A loan file is a stack of documents that arrive out of order, in different formats, from people who do not know what the underwriter needs. Before anyone can judge credit, someone has to work out what is in the file, what is missing, what is stale and whether the numbers agree with each other. That sorting and checking is where most of the hours go.
This guide is for a US bank or lender credit operations or underwriting support leader. It covers consumer and mortgage-style files and commercial files, and it stays operational: which checks a machine can run, which decisions stay with a person, and which US rules shape the line between the two. For the wider picture of AI in banking, see our pillar guide to AI employees in banking and financial services.
Which parts of loan document review can AI automate?
What documents are in a loan file?
The stack depends on the product, but the families repeat.
Consumer and mortgage files usually hold the loan application, government IDs, pay stubs and W-2s, tax returns and IRS transcripts, bank and asset statements, the appraisal, the title commitment, homeowners insurance and, for some borrowers, gift letters, divorce decrees or lease agreements.
Commercial files hold the application and guaranty, business and personal tax returns, interim and year-end financial statements, accounts receivable and payable agings, bank statements, entity documents such as articles, operating agreements and certificates of good standing, collateral appraisals, insurance certificates and, where relevant, leases and organizational charts.
The same document type looks different from every employer and bank, and many arrive as phone photos or scans with pages out of order. Our guide to intelligent document processing explains how current systems read documents without a fixed template, and the glossary entry on intelligent document processing gives the short definition.
What does AI actually do with these documents?
The work breaks into six steps, in the order a file moves through them.
- Classify and split.
Identify each document by type and separate a 60-page upload into its parts: the pay stub, the bank statement, the insurance binder. - Extract.
Pull the fields that matter: employer name and year-to-date earnings from a pay stub, ending balances and deposits from a statement, line items from a tax return, the insured amount and effective dates from an insurance certificate. - Calculate.
Total qualifying income, average deposits over a period, debt service coverage from financial statements, debt-to-income ratio, using the lender's own policy rules. - Cross-check.
Compare values across documents. Does the employer on the pay stub match the application? Does the W-2 figure agree with the tax return and the transcript? Does the borrower name and property address match on the appraisal, title and insurance? - Flag staleness and gaps.
Check dates against policy: a statement older than the lender allows, an insurance policy that expires before closing, a page missing from a multi-page return, an unsigned form. - Raise tampering signals.
Surface things a person would want to look at again: fonts that change mid-line, totals that do not add up, metadata that does not fit the document, a pay stub whose year-to-date figures do not progress from the last one.
A tampering signal is a reason to look, not a finding.
What stays with underwriters and credit officers?
Four kinds of decision stay with people.
Credit judgment.
Whether the borrower can and will repay, how to weigh strengths against weaknesses, what to do with a thin file. The AI assembles the evidence and the math. A person makes the call.
Exception materiality.
A debt service ratio a hair under policy, a business that was formed eight months ago, an appraisal that came in slightly low. The system can detect the exception and attach the facts. Whether it matters for this loan is a policy and risk decision.
Authenticity.
When a signal suggests a document was altered, the next step is a human one: call the employer, order a transcript, ask the borrower. Deciding that a borrower submitted a falsified document is a serious conclusion that belongs to a named person, with the evidence in front of them.
Fair lending.
Fair lending review looks at outcomes and at the criteria that produce them. A person owns how rules are set, what gets overridden and how patterns are monitored.
What does each document get checked for?
Document | What can be automated | What a person decides |
|---|---|---|
Application | Completeness, signatures, consistency with other documents | Whether discrepancies are errors or misstatements |
IDs | Type, expiry date, name match against the application | Whether the ID is genuine when a signal appears |
Pay stubs and W-2s | Field extraction, year-to-date progression, income calculation per policy | How to treat bonuses, overtime or recent job changes |
Tax returns and IRS transcripts | Page completeness, schedule extraction, comparison of return to transcript | Which income counts, and how to treat a mismatch |
Bank statements | Balances, deposits, large or unusual items, statement period and name | Whether a deposit is sourced well enough |
Appraisal | Address, effective date, value, comparable count, match to contract | Whether the value supports the loan |
Title and insurance | Named insured, coverage amount, effective and expiry dates, mortgagee clause | Whether a gap or exception is acceptable |
Business financials | Ratio calculation, statement-to-tax-return comparison, aging analysis | How to normalize earnings, and how to weigh trends |
Entity documents | Entity name and state match, signer authority, good standing date | Whether the signer authority is sufficient |
Which US rules shape this work?
These are the rules this process touches most often. Check each against current text with your counsel.
Income verification for mortgages.
Under the Ability-to-Repay rule in Regulation Z, a creditor must verify the information it relies on for a covered transaction using reasonably reliable third-party records. For income and assets, the rule says a creditor may verify income with an IRS tax-return transcript and lists other acceptable records, including filed tax returns, W-2s, payroll statements and financial institution records (12 CFR 1026.43(c)). The rule is about evidence, and the system can show which record supported each figure.
IRS transcripts.
Lenders commonly obtain transcripts through the IRS Income Verification Express Service using Form 4506-C, which the IRS titles an IVES Request for Transcript of Tax Return. An automated check can confirm that the form is complete and signed and can compare the transcript's figures to the return the borrower provided. Ordering the transcript and handling a mismatch stay with staff.
Incomplete applications and adverse action.
Regulation B requires a creditor to notify an applicant of action taken within 30 days of a completed application, and for an application that is incomplete it must either give notice of action or send a notice of incompleteness that specifies the information needed and a reasonable period to provide it (12 CFR 1002.9). Missing-document detection feeds that clock directly. The same section requires a statement of reasons to be specific and to indicate the principal reasons for adverse action, and it says that a statement that an applicant failed to achieve a qualifying score is insufficient. If a model contributes to a decision, someone must be able to turn its outputs into the actual reasons. That is a reason to keep the underwriter as the decision maker and to log which facts drove each recommendation.
Record retention.
Regulation B requires a creditor to keep application records, including written or recorded information used in evaluating the application, for 25 months after notifying the applicant of action taken, or 12 months for business credit in most cases (12 CFR 1002.12). Store whatever your system extracts or flags with the file. Your own policy may require longer.
Model risk.
In April 2026 the Federal Reserve, OCC and FDIC issued revised interagency model risk management guidance. The Fed issued it as SR 26-2, which supersedes SR 11-7, and the OCC issued it as Bulletin 2026-13, which rescinds its earlier model risk guidance. If a bank uses AI to score, rank or recommend, that use belongs in the model inventory with an owner, validation and monitoring proportionate to its risk. Our piece on model risk management for AI agents covers how that applies to agent workflows.
How does a Zamp AI employee run loan document review?
Zamp builds AI employees that run jobs end to end, with human approval gates and a full audit trail. For loan document review, the AI employee follows an Agent Operating Procedure, the written document that spells out the lender's checklist by product, the policy rules for income and ratios, which values must agree across documents, how old each document may be, and when to stop and ask a person.
The employee works in the lender's own systems. It reads what arrives in the loan origination system, email or a document portal, runs the checks, writes the extracted values and the evidence for each one back to the file, and prepares the borrower request for missing items. It cannot approve or decline a loan, and it cannot send a communication that carries a credit decision. A case it cannot resolve inside its scope, such as a conflict between a return and a transcript or a signal of alteration, goes to a person marked as Needs Attention, with the documents and the specific mismatch attached.
Each step is recorded in an audit trail, so a reviewer or examiner can see what the employee read, calculated and flagged. When an underwriter corrects the employee, the correction goes into the procedure, not into the underlying model, and the change is tested and reviewed before it takes effect. Where a bank requires it, Zamp can run inside the bank's own cloud account or on premises; see our deployment models guide. For the reasoning on where people stay in the loop, read human-in-the-loop AI.
Identity and entity checks sit next to document review, and our guide to KYC automation covers that side. On the mortgage side, see what mortgage automation is and what to buy.
How should a lender start?
Start with one product and one stage, usually completeness and staleness checks on a consumer or small-business file, because the rules are written down and mistakes are cheap to catch. Run the AI employee beside your processors, compare outputs on every file, and widen scope when disagreements are rare.
Keep four things from day one: a named owner for the procedure, a record of which documents supported each calculated figure, a rule that the underwriter makes and signs the credit decision, and a model inventory entry that your risk team has reviewed. Separating the person who reviews from the person who approves is segregation of duties, and the same principle applies to an AI employee that prepares work for a human to approve.
