# Phase 49 — Credit Bureau, Reference Checks & Borrower Exposure Management

Phase 49 adds a professional credit-evidence layer for responsible lending without replacing the existing loan maker-checker process.

## New workspace
- URL: `/credit-bureau`
- Menu: Risk & Performance → Credit Bureau & References
- Tabs: Overview, Consents, Requests, References

## Customer consent
- Consent reference and purpose
- Written / digital / OTP / recorded consent methods
- Evidence reference
- Consent and expiry dates
- Revocation history
- A valid, unexpired consent is required before a bureau request can be created

## Credit-bureau requests
- Controlled request number
- Customer and optional loan link
- Provider and provider reference
- Bureau score/band
- Total/open/delinquent facilities
- Maximum days past due
- External outstanding balance
- External monthly commitment
- 12-month enquiry count
- Adverse flag and report summary
- Detailed external tradelines
- Request maker/report receiver cannot independently review the same report

When an active `credit_bureau` connector exists in API & Integrations, a `credit_bureau_enquiry` integration job is queued automatically. If no active connector is configured, the request can still be managed manually.

## Reference checks
- Personal, employer, business, guarantor, address and other checks
- Reference contact and organisation
- Positive / neutral / adverse / unreachable outcome
- Independent review
- Adverse accepted findings generate a credit early-warning indicator

## Credit scoring integration
`CreditScoringService` now retrieves the latest independently reviewed bureau report. The DTI calculation uses:

`declared other monthly commitments + reviewed bureau monthly commitments + estimated new installment`

The credit-assessment record preserves the bureau request ID, bureau monthly commitment and external outstanding balance used for the decision.

The assessment form now explicitly asks for commitments **not already included** in the reviewed bureau report to reduce double-counting risk.

## Early warnings
Reviewed adverse/delinquent bureau evidence creates open credit-risk warnings. The system combines active internal loans with open external facilities; three or more concurrent facilities create a borrowing-exposure warning.

## Database
Upgrade with `sql/migration_049_credit_bureau_exposure.sql`.

New tables:
- `credit_bureau_consents`
- `credit_bureau_requests`
- `credit_bureau_tradelines`
- `credit_reference_checks`

Extended table:
- `credit_assessments`

## Safety / governance
- Bureau data is evidence, not an automatic approval decision.
- A bureau result cannot approve, reject or disburse a loan.
- Existing credit/loan maker-checker controls remain mandatory.
- Provider credentials stay under API & Integrations rather than being stored in bureau records.