Nova Credit

A data and infrastructure business with analytics layered over it, and the company says so in its own description of itself as a credit infrastructure and analytics company. The asset a competitor cannot replicate by modelling better is access: bureau relationships in more than a dozen countries, aggregator coverage exceeding 90 percent of United States banks, payroll and document sources, and consumer reporting agency status permitting all of it to be used in a regulated credit decision.

Building that took years and licences rather than training runs. The learned layer is real, since raw foreign credit files and bank transaction streams are useless to an underwriter until they are categorised and turned into risk predictive attributes and scores, and that transformation is where the analytics sit.

But strip the models and a data business survives intact, still translating foreign credit reports into a readable format and still delivering permissioned transaction and payroll data through one integration. The company's own framing of its edge is combining cross border coverage, cash flow analytics and regulatory grade compliance in one place, which lists modelling as one of three.

The division of responsibility is published in plain terms and it is the right one. The company states that its clients approve, decline and send adverse action notices while it manages disputes, which places the credit decision squarely with the lender and the data accuracy obligation squarely with the data provider.

That is a cleaner allocation than most of this index manages, and it matters because it means no automated decision is taken by this vendor at all: it supplies attributes and scores into a decision engine the lender controls. The dispute function is the counterweight, giving the consumer a route back to the party that supplied the data rather than only to the lender who acted on it. What is not published is any boundary on use.

Nothing states what a lender should not do with these attributes alone, what minimum human review the company expects before an adverse decision rests on cash flow derived signals, or whether it declines any use case, which is a live question when the same attributes are sold into tenant screening as into lending.

One excellent outcome figure and no methodology behind anything. The figure is genuinely strong because of who published it: a major card issuer reported that accounts approved through this company's cross border data were 79 percent less likely to become delinquent, which is a customer disclosing performance on its own book rather than a vendor characterising its product.

The aggregate claim of more than 10 billion dollars in credit unlocked is a volume measure rather than a performance one. What is absent is everything a lender's model risk function would need to put these attributes into a regulated credit process: no attribute level performance disclosure, no validation methodology, no sample or observation period, no population stability or drift reporting, no documentation of how transaction categorisation errors propagate into scores, and no accuracy measure for the categorisation itself. That last gap is specific to this method, since a miscategorised deposit becomes a wrong income figure, which becomes a wrong debt to income ratio, which becomes a declined application.

Adoption at the top of United States consumer credit, named on both sides, with a risk outcome published by the customer rather than the vendor. The president of a major card issuer's branded cards business is quoted by name on selecting both the cash flow and cross border products, stating the intention to better assess credit risk and approve customers with right sized lines. A global payments platform deployed the cash flow product across its consumer credit portfolio.

Further named clients span a global card network, two international banks, a digital lender and two property management platforms, within a stated base of more than 5,000 businesses. The strongest single item is third party attributed and quantified: a major card issuer reported that accounts approved through this company's cross border data were 79 percent less likely to become delinquent, which is a risk performance figure published about a lender's own book rather than a vendor claim about its product. Aggregate impact is stated at well over 10 billion dollars in credit unlocked. A Series D round of 35 million dollars was raised in 2025.

Stewardship carried by statutory duty rather than by voluntary policy, which is the stronger form. As a regulated consumer reporting agency the company owes accuracy obligations it can be held to, and it operates dispute handling as a staffed function rather than a form, meaning a person who believes the data about them is wrong reaches the party that holds it.

A dedicated information security team is described, working to an information security policy built on a recognised international standard. Permissioning limits collection at source. Two gaps and one tension. Across two passes no model card, evaluation methodology, red team result or incident disclosure was located for the attributes and scores the company derives.

The tension is in its own privacy policy, which reserves the right to develop new insights based on data collected about the individual and to use collected data for marketing, both of which describe secondary use of information a person permissioned for a specific credit application, and neither is bounded publicly.

Consumer permissioning as architecture rather than as a policy statement, backed by statutory obligations and a working consumer channel. Nothing here is collected without the person choosing to share it, which inverts the default in a category built largely on data about people gathered without their involvement.

Consumer reporting agency status under the Fair Credit Reporting Act then attaches accuracy duties, permissible purpose limits and dispute rights enforceable by regulators and by the consumer directly. The company handles disputes itself rather than routing them to the lender, and publishes a disputes page detailing the process, including the statutory provision allowing a survivor of human trafficking to have adverse information blocked, with physical addresses and required documentation set out.

Publishing the machinery of a right most agencies bury is meaningful. One tension belongs on the record rather than in the grade: the privacy policy also describes using collected data for marketing and advertising and for developing new insights about the individual, which sits uneasily beside the permissioned framing and is worth a buyer's attention.

Both credentials named in text with the correct word attached to each, which sounds like a small thing and is not. The company states that it operates under a comprehensive information security policy based on a recognised international standard, that it holds a certification against that standard, and that it holds a service organisation control attestation of the second type, and it describes a dedicated information security team responsible for administering system access.

Across the vendors graded in this sweep, almost every one described the service organisation control framework as a certification, which it is not, since that framework produces an independent auditor's report and confers no certificate. This vendor drew the distinction correctly and unprompted, which is a meaningful signal about who wrote the page and how carefully.

What holds it below the top band is obtainability: there is no trust centre, no downloadable certificate or report, no scope statement establishing whether the data processing pipeline sits inside the certified boundary, no revision year for the standard, and no penetration test summary.

Genuine regulated standing with statutory consequences, evidenced rather than asserted, and only the second such record in this index. The company states plainly that it operates as a consumer reporting agency under the Fair Credit Reporting Act.

That is not a certification bought from an auditor but a regulated status carrying accuracy obligations, permissible purpose limits, dispute investigation duties with statutory timelines, adverse action support requirements, and exposure to both federal regulators and private action by consumers.

It clears the credential test on every limb: a defined status, a named statute, and published machinery proving it operates, including a disputes process and the specific statutory route for a survivor of human trafficking to block adverse information. Two qualifications belong on the record.

The status is jurisdictional, and the company's own privacy policy says it is regulated as a consumer reporting agency in certain jurisdictions, so its United Kingdom, Canadian, Emirati and Singaporean operations do not automatically carry it. And nothing published addresses the forthcoming consumer data access rule that will reshape the permissioned data supply this business depends on.

The company built its business on a fairness argument and publishes nothing testing whether its own method is fair. The argument is genuine and well made: traditional bureau files exclude newcomers and thin file consumers for reasons unrelated to their conduct, more than 45 million Americans are credit invisible, and cross border and cash flow data can price those people accurately rather than refuse them. The unexamined half is what bank transaction data encodes.

A checking account reveals income volatility, gig and shift work, remittances sent abroad, religious giving, gambling, benefits receipt and medical spending, none of which appears in a bureau file and all of which correlates with national origin, religion, disability and family status. Attributes derived from that stream can reproduce protected characteristics without naming them, and fair lending law reaches effects rather than intentions.

Across two passes no disparate impact testing, attribute level fairness analysis, model card or explainability documentation was located, which also bears on the specific adverse action reasons a lender must give under the equal credit rules.

Statutory recourse for the person the data describes, which is rarer in this index than recourse for the paying customer. Because the company operates as a regulated consumer reporting agency, a consumer who believes information in their report is wrong has a defined right to dispute it, an obligation on the company to investigate within statutory timelines, and enforcement available through federal regulators and through private action.

The company handles that function itself rather than deferring to the lender, publishes the process, and documents specific statutory routes including blocking of adverse information for survivors of human trafficking. For a product that determines whether someone is offered credit, a working correction channel is the most meaningful form of accountability available. The business customer side is the gap.

Across two passes no published terms of service, warranty, indemnity, liability cap or service level was located, and nothing states what a lender is owed if an attribute is wrong, a foreign file is mistranslated or a transaction is miscategorised in a way that produces a bad decision.

The data supply chain is described structurally and honestly, including a dependency most competitors would rather obscure. The company states that it does not originate its raw material: foreign credit data comes through integrations with international credit bureaus in more than a dozen countries, United States checking and savings data comes through third party aggregators covering over 90 percent of banks, and further inputs come from payroll systems and document processing.

Publishing that the domestic cash flow product rests on aggregators is a genuine disclosure, because it tells a buyer that this vendor's coverage, uptime and cost are bounded by intermediaries it does not control, and the platform's intelligent routing between sources is presented as the mitigation. At least one upstream bureau has been named in company announcements.

What is missing is specificity and the model layer: individual aggregators are not named, so concentration cannot be assessed, and no technique, provider or version is disclosed for the categorisation engine or the attribute and score models built on top.

Built explicitly as a middle layer, and the integration surface reflects that on both sides. Upstream it orchestrates across international credit bureaus in more than a dozen countries, United States bank data aggregators covering over 90 percent of banks, payroll systems and automated document data, with multi source routing described as intelligent because each provider has different coverage and uptime characteristics and the platform is designed to fail over between them.

Downstream it offers three implementation paths, no code, low code and full interface, across digital and retail channels, so an institution can adopt it without an engineering programme or embed it deeply. The distribution choice is the strongest signal: rather than requiring lenders to integrate directly, the company has made its connectivity available through leading third party decisioning systems, naming platforms that are themselves independent vendors in this market, which means a lender already running one of those engines can add this data without touching its own stack. Coverage of both lending and tenant screening through the same integration widens the surface further.

A hosted data and interface service with the placement questions unaddressed, in a business whose whole premise is data crossing borders. The cross border product works by taking a person's credit file from a bureau in one country and rendering it usable by a lender in another, serving arrivals into five named markets from more than a dozen source countries, so international transfer is the product rather than an incidental consequence of it.

Across two passes nothing published states where that processing occurs, which regions store the resulting consumer reports, what transfer mechanisms are relied on for files originating in jurisdictions with export restrictions, how long a translated foreign credit file is retained, or what the tenancy arrangement is.

The domestic side raises the same question differently, since permissioned bank transaction data for United States consumers flows through aggregators to the vendor and then to lenders. No self hosted or customer controlled option is described, which is expected for a bureau model but should still be stated.

No price, unit or tier is published across two passes, and nothing indicates whether charging follows reports pulled, applicants screened, seats, data sources enabled or a platform fee, which matters here because the platform draws on several distinct upstream sources that presumably carry different costs. The published entry route is a sales contact.

One claim is published that a buyer can actually use in a business case, and it is a time claim rather than a price: the company states its consumer permissioned risk data can be implemented 9 to 12 months faster than building in house, and it names the specific work that time replaces, namely establishing international bureau partnerships, categorising data and constructing attributes from bank transaction data.

That is a comparator a lender can evaluate against its own engineering estimates. Distribution through named third party decisioning platforms provides an alternative commercial route that may carry its own pricing. Deployment paths from no code through low code to full interface suggest scope flexibility without disclosing whether it changes the commercial basis.

Coverage across institution types and across borders, both evidenced by name. Institution types run from the largest United States card issuers through global banks, digital lenders and payment platforms to property management and tenant screening operators, within a stated base of more than 5,000 businesses, which is unusual breadth for a data provider and reflects that the same underwriting question arises in renting as in lending.

Geographic coverage is the distinguishing element and is specific rather than aspirational: the cross border product serves people arriving in the United States, United Kingdom, Canada, United Arab Emirates and Singapore, drawing on bureau relationships in more than a dozen countries, and domestic aggregator coverage exceeds 90 percent of United States banks.

The consumer segments addressed are named and defined rather than gestured at, covering newcomers to a country, thin file and no file consumers, and the company cites more than 45 million credit invisible Americans as the population its products exist to reach.