System Design: End-to-End Loan Application Platform
Context
You are designing a scalable, compliant loan origination platform for a small lending startup. The platform must support unsecured term loans to small businesses and consumers. Assume peak traffic of 2k applications/day (burst 5 req/s), decisions within minutes, and funding within hours. Design for horizontal scalability and vendor replaceability.
Requirements
Design the system to cover:
-
User Experience and Product Selection
-
Browse loan products (amount, term, APR ranges, eligibility hints).
-
Pre-qualification (soft credit / cashflow pre-check) with user consent.
-
Multi-device, save-and-resume application.
-
Application Intake
-
Capture applicant identity, business info, income/cashflow, purpose, documents.
-
KYC/CIP and AML/OFAC screening.
-
Consent management (FCRA, credit pull authorization, bank data access).
-
Document upload and bank-link (e.g., via an aggregator).
-
Underwriting Workflow (Internal)
-
Orchestrate tasks: credit pull, bank-statement fetch, identity checks, fraud screens.
-
Rule engine + ML scoring, with manual review queue and analyst console.
-
Audit trail and reason codes.
-
External Integrations
-
Credit history/bureau(s) for soft/hard pulls.
-
Bank-statement/cashflow aggregation (read-only).
-
Payments rails for disbursement (ACH/wire) with webhooks.
-
Decisioning and Offer
-
Risk scoring and credit policy; approve/deny/conditional.
-
Pricing and limit assignment; compute amortization schedule.
-
Adverse action notices and ECOA-compliant reasons.
-
Funding/Disbursement
-
E-sign, KBA, vaulting of agreements.
-
Idempotent payouts, internal ledger, reconciliation.
-
Status tracking and notifications.
Non-Functional and Compliance
-
PII security (encryption at rest/in transit), key management, RBAC.
-
Idempotency, retries, circuit breakers for vendor calls.
-
Observability, audit logs, data retention, GDPR/CCPA delete.
-
Feature flags and phased rollout.
Deliverable
Describe the architecture, data model at a high level, critical APIs, eventing/queues, workflow states, failure handling, and how you would scale. Include key trade-offs and assumptions. Provide at least one small numeric example for pricing/decisioning.