Pagaya

Nothing survives the removal test here, and the company's own conduct confirms it. The entire proposition to a lending partner is that a model can find creditworthy borrowers inside the population that lender's own model just declined. Strip the model and there is no reason for a partner to route rejected applications anywhere, no basis on which institutional investors would buy the resulting paper, and no network.

The chief financial officer states it directly, describing technology integrated into partners' loan origination systems that underwrites loans on their behalf before placing them with investors. The volume figure is model throughput rather than transaction volume, at more than 3.6 trillion dollars in applications assessed since inception. Two further signals point the same way.

Revenue is earned as fees for the use of the technology, with management attributing roughly 80 percent of fees to the lending partner side rather than to capital markets activity. And the company is litigating in United States courts to protect its underwriting model from a former partner, which is a company treating the model as the asset the business rests on.

Automated credit decisioning at scale, with accountability and decision making deliberately located in different places. The products describe the arrangement clearly: one evaluates applications concurrently with the bank in real time, another routes defined segments directly to the network, and in both cases the model decides whether a declined applicant is approved.

The lender then originates the loan, keeps the customer relationship and carries the origination and servicing compliance obligations for a decision its own systems did not make. That separation is the design rather than a flaw in it, and it is what makes the offer attractive, but it means the party answerable to a regulator is not the party that decided.

Across two passes nothing published describes what human review a partner performs or is expected to perform, what a lender may override, what confidence threshold governs an automated approval, or what decisions the company will not automate. Published industry commentary raises precisely this point, noting that partners retain compliance obligations without visible means of assuring themselves about the decisioning behind them.

No model documentation is published, and an unusual external discipline partly compensates in a way worth recording. The published performance claim, an average 30 percent uplift in customer conversion for partners, carries no methodology, sample, observation period or definition of the baseline, and across two passes no accuracy measure, loss rate, validation methodology, drift disclosure or model documentation was located.

What differs from most vendors here is the securitisation channel. More than 27 billion dollars has been raised across over 85 transactions on top rated shelves, which means rating agencies have modelled the credit performance of this underwriting repeatedly, institutional investors have underwritten it with their own analytics, and actual loss experience is disclosed to those investors through offering documents and ongoing servicer reporting.

That is sustained third party scrutiny of model output by parties with money at risk, and it is a stronger test than most published accuracy figures. It is not, however, model transparency: none of it is public, and a lending partner cannot obtain it to satisfy its own model risk function.

Both sides of a two sided network evidenced by name, with the numbers filed under securities law rather than asserted in marketing. On the lending side, more than 31 partners are named across institution types: a large national bank, digital consumer lenders, established personal loan originators, several auto finance companies and a buy now pay later provider, with the company stating it is in discussions with many of the largest United States banks.

On the capital side, roughly 155 institutional investors span alternative asset managers, insurers and sovereign funds. Throughput and financial performance are reported quarterly: more than 3.6 trillion dollars in applications processed and over 28 billion dollars of lending generated since inception, more than 27 billion dollars raised across over 85 securitisations, 2025 revenue of 1.3 billion dollars up 26 percent, and a record quarter in 2026 with network volume of 3.5 billion dollars up 33 percent and adjusted earnings up 43 percent.

Two named partners provide attributed testimonials. The reservation is that the published outcome claim, an average 30 percent uplift in customer conversion, carries no methodology, sample or baseline definition.

A described compliance programme rather than a claimed one, which is worth crediting, and nothing at all on the models inside it. The company publishes that its compliance management programme includes governance, documented policies and procedures, regular employee training, monitoring and testing, and a stated culture of compliance.

Naming monitoring and testing as components matters because those are the activities that would detect a model behaving badly, and most vendors here do not describe them. What is absent is any output from them. Across two passes no model card, evaluation methodology, red team result, incident disclosure or acceptable use boundary was located, and no testing result of any kind is published.

The gap has been noticed outside this index: published industry commentary questions how lending partners satisfy themselves that fully automated decisioning conforms to their own origination compliance requirements, which is a fair question that the public record does not answer, and it is asked about a company whose partners carry the regulatory obligation for decisions they did not make.

One relevant control named precisely, and the structural question left entirely unaddressed. The named control is permissible purpose, which the compliance programme lists alongside the Fair Credit Reporting Act, and permissible purpose is the statutory gate governing when a consumer report may lawfully be pulled, so naming it indicates the company understands the specific data governance duty attaching to what it does.

Beyond that, across two passes no privacy programme description, data processing disclosure, retention schedule or subprocessor list was located, and the Gramm Leach Bliley Act appears nowhere. The structural question is more interesting than the missing documents.

The chief financial officer states plainly that the company has no direct exposure to or interface with the consumer, which means the person whose credit application is being underwritten has no relationship with the company assessing them and in most cases no knowledge that it exists. Nothing published describes what that consumer is told, what data about them is retained by Pagaya rather than the lender, or how they would reach the company at all.

A compliance page that addresses regulation thoroughly and information security barely. Across two passes no trust centre, named certification, attestation report, penetration test summary or subprocessor list was located on any public surface. The compliance material names data security as one of the standards the company aligns with, in a list alongside fair lending and risk management, without any accompanying credential, framework name or evidence.

The controls almost certainly exist and have been examined: a company receiving consumer credit application data from a large national bank and more than thirty other regulated lenders will have passed each of their third party risk assessments, and a Nasdaq registrant carries internal control obligations. None of it is publicly establishable.

The contrast within the company's own material is instructive, since it can describe its regulatory compliance programme in specific terms naming statutes and doctrines, and chooses not to describe its security posture at the same level.

No licence of its own, and unusually precise engagement with the regimes that actually govern this structure. The published compliance programme names the Equal Credit Opportunity Act and its implementing regulation, the Fair Credit Reporting Act, prohibitions on unfair, deceptive or abusive acts and practices, and then three doctrines most vendors would not raise in public: permissible purpose, true lender and true sale.

Naming true lender and true sale is the notable part, because those are the doctrines that determine whether a partnership in which a bank originates and a third party's capital funds survives legal challenge, and raising them indicates the legal architecture has been examined rather than assumed. The company states it operates with banks supervised by the three federal banking agencies and, as a Nasdaq registrant, carries securities reporting obligations.

Absent across two passes: any published supervisory examination outcome, any regulatory action or enforcement history, and any position on the European artificial intelligence regulation, which external analysts have flagged as a long term consideration for highly automated underwriting.

The most directly consequential fairness exposure in this index, addressed by naming the obligation and never by publishing a result. An automated model determines whether individual consumers receive credit, across 31 lenders and more than 3.6 trillion dollars of applications, and the specific population it assesses is people a mainstream lender has already declined, a group that skews thinner file, younger, lower income and disproportionately minority.

Equal credit law reaches disparate effects rather than intentions and requires specific adverse action reasons, so both fairness testing and explainability are legal requirements rather than good practice here. The company names fair lending in its compliance programme and describes monitoring and testing as components, which is why this sits at the top of the grade rather than lower.

What is not published is any output: no disparate impact analysis, no fair lending testing result, no model card, no explainability documentation, no description of how adverse action reasons are generated from an automated model, and no account of what alternative data enters the decision.

The legal structure has evidently been thought about carefully, and how risk is allocated when the model is wrong remains unpublished. The thinking shows in the compliance programme's naming of true lender and true sale, doctrines that exist precisely to determine who is legally the lender and whether a transfer of the asset is genuine, which are the questions on which this structure's liability turns.

Against that, across two passes no terms of service, warranty, indemnity, liability cap or service level was located. Two exposures sit uncovered and both are unusual. The lending partner originates, services and carries the origination compliance obligation for a credit decision made by a model it does not own or fully see, and nothing published describes what it is owed if that decision proves discriminatory or defective.

And the declined consumer, who has no relationship with the company and generally does not know it exists, has no described route to it at all, while the adverse action notice they receive comes from the lender.

Provenance is established unambiguously and composition is not. That the underwriting models are the company's own proprietary work is not merely claimed but demonstrated, since it is pursuing a claim in United States courts alleging a former partner misappropriated its subprime underwriting model, a step no company takes over technology it licensed from someone else.

A buyer therefore knows the decisioning is in house rather than a resold engine, which is the primary question this axis asks and which several larger vendors in this index leave unanswered. Everything below that is undisclosed.

Across two passes no description was located of what data feeds the models beyond the partner's own application, whether alternative or bureau data sources are purchased and from whom, what technique or architecture is used, or whether any third party model participates. For a company whose central claim is finding creditworthy borrowers that a bureau based model missed, the additional data doing that work is the substance of the claim and it is not described.

Integration into the live credit decision itself, which is as deep as this axis goes. The chief financial officer describes technology embedded in partners' loan origination systems, and the products describe two distinct modes of embedding: one evaluating applications concurrently with the bank in real time as the decision is being made, and another taking defined applicant segments directly.

Running alongside a bank's own underwriting in real time, inside its origination flow, is a materially harder integration than delivering a score to an interface, and it has been achieved across more than 31 partners spanning national banking, digital lending, auto finance and point of sale, each with different origination stacks.

The surface extends beyond decisioning into partner acquisition, with published engines for affiliate channel optimisation, direct marketing, prescreening and accelerated processing, so a partner can adopt the network at several points in its funnel. Named partner testimonials specifically praise integration smoothness and flexibility. Across two passes no public interface documentation or developer surface was located, which is consistent with an enterprise partnership model rather than a gap.

Not addressed on the public surface. Across two passes nothing published states where processing occurs, which regions store consumer application data, what the tenancy arrangement is, or whether any residency commitment is available to partners. The question is not academic for this business.

Consumer credit application data from more than 31 United States lending institutions flows into the company's models, and the company is an Israeli founded and Israeli incorporated business listed in the United States with operations across both, so cross border processing is a reasonable inference that the public record neither confirms nor bounds.

A lending partner's own third party risk function would need that answer before onboarding, and would obtain it privately, but nothing is discoverable from outside. No self hosted, customer tenancy or in perimeter deployment option is described, which is expected given that the model runs as a network service rather than as software delivered to the partner, though the absence of any statement means a buyer cannot confirm even that.

No rate card, and more usable commercial disclosure than any private vendor in this index can offer, because the reported metrics are the product's own unit economics rather than segment revenue. As a listed company Pagaya reports network volume, total revenue, revenue per application, partner counts and the split of fees between the two sides of the network, and management discusses take rate dynamics directly, including periods where it earns less per dollar flowing through the system while total profit rises.

A prospective lending partner can therefore derive the aggregate economics of the arrangement with real precision before entering a negotiation, which is a materially different position from a private vendor's contact sales page. What is still absent is the individual deal: no published fee schedule, no stated basis per partner, and no indication of how terms differ between a large bank and a small fintech or between asset classes. Arrangements are evidently bespoke, and the aggregate take rate a reader can compute is an average across 31 partners rather than a quote.

Coverage on two dimensions that rarely appear together, and named on both. Lending partners span a large national bank, digital consumer lenders, established personal loan originators, multiple auto finance companies including subprime specialists, and a buy now pay later provider, with the company stating it operates alongside banks supervised by the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation.

Three asset classes are live, covering personal loans, auto and point of sale, with credit cards and single family rental explored. On the capital side the investor base of roughly 155 institutions spans alternative asset managers, insurers and sovereign wealth funds, which is coverage of a segment most vendors in this index never touch.

The consumer population addressed is defined rather than gestured at, being those declined under a partner's existing criteria, and the company cites roughly 42 percent of United States consumers as underserved by traditional scoring. Geographic reach is essentially domestic.