European consumer lending is officially getting its biggest regulatory makeover in a generation. The revised CCD2 directive is repealing the outdated 2008 framework, updating the consumer credit market and placing it firmly into the modern digital economy.
This change brings Buy Now, Pay Later (BNPL), micro-loans, and interest-free credit into full regulatory scope, and stops superficial “tick-box” underwriting. If you are a credit provider, neobank, or e-commerce platform, you can no longer rely on unverified self-declarations or lagging, backward-looking credit bureau reports.
Instead, lenders must conduct verifiable, data-backed Creditworthiness Assessments (CWA) based on actual monthly cash flow, bringing micro-lending in line with traditional credit checks. Open banking infrastructure provides the only practical way to meet this standard without slowing down customer onboarding or hurting checkout conversion.
Wondering if your platform is ready for the transition? We have mapped out the key milestones, scope changes, and compliance steps you need to take before the deadline. Download our free CCD2 Checklist to make sure your product, risk, and compliance teams do not get left behind.
What is the EU Consumer Credit Directive (CCD2), and why did it replace the 2008 consumer credit rules?
The CCD2 (Directive (EU) 2023/2225) replaces the outdated CCD1. It establishes a modern regulatory framework across the EU to eliminate loopholes exploited by digital lending models and enforce responsible, evidence-based lending.
Under the old rules, micro-loans under €200s and deferred payment schemes often slipped through the cracks. Not anymore. The new directive levels the playing field, making sure that every single digital consumer credit agreement no matter how small the cost or how short the term, adheres to the exact same high standards of consumer protection and robust affordability assessments.
When the original consumer credit rules took effect in 2008, smartphones were new, point-of-sale embedded finance did not exist, and automated underwriting was to say the least – basic. Fast forward a decade, and massive fintech growth has left some significant regulatory blind spots. CCD2 (Directive (EU) 2023/2225) is officially stepping in to replace the outdated CCD1 rules, bringing a fresh, modern framework to the EU that shuts digital loopholes for good.
When must lenders comply with CCD2?
CCD2 entered into force in late 2023, but the clock is now ticking for the rollout. EU member states had until 20th November 2025 to translate these rules into local laws. After that, the real milestone hits on 20th November 2026, when full enforcement kicks in. From that date, every new credit contract, extension, and digital checkout must fully comply with the new standards.
If you have older agreements, don’t panic. Pre-existing credit deals are generally “grandfathered” under the old CCD1 rules. However, the moment a customer renews their credit, expands their limit, or refinances after November 2026, they fall squarely under the new CCD2 rules.
Which credit products and lending services fall within the expanded scope of CCD2?
CCD2 eliminates the legacy exemptions that previously sheltered small-ticket, short-term, and zero-interest lending. The regulatory body has cast a much wider net, bringing a massive range of popular digital payment methods under the official consumer credit umbrella for the very first time.
This includes deferred payment arrangements like Buy Now, Pay Later (BNPL) and Split Pay, even if they are completely interest-free and fee-free. Micro-loans under €200 are also included because the original CCD1 exemption has been entirely removed. Zero-interest and fee-free credit structures funded by merchant discount rates are now officially classified as consumer credit.
Lenders must also comply when offering short-term payday and bridge loans with repayment windows under three months, which includes 14 to 30-day deferred invoicing. Finally, formal overdrafts, informal account overrunning, peer-to-peer crowdlending platforms, and consumer hire-purchase or leasing agreements containing a purchase option are all newly regulated.
What are the new Creditworthiness Assessment (CWA) requirements?
Under CCD2, the Creditworthiness Assessment (CWA) is no longer a check-the-box formality. It is a strict legal gatekeeper. If your assessment shows a customer is unlikely to meet their repayment commitments, you are explicitly prohibited from granting them credit. No exceptions, no “grey areas.”
This shift completely rewrites the rules of underwriting in three major ways. First, pure self-declaration is officially dead, meaning you can no longer rely on unverified user inputs. Income, rent, and monthly fixed outgoings must be backed by reliable, authoritative evidence.
Second, underwriting models must focus entirely on net disposable affordability, assessing the actual surplus cash flow left over after accounting for real-world living expenses, debt payments, and household overheads. Finally, cash flow now beats collateral every time, meaning that holding high-value assets is no longer a valid reason. You still have to prove the customer has the verifiable monthly cash flow to afford the loan.
What data does CCD2 prohibit lenders from using in Credit Assessments?
To safeguard privacy and prevent discriminatory profiling, CCD2 strictly bans lenders from using special categories of personal data and non-financial digital footprints.
To protect customer privacy and stop unfair profiling, CCD2 is drawing some strict lines in the sand. When it comes to assessing creditworthiness, what you cannot look at is now just as important as what you must look at. Lenders are strictly prohibited from digging into social media profiles, online behavioural activity, or biometric profiling. Even health records and medical histories are completely off-limits, reinforcing a strong “right to be forgotten” for consumers.
Instead, the new rules push lenders toward clean, financial data. Verified transactional bank data (accessed instantly via Open Banking), documented recurring net income, and audited fixed liabilities like rent, utilities, and existing credit commitments, alongside traditional national credit registry records.
What are the CCD2 requirements for AI and automated credit decisioning?
Automated decisioning and algorithmic credit scoring remain permissible, but some element of underwriting are officially over. Under CCD2, whenever a lending decision is fully automated, consumers enjoy explicit statutory rights to human intervention and crystal-clear explanations.
This means lenders must proactively notify applicants upfront whenever automated profiling or AI systems are evaluating their application. If an applicant gets declined, you must provide a meaningful, easy-to-understand explanation of the specific financial criteria that drove the rejection. On top of that, borrowers now have the legal right to challenge any automated decision, submit clarifying evidence, and demand a formal review by a real, human credit officer.
What does CCD2 mean for Buy Now, Pay Later (BNPL) providers and retail merchants?
The era of zero-friction deferred payments is officially over. Buy Now, Pay Later (BNPL) providers and embedded finance partners must now run proportionate, real-time affordability checks before approving any deferred transactions at the point of sale.
But it’s worth remembering that introducing traditional document uploads or multi-day credit bureau checks at checkout will cause shopping cart abandonment to surge. To protect your revenue, you must deploy lightweight, API-driven Open Banking checks that calculate income stability and affordability instantly. Therefore, keeping checkouts fast while maintaining bulletproof compliance.
How can lenders and fintechs start preparing for CCD2 compliance today?
Transitioning to CCD2 compliance is not a task to be left until the last minute. It requires a proactive overhaul of your existing risk frameworks, data infrastructure, and user journeys. The smartest move you can make right now is to audit your current underwriting methods and pinpoint exactly where your flows still rely on unverified self-declarations or legacy credit bureau reports. You can use our CCD2 Checklist to help with this.
Once you have identified those gaps, the next step is to integrate a robust, automated open finance partner to transition your system towards data-backed, real-time creditworthiness assessments. By testing and scaling lightweight, API-driven open banking technology early, you can make sure your verification models are fully optimised and friction-free well before the enforcement deadline hits.
How can Open Banking help lenders meet CCD2 compliance requirements?
Under the requirements of CCD2, underwriting must be substantially more rigorous, yet modern consumers demand instant approvals. How do you go deep into the data without destroying your checkout conversion? Account Information Services (AIS) via Open Banking resolve this tension by retrieving and categorising verified, bank-grade data in seconds.
This infrastructure enables instant income verification by identifying and validating recurring payroll, benefits, or freelance earnings directly from the applicant’s primary account. At the same time, it allows for real-time expenditure categorisation, using machine-learning models to instantly extract fixed commitments and discretionary spending habits.
Operationally, it virtually eliminates fraud by ditching easily doctored PDF bank statements. It keeps checkout conversion rates high by replacing painful manual document uploads with a secure, consented, 30 second bank login flow.
Get your CCD2 readiness checklist
While CCD2 introduces stricter mandates, it also creates an opportunity for market differentiation. Lenders that rely on outdated bureau checks and manual document reviews will face ballooning operational overheads and elevated drop-off rates. But are you ready?
Ensure your business is fully aligned with the upcoming regulatory deadlines without sacrificing your customer checkout conversion rates. We have compiled a step-by-step technical and compliance checklist to help your risk, product, and compliance teams audit your current systems and build a bulletproof roadmap.
