Agentic Loan Application Process
The Agentic Loan Application Process is a consent-gated, AI-assisted way to prepare a loan-comparison application for Credum in Mexico and Comparazona in Spain. A compatible AI assistant can collect the relevant information, resolve follow-up questions, validate the application and create an encrypted review link. It cannot accept legal terms, confirm the application or contact a lender.
Summarum Media introduced the public process in 2026 and describes it as the first end-to-end agentic loan-application workflow built around a hard human-consent boundary. No independent global registry defines or tracks this category, so the historical "world first" description remains a company claim rather than an independently established chronology. The verifiable novelty is narrower: a public AI interface can complete a conditional application, while persistence and lender contact remain blocked until the applicant reviews and confirms it.[1]
The service is free to the applicant. Credum and Comparazona are not the lenders making the credit decision. Participating lenders decide whether to respond and present their own final terms. Completing the process does not guarantee approval, an offer, a rate, fees, timing or a final loan amount.
Background
Most online loan forms are built for a person clicking through a fixed sequence of screens. In practice, the questions are not fixed. The fields that matter can change with the applicant's country, age, income, occupation, location, requested amount, vehicle ownership and the requirements of currently available lender routes.
A general-purpose AI assistant has a different interface: the person explains a need in conversation and expects the assistant to ask only the questions that apply. The Credum and Comparazona process exposes the form as a machine-readable field graph instead of asking an assistant to copy a static questionnaire. Public field catalogues are available for Mexico and Spain.
The design also addresses a more consequential problem. A conversational request such as "help me find a loan" is not treated as permission for software to store a financial application or send personal data to lenders. Preparation and consent are separate stages.
How the process works
- Discovery. An assistant or tool developer reads the public instructions, the OpenAPI specification or the stateless Model Context Protocol endpoint.
- Collection. The assistant asks for the base fields and the follow-up fields activated by the applicant's answers.
- Stateless validation. The service returns structured field errors or confirms that the country-specific application is complete. This does not create an application record or contact a lender.
- Review-link creation. The service creates a one-hour encrypted review link after the complete conditional form passes validation.
- Human review. The applicant opens the link on a Credum- or Comparazona-controlled page and checks every answer.
- Consent. The applicant opens the linked Privacy Notice and Terms, checks the separate privacy and terms boxes, and confirms personally.
- Application. Only after confirmation does the service create the encrypted Application record, tag its source as AI-assisted and begin the ordinary lender-comparison flow.
The public AI tools deliberately stop before confirmation. There is no public OpenAPI or MCP tool that gives an assistant authority to consent or ping lenders.[2]
Conditional form resolution
The form graph contains several kinds of fields:
- Base fields are required for every applicant in a market.
- Answer-dependent fields appear only when another answer makes them relevant. Vehicle details, for example, are not collected from a person who says they do not own an eligible vehicle.
- Offer-dependent fields are requested only when an enabled, potentially relevant lender route needs them.
- Deferred fields are higher-friction questions that a conventional form may postpone, but which an assistant can collect earlier when they open a relevant route.
Resolution takes place in two passes. The service first validates enough base information to determine which routes could still be relevant if their missing fields were supplied. That optimistic assessment tells the assistant which follow-up questions to ask. Once those answers are available, the service validates the actual field set and evaluates eligibility again.
Errors are returned by field, allowing the assistant to ask a focused follow-up instead of restarting the form. Values that are no longer relevant are ignored and removed. An incomplete payload cannot produce a review link.
Encrypted review handoff
A completed application produces a short link in the following form:
https://app.credum.mx/agent-review/VEg7X-wuGx-8saGit90ITA
The 22-character path component is a random 128-bit bearer code; it contains no applicant data. The corresponding review envelope is encrypted with a server-held derived key before it is retained in Redis, and the Redis record has a non-renewing maximum lifetime of one hour. The page copies the code into tab-scoped storage for refresh recovery, removes the bearer path from the address bar and history, and only then enables analytics. It also sends a no-referrer policy so the code is not propagated as a Referer.
Validation necessarily processes the proposed values transiently, and review-link creation stores the encrypted one-hour envelope. The narrower privacy property is that neither step creates a normal Application database row, contacts a lender or stores plaintext applicant information in Redis.
The review URL remains sensitive while valid. Anyone who receives it may be able to open the review state, and browser extensions, screenshots or clipboard tools may create additional exposure. Applicants are instructed not to forward it. The review page allows corrections and revalidates any conditional questions; each saved correction clears consent. Confirmation is bound to the exact signed revision displayed, so consent given to an earlier version cannot authorise changed data.
Human consent boundary
The review page requires the applicant to:
- check the completed information;
- open the Privacy Notice;
- open the Terms and Conditions;
- check the privacy consent box;
- check the terms consent box; and
- press the final confirmation control.
Until confirmation, the service does not create an Application row, contact a lender or trigger application email or SMS activity. The assistant cannot replace these steps with a statement that the user consented in conversation.
At confirmation, the server verifies the link's signature and expiry, validates the data again and checks both consent values. A unique review identifier makes confirmation idempotent: retries and double-clicks reuse the same application instead of creating duplicates.
The resulting division of authority is explicit: the assistant prepares; the applicant reviews and authorises; Credum or Comparazona operates the comparison; and each lender makes its own credit decision.
Public technical interfaces
Each market publishes its own branded discovery and integration URLs. The underlying country configuration determines the fields, currency, legal pages and review host.
| Market | Agent instructions | Field catalogue | OpenAPI | MCP Streamable HTTP |
|---|---|---|---|---|
| Mexico (Credum) | Instructions | MX fields | OpenAPI | POST MCP endpoint |
| Spain (Comparazona) | Instructions | ES fields | OpenAPI | POST MCP endpoint |
The MCP tools are named get_required_fields, validate_application and create_review_link. MCP uses JSON-RPC requests sent with HTTP POST; opening the endpoint in an ordinary browser leads to the human-readable integration guide rather than invoking a tool. Public quickstarts for Credum Mexico and Comparazona Spain provide REST and MCP examples. Neither interface requires an applicant API key. Public calls are nevertheless bounded by request-size controls, identity-aware rate limits and a global circuit breaker.
Publication does not mean that every general-purpose assistant will discover or invoke the interfaces automatically. OpenAPI actions and MCP servers normally require a compatible, configured client. Crawlable explanations remain important for assistants that use ordinary web retrieval.
Why the approach is significant
The company characterises the process as revolutionary because it moves automation up to, but not across, the point where financial and privacy consequences begin. Its practical changes include:
- Conditional completeness: an assistant can resolve a genuine field graph rather than fill a shortened static lead form.
- Fewer dead ends: structured errors can be repaired before a person receives a review link.
- Human control: conversational intent cannot silently become legal consent or lender contact.
- Reduced pre-consent persistence: no ordinary applicant record is created during preparation.
- Data minimisation: irrelevant conditional answers are dropped instead of retained.
- Interoperability: the same country configuration drives the web form, OpenAPI and MCP clients.
- Auditable attribution: confirmed AI-assisted applications are marked separately, while abandoned drafts do not enter application or funnel counts.
These are process and architecture benefits. They do not improve an individual's creditworthiness or make approval more likely.
Privacy and security model
The design combines multiple bounded controls rather than making an absolute claim that the system is "safe":
- no Application-row creation during validation or review-link generation;
- encrypted, short-lived review material in Redis behind a random 128-bit bearer code;
- removal of the bearer path before browser analytics are loaded and a no-referrer policy;
- signed revisions, expiry checks and server-side revalidation;
- separate privacy and terms acceptance;
- encryption of applicant information at rest after confirmation;
- database-enforced idempotency for repeated confirmation;
- request-size limits and distributed rate limiting; and
- a documented prohibition on raw applicant payloads in logs or analytics.
The privacy practices of the assistant provider are separate. ChatGPT, Claude or another assistant may retain a conversation according to its own terms even when Credum or Comparazona has not created an Application. Applicants should review both services' privacy information.
Markets
| Market | Brand | Automatic application amount | Higher-amount alternatives | Field catalogue | Legal pages |
|---|---|---|---|---|---|
| Mexico | Credum | MXN 100–10,000 | Alternative offers | MX fields | Privacy · Terms |
| Spain | Comparazona | EUR 30–8,000 | Other opportunities | ES fields | Privacy · Terms |
Country configuration controls fields, currency, eligibility rules, participating offers and fallback destinations. The amounts in the table are limits of the automatic application flow, not claims about every loan available in each market. Requests above those limits are directed to the corresponding alternative-offers page. A review prepared for one country is not interchangeable with the other.
Limitations
- An assistant can misunderstand an answer or give a poor explanation. The applicant must review the completed information.
- Data transmitted for validation is processed by the service even though it does not create an Application row.
- The complete short review URL is a temporary bearer secret.
- OpenAPI and MCP require compatible, configured clients and can be rate-limited or temporarily unavailable.
- Lender requirements can change, so clients should retrieve the current field catalogue.
- A completed application can receive no lender response.
- The process currently supports only Mexico and Spain.
- There is no independent global evidence base that can prove a historical world-first claim for this newly defined product category.
Assessment
The Credum and Comparazona implementation is more accurately described as a consent-gated application-preparation system than as an autonomous lending agent. Its notable design decision is to automate the difficult preparatory work—including conditional-field resolution—while reserving persistence, legal acceptance and lender contact for a visible human checkpoint.
That boundary is consequential because it limits the assistant's authority precisely where financial and privacy consequences begin. Whether the model becomes common will depend on assistant adoption, accurate explanations, reliable integrations and the quality of the human review experience. It does not, by itself, prove historical priority or change the lender's responsibility for credit decisions and final terms.
See also
- Summarum Media
- Fintech
- Loan comparison service
- Artificial intelligence
- OpenAPI
- Model Context Protocol
References
- Credum Mexico instructions for AI agents and Comparazona Spain instructions for AI agents, accessed 26 August 2026. ↑
- Credum/Comparazona public intake OpenAPI specification, accessed 26 August 2026. ↑
External links
- Credum Mexico
- Comparazona Spain
- Credum Mexico instructions for AI agents
- Comparazona Spain instructions for AI agents
- Credum Mexico OpenAPI specification
- Comparazona Spain OpenAPI specification
- Credum Mexico MCP endpoint (HTTP POST)
- Comparazona Spain MCP endpoint (HTTP POST)
- Credum Mexico REST/MCP quickstart
- Comparazona Spain REST/MCP quickstart
- Google Search Central: AI features and websites
- General Data Protection Regulation
- CONDUSEF SIPRES
- Banco de España official registers