logo

Alliance Bank builds Digital SME lending engine around fraud controls and financial capability

Alliance Bank builds Digital SME lending engine around fraud controls and financial capability

Kevin Shum, Head, Digital SME, Business Transformation and Merchant Acquiring, Group Business and Transaction Banking at Alliance Bank Malaysia, set out how the bank is scaling a “Digital SME” business with bank-statement-led underwriting, faster approvals and targeted programmes to help smaller firms improve credit readiness while keeping losses within defined limits.

Alliance Bank Malaysia is positioning its small and medium-sized enterprise (SME) franchise as a core earnings engine rather than a peripheral growth segment. In September 2025, the bank reported an SME loan book of MYR 25.52 billion (about $5.43 billion) and year-on-year growth of 8.7%, ahead of estimated industry growth of around 5.5%. SMEs contributed 37.8% of total bank revenue, with SME return on equity (ROE) of 13.0% and return on assets (ROA) of 2.0% ending March 2025, alongside reported SME non-performing loans (NPLs) of 1.6% as of September 2025.

At the same time, operating leverage remains a live issue. Gross SME banking revenue increased to MYR 470.3 million (about $100.1 million) as of September 2025 from MYR 431.8 million (about $91.9 million) in the prior period, but the SME cost-to-income ratio rose to 45.4% from 43.3% in September 2024. The bank’s challenge is to sustain balance-sheet and revenue growth while pulling efficiency improvements through the operating model rather than relying on headcount-heavy servicing.

Within this franchise, Kevin Shum, Head of Digital SME Business Transformation and Merchant Acquiring, Group Business and Transaction Banking at Alliance Bank Malaysia, described “Digital SME” as both a business and a channel. He framed it as a response to the economics of serving smaller SMEs where a traditional relationship-manager model is hard to justify on cost-to-income grounds. He also positioned Digital SME as a deliberate strategic choice made inside a fully licensed bank rather than through a separate digital bank licence route, with a focus on building a profitable, scalable lending and onboarding engine that can originate new-to-bank customers.

Shum’s account of the operating model centred on three linked design decisions: making bank statements the primary input for underwriting and financial coaching, embedding fraud detection rules into the front-end of the journey and tightening the acceptance cycle rather than optimising only for disbursement speed. He also described how the bank used programmes, education and tailored credit pathways to move smaller firms from “not ready for credit” into a position where they could qualify and build a credit history.

He discussed how Alliance Bank’s Digital SME business is being built, what it is trying to solve and where the remaining constraints and trade-offs sit as the bank moves from early success into broader scale.

Digital SME as a “bank within a bank” with a separate profit and loss discipline

Shum described Alliance Bank’s business banking as comprising three segments: Digital SME, SME and commercial. He characterised the Digital SME segment as previously “non-existent” and built up over the past four years to address the economics of serving smaller enterprises that do not fit comfortably into a relationship-managed cost structure.

He said the bank treated Digital SME as a “bank in a bank”, with a separate profit and loss (P&L) view and cost centre discipline, because the unit was expected to demonstrate profitability rather than be subsidised indefinitely. He said the bank had to report performance in a way that made costs and returns visible and comparable, including the extent to which the digital engine could originate and service loans without escalating headcount.

Shum linked this structure to the internal pressure he faced early on when the bank needed the Digital SME proposition to become commercially viable within a short timeframe. He said this shaped the initial product focus, which leaned towards “clean” loans because the economics were easier to prove, before expanding the product shelf as origination capability improved and the bank developed more confidence in its risk controls.

He said Alliance Bank made a conscious decision not to apply for a digital bank licence and instead built a digital SME proposition within the bank. He contrasted this with the local context where digital bank licences were issued to serve the underserved and unserved segments, citing the emergence of new digital banks in Malaysia as part of the competitive backdrop.

Shum’s framing positioned Digital SME as an operating model and distribution channel that could originate a broader set of SME products, rather than a narrow digital loan product. He described the ambition as running digital marketing and partnerships to bring customers into the bank while maintaining underwriting discipline through data-led decisioning and structured control steps.

Building the Digital SME book through product mix, risk-sharing and early-life-cycle underwriting

Shum said the Digital SME book had grown to MYR 660 million (about $140.5 million) as of December 2025, compared with MYR 628 million (about $133.6 million) from September 2025. He described the early phase as focused on clean loans with a net interest margin of around 10%, but said those clean loans represented around MYR 120 million (about $31.9 million) of the MYR 660 million, with the remainder a mix of secured and scheme-supported lending.

He explained that the mix included significant property financing and participation in government guarantee schemes, including Credit Guarantee Corporation (CGC) structures. He described a focus on financing SMEs with as little as six months of business operations, positioning the bank as an early mover in that risk tier, and said this was paired with CGC support to manage risk-sharing, albeit with guarantee fees that raised the all-in cost.

Shum said the bank took an additional step by using 50% guarantee coverage for this segment, rather than higher guarantee cover that might apply to larger, more established businesses. He presented this as a deliberate balance between risk-taking and discipline, with the bank choosing to finance earlier-stage businesses but not fully offloading the risk.

He said this early-life-cycle focus was driven by a structural gap: startups and small SMEs often lack credit history, face repeated rejections and receive little feedback on why they do not qualify. He positioned Alliance Bank’s approach as trying to “fix” the earliest stage of the SME business life cycle by combining underwriting, coaching and gradual credit-building.

Shum also described Digital SME as an origination channel that could bring in larger deals, including loans beyond smaller ticket sizes, with a team that could “go out and close the deal” where legal documentation and assisted processes were required. He said the digital engine was therefore not limited to one product but could originate multiple lending products and drive cross-sell into other services.

Bank-statement-led underwriting as both fraud control and credit coaching

A core pillar of Shum’s narrative was the “financial health report”, which he described as a newly launched tool that requires SMEs to upload a six-month bank statement to receive an analysis of their financial strength. He said the tool assessed two dimensions at the front end: fraud and credit, and that the bank would not proceed with the report if fraud indicators were triggered.

He said the bank performed checks to detect whether a bank statement had been altered or tampered with. Where possible fraud is identified, the bank will keep records of the applicant’s information such as email addresses for blacklist purposes. He also described additional fraud checks beyond the surface report, including detection rules designed to identify “made up” statements.

Shum explained that the bank’s fraud approach depended on metadata embedded in the digital document, which created challenges when SMEs printed statements and re-scanned them before uploading, which results in the loss of the digital metadata. He said the bank was therefore pushing customers towards downloading and uploading digital copies rather than printing, stamping and scanning, because the latter workflow degraded the evidence trail the bank relied on to validate documents.

He also described balance reconstruction as a control step, explaining that even if figures were altered, the bank could run reconstruction rules across the statement to detect inconsistencies. He described this rules-driven approach as part of an in-house “bank statement analyser” built with a vendor, and he contrasted it with off-the-shelf solutions used in the market, positioning the bank’s build as more tailored to banking decisioning.

Shum linked the same bank-statement analysis to credit coaching. He said banks often reject applications without explaining why, but he framed the financial health report as a way to show SMEs what was lacking and what needed to be improved to qualify for credit, including measures such as average monthly balance, cash flow patterns and transaction consistency. He also described using indicators, such as foreign currency transaction patterns, to flag cross-sell opportunities that relationship managers could follow up on.

From “speed to disbursement” to “speed to acceptance” and controlling loss outcomes

Shum said the bank used an internal bank statement score to support credit decisioning, which enabled an approval-in-principle within about 10 minutes for loans up to MYR 500,000 (about $106,000). He contrasted this with the industry emphasis on “speed to disbursement”, arguing that the more critical metric was “speed to acceptance” because SMEs that do not accept an approved loan will shop around and may not convert.

He said the bank could disburse within 24 hours, but he described structuring the process so that the customer opened an account and disbursement went into that account. He framed this as both a control and relationship strategy, because the bank wanted visibility into transaction behaviour after disbursement to understand usage patterns and monitor risk and engagement.

Shum said the bank statement analyser helped filter out weak applications, allowing staff time to be focused on what he described as “control work” rather than manual document processing. He quantified the operational shift as moving from around MYR 3 million (about $638,000) of monthly clean loan disbursement earlier in the build-out to around MYR 10 million (about $2.13 million) per month with the same number of staff after implementing the analyser.

He connected this productivity gain to portfolio outcomes, citing gross impairment levels of around 1% in the Digital SME portfolio, compared with a typical 6% to 8% for similar high-yield portfolios. He linked this to how the bank combined automated filtering with a human control step rather than attempting to remove staff involvement entirely.

Shum described that human control step as a templated 15-minute virtual interview for every application, with relationship managers asking a structured set of questions that mattered for risk assessment. He positioned this as a practical way to validate the business and the narrative behind the numbers, especially for newer SMEs where financial statements and history were limited.

Using programmes and tailored credit pathways to build “credit readiness” and inclusion

Shum spent time describing how the bank treated financial inclusion as a design choice in credit architecture rather than a peripheral initiative. He described the problem that startups and small SMEs often do not understand the implications of credit behaviour and may have weak personal credit hygiene even when their business ideas are sound.

He gave an example from a programme pipeline where a business could be commercially promising but still fail conventional credit checks due to personal credit card utilisation and minimum-balance repayment behaviour. He described coaching and restructuring to help improve credit positioning, as well as a staged approach where a smaller facility could be extended first, followed by a term loan if servicing behaviour was prompt over time.

He described a wider ecosystem approach for SMEs that were not yet ready for loans. He said that if SMEs did not qualify, the bank could route them into sessions aimed at strengthening financial management. He described this as an “education” pathway, aimed at improving financial discipline so that future borrowing could be approved on more conventional terms.

Shum described a programme he called the “BizSmart Challenge”, which he compared to a “Shark Tank” style model, with cash awards and prize money, and involvement from venture capital (VC) and private equity (PE) participants, as well as references to grants. He framed it as a way to surface SMEs that might not qualify for bank credit but could access other funding sources or structured support.

He also described the bank crafting special policies for certain groups to grant limited credit facilities specifically to help them build a credit history. He framed this as addressing a structural barrier where startups are repeatedly denied credit because they have no borrowing track record, which then prevents them from ever building one under conventional underwriting rules.

Where the economics still need to tighten as scale increases

While Alliance Bank’s SME franchise may appear to be growing ahead of the market, it also faces an efficiency challenge, with the SME cost-to-income ratio rising to 45.4% in September 2025. Shum’s account of the operating model provides a plausible path to reversing this through automation, filtering and control redesign, but it also implies that the bank is still in the transition phase where capability build-out can add cost before leverage shows up.

Shum’s data points on the Digital SME engine suggest improved productivity and loss outcomes, but the scale of Digital SME remains small relative to the total SME book. At MYR 628 million (about $133.6 million) in September 2025, and MYR 660 million (about $140.5 million) in December 2025, Digital SME is still a low single-digit share of the MYR 25.52 billion (about $5.43 billion) SME book, which raises questions about what the binding constraints are on faster migration of origination into the digital engine.

He also positioned the model as dependent on combining automation with disciplined human validation steps such as templated virtual interviews. That implies a scaling challenge: maintaining the integrity of control work while increasing volumes, without reintroducing the same cost structure that Digital SME was designed to avoid.

Shum’s focus on “speed to acceptance” also implies that competition is not just about approval speed but about creating enough confidence and perceived value for SMEs to accept quickly. That places emphasis on trust, transparency and the ability to explain credit outcomes and coaching steps in ways SMEs can act on.

Finally, Shum’s narrative suggests that inclusion and risk discipline are being held together through structured policy choices, scheme partnerships and front-end fraud controls. As the bank moves into its next phase of strategy, the test will be whether these choices remain effective when volumes increase, economic conditions tighten or competitors replicate similar underwriting toolkits.

Scaling discipline without losing inclusion intent

Shum framed Alliance Bank’s Digital SME build as a response to a hard economic problem: serving smaller SMEs at a cost base that does not collapse margin and returns. He described Digital SME as a business with its own P&L accountability, intended to prove commercial viability rather than operate as an experimental channel.

He set out a control-led operating model where bank statements anchor both fraud detection and credit assessment, with in-house rules and reconstruction checks designed to reduce document risk before underwriting proceeds. He positioned this as an attempt to bring discipline to a segment that is often treated as either too risky to serve or only viable through aggressive pricing.

He described a credit workflow built around faster acceptance cycles, with a 10-minute approval-in-principle for loans up to MYR 500,000 (about $106,000), combined with the insistence on account opening and visibility into post-disbursement transaction flows. He linked these design choices to how the bank tries to win commitment from SMEs quickly while tightening monitoring and engagement.

He also described inclusion not as a slogan but as an operating choice: giving SMEs feedback on credit readiness, routing “not yet eligible” firms into education and capability-building and crafting staged credit pathways so that firms can build credit history rather than remain permanently excluded.

The remaining question for the franchise is whether the Digital SME engine can move from a high-performing specialist unit into a primary origination and servicing backbone for the wider SME portfolio, and whether that transition can reverse the cost-to-income pressure highlighted in the bank’s own performance data without diluting underwriting discipline or the inclusion intent that Shum described.