From Limited Credit Data to Tiered BNPL Decisions

Southeast Asia’s BNPL market is growing inside a fragmented credit environment. A prospective borrower may have a valid identity and active mobile number but relatively little conventional credit history. At the same time, digital lenders must contend with identity rental, account farming, synthetic profiles, device reuse and increasingly accessible face-manipulation tools.

The problem is therefore larger than confirming that a document looks valid. BNPL providers need to determine whether an application represents a genuine individual, whether the submitted evidence is trustworthy and whether the observed risk signals justify approval, additional verification or rejection.

This deployment-derived composite case shows how a regional BNPL technology vendor and systems integrator could combine its lending workflow with Finlaris identity and visual-risk capabilities.

This composite case draws on anonymized technical patterns from Finlaris deployment experience. The partner profile, geography, commercial model, volumes and decision thresholds have been generalized or altered and do not describe a specific Finlaris partner.

When thin-file lending meets industrialized fraud

Short-term digital credit can improve access to financing, but the OECD also notes that BNPL products can create consumer risks, including over-indebtedness. That makes responsible customer assessment and risk-based decisioning increasingly important. OECD

The regional fraud environment is also changing. A 2025 ASEAN consumer study found that the average share of surveyed consumers reporting that they had experienced a scam increased from 31% to 43%. GSMA

For BNPL operators, the practical challenges can include:

  • Limited conventional credit-bureau coverage
  • Fragmented alternative data
  • Borrowed or traded identity information
  • Mobile numbers registered or controlled by another party
  • Repeated applications across related devices
  • Face replay, injection and manipulation attacks
  • Limited confirmed bad-debt samples for modelling
  • Pressure to approve genuine customers without lengthy manual review

A regional BNPL vendor serving lenders and merchant-finance platforms identified an opportunity to address these problems through a reusable pre-loan risk layer.

The partner profile

The partner provides BNPL infrastructure and implementation services across several Southeast Asian markets.

Its platform already manages:

  • Customer application capture
  • Instalment-plan configuration
  • Merchant and lender integration
  • Credit-policy orchestration
  • Repayment schedules
  • Application status management
  • Manual-review queues
  • Local implementation and support

However, identity controls varied by customer. Some lenders relied mainly on document images and basic identity-database queries. Others used separate vendors for OCR, face comparison, device intelligence and blacklist checks.

This made it difficult for the partner to offer one consistent pre-loan risk framework.

Designing a layered pre-loan funnel

Rather than treating KYC as one pass-or-fail API call, the partner and Finlaris designed the proposed solution around a sequence of controls.

  1. Application capture

The applicant provides basic identity, contact and credit-application information and completes the required consent process.

At this stage, the system also establishes identifiers that can later be associated with device, document, mobile-number and application-history signals.

  1. Real-person verification

The identity layer combines:

  • ID-document capture
  • OCR and structured field extraction
  • Identity-number consistency checks
  • Selfie-to-document face comparison
  • Passive or active liveness detection
  • Mobile-number verification where available

The objective is not simply to confirm that every field is present. It is to determine whether the identity evidence, facial evidence and application data are mutually consistent.

  1. Capture-quality and presentation-risk controls

Images are evaluated before being accepted into the wider decision process.

Relevant checks can include:

  • Blur and insufficient resolution
  • Overexposure or uneven illumination
  • Screen recapture
  • Printed-photo presentation
  • Abnormal document boundaries
  • Background irregularities
  • Image tampering indicators
  • Potential injection or deepfake characteristics

Separating capture quality from identity matching is important. A low-quality image may require recapture, while a high-quality but manipulated image represents a different risk condition.

  1. Cross-application risk detection

The partner’s workflow can combine Finlaris outputs with additional controls such as:

  • Blacklist matching
  • Device fingerprint correlation
  • Repeated identity or mobile-number use
  • Face 1:N search against prior applications
  • Duplicate-account detection
  • Application-velocity rules
  • Existing credit-exposure or multi-borrowing indicators

A 1:N face search serves a different purpose from 1:1 verification. The 1:1 check asks whether the applicant matches the submitted identity document. A 1:N search asks whether the same face may already exist elsewhere in the application population under another identity or account.

  1. Risk scoring and decision routing

The collected signals are converted into features that can support the partner’s existing credit-risk model or a separate visual-risk score.

Instead of allowing one biometric result to make a credit decision, the architecture uses identity and visual-risk signals as supplementary information within a broader decision framework.

Defining the modelling target

To evaluate whether the additional risk signals contributed useful separation, the implementation used an early-delinquency outcome as the bad-sample definition.

For example, a loan reaching roughly ten or more days past due within the defined observation window could be labelled as a bad outcome. The precise delinquency threshold and observation period would remain configurable by the lender.

This creates a target variable against which the risk features can be tested.

Two common validation measures are:

  • AUC, which evaluates the model’s ability to rank good and bad outcomes across thresholds
  • KS, which measures the maximum separation between the cumulative distributions of good and bad samples

In an anonymized early-stage validation, the standalone visual-risk component produced an AUC in the mid-to-high 0.5 range and a KS of approximately 0.1.

Those figures do not justify using the component as a standalone credit model. They indicate modest but measurable separation—precisely the kind of independent information that can be valuable when added to a stronger primary model.

Two ways to use the risk output

The partner could operationalize the output in two ways.

As model features

Identity consistency, image quality, face-risk and cross-application signals can enter the partner’s main pre-loan model as additional features.

The relevant question is not whether the visual component outperforms the entire credit model. It is whether it contributes incremental predictive information that is not already captured by financial, behavioral or device data.

As pre-decision rules

Higher-risk tails can also be routed through rules before the main approval decision.

Depending on the lender’s risk appetite, a simplified tiering structure could look like this:

The actual score ranges should be calibrated for each customer. Publishing universal thresholds would be inappropriate because population quality, product terms, fraud patterns and approval policies differ between lenders.

Operational evidence from the composite deployment

The technical pattern behind this scenario produced several practical findings:

  • Visual-risk signals provided incremental separation rather than replacing the primary credit model.
  • Image-quality checks reduced invalid inputs reaching downstream verification.
  • Face 1:N search helped identify potential repeat applicants across different account details.
  • High-risk applications could be intercepted earlier in the funnel.
  • Manual reviewers could focus on ambiguous middle-risk cases instead of examining every application.
  • Lower-risk applicants could continue through a more automated path.
  • Risk thresholds required recalibration as the applicant population and fraud patterns changed.

These are operational findings, not a guarantee of a specific approval-rate or delinquency improvement.

How the partner model works

The BNPL vendor would own:

  • Credit and application workflow
  • Customer configuration
  • Device and application-history signals
  • Decision orchestration
  • Customer implementation
  • Manual-review design
  • First-line operational support

Finlaris would provide:

  • Document OCR
  • Face comparison
  • Liveness detection
  • Deepfake and presentation-attack detection
  • Image-quality and document-risk signals
  • Face 1:N search
  • API and SDK integration support
  • Test-data analysis and threshold consultation
  • Product-level troubleshooting

The lender would retain responsibility for its credit policy, risk appetite, regulatory obligations and final approval decisions.

Value for an ASEAN BNPL partner

For the partner, the commercial value comes from offering more than a transaction engine.

The combined proposition can support:

  • Broader pre-loan risk projects
  • Higher-value implementation work
  • Reusable identity and fraud modules
  • Stronger differentiation in lender proposals
  • Additional revenue from verification usage and services
  • Continued optimization after launch
  • Expansion into digital lending, wallets and merchant finance

Most importantly, the partner can bring specialist identity and visual-risk capabilities into its platform without building biometric models and document-analysis infrastructure internally.

Build a stronger BNPL risk stack with Finlaris

Finlaris works with BNPL vendors, lending-platform providers and systems integrators that want to add identity verification, document intelligence and visual-risk signals to their existing decision workflows.

The objective is not to replace the partner’s lending expertise. It is to add another layer of evidence to the systems the partner already provides.

Talk to Finlaris about developing an identity and pre-loan risk solution for your market.