Underwriting Workflow guide: Merchant Cash Advance Underwriting: The Complete Step-by-Step Process

Merchant cash advance underwriting is the review a funder runs before buying a share of a business's future receivables. The underwriter checks that the file is complete, confirms who owns the business, measures true revenue and balances from three to six months of bank statements, counts existing advances, verifies the business, reviews fraud signals, applies the funder's policy and sizes a range before deciding.

This guide walks one illustrative file, Cedar & Stone LLC, through every step in order. For each step it covers what is checked, the evidence that usually supports it, where files tend to stall, and which parts software can do while a person keeps the judgment. Deeper guides on individual topics are linked where they apply, so this page stays the end-to-end view.

Evaluating tools for your own funding operation? See how Cevrynt's MCA underwriting software brings bank statements, existing positions, verification, fraud signals and your own policy into one evidence-linked review, with the decision left to your underwriters.

01What is merchant cash advance underwriting?

MCA underwriting is the due diligence a funder does to decide whether to buy a portion of a business's future sales, how much to advance and on what terms. Because repayment comes out of the business's receivables, the review centers on cash flow evidence in bank statements rather than on collateral or a long credit history.

A merchant cash advance is generally structured as a purchase of future receivables, not a loan: the funder pays an amount up front and collects a larger, specified amount as a share of sales, usually through daily or weekly debits that approximate that share. Whether a particular contract is treated as a sale or a loan depends on its terms and on the law of the state involved, and courts have not all agreed. That is a question for counsel, but it shapes underwriting, which has to produce numbers that fit the contract's terms.

Disclosure rules also reach this product. New York's Department of Financial Services adopted its commercial finance disclosure regulation, Part 600 of Title 23 of the NYCRR, on February 1, 2023. It implements Article 8 of the Financial Services Law, covers commercial financings up to $2.5 million and lists sales-based financing among the covered types, according to the DFS announcement. Other states have passed their own commercial financing disclosure laws, and the list and the details change, so funders should confirm current requirements with counsel for each state they fund in.

Federal enforcement has focused on how advances are described and collected. In 2020 the FTC filed a complaint alleging that RCG Advances misrepresented personal guarantee requirements and upfront costs, made unauthorized withdrawals and used confessions of judgment in ways the contracts did not permit; in 2023 a federal court ruled against its controlling owner and banned him from the industry. In 2021 Yellowstone Capital agreed to pay $9.8 million to settle FTC allegations that it kept withdrawing money after advances were repaid and misled businesses about how much funding they would receive. None of that is underwriting analysis, but it is why the amount funded, the payment authorization and the file's documentation deserve the same care as the cash flow numbers.

02What are the steps in the MCA underwriting process?

A typical MCA underwriting process runs from submission and a completeness check, through the application, documents and bank statements, into revenue, balance and position analysis, then verification, fraud review, policy and sizing, and ends with the underwriter's decision, documentation and funding conditions. Funders order and name these steps differently, but the work is the same.

1. Submission and completeness check. Is everything here that the policy requires?
2. Application and ownership. Who is applying, who owns the business, what is claimed?
3. Documents. Are the files readable, current, consistent and the right ones?
4. Bank statements. Is the window recent and unbroken?
5. Revenue and balances. True revenue, average daily balance, negative days and NSFs.
6. Existing positions and holdback capacity. Who else is already collecting, and how much room is left?
7. Verification. Does the business exist as claimed, and can this person sign for it?
8. Fraud review. Do the documents and patterns hold up?
9. Policy, exceptions and sizing. What do the rules say, and what range do they produce?
10. Decision and funding conditions. What is decided, why, and what must happen before funding?

The illustrative file used throughout is Cedar & Stone LLC, a small general contractor applying through an ISO. Every figure below is invented for illustration and matches the same file shown on Cevrynt's bank statement analysis and fraud signals pages. The lender policy, pricing and range used in later steps are also illustrative and belong to no real funder.

03How does a funder check an MCA submission for completeness?

The completeness check compares what arrived against what the funder's policy requires before anyone analyzes it: a signed application, the required months of business bank statements, owner identification and any program-specific documents. A file that fails this check should go back to the broker with a specific list, not sit in a queue.

Step 1: submission and completeness

Cedar & Stone's broker sends one email with an application, a driver's license for the owner and six statement files labelled February through July. Opening them shows that March was never supplied and July was exported twice. The two July files need to be compared rather than assumed identical, and the gap in March matters or not depending on the policy: a funder that needs the three most recent consecutive months can proceed on May to July, while one that needs four consecutive months cannot.

• What is checked: required documents present, signatures, statement months against the policy window, duplicates, files that will not open or are password-protected.
• Typical evidence: the submission email or portal upload, the broker's cover note, the file list with dates.
• Where it stalls: a missing month discovered days later by an underwriter, after the broker has moved on. The first request should be complete and specific: which month, which account, why.
• Automate or keep human: classifying files, reading statement periods and listing gaps can be automated reliably. Deciding whether to accept a substitute, such as a bank-generated transaction history in place of a statement, stays with a person.

Intake in detail, including routing and broker communication, is covered in Automating MCA submission intake, and how brokers and ISOs submit cleaner deals covers the same problem from the other side of the email.

Step 2: application and ownership

The application sets the claims the rest of the file has to support: legal name and any trade name, entity type, state of formation, start date, industry, address, requested amount, use of funds, stated monthly revenue, the owners and their percentages, and any existing advances the merchant chose to disclose. Cedar & Stone states monthly revenue of $84,600, which will matter in step 5.

• What is checked: that the signer is an owner or officer, that listed ownership adds up to what the policy requires, that the industry is one the funder serves, and that disclosed positions are recorded so they can be matched against the statements later.
• Typical evidence: the signed application, owner IDs, and later, registry records and the statements themselves.
• Where it stalls: ownership that does not add up, a signer who is not listed as an owner, or an industry code that does not match what the statements show the business doing.
• Automate or keep human: extracting fields and comparing names across documents is mechanical. Deciding what an ownership discrepancy means, for example a recent buyout that registry records have not caught up with, is a judgment call.

04How many months of bank statements do MCA funders review?

Most MCA funders ask for the three to six most recent months of business bank statements, consecutive and covering every operating account the business uses. The exact number is a policy choice: three months is common for straightforward files, while longer windows help with seasonal businesses, renewals and files where the recent months look unusual.

Step 3: documents

Before the numbers, the documents themselves need a review. Each statement should belong to the business named on the application, carry the expected account number, cover a full period and be readable. The two July exports in Cedar & Stone's file are a small but real question: if they are byte-for-byte or line-for-line identical, one is discarded; if they differ, the difference is the first thing a reviewer looks at.

• What is checked: account holder name, account number, statement periods, page counts, consistency of format across months, and whether any document postdates the application.
• Typical evidence: the PDFs or bank-connection data, with each extracted value linked to its location on the page.
• Where it stalls: scanned or photographed statements that extract poorly, partial periods, and a second operating account that appears in transfers but was never submitted.
• Automate or keep human: reading, de-duplicating and date-checking are well suited to software when every value stays linked to its source; source-linked extraction explains why that link matters. Judging an odd or partial file stays human.

Step 4: the statement window

With the documents sorted, the analysis window is set. For Cedar & Stone it is May through July: the three most recent months, all inside an unbroken run, with nothing after the application date. February stays in the file as context but outside the averages, because a window with a hole in it produces averages nobody can defend.

Every line in the window is extracted: date, description, amount and running balance. Before any classification, the extraction should reconcile: opening balance plus credits minus debits equals the closing balance, and each running balance follows from the one before. A reconciliation break is either an extraction error, which needs fixing before analysis, or something about the document itself, which belongs to the fraud review in step 8. The bank statement analysis guide covers extraction and reconciliation in depth.

• Where it stalls: extraction corrected by hand in a spreadsheet, so memo figures no longer trace to the page.
• Automate or keep human: extraction and reconciliation can be automated. Whether three months is enough for this business, for example a contractor with visible seasonality, is a person's call.

05How do underwriters find true revenue in MCA bank statements?

True revenue is total deposits minus credits that are not sales: transfers between the owner's own accounts, loan or advance proceeds, refunds and reversals, and other one-off credits. Underwriters classify every credit, total what remains, and compare that figure with the revenue stated on the application.

Gross deposits overstate revenue whenever a file contains any of the following:

• Transfers from the owner's other accounts. These recycle money the business already had. Repeated round-number transfers from an account that was not submitted are also a reason to ask for that account.
• Loan and advance proceeds. Money from another funder is debt, not sales, and it is also evidence of a position for step 6.
• Refunds, reversals and chargeback credits. These return money that already left.
• One-off credits. Insurance payouts, asset sales and tax refunds are real money but not recurring revenue.

For Cedar & Stone, the three statements show $253,800 in gross credits, or $84,600 a month, which matches the revenue stated on the application. Classified line by line, they include $171,400 in card settlements, six transfers of $3,000 each from an owner account ending 4471 that was not submitted ($18,000), the $9,500 net proceeds of a renewed advance on May 21, and a refund and other non-revenue credits making up the remaining $8,700. That leaves $217,600 in revenue-like deposits, about $72,533 a month.

Both figures are true, and neither is a mistake by the merchant: the application reported gross deposits. Which one counts as revenue for sizing is the funder's policy, not an analyst's preference, and the file should show both with the lines that separate them. Two follow-ups come out of this step: request statements for account 4471, and record the May 21 credit as evidence of an existing position.

• Where it stalls: ambiguous descriptors, such as a deposit labelled only with a reference number, and payment-processor settlements that combine several days.
• Automate or keep human: classification can be automated when each class carries the reason it was assigned and a link to the line. Ruling on the ambiguous credits stays with the underwriter.

06How do ADB, negative days and NSFs affect MCA underwriting?

Average daily balance shows how much cash a business keeps after paying its bills, and negative days and NSF or returned-item fees show when it could not cover its obligations. Together they tell an underwriter whether daily or weekly debits are likely to clear, which revenue alone cannot show.

Revenue says how much comes in; balances say how much is left when the debits arrive. The second half of step 5 measures three things:

• Average daily balance (ADB): the mean of each day's closing balance across the window, including weekends and holidays. A month-end balance can be dressed up; a daily average is much harder to move.
• Negative days: the count of days the account closed below zero, and when they fell. Clustered negative days mean something different from scattered ones.
• NSF and returned-item fees: each one is a payment the account could not cover. Underwriters count them, date them and look at what bounced.

Cedar & Stone's ADB across May to July is $31.2K, and the account closed negative on nine days: June 9 to 15 and July 28 to 29. The two clusters matter more than the count. Both recover within days. A reviewer should look at what was paid during those stretches and whether NSF or returned-item fees appeared, because an ACH debit returned unpaid during a negative stretch is how a collection problem would first show up. The deeper treatment of these signals is in NSF patterns and overdrafts and DSCR and average daily balance for MCA.

• Where it stalls: ADB computed from a few sampled days or from month-end balances, which then disagrees with a second reviewer's figure.
• Automate or keep human: computing ADB, counting negative days and finding NSF fees is mechanical. Reading the story behind a dip, such as a large supplier payment before a project draw, takes a person, and sometimes a question to the merchant.

07How do you calculate holdback capacity with existing MCA positions?

Holdback capacity is how much more of a business's daily revenue can go to advance payments without breaking the funder's limit. Underwriters find every existing position in the statements, convert each payment to a daily amount, divide the total by average daily revenue and compare the result with the cap in their policy.

Step 6 starts with finding positions. Disclosed positions on the application are a starting point, not the answer: the statements are the evidence. Positions usually appear as recurring same-amount ACH debits with a funder's name or a processor's descriptor, daily or weekly, often preceded somewhere by a funding credit. Cedar & Stone's statements show two:

• A daily debit of $1,550 every business day across the window, from an existing funder. The $9,500 credit on May 21 is that funder's renewal, so this position recently reset.
• A weekly debit of $610 on nine consecutive Tuesdays from May 28 to July 23, with no matching funding credit anywhere in the window. It may be a position funded before May, one funded into account 4471, or not an advance at all, such as an equipment lease. The statements cannot say which, so the merchant has to.

Then the arithmetic, with an illustrative 30 percent cap and 21 business days a month. Conventions differ between funders, so they belong in the written policy, not in each file.

Revenue-like deposits, May-July      $217,600   ($72,533 / month)
Average per business day             $72,533 / 21        = $3,454

Existing obligations per business day
  Daily position                     $1,550
  Weekly debit $610 / 5              $122
  Total                              $1,672              = 48.4% of $3,454

Illustrative policy cap              30% x $3,454        = $1,036 / day

A. Both positions stay open          $1,036 - $1,672     = no capacity
B. Daily position paid off at funding
                                     $1,036 - $122       = $914 / day of room

With both positions open, Cedar & Stone already sends 48.4 percent of its average daily revenue-like deposits to fixed payments, above the illustrative cap, so the rules produce no new capacity. If the existing daily position were paid off from the new funding, a common structure for a renewal or consolidation, the room under the cap would be about $914 a business day. That scenario is not a recommendation; it is what the underwriter will weigh in steps 9 and 10, and it depends on a payoff letter and on what the $610 weekly debit turns out to be. Stacking patterns and how to detect undisclosed positions are covered in Detecting stacking in MCA underwriting.

• Where it stalls: an unexplained recurring debit, and a merchant who takes days to answer what it is.
• Automate or keep human: finding recurring debits, grouping them by counterparty and computing the burden is well suited to software. Confirming what each one is, and whether a position is current, stays with a person.

08What do verification and fraud review cover in MCA underwriting?

Verification confirms that the business exists as claimed and that the applicant can sign for it, using records the applicant did not create. Fraud review checks whether the documents and the activity in them are genuine. Both produce findings for a person to weigh, not automatic declines.

Step 7: verification

For Cedar & Stone, verification means confirming in the state registry that the LLC exists, is active and was formed when the application says; matching its legal name across the application, statements and registry, including spelling variants of the ampersand; checking the address against the business's public footprint; and confirming that the signer appears as an owner or member and is who their ID says. The KYB guide for lenders covers the sources and their gaps.

• What is checked: entity status and formation date, name and address consistency, owner identity and authority, time in business against the policy minimum.
• Typical evidence: registry records, identity verification results, the business's web presence and listings, with each source and its retrieval date recorded.
• Where it stalls: registries that lag recent filings, a trade name that differs from the legal name, and a sole owner whose authority is clear in practice but absent from public records.
• Automate or keep human: querying registries and comparing normalized names is automatable. Resolving a conflict between records is a judgment the file should show was made by a named person.

Step 8: fraud review

Fraud review asks two questions. First, are the documents genuine: do the statements reconcile line by line, are fonts, layout and file structure consistent with the bank's format, and do the two July exports match? Second, is the activity plausible: do deposits look like a real general contractor's receipts, does one payer account for an outsized share, and is there a pattern of recent new positions, rising balances just before application or other signs of a planned default? How to detect fake bank statements covers the document side; fraud signals in small business lending and bust-out fraud in MCA lending cover the behavioral side.

• What is checked: reconciliation, document structure, payer concentration, round-number and same-day in-and-out transfers, recent new positions, mismatches between stated and observed activity.
• Where it stalls: a flag nobody owns, raised in a separate tool and never written into the file, or a flag treated as a verdict and declined without review.
• Automate or keep human: surfacing document and pattern signals is automatable. Deciding what a signal means, and whether it is explained by something ordinary, is the underwriter's job; a flag is a reason to look, not a decision.

09How do funders apply policy, handle exceptions and size an MCA?

Funders run the file against their written underwriting rules (minimum revenue, balance, time in business, negative days, position count and burden), record every rule the file fails as an exception, and then compute the range the rules allow. That range is an input to the underwriter's decision, not an offer to the merchant.

Step 9: policy and exceptions

An illustrative policy applied to Cedar & Stone, with each result stated alongside the figure it was read from:

• Three most recent consecutive months of statements: met, May to July.
• Revenue-like deposits of at least $40,000 a month: met, $72,533.
• Average daily balance of at least $10,000: met, $31.2K.
• No more than six negative days in the window: not met, nine. Exception.
• No more than two open positions: met if the $610 weekly debit is a position, which makes two.
• Total daily obligations no more than 30 percent of average daily revenue-like deposits: not met with both positions open, 48.4 percent. Exception, unless the daily position is paid off at funding.
• At least one year in business, verified in the registry: depends on step 7's result.

Exceptions are not declines; they are where a person with the right authority decides whether a reason exists to proceed. A good exception record states the rule, the observed value, the evidence, who approved or rejected it and why. That record matters for the funder's own consistency and for any later review, and policy exceptions, overrides and the audit trail goes into how to keep it. For how rules should be written so they run the same way every time, see What is a loan policy engine?

Step 9, continued: sizing a range from the funder's own rules

Sizing turns capacity into an amount using the funder's pricing table and term limits. Under scenario B from step 6, with about $914 a business day of room, an illustrative pricing table with a factor rate of 1.35 and terms of 100 to 120 business days produces a range:

Room per business day (scenario B)          $914
Illustrative factor rate                    1.35
Illustrative term limits                    100 to 120 business days

Low:  $914 x 100 = $91,400 payback  / 1.35  = about $67,700 funded
High: $914 x 120 = $109,680 payback / 1.35  = about $81,200 funded

Illustrative ceiling: 1.0 x monthly revenue-like deposits = $72,533

Range from the rules: about $67,700 to $72,500 funded,
before the payoff of the existing position and any fees.
Not an offer. The underwriter decides.

The range is conditional: it exists only in scenario B, which needs the existing funder's payoff letter, and the payoff comes out of what the merchant would receive. It is also the output of rules, not a judgment about the business. Whether to fund, where in the range, or not at all, is the next step.

• Where it stalls: policies that live in people's heads, so two underwriters size the same file differently, and exceptions approved in chat with no record.
• Automate or keep human: running written rules and computing the range is exactly what software should do, consistently, with each result linked to its evidence. Approving exceptions and setting terms stays with the people who hold that authority.

10What happens at the underwriter's decision, and what are MCA stips?

The underwriter reviews the evidence, exceptions and range, then approves, approves with conditions, counters or declines, and writes down why. Stips, short for stipulations, are the conditions that must be satisfied before funding, such as a payoff letter, a missing statement, a verification call or a signed contract.

Step 10: the decision and its documentation

For Cedar & Stone the underwriter has a coherent picture: real activity at about $72,500 a month in revenue-like deposits, a healthy average balance with two short negative stretches, one recently renewed daily position, one unexplained weekly debit and an unsubmitted owner account. Underwriters at different funders could reasonably decline, approve conditional on a payoff, or ask for more first. The process does not choose; it makes sure whoever chooses has the whole picture and leaves a record.

That record is the underwriting memo. It should state the decision, the figures it rests on with links back to the statement lines, the exceptions and who approved them, the open questions and how they were resolved, and the conditions. AI credit memos for small business lending and evidence-backed underwriting reports cover what a memo needs to hold up later.

Funding conditions and stips

If the underwriter approves Cedar & Stone conditionally under scenario B, the stips might read:

• A payoff letter from the existing daily funder, with the balance and a good-through date.
• Statements for the owner's account ending 4471 covering May to July.
• A written explanation of the $610 weekly debit, with its agreement if it is a position or lease.
• The March statement, if the funder's policy or the underwriter requires it.
• Verification of the operating account, for example a voided check or bank verification, and the signer's identity.
• A month-to-date statement or bank check shortly before funding, to catch any new position taken after the application.
• The signed contract, with the amount funded, payment amount and payment authorization stated clearly.

The last item connects to the enforcement history above: the amount the merchant actually receives after any payoff and fees, and exactly what the merchant authorizes the funder to debit, should be unambiguous in the contract and consistent with the file. Track each stip with its status, who cleared it and the document that cleared it.

• Where it stalls: stips. Files commonly wait longer after approval than during analysis, on payoff letters, missing statements and merchants who are slow to reply. A new position discovered in the pre-funding check sends the file back to step 6.
• Automate or keep human: drafting the memo from the evidence and tracking stip status can be automated. The decision, the signature and responsibility for the outcome stay with the underwriter.

11What are the bottlenecks in merchant cash advance underwriting, and what can automation fix?

The usual bottlenecks in MCA underwriting are incomplete submissions, manual statement extraction, unexplained debits that need merchant follow-up, and stips after approval. Automation helps most with extraction, classification, calculations, rule checks and tracking, and least with the questions that need a merchant's answer or a person's judgment.

Walking Cedar & Stone through all ten steps shows where the time goes. Little of it is arithmetic. It is waiting, for the March statement, account 4471, an answer about the $610 debit and a payoff letter, and rework: a figure retyped into a spreadsheet that no longer matches the page, or an exception approved in a message that never reached the file. Underwriting turnaround time covers how to measure those delays.

• Late discovery of gaps. A missing month or account found by the underwriter instead of at intake costs a full round trip with the broker.
• Manual extraction and re-keying. Every hand-typed figure is a figure that can drift from its source.
• Serial handoffs. Verification waiting for financials, fraud review waiting for verification, when much of the work could run at the same time on the same file.
• Questions asked one at a time. Three follow-ups sent on three different days instead of one complete list.
• Unwritten policy. Rules applied from memory produce different answers for the same file and make exceptions invisible.
• Stips without owners. Conditions tracked in email threads instead of in the file.

Automated MCA underwriting, done well, means the left column runs as soon as the file arrives, with every output tied to its source, and the right column reaches the underwriter as a short list of decisions with the evidence attached. It does not mean an approve-or-decline engine: the right column is where risk is judged and where a later review will look. Human-in-the-loop AI underwriting covers how to draw that line.

When evaluating merchant cash advance underwriting tools, run one messy file like Cedar & Stone through all ten steps and check that gaps are listed at intake, every number traces to its source, the funder's rules run as written with exceptions recorded, and the decision and stips live in the same file as the analysis. The MCA software guide covers the wider category.

From here, this article is about Cevrynt

12How Cevrynt supports the MCA underwriting process

Cevrynt is an MCA platform for funders and alternative lenders: AI-assisted underwriting plus a built-in MCA CRM, so the steps before and after the review (deal pipeline, ISO submissions, offers and contracts, funding and servicing) live in the same system as the file. Its platform follows the same underwriting sequence as this guide: intake and document intelligence, bank statement analysis of deposits, balances and positions, business verification, fraud signals, the lender's own rules in the policy engine, and an evidence-linked underwriting report in which every figure links to the line or record it was read from.

Cevrynt is not a lender, does not fund deals and does not guarantee funding. Fraud and policy results are flags and exceptions for a person to review, any range comes from the lender's own rules and is not an offer, offers are built from the lender's own pricing and terms and sent only when the lender decides, and the underwriter keeps the final decision. The merchant cash advance solution page shows how this fits an MCA funder's workflow, and a walkthrough or a scoped pilot is the way to test it against your own files.