Blog · arXiv Analysis · Last reviewed August 12, 2026

The Prospectus Becomes the Collateral Gate

A collateral-eligibility document system turns a prospectus package and master data into criterion-level findings that may help a central bank decide whether a security can be accepted as collateral. It becomes a collateral gate when machine extraction, normalization, and interpretation determine which assets advance, which are rejected, and which reach a human reviewer.

A 2026 conference paper tests that pattern on a Bundesbank use case. Its results are promising but bounded: the six criteria are simplified, the experiment receives human annotations for base prospectuses, the final decision metrics do not use the LLM judge, and 91% precision is not authority for automatic acceptance.

Published: June 25, 2026 Modified: August 12, 2026 Last reviewed: August 12, 2026 Tags: arXiv, financial AI, collateral, document extraction, evaluation, governance

What the Gate Is

A prospectus-review model does not value collateral or lend money. Its narrower job is to turn documentary evidence into findings about eligibility criteria. The full institutional path is longer: identify the authoritative document set, parse it, extract terms, normalize values, apply the rule version in force, combine the findings with master data and other checks, route uncertainty to a qualified reviewer, and record the final determination.

The distinctions matter. Approval of a prospectus under the EU Prospectus Regulation concerns disclosure for a public offer or admission to trading. Eurosystem collateral eligibility is a separate determination under the monetary-policy framework. Eligibility is also distinct from credit assessment, valuation, haircuts, actual mobilisation by a counterparty, and the Eurosystem's continuing power to exclude an asset. A model that passes six document checks has not completed all of those functions.

For this essay, the collateral gate is the machine-assisted document workflow that can move a security toward acceptance, rejection, or review. Its accountable object is not merely the final label. It is the chain from source document and effective rule to extracted evidence, criterion status, human action, and official record.

The Paper and Its Boundary

LLM-Based Examination of Eligibility Criteria from Securities Prospectuses at the German Central Bank, by Serhii Hamotskyi, Akash Kumar Gautam, and Christian Hänig, was submitted to arXiv on June 25, 2026. arXiv lists it as a paper in the proceedings of the 7th Financial Narrative Processing Workshop at LREC 2026. The authors are affiliated with Anhalt University of Applied Sciences, and the acknowledged CORAL project was funded by Germany's Federal Ministry of Research, Technology and Space.

That provenance sets the claim boundary. This is a conference case study about a Bundesbank eligibility-review use case, not a Bundesbank policy document, an announcement that this LLM pipeline is in production, or authorization for autonomous collateral acceptance. It extends a 2023 decision-support paper from an overlapping author team; that predecessor is technical lineage, not independent replication.

The fresh contribution is the move from span-based named-entity recognition toward generative information extraction. The authors test whether instruction-following models can handle OCR noise, variable financial language, long documents, and German-English layouts without retraining a classifier for every annotation type.

The Experimental Pipeline

The study evaluates six criteria: currency, instrument type, principal amount, redemption at maturity, coupon, and status or subordination. All six must pass under the experiment's aggregation rule. The first four use an extraction-and-normalization step followed by an interpretation step. Coupon and status may combine multiple extracted fields with master data. A deterministic Python stage then combines model outputs, available base-prospectus annotations, and master data into criterion and document labels.

These are not the complete Eurosystem criteria. The paper explicitly says the descriptions are simplifications and that two criteria from the earlier system were excluded because the training data contained too few examples. It also assumes that annotations from a base prospectus, when one exists, are available during inference and generally take precedence over predictions from the issue prospectus. The reported results therefore do not measure end-to-end extraction of every document and rule needed for an official eligibility decision.

The source path matters. The paper converts each PDF to Markdown with Docling, then sends the entire converted prospectus to Llama-3.3-70B-Instruct or Command-R 08-2024 using structured JSON output. It reports that private-use Unicode, inconsistent spacing, and checkbox artifacts in an earlier text extraction caused repetition and invalid JSON, especially on longer documents. Conversion is therefore not clerical plumbing; it changes what evidence the model can see and whether the pipeline returns a usable record.

A production source bundle may also span a base prospectus, final terms, and supplements. Article 8 of the EU Prospectus Regulation requires final terms to be read with the base prospectus and any supplement to obtain all relevant information. The gate must identify and freeze that complete bundle before inference. A perfectly extracted obsolete or incomplete document set is still the wrong evidence.

What Was Evaluated

The inherited dataset contains 413 prospectuses: 268 in a training partition and 145 in a test partition. Most test PDFs were annotated twice, yielding 285 annotation instances rather than 285 independent prospectuses; 203 instances were labeled eligible and 82 ineligible. All documents are in German, about one third are bilingual, and only the German text is annotated as primary.

The annotations cover 18 types and identify enough supporting evidence to make a determination, not every relevant mention. Different annotators can support the same criterion from different locations. That makes exact offset matching a poor sole measure, especially because the switch to Docling invalidated the old character offsets.

The study therefore evaluates three different objects:

  1. Document eligibility against a binary reference label.
  2. Criterion eligibility against criterion-level binary labels.
  3. Extracted values by fuzzy string matching and by Mistral-Small-3.1-24B-Instruct acting as a semantic judge under field-specific equivalence instructions.

The LLM judge is used for the third object, not to score the final document labels. The authors also identify a concrete weakness in fuzzy matching: large but different numbers can look textually similar. For principal amounts, executable numeric comparison is safer than either surface similarity or a fluent semantic judgment.

What the Results Mean

At the document-label level, the paper reports Command-R 08-2024 at 0.84 accuracy, 0.86 F1, 0.91 precision, and 0.82 recall. Llama-3.3-70B-Instruct reaches 0.82 accuracy, 0.85 F1, 0.90 precision, and 0.80 recall. The earlier 2023 system is shown at 0.60 accuracy, 0.72 F1, 0.70 precision, and 0.76 recall; the paper notes that those comparison scores were supplied by an author.

The positive class is eligibility. With roughly 71% of evaluation instances eligible, class prevalence matters. Command-R's 0.91 precision means that a predicted-eligible label is usually right under the study's reference, but not always; its 0.82 recall means that a material share of reference-eligible instances is sent to the ineligible side. These metrics support triage, not unattended acceptance.

The authors call this a safety-oriented or conservative profile because one failed criterion makes the whole prospectus ineligible, routing false negatives toward human review rather than falsely accepting an ineligible security. That interpretation depends on an operational control the study does not test: a staffed review queue with usable evidence, authority to correct the model, and a service level that prevents temporary uncertainty from becoming silent exclusion.

There is a deeper design issue. In the annotation scheme, absence of an eligible annotation can mean either that information is missing or that the value is ineligible. A real gate should preserve three states—eligible, ineligible, and unresolved—instead of converting unreadable or missing evidence directly into a legal conclusion.

Current Eurosystem Context

As of August 12, 2026, the official framework is broader and more dynamic than the paper's six-label experiment. The Bundesbank's collateral overview says national central banks assess eligibility under the Eurosystem legal framework, the ECB's eligible-assets list is updated every business day, and the criteria are reviewed and updated as needed. The same page separates eligibility from credit-quality assessment, valuation haircuts, and actual collateral use.

Rule drift is concrete, not hypothetical. The Bundesbank says that, since March 30, 2026, US-dollar, Japanese-yen, and pound-sterling collateral can fall within the currency set when issued in a euro-area Member State. That conditional rule is richer than a prompt that merely recognizes four currency codes. Every result therefore needs the legal source, effective date, jurisdictional conditions, and master-data snapshot that made the rule true.

The operational layer also changed before this paper appeared. The ECB launched the Eurosystem Collateral Management System on June 16, 2025, replacing 20 national collateral-management systems with one platform for managing collateral in Eurosystem credit operations. ECMS does not turn this experimental extractor into an eligibility authority; it raises the importance of clean interfaces between national assessment, shared collateral infrastructure, and the daily official list.

The EU AI Act is a neighboring framework, not the collateral rulebook. Most of the Act began applying on August 2, 2026, while the July 2026 AI Omnibus moved the Annex III high-risk-system rules to December 2, 2027. Financial or public-sector use alone does not settle an AI system's classification; intended purpose and the Act's specified categories still matter. Whatever classification ultimately applies, AI Act compliance would not establish collateral eligibility or validate this particular pipeline.

A Governance and Safety Standard

A production prospectus gate should be designed as decision support with bounded authority:

  1. Version the rule before the prompt. Maintain a machine-readable criterion specification linked to the authoritative Eurosystem and Bundesbank text, effective date, amendments, approved interpretation, test cases, and legal owner. A prompt change and a rule change are different events.
  2. Freeze the evidence bundle. Record the security and prospectus identifiers, source repository, base prospectus, final terms, supplements, language, retrieval time, and cryptographic hashes. Reject missing, conflicting, expired, or unmatched components into an unresolved queue.
  3. Keep stages inspectable. Preserve the source page or region, literal extracted text, normalized value, interpretation, rule citation, master-data inputs, deterministic aggregation, and confidence or disagreement signal. A generated field called exact_quote is not enough unless it resolves back to the frozen PDF.
  4. Treat issuer documents as untrusted input. Prospectuses can contain malformed PDFs, hidden layers, unusual Unicode, oversized content, and text that resembles instructions. Sandbox parsing, bound resources, strip active content, prevent document text from changing system instructions or invoking tools, and test indirect prompt injection. This connects the financial workflow to the site's document-ingestion threat model.
  5. Use three-way outcomes. Eligible means every required criterion is affirmatively supported under the current rule. Ineligible means evidence affirmatively fails a criterion. Unresolved means evidence is missing, contradictory, unreadable, out of distribution, or below threshold. Only an authorized reviewer should collapse unresolved into a final decision.
  6. Validate the whole pipeline. Use unique-document, issuer-family, base-prospectus-family, and time-separated tests where feasible. Include rare ineligible cases, amendments, long documents, tables, checkboxes, bilingual layouts, numeric edge cases, adversarial files, rule changes, and parser failures. Report uncertainty, class prevalence, false-acceptance cost, false-rejection workload, and performance by document condition.
  7. Calibrate the evaluator. Compare fuzzy rules and the LLM judge with domain-expert labels on a held-out calibration set. Use deterministic parsers for currency and amounts where possible. Version the judge, rubric, threshold, prompts, and sampling settings; do not let one model silently certify another. See LLM-as-a-Judge.
  8. Make human review real. Give reviewers direct source access, rule context, disagreement views, override authority, and enough time. Sample accepted cases as well as rejected ones so a high-precision label does not become an automation-bias shortcut.
  9. Control every change. Parser, OCR, model, prompt, schema, base-prospectus annotation, master data, rule, and threshold changes all need impact assessment and proportionate revalidation. Preserve a rollback path and connect changes to post-deployment monitoring.
  10. Plan correction and incident response. Define who can pause automated recommendations, re-evaluate affected assets, correct master data, supersede a prior record, notify downstream systems, and investigate a false acceptance or systematic exclusion.

Limits and Open Questions

Collateral-Decision Receipt

Each machine-assisted determination should retain:

The defensible claim is: this versioned system extracted these values from this frozen document set, applied this effective rule and master-data snapshot, and a named authority resolved the remaining uncertainty. “The LLM approved the prospectus” is neither accurate nor auditable.

Source Discipline

The primary research source is a conference paper also posted as arXiv version one, not an official Bundesbank publication. Its model results are retrospective metrics on an inherited research corpus. The 2023 system and FinCorpus-DE10k come from overlapping authors and connected datasets; they establish lineage, not independent confirmation.

The paper itself distinguishes the extraction-value metrics: the prior NER model uses offset-based scores, while the new models use value-based fuzzy and LLM-judge scores, and those methods are not directly comparable. This essay therefore does not present the value-extraction figure as a clean model-generation leaderboard. Official ECB, Bundesbank, EUR-Lex, and European Commission sources support the current institutional and legal context; none endorses the paper's models.

Sources

Return to Blog