Happy Monday, Fintech Takers!

Well, we’re off and away. Money20/20 is in full swing and it’s the last year at the Venetian, so let’s leave all out there on the long carpeted hallways.

Yesterday’s 3x3 basketball tournament was, as always, fantastic. Thank you to everyone who played, watched, and helped put it on. And a special thank you to our friends at Brico for sponsoring the event!

We’ll be back next year, bigger and better than ever, so mark your calendars. One change I’m considering is switching from co-ed to hosting both men’s and women’s games. Our venue can accommodate additional players. Please let me know what you think about this idea!

And, if you’re here in Vegas, please look for me over the next couple of days and say hello if you see me.

Enjoy the madness!

- Alex

3 FINTECH NEWS STORIESCopy anchor linkCopied

#1: There Will Be No Monopoly in Cash Flow Underwriting Copy anchor linkCopied

What happened?Copy anchor linkCopied

Lots of stuff is happening in the world of cash flow underwriting.

Experian launched a cash flow credit bureau:

Data analytics and consumer credit reporting company Experian is launching a new consumer reporting agency (CRA) called the Experian Cashflow Data Bureau. The new CRA’s goal is to help banks leverage consumer-permissioned cash flow insights to support underwriting decisions.

The new Cashflow Data Bureau will serve as the foundation for Experian’s broader cash flow ecosystem, bringing together existing cash flow products such as Cashflow Attributes and Cashflow Score with capabilities for consumer consent, data aggregation, standardized reporting, analytics, and decisioning. The launch essentially brings cash flow data into a bureau-like framework, allowing lenders to incorporate consumer-permissioned banking activity into underwriting alongside traditional credit bureau data.

Equifax announced a new partnership around cash flow-powered analytics:

Equifax is expanding its open banking solutions with the addition of consumer-permissioned insights enabled via Mastercard Open Finance, giving lenders and fintechs more choice in the open finance provider they use alongside the Equifax consumer credit file. Mastercard Open Finance's Cashflow Analytics, Payment Risk Insights and Transaction Report are now available to Equifax customers.

And Prism Data raised a $20M Series A and announced a new AI-powered transaction categorization engine:

Today, we’re introducing REFRACT, a new AI-powered transaction categorization engine trained on Prism’s proprietary dataset of more than 30 billion bank transactions. REFRACT, the Real-time Engine For Recognizing, Analyzing, and Categorizing Transactions, is the foundation underlying our forthcoming generation of scores and analytics, and the reason Prism’s products can see financial behaviors and obligations that conventional systems miss.

Unlike standard categorization that assigns labels from merchant names or keywords alone, REFRACT’s independent consumer and commercial models infer the financial purpose of transactions with high precision. By connecting contextual clues, REFRACT distinguishes transactions that look alike on a bank statement but represent fundamentally different financial activities. For example, it can discern earnings from borrowed funds, refunds from income, and purchases from transfers, even when the same payment platform is involved.

So what?Copy anchor linkCopied

FICO launched the first general-purpose credit score in 1989. It secured a de facto government monopoly for credit scores in the mortgage market (which solidified its overall monopoly in the space) in 1995. This monopoly was enabled by the three national credit bureaus — Experian, Equifax, and TransUnion — which distributed the FICO Score (with a markup on top) along with their credit files to lenders.

As difficult as it is to believe, it took the credit bureaus more than ten years to realize that maybe, perhaps, they should compete with FICO for the booming market for credit scores, rather than simply allowing them to own 100% of the market. The bureaus launched the VantageScore in 2006 and it took another 20 years (plus Bill Pulte’s mercurial nature) for them to finally break FICO’s hold.

We’re not going to be repeating that pattern with cash flow credit scores.

The cash flow lending ecosystem is already very competitive and, importantly, that competition is vertically integrating at a pace that far exceeds what we saw 30 years ago in the traditional credit scoring space:

• 2018: FICO launches UltraFICO 1.0 in partnership with Experian and Finicity.
• 2020: Mastercard acquires Finicity and proceeds to squander its lead in cash flow underwriting. Visa fails to acquire Plaid, setting Plaid down the path of developing more robust solutions on top of its data aggregation capabilities.
• 2022: Nova Credit pivots into cash flow underwriting, launching its cash flow score and leveraging its status as consumer reporting agency (CRA).
• 2023: Prism Data spins out of Petal, leveraging its in-house cash flow underwriting experience and performance data to launch a cash flow credit score. Plaid gives up its long-held resistance to being a CRA and becomes one.
• 2024: Plaid launches its consumer report product for cash flow data and partners with Prism Data to distribute its credit risk attributes and score. Prism also partnered with Equifax to distribute its cash flow credit score to Equifax customers.
• 2025: Experian introduces its own cash flow score, partnering with Plaid as the CRA. FICO launches UltraFICO 2.0 in partnership with Plaid as the CRA (in place of Finicity/Mastercard) and without Experian. Plaid launches its own cash flow credit score, which requires lenders to pull the data powering the score from Plaid as well. Nova Credit raises a Series D.
• 2026: Block launches a credit score built on its first-party data and made available to lenders, without going through any of the data aggregators, but (initially) going through Nova Credit as a distribution partner and CRA. Experian launches its own cash flow CRA to power its cash flow risk analytics products (reducing its reliance on Plaid). Equifax expands its open-banking marketplace by adding Mastercard’s cash flow analytics as an alternative to the Prism-powered score it already resells. And Prism raises a Series A and doubles down on its core analytics offering with AI-enhanced transaction categorization.         

See what I’m talking about?

Lots of movement! Lots of partnerships! Lots of product launches that jeopardize the viability of those partnerships! And it all leaves me with lots of questions, including:

• Can Prism Data continue to focus exclusively on analytics when multiple distribution partners are building or distributing competing analytic products? Is there enough of an edge in “we build the best attributes and models” to sustain a strong competitive moat?
• Can Plaid maintain its partnerships while competing directly with those partners? It feels like FICO has no choice (it’s not going to stand up its own cash flow CRA), but Experian sure did and it made it. Will Plaid’s focus on vertical integration drive the market towards providers that take a more modular approach?
• Will other banks and fintech companies follow Block’s lead and productize their own internal scores and first-party data? Will this trend lead to less furnishing and fewer data access agreements between data providers and data aggregators?
• What is TransUnion doing? Are they awake? Are they paying attention?
• Are consumers going to be confused by all of these new CRAs? How will they know what consumer reports and scores they should monitor? Will they know where to go when they need to dispute something?
• Can Mastercard mount a comeback in cash flow lending now that pay-by-bank in the U.S. is, functionally, dead?
• Will we see other players in the space follow Plaid’s lead with Instant Link and try to make permissioning less of a point of friction in lending workflows? And, if we do, how will those changes end up synchronizing with rulemaking on Dodd-Frank Section 1033 (which is, in theory, still in process)?    

I don’t know the answers to these questions, but the sheer volume of them suggests to me that the competitive dynamics in the next generation of the credit data and analytics market will look nothing like the dynamics that FICO so effectively mastered in the last generation.

#2: I Wish You Good Fortune in the Wars to Come Copy anchor linkCopied

What happened?Copy anchor linkCopied

OK, well, we knew this was coming. And now it’s here. The big banks have officially said that they will be blocking AI agents from moving money on their customers’ behalf:

A customer who hands a login to an artificial intelligence agent now gets turned away at four of the biggest names in banking in the United States.

Charles Schwab sees the attempts firsthand. Across all its clients, the brokerage blocks the big, unauthorized AI agents, including Meta’s Muse, “in the tens and 20s” each week, CEO Rick Wurster said …

JPMorganChase CEO Jamie Dimon warned of “rogue agents” and said outside agents would not get inside the bank during a third-quarter earnings call Tuesday (Oct. 13) …

Bank of America followed a day later with a condition rather than a ban. The bank is limiting agents’ access to consumer deposits while it writes protocols that decide which party is liable for a payment an AI authorizes, and CEO Brian Moynihan said Wednesday (Oct. 14) that a human should stay in the loop to approve money moving out of an account …

By Friday, Citigroup had drawn the same line. The bank does not let third-party agents log into accounts or transact …

All four firms kept the read-only door open while closing the one that moves money. At JPMorganChase, outside agents can see balances when a customer authorizes a connector such as Plaid, but they cannot send money or pay bills, and the bank gave no timeline for changing that … Dimon told analysts on the same call that customers who use outside agents should understand “the liability transfer.”

Instead, the big banks are building their own AI agents that will enable customers to move money between their different accounts at the same institution:

The transfers the banks will not hand to an outside agent are the ones they plan to run themselves. Dimon wrote in his 2025 shareholder letter that JPMorgan’s Smart Cash capability would move client money automatically between checking accounts and higher-yielding brokerage products in 2026, … The bank is testing the same sweep an outside agent would offer inside its own app.

Schwab is doing the same with Charley, the generative AI assistant it announced Sept. 30. Charley answers questions on transfers, trading and account actions, pulls quotes and research, and hands off to a Schwab representative. It began rolling out in phases to eligible U.S. retail clients in October.

Wurster said he wants clients using Charley instead of handing a password to Muse

Ohh, and also, in a somewhat related announcement, Knot is productizing its technology platform so that other companies can build customer-permissioned data access and agentic action APIs:

I couldn't be more excited to announce Supernova by Knot.

For years, we've poured our hearts and souls into building the technology behind Knot.

Today, it powers more than 1 million actions every day for some of the largest financial institutions in the world.

Now, we're putting that same technology in your hands: Supernova turns virtually any action on any website into an API.

Tell Supernova what you want to do and Supernova, if needed, uses a VM to learn the action once, then turns it into a reusable API. Frictionless authentication, persistent connections, health checks, self-healing, and ongoing maintenance? All handled by Supernova.

The result: An API you can call over and over, without spinning up a browser every time.

Think about what this unlocks:

🛒 Commerce: Build APIs to search, shop, and purchase across retailers.

🏦 Financial services: Connect accounts, retrieve transactions, and manage payments.

🚀 Entrepreneurs: Build the next Finicity/Plaid/MX for procurement, Stripe for returns, or an entirely new API business.

So what?Copy anchor linkCopied

The last war that the big banks fought over unauthorized access to their systems was the great open banking war (2010 – 2025). That war was about read access to banks’ data, permissioned by the banks’ customers. The banks objected to the idea that their customers could give their data to companies that wanted to compete with them, and that objection sharpened into a lawsuit when the CFPB told banks that they would be legally required to provide that access for free.

The banks’ dislike of open banking always struck me as a combination of operational annoyance (primarily focused on screen scraping) and strategic indignity at being forced to give a valuable asset, for free, to companies that would dare to compete with them. It was aggravating and vaguely threatening, but not acutely dangerous.

The next war is much more acutely dangerous to banks. And it’s centered on write access, not read access.

Products like Muse and Instinct want to automate much of the routine, tedious, and operationally complex work in consumers’ lives that they know they should do, but never find the time to actually do.

In financial services, there’s a lot of that work: Moving cash between different accounts to optimize yield without missing any payments, refinancing loans when rates move, avoiding unnecessary fees, etc. And pretty much all of that work — when it is not consistently done by consumers — helps to increase the profitability of banks.

Hence banks’ concerns about AI agents.

Now, the banks will say that they aren’t trying to stop customers from optimizing their finances. They are merely trying to protect them from the mistakes that AI agents will inevitably make, as well as to protect themselves from “rogue” AI agents that may not be acting on customers’ authority at all. Those are very fair concerns.

However, if those were the only concerns, banks wouldn’t be talking about blocking AI agents. They’d be talking about figuring out how to enable authorized external AI agents to safely and reliably transact within their environments.

That’s not what they’re doing. Instead, the banks are blocking external agents and talking up their own internal agents, which will (they say) fulfill the same basic functions for customers, such as sweeping money from lower-yielding accounts to higher-yielding accounts.

This is a position that I’m quite skeptical of.

First, there will always be product options, outside the banks’ walls, that are better for certain customers in certain circumstances. An internal AI agent at JPMorgan Chase isn’t going to recommend that a customer move money from their JPMC checking account to a SoFi checking account, even if SoFi is offering a better rate than anything JPMC offers across its deposit product portfolio. Second, it’s easy to imagine a big bank’s internal AI agent taking suboptimal actions on behalf of their customers in order to fully optimize for the bank’s profitability (You’re absolutely right. I forgot to move that $2,000 to the high-yield savings account yesterday, even though I was supposed to. My apologies.)

The problem for banks is that it will be very difficult to stop external AI agents in perpetuity.

When a bank says today that it’s “blocking AI agents,” what it’s actually blocking is a specific, detectable pattern: A third party like Muse taking a customer’s credentials and logging in from its own servers, or driving a session with automation the bank can fingerprint. If your systems can detect those patterns, you can block the first, clumsiest generation of agents.

The version of an external AI agent that actually scares banks doesn’t live in Meta’s cloud. It lives on your phone, in your browser, on the session you’re already logged into. It uses your cookies, your saved password, your device, your IP, your location. To the bank’s systems, it doesn’t look like a rogue third party. It looks like you, because it’s running on the exact same signals the bank uses to know it’s you in the first place. You can’t cleanly block that without getting very good at telling a human apart from that human’s own software, running on that human’s own device, acting on that human’s own instructions. And that’s a bot-detection arms race the bank has to run against its own customers.

That arms race becomes even harder for banks to win when the costs of building a local agent that reliably logs in, survives a UI that changes without warning, clears step-up auth, holds the session, and doesn’t break every Tuesday go down.

That’s where this announcement from Knot¹ comes in.

Knot has spent years solving the brittle, unglamorous middle that makes agentic action hard: Learn an action once, turn it into a durable API, then handle authentication, persistent connections, health checks, self-healing, and ongoing maintenance so the connection doesn’t rot. Now they’re selling it as a platform, which can turn virtually any action on any website into an API.

The banks can block centralized agents and buy some time, but they can’t block the ones that run on your own phone and look exactly like you, and those get cheaper to build every time something like Supernova ships. Hence the title of this story: I wish you good fortune in the wars to come.

#3: Watch Out for the Whipsaw Copy anchor linkCopied

What happened?Copy anchor linkCopied

The OCC released its final report on results of its review of debanking at the nine then-largest national banks under its supervision:

The Office of the Comptroller of the Currency (OCC) today released a report of its findings from its supervisory review of debanking activities at the nine largest national banks it supervises: JPMorgan Chase Bank, Bank of America, Citibank, Wells Fargo Bank, U.S. Bank, Capital One, PNC Bank, TD Bank, and BMO Bank.

In the report, the OCC found that broad reputation risk policies—which lacked clear standards and objective, risk-based criteria—disadvantaged certain Americans based on their political, religious, or social views or based on their lawful business activities. The OCC also found that banks maintained public and nonpublic policies restricting certain industry sectors’ access to financial services, including those in oil and gas exploration, coal mining or coal-powered plants, firearms or ammunition manufacturing or distribution, construction or operation of detention facilities, the manufacturing, distribution or online retail of tobacco or e-cigarettes, and digital asset activities.

And the CFPB, not wanting to be left out of the fun, announced its own debanking initiative, following up on the findings from the OCC’s report:

Today, the Consumer Financial Protection Bureau (CFPB) announced the next step in its work to advance President Trump’s fight against the debanking of businesses and individuals on the basis of their constitutionally protected rights, including support of President Trump, MAGA, pro-life causes, and industries disfavored by the Left. The CFPB will address any consumer harm caused by the nation’s largest banks in response to the Report on debanking practices by Office of the Comptroller of the Currency (OCC).

So what?Copy anchor linkCopied

I won’t delve deeply into the OCC’s report, since several others have already done so. In particular, I’d recommend reading the latest from Jason Mikula and Adam Levitin. I’ll only amplify a few points made by Jason and Adam:

• The report provides no data. Despite the OCC reviewing nearly 100,000 complaints, hundreds of individual bank decisions, and about 420,000 pages of bank documents, the report doesn’t give any hard data or numbers on the scale of the debanking problem at these nine large banks. Instead, the report focuses on a number of anecdotes, which are interesting but not conclusive.
• Of the anecdotes that were shared, there aren’t any about consumers being debanked due to political or religious beliefs. Also, interestingly, none of the anecdotes about businesses being debanked relate to the crypto space, despite many in the crypto industry claiming to have seen or personally experienced debanking during the last administration.
• The report spends quite a bit of time criticizing the use of reputation risk by regulators and by banks themselves. I think these concerns are very fair and it seems like everyone in the industry is relatively supportive of the current administration’s decision to strip reputation risk out of the bank supervisory toolkit.   

The most interesting and ironic part of the report is a quote that Jason astutely pointed to in his newsletter:

“[W]hen banks rely on difficult-to-quantify factors to decide whether to provide financial services, there is significant risk that bank decisions will whipsaw back and forth with the current political or social climate” and that this “whipsaw” effect may continue “with the change of each administration or Congress even in the absence of statutory changes.”

Perfect. The OCC diagnoses the problem — decisions built on difficult-to-quantify factors will whipsaw with the political climate, administration to administration, even with no change in the law — and then the CFPB walks out and gives a helpful demonstration of exactly what it looks like.

The CFPB’s statement started by announcing, “the next step in its work to advance President Trump’s fight” against debanking tied to “support of President Trump, MAGA, pro-life causes, and industries disfavored by the Left.” That’s not how an unbiased referee calling balls and strikes talks. That’s how a political party describes its score-settling agenda.

And now let’s think about the mechanics of how that score will be settled. The CFPB cites three different statutory powers that it will use to investigate instances of debanking: ECOA (fair lending), FCRA (credit reporting), and Dodd-Frank (UDAAP). Most of the anecdotes cited in the OCC’s report don’t relate to credit or lending, so fair lending and credit reporting aren’t especially useful. And UDAAP, while being a very flexible supervisory tool for the bureau, only applies to consumers, where the OCC did not highlight evidence of debanking.

Additionally, it’s worth pointing out that this same CFPB spent all of last year insisting that its authority (particularly around UDAAP) shouldn’t be stretched by the bureau to inappropriately target financial services providers. Its own 2025 Fair Lending Report bragged about narrowing fair lending to “proven, intentional racial discrimination with actual identifiable victims” and bringing zero new fair lending actions all year, and in court it dismissed its own appeal defending UDAAP as a reach beyond ECOA.

Now it’s maybe going to try to use UDAAP to investigate instances of debanking?

The OCC was right to highlight the concern about the politicization of the supervisory process and the risks that such actions may lead to a whipsawing effect for the industry, as control of government shifts from one party to the other.

They should have mentioned that concern to the CFPB.

2 READING RECOMMENDATIONSCopy anchor linkCopied

#1: Who's responsible when the AI agent is wrong? (by Alex McLeod, Weights and Measures)  📚Copy anchor linkCopied

A timely topic!

(This is literally the number one thing folks at Money20/20 seem to be discussing/debating.)

#2: Can You Prove That? (by Jenn Day, Readable Money) 📚Copy anchor linkCopied

I loved the way Jenn summarized her argument in this piece:

Marketing wants to say the most compelling thing. Compliance wants to say the most defensible thing. The work is finding the place where those turn out to be the same sentence.

Read the whole piece.

Bonus: A Digital Wallet For Agents (by me, with Method Financial) 📚Copy anchor linkCopied

Your digital wallet knows which cards you have. But does it know which one to use? AI agents need to understand rewards, available credit, and permissions before they can choose on our behalf. I wrote about what it takes to build a wallet that gives agents that context.

*This rec is brought to you by one of our fantastic brand partners.

1 QUESTION FROM FINITYCopy anchor linkCopied

There are a TON of interesting questions being asked in Finity (our digital community for fintech and banking nerds). I’ll share one question, sourced from the community, each week. However, if you’d like to join the conversation, please apply to join!

If you were to rank the federal prudential bank regulatory agencies by how sophisticated their average bank examiner is, when it comes to fintech, how would you rank them?

If you have any thoughts on this question, reply to this email or DM me in Finity!

Thanks for the read! Let me know what you thought by replying back to this email.

— Alex