Credit Scoring is the use of a statistical model to estimate how likely a borrower is to repay, compressed into a number that lenders use to approve, decline and price credit. Models are trained on past borrowers with known outcomes, traditionally with logistic regression and increasingly with gradient-boosted trees. A score ranks risk rather than stating it: each band maps to an observed default rate, which lenders convert into a probability of default for risk-based pricing and capital. Thin-file applicants are scored better with alternative data such as open banking transactions. In the EU, AI systems that score natural persons are high-risk under the AI Act, and buyers of lenders compare predicted with actual defaults.
How is a credit score calculated
A scoring model is trained on past borrowers whose outcomes are known. The developer takes accounts opened in a past period, labels those that went seriously delinquent within a set window, and fits a model, traditionally logistic regression and increasingly gradient-boosted trees, that predicts the label from data available at application. The output is scaled into points.
The best-known example is the US FICO score, which usually runs from 300 to 850. FICO weights five categories: payment history 35%, amounts owed 30%, length of credit history 15%, new credit 10% and credit mix 10%. Lenders also build their own application scorecards for new customers and behavioural scorecards that rescore existing customers monthly from account activity.
Credit scoring example
Illustrative example: a lender's scorecard shows that borrowers in the 700–749 band default at 2% within 12 months, and those in the 600–649 band at 8%. With a €10,000 loan and a 60% loss given default, expected loss is €120 for the first band and €480 for the second. The price of each loan must cover that loss plus funding and operating costs, which is how risk-based pricing works. The lender sets its approval cut-off at the band where the achievable margin no longer covers expected loss.
Alternative data and thin-file borrowers
Applicants with little credit history, such as recent migrants, young adults and new small businesses, score poorly on bureau data alone. Lenders add alternative data: bank transaction history shared through open banking with the customer's consent, rent and utility payments, payroll data, or for merchants, sales history from their payment provider. Transaction data shows income stability and spending commitments directly, which often matters more than a missing credit history.
How is credit scoring regulated
In the EU, AI systems used to evaluate the creditworthiness of natural persons or to establish their credit score are classed as high-risk under Annex III of the AI Act. After the Digital Omnibus on AI was published in the Official Journal on 24 July 2026, obligations for Annex III systems apply from 2 December 2027. Lenders using such models must then run a risk management system, meet data governance and documentation requirements and provide human oversight. GDPR Article 22 separately gives individuals the right not to be subject to a decision based solely on automated processing that significantly affects them, which covers fully automated loan refusals.
Credit scoring in lender acquisitions
For a buyer of a lending business, the scoring model is a core asset. Diligence compares predicted against actual default rates by loan vintage, checks whether model accuracy has drifted, confirms the rights to bureau and alternative data survive a change of ownership, and assesses how much work the model needs before the AI Act deadline.