Design loan application system

Q: Design loan application system

This question evaluates architecture and systems engineering competencies related to building scalable, compliant financial platforms, including data modeling, API and event-driven workflow design, security, and regulatory integration.

Q: How do I approach System Design interview questions?

System Design questions require understanding of core concepts and practice. PracHub provides solutions with explanations to help you master system design interviews.

Question

System Design: End-to-End Loan Application Platform

Context

You are designing a scalable, compliant loan origination platform for a small lending startup. The platform must support unsecured term loans to small businesses and consumers. Assume peak traffic of 2k applications/day (burst 5 req/s), decisions within minutes, and funding within hours. Design for horizontal scalability and vendor replaceability.

Requirements

Design the system to cover:

User Experience and Product Selection
- Browse loan products (amount, term, APR ranges, eligibility hints).
- Pre-qualification (soft credit / cashflow pre-check) with user consent.
- Multi-device, save-and-resume application.
Application Intake
- Capture applicant identity, business info, income/cashflow, purpose, documents.
- KYC/CIP and AML/OFAC screening.
- Consent management (FCRA, credit pull authorization, bank data access).
- Document upload and bank-link (e.g., via an aggregator).
Underwriting Workflow (Internal)
- Orchestrate tasks: credit pull, bank-statement fetch, identity checks, fraud screens.
- Rule engine + ML scoring, with manual review queue and analyst console.
- Audit trail and reason codes.
External Integrations
- Credit history/bureau(s) for soft/hard pulls.
- Bank-statement/cashflow aggregation (read-only).
- Payments rails for disbursement (ACH/wire) with webhooks.
Decisioning and Offer
- Risk scoring and credit policy; approve/deny/conditional.
- Pricing and limit assignment; compute amortization schedule.
- Adverse action notices and ECOA-compliant reasons.
Funding/Disbursement
- E-sign, KBA, vaulting of agreements.
- Idempotent payouts, internal ledger, reconciliation.
- Status tracking and notifications.

Non-Functional and Compliance

PII security (encryption at rest/in transit), key management, RBAC.
Idempotency, retries, circuit breakers for vendor calls.
Observability, audit logs, data retention, GDPR/CCPA delete.
Feature flags and phased rollout.

Deliverable

Describe the architecture, data model at a high level, critical APIs, eventing/queues, workflow states, failure handling, and how you would scale. Include key trade-offs and assumptions. Provide at least one small numeric example for pricing/decisioning.