Explainable Credit Decisions, by Construction

By Anushka Appala and Dr. Janio Rosales

A bank declines a loan. The applicant — or a regulator, months later — asks a simple question: why? If the answer is "the model scored you below the cutoff," the bank has a problem. It cannot point to the reason in a way the customer can act on, an examiner can test, or a court can accept. This is the same failure we built NaciluzIA to solve in government, wearing a different suit. When an automated decision touches someone's rights or livelihood, an unexplainable output is not a technical shortcoming — it is a liability.

The reflex in financial services has been to reach for "explainable AI" tooling: post-hoc methods that approximate why a black-box model produced a score. That is better than nothing, but it inverts the architecture. It builds an opaque decision-maker and then hires an interpreter to guess at its reasons. NaciluzIA takes the opposite path. The binding decision is never made by the probabilistic model at all. It is made by a deterministic, published rule — so the explanation is not reconstructed after the fact, it is the decision.

The governed loop, applied to lending

The same four roles that never blur in government carry over cleanly to a credit file.

The AI layer advises: it reads documents, extracts income and obligations, flags inconsistencies, and drafts a recommendation with its supporting evidence. It never approves or declines. The deterministic rules engine decides: a versioned, auditable policy — debt-to-income thresholds, affordability tests, the institution's own credit policy — executes the binding call and returns the specific reasons that produced it. A human underwriter signs the cases that policy routes to review, with the AI's draft and the rule result in front of them. And the audit ledger verifies: every decision records the inputs it saw, the model version that advised, the exact rule version that decided, the reasons, and the signature.

   APPLICATION
        │
        ▼
  ┌─────────────┐   advice + evidence, never a decision
  │  AI  LAYER  │──────────────────────────────┐
  └─────────────┘                               ▼
        │                              ┌───────────────────┐
        │  extracted, verified data    │ DETERMINISTIC     │
        └─────────────────────────────►│ POLICY  RULE      │
                                       │  (versioned)      │
                                       └───────────────────┘
                                                │
                    DECISION  +  reason codes  ─┤
                                                ├──► approve / decline / refer
                                                │
                        refer edge cases ──►  HUMAN UNDERWRITER (signs)
                                                │
                                                ▼
                                     ┌───────────────────────┐
                                     │  AUDIT LEDGER          │
                                     │  inputs · model ver ·  │
                                     │  rule ver · reasons ·  │
                                     │  signature             │
                                     └───────────────────────┘

The reason codes are not generated by asking a model to rationalize itself. They fall directly out of the rule that made the decision — which is exactly what an adverse-action notice is supposed to contain.

This is now the law, not a nicety

Two regimes are converging on precisely this design. Under the EU AI Act, credit scoring and creditworthiness assessment are named high-risk uses — which brings mandatory human oversight, logging, transparency, and record-keeping. Separately, lenders have long owed applicants a real reason for a denial: in the United States, the Equal Credit Opportunity Act and Regulation B require specific, accurate adverse-action reasons, and supervisors have made clear that "the algorithm did it" is not an acceptable answer for a black-box model. Bank model-risk management expectations point the same way — a model whose decisions cannot be explained and validated is a model you cannot safely put into production.

In other words, the market is being pushed, by regulation, toward the architecture NaciluzIA already is. A deterministic rule of record produces the reason by construction; the ledger makes the whole decision reproducible for a validator or an examiner; the human stays in the loop where the policy says they must.

Why the strictest case travels well

The market behind this is not small. RegTech — the technology of regulated compliance — is heading from roughly $18.6B in 2025 to about $77B by 2034, and its single largest segment is risk-and-compliance management (IMARC, 2025). The AI-governance market that sits alongside it is growing at about 36% a year (Grand View, 2025). The demand is the same demand government felt first: prove the decision, keep a human accountable, keep a record that survives scrutiny.

We built for the hardest version of this problem — a public benefit denied to a citizen who speaks only Q'eqchi', defensible under statute and inspectable by the Contraloría. A credit decision inside a single institution's own policy is a more contained case of the same shape. The architecture does not change. The rulebook does, and the caller does. Explainability stops being a feature bolted onto a black box and becomes a property of the system — the reason is the decision, and the record proves it.

Cada decisión, a la luz.

— Anushka Appala and Dr. Janio Rosales