Start with the lending entity and the product
A fintech brand may include several entities performing origination, underwriting, servicing, payment processing and merchant contracting. CCD2 compliance follows the regulated activities and product, not the brand’s description as technology. Article 3 defines creditor, credit intermediary and credit agreement. A product that finances an identified consumer purchase through deferred payment may fall within the Directive even if there is no interest charge. Record the funding entity, contracting creditor, loan-book owner, collection agent, sales markets, maturity, charges and any intermediary. Check the limits and exclusions in Article 2 for the actual product. Do not import a merchant supplier exemption into a third-party fintech structure without testing the legal conditions.
Map national access requirements and operational ownership
Article 37 provides for admission, registration and supervision arrangements for creditors and credit intermediaries, subject to stated exemptions and Member State options. Certain existing regulated payment or credit institutions are treated differently for relevant activities, but exemptions from admission procedures are not blanket exemptions from consumer protection. An EU-wide app launch therefore needs a country-specific matrix of regulated entities, applicable permissions, competent authorities and implementation dates. Compliance ownership should cover outsourced credit decisions, software vendors and merchant integrations. A fintech can delegate operational work while remaining responsible for duties that attach to it as creditor under national law. Record actual controls and escalation paths, not merely a high-level statement that vendors are compliant.
Build creditworthiness into the approval event
Article 18 requires a thorough creditworthiness assessment before concluding an in-scope agreement, conducted in the consumer’s interest and based on relevant financial and economic information. An instantaneous decision can still be assessed against those requirements, but decision speed is not a substitute for adequate evidence. Model inputs, external databases, repeat purchases and known commitments need documented handling. Article 18 also addresses decisions involving automated processing and associated consumer safeguards. Preserve decision-policy versions, timestamps, relevant input sources, the result and a functioning human-review route where required. Review GDPR requirements separately and avoid claiming that one CCD2 assessment method is mandated for every loan size or borrower.
Align the advertising and disclosure lifecycle
Fintech providers often distribute credit through merchant checkouts, embedded APIs and their own applications. Articles 7 and 8 address credit advertising and standard information. Articles 10–12 govern relevant pre-contract information and explanations, with different rules for certain defined agreements. A fintech should maintain an approved offer-data service supplying the actual instalments, total amount payable, APR where required, charges and creditor identity to each channel. Test changes in basket amount and product eligibility, language variants and durable-medium delivery. The firm should be able to reconstruct what information a consumer saw and received before becoming bound. Merchants and affiliates need updated materials rather than relying on stale campaign screenshots.
Design servicing, hardship and complaints as product controls
BNPL is not complete when credit is granted. For covered agreements, Article 35 addresses arrears and forbearance measures, Article 36 addresses debt advisory services, and Article 40 deals with out-of-court dispute resolution. A fintech needs processes for payment failure, proportionate collections, hardship information, fee handling, complaints, refund adjustment and external redress. Consumer interfaces should identify the contracting creditor and the correct contact. Credit servicing partners need access to current account data and auditable escalation routes. National rules can define fee caps, complaint processes and supervisory requirements, so a standard global collections script may be inadequate. Keep differentiated controls for regulated credit and other payment arrangements.
Use an evidence map and change calendar
Build a product-by-country compliance register linking Article 2 scope conclusions, creditor role, permission or registration status, advertising assets, decision policies, disclosure templates, agreement versions and servicing controls. Assign owners and test samples from real customer journeys using privacy-safe evidence. Monitor complaints, fairness outcomes, overrides and documentation defects, with changes tracked back to the affected products. Article 48 requires national implementing measures to apply from 20 November 2026 after the 2025 transposition deadline; the Directive being in force today does not mean every new obligation already applies uniformly. Current country law and regulator guidance must still be applied. Trigger reassessment when the fintech adds a market, merchant partner, credit feature, pricing change or new decision technology. For a fintech operating through numerous merchant partners, sample testing should include small and large transaction values, repeat users, interrupted applications, changes of product terms, unsuccessful payment collection and returns. A model can function correctly while the customer journey still provides the wrong pre-contract disclosure because the checkout was showing stale terms. Escalations should therefore connect product engineering, credit risk, compliance and servicing rather than allocate all defects to one team. A documented release gate can verify the legal entity, market, eligibility logic, price presentation, required documents and complaint route before activation. This is a practical control proposal rather than a statutory checklist explicitly prescribed by CCD2. Any legal conclusion about authorisation or a disclosure exemption needs a record of the national provision and its current date.
Frequently asked questions
Does interest-free fintech BNPL fall outside CCD2?
Not automatically. The product and Article 2 exclusions need specific analysis, including whether a third party offers credit.
Can a fintech outsource creditworthiness?
Operational services can be outsourced subject to applicable law, but outsourcing does not automatically remove the creditor’s regulatory responsibilities.
When does the CCD2 framework apply?
Member States must apply implementing measures from 20 November 2026, while current national credit laws remain relevant before that date.
Primary sources
Directive (EU) 2023/2225 ↗EUR-Lex national transposition measures ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.