Lend money to
strangers. Get most
of it back.
Every consumer fintech that touches credit is running the same wager: extend access today, and trust that tomorrow's repayment — minus the slice that never arrives — still leaves you ahead. This manual is about engineering that slice.
Meet Northwind
Throughout this manual we'll reason about a fictional company — Northwind Financial, a direct-to-consumer fintech app. Northwind earns money four different ways, and each one carries a different flavor of risk. Knowing which product you're talking about changes every answer below.
A checking-style account with a debit card. No credit extended — but balances, overdrafts, and direct-deposit behavior are the richest signal Northwind owns.
Small-dollar cash advances ($20–$250) repaid on the user's next payday. High velocity, thin margins, fast-moving losses.
A 12-month credit-builder installment loan. Longer duration, reported to bureaus — losses mature slowly over a vintage.
An affiliate marketplace that refers users to third-party personal-loan and refi lenders. Northwind bears no credit loss — only the risk of sending bad-fit leads.
Two mental models run through everything that follows. The balance-sheet lens: when Northwind funds a Boost or Build loan, its own capital is at stake, and unpaid loans become real losses. The marketplace lens: with Match, Northwind never lends — but a partner lender who keeps receiving leads that default will cut payouts or terminate the contract. Same discipline, different P&L.
Managing Portfolio & Credit Risk
Credit risk is the risk of loss when a borrower fails to repay what they owe, on the terms they agreed to. Managing it well means you can name — in dollars, before the fact — how much loss you expect, how much you could suffer in a bad scenario, and whether the revenue you collect is enough to cover both.
A.The equation everything hangs on
Expected loss is not a guess. It decomposes into three estimable parts. Internalize this and most of credit risk becomes arithmetic:
For a Northwind Boost advance of $150 with a 9% chance of default and an 85% loss rate (cash advances recover little): expected loss = 0.09 × 0.85 × $150 = $11.48. If Northwind's fee on that advance is $9, it is underwater on expected value before a single account misbehaves. That single line of math is the verdict on a pricing decision.
B.Two lenses: the loan vs. the book
An individual loan can default — that's idiosyncratic risk, and you accept it on every account. The portfolio is where risk is actually managed, because losses there are partly predictable and partly correlated. The job is to keep the aggregate loss rate inside a tolerance you set in advance.
- Either pays or doesn't — binary outcome.
- You can decline it, price it, or size it down.
- One default is noise, not signal.
- Loss rate is a distribution you can forecast.
- Managed via mix, limits, and pricing — not one account at a time.
- A rising loss rate is signal — act on it.
C.Concentration & correlation — the silent killers
A portfolio's danger is rarely the average borrower; it's concentration. If 40% of Northwind Build loans sit with gig-economy workers in one metro, a regional downturn defaults them together. Diversified-looking books hide correlated risk: thin-file, low-income, and recently-onboarded segments all tend to sour at once when conditions turn. Track exposure by segment — geography, income band, channel, tenure, credit tier — and cap any single concentration before it caps you.
D.The metrics you live by
Portfolio management is a monitoring discipline. These are the instruments on the dashboard you should be able to read in your sleep:
Dollars written off as uncollectible, net of recoveries, as a share of the book. The single most-watched number.
Share of balances past due (e.g. 30+ DPD). Leads charge-offs by 1–4 months — your forward-looking gauge.
Cumulative loss for a cohort by months-on-book. Lets you compare originations fairly before they fully season.
Reserve held today for losses expected over the loan's life. Funds set aside, not earnings — and a discipline check on growth.
Revenue minus expected loss minus cost of funds and servicing. If negative, the segment shouldn't exist.
How bad losses get in a bad year, not an average one. The amount of capital you must survive on.
E.Risk appetite — decide before you need it
Good portfolio management starts with a written risk appetite statement: the loss rate Northwind will tolerate, the segments it will and won't serve, and the concentration caps it won't breach. The number isn't "as low as possible" — a zero-loss lender is simply declining profitable customers. The right loss rate is the one that maximizes risk-adjusted profit given your pricing. Appetite set in calm weather keeps you honest when a tempting-but-toxic growth channel appears.
"You don't manage a portfolio to avoid losses. You manage it so that the losses you take are the ones you chose, priced, and can afford."
F.The interactive part — feel the math
Drag the inputs below. Watch how a small move in default probability swamps a generous-looking fee. This is the instinct every credit operator needs:
Expected-Loss Sandbox
Watching Account Balances — Aggregate & Individual
Balances are the pulse of a fintech. On the deposit side, aggregate balances are your funding and your liquidity; on the credit side, balance trajectories are the earliest, cheapest signal that a borrower is heading for trouble. Monitoring them is a two-altitude discipline: the whole book from above, and the single account up close.
A.The aggregate view — the book from above
At the portfolio altitude you are answering: is the whole thing growing, shrinking, or quietly destabilizing? For Northwind Spend deposits, watch:
- Total balance & net flows. Are inflows (deposits, direct deposit) outpacing outflows? Decompose growth into new accounts vs. balance-per-account — they mean very different things.
- Balance concentration. What share of deposits sits in the top 1% of accounts? Concentrated deposits can leave fast. The same Gini-style lens applies to credit exposure.
- Cohort balance curves. Track average balance by signup month. A healthy product sees cohorts build balance over time; erosion across cohorts is a leading churn indicator.
- Direct-deposit penetration. The share of users routing a paycheck in. It predicts retention, lending eligibility, and deposit stickiness all at once.
- Liquidity coverage. Could Northwind fund a sudden wave of withdrawals? Model a stress outflow and confirm liquid assets cover it.
B.The individual view — one account, up close
At the account altitude the question is behavioral: is this person's relationship with money getting healthier or more fragile? The shape of a balance over time carries more information than its level on any single day.
- Recurring direct deposits, regular cadence.
- Balance recovers between paychecks — buffer rebuilds.
- Spending tracks income; rare or no overdrafts.
- Gradual upward drift in the floor balance.
- Direct deposit stops or shrinks — possible job loss.
- Balance floor trends toward zero; no buffer rebuild.
- Rising overdraft frequency; balance "sawtooths".
- Sudden full drawdown — flight, fraud, or hardship.
C.What you should actually be analyzing
"Monitoring balances" is not staring at a total. It is a structured set of analyses run on a cadence:
| Analysis | Question it answers | Cadence |
|---|---|---|
| Distribution shift | Is the shape of the balance distribution moving — more accounts clustering near zero? | Weekly |
| Cohort / vintage curves | Are newer signups building balance like older ones did? | Monthly |
| Velocity & volatility | How fast do balances move? High volatility flags instability before the level does. | Weekly |
| Trigger / threshold alerts | Which individual accounts just crossed a risk line (DD lost, balance < $X for N days)? | Daily |
| Segment cuts | Are trends concentrated in one channel, tenure, or geography? | Monthly |
| Liquidity stress test | Survive a modeled outflow shock? | Quarterly |
D.Early-warning signals worth wiring up
The point of monitoring is intervention before loss. Each signal should map to an automatic action — a tier downgrade, a credit-line freeze, a check-in nudge, a fraud review:
| Signal | Reads as | Severity |
|---|---|---|
| Direct deposit missed / stopped | Income disruption — repayment capacity at risk | High |
| Balance below $5 for 7+ days | No buffer; next obligation likely to bounce | Medium |
| Overdraft frequency rising MoM | Chronic cash-flow stress | Medium |
| Sudden full withdrawal | Churn, hardship, or account takeover | High |
| Spend spike with no income change | Possible fraud / mule activity | High |
| Balance floor drifting up over months | Improving health — candidate for a credit-line increase | Positive |
E.From signal to action — the playbook
- Instrument it. A live dashboard for aggregates; a per-account risk feed for triggers. If a signal isn't visible, it isn't managed.
- Set thresholds in advance. Define the lines that fire alerts before you're emotional about a specific account.
- Tier the response. Map each signal to a proportionate action — nudge, soft limit cut, freeze, manual review.
- Always segment. A flat aggregate can hide one cohort collapsing while another booms. Cut every trend by channel, tenure, and product.
- Close the loop. Track whether interventions actually reduced loss or churn. Monitoring without measured follow-through is theater.
Modeling Repayment & Delinquency Behavior
Once a loan is on the books, the question stops being "will they pay?" and becomes "given what they've done so far, what happens next?" Behavior modeling turns the messy reality of missed and partial payments into probabilities you can forecast, reserve against, and act on.
A.The vocabulary: delinquency buckets
A borrower doesn't snap from "fine" to "lost." They migrate through stages defined by days past due (DPD). For Northwind Build installment loans:
B.Roll rates & the transition matrix
The single most useful delinquency tool is the roll rate: of the balances in bucket X this month, what fraction rolled to bucket X+1 next month? Stack roll rates for every bucket and you have a transition matrix — a Markov model of the book. Multiply current bucket balances through it and you get a forward loss forecast. When a roll rate jumps, you have an early-warning siren that fires months before charge-offs print.
C.First-payment default — the canary
FPD — a borrower who misses their very first installment — is the most damning signal in lending. It rarely means hardship; it usually means the loan should never have been approved: fraud, a broken underwriting rule, or a misjudged applicant. A rising FPD rate points the finger straight back at origination, not collections, and is the fastest feedback loop you have on decisioning quality.
D.Vintage curves — comparing apples fairly
You can't compare a loan booked last month to one booked last year by raw loss rate — the young one hasn't had time to default. Vintage analysis fixes this by plotting cumulative loss against months on book, so every cohort is compared at the same age. Curves that climb steeper, or fail to flatten, mean recent underwriting is deteriorating:
The 2025 cohort here is a warning the dashboard would catch by month 6 — long before the full loss is realized. That early read is the entire point of vintage analysis.
E.How the models are actually built
Behavior modeling spans a toolkit, from simple and explainable to complex and powerful:
| Approach | What it does | Best for |
|---|---|---|
| Roll-rate / Markov chain | Forecasts bucket-to-bucket migration | Loss forecasting, reserves, collections sizing |
| Logistic regression (PD) | Scores probability of default in a window | Behavioral scorecards — transparent, regulator-friendly |
| Survival analysis | Models time to default, not just yes/no | Pricing term, lifetime-loss & CECL estimates |
| Gradient boosting / ML | Captures non-linear behavior signals | Highest accuracy where explainability can be retrofitted |
F.Getting the target definition right
Before any model trains, three definitions must be nailed down — get these wrong and the fanciest algorithm is worthless:
- The bad definition. What counts as "default"? Commonly 90+ DPD, charge-off, or bankruptcy. State it precisely.
- The performance window. How far forward do you observe outcomes — 12 months? 18? Long enough for risk to mature, short enough to stay current.
- The observation point. The moment you snapshot behavior to predict from. For behavioral models this is "as of each month on book," not application date.
G.Cures, re-aging, and recidivism
Delinquency isn't one-directional. A cure is a delinquent account returning to current. But beware re-aging — resetting an account to current after a token payment flatters today's metrics and hides tomorrow's loss. And watch recidivism: cured accounts that relapse default at far higher rates than the never-delinquent. Your model should treat a re-cured account as the elevated risk it truly is.
H.Does the model still work? Validation
A model is a perishable asset. Monitor it like one:
- KS statistic — separation of goods from bads.
- Gini / AUC — overall rank-ordering power.
- Backtest predicted vs. actual by score band.
- PSI (Population Stability Index) — has the applicant mix drifted?
- Characteristic drift on key inputs.
- Trigger a rebuild when stability breaks.
"Collections manages the loans that already went wrong. Behavior modeling tells you which ones those will be — while there's still time to do something about it."
Credit Decisioning — At Origination & Forever After
Decisioning is where risk strategy becomes a yes or a no. It happens twice: once at the moment of lending, when you know the least, and continuously afterward, when behavior tells you everything. Strong lenders treat both as one connected system.
A.At the time of lending — the origination decision
When a Northwind user applies for a Boost or Build loan, the request runs a decision waterfall: an ordered sequence of checks, each able to decline, refer, or pass the applicant onward. Order matters — cheap, decisive checks come first:
Confirm the person is real, who they claim, and not a synthetic or stolen identity. A fraud loss is a 100% loss — this gate comes first.
Non-negotiable cutoffs — minimum age, eligible geography, no active bankruptcy, not already over an exposure cap. Binary, fast, cheap.
Bureau score plus alternative data — and for Northwind, cash-flow underwriting on Spend account history. This produces the PD estimate.
Willingness ≠ capacity. Estimate income and obligations; confirm the new payment realistically fits the budget. A regulatory expectation, not just prudence.
Not just yes/no — how much, at what rate, over what term. Risk-based pricing: higher PD earns a higher rate and a smaller line.
If declined, deliver compliant reason codes (ECOA / Reg B). Decisioning logic must be explainable end to end.
B.Pricing for risk — the line and the rate
Approval is not one decision but three: approve, how much, how dear. Risk-based pricing sets the rate so expected revenue covers that segment's expected loss plus costs plus target margin. The line assignment caps exposure-at-default — a thin-file Build borrower might start at $500, earning the right to more through performance. Price and limit are the dials that let you say "yes" to riskier applicants profitably instead of declining them outright.
C.Testing changes safely — champion / challenger
Never swap a credit policy wholesale on a hunch. Run champion/challenger: route most volume through the current policy (champion) and a slice through the proposed one (challenger), then compare loss and approval rates on matched populations. Pair it with swap-set analysis — examining exactly who the new policy approves that the old declined, and vice versa — to confirm you're trading up in quality, not just changing the names.
D.Ongoing — decisioning never stops
Origination is one decision frozen in time on stale data. Once an account is live, behavior — the topic-three signal — feeds a continuous stream of new decisions:
Re-score every active account on a behavioral model. Today's repayment record beats the application bureau pull.
Proactively raise limits for proven performers — grows the book and rewards loyalty where risk has fallen.
Reduce or freeze exposure when behavior deteriorates — stop lending into a developing default.
Route delinquents by cure likelihood: self-cure gets a nudge, high-risk gets early human contact.
E.Collections is a decisioning problem too
When an account goes delinquent, every contact is a decision: who to call, when, with what offer. Use the behavior model to segment. A high-cure-probability account often just forgot — a gentle reminder works and a costly call would only annoy. A low-cure account needs early human contact and maybe a hardship plan or settlement. Spending collections effort where it changes the outcome is itself risk-adjusted decisioning.
F.The marketplace case — Northwind Match
With Match, Northwind lends nothing and bears no credit loss — so why care about credit risk? Because the partner lender does, and they pay per funded loan, not per click. Send leads that the lender's own underwriting rejects, or that fund and then default, and your payout per lead falls or the contract ends. Northwind's job is pre-qualification: matching each user to lenders whose appetite they actually fit. The discipline is identical to underwriting — you're just optimizing the partner's loss curve instead of your own.
G.Governance — keep it legal and accountable
Credit decisioning is among the most regulated things a fintech does. Three non-negotiables:
- Fair lending. Models must not discriminate on protected classes (ECOA). Test for disparate impact — even proxy variables that correlate with a protected class are a problem.
- Explainability & adverse action. Every decline needs specific, accurate reason codes. A model you can't explain is a model you can't legally deploy.
- Model risk management. Independent validation, documentation, versioning, and ongoing monitoring of every model in production. The model that was right last year can quietly drift wrong.
"Underwriting decides who gets in the door. Portfolio management decides how long they stay and on what terms. Treat them as one loop, not two departments."
Field Glossary
The terms in this manual, in one place. These are the words spoken in any consumer-credit risk meeting — fluency here is table stakes.
- PD
- Probability of Default — likelihood a borrower stops paying within a defined window.
- LGD
- Loss Given Default — share of exposure unrecoverable after collections, as a percentage.
- EAD
- Exposure at Default — dollars outstanding at the moment default occurs.
- Expected Loss
- PD × LGD × EAD — the loss you should price in and reserve for, on average.
- Unexpected Loss
- Loss in a bad scenario beyond the average — the amount capital must absorb.
- NCO Rate
- Net Charge-Off rate — write-offs net of recoveries over average receivables.
- DPD
- Days Past Due — days since a scheduled payment was missed.
- Delinquency Bucket
- A DPD band (1–29, 30–59, …) used to stage an account's deterioration.
- Roll Rate
- Probability a balance migrates from one delinquency bucket to the next-worse one.
- Transition Matrix
- The full grid of roll rates — a Markov model of how the book moves.
- FPD
- First-Payment Default — missing the very first installment; usually an origination failure.
- Vintage
- A cohort of loans originated in the same period, tracked together by months on book.
- Vintage Curve
- Cumulative loss for a cohort plotted against age, enabling fair cohort comparison.
- MOB
- Months on Book — how long an account has been open; the x-axis of vintage analysis.
- Cure
- A delinquent account returning to current status.
- Re-aging
- Resetting an account to current after a token payment — flatters metrics, hides loss.
- CECL
- Current Expected Credit Loss — accounting standard requiring lifetime-loss reserves up front.
- Risk-Based Pricing
- Setting rate and line by estimated risk, so revenue covers each segment's expected loss.
- Decision Waterfall
- The ordered sequence of underwriting checks an applicant flows through.
- Cash-Flow Underwriting
- Assessing creditworthiness from bank-account transaction behavior, not just bureau data.
- Champion / Challenger
- Running a new policy on a slice of volume against the incumbent to compare outcomes.
- Swap Set
- The applicants a new policy decides differently from the old — the real basis of comparison.
- KS / Gini / AUC
- Statistics measuring how well a model separates and rank-orders good from bad accounts.
- PSI
- Population Stability Index — flags when the applicant population has drifted from training data.
- Adverse Action
- The legally required notice and reason codes given when credit is declined (ECOA / Reg B).
- Disparate Impact
- A neutral-looking policy that nonetheless harms a protected class — a fair-lending violation.
- Concentration Risk
- Outsized exposure to one segment, so a single shock causes correlated losses.
- Risk Appetite
- The pre-agreed level of loss and the segments a lender will and won't accept.
Five Companies Worth Your Next Move
A shortlist for a senior, lead, VP, or director Product Management search in consumer fintech — chosen because each one is growing, hiring, and building exactly the credit, lending, and risk products this manual is about. Knowing the four topics above is your edge in these interview rooms.
The largest US consumer neobank by new-account share, Chime IPO'd in June 2025 and posted its first GAAP-profitable quarter in Q1 2026. It is pushing decisively from fee-light banking into credit — the Chime Card secured credit builder, MyPay earned-wage access, and Instant Loans — and just launched a premium tier, Chime Prime.
Post-IPO scaling story with real momentum — building a credit org almost from scratch and moving upmarket. Lots of net-new product surface for senior PMs.
Own credit-product expansion, member monetization (ARPAM), or the risk/decisioning layer that lets a fee-averse base safely access credit.
SoFi has evolved from student-loan refinancing into a chartered, full-spectrum digital bank — personal, student, and home lending alongside deposits, investing, and credit cards. Q1 2026 was a record quarter on members, products, and originations, with heavy investment in AI-driven underwriting and fraud.
The broadest product portfolio in consumer fintech — a deep org with senior/director ladders across lending, banking, and the cross-sell "financial services productivity loop."
Lead a lending vertical, the cross-sell engine, or credit-decisioning and risk platform work powering AI underwriting.
The US buy-now-pay-later leader, Affirm reached GAAP profitability in fiscal Q3 2026 on roughly $49B of annual GMV. Its breakout product is the Affirm Card — a debit-style card with on-the-fly financing — which is converting Affirm from a checkout button into a direct consumer relationship.
Credit decisioning is the product — Affirm is famous for real-time, transaction-level underwriting. A PM here lives inside the topics of this manual every day.
Drive the Affirm Card's D2C expansion, 0% APR merchant programs, or the risk and pricing systems that underwrite every transaction.
Dave is the breakout performer in small-dollar credit — its ExtraCash advances repaid on payday. Q1 2026 saw revenue up 47%, the highest monetization rate in four years, and its lowest-ever Q1 past-due rate (1.69%) — proof its CashAI underwriting model is working. Smaller than the others, so senior roles carry more scope.
A leaner public company where a lead/director PM owns a whole product line. High-velocity, short-duration lending makes the risk feedback loop fast and visible.
Own ExtraCash, the CashAI underwriting roadmap, or banking attach and member monetization (ARPU climbed to $212).
Cash App is the largest D2C consumer-finance app on this list by reach, and Block is deliberately turning it into a lending hub. Q1 2026 consumer-lending originations jumped 82% to $17.6B, with Cash App Borrow up 175% and Afterpay BNPL outpacing Borrow's early curve — all on a proprietary Cash App Score underwriting model.
Unmatched scale and an explicit strategic pivot into lending — director/VP roles shape products touching tens of millions while the credit org is actively being built up.
Lead Cash App Borrow, Afterpay integration, the Cash App Score risk model, or banking attach for the upmarket "primary banking" cohort.
→How to use this list in interviews
Every company here lives or dies on the four topics above. Walk in able to discuss their loss curves, their delinquency trends, and their decisioning strategy as a credit-literate product leader — not a generic PM. Read the last two earnings releases, form a point of view on one product's unit economics, and bring it. That fluency is what separates a senior IC from a director candidate.