ML Underwriting at Northline Bank: When Branch Managers Overturn the Model
Northline Bank, a private bank with ₹62,000 crore of advances, underwrites 70% of its MSME loans manually; average turnaround is nine days against two days at NBFC competitors. The bank has licensed a vendor's machine-learning scorecard that consumes GST returns and bank-statement data through the account aggregator, and it is running on the vendor's cloud with no in-house model documentation. In the six-month pilot, 34% of model declines were overturned by branch managers, who can override with a written justification; the internal audit note records that overrides were approved without a second credit opinion, and that the override cohort is performing worse than the model declined. Customers have consented to data use at onboarding but not to the specific model features derived from their statements. The vendor's contract has no clause on model retraining, drift monitoring or exit.
1. Identify the governance and model-risk failures and design the controls, mapping them to the bank's three lines of defence.
Read the worked answer
Failures, in order of severity.
- No model ownership: a licensed scorecard with no in-house documentation means the bank cannot explain a decline to a customer, a regulator or an auditor. Outsourcing the model does not outsource the credit decision.
- Unaccountable overrides: 34% override rate with no second opinion is not credit judgement, it is model bypass; the override cohort performing worse than declines proves the overrides are destroying value, not correcting the model.
- Purpose limitation: consent at onboarding for "data use" does not cover derived features from statement analysis. Under the DPDP Act, 2023, consent must be specific and purpose-limited, and the account aggregator framework requires a clear purpose code for each data pull.
- Vendor dependency: no retraining, drift or exit clause converts a decision-support tool into an operational single point of failure.
Controls by line of defence.
- First line (business/credit): documented override policy - second credit opinion above a ticket threshold, override reason codes from a fixed taxonomy, a cap on override volume per branch, and quarterly override-attribution reporting. Model owner named in the credit policy.
- Second line (risk): independent validation before go-live and annually; monitoring of population stability index, KS/Gini, and rank-order stability by segment; a challenger model kept live on shadow mode; feature-level explanation available for every decline. Data protection impact assessment and a consent-purpose matrix.
- Third line (audit): periodic review of override quality, vendor SLA adherence, and consent-to-feature traceability.
Contract fixes. Retraining cadence and data rights, source-code escrow, exit assistance, audit rights, and a service-credit regime tied to score stability.
2. Explain why 34% of declines get overturned and set out what you would actually change to stop it.
Read the worked answer
Why it happens. The override is doing a job for the branch manager that the system does not do for him. He is measured on disbursement and branch P&L; a model decline is a personal revenue loss and a relationship risk with a customer he has known for a decade. The model gives him a number and no story, so his local knowledge - often genuinely better than a GST-based score for a trader with informal cash flows - has no legitimate channel. Suppressing the override without giving it a channel pushes the behaviour underground (split applications, name changes, unrecorded top-ups).
Diagnosis before design. Test three hypotheses: (a) the model is systematically wrong for a segment - check override reasons coded against actual delinquency by segment; (b) the override is a pricing problem - managers override to keep relationships, not to take risk; (c) it is a pure incentive problem.
What to change.
- Separate the decision from the relationship. Route declines to a central credit judgement unit within 24 hours, with the branch manager submitting structured additional evidence (rent receipts, supplier invoices, UPI volumes). The override becomes an escalation, not a veto.
- Make the model auditable in the conversation. Show the manager the top three adverse features and what would change the outcome; most overrides collapse when the reason is specific.
- Change the incentive. Score branch managers on risk-adjusted contribution and portfolio quality at 12 months, not on disbursement; publish override-attribution by branch.
- Cap and price. Permit a small, monitored override quota only where evidence is documented, and reprice those tickets.
- Feed the loop. Override outcomes become labelled training data - the model should learn the segment it is getting wrong within two retraining cycles.
Expected result. A healthy override rate for a new model is roughly 8–12% with documented evidence, not 34% with a written justification.
3. Sequence the transformation over 18 months. What do you do first, and what do you deliberately not do?
Read the worked answer
Sequencing logic. Fix accountability before you scale automation, because automating an unowned decision multiplies the error.
Months 0–3 - own it. Appoint a model owner in credit risk; renegotiate the vendor contract (escrow, drift monitoring, exit); run the DPIA and rebuild consent purpose by purpose; suspend overrides above a ticket size until the escalation unit exists. Publish the override policy. No new segments. Months 3–6 - validate and shadow. Independent validation; challenger model on shadow mode; build the feature-explanation layer; set up monthly model performance pack to the risk committee. Start straight-through processing only for a narrow, well-populated segment (e.g. GST-registered traders with 24 months of filing history) where the model's population stability is strongest. Months 6–12 - industrialise. Move to automated decisioning with risk-based pricing and an exceptions queue; connect the override outcomes to retraining; extend to a second segment (supply-chain-anchored MSMEs) only after the first segment's KS and loss curves are stable for two quarters. Months 12–18 - scale and build. Migrate the model in-house or to a portable container with documented feature pipeline; train branch staff as evidence collectors rather than approvers; move 70% manual share down to roughly 30%.
Deliberately not doing. Not migrating the core banking system in parallel - it competes for the same engineering and change capacity. Not removing human credit judgement for new-to-credit or non-GST borrowers where the model has no signal. Not promising a two-day TAT bank-wide; promise it for the segment where you have proof, and let credibility carry the next segment.
Leading indicators. Override rate falling below 12%, percentage of decisions with full audit trail at 100%, model validation sign-off before each segment expansion, TAT in the pilot segment under 48 hours.