Inside the credit decision: how a lender says yes or no

Next update. The Reserve Bank's next decision on the cash rate is due on 3 November 2026. We will update the rates and figures in this article after it.

From the outside, a business loan looks like one decision: the bank said yes, or it said no. Inside a lender it is a chain of smaller decisions, made by different people, each testing something different. The relationship manager who takes the first call does not approve the loan. Any valuation of the security has to be independent of both the people who bring the loan in and the people who approve it. If the loan goes wrong, a workout team kept apart from the one that made it takes over.¹

This article follows a business loan through that chain, for owners, directors and investors who deal with lenders but have not worked inside one, with a model of debt service cover to adjust along the way. The loan products, and how lenders size a loan, are in Part 4; security, guarantees and default are in Part 6.

Past due, at which a bank loan is non-performing under APS 220 if it is not already

90 days

APRA

Share of banks' non-performing business loans considered well secured in June 2026, against over 90% for housing

Over 50%

RBA

Minimum notice a bank bound by the Banking Code gives a small business that is not in default before it declines to extend a loan with a balance due at expiry

3 months

Banking Code of Practice

Twelve stages, and the people in them

On the borrower's side of a business loan are the owners, usually their accountant and sometimes a finance broker. On the lender's side, a relationship manager brings the loan in and stays the main contact, a credit analyst builds the financial case, approvers with authority for loans up to a certain size and complexity decide, a valuer values any property offered as security, lawyers prepare the documents and, if the loan later runs into trouble, a separate team takes it over.

Small, standard loans compress these roles, sometimes into a system. ANZ says its GoBiz online lending can give conditional approval in minutes and full approval within two business days, subject to its team verifying the information and checking the business's existing account conduct (page modified 8 September 2026).³ Larger and less standard loans take the long way, through the stages below. The references are to APRA's standard on credit risk, APS 220, and to the commitments of the banks that have adopted the Banking Code of Practice, called Code banks here; both are explained further on.

Threefold Capital interpretation

How a lender decides on a business loan, stage by stage

1. 1

   Stage 1 of 12

   Enquiry and first conversation

   Who is involved

   The owners, a bank relationship manager, sometimes a finance broker.

   How long

   Days

   What happens

   The borrower explains what the money is for, how much is needed, over what period and how it will be repaid. The lender's first question is whether the request fits its appetite at all.

   What the borrower provides

   A short description of the business, the purpose and amount, recent results and existing debts.

   What the lender checks

   Whether the industry, purpose, size and security fall within the risk the lender is willing to take, which its strategy must describe by type of loan, industry, location, currency and maturity (paragraph 23).

   What to watch for

   A request with no clear purpose, or one sized to what the owners want rather than what the business can repay.

2. 2

   Stage 2 of 12

   Preliminary assessment

   Who is involved

   The relationship manager, sometimes with an early view from credit.

   How long

   Days

   What happens

   A first test of whether the numbers could work: rough debt service cover, the security available and the owners' own money in the business. Any indication of terms at this stage is not an approval.

   What the borrower provides

   The latest financial statements and management accounts, and a list of debts.

   What the lender checks

   Rough capacity to repay, and any obvious obstacle in the lender's policy, such as the industry, the time in business or the credit history.

   What to watch for

   Treating an indication as an approval, and figures that change later.

3. 3

   Stage 3 of 12

   Application and documents

   Who is involved

   The borrower, its accountant, the relationship manager or a broker.

   How long

   Days to weeks, depending on how ready the documents are

   What happens

   The formal application. A Code bank tells a small business what information it requires and, once it has it, how long a decision is likely to take (Banking Code, paragraph 76).

   What the borrower provides

   Financial statements, tax returns, BAS and ATO portal statements, management accounts, bank statements, forecasts, leases and contracts, and the directors' own financial details.

   What the lender checks

   That the file is complete, and that the figures in the different documents agree.

   What to watch for

   An incomplete file stops the clock, because the Code's estimate runs from when the bank has what it asked for.

4. 4

   Stage 4 of 12

   Identity and verification

   Who is involved

   The lender's operations and credit staff.

   How long

   Days

   What happens

   The lender confirms who it is dealing with, which the law requires of it: as a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, a lender must carry out initial customer due diligence before it provides a designated service, and making a loan in the course of a loans business is one, including identifying who ultimately owns or controls a company or trust (the Act's outline in section 4; "beneficial owner" in section 5; section 6, Table 1, item 6).⁴ It then checks what it has been told against independent records.

   What the borrower provides

   Identification for directors and guarantors and, for a company or trust, the details of anyone who owns 25% or more of it or controls it; company or trust documents; consent to credit checks; and access to bank and accounting data.

   What the lender checks

   Credit reports, bank statements and accounting data against the reported figures, and tax lodgements and any tax debt. The bank must take reasonable steps to verify income or cash flows, commitments and total debt (paragraphs 45(a) and (b), applied by paragraph 46).

   What to watch for

   Debts or tax arrears the application did not mention, and figures the bank statements do not support.

5. 5

   Stage 5 of 12

   Financial analysis

   Who is involved

   A credit analyst or credit officer.

   How long

   Days to weeks

   What happens

   The analyst rebuilds the business's earnings and cash flow, adjusts for one-off items, tests the forecast and runs the scenarios.

   What the borrower provides

   Answers to the analyst's questions, and evidence for any one-off items and large movements.

   What the lender checks

   Debt service and interest cover, debt against earnings, liquidity, working capital and the owners' equity, and repayment under higher rates and lower income (paragraphs 45(c) and 46).

   What to watch for

   Adjustments without evidence, forecasts far above the business's history, and dependence on one customer.

6. 6

   Stage 6 of 12

   Security and valuation

   Who is involved

   A valuer from the lender's panel, instructed by the lender and reporting to it, usually at the borrower's cost, and independent of the people who originate and approve the loan (paragraph 48; Attachment A, paragraphs 10 and 11).

   How long

   Days to weeks

   What happens

   Property or other assets offered as security are valued at fair value, independently (paragraphs 48 and 49), and before any money is drawn (Attachment A, paragraph 3). Guarantees are assessed for what they are worth.

   What the borrower provides

   Access to the property, leases and tenancy details, and details of any other assets offered.

   What the lender checks

   The value against the loan, the lender's limits on loan to value ratios (paragraph 52), title, other charges and insurance.

   What to watch for

   A valuation below the price paid or the owner's estimate, and a valuation the borrower commissioned, which is usually not relied on. A Code bank gives a small business a copy of a commercial property valuation the business paid for, unless enforcement has begun (Banking Code, paragraph 97).

7. 7

   Stage 7 of 12

   The credit paper

   Who is involved

   The credit analyst or relationship manager writes it; credit reviews it.

   How long

   Days

   What happens

   The case is written up: the request, the borrower, the numbers, the scenarios, the security, the risk grade, which sets the price and the approver, the proposed terms, any exceptions to policy and a recommendation.

   What the borrower provides

   Nothing new, ideally. The paper works with what the borrower has already supplied.

   What the lender checks

   That the loan meets policy, or that any exception is identified, justified and sent to the right approver (paragraphs 55 and 57).

   What to watch for

   An unanswered question goes into the paper as a risk.

8. 8

   Stage 8 of 12

   Approval

   Who is involved

   Usually two people, a business approver and an independent credit approver, each within a delegated authority, or a credit committee for the largest or least standard loans.

   How long

   Days to weeks

   What happens

   The approvers decide: yes, yes on changed terms, or no. Each loan has an approval authority suited to its size and complexity (paragraphs 54 and 55).

   What the lender checks

   Whether the risk is acceptable for the return, within the lender's appetite and limits.

   What to watch for

   Exceptions to policy need authority of their own and are reported (paragraphs 57 and 58). The relationship manager's support is one signature, not the decision. A Code bank that declines gives the general reason, unless it is reasonable not to (Banking Code, paragraph 81).

9. 9

   Stage 9 of 12

   Letter of offer and terms

   Who is involved

   The relationship manager, the borrower and its advisers.

   How long

   Days

   What happens

   The lender sets out the approved terms: amount, rate, fees, term, repayments, security, guarantees, covenants, reporting and conditions. A Code bank gives a small business a plain English summary of the key terms before it accepts (Banking Code, paragraph 80).

   What the borrower provides

   Acceptance, and questions on anything unclear.

   What the lender checks

   That the borrower accepts the terms as approved.

   What to watch for

   The price is set here, from the risk grade, often as a margin over a bank bill benchmark rate plus a line fee; an indicative rate from the first conversation is not a commitment. Also covenants and reporting the business cannot comfortably meet; the definitions decide how a covenant is measured.

10. 10

    Stage 10 of 12

    Conditions precedent and documentation

    Who is involved

    Lawyers or a documentation team on both sides, the borrower's accountant, and any guarantors.

    How long

    Days to weeks

    What happens

    Loan and security documents are prepared and signed, and each condition precedent in the offer is met before any money is advanced. Some conditions are allowed to follow settlement, as conditions subsequent with a date: audited accounts, a registered lease, insurance noting the lender. Missing one is a default like any other.

    What the borrower provides

    Signed documents and guarantees, insurance, evidence of the owners' contribution, and any consents from third parties such as a landlord.

    What the lender checks

    That every condition is met and every document is valid. A Code bank does not accept a guarantee until the third day after the guarantor receives the required information, with listed exceptions (Banking Code, paragraphs 112 and 113).

    What to watch for

    Conditions that depend on someone else, such as a landlord's consent, can take longest.

11. 11

    Stage 11 of 12

    Settlement and drawdown

    Who is involved

    The lender's settlements team, lawyers and the borrower.

    How long

    Once every condition is met

    What happens

    The loan is advanced, in one amount or in stages, and the security is registered.

    What the borrower provides

    Drawdown requests, and invoices or progress claims for loans drawn in stages.

    What the lender checks

    That the security is in place and valued, and that the money goes to the approved purpose.

    What to watch for

    The promises in the agreement apply from this day, including how the money may be used.

12. 12

    Stage 12 of 12

    Monitoring and annual review

    Who is involved

    The relationship manager and credit, with a watch list for a loan that slips and, if it keeps slipping, a separate workout team.

    How long

    The life of the loan

    What happens

    The lender monitors repayments, covenants, reports and security, regrades the borrower on each year's accounts and, for a facility that expires, decides afresh whether to renew it. The annual review of a term loan is monitoring, not a new decision: the lender cannot change a loan that is not in default unless the agreement gives it that right.

    What the borrower provides

    Annual accounts, covenant certificates and other reports the agreement requires, and anything promised as a condition subsequent, by its date.

    What the lender checks

    The borrower's current financial condition, covenants and collateral (paragraphs 62 and 63), and early signs of stress.

    What to watch for

    Late reports, a missed condition subsequent, and a facility due to expire. A Code bank gives a small business that is not in default at least three months' notice if it will not extend a loan whose balance is not fully repaid by its instalments (Banking Code, paragraph 93).

The stages are typical, not fixed: a small online loan can pass through several of them in minutes, and a large one may repeat some. Times are rough indications, not service standards. Paragraph numbers are those of APS 220 unless the Banking Code is named.

The rules behind the process: APS 220

Banks and the other authorised deposit-taking institutions (ADIs: banks, building societies and credit unions) decide on loans under APRA's Prudential Standard APS 220 Credit Risk Management, in force since 1 January 2023.⁵ It applies to every ADI other than purchased payment facility providers (paragraph 2).¹ It sets no interest rates, ratios or loan sizes, only how a bank must decide, from its overall appetite for risk down to a single loan in arrears. Non-bank lenders and private credit funds do not take deposits, so it does not bind them, but in our view it is still the clearest public description of how a careful lender thinks.

Its centre is paragraph 42: "An ADI must assess credit risk primarily on the strength of a borrower's repayment capacity. The ADI must not place undue reliance on collateral provided by the borrower as a substitute for a comprehensive credit assessment."¹ Security is the second way out, not the first, and the data shows how often it is not enough. In June 2026, over 90% of banks' non-performing housing loans were considered well secured, against over 50% of their non-performing business loans,⁶ so for close to half of the business loans in trouble the bank's recovery depends on something other than its security. In our view the gap reflects what business security often is: equipment, stock and debts owed to the business, which lose value quickly when a business fails, and property that may have to be sold in a weak market.

Around that principle sit "experienced credit judgement" (paragraph 41), verified figures, repayment tested under scenarios such as "an increase in interest rates" (paragraph 45) and, for a business, "the borrower's historical financial and future cash flows" and the equity invested (paragraph 46); the rest is separation and control, as the table sets out.¹

The standard also fixes when a loan is in trouble: past due "from the first day of missed payment", and non-performing once the bank considers the borrower unlikely to pay in full without realising its security, or once it is 90 days or more past due, "even if the collateral value exceeds the amount of the past-due exposure" (paragraphs 13 and 91).¹ What follows for a borrower in default is the subject of Part 6.

Reported data

What APS 220 requires of a bank's credit process

Paragraph	What it requires
2	Applies to every authorised deposit-taking institution except purchased payment facility providers
13	A loan is past due from the first day of a missed payment. It is non-performing when the bank considers the borrower unlikely to pay in full without realising security, or once it is 90 days or more past due
20, 23	A documented appetite for credit risk, and a strategy describing the risk the bank will accept by type of loan, industry, location, currency and maturity
41, 43, 44	A comprehensive assessment, proportionate to the loan and made with "experienced credit judgement"; adequate information; the borrower's integrity, reputation and legal capacity
42	Credit risk assessed "primarily on the strength of a borrower's repayment capacity", without "undue reliance on collateral"
45(a) to (c)	The purpose and sources of repayment; reasonable steps to verify income or cash flows, commitments and total debt; repayment tested under scenarios, including higher rates, a move between fixed and floating rates, lower income and the end of an interest-only period
45(e), (f)	Terms and covenants that limit the bank's exposure if the borrower's risk changes; the adequacy and enforceability of collateral and guarantees, under various scenarios
46	For a business, also its expertise, industry and position in it; its historical and future cash flows; the equity invested in it; and protections other than collateral, such as hedging and insurance
48, 49; Attachment A, 3, 10, 11	Valuations at fair value, independent of origination, assessment and approval; security valued before the loan is drawn; each valuation on the bank's own instructions, and any panel of valuers reviewed at least yearly
52	Limits on loan to value ratios, and scrutiny of high loan to value lending
54 to 58	A clear approval process, an approval authority for each loan suited to its size and complexity, experienced people, and limits on exceptions to policy, which are reported to governance bodies
39, 59	Oversight of brokers and other third parties, and checks on the information they supply
61 to 64, 67	Administration that monitors documents, covenants and collateral, with segregation of duties; current information on the borrower; an internal risk grading system where appropriate
29(e), 77	Regular reviews of the credit process, independent of the business function, reported to the board and senior management
79, 80	Early action on problem loans, and a workout function separate from the area that made the loan

Paraphrased, except where quoted. APS 220 binds authorised deposit-taking institutions. It sets no ratios, interest rates or loan sizes.

The five Cs: what a lender is really asking

A long-standing way of organising a credit judgement is the five Cs: character, capacity, capital, collateral and conditions. It is a teaching device rather than a rule, but each C corresponds to something APS 220 requires a bank to consider, and each hides a question worth answering before the lender asks it.

Character is the evidence that the owners do what they say, read in the record: how the accounts have been run, the credit history, whether tax is up to date, and whether the application itself is candid. APS 220 requires "due consideration to the integrity and reputation of the borrower" (paragraph 44),¹ and NAB says that new or increased lending is "generally conditional upon a clear credit history" (no date shown, read 12 October 2026).⁷

Capacity is the first way out: the cash the business generates to pay interest and repay principal, on its history and on a forecast the lender has tested. The Banking Code describes the test from the customer's side. A Code bank assesses a small business's ability to repay from its financial position or account conduct, or both, may take projected cash flows into account, and "will not ask a third party (such as your accountant) to certify that you can repay the Loan" (paragraph 78).²

Capital is the owners' own money in the business, which takes the first loss (paragraph 46).¹ The question behind it is how much the owners would lose before the lender lost anything. Collateral is the second way out, valued at what it would fetch, allowing for "time taken for the liquidation or realisation of collateral" (paragraph 49).¹ Conditions cover the industry, the economy and the terms of the loan itself, including the covenants that let the lender act if the risk changes (paragraphs 45(e) and 46(a)).

Threefold Capital interpretation

The five Cs of credit, and where APS 220 asks for each

The C	The lender's question	What it looks at	APS 220
Character	Will these owners do what they say, and tell us early when they cannot?	Track record, credit history, conduct of accounts, tax and statutory payments, candour	44
Capacity	Can the business repay from its own cash, with room to spare, in a bad year as well as a good one?	Earnings and cash flow, history and forecast, debt service and interest cover, scenarios	42, 45(c), 46(b)
Capital	How much would the owners lose before the lender loses anything?	Equity invested, profits kept in the business, gearing, the owners' contribution to the project	46(c)
Collateral	If the cash flow fails, what is the second way out, and what is it worth in a forced sale?	Property and other assets, independent valuation, loan to value, guarantees	45(f), 47 to 53
Conditions	What could change around the business, and can the loan's structure cope?	Industry and position, customers and suppliers, the economy, purpose, term and covenants	45(e), 46(a), 70

The five Cs are a long-standing way of organising a credit judgement, not a rule. The paragraph numbers are those of APS 220.

Six ratios, and the question behind each

Capacity, capital and collateral are measured with ratios. None has a legal definition that governs a loan contract: even the loan to value ratio, which APRA's capital standard uses to set risk weights (Part 1), means in a facility agreement whatever that agreement says. APS 220 sets no level for any of them; it requires limits on loan to value ratios without saying what they should be (paragraph 52).¹ Most rest on earnings before interest, tax, depreciation and amortisation (EBITDA), a rough guide to the cash a business generates before it pays its lenders, the tax office and for new equipment.

Debt service cover divides the cash available for the loan, usually EBITDA less tax paid and often less the capital spending and distributions the business cannot do without, by a year of interest and scheduled principal, on the loan agreement's definition. Lenders differ in what they deduct and in the rate they test the payments at, many adding a buffer to the loan's rate or using a floor, so the same business can show comfortable cover on one definition and little to spare on another. The model below divides plain EBITDA by the payments at the loan's own rate: earnings of $600,000 against payments of $327,000 give cover of 1.83×. At 1.00 times every dollar of earnings goes to the lender; the room above it is what absorbs a bad year. Interest cover divides earnings by interest alone, 4.29× for the same business, and matters most for loans that repay little principal. Debt to EBITDA measures debt in years of earnings: the model business owes 2.9× a year's earnings. Some lenders publish limits in these terms. Macquarie's commercial lending guide for brokers, dated May 2026, sets maximum lending for some professional and service industries at multiples of EBITDA from 2.0 times to 4.5 times, depending on the industry.⁸

Loan to value divides the loan by the value of the security. A lender's published maximum loan to value ratio for commercial investment property can be as low as 65% (Part 4 sets out several lenders' terms); at that level the property could lose 35% of its value before the loan exceeded it, before the costs of a sale. Gearing compares debt with the owners' equity, and the current ratio, current assets over current liabilities, asks whether the business can pay what falls due in the next twelve months without new money.

Threefold Capital interpretation

Six ratios lenders use, and the question each one answers

Ratio	Usually worked out as	The question it answers
Debt service cover	The cash available for the loan, usually EBITDA less tax paid and often less capital spending and distributions, divided by a year of interest and scheduled principal	Can the business meet every loan payment from what it earns, with room to spare?
Interest cover	EBITDA, or earnings before interest and tax, divided by a year of interest	Could it carry the debt if the principal had to be refinanced rather than repaid?
Debt to EBITDA	Total debt divided by a year's EBITDA	How many years of earnings does the debt represent?
Loan to value	The loan divided by the value of the security	How far can the security's value fall before it no longer covers the loan?
Gearing	Debt divided by equity, or by debt and equity together	Who has more at stake in the business, the owners or the lenders?
Current ratio	Current assets divided by current liabilities	Can the business pay what falls due in the next twelve months without new money?

EBITDA is earnings before interest, tax, depreciation and amortisation. APS 220 requires limits on loan to value ratios (paragraph 52) but sets no level for any ratio.¹

The documents, and what each one proves

A lender's request for documents is better understood as a set of cross-checks than as paperwork: the standard requires adequate information and verified figures (paragraphs 43, 45 and 46),¹ and each document either supplies a figure or tests one supplied elsewhere.

The Commonwealth Bank (CommBank), NAB and Westpac each publish what they may ask for, and their lists overlap: financial statements, tax returns, BAS or ATO portal statements, bank statements, identification and the directors' own finances.^9,7,10 NAB says most businesses need at least two years of annual financial statements and the latest full tax portal report,⁷ and Westpac asks for business tax returns for the past two or three years.¹⁰ Westpac's minimum documents for equipment finance add, depending on the application, management accounts where the annual accounts are over six months old, aged debtor and creditor listings for transactions over $500,000, cash flow projections with assumptions for transactions over $1 million, and a copy of any ATO payment plan.¹¹ More of the data now arrives directly: NAB's QuickBiz loan draws it from accounting software.¹² ANZ says it asks for the directors' consent before it runs a credit check,³ and in our understanding the credit reporting rules in Part IIIA of the Privacy Act 1988 require every lender to do the same before it obtains a director's credit report for a business loan or a guarantee.¹³

Threefold Capital interpretation

What lenders usually ask a business for, and what each document tells them

Document	What it tells the lender	Listed by
Financial statements, usually two years or more	Profit, assets and debts, and the trend	CommBank, NAB, Westpac
Business tax returns	That the profit shown to the lender is the profit declared	CommBank, NAB, Westpac
BAS and ATO portal statements	Turnover reported during the year, and whether tax accounts are up to date	CommBank, NAB, Westpac
Management accounts	Trading since the last annual accounts	NAB, Westpac
Business bank statements	The cash actually received and paid, and how the accounts are run	CommBank, Westpac
Aged debtors and creditors	Who owes the business, whom it owes, and how late each is	Westpac, for larger equipment finance
Forecasts with assumptions	What the business expects, and on what basis	CommBank, NAB, Westpac
Leases and contracts of sale	The security of the premises, and the terms of a business being bought	CommBank, NAB
Identification and registration	Who the borrower, owners, directors and guarantors are, and how the business is set up	CommBank, NAB, Westpac
Directors' tax returns and personal finances	What stands behind the owners and any guarantee	CommBank, NAB, Westpac
Credit history and credit reports	How the business and its directors have repaid before	NAB, Westpac

Each bank's list depends on the product, the amount and whether the business is already a customer, and each says it may ask for more. "Listed by" names the banks whose published lists include the item, under the conditions given in the text. On years, NAB asks for two years of financial statements and Westpac for two or three years of business tax returns; CommBank's page gives no number.

Three sets of numbers that must agree

Most businesses produce their numbers three ways: the annual accounts and tax return, the BAS lodged during the year, and the management accounts the owners run the business on. They rarely match exactly, for ordinary reasons of timing, GST and year-end adjustments, and they do not need to, so long as each difference can be explained. The same goes for earnings adjusted for one-off costs, such as a legal dispute or a relocation. We think a lender accepts an adjustment that is real and evidenced, with an invoice and a reason it will not recur, and discounts one that is not. A cost that recurs every year under a different name is not a one-off, and an adjustment that does not survive the first question costs more credibility than it adds in earnings.

Honest preparation, and where it stops

Preparation means presenting the business as it is, clearly and completely, and a debt the lender finds for itself costs more credibility than one disclosed. Among the events other than a missed payment on which a Code bank may act under a standard form small business loan, the Code lists a borrower or guarantor giving information that is "materially incorrect or misleading (including by omission)" (paragraph 87(f)), subject to the test of materiality in paragraph 90.² A loan obtained on a misleading picture can be in default even when every payment has been made on time.

Testing the numbers: the borrowing stress tester

APS 220 requires a bank to test repayment "under various scenarios" and to "assess its credit risk exposures under stressed conditions" (paragraphs 45 and 70).¹ In 2026 the scenarios have not been hypothetical. The cash rate has risen four times this year, from 3.60% to 4.60%,¹⁴ and the Reserve Bank's October Financial Stability Review says pass-through "is likely to be faster for smaller businesses than larger corporates".¹⁵ A smaller business is the kind of borrower the worked example below describes, which is why its rate scenario is not a formality. Part 3 covers the state of credit in 2026.

Our model applies the test to a hypothetical established business with revenue of $4 million, EBITDA of 15% of revenue, $600,000, and a loan of $1.75 million at an illustrative 8%, repaid monthly over seven years. A year of payments comes to $327,000, so debt service cover is 1.83×. The model compares that with a covenant of 1.25 times. That level is our illustration, not any lender's. On the stricter measure many lenders use, with tax and the equipment the business must keep buying taking a third of earnings, the business today would cover its payments about 1.2 times rather than 1.83× (our calculation); Part 7's second model works on that basis.

Illustrative model

Model: the borrowing stress tester

Choose a scenario, or set your own business and loan with the controls. The 1.25 times covenant is our illustration, not any lender's level.

TodayRates up 2 pointsRevenue down 15%Earnings margin down a quarterAll three

Without JavaScript the model shows one scenario: Today.

The business

Revenue a year

$4,000,000

−+

EBITDA, share of revenue

15.00%

−+

The loan

Debt

$1,750,000

−+

Interest rate

8.00%

−+

Years to repay

7 years

−+

The stress

Rise in the interest rate, percentage points

0.00

−+

Fall in revenue

0%

−+

Fall in the earnings margin, percentage points

0.00

−+

Debt service cover 1.83×interest cover 4.29×

Debt service cover

1.83×

Left after loan payments, a year

+$273,000

Room to borrow before the test fails (if negative, debt to repay to pass it)

+$816,000

Debt, times earnings

2.9×

Earnings cover the loan payments 1.83×, above the 1.25× in our illustrative covenant.

The test would fail if the interest rate reached 21.07%, 13.07 percentage points above the rate set.

Earnings could fall a further 31.8% before the test fails.

Borrowing stress tester

Cover at the earnings set

The scenarios change one thing at a time, then all three together: interest rates two percentage points higher, revenue 15% lower, and an earnings margin a quarter lower, from 15% to 11.25% of revenue.

Illustrative model

The illustrative business under each scenario

Line	Today	Rates up 2 points	Revenue down 15%	Earnings margin down a quarter	All three
Revenue	$4,000,000	$4,000,000	$3,400,000	$4,000,000	$3,400,000
EBITDA	$600,000	$600,000	$510,000	$450,000	$383,000
Interest rate	8.00%	10.00%	8.00%	8.00%	10.00%
Loan payments a year	$327,000	$349,000	$327,000	$327,000	$349,000
Interest in the first year, approximately	$140,000	$175,000	$140,000	$140,000	$175,000
Debt service cover	1.83×	1.72×	1.56×	1.37×	1.10×
Interest cover	4.29×	3.43×	3.64×	3.21×	2.19×
Debt, times earnings	2.9×	2.9×	3.4×	3.9×	4.6×
Left after loan payments	+$273,000	+$251,000	+$183,000	+$123,000	+$34,000
Room to borrow before the test fails (negative: debt to repay to pass it)	+$816,000	+$659,000	+$431,000	+$175,000	−$214,000
Rate at which the test fails	21.07%	21.07%	15.23%	11.04%	5.92%

Each scenario changes only what its name says. Debt service cover is EBITDA divided by a year of interest and principal, at the loan's own rate. The covenant it is tested against, 1.25 times, is an illustration. A negative figure in the "room to borrow" line is the debt the business would have to repay for cover to reach 1.25 times.

Illustrative model

Debt service cover as revenue falls and interest rates rise

Revenue down	Rates up 0.00	Rates up 1.00	Rates up 2.00	Rates up 3.00	Rates up 4.00
0%	1.83×	1.78×	1.72×	1.67×	1.62×
10%	1.65×	1.60×	1.55×	1.50×	1.46×
20%	1.47×	1.42×	1.38×	1.33×	1.29×
30%	1.28×	1.24×	1.20×	1.17×	1.13×
40%	1.10×	1.07×	1.03×	1.00×	0.97×

Starting from the business today, at an interest rate of 8%. The columns are rises in the interest rate, in percentage points. The illustrative covenant is 1.25 times; at 1.00 times, earnings only just meet the payments.

Illustrative model

What one change is worth, from the business today

Change	Debt service cover	Left after loan payments
Rate: one point higher	−0.06	−$11,000
Revenue: 5% lower	−0.09	−$30,000
Margin: one point lower	−0.12	−$40,000
Debt: $250,000 more	−0.23	−$47,000
Term: five years, not seven	−0.42	−$98,000
Term: nine years, not seven	+0.36	+$54,000

Each row changes one thing from the business today, at 8% over seven years. The change in debt service cover is in times, and the change in cash left after loan payments in dollars a year. Rate and margin changes are in percentage points.

A worked example: a $400,000 expansion loan

Now take a smaller business. A hypothetical engineering services firm, established for many years, had revenue of $1.5 million last year and EBITDA of 10% of revenue, $150,000. It has no other borrowings. To fit out and equip a second workshop, the owners want to borrow $400,000, repaid monthly over five years at an illustrative 8%. Every figure below comes from the model above with these settings.

On last year's figures the loan is comfortable. A year of payments is $97,000, debt service cover is 1.54× and interest cover 4.69×. Earnings could fall 18.9% before cover reached the illustrative 1.25 times. The stresses tell a different story.

Illustrative model

The $400,000 expansion loan under four stresses

Case	Debt service cover	Interest cover	Left after loan payments, a year	Room to borrow before the test fails (negative: debt to repay)
Last year's figures	1.54×	4.69×	+$53,000	+$93,000
Rates up 2 points	1.47×	3.75×	+$48,000	+$71,000
Revenue down 15%	1.31×	3.98×	+$30,000	+$19,000
Margin down a quarter, to 7.5%	1.16×	3.52×	+$15,000	−$30,000
All three	0.94×	2.39×	−$6,000	−$100,000
All three, repaid over seven years	1.20×	2.39×	+$16,000	−$16,000

A hypothetical firm with revenue of $1.5 million and EBITDA of 10% of revenue, borrowing $400,000 at an illustrative 8%, repaid monthly over five years unless the row says seven. Each row changes only what it names. The covenant of 1.25 times is an illustration. A negative figure in the last column is the debt the firm would have to repay for cover to reach 1.25 times.

The second workshop is meant to raise earnings, and a lender may count some of that: the Banking Code allows projected cash flows to be taken into account where relevant (paragraph 78), and APS 220 requires future as well as historical cash flows to be considered (paragraph 46).^2,1 In our view, though, most lenders will want the existing business to carry an expansion loan on its own, and will treat the forecast uplift as the reason to lend rather than the means of repayment.

The credit paper and the approval

Once the analysis is done, the case is written up in what banks variously call a credit paper, credit submission or credit memorandum, so that someone who has never met the borrower can decide and be accountable for the decision; APS 220 requires a bank to document its assessment and approval and to identify the approval authority for each loan (paragraph 55).¹ In our reading, a credit paper for a business loan usually covers:

1. The request: amount, purpose, product, term, repayments and pricing.
2. The borrower and the business: structure, owners and directors, their record with the bank, the industry and the business's place in it.
3. The financial analysis: several years of results, the quality of earnings and any adjustments, working capital and existing debts.
4. Repayment: debt service and interest cover on history and forecast, and under the bank's scenarios.
5. Security: what is offered, its independent value, the loan to value ratio, and any guarantees.
6. The risk grade: the bank's internal grade of the borrower (how likely it is to default) and of the security (how much would be lost if it did), which APS 220 requires a grading system for where it suits the bank's operations (paragraph 67).¹ The grade does most of the work, in our reading: it sets the capital the loan consumes, the margin the bank needs to earn its target return and the level of authority that can approve the loan, so a weaker grade means a higher price and a more senior approver, and a price below what the grade requires is itself an exception.
7. Terms, exceptions and the recommendation: covenants and conditions, anything outside policy and why, the main risks and what the writer recommends.

The approver works within a delegation, personal authority to approve loans within limits the bank sets. APS 220 requires an approval authority suited to "the size and complexity of the exposures" and people with "appropriate experience and knowledge to exercise prudent credit judgement" (paragraphs 54 and 56), but sets no amounts.¹ As we understand the practice, most business loans above the level a scorecard decides are approved on two signatures, a business approver's and an independent credit approver's, each within a delegation, with a credit committee only at the top of the range. Exceptions to policy are reported to the bank's governance bodies (paragraphs 57 and 58).

The answer is rarely a bare yes or no. The approvers can approve the loan as asked, approve it on changed terms, such as a smaller amount, a different term or more security, or decline it. In our view, a changed structure is often the most useful answer a borrower can receive, because it shows what the lender would do. If a Code bank declines a small business loan, "we will tell you the general reason why, unless it is reasonable for us not to do so" (paragraph 81).²

From approval to drawdown

An approval becomes money in the account through stages 9 to 11 of the process above.

The offer. Before a small business accepts an offer from a Code bank, the bank gives it "a plain English document clearly setting out the key general Terms and Conditions of the Loan" (paragraph 80).² The summary is not the contract. The definitions in the facility agreement decide how a covenant is measured and what happens on a breach, and they are worth reading with an adviser before signing.

Covenants. Covenants are promises the borrower makes for the life of the loan: to keep ratios within limits, to report on time, to insure assets, not to borrow elsewhere without consent. APS 220 requires a bank to consider covenants "designed to limit the ADI's exposure to changes in the future risk profile of the borrower" (paragraph 45(e)).¹ A financial covenant is usually tested each quarter or half-year on the previous twelve months' figures, which the borrower certifies in a compliance certificate, and the agreement's definitions of debt, earnings and permitted payments decide the number as much as the business does. Some agreements call a breach a review event, which lets the lender reopen the terms, rather than an event of default, which lets it act. For standard form small business loans, the Banking Code lets a bank use financial indicator covenants as a trigger for default based action only in loans for property development and listed kinds of specialised lending, such as construction finance and tailored cash flow lending (paragraph 91); in our reading of paragraphs 87 and 91 together, a ratio breach on its own is not a default a Code bank can act on in any other standard form small business loan, while negotiated and larger facilities are outside those provisions and covenant defaults are usual there. The Code also rules out a default based on "unspecified material adverse changes" (paragraph 92) and lists a failure to provide required financial information among the defaults a bank may act on (paragraph 87(i)).² Part 6 sets out the default provisions, and Part 7 how covenant headroom shapes a borrowing strategy.

Conditions and guarantees. The conditions precedent in the offer, from signed documents and guarantees to a satisfactory valuation, insurance and third-party consents, are met before money is advanced. Some conditions are allowed to follow settlement as conditions subsequent, each with a date, such as audited accounts within a set number of days or a registered lease; a missed one is a default like any other, and one of the commonest technical defaults in a loan that is otherwise performing. NAB says it will need a guarantee from directors "in most cases" where a company borrows.⁷ For an individual guaranteeing a loan to a small business, the Code requires a prominent notice that the guarantor should seek independent legal and financial advice and can refuse to sign (paragraph 103), and a Code bank "will not accept a guarantee from you until the third day after you have been given the information" the Code requires (paragraph 112), with listed exceptions, such as a director guarantor who chooses to sign earlier, a choice the bank "will not influence" (paragraph 113).² Part 6 covers guarantees in full. Once every condition precedent is met, the money is advanced, the security is registered and the promises in the agreement apply.

After settlement: monitoring and review

The credit decision does not end at settlement. APS 220 requires a bank to monitor documents, covenants and collateral (paragraph 62), to know the borrower's "current financial condition" (paragraph 63), and to review its loans regularly, individually or as a portfolio (paragraph 84).¹ For a business borrower, that means the annual accounts, reports and covenant certificates the agreement requires, on time.

Some facilities are reviewed on a fixed cycle. Judo Bank describes its line of credit as having a "12-month term with annual review" (page modified 23 July 2026),¹⁶ and Prospa checks every two years whether a business line of credit can continue (page modified 24 September 2026).¹⁷ In our view, a review of a facility that expires is a fresh credit decision on current figures, which is why a weaker business can find such a facility renewed on different terms or not at all. A term loan's annual review is different: the bank regrades the borrower on the new accounts and tests the covenants and the security, but cannot change a loan that is not in default unless the agreement gives it that right. A Code bank that will not extend a small business loan that is not in default, and whose principal is not fully repaid by its regular repayments, must say so "at least 3 months before you need to repay your Loan in full" (paragraph 93), and need not extend or refinance "on the same terms" (paragraph 94).²

When a loan starts to slip, the bank must have a system for early remedial action (APS 220, paragraph 79), and its workout function must be kept separate from the people who made the loan (paragraph 80).¹ In practice there is a stage between the two: a watch list, where the relationship manager keeps the loan under closer credit oversight, with more frequent reporting, a revaluation or a review by an investigative accountant, whom a Code bank commits to use fairly (Banking Code, paragraph 99).² The loan moves to the specialised unit only if its grade keeps falling or the bank decides the relationship is no longer the way to be repaid. The Code asks a small business in financial difficulty to make contact "as soon as possible" (paragraph 167),² and Part 6 follows that path to enforcement.

What the Banking Code promises a small business

The Banking Code of Practice is the Australian Banking Association's code. Member banks with a retail presence in Australia must sign up to it as a condition of membership, and the banks that have adopted it, including ANZ, CommBank, NAB and Westpac, are listed on the Association's website.^2,18 The current version took effect on 28 February 2025. The Code reaches a customer through the bank's own documents: a Code bank's written terms and conditions for a banking service or guarantee the Code applies to include a statement that the relevant provisions of the Code apply (paragraphs 2 and 3), and an independent body, the Banking Code Compliance Committee, monitors compliance (paragraph 6). A customer can complain to the bank about its compliance (paragraph 195), and one whose complaint is not resolved within 30 days is told of the right to take it to the Australian Financial Complaints Authority, AFCA (paragraph 199).² Its small business provisions cover a business that, with its group, meets the Code's three tests on turnover, staff and total debt, which Part 4 sets out.² In our reading, many commercial property loans and larger business loans fall outside it.

Reported data

What the Banking Code says about lending to a small business

Stage	Paragraph	What the Code says
Applying	76	The bank says how to apply, what information it requires and, once it has that information, how long a decision is likely to take
Assessing	77	For a new loan or a higher limit, the bank exercises "the care and skill of a diligent and prudent banker"
Assessing	78, 79	The bank assesses repayment from the business's financial position or account conduct, or both, and may consider projected cash flows; it does not ask the business's accountant to certify that it can repay; it owes a guarantor the same care
Valuation	95 to 98	Valuations are fair and transparent and by qualified valuers, and the business gets a copy of any commercial property valuation it paid for, unless enforcement has begun
The offer	80	A plain English summary of the key terms before the business accepts
A decline	81	The general reason, "unless it is reasonable for us not to do so"
Covenants	87(i), 91, 92	Financial indicator covenants may trigger default based action in standard form loans for property development and listed specialised lending; no default for "unspecified material adverse changes"; failing to provide required financial information is a listed default
Guarantees	103, 112, 113	A prominent notice to the guarantor, including to seek independent advice and that they can refuse; no acceptance until the third day after the required information is given, with listed exceptions
Expiry	93, 94	At least three months' notice of a decision not to extend a loan that is not in default and is not fully repaid by its instalments; no obligation to extend on the same terms
Difficulty	167	A business in financial difficulty should make contact as soon as possible, and the bank discusses the options
Complaints	195, 199	A complaint can be made about the bank's compliance with the Code; if it is not resolved within 30 days, the bank tells the customer about the right to complain to AFCA

These provisions bind the banks that have adopted the Code, for customers within its definition of a small business, and apply as the Code sets out. Paraphrased, except where quoted.

Why applications are declined or delayed

We found no official series of lenders' decline rates for business loans, so we give none. The reasons below are drawn from the rules, from lenders' own published criteria and from how credit officers describe their work, and they are not ranked.

• Earnings do not cover the payments on the lender's definitions, by the margin its policy requires, on history or under its scenarios. This is the direct test of paragraph 42.
• The figures do not agree, or cannot be verified. Accounts that do not reconcile with the tax returns, or bank statements that tell a different story, fail the verification APS 220 requires.
• The record says something the application did not. NAB's clear credit history and ANZ's account conduct, quoted above, are tests of the record, and CommBank says applicants for its business overdraft are more likely to be approved if they have not been overdrawn or in arrears in the past three months, declared bankrupt in the past five years or had accounts in collections in the past six months (information current at 9 October 2026).¹⁹
• Tax is behind. NAB may ask about tax debt and repayment plans with the ATO,¹² and Westpac asks for a copy of any ATO payment plan.¹¹ We would expect a plan that is being kept to read very differently from one that is not.
• Too little of the owners' money is at risk (APS 220, paragraph 46), leaving the lender to carry most of the risk of a new venture.
• The security falls short. A valuation below the price can push a loan past the lender's loan to value limit, and the amount offered falls with it.
• One customer or supplier is too large. If losing the largest customer would take cover below the lender's level, the loan rests on that customer, not on the business.
• The purpose is one the lender will not fund, such as paying out another lender's stressed position or a tax debt, or returning money to the owners.
• The structure does not work: the income in one entity and the asset or the loan in another, a trust deed that does not permit the borrowing, or a guarantor with nothing behind the guarantee.
• The loan is outside the lender's appetite for that type of loan, industry or location (paragraph 23).¹ Another lender may see it differently.
• The business is too new for the product. ANZ's GoBiz lending needs at least six months of reconciled accounting data and six months under the current ABN or ACN,³ and NAB's QuickBiz an ABN registered for at least 12 months.¹²

Delays have a shorter list. In our view, the most common is an incomplete file: under the Code, a bank's estimate of how long a decision will take runs from when it has the information it asked for (paragraph 76).² Valuations, consents and complexity take time of their own. Westpac says approval may take from a few hours to a few days, depending on the type and amount of the loan, and longer for more complex businesses (read 12 October 2026).¹⁰

What a well-prepared application looks like

We think a well-prepared application is one a relationship manager can take to credit without going back with questions. Beyond the documents and reconciliations above, it usually has four things the lists do not ask for: a one-page summary of the purpose, amount, term, repayment, security and the owners' contribution; a forecast with written assumptions and a downside case, with debt service cover under both, because running the lender's test first shows that the owners understand their own risk; a structure that fits, with a term no longer than the life of what is financed and an amount the history supports; and the bad news, stated plainly, with what has been done about it. It is honest before it is persuasive, and a decline on an honest picture at least tells the owners something true.

How we read it

What follows is our interpretation of how credit officers think, and what that means for anyone dealing with one.

How a credit officer reads an application

A credit officer reads an application looking for the way it fails. The borrower presents a plan; the credit officer looks for the assumption it hangs on and asks what happens if that assumption is wrong. The credit officer is doing the job the standard describes: repayment assessed under scenarios, by someone accountable for the decision.

Credit officers weigh evidence by its quality, not its size. History counts for more than forecasts, bank statements for more than accounts, and accounts for more than narrative, and consistency across documents is read as evidence of control. They also work within a system that makes exceptions costly, because an exception needs an approver with authority for it and is reported upwards (APS 220, paragraphs 57 and 58).¹ A borrower who asks for a structure that fits policy, even a smaller or slower one, is usually asking for a quicker yes.

The asymmetry of lending

Lending has a capped upside and a much larger downside. If a loan is repaid, the lender earns its interest and fees and gets its money back. If the loan fails, it can lose a large part of the money itself. The Reserve Bank's explainer puts the economics plainly: banks measure the profitability of lending as "the difference between the revenue the bank expects to receive from making the loans and the cost of funding loans", and set their rates to maximise it "subject to an appropriate exposure to the risk that some borrowers will fail to repay their loans".²⁰

Suppose, for illustration, that a lender earns 2.5 cents a year on each dollar it lends over its cost of funds, before its own costs and the capital it must hold (a margin between the home loan's and the business loan's in Part 1's model), and loses 40 cents in the dollar when a loan fails and the security has been sold. One failure then wipes out a year's margin on sixteen loans of the same size, before the lender has paid its staff or the cost of the capital it must hold. These are our assumptions, not any lender's, but the shape holds whatever the numbers: a lender gains little from a borrower's success and loses a great deal from its failure.

That is the real difference between a lender and an investor. An investor shares in the upside, so it asks how much a business could become (we set out what an investor looks for in a separate article); a lender does not, so it asks how the loan could go wrong and what it would recover. Equity, security, guarantees and covenants each move part of that downside away from the lender. The most useful thing a borrower can offer is whatever reduces the lender's downside at least cost to the business, which is often better information or a larger contribution from the owners rather than another property.

Why the conversation matters

APS 220 asks for "experienced credit judgement" (paragraph 41),¹ and judgement is exercised by people on the information in front of them. Inside the lender, the relationship manager has to explain the business to a credit officer who has never seen it, and is the borrower's advocate as well as the bank's. A borrower who explains the business clearly and early gives that person something to argue with.

The owners always know more about the business than the lender does, and a lender protects itself against what it cannot see by assuming the worst case: a lower valuation, a thinner margin, a shorter life for the asset. Every question answered before it is asked removes one of those assumptions. We believe the cost of candour is almost always lower than the discount a lender applies to what it cannot see, and that the worst time to tell a lender about a problem is after it has found the problem itself.

Conclusion

A credit decision is less mysterious than it looks from outside. It is a sequence of tests, run by different people under public rules: repayment capacity first, verified and tested under scenarios, with security valued independently, a risk grade that sets the price and the approver, and an approver accountable for the result.

For a small business at a Code bank, the Banking Code adds commitments on information, timing, terms, reasons and notice. Our model shows how much the outcome depends on structure as well as size. A business that absorbs any single stress can fail the test when three arrive together, and the engineering firm's $400,000 loan, comfortably covered today, would fall short of its payments in a bad year over five years but not over seven. We believe the owners who do best with lenders run the lender's tests on their own business first, present the results honestly and talk early. That is good preparation, not a way around the process.

Method and sources

Cut-off. This article uses material published on or before 12 October 2026.

Sources. The rules come from their publishers: APRA's Prudential Standard APS 220 Credit Risk Management, as made and in force from 1 January 2023; the Banking Code of Practice effective from 28 February 2025; the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 in the compilation of 4 June 2026; and Part IIIA of the Privacy Act 1988, the Acts read on the Federal Register of Legislation. Quotations are exact; elsewhere we paraphrase and give the paragraph or section. Economic figures come from the Reserve Bank. Lender requirements come from each lender's own pages and broker documents, read on 12 October 2026, with the date each carries where it carries one; they describe that lender's product at that date, not the market.

Our interpretation. The twelve stages, the five Cs table, the ratio definitions, the table of documents, the contents of a credit paper, the approval and watch list practice and the reasons for decline are our interpretation of the standard, the Code, the lenders' published lists and the way credit officers describe their work, not any lender's internal procedure.

Our calculations. A loan at 65% of a property's value is covered until the value falls by 35%, which is 100% less 65%. Cover on cash after tax and capital spending, with those taking a third of earnings, is two thirds of the model's 1.83×, which is about 1.2 times. In the illustration of the asymmetry of lending, a loss of 40 cents in the dollar divided by a margin of 2.5 cents a year gives sixteen; both inputs are assumptions.

The model. The stress tester is hypothetical: EBITDA divided by a year of loan payments, repaid in equal monthly instalments over the years set, at the loan's own rate with no buffer. A fall in revenue reduces earnings in proportion, as if every cost moved with revenue, so the model flatters a business with fixed costs; the margin control tests that. Interest cover uses a year's interest on the opening balance, and the most debt the test allows is the loan whose payments earnings cover 1.25 times, our illustrative covenant. Tax, capital spending, working capital, other debts and fees are left out. The worked example is the same model with revenue, margin, debt and term set as the text says. The model runs twice, once in the build and once on the page as the controls move, the two are tested against each other, and every figure quoted from it is filled in by the build.

Labels. Reported data: what the source named publishes, including the rules as written. Threefold Capital interpretation: our reading of the evidence. Illustrative model: hypothetical figures from our model. Forward-looking scenario: a planning case; this article has none.

Limitations. APS 220 binds authorised deposit-taking institutions only, and the Banking Code binds only the banks that have adopted it, for customers within its definition of a small business. Lenders' definitions of every ratio differ, and their pages change. We found no official series of lenders' decline rates for business loans. The customer identification rules are described in outline only; the detail of what a lender must collect sits in the AML/CTF Rules, which are not covered here.

Corrections. If you see an error, please tell us at threefoldcapitalau@gmail.com. We correct published articles and record what changed at the top of the page.