Credit Risk Modelling with AI: A Guide for Malaysian Lenders
AI can make a credit risk model more sensitive, but in Malaysia it only earns its place if it can be explained, validated independently and owned by senior management. The models that reach production are rarely the ones with the highest accuracy score. They are the ones a risk committee, an auditor and Bank Negara Malaysia (BNM) can all understand and challenge.
This guide is for risk, credit and technology leaders at banks, insurers and non-bank lenders who want to know how to build a credit risk model with machine learning, where it fits beside existing scorecards, and what has to be in place before a model touches a lending decision.
TL;DR
A credit risk model turns borrower data into estimates of default likelihood and loss. In regulated lending, that means Probability of Default (PD), Loss Given Default (LGD) and Exposure at Default (EAD).
Machine learning usually supplements traditional statistical models rather than replacing them. Ensembles often predict better, but they demand more rigorous validation.
BNM expects independent validation, documentation, audit trails, back-testing and human accountability. Explainability is a condition of approval, not a feature.
Fairness testing, data governance and monitoring decide whether a model survives its first year in production.
The strongest programmes plan strategy, build and operation together, so the model is not orphaned after go-live.
Table of Contents
What a credit risk model actually produces
A credit risk model converts information about a borrower into an estimate of how likely default is and how much would be lost if it happened. Risk Hub’s course material describes the output as the components of expected loss.
Those components are the three that Malaysian lenders already know:
PD is the probability that a borrower defaults over a defined horizon.
LGD is the share of the exposure lost after default, net of recoveries.
EAD is the amount outstanding at the moment of default, which matters most for revolving lines and credit cards.
BNM’s credit risk policy document sets out the expectation that financial institutions measure credit risk robustly, so that they hold a complete and accurate view of the portfolio’s risk profile. AI does not change what has to be estimated. It changes how the estimates are produced, and how much evidence the institution must keep about that process.
That distinction matters when planning. A team that starts with “which algorithm?” has begun in the wrong place. The better starting question is which decision the model supports: application scoring, behavioural scoring, early warning, collections prioritisation, or provisioning under MFRS 9. Each has a different tolerance for complexity, a different validation burden and a different owner.
Where machine learning adds value over traditional scorecards
Logistic regression scorecards remain popular for good reasons. They are transparent, stable and easy to document. Machine learning earns its place where relationships are non-linear, where data is richer than a bureau file, or where a portfolio is changing faster than an annual redevelopment cycle can follow.
A systematic literature survey of statistical and machine learning models in credit scoring highlights that ensemble classifiers outperform single classifiers, and that non-transparency is a recurring concern. A more recent systematic review in Artificial Intelligence Review covers the same terrain for machine learning credit scoring.
In practice, three use cases tend to justify the effort.
Thin-file and underserved segments. BNM’s discussion paper on AI in the financial sector notes that responsible AI in scoring could help providers serve unserved and underserved segments, including customers with thin files. For Malaysian lenders with large MSME and first-time-borrower books, this is the most commercially interesting case.
Challenger models beside an incumbent scorecard. A gradient-boosted model run in parallel can show where the scorecard is leaving risk separation on the table, without being given authority over decisions on day one.
Early warning and monitoring. Models that read transaction behaviour can flag deterioration before a missed payment, giving relationship managers time to act.
What the evidence does not support is the idea that AI makes the old approach obsolete overnight. The practical standard is hybrid: traditional statistical models supplemented by machine learning for greater risk sensitivity.
What BNM expects from AI-driven credit models
Malaysia has no single “AI credit scoring rulebook”. Expectations come from several places, and they point in the same direction.
Independent validation and documentation
BNM’s credit risk policy expects models to be validated by parties independent of the development team, to confirm conceptual soundness and fitness for purpose. It also expects clear documentation and audit trails. AI and machine learning methods are not prohibited, but the burden of proof sits with the institution.
For teams new to this, our own guide to ML model validation walks through what an independent reviewer will want to see, and the article on model risk management lifecycle controls shows where validation sits inside the wider framework.
Human accountability
In August 2026, reporting on a speech by BNM’s governor made the position plain: as models grow more complex, institutions must be able to explain outcomes, challenge automated decisions and remain accountable for them, and that responsibility cannot be delegated to an algorithm. Boards and senior management own the result.
For credit, this has a design consequence. A fully automated approve-or-decline pipeline with no route for human override is difficult to defend. A model that recommends, with reasons, and a credit officer who can see those reasons and disagree, is far easier to defend.
Ongoing monitoring
BNM’s Financial Stability Review for the second half of 2022 found many Malaysian providers already using AI and machine learning, mostly in customer analytics and engagement, with credit underwriting applications limited to specific portfolios. The same material points to periodic back-testing and performance monitoring, with remedial actions defined for weaknesses. A model is a living asset, and its drift needs an owner.
A regulatory direction of travel
BNM has also consulted on future AI regulation. A law firm summary of the discussion paper notes that it is non-binding but signals BNM’s forward-looking posture, and that it invites feedback on the scope of future rules, risks and the adequacy of existing frameworks. Institutions building today should design for stricter expectations, not looser ones. For the data side, see our overview of Malaysia’s AI and PDPA rules.
How to build a credit risk model with machine learning
The sequence below reflects how production-grade models are actually delivered. The order matters more than the tooling.
1. Define the decision and the target
Decide what the model will be used for and what “default” means for that purpose. A 90-days-past-due definition for a retail PD model is not the same as the stage-transfer logic used for MFRS 9 provisioning. Misaligned definitions are one of the most common reasons a technically good model cannot be used.
2. Check the data before choosing the algorithm
Assess history length, label quality, missing values, changes in underwriting policy and any data you may not lawfully use. Lending portfolios often carry hidden breaks: a product repriced, a channel launched, a collections policy changed. A model trained across such a break learns the policy, not the borrower.
This is the stage where a readiness and data diligence review pays for itself. Our Readiness & Data Diligence service exists for exactly this question: is the data good enough to support the model the business wants?
3. Build a transparent baseline first
Fit a scorecard or regularised regression before anything else. It sets the performance floor and the benchmark against which any complex model must justify itself. If gradient boosting adds a modest uplift but costs you explainability, the trade may not be worth it.
4. Develop challenger models
Try tree-based ensembles and, where the data supports it, other methods. Researchers note that hybrid ensembles frequently deliver higher predictive accuracy than single algorithms, but that their complexity demands more rigorous validation. The same body of work advises against chasing performance metrics alone. Alignment with MFRS 9 requirements and the institution’s risk appetite should weigh as heavily as the Gini coefficient.
5. Build explainability in from the start
Practitioners report that the hardest part of adoption is often not performance but translating model output into a form that satisfies auditors, regulators and internal risk committees. Techniques such as SHAP and LIME are widely used for this, as the Springer review discusses. Explanations should be generated per decision, stored with the decision, and written in terms a credit officer and, where relevant, a customer can follow.
6. Test for bias and stability
A frequent misconception is that AI automatically produces unbiased results. It does not. Models can amplify existing bias when training data is not carefully curated, which is why BNM guideline commentary stresses fairness and bias-detection testing, particularly across diverse demographics like Malaysia’s. Test outcomes by segment, examine proxy variables, and decide in advance what disparity would trigger redevelopment.
7. Validate independently
Hand the model, its documentation and its code to a team that did not build it. Expect challenge on sampling, variable selection, calibration, stability over time and the reasonableness of explanations. Fix what is found, and keep the record.
8. Deploy with monitoring and a defined response
Production deployment is where many projects stop being managed. Set thresholds for drift and performance decay, agree who is alerted, and define what happens next: recalibrate, restrict, or retire. Back-testing should be scheduled, not discretionary.
Traditional, machine learning and hybrid approaches compared
Criterion | Traditional scorecard | Machine learning model | Hybrid approach |
Explainability | High, built into the structure | Needs added tooling such as SHAP | Scorecard for decisions, ML for insight and challenge |
Predictive power on complex data | Limited by linear structure | Typically stronger, especially ensembles | Captures most of the uplift with controlled risk |
Validation effort | Established and familiar | Heavier, with more to test | Moderate, staged by use |
Regulatory comfort | Well understood | Requires stronger evidence | Easiest path for most lenders |
Maintenance | Annual redevelopment cycle | Needs active drift monitoring | Both disciplines required |
For most Malaysian lenders today, the hybrid column is the realistic destination. It allows the institution to demonstrate value from machine learning while keeping a defensible, explainable core.
Why credit AI projects stall
The technical work is rarely the cause. Four patterns recur.
The model is built by one team and handed to another. Assumptions, data quirks and caveats are lost in the handoff, and the operating team inherits something it cannot confidently maintain. The cost compounds with every quarter of drift.
Explainability is added at the end. A model designed as a black box and then decorated with explanations tends to fail review. A model designed with its explanations in mind passes more easily.
Governance is treated as paperwork. Model inventories, risk tiering, approval gates and change control are what let a board stand behind a model. They need to exist before the first deployment.
Data governance is unresolved. Using customer data for new model purposes raises consent, retention and purpose questions. Our mapping of AI data governance against ISO/IEC 42001 and Malaysia’s PDP requirements covers the controls to settle first.
Our perspective: own the model from strategy to operation
We see the same gap across enterprise AI work. Strategy is written by one party, the model is engineered by a second, and operations are left to a third, or to nobody. In credit, that gap is dangerous, because the regulator’s question is not who built the model but who is accountable for it today.
Our view is that a credit model should be engineered for production from the first week. That means deciding early how it will be monitored, how its decisions will be explained, who signs off on changes and what the audit trail will contain. It means choosing the simplest approach that meets the business target, and treating a marginal accuracy gain as a cost if it makes validation harder.
We also think lenders should resist the pressure to automate the final call. BNM has been clear that accountability stays with senior management. The best use of AI in credit is to give underwriters and risk committees better evidence, faster, with reasons they can examine and overrule.
Finally, measure the result in business terms: loss rates, approval quality, time to decision, provisioning accuracy and operating cost. A model that scores well in a notebook and moves none of those is not finished.
— Thomas Samuel
Where Sentient Concepts fits
Sentient Concepts is an end-to-end AI firm: one senior team owns strategy, build and operation, so the people who design a model are the ones accountable for running it. For lenders, that spans AI Strategy & Roadmap, data and platform engineering, AI & GenAI solutions, deployment and MLOps, and managed operations with monitoring and evaluation. You can see how this applies to the sector on our banking and finance page, or browse the full list of services.
Credit decisions also depend on documents: income statements, facility letters, collateral records. If manual document handling slows your underwriting, our piece on audit-ready loan document classification shows how the front end of the credit process can be automated with the same governance discipline.
Questions to settle before you start
Before commissioning a model, a credit or risk leader should be able to answer each of these in writing.
Which decision does the model support, and who is the accountable owner? Which data will feed it, and are you permitted to use it for this purpose? What is the baseline it must beat, and by how much? Who will validate it independently, and when? What will the monitoring thresholds be, and what action follows a breach? How will a credit officer see, and override, the model’s reasoning?
If several of these remain open, a readiness and use-case prioritisation exercise will save more than it costs. It is cheaper to learn that a portfolio lacks usable default history before development than after.
FAQ
What is AI-based credit scoring?
AI-based credit scoring uses machine learning to estimate a borrower’s likelihood of default from a wider range of data than a traditional scorecard typically uses. The output is still a risk estimate that feeds a lending decision. In regulated settings it must come with explanations, validation and monitoring.
Can Malaysian banks use machine learning for PD, LGD and EAD models?
Yes. BNM’s credit risk policy does not bar AI or machine learning methods, but it expects independent validation, clear documentation and audit trails. Institutions should also be able to show that the model is conceptually sound and fit for its purpose.
Does AI make credit decisions fairer?
Not automatically. Models can reproduce or amplify bias present in historical data. Fairness testing across customer segments, review of proxy variables and ongoing monitoring are needed to show that a model treats borrowers consistently.
Can credit decisions be fully automated in Malaysia?
BNM has stressed that boards and senior management remain accountable for AI-driven decisions and that responsibility cannot be handed to an algorithm. For higher-stakes credit decisions, a human-in-the-loop design is the safer approach. Automation can still support routine, low-risk decisions under clear governance, but confirm the position with your compliance function and BNM’s current requirements.
How long does it take to build a credit risk model with AI?
It depends on data readiness, the scope of the decision and the validation cycle, so no honest figure applies to every lender. The data diligence and independent validation steps, rather than model training, are usually where the time goes. A short readiness review is the most reliable way to size the work.
Sources
BNM, Artificial Intelligence in the Financial Sector discussion paper
Metropolitan Asia, BNM governor on human accountability for AI decisions
Springer, Machine learning powered financial credit scoring: a systematic literature review
ScienceDirect, Statistical and machine learning models in credit scoring
Recommended