Pagaya

Without the model there is no business, and the company's own conduct confirms it. The entire proposition to a lending partner is that a model can find creditworthy borrowers inside the population that lender's own model just declined. Strip the model and there is no reason for a partner to route rejected applications anywhere, no basis on which institutional investors would buy the resulting paper, and no network.

The chief financial officer says so directly, describing technology integrated into partners' loan origination systems that underwrites loans on their behalf before placing them with investors. The volume figure is model throughput rather than transaction volume, at more than $3.6 trillion in applications assessed since inception. Two further signals point the same way.

Revenue is earned as fees for the use of the technology, with management attributing roughly 80 percent of fees to the lending partner side rather than to capital markets activity. And the company is litigating in United States courts to protect its underwriting model from a former partner, which is a company treating the model as the asset the business rests on.

Automated credit decisioning at scale, with accountability and decision making deliberately placed in different hands. The products describe the arrangement clearly. One evaluates applications concurrently with the bank in real time, another routes defined segments directly to the network, and in both the model decides whether a declined applicant is approved.

The lender then originates the loan, keeps the customer relationship, and carries the origination and servicing compliance obligations for a decision its own systems did not make. That separation is the design rather than a flaw in it, and it is what makes the offer attractive. But it means the party answerable to a regulator is not the party that decided.

Nothing published describes what human review a partner performs or is expected to perform, what a lender may override, what confidence threshold governs an automated approval, or what decisions the company will not automate. Published industry commentary raises exactly this point, noting that partners keep compliance obligations without visible means of assuring themselves about the decisioning behind them.

No model documentation is published, and an outside discipline partly makes up for it. The published performance claim, an average 30 percent uplift in customer conversion for partners, carries no method, sample, observation period or definition of the baseline. No accuracy measure, loss rate, validation method, drift disclosure or model documentation is published either. The securitization channel is what changes the picture.

More than $27 billion has been raised across over 85 transactions on top rated shelves. Rating agencies have modeled the credit performance of this underwriting repeatedly, institutional investors have underwritten it with their own analytics, and actual loss experience is disclosed to those investors through offering documents and ongoing servicer reporting.

That is sustained third party scrutiny of model output by parties with money at risk, a stronger test than a typical published accuracy figure. It is not model transparency, though. None of it is public, and a lending partner cannot obtain it to satisfy its own model risk function.

Both sides of a two sided network evidenced by name, with the numbers filed under securities law rather than asserted in marketing. On the lending side, more than 31 partners are named across institution types: a large national bank, digital consumer lenders, established personal loan originators, several auto finance companies and a buy now pay later provider, with the company stating it is in discussions with many of the largest United States banks.

On the capital side, roughly 155 institutional investors span alternative asset managers, insurers and sovereign funds. Throughput and financial performance are reported quarterly: more than $3.6 trillion in applications processed and over $28 billion of lending generated since inception, more than $27 billion raised across over 85 securitisations, 2025 revenue of $1.3 billion up 26 percent, and a record quarter in 2026 with network volume of $3.5 billion up 33 percent and adjusted earnings up 43 percent.

Two named partners provide attributed testimonials. The reservation is that the published outcome claim, an average 30 percent uplift in customer conversion, carries no methodology, sample or baseline definition.

A described compliance program rather than a claimed one, and nothing at all on the models inside it. The company publishes that its compliance management program includes governance, documented policies and procedures, regular employee training, monitoring and testing, and a stated culture of compliance. Naming monitoring and testing matters, because those are the activities that would catch a model behaving badly. What is missing is any output from them.

There is no published model card, evaluation method, red team result, incident disclosure or acceptable use boundary, and no testing result of any kind. Others have noticed the gap. Published industry commentary questions how lending partners satisfy themselves that fully automated decisioning meets their own origination compliance requirements. That is a fair question nothing published answers, and it is asked about a company whose partners carry the regulatory obligation for decisions they did not make.

One relevant control is named precisely, and the structural question is left entirely unaddressed. The named control is permissible purpose, listed in the compliance program alongside the Fair Credit Reporting Act. Permissible purpose is the statutory gate on when a consumer report may lawfully be pulled, so naming it shows the company understands the specific data governance duty attached to what it does.

Beyond that, no privacy program description, data processing disclosure, retention schedule or subprocessor list is published, and the Gramm Leach Bliley Act appears nowhere. The structural question matters more than the missing documents. The chief financial officer states plainly that the company has no direct exposure to or interface with the consumer.

The person whose credit application is being underwritten has no relationship with the company assessing them, and in most cases no knowledge that it exists. Nothing published describes what that consumer is told, what data about them Pagaya rather than the lender retains, or how they would reach the company at all.

A compliance page that covers regulation thoroughly and information security barely. No trust center, named certification, attestation report, penetration test summary or subprocessor list is public. The compliance material names data security as one of the standards the company aligns with, in a list alongside fair lending and risk management, with no credential, framework name or evidence attached. The controls almost certainly exist and have been examined.

A company receiving consumer credit application data from a large national bank and more than thirty other regulated lenders will have passed each of their third party risk assessments, and a Nasdaq registrant carries internal control obligations. None of it can be confirmed in public. The contrast inside the company's own material is telling. It describes its regulatory compliance program in specific terms, naming statutes and doctrines, and chooses not to describe its security posture at the same level.

No license of its own, and precise engagement with the regimes that actually govern this structure. The published compliance program names the Equal Credit Opportunity Act and its implementing regulation, the Fair Credit Reporting Act, and prohibitions on unfair, deceptive or abusive acts and practices. It then goes further and names three doctrines: permissible purpose, true lender and true sale. True lender and true sale are the notable part.

Those doctrines decide whether a partnership in which a bank originates and a third party's capital funds can survive legal challenge, and raising them shows the legal architecture has been examined rather than assumed. The company states it operates with banks supervised by the three federal banking agencies and, as a Nasdaq registrant, carries securities reporting obligations.

Three things are not published: any supervisory examination outcome, any regulatory action or enforcement history, and any position on the European artificial intelligence regulation, which outside analysts have flagged as a long term consideration for highly automated underwriting.

The fairness exposure is direct, and it is addressed by naming the obligation, never by publishing a result. An automated model decides whether individual consumers receive credit, across 31 lenders and more than $3.6 trillion of applications. The population it assesses is people a mainstream lender has already declined, a group that skews thinner file, younger, lower income and disproportionately minority.

Equal credit law reaches disparate effects rather than intentions and requires specific adverse action reasons, so fairness testing and explainability are legal requirements here, not good practice. The company names fair lending in its compliance program and describes monitoring and testing as components. What is not published is any output. There is no disparate impact analysis, fair lending testing result, model card or explainability documentation. Nothing describes how adverse action reasons are generated from an automated model, or what alternative data enters the decision.

The legal structure has clearly been thought through, and how risk is split when the model is wrong remains unpublished. The thinking shows in the compliance program's naming of true lender and true sale. Those doctrines exist to settle who is legally the lender and whether a transfer of the asset is genuine, the questions on which this structure's liability turns. Against that, there are no public terms of service, and no warranty, indemnity, liability cap or service level.

Two exposures sit uncovered, and both are unusual. The lending partner originates, services and carries the origination compliance obligation for a credit decision made by a model it does not own or fully see, and nothing published says what it is owed if that decision proves discriminatory or defective.

And the declined consumer, who has no relationship with the company and generally does not know it exists, has no described route to it at all, while the adverse action notice they receive comes from the lender.

Provenance is established beyond doubt, and composition is not. The underwriting models are the company's own work, and that is demonstrated rather than merely claimed. It is pursuing a claim in United States courts alleging a former partner misappropriated its subprime underwriting model, a step no company takes over technology it licensed from someone else. A buyer therefore knows the decisioning is built in house rather than a resold engine. Everything below that is undisclosed.

Nothing published describes what data feeds the models beyond the partner's own application, whether alternative or bureau data is purchased and from whom, what technique or architecture is used, or whether any third party model takes part. The company's central claim is finding creditworthy borrowers that a bureau based model missed. The additional data doing that work is the substance of the claim, and it is not described.

Integration reaches into the live credit decision itself, about as deep as integration goes. The chief financial officer describes technology embedded in partners' loan origination systems, and the products describe two ways of embedding. One evaluates applications concurrently with the bank, in real time, as the decision is being made. The other takes defined applicant segments directly.

Running alongside a bank's own underwriting in real time, inside its origination flow, is materially harder than delivering a score to an interface. It has been done across more than 31 partners spanning national banking, digital lending, auto finance and point of sale, each with a different origination stack.

The surface extends beyond decisioning into partner acquisition, with published engines for affiliate channel optimization, direct marketing, prescreening and accelerated processing, so a partner can adopt the network at several points in its funnel. Named partner testimonials praise integration smoothness and flexibility. No public interface documentation or developer surface is published, which fits an enterprise partnership model rather than signaling a gap.

Not addressed on the public surface. Nothing published states where processing occurs, which regions store consumer application data, what the tenancy arrangement is, or whether any residency commitment is available to partners. The question is not academic for this business. Consumer credit application data from more than 31 United States lending institutions flows into the company's models.

The company is Israeli founded and Israeli incorporated, listed in the United States, with operations across both, so cross border processing is a reasonable inference that nothing published confirms or bounds. A lending partner's own third party risk function would need that answer before onboarding and would get it privately, but nothing can be found from outside. No self hosted, customer tenancy or in perimeter deployment option is described. That is expected, since the model runs as a network service rather than as software delivered to the partner, though without any statement a buyer cannot confirm even that.

There is no rate card, but the commercial disclosure is highly usable, because the reported metrics are the product's own unit economics rather than segment revenue. As a listed company, Pagaya reports network volume, total revenue, revenue per application, partner counts and the split of fees between the two sides of the network. Management also discusses take rate directly, including periods where it earns less per dollar flowing through the system while total profit rises.

A prospective lending partner can therefore work out the aggregate economics of the arrangement with real precision before entering a negotiation, instead of starting from a contact sales page. What is still missing is the individual deal. There is no published fee schedule, no stated basis per partner, and no sign of how terms differ between a large bank and a small fintech or between asset classes. Arrangements are evidently bespoke, and the aggregate take rate a reader can compute is an average across 31 partners, not a quote.

Coverage runs along two dimensions, and both are named. Lending partners span a large national bank, digital consumer lenders, established personal loan originators, multiple auto finance companies including subprime specialists, and a buy now pay later provider. The company states it operates alongside banks supervised by the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation.

Three asset classes are live, covering personal loans, auto and point of sale, with credit cards and single family rental explored. On the capital side, the investor base of roughly 155 institutions spans alternative asset managers, insurers and sovereign wealth funds. The consumer population is defined rather than gestured at: those declined under a partner's existing criteria. The company cites roughly 42 percent of United States consumers as underserved by traditional scoring. Geographic reach is essentially domestic.