The commercial finance underwriting bottleneck
In the Merchant Cash Advance (MCA) and alternative commercial lending sector, deal conversion is dictated entirely by speed. When a small business owner requests working capital, multiple brokerage shops race to underwrite the deal simultaneously. The brokerage that packages and delivers an accurate application to funding houses first almost always secures the client.
However, the traditional underwriting workflow is crippled by manual clerical bottlenecks:
- Disparate Bank Statement Formats: Merchants upload statements from thousands of regional credit unions and national banks (Chase, Wells Fargo, Bank of America, local institutions). Each institution utilizes distinct PDF page layouts, font encodings, and transaction table formats.
- Manual Arithmetic Overhead: An underwriting analyst must inspect 3 to 6 months of statements (typically 30 to 80 pages), calculate average monthly gross deposits, remove non-revenue transfers, tally NSF (non-sufficient funds) overdraft occurrences, and compute average daily ledger balances.
- Lender Policy Friction: Each lending institution maintains strict, evolving underwriting guidelines (e.g., maximum 3 negative days per month, minimum $25,000 monthly revenue, exclusions on specific NAICS industry codes, or restricted geographic regions). Submitting an unqualified package results in instant rejection and wasted time.
- Unsecured File Handling: Statements containing sensitive banking coordinates and corporate tax IDs were historically exchanged over unencrypted email attachments or public cloud dropboxes, creating catastrophic compliance and data leakage risks.
Engineering the Finject automated underwriting engine
Lesscode designed and built Finject as a specialized commercial finance CRM. The system pairs a high-performance Next.js web application with a distributed Python/FastAPI document extraction pipeline and a deterministic lender matching matrix.
1. Document AI & financial table parsing pipeline
To parse scanned and native vector PDFs with 99%+ mathematical fidelity, we built an asynchronous processing queue:
- Asynchronous Ingestion: Uploaded statements trigger Celery tasks running on Redis queues, preventing long-running PDF parsing from blocking web workers.
- Hybrid OCR & Spatial Extraction: Documents pass through a multi-pass pipeline utilizing
LlamaParseandpdfplumber. The parser identifies table bounding boxes, normalizes inconsistent date conventions, and extracts credit transactions, debit debits, and balance records. - Deterministic Arithmetic Reconciliation: Rather than trusting raw OCR or LLM text generation alone, the engine executes rigid mathematical checksums: $$\text{Beginning Balance} + \sum \text{Credits} - \sum \text{Debits} = \text{Ending Balance}$$ If a extracted month fails arithmetic reconciliation by more than $0.05, the document is flagged for split-screen human-in-the-loop review.
2. Intelligent lender matching matrix
Once transactions are normalized, Finject computes underwriting telemetry:
- Monthly average gross revenue (excluding internal transfers and MCA refinancing deposits)
- Daily average ledger balance
- Total count of negative ending days and overdraft fees per 30-day window
- Existing position detection (identifying daily ACH debits from competing MCA funders)
These variables feed directly into a compound SQL filtering engine in PostgreSQL that evaluates real-time lender criteria:
- Minimum average monthly revenue thresholds
- Allowed maximum existing positions (1st position, 2nd position, 3rd position)
- Restricted industries (e.g., auto dealerships, legal firms) and excluded US states
- Minimum time in business
Brokers view an instant, ranked compatibility score for dozens of integrated funding houses, eliminating guesswork.
3. Zero-trust security & short-lived client upload links
Because financial statements represent high-value financial telemetry, the architecture adheres to zero-trust standards:
- Brokers generate time-bound, single-use upload links sent to merchants via SMS and email.
- Uploads stream directly from the merchant's browser to encrypted private AWS S3 buckets using short-lived signed URLs, never passing unencrypted through intermediate servers.
- Role-Based Access Control (RBAC) in Supabase Auth ensures junior reps only access assigned deals, while company leadership retains global pipeline oversight.
4. Real-time submission packaging & pipeline telemetry
When a broker selects their target lenders, Finject automatically generates a submission package:
- Compiles the pre-calculated underwriting summary sheet (one-page PDF executive brief).
- Bundles the merchant application, driver's license, and parsed bank statement files.
- Dispatches formatted submission emails directly to underwriters' inboxes via SendGrid SMTP with custom tracking tokens.
- Server-Sent Events (SSE) stream status updates back to the broker's Kanban board when underwriters open emails, download packages, or submit offers.
Measured outcomes & production impact
Deploying Finject across active MCA brokerages replaced spreadsheets, email folders, and manual calculator pads with an automated, high-velocity operation:
- 85% Underwriting Speedup: Deal packaging time decreased from an average of 3.5 hours to under 20 minutes per application.
- Zero Lost Opportunities: Eliminating manual calculation errors and email tracking oversights brought dropped deal rates from delays down to absolute zero.
- +40% Deal-to-Funded Conversion: By instantly routing applications to lenders whose exact risk guidelines matched merchant telemetry, rejection rates dropped and funded conversions surged by 40%.
- Enterprise Bank-Grade Compliance: Secure S3 upload tokens and automated PII protection eliminated unencrypted email PDF exchanges completely.