 | ||||||||
| ||||||||
| | ||||||||
Happy Monday, Fintech Takers! Well, we’re off and away. Money20/20 is in full swing and it’s the last year at the Venetian, so let’s leave all out there on the long carpeted hallways. Yesterday’s 3x3 basketball tournament was, as always, fantastic. Thank you to everyone who played, watched, and helped put it on. And a special thank you to our friends at Brico for sponsoring the event! We’ll be back next year, bigger and better than ever, so mark your calendars. One change I’m considering is switching from co-ed to hosting both men’s and women’s games. Our venue can accommodate additional players. Please let me know what you think about this idea! And, if you’re here in Vegas, please look for me over the next couple of days and say hello if you see me. Enjoy the madness! - Alex Was this email forwarded to you? Sponsored by Fundbox What does financing look like when it's designed around how professional firms actually earn and get paid? Fundbox uses de-identified payment data from 8am to surface pre-qualified offers inside their existing workflows, so businesses aren't asked to provide information 8am already has. Behind the product is Fundbox's modular infrastructure, built on more than 12 years of SMB data. That modularity allows industry-specific software to offer financing, utilizing only the parts of the infrastructure it needs.  Francisco de Goya 3 FINTECH NEWS STORIES#1: There Will Be No Monopoly in Cash Flow UnderwritingWhat happened?Lots of stuff is happening in the world of cash flow underwriting. Experian launched a cash flow credit bureau:
Equifax announced a new partnership around cash flow-powered analytics:
And Prism Data raised a $20M Series A and announced a new AI-powered transaction categorization engine:
So what?FICO launched the first general-purpose credit score in 1989. It secured a de facto government monopoly for credit scores in the mortgage market (which solidified its overall monopoly in the space) in 1995. This monopoly was enabled by the three national credit bureaus — Experian, Equifax, and TransUnion — which distributed the FICO Score (with a markup on top) along with their credit files to lenders. As difficult as it is to believe, it took the credit bureaus more than ten years to realize that maybe, perhaps, they should compete with FICO for the booming market for credit scores, rather than simply allowing them to own 100% of the market. The bureaus launched the VantageScore in 2006 and it took another 20 years (plus Bill Pulte’s mercurial nature) for them to finally break FICO’s hold. We’re not going to be repeating that pattern with cash flow credit scores. The cash flow lending ecosystem is already very competitive and, importantly, that competition is vertically integrating at a pace that far exceeds what we saw 30 years ago in the traditional credit scoring space:
See what I’m talking about? Lots of movement! Lots of partnerships! Lots of product launches that jeopardize the viability of those partnerships! And it all leaves me with lots of questions, including:
I don’t know the answers to these questions, but the sheer volume of them suggests to me that the competitive dynamics in the next generation of the credit data and analytics market will look nothing like the dynamics that FICO so effectively mastered in the last generation. #2: I Wish You Good Fortune in the Wars to ComeWhat happened?OK, well, we knew this was coming. And now it’s here. The big banks have officially said that they will be blocking AI agents from moving money on their customers’ behalf:
Instead, the big banks are building their own AI agents that will enable customers to move money between their different accounts at the same institution:
Ohh, and also, in a somewhat related announcement, Knot is productizing its technology platform so that other companies can build customer-permissioned data access and agentic action APIs:
So what?The last war that the big banks fought over unauthorized access to their systems was the great open banking war (2010 – 2025). That war was about read access to banks’ data, permissioned by the banks’ customers. The banks objected to the idea that their customers could give their data to companies that wanted to compete with them, and that objection sharpened into a lawsuit when the CFPB told banks that they would be legally required to provide that access for free. The banks’ dislike of open banking always struck me as a combination of operational annoyance (primarily focused on screen scraping) and strategic indignity at being forced to give a valuable asset, for free, to companies that would dare to compete with them. It was aggravating and vaguely threatening, but not acutely dangerous. The next war is much more acutely dangerous to banks. And it’s centered on write access, not read access. Products like Muse and Instinct want to automate much of the routine, tedious, and operationally complex work in consumers’ lives that they know they should do, but never find the time to actually do. In financial services, there’s a lot of that work: Moving cash between different accounts to optimize yield without missing any payments, refinancing loans when rates move, avoiding unnecessary fees, etc. And pretty much all of that work — when it is not consistently done by consumers — helps to increase the profitability of banks. Hence banks’ concerns about AI agents. Now, the banks will say that they aren’t trying to stop customers from optimizing their finances. They are merely trying to protect them from the mistakes that AI agents will inevitably make, as well as to protect themselves from “rogue” AI agents that may not be acting on customers’ authority at all. Those are very fair concerns. However, if those were the only concerns, banks wouldn’t be talking about blocking AI agents. They’d be talking about figuring out how to enable authorized external AI agents to safely and reliably transact within their environments. That’s not what they’re doing. Instead, the banks are blocking external agents and talking up their own internal agents, which will (they say) fulfill the same basic functions for customers, such as sweeping money from lower-yielding accounts to higher-yielding accounts. This is a position that I’m quite skeptical of. First, there will always be product options, outside the banks’ walls, that are better for certain customers in certain circumstances. An internal AI agent at JPMorgan Chase isn’t going to recommend that a customer move money from their JPMC checking account to a SoFi checking account, even if SoFi is offering a better rate than anything JPMC offers across its deposit product portfolio. Second, it’s easy to imagine a big bank’s internal AI agent taking suboptimal actions on behalf of their customers in order to fully optimize for the bank’s profitability (You’re absolutely right. I forgot to move that $2,000 to the high-yield savings account yesterday, even though I was supposed to. My apologies.) The problem for banks is that it will be very difficult to stop external AI agents in perpetuity. When a bank says today that it’s “blocking AI agents,” what it’s actually blocking is a specific, detectable pattern: A third party like Muse taking a customer’s credentials and logging in from its own servers, or driving a session with automation the bank can fingerprint. If your systems can detect those patterns, you can block the first, clumsiest generation of agents. The version of an external AI agent that actually scares banks doesn’t live in Meta’s cloud. It lives on your phone, in your browser, on the session you’re already logged into. It uses your cookies, your saved password, your device, your IP, your location. To the bank’s systems, it doesn’t look like a rogue third party. It looks like you, because it’s running on the exact same signals the bank uses to know it’s you in the first place. You can’t cleanly block that without getting very good at telling a human apart from that human’s own software, running on that human’s own device, acting on that human’s own instructions. And that’s a bot-detection arms race the bank has to run against its own customers. That arms race becomes even harder for banks to win when the costs of building a local agent that reliably logs in, survives a UI that changes without warning, clears step-up auth, holds the session, and doesn’t break every Tuesday go down. That’s where this announcement from Knot1 comes in. Knot has spent years solving the brittle, unglamorous middle that makes agentic action hard: Learn an action once, turn it into a durable API, then handle authentication, persistent connections, health checks, self-healing, and ongoing maintenance so the connection doesn’t rot. Now they’re selling it as a platform, which can turn virtually any action on any website into an API. The banks can block centralized agents and buy some time, but they can’t block the ones that run on your own phone and look exactly like you, and those get cheaper to build every time something like Supernova ships. Hence the title of this story: I wish you good fortune in the wars to come. #3: Watch Out for the WhipsawWhat happened?The OCC released its final report on results of its review of debanking at the nine then-largest national banks under its supervision:
And the CFPB, not wanting to be left out of the fun, announced its own debanking initiative, following up on the findings from the OCC’s report:
So what?I won’t delve deeply into the OCC’s report, since several others have already done so. In particular, I’d recommend reading the latest from Jason Mikula and Adam Levitin. I’ll only amplify a few points made by Jason and Adam:
The most interesting and ironic part of the report is a quote that Jason astutely pointed to in his newsletter:
Perfect. The OCC diagnoses the problem — decisions built on difficult-to-quantify factors will whipsaw with the political climate, administration to administration, even with no change in the law — and then the CFPB walks out and gives a helpful demonstration of exactly what it looks like. The CFPB’s statement started by announcing, “the next step in its work to advance President Trump’s fight” against debanking tied to “support of President Trump, MAGA, pro-life causes, and industries disfavored by the Left.” That’s not how an unbiased referee calling balls and strikes talks. That’s how a political party describes its score-settling agenda. And now let’s think about the mechanics of how that score will be settled. The CFPB cites three different statutory powers that it will use to investigate instances of debanking: ECOA (fair lending), FCRA (credit reporting), and Dodd-Frank (UDAAP). Most of the anecdotes cited in the OCC’s report don’t relate to credit or lending, so fair lending and credit reporting aren’t especially useful. And UDAAP, while being a very flexible supervisory tool for the bureau, only applies to consumers, where the OCC did not highlight evidence of debanking. Additionally, it’s worth pointing out that this same CFPB spent all of last year insisting that its authority (particularly around UDAAP) shouldn’t be stretched by the bureau to inappropriately target financial services providers. Its own 2025 Fair Lending Report bragged about narrowing fair lending to “proven, intentional racial discrimination with actual identifiable victims” and bringing zero new fair lending actions all year, and in court it dismissed its own appeal defending UDAAP as a reach beyond ECOA. Now it’s maybe going to try to use UDAAP to investigate instances of debanking? The OCC was right to highlight the concern about the politicization of the supervisory process and the risks that such actions may lead to a whipsawing effect for the industry, as control of government shifts from one party to the other. They should have mentioned that concern to the CFPB. Sponsored by Brico Christina Luk, Brico's VP of Compliance and Operations, is hosting an informal AMA at Money20/20 to answer all your licensing and compliance questions. 2 READING RECOMMENDATIONS#1: Who's responsible when the AI agent is wrong? (by Alex McLeod, Weights and Measures) 📚A timely topic! (This is literally the number one thing folks at Money20/20 seem to be discussing/debating.) #2: Can You Prove That? (by Jenn Day, Readable Money) 📚I loved the way Jenn summarized her argument in this piece:
Read the whole piece. Bonus: A Digital Wallet For Agents (by me, with Method Financial) 📚Your digital wallet knows which cards you have. But does it know which one to use? AI agents need to understand rewards, available credit, and permissions before they can choose on our behalf. I wrote about what it takes to build a wallet that gives agents that context. 1 QUESTION FROM FINITYThere are a TON of interesting questions being asked in Finity (our digital community for fintech and banking nerds). I’ll share one question, sourced from the community, each week. However, if you’d like to join the conversation, please apply to join! If you were to rank the federal prudential bank regulatory agencies by how sophisticated their average bank examiner is, when it comes to fintech, how would you rank them?If you have any thoughts on this question, reply to this email or DM me in Finity! Thanks for the read! Let me know what you thought by replying back to this email. — Alex Footnotes 1.Disclosure: My company (Workweek) is a small investor in Knot. | ||||||||
|
