Choose evidence based on legal requirements
A credit compliance evidence library should make it possible to demonstrate what customers were told, what decisions were made and which controls operated at the relevant time. Start with a jurisdiction-by-jurisdiction obligation map covering promotion, pre-contract disclosure, creditworthiness, agreements, servicing, arrears and complaints. Assign each obligation to its source records and owner. Distinguish a statutory recordkeeping requirement from an internal control selected to help demonstrate compliance. Directive (EU) 2023/2225 contains consumer-credit obligations but does not prescribe one universal folder structure for every lender. National law, the GDPR and the requirements of an authorised institution may impose different retention and access expectations. Avoid retaining everything indefinitely merely because it might someday be useful.
Store source artefacts, not just policy summaries
Preserve the actual evidence a reviewer would need: dated advertising captures, approved product terms, the disclosures issued to an applicant, agreement versions, creditworthiness inputs, relevant notices and complaint correspondence. Retain appropriate information about which software release or provider produced the outcome. An internal dashboard showing that disclosures were generated is not a substitute for checking whether the correct document reached the consumer in the required manner. Likewise a signed policy does not prove every operational exception was approved. Link source records to the relevant credit transaction and keep a record of material corrections. Evidence should reflect historical reality, not reconstructed documents labelled as originals.
Design taxonomy, version control and provenance
Use a consistent classification for legal jurisdiction, product, customer journey, control, effective date, record owner and relevant transaction or sample identifier. Version-controlled documents should show what text or rule applied on each date. Record provenance when evidence moves between a bank, broker, service provider and data platform. Where a file can be amended, retain an audit history or another means of distinguishing the original from later corrections. Choose identifiers that support retrieval without exposing customer information in filenames unnecessarily. A taxonomy should allow reviewers to answer questions about a particular credit decision without copying entire sensitive datasets across unprotected shared drives.
Protect access, privacy and retention
Credit files and bureau extracts can contain sensitive financial and identifying information. Access permissions should reflect job responsibilities, and bulk exports need controlled approval and logging. GDPR Article 5 includes storage limitation, data minimisation and integrity principles; Article 32 addresses appropriate security measures. Retention periods require analysis of applicable law, purpose and legitimate evidence needs, not a uniform assumption about all European credit products. Where a legal hold affects deletion, document its scope and governance. When providers store evidence outside the EEA, consider whether GDPR Chapter V is implicated. Test backup restoration and controlled retrieval without creating additional uncontrolled copies.
Make the library usable during testing and incidents
A library that nobody can query promptly has limited compliance value. Define how monitoring teams, internal audit, legal counsel and authorised supervisors can retrieve source material, with role-appropriate permissions. Run periodic drills by selecting credit files and attempting to reconstruct the advertisement, disclosure, decision, agreement and later servicing history. Measure missing records, wrong versions, inconsistent labels and inaccessible vendor archives. Attach issue tickets and remediation evidence to the relevant control so a reviewer can establish both the original deficiency and the final outcome. Do not confuse a convenient dashboard with evidence of effectiveness. The controls must be tested against real transactions and known failures.
Govern changes and periodic evidence quality reviews
Appoint owners for record definitions, quality thresholds, access rules, retention schedules and provider handovers. Review the library after a product launch, merger, technology migration, supervisory enquiry or material control incident. Sample whether archived documents remain readable and whether links between systems still resolve. Record how disposed data was treated, rather than declaring a lost record deliberately deleted without evidence. A finding that records cannot be reconstructed may require a separate investigation into affected customer outcomes. Align future CCD2 implementation changes with legal requirement mappings, while maintaining evidence of obligations applying before 20 November 2026. Audit the evidence library from the perspective of someone who did not build it. Can that reviewer identify the relevant agreement, reconstruct the decision sequence and locate a subsequent correction without an oral explanation? Evaluate whether permission controls also stop unauthorised downloading or bulk search, not just editing. Vendor contracts should state how records can be returned or retrieved on termination. A technology migration is an opportunity to reconcile old identifiers with new ones, but should not result in fabricated timestamps or erased exception histories. Periodic demonstrations of these controls provide stronger assurance than a one-time inventory.
Frequently asked questions
Does CCD2 prescribe a single evidence-library structure?
No. Build the library around applicable duties, national law and reliable retrieval needs.
Should credit files be kept indefinitely?
No. GDPR storage limitation and relevant national duties require a lawful retention assessment.
Are current templates enough to prove historic compliance?
No. Preserve the versions actually used in the relevant transactions.
Primary sources
Directive (EU) 2023/2225 ↗EBA Guidelines on Internal Governance ↗GDPR Regulation (EU) 2016/679 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.