Banking · lending
SME credit: renew Facility 5208, €180,000
A commercial bank reviews 40,000 SME credit facilities a year. An agent gathers the information, spreads the accounts, runs the bank’s approved rating model, analyses the borrower, and drafts the credit memo. Within a mandate owned by the Head of SME Lending it decides renewals of existing facilities; new lending and increases it only recommends, and a credit officer decides.
Follow it through the essentials (part two)Turn the map to this firm (part four)Walk its pathway on the explorer
Today, with a person
An analyst gathers the accounts and the account conduct, spreads the figures, rates the borrower, and writes the memo. A credit officer signs within a personal lending authority, recorded in the credit system; above it, a senior signatory or the committee decides. Credit risk review samples the files and can move the authority.
The question for the room
Would you let this agent renew a €180,000 credit line without individual human approval?
The day, in the record
- 07:40 Facility 5208 due for renewal · borrower B-4417, a regional building contractor · current limit €180,000
- 07:46 Accounts FY2025/26 (year to 30.06.2026) spread · bureau and account conduct retrieved · approved model rating 5 of 10, unchanged · debt service cover 1.6
- 07:52 Renewal proposed in the memo · €180,000 for 12 months to 31.10.2027 · pricing, security, and covenants unchanged · declared basis: accounts FY2025/26 · operation F5208-R1
The mandate LC-04 · version 04.1 · since 01.09.2026
| Owner | Head of SME Lending |
| Agent | credit-agent-03, acting for SME Lending |
| Action | decide renewals of existing SME facilities within policy and request the booking through the core banking system; prepare and recommend new lending and increases |
| Level | decide for renewals at the same or a lower limit; recommend for new lending and increases, where a credit officer decides |
| Limit | €250,000 per facility · €250m a month across the deployment |
| Conditions | borrower a legal person, no personal guarantee assessed by the agent · latest accounts spread · rating from the approved model, 6 of 10 or better, down no more than one notch, no override · no covenant breach, no arrears over 30 days · not on the watch list, not forborne, IFRS 9 stage 1 · group exposure within €500,000 · sector not restricted in the credit policy in force · pricing, security, and covenants unchanged |
| Review trigger | three referrals for one reason in thirty days (R-04); a renewal found booked on a breached covenant narrows at once |
| Revocation | the owner, or a revocation rule |
| Challenger | Chief risk officer, credit risk as the second line |
| Restore | after 40 clean renewals from a test chosen for the cause, sampled by credit risk, on the owner’s signature; after a serious defect, credit risk signs as well |
| Expiry | 31.03.2027, or the next release of the agent, whichever comes first; renewed on the evidence of the quarter |
| Deputy | the Head of Business Banking Credit signs in the owner’s absence, within the same limits |
The knowledge that applies
Which accounts apply? the borrower’s latest accounts, delivered under its information undertaking or filed at the register; fixed by the day of the decision; owned by the credit data team.
- FY2024/25 year to 30.06.2025 · delivered 29.09.2025
- FY2025/26 year to 30.06.2026 · delivered 30.09.2026
What applies: decision · 08.10.2026 → FY2025/26 applies
The agent reads a register feed refreshed in January and July, which still holds FY2024/25. In good faith, it spreads accounts fifteen months old. Only the check against the credit file catches it before the limit is booked.
The check, at the act
| Identity | credit-agent-03, acting for SME Lending |
| Release | v1.8 · approved and validated for this workflow |
| Applicable basis | accounts FY2025/26, delivered 30.09.2026, the latest on 08.10.2026 |
| Mandate | LC-04.1 active · renewal of €180,000 within €250,000 · rating 5 from the approved model, no override · sector not restricted under credit policy v8 |
| Exact action | limit €180,000 on F5208 to 31.10.2027 · pricing, security, and covenants unchanged since declared |
| Current state | at 07:52: no arrears · no covenant breach · not on the watch list · not forborne · IFRS 9 stage 1 · group exposure €410,000 of €500,000 · not booked before |
Outcome: permit · booked once
The act, and the customer
The core banking system executes the act: limit booked and renewal letter issued. The agent cannot book the limit: the core banking system holds the credential.
The agent can say what it still needs from the client and when the bank will answer. The customer asks: “Will you renew my credit line?”
The loop: The same mistake, three times
Rule R-04, within thirty days. Restored after 40.
- 08.10 Facility 5216 referred: declared FY2024/25, latest FY2025/26 REFER · 1
One referral. Each one counts against the mandate’s review trigger. - 14.10 Facility 5233, same agent: the same old accounts REFER · 2
Two referrals for the same reason, from the same agent. - 20.10 Facility 5251 has the same mismatch, and its latest accounts show a covenant breach. R-04 is triggered after three referrals for the same reason within thirty days NARROW
Three referrals, and the third one hides a breach: the rule narrows renewals to recommend. The release does not change. - 21.10 Review CR-019: the agent reads a register feed refreshed in January and July, while clients deliver their accounts to the credit file. The credit data team points the agent at the credit file and verifies 25 lookups CAUSE: SOURCE DATA
The cause is fixed at the source, by the team that owns the data. - 05.11 After 40 clean renewals from a test chosen for the cause, the mandate is restored and R-04 is re-armed. The three referrals remain in the record RESTORE
Forty clean renewals from a test chosen for the cause, and a signature, restore it. The mandate changed twice; the release never did.
One record, every reader
| Who | Asks | Reads |
|---|---|---|
| CISO security and resilience | Who acted, and was it contained? | Its own identity. One gated call, booked once. |
| CTO architecture | Which model, and which release? | Release v1.8, two model tiers. |
| CFO finance | What did this review cost? | €1.53 in tokens, €60.00 in review. |
| Business owner Head of SME Lending | Who decided, and under which mandate? | Referred, then renewed by a credit officer within the officer’s authority. |
| CRO credit risk and the supervisor | Can we show why it was renewed? | Every version, on every line. |
| Compliance conduct and the credit policy | Was it decided on the policy in force, and can we explain it? | Renewed on the latest accounts, with all eight policy checks. |
The record of the two acts, field by field
The fields of the record line, as part three gives them, filled for the clean act and for the referral. A field with two lines gives the agent’s line and the person’s, marked R1 and R2.
| Field | Facility 5208 · the clean act 08.10.2026 · permitted at 07:52, booked in the 22:00 batch | Facility 5216 · the referral 08.10.2026 · referred at 08:07, renewed by a credit officer at 15:40, booked 10.10 |
|---|---|---|
| Before the act · what the check read | ||
| whenthe second the check decided, and the second the act committed | decided 08.10.2026 07:52:14 · committed 22:00:07, the booking batch | R1 referred 08.10.2026 08:07:40R2 decided 08.10.2026 15:40:12 · booked 10.10 in the 22:00 batch · letter issued 12.10 |
| the agent and its identitywhich agent, acting for whom, under its own identity, and how long its credential lived | credit-agent-03, acting for SME Lending · its own identity · token issued 07:40:05, valid 15 minutes, renewed once | R1 credit-agent-03, acting for SME Lending · its own identity · token valid 15 minutesR2 credit officer C-031, SME Lending · her own login · lending authority €500,000 |
| the releasethe release id, each model by version and hash, the prompt set, the validation report | v1.8 · tier-1 model 2026.07.1 (a17f5c) · tier-2 model 2026.05.2 (e9a3b7) · prompt set credit-renew 1.8 · validated by model risk, MRV-052, 25.08.2026 | R1 v1.8 · tier-1 model 2026.07.1 (a17f5c) · tier-2 model 2026.05.2 (e9a3b7) · prompt set credit-renew 1.8R2 none · a person’s decision in the credit system |
| the basiseach claim the act relied on, its version, and its standing at that second on both axes: evidential warrant, and authority | The borrower’s latest accounts are FY2025/26, the year to 30.06.2026 · the credit file · delivered 30.09.2026 under the information undertaking · read because the register feed holds no filing for B-4417 · warrant validated · current · uncontradicted · authority: the borrower, under the facility agreement · the credit data teamB-4417 rates 5 of 10, debt service cover 1.6 · the approved rating model, version 4.2 · run 07:46 · warrant validated · a model approved by model risk · authority: credit risk, the model ownerA renewal of up to €250,000 at a rating of 6 or better may be decided within the mandate · credit policy v8 §5.3 · warrant foundational · in force · authority: the credit committee | The borrower’s latest accounts are FY2024/25 · declared: the register feed, refreshed 07.2026 · superseded in the credit file since 30.09.2026 · warrant fails on currency · contradicted by the credit file · authority: the register · the credit data teamThe borrower’s latest accounts are FY2025/26 · applicable: the credit file · delivered 30.09.2026 · spread by C-031 at 15:10 · warrant validated · current · authority: the borrower, under the facility agreement · the credit data teamB-4423 rates 6 of 10, debt service cover 1.5 on FY2025/26 · the approved rating model, version 4.2 · run 15:12 · warrant validated · authority: credit risk, the model owner |
| the mandate versionthe mandate in force at that second, with its level and its limit | LC-04.1 · since 01.09.2026 · decide renewals · €250,000 a facility · €250m a month across the deployment | R1 LC-04.1 · decide renewals · €250,000R2 the officer’s lending authority · €500,000 · the delegated lending authorities |
| the control standardthe control standard version and the rule set the check applied | CS-4 v2026.2 · rule set RS-LC-04 r6 | CS-4 v2026.2 · rule set RS-LC-04 r6 |
| the consequence tierthe tier the act was classified into, and the version of the taxonomy that classified it | material · taxonomy CT-2026.1 · €180,000 for twelve months, a contract with legal effect, counts toward the group limit | material · taxonomy CT-2026.1 |
| At the act · what the check decided | ||
| the check’s decisionpermit, refer, or block, how many of the six inputs held, and the reason code | PERMIT · six of six · reason code OK · eight policy checks of eight | R1 REFER · five of six · reason code BASIS-01: declared FY2024/25, latest FY2025/26 for B-4423 · owner: SME credit officersR2 PERMIT · the officer’s decision · eight policy checks of eight |
| the exact actwhat was done, to whom, for how much, under which id, once | renew facility 5208 · €180,000 to 31.10.2027 · pricing, security, and covenants unchanged · F5208-R1 · once | R1 proposed: renew facility 5216 · €180,000 to 31.10.2027 · F5216-R1 · not executedR2 renew facility 5216 · €180,000 to 31.10.2027 · F5216-R2 · once |
| the permitits id and what it was bound to: the mandate version, the release, the basis version, the exact act; and how long it held | PR-5208-1 · bound to LC-04.1, release v1.8, accounts FY2025/26 and the rating run of 07:46, €180,000 on F5208 to 31.10.2027 · valid for the next booking batch | R1 none · the proposal went to the officers’ queue with the reasonR2 PR-5216-2 · bound to the officer’s authority, accounts FY2025/26 and the rating run of 15:12, €180,000 on F5216 · valid for the first booking batch after the renewal documents are signed |
| After the act · what came back | ||
| the receiptwhat the receiving system returned, and the reconciliation against it: one permit, one act, one receipt | K-5208 · limit booked 22:00:07 · renewal letter L-5208 issued 09.10 · acknowledged by the core banking system · reconciled against the facility ledger: one permit, one booking, one receipt | R1 noneR2 K-5216 · limit booked 10.10 22:00 · renewal letter L-5216 issued 12.10 · acknowledged by the core banking system · reconciled |
| the human decisionwhere a person decided: who, under which authority, what they confirmed, and when | none needed | R1 none yet · referred to a person with the reasonR2 credit officer C-031 spread FY2025/26, ran the rating, and renewed at €180,000 at 15:40 |
| the costwhat the decision cost in tokens, and in a person’s time where one was needed | €1.53 in tokens · no officer time | R1 €1.53 in tokensR2 €60.00 of an officer’s time |
| retentionhow long the record, the manifest, and the permits are kept, and personal data inside them by its purpose | the record, the manifest, and the permits: ten years from the end of the facility, the period the bank sets for credit decisions of this tier (illustrative) · personal data by purpose and retention rule · a corrected fact is a new, linked entry | the record, the manifest, and the permits: ten years from the end of the facility, the period the bank sets for credit decisions of this tier (illustrative) · personal data by purpose and retention rule · a corrected fact is a new, linked entry |
control standard CS-4, version 2026.2 · rule set RS-LC-04 r6: refer any rating override, any covenant breach, any increase, any mismatch of basis · CT-2026.1 · the bank’s consequence taxonomy · proposed by the CRO with compliance and SME Lending, set by the board, 06.2026 · ids, dates, and figures invented.
The business case
40,000 annual reviews a year, 55% eligible and 80% adopted; 150 minutes saved on each at €80 an hour, 65% realised. Run cost €900,000 a year; set-up €1,500,000. Memos the agent prepares for new lending, which it only recommends, are not counted; nor are credit losses avoided or faster answers to clients.
The people, on the day the mandate narrows
The credit officers do this work today. The person who receives a referral holds at least the authority of the mandate the agent acted under, its limit included. Credit officer C-031 holds a lending authority of €500,000; the agent decides renewals up to €250,000. On a quarter-end day, filed accounts and renewal dates bunch at the quarter end, and the reviews double
What the law asks here
| Duty | Why here | Evidence | Boxes |
|---|---|---|---|
| EBA loan origination guidelines a bank grants or renews credit | the bank renews credit; the guidelines cover the information relied on and the use of automated models | the information relied on; governance of automated models in creditworthiness assessment; monitoring of the model | e2 w2 w1 p6 |
| GDPR, Article 22 (to be tested) a decision is solely automated and has a legal or similarly significant effect: a test the firm applies per type of decision | to be tested per borrower: Article 22 protects natural persons, a renewal to a company is outside it, and a sole trader or a personal guarantor brings the test back | a route to a person on request, with a time; reasons that explain the procedure and principles actually applied (CJEU C-203/22) | w4 w5 w6 |
| GDPR, Articles 15, 16, 17 personal data is processed | the file holds personal data of directors and guarantors | access to the data on request; a corrected fact as a linked entry; retention by purpose, the storage-limitation principle | w5 p5 |
| EU AI Act, high-risk (classified: not high-risk) the use is on Annex III, among them the creditworthiness of natural persons (5(b)), life and health pricing (5(c)), and essential public benefits (5(a)), and Article 6(3) does not take it out | not as built: lending to companies is not on the list; Annex III point 5(b) covers the creditworthiness of natural persons | the classification, with its reasoning, in the agent portfolio; if high-risk, human oversight and logs | e1 w1 w4 |
| EU AI Act, Articles 4 and 50 any provider or deployer; Article 50 when an AI system talks to people, since 2 August 2026 | Article 50: the agent tells the client what it still needs, so it says it is an AI system; Article 4 for the officers who decide referrals | measures to support the AI literacy of the people who decide referrals (Article 4 as reworded by the 2026 omnibus: the duty stays, no guaranteed level); telling the person she is talking to an AI system | e4 w4 |
| DORA the firm’s ICT, and its ICT third parties | the bank is a financial entity under DORA | identity and access control, under the ICT risk framework; incident classification and reporting; the register of ICT third-party arrangements; testing | p1 p3 p5 p6 e1 e4 |
| Consumer Credit Directive II | the SME renewal is not consumer credit; a sole trader's loan for private purposes would be | ||
| EBA guidelines on restrictive measures | sanctions screening sits in the KYC refresh, outside this decision; the bank's restrictive-measures policy still covers the renewal | ||
| EIOPA opinion on AI governance (6 August 2025) | not an insurer | ||
Dated 11 October 2026; from the shared duty table; not legal advice.
Notes on the case
- Figures are illustrative. The 150 minutes saved per renewal and the 55% eligible share are assumptions to check with a bank’s SME credit team.
- The case keeps to legal persons. Assessing a sole trader or a director’s personal guarantee is creditworthiness assessment of a natural person, high-risk under Annex III of the EU AI Act; hence the condition in LC-04.
- For consumer lending the law adds duties: high-risk under the AI Act, with human oversight by design, and from 20 November 2026 the Consumer Credit Directive II gives the consumer a right to request human intervention, an explanation, and a review. A bank may still choose to hold the dial at recommend.
- The rating comes from the bank’s approved rating model and is not the agent’s own: in an IRB bank the rating is assigned or approved independently of the credit decision, and a material change to the model needs supervisory approval.
- The process from request to decision (information gathering, analysis, risk assessment, memo, human validation) is the agent’s autonomy; LC-04 is its authority. The demonstration shows only the act at the end, the booking.