under LC-07/SCovenants met: leverage 2.7x of 3.5x, cover 1.7 of 1.25 · covenant-agent-01 · CV-5302-1 · 09:09 · on SP-5302-1, agreement v3 §12 · warrant: the spread’s, reconciled · a rules engine, no model · authority: delegated under LC-07/CB-5102 rates 5 of 10 · the approved rating model v4.3 · 09:10 · warrant validated · authority: credit risk, the model ownerA renewal to €250,000 at rating 6 or better may be decided; a delegate’s output enters the basis with its own standing · credit policy v9 §5.3, §5.7 · warrant foundational · in force · authority: the credit committee · §5.7 on the credit data team’s proposal | Latest accounts FY2025/26, audited, with management accounts beside them · the credit file · delivered 29.09.2026 · warrant validated · current · authority: the borrower · the credit data teamThe spread: EBITDA €413,000 · declared: spreading-agent-02 · SP-5316-1 · 09:28 · note 4 of the management accounts · reconciliation failed: a disposal gain of €95,000 · warrant model-derived · unreconciled · the weakest premise, below the bar · authority: delegated under LC-07/S · does not countEBITDA €318,000, leverage 3.3x of 3.5x, cover 1.3 · applicable: the audited accounts, reconciled by C-044 at 13:50 · SP-5316-2, a second line · warrant validated · a person’s reconciliation, signed · authority: the credit officerCovenants met on the spread as delivered: leverage 2.5x of 3.5x · covenant-agent-01 · CV-5316-1 · 09:29 · on SP-5316-1 · warrant: that of SP-5316-1, unreconciled · the test itself is a rules engine’s · authority: delegated under LC-07/CB-5119 rates 6 of 10 on the reconciled spread · the approved rating model v4.3 · 14:02 · warrant validated · authority: credit risk |
| the mandate versionthe mandate in force at that second, with its level and its limit | LC-07.1 · since 01.09.2026 · decide renewals · €250,000 a facility · €300m a month · delegates LC-07/S (the spread) and LC-07/C (the covenant test), bound to the parent’s limits and expiry | R1 LC-07.1 · decide renewals · €250,000 · delegates LC-07/S, LC-07/CR2 the officer’s lending authority · €500,000 · the delegated lending authorities |
| the control standardthe control standard version and the rule set the check applied | CS-4 v2026.2 · rule set RS-LC-07 r3 | CS-4 v2026.2 · rule set RS-LC-07 r3 |
| the consequence tierthe tier the act was classified into, and the version of the taxonomy that classified it | material · taxonomy CT-2026.1 · €220,000 for twelve months, a contract with legal effect, counts toward the group limit | material · taxonomy CT-2026.1 |
| At the act · what the check decided | ||
| the check’s decisionpermit, refer, or block, how many of the six inputs held, and the reason code | PERMIT · six of six · reason code OK · the chain read: two delegate records bound to this call · eight policy checks of eight | R1 REFER · five of six · reason code BASIS-04: SP-5316-1 unreconciled, €413,000 declared, €318,000 audited · owner: SME credit officersR2 PERMIT · the officer’s decision on the reconciled spread · eight policy checks of eight |
| the exact actwhat was done, to whom, for how much, under which id, once | renew facility 5302 · €220,000 to 31.10.2027 · pricing, security, and covenants unchanged · F5302-R1 · once | R1 proposed: renew facility 5316 · €240,000 to 31.10.2027 · F5316-R1 · not executedR2 renew facility 5316 · €240,000 to 31.10.2027 · a covenant certificate each quarter · F5316-R2 · once |
| the permitits id and what it was bound to: the mandate version, the release, the basis version, the exact act; and how long it held | PR-5302-1 · bound to LC-07.1, CH-07, FY2025/26, SP-5302-1, CV-5302-1, the rating run of 09:10, €220,000 on F5302 to 31.10.2027 · valid for the next booking batch | R1 none · the proposal went to the officers’ queue with the reason and both figuresR2 PR-5316-2 · bound to the officer’s authority, SP-5316-2, the rating run of 14:02, €240,000 on F5316 · valid for the first batch after the documents are signed |
| After the act · what came back | ||
| the receiptwhat the receiving system returned, and the reconciliation against it: one permit, one act, one receipt | K-5302 · limit booked 22:00:05 · renewal letter L-5302 issued 16.10 · acknowledged by the core banking system · reconciled against the facility ledger: one permit, one booking, one receipt | R1 noneR2 K-5316 · limit booked 17.10 22:00 · renewal letter L-5316 issued 19.10 · acknowledged by the core banking system · reconciled |
| the human decisionwhere a person decided: who, under which authority, what they confirmed, and when | none needed | R1 none yet · referred to a person with the reasonR2 credit officer C-044 reconciled the spread, ran the rating, and renewed at €240,000 at 14:20 |
| the costwhat the decision cost in tokens, and in a person’s time where one was needed | €1.80 in tokens across the three agents · no officer time | R1 €1.80 in tokens across the three agentsR2 €66.67 of an officer’s time |
| retentionhow long the record, the manifest, and the permits are kept, and personal data inside them by its purpose | the record, the manifest, the delegates’ records, and the permits: ten years from the end of the facility (illustrative) · personal data by purpose and retention rule · a corrected figure is a new, linked entry | the record, the manifest, the delegates’ records, and the permits: ten years from the end of the facility (illustrative) · personal data by purpose and retention rule · a corrected figure is a new, linked entry |
control standard CS-4, version 2026.2 · rule set RS-LC-07 r3: refer any unreconciled spread, any covenant breach or waiver, any increase, any rating override, any mismatch of basis; a delegate’s record is read as part of the basis · CT-2026.1 · the bank’s consequence taxonomy · proposed by the CRO with compliance and SME Lending, set by the board, 06.2026 · ids, dates, and figures invented.
The business case
36,000 annual reviews a year, 50% eligible and 80% adopted; 160 minutes saved on each at €80 an hour, 65% realised. Run cost €950,000 a year; set-up €1,800,000. Memos the chain prepares for new lending, increases, and waivers, which the agent only recommends, are not counted; nor are credit losses avoided or faster answers to clients. The running cost covers all three agents.
The people, on the day the mandate narrows
The credit officers do this work today. The person who receives a referral holds at least the authority of the mandate the agent acted under, its limit included. Credit officer C-044 holds a lending authority of €500,000; the credit agent decides renewals up to €250,000, and its delegates decide nothing. On a quarter-end day, delivered accounts and renewal dates bunch at the quarter end, and the reviews double
What the law asks here
| Duty | Why here | Evidence | Boxes |
|---|---|---|---|
| EBA loan origination guidelines a bank grants or renews credit | the bank renews credit; the guidelines cover the information relied on and the use of automated models, the spread and the covenant test included | the information relied on; governance of automated models in creditworthiness assessment; monitoring of the model | e2 w2 w1 p6 |
| GDPR, Article 22 (to be tested) a decision is solely automated and has a legal or similarly significant effect: a test the firm applies per type of decision | Article 22 protects natural persons: a renewal to a company is outside it; a sole trader or a personal guarantor brings the test back | a route to a person on request, with a time; reasons that explain the procedure and principles actually applied (CJEU C-203/22) | w4 w5 w6 |
| GDPR, Articles 15, 16, 17 personal data is processed | the file holds personal data of directors and guarantors | access to the data on request; a corrected fact as a linked entry; retention by purpose, the storage-limitation principle | w5 p5 |
| EU AI Act, high-risk (classified: not high-risk) the use is on Annex III, among them the creditworthiness of natural persons (5(b)), life and health pricing (5(c)), and essential public benefits (5(a)), and Article 6(3) does not take it out | not as built: lending to companies is not on the list; Annex III point 5(b) covers the creditworthiness of natural persons | the classification, with its reasoning, in the agent portfolio; if high-risk, human oversight and logs | e1 w1 w4 |
| EU AI Act, Articles 4 and 50 any provider or deployer; Article 50 when an AI system talks to people, since 2 August 2026 | Article 50: the agent tells the client what it still needs, and says it is an AI system; Article 4 for the officers who decide referrals and reconcile spreads | measures to support the AI literacy of the people who decide referrals (Article 4 as reworded by the 2026 omnibus: the duty stays, no guaranteed level); telling the person she is talking to an AI system | e4 w4 |
| DORA the firm’s ICT, and its ICT third parties | the bank is a financial entity under DORA | identity and access control, under the ICT risk framework; incident classification and reporting; the register of ICT third-party arrangements; testing | p1 p3 p5 p6 e1 e4 |
| Consumer Credit Directive II | the SME renewal is not consumer credit; a sole trader's loan for private purposes would be | ||
| EBA guidelines on restrictive measures | sanctions screening sits in the KYC refresh, outside this decision; the bank's restrictive-measures policy still covers the renewal | ||
| EIOPA opinion on AI governance (6 August 2025) | not an insurer | ||
Dated 11 October 2026; from the shared duty table; not legal advice.
Notes on the case
- Each delegate acts under the parent’s authority, with its own identity and a token bound to the call and to the sub-mandate; the check before the booking reads the chain through the delegates’ records, cited in the credit agent’s basis; the weakest premise of the act is the spread, a figure a model derived, which counts once it reconciles to the audited totals. The chain CH-07 is validated as one release; a new version of any agent in it is a new chain.
- What the delegation adds to the map, and nothing else. w1: three identities and one validated chain. w3: a sub-mandate inherits the parent’s limits, conditions, and expiry, and is revoked, narrowed, and restored with it. w4: the check reads a delegate’s record as part of the basis, with the standing of the delegate’s claim on both axes; the delegate takes no act on the world. So no second check fires, and the platform’s policy enforcement holds the delegate to the facility the call names. w5: the first agent’s record names the second, by release, sub-mandate, and record id. So a reader can rebuild the decision across the chain. w6: a referral caused by a delegate counts against the parent’s trigger.
- The cohort layer stays signalled, not drawn: several delegates on one process, each inside its limit, together over a limit none of them holds, is part one’s slide 12 and the reference model, and this case shows one chain of three. The traces the delegates leave are their records; the parent reads them before its act.
- Figures are illustrative. The 160 minutes saved per renewal and the 50% eligible share are assumptions to check with a bank’s SME credit team; the running cost of €950,000 covers the three agents.
- The case keeps to legal persons. Assessing a sole trader or a director’s personal guarantee is creditworthiness assessment of a natural person, high-risk under Annex III of the EU AI Act; hence the condition in LC-07.
- The rating comes from the bank’s approved rating model and is not the chain’s own: in an IRB bank the rating is assigned or approved independently of the credit decision, and a material change to the model needs supervisory approval. The spread is an input to the rating. So a spread the model derives and nobody reconciles reaches the rating too; hence the reconciliation before the rating run.
- The process from request to decision (the spread, the covenant test, the rating, the memo, human validation) is the chain’s autonomy; LC-07 and its sub-mandates are its authority. The demonstration shows only the act at the end, the booking.