System Design: End-to-End Loan Application Platform

Context

You are designing a scalable, compliant loan origination platform for a small lending startup. The platform must support unsecured term loans to small businesses and consumers. Assume peak traffic of 2k applications/day (burst 5 req/s), decisions within minutes, and funding within hours. Design for horizontal scalability and vendor replaceability.

Requirements

Design the system to cover:

1. User Experience and Product Selection
   • Browse loan products (amount, term, APR ranges, eligibility hints).
   • Pre-qualification (soft credit / cashflow pre-check) with user consent.
   • Multi-device, save-and-resume application.
2. Application Intake
   • Capture applicant identity, business info, income/cashflow, purpose, documents.
   • KYC/CIP and AML/OFAC screening.
   • Consent management (FCRA, credit pull authorization, bank data access).
   • Document upload and bank-link (e.g., via an aggregator).
3. Underwriting Workflow (Internal)
   • Orchestrate tasks: credit pull, bank-statement fetch, identity checks, fraud screens.
   • Rule engine + ML scoring, with manual review queue and analyst console.
   • Audit trail and reason codes.
4. External Integrations
   • Credit history/bureau(s) for soft/hard pulls.
   • Bank-statement/cashflow aggregation (read-only).
   • Payments rails for disbursement (ACH/wire) with webhooks.
5. Decisioning and Offer
   • Risk scoring and credit policy; approve/deny/conditional.
   • Pricing and limit assignment; compute amortization schedule.
   • Adverse action notices and ECOA-compliant reasons.
6. Funding/Disbursement
   • E-sign, KBA, vaulting of agreements.
   • Idempotent payouts, internal ledger, reconciliation.
   • Status tracking and notifications.

Non-Functional and Compliance

• PII security (encryption at rest/in transit), key management, RBAC.
• Idempotency, retries, circuit breakers for vendor calls.
• Observability, audit logs, data retention, GDPR/CCPA delete.
• Feature flags and phased rollout.

Deliverable

Describe the architecture, data model at a high level, critical APIs, eventing/queues, workflow states, failure handling, and how you would scale. Include key trade-offs and assumptions. Provide at least one small numeric example for pricing/decisioning.