Legacy Banking Architecture:

┌─────────────────────────────────────────────────────────────────────┐
│                    Legacy Banking Architecture                    │
│                                                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │                    Customer Interface                        │   │
│  │         (Branch, ATM, Call Center, Online Banking)          │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    Core Banking System                       │   │
│  │    (Mainframe: IBM AS/400, COBOL, PL/I, CICS)              │   │
│  │                                                             │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │          Customer Information System (CIS)         │   │   │
│  │  ├─────────────────────────────────────────────────────┤   │   │
│  │  │          General Ledger (GL)                       │   │   │
│  │  ├─────────────────────────────────────────────────────┤   │   │
│  │  │          Deposit Management                         │   │   │
│  │  ├─────────────────────────────────────────────────────┤   │   │
│  │  │          Loan Management                           │   │   │
│  │  ├─────────────────────────────────────────────────────┤   │   │
│  │  │          Payment Processing                        │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    Internal Network                          │   │
│  │         (SNA, TCP/IP, Proprietary Protocols)                │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  Characteristics:                                               │
│  • Single monolithic codebase                                  │
│  • Limited external connectivity                               │
│  • Rigid, proprietary data formats                            │
│  • Long development cycles (months to years)                  │
│  • High maintenance costs                                     │
│  • Data locked inside proprietary systems                     │
└─────────────────────────────────────────────────────────────────────┘

Open Finance Architecture:

┌─────────────────────────────────────────────────────────────────────┐
│                    Open Finance Architecture                       │
│                                                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │              Customer-Facing Applications                   │   │
│  │    (Mobile Apps, Web Portals, AI Agents, Chatbots)          │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    API Gateway Layer                         │   │
│  │                                                             │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  Authentication  │  Rate Limiting  │  Logging      │   │   │
│  │  │  (OAuth 2.0)    │  (Token Bucket) │  (Audit)      │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    Microservices Layer                       │   │
│  │                                                             │   │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐  │   │
│  │  │ Account  │  │ Payment  │  │ Lending  │  │ Identity │  │   │
│  │  │ Service  │  │ Service  │  │ Service  │  │ Service  │  │   │
│  │  └──────────┘  └──────────┘  └──────────┘  └──────────┘  │   │
│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐  │   │
│  │  │ KYC/AML  │  │ Fraud    │  │Insights  │  │ AI/ML   │  │   │
│  │  │ Service  │  │ Service  │  │ Service  │  │ Service  │  │   │
│  │  └──────────┘  └──────────┘  └──────────┘  └──────────┘  │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  ┌───────────────────────────▼─────────────────────────────────┐   │
│  │                    Core Banking Integration                  │   │
│  │                                                             │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │         Legacy Core Banking System                 │   │   │
│  │  │         (Mainframe/COBOL)                          │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │         Modern Ledger & Data Lakes                 │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  Characteristics:                                               │
│  • Modular, decoupled services                                 │
│  • Open, standardized APIs                                    │
│  • Real-time data sharing                                     │
│  • Rapid development cycles (hours to days)                   │
│  • Cloud-native, scalable infrastructure                      │
└─────────────────────────────────────────────────────────────────────┘

RESTful API Design:

┌─────────────────────────────────────────────────────────────────────┐
│                    RESTful API Design                             │
│                                                                   │
│  Resources:                                                     │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  /accounts               - Collection of accounts          │   │
│  │  /accounts/{id}          - Specific account               │   │
│  │  /accounts/{id}/transactions - Account transactions      │   │
│  │  /payments               - Payment initiation             │   │
│  │  /customers              - Customer profiles              │   │
│  │  /merchants              - Merchant information           │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  HTTP Methods:                                                  │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  GET    /accounts/{id}      - Retrieve account            │   │
│  │  POST   /payments           - Create payment             │   │
│  │  PUT    /accounts/{id}      - Update entire account      │   │
│  │  PATCH  /accounts/{id}      - Partial account update     │   │
│  │  DELETE /accounts/{id}      - Close account              │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  Statelessness:                                                 │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Each request carries full authentication and context   │   │
│  │  • Server stores zero session state                       │   │
│  │  • Scalable and reliable                                  │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  JSON Payloads:                                                │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  Lightweight, machine-learning friendly format            │   │
│  │  Easy to parse and generate                               │   │
│  │  Supported by all programming languages                   │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

{
  "account_id": "ACC123456",
  "balance": 15000.00,
  "currency": "USD",
  "transactions": [
    {
      "id": "TX789012",
      "date": "2024-01-15T10:30:00Z",
      "amount": -45.67,
      "description": "UBER *TRIP 8934 SFO",
      "category": "Transportation",
      "merchant": "Uber",
      "status": "completed"
    },
    {
      "id": "TX789013",
      "date": "2024-01-15T14:22:00Z",
      "amount": -127.50,
      "description": "AMAZON.COM ORDER #12345",
      "category": "Shopping",
      "merchant": "Amazon",
      "status": "completed"
    }
  ],
  "links": {
    "self": "/accounts/ACC123456",
    "transactions": "/accounts/ACC123456/transactions",
    "balances": "/accounts/ACC123456/balances"
  }
}

GraphQL Query Example:

query GetCreditProfile($customerId: ID!) {
  customer(id: $customerId) {
    id
    name
    accounts {
      id
      type
      balance
      transactions(limit: 365) {
        date
        amount
        category
        merchant
      }
    }
    creditScore
    income
    employment
    liabilities {
      type
      amount
      remaining
    }
  }
}

REST vs GraphQL Comparison:

┌─────────────────────────────────────────────────────────────────────┐
│                    REST vs GraphQL Comparison                     │
│                                                                   │
│  REST:                                                          │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Fixed endpoints                                        │   │
│  │  • Multiple requests for related data                    │   │
│  │  • Over-fetching (unnecessary data)                      │   │
│  │  • Under-fetching (missing data)                         │   │
│  │  • Versioning required for changes                       │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  GraphQL:                                                       │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Single endpoint                                        │   │
│  │  • One request for all needed data                       │   │
│  │  • No over-fetching (client specifies fields)           │   │
│  │  • No under-fetching (all data in one request)           │   │
│  │  • No versioning (deprecation instead)                   │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

Token Bucket Algorithm:

Tₜ = min(T_max, T_(t-Δt) + r · Δt)

Where:
- Tₜ = tokens at time t
- T_max = bucket capacity (maximum tokens)
- r = refill rate (tokens per second)
- Δt = time since last update

Request requiring k tokens executes only if Tₜ ≥ k.

Token Bucket Visualization:

┌─────────────────────────────────────────────────────────────────────┐
│                    Token Bucket Visualization                     │
│                                                                   │
│  Tokens                                                         │
│  ▲                                                              │
│  │  T_max ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─           │
│  │  │      ●    ●    ●    ●    ●    ●    ●    ●    ●    ●    │   │
│  │  │    ●    ●    ●    ●    ●    ●    ●    ●    ●    ●    ● │   │
│  │  │  ●    ●    ●    ●    ●    ●    ●    ●    ●    ●    ●  │   │
│  │  │●    ●    ●    ●    ●    ●    ●    ●    ●    ●    ●    │   │
│  │  └──────────────────────────────────────────────────────────▶  │   │
│  │    0    1    2    3    4    5    6    7    8    9    10    │   │
│  │                                                             │   │
│  │  ● = Token added (refill rate r)                         │   │
│  │  ─ = Token consumption (request uses k tokens)           │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

import time

class TokenBucket:
    def __init__(self, capacity, refill_rate):
        self.capacity = capacity
        self.refill_rate = refill_rate  # tokens per second
        self.tokens = capacity
        self.last_refill = time.time()
    
    def consume(self, tokens=1):
        """
        Attempt to consume tokens for a request.
        Returns True if successful, False otherwise.
        """
        self._refill()
        if self.tokens >= tokens:
            self.tokens -= tokens
            return True
        return False
    
    def _refill(self):
        now = time.time()
        elapsed = now - self.last_refill
        refill_amount = elapsed * self.refill_rate
        self.tokens = min(self.capacity, self.tokens + refill_amount)
        self.last_refill = now
    
    def get_remaining(self):
        self._refill()
        return self.tokens

# Usage
bucket = TokenBucket(capacity=10, refill_rate=5)  # 10 tokens, 5 per second

if bucket.consume(1):
    # Process request
    pass
else:
    # Rate limit exceeded
    pass

BaaS Three-Tier Architecture:

┌─────────────────────────────────────────────────────────────────────┐
│                    BaaS Technology Stack                          │
│                                                                   │
│  Layer 3 – Brand / FinTech Frontend:                             │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Customer-facing applications                            │   │
│  │  • Ride-sharing apps issuing debit cards                  │   │
│  │  • E-commerce platforms offering lending                  │   │
│  │  • Accounting software with embedded payments             │   │
│  │  • Examples: Uber, Shopify, Airbnb                        │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  Layer 2 – Middleware / API Provider:                           │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Technology firms exposing RESTful endpoints            │   │
│  │  • Abstraction of legacy banking complexity              │   │
│  │  • Developer-friendly SDKs and documentation             │   │
│  │  • Examples: Stripe Treasury, Galileo, Unit, Solaris     │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  Layer 1 – Licensed Sponsor Bank:                               │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Holds banking charter                                  │   │
│  │  • Maintains reserves and FDIC compliance                │   │
│  │  • Manages regulatory oversight                          │   │
│  │  • Examples: The Bancorp, Cross River Bank, FDIC banks   │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

BaaS Integration Architecture:

┌─────────────────────────────────────────────────────────────────────┐
│                    BaaS Integration Architecture                  │
│                                                                   │
│                 │
│  │  FinTech / Brand Application                               │   │
│  │  ┌─────────────────────────────────────────────────────┐   │   │
│  │  │  User Interface (Mobile/Web)                       │   │   │
│  │  └─────────────────────────────────────────────────────┘   │   │
│  │                           │                                 │   │
│  │  ┌───────────────────────▼─────────────────────────────────┐   │   │
│  │  │  BaaS API Calls (REST/GraphQL)                       │   │   │
│  │  │  • Create Account                                    │   │   │
│  │  │  • Issue Card                                        │   │   │
│  │  │  • Process Payment                                   │   │   │
│  │  │  • Check Balance                                     │   │   │
│  │  └───────────────────────────────────────────────────────┘   │   │
│  │                           │                                 │   │
│  │  ┌───────────────────────▼─────────────────────────────────┐   │   │
│  │  │  BaaS Middleware Platform                             │   │   │
│  │  │  ┌───────────────────────────────────────────────────┐   │   │
│  │  │  │  API Gateway    │  Compliance    │  Ledger      │   │   │
│  │  │  │  (OAuth 2.0)   │  (KYC/AML)    │  Management  │   │   │
│  │  │  └───────────────────────────────────────────────────┘   │   │
│  │  └───────────────────────────────────────────────────────┘   │   │
│  │                           │                                 │   │
│  │  ┌───────────────────────▼─────────────────────────────────┐   │   │
│  │  │  Sponsor Bank Integration                              │   │   │
│  │  │  ┌───────────────────────────────────────────────────┐   │   │
│  │  │  │  Core Banking  │  Card Network  │  FDIC/Reg    │   │   │
│  │  │  │  System       │  Integration  │  Compliance   │   │   │
│  │  │  └───────────────────────────────────────────────────┘   │   │
│  │  └───────────────────────────────────────────────────────┘   │   │
└─────────────────────────────────────────────────────────────────────┘

Embedded Finance Examples:

┌─────────────────────────────────────────────────────────────────────┐
│                    Embedded Finance Examples                      │
│                                                                   │
│  Embedded Payments:                                             │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Uber: Passengers exit without paying (automatic)       │   │
│  │  • Amazon: One-click checkout                            │   │
│  │  • E-commerce: Integrated checkout                        │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  Embedded Lending:                                             │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Shopify Capital: Merchant cash advances                │   │
│  │  • Klarna: Buy Now, Pay Later at checkout                │   │
│  │  • Square: Merchant loans based on transaction volume     │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  Embedded Insurance:                                           │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Travel booking: Travel insurance at checkout           │   │
│  │  • E-commerce: Purchase protection                        │   │
│  │  • Ride-sharing: Passenger insurance                      │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  Embedded Banking:                                             │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Uber: Debit cards for drivers                          │   │
│  │  • Shopify: Business checking accounts                   │   │
│  │  • Airbnb: Host payment accounts                          │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

AI in Embedded Finance:

1. Contextual Behavioral Data:
   - Merchant traffic patterns
   - Supply chain frequency
   - Customer engagement metrics
   - Transaction timing and location

2. Credit Underwriting:
   - Real-time cash flow analysis
   - Behavioral credit scoring
   - Alternative data integration
   - Dynamic risk assessment

3. Risk Modeling:
   - Fraud detection
   - Default prediction
   - Anomaly detection
   - Portfolio optimization

OAuth 2.0 Authorization Code Flow:

┌─────────────────────────────────────────────────────────────────────┐
│                    OAuth 2.0 Authorization Flow                   │
│                                                                   │
│  ┌─────────────┐                              ┌─────────────┐    │
│  │   Resource  │                              │ Authorization│   │
│  │    Owner    │                              │   Server    │    │
│  │   (User)    │                              │   (Bank)    │    │
│  └──────┬──────┘                              └──────┬──────┘    │
│         │                                            │           │
│         │  1. Authorization Request                  │           │
│         │  (Client redirects user to bank login)    │           │
│         │───────────────────────────────────────────>│           │
│         │                                            │           │
│         │  2. User Authenticates                     │           │
│         │  (User logs in, approves scopes)          │           │
│         │<───────────────────────────────────────────│           │
│         │                                            │           │
│         │  3. Authorization Code                     │           │
│         │  (Bank issues authorization code)         │           │
│         │───────────────────────────────────────────>│           │
│         │                                            │           │
│         │  4. Authorization Code Exchange            │           │
│         │  (Client exchanges code for tokens)       │           │
│         ┌─────────────┐                              │           │
│         │   Client    │─────────────────────────────>│           │
│         │   (App)     │                              │           │
│         └─────────────┘<─────────────────────────────│           │
│         │             5. Access Token & Refresh Token│           │
│         │                                            │           │
│         │  6. API Request with Access Token          │           │
│         │───────────────────────────────────────────>│           │
│         │                                            │           │
│         │  7. Access Protected Resource              │           │
│         │<───────────────────────────────────────────│           │
│         │                                            │           │
│         │  8. Refresh Token (When token expires)     │           │
│         │───────────────────────────────────────────>│           │
│         │                                            │           │
│         │  9. New Access Token                       │           │
│         │<───────────────────────────────────────────│           │
└─────────────────────────────────────────────────────────────────────┘

JWT Structure:

Header: {
  "alg": "HS256",
  "typ": "JWT"
}

Payload: {
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516242622,
  "scope": "accounts:read payments:write"
}

Signature = HMAC-SHA256(
  base64url(Header) + "." + base64url(Payload),
  SecretKey
)

Complete JWT:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Server verifies signature before fulfilling requests:

1. Split JWT into: Header, Payload, Signature
2. Compute HMAC-SHA256(Header + "." + Payload, SecretKey)
3. Compare computed signature with provided signature
4. Check expiration (exp claim)
5. Verify audience (aud claim)
6. Check issuer (iss claim)

If all checks pass, process the request.

mTLS Authentication Flow:

┌─────────────────────────────────────────────────────────────────────┐
│                    mTLS Authentication Flow                       │
│                                                                   │
│  Client                                                         Server│
│     │                                                             │
│     │  1. Client Hello (TLS handshake)                           │
│     │────────────────────────────────────────────────────────────>│
│     │                                                             │
│     │  2. Server Hello + Certificate (Server Certificate)        │
│     │<────────────────────────────────────────────────────────────│
│     │                                                             │
│     │  3. Client Certificate (Client presents its certificate)   │
│     │────────────────────────────────────────────────────────────>│
│     │                                                             │
│     │  4. Certificate Verification (Server verifies client)      │
│     │  ┌─────────────────────────────────────────────────────┐   │
│     │  │  • Verify certificate signature                    │   │
│     │  │  • Verify certificate chain                       │   │
│     │  │  • Check certificate revocation                  │   │
│     │  │  • Verify client identity                         │   │
│     │  └─────────────────────────────────────────────────────┘   │
│     │                                                             │
│     │  5. Encrypted Tunnel Established                          │
│     │  ┌─────────────────────────────────────────────────────┐   │
│     │  │  • Both parties authenticated                     │   │
│     │  │  • All data encrypted                             │   │
│     │  │  • Mutual trust established                       │   │
│     │  └─────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

Transaction Categorization Pipeline:

┌─────────────────────────────────────────────────────────────────────┐
│                    Transaction Categorization Pipeline            │
│                                                                   │
│  Raw Transaction:                                               │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  "POS 4921 SQ *COFFEE SHOP NAIROBI"                        │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  1. Text Cleaning:                                            │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Remove special characters                              │   │
│  │  • Normalize case                                         │   │
│  │  • Remove POS-specific codes                               │   │
│  │  • Result: "COFFEE SHOP NAIROBI"                         │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  2. Merchant Identification:                                   │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Match against merchant database                        │   │
│  │  • Extract merchant name                                  │   │
│  │  • Result: "Coffee Shop Nairobi"                          │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  3. Category Classification (NLP):                           │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Fine-tuned BERT/Transformer model                      │   │
│  │  • Classify into merchant category                        │   │
│  │  • Result: "Food & Dining"                               │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                              │                                    │
│  4. Enrichment:                                             │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Add merchant logo                                     │   │
│  │  • Add geolocation                                       │   │
│  │  • Add carbon footprint estimate                         │   │
│  │  • Result: Complete enriched transaction                  │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch

class TransactionClassifier:
    def __init__(self, model_name="finbert-transaction-categorizer"):
        self.tokenizer = AutoTokenizer.from_pretrained(model_name)
        self.model = AutoModelForSequenceClassification.from_pretrained(model_name)
        self.categories = [
            "Food & Dining", "Transportation", "Shopping", "Housing", 
            "Utilities", "Healthcare", "Entertainment", "Travel", "Other"
        ]
    
    def classify(self, description):
        # Tokenize input
        inputs = self.tokenizer(
            description,
            return_tensors="pt",
            truncation=True,
            max_length=128,
            padding=True
        )
        
        # Get predictions
        with torch.no_grad():
            outputs = self.model(**inputs)
            predictions = torch.softmax(outputs.logits, dim=1)
            
        # Get category
        category_idx = torch.argmax(predictions, dim=1).item()
        return {
            'category': self.categories[category_idx],
            'confidence': predictions[0][category_idx].item()
        }

Credit Scoring Comparison:

┌─────────────────────────────────────────────────────────────────────┐
│                    Credit Scoring Comparison                      │
│                                                                   │
│  Traditional Credit Scoring:                                    │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Data sources: Credit bureaus (Equifax, Experian)       │   │
│  │  • Data frequency: Monthly or quarterly updates           │   │
│  │  • Data coverage: Limited to credit accounts              │   │
│  │  • Limitations: Thin-file consumers excluded              │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                   │
│  Open Finance Credit Scoring:                                  │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │  • Data sources: Live bank account data across accounts   │   │
│  │  • Data frequency: Real-time, continuous updates          │   │
│  │  • Data coverage: Full cash-flow picture                  │   │
│  │  • Advantages: Includes thin-file consumers               │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

PD = 1 / (1 + e^-(β₀ + β₁X₁ + β₂X₂ + ... + βₙXₙ))

Where features include:
- X_cash_velocity: Cash flow velocity
- X_rent_ratio: Rent-to-income ratio
- X_debt_service: Debt service ratio
- X_income_stability: Income stability measure
- X_spending_patterns: Behavioral spending patterns
- X_savings_rate: Savings rate
- X_transaction_frequency: Transaction frequency
- X_merchant_diversity: Merchant category diversity
- X_risk_segments: Segment-based risk indicators

import xgboost as xgb
from sklearn.model_selection import train_test_split
from sklearn.metrics import roc_auc_score, classification_report

class CreditScoringModel:
    def __init__(self):
        self.model = None
    
    def engineer_features(self, data):
        """
        Engineer features from raw financial data
        """
        # Cash flow velocity (income velocity)
        data['cash_velocity'] = data['income'] / data['account_age_days']
        
        # Rent-to-income ratio
        data['rent_ratio'] = data['rent'] / data['income']
        
        # Debt service ratio
        data['debt_service_ratio'] = data['debt_payments'] / data['income']
        
        # Income stability
        data['income_stability'] = data['income_std'] / data['income_mean']
        
        # Savings rate
        data['savings_rate'] = data['savings'] / data['income']
        
        # Spending patterns (spending diversity)
        data['category_diversity'] = data['unique_categories'] / data['total_categories']
        
        return data
    
    def train(self, X, y):
        """
        Train XGBoost model for credit scoring
        """
        # Split data
        X_train, X_test, y_train, y_test = train_test_split(
            X, y, test_size=0.2, random_state=42
        )
        
        # XGBoost model
        self.model = xgb.XGBClassifier(
            n_estimators=100,
            max_depth=6,
            learning_rate=0.1,
            scale_pos_weight=2,  # Imbalanced data
            random_state=42,
            early_stopping_rounds=10
        )
        
        # Train
        self.model.fit(
            X_train, y_train,
            eval_set=[(X_test, y_test)],
            verbose=False
        )
        
        # Evaluate
        y_pred = self.model.predict(X_test)
        y_prob = self.model.predict_proba(X_test)[:, 1]
        
        print(f"AUC-ROC: {roc_auc_score(y_test, y_prob):.4f}")
        print(f"Classification Report:\n{classification_report(y_test, y_pred)}")
        
        return self.model
    
    def predict_pd(self, customer_data):
        """
        Predict Probability of Default for a customer
        """
        features = self.engineer_features(customer_data)
        pd = self.model.predict_proba(features)[0, 1]
        return pd

Cash-Flow Metrics:

1. Income Metrics:
   - Total income
   - Income stability (std deviation)
   - Income frequency
   - Income sources diversity

2. Expense Metrics:
   - Total expenses
   - Essential vs. discretionary spending
   - Spending volatility
   - Category distribution

3. Cash Flow Metrics:
   - Net cash flow (income - expenses)
   - Cash flow stability
   - Savings rate
   - Debt service coverage ratio

4. Behavioral Metrics:
   - Payment history
   - Overdraft frequency
   - Late payment patterns
   - Merchant diversity

5. Lifecycle Metrics:
   - Account age
   - Transaction frequency
   - Relationship depth
   - Product penetration

Thin-File Consumer Assessment:

Traditional Approach:
- No credit history → No credit score → No loan

Open Finance Approach:
- Access to bank transaction data
- Analyze cash flow, spending, savings
- Build alternative credit score
- Extend credit to thin-file consumers

Benefits:
- Financial inclusion
- Access to credit for underserved populations
- Lower default rates (cash-flow-based lending)
- Competitive advantage for lenders