Translate legal requirements into decision checkpoints
Begin with a jurisdiction-by-product matrix showing who must assess, when the assessment occurs, relevant legal sources and any transitional rules. Convert that matrix into checkpoints in the application journey: identify the proposed agreement, collect permissible information, evaluate data quality, assess the commitment, decide, deliver any required communication and preserve the evidence. Each checkpoint should have an accountable owner and an explicit failure route. Avoid building a single global compliance flag that hides differences between EU CCD2, UK CONC 5.2A and US product-specific requirements. The operational design should distinguish the assessment duty from related privacy, consumer reporting, adverse-action and automated-processing rights.
Identify the credit product and governing rules
The starting point is the actual legal and contractual arrangement, not the marketing label. Record the creditor, borrower, repayment structure, amount, term, fees and how the customer becomes bound. Determine whether the transaction falls within the relevant consumer credit rules, and identify any exemption or special regime using the operative legislation. A conclusion reached for one type of credit cannot automatically be applied to an instalment loan, overdraft or revolving account. Also distinguish a customer application from a later material increase in available credit. The creditor should document which entity is legally responsible for the assessment when an intermediary, merchant or technology provider collects information. A reproducible scope decision is necessary before selecting evidence, a decision model or a disclosure process.
A creditworthiness score does not settle affordability
A model predicting the probability of missed payments can provide useful information, but may not show whether payments will place the customer under financial strain. Credit history can be thin, income variable and household expenditure difficult to estimate. Establish what is being predicted, how the proposed repayment schedule affects the customer and whether the data are sufficient for the legal standard in question. A lender should avoid concluding that an apparently low-risk applicant can afford all offered amounts. Existing debt service, essential costs and repayment timing may be relevant even where an individual instalment is modest. Where information conflicts, define an escalation procedure and keep the reasoned outcome. The decision should connect the evidence to the proposed commitment rather than merely repeat a numerical threshold.
EU CCD2 timing and national implementation
Directive (EU) 2023/2225 Article 18 establishes a revised creditworthiness framework intended to prevent irresponsible lending, while Article 19 addresses database access. Member States had to transpose the directive by 20 November 2025, and national implementing measures generally apply from 20 November 2026, subject to transition. In October 2026 the revised requirements should not be described as already universally applicable. Existing national law and any national implementing act must be examined for the agreement date and product. Differences in domestic legislation can affect information sources, verification, consumer rights and the consequences of an unfavourable assessment. Maintain a register showing which national rules apply and when changes take effect. A general EU explanation cannot replace the operative Member State rules.
UK FCA responsible lending approach
FCA CONC 5.2A requires a reasonable creditworthiness assessment for relevant regulated consumer credit agreements and certain significant credit increases. The assessment covers both the risk that the consumer will not repay on time and the affordability risk to the consumer. Its depth depends on circumstances and relevant proportionality requirements rather than an identical checklist for every application. Existing information may be useful where it remains reliable, but contradictory evidence and known financial difficulty warrant attention. Verify the exact product scope and exceptions instead of assuming that a loan's size or digital application route decides the matter. Record any income, expenditure or existing obligation estimates and the justification for reliance on them. Automated approval does not remove the creditor's duties.
US requirements are not a copy of EU or UK rules
United States requirements depend on the product, creditor and applicable federal and state law. ECOA and Regulation B govern discriminatory credit evaluation and adverse-action notices under their conditions. Certain residential mortgage transactions have specific ability-to-repay obligations under Regulation Z section 1026.43. Other consumer products do not automatically inherit the same mortgage test or the UK's CONC 5.2A proportionality provisions. Use consumer reports only with the relevant permissible purpose and observe applicable Fair Credit Reporting Act duties. If an application is denied, ensure any required explanation reflects the factors actually used in the decision. A cross-border decision system must distinguish the substantive assessment from separate notice and reporting responsibilities.
Make exceptions and post-decision changes part of the workflow
A practical workflow needs routes for missing data, inconsistent income, disputes, manual overrides, suspected fraud and applicants who cannot use the default digital verification provider. Define when an additional review is required and which employee can approve exceptions. Check whether significant credit increases or other agreement changes trigger a new assessment under the applicable law. Preserve original decisions instead of overwriting them with subsequent reviews. Coordinate decision outputs with agreement generation and notices so the terms actually accepted match those assessed. Run scenario tests for repeated small borrowing, BNPL instalment overlap, joint obligations, variable income and automatic credit limit increases. A control that passes ordinary applications may still fail precisely where consumer risk is greatest.
Operational evidence and independent testing
Preserve the product and borrower context, information source, observation date, assumptions, policy version, automated model build, reviewer authority, decision and customer communications. Distinguish a declared value from a verified value or a statistical estimate. Test scenarios with irregular income, recently opened debt, disputed bureau information, multiple obligations and unexpected payment dates. Review fairness, data accuracy, exceptions, consumer complaints and repayment stress for indications that the assessment process is failing. Changes to legislation, product terms or model features require controlled review and regression testing. A record should make it possible to reproduce why the decision was reasonable at the time, without retaining unnecessary personal information indefinitely. Vendor outputs should be reviewed as part of creditor accountability.
Frequently asked questions
Does a small payment automatically remove the assessment duty?
No. The legal scope and any exemption depend on the jurisdiction and credit product.
Is a credit score alone sufficient?
Not necessarily. The legal assessment may require other relevant information about repayment capacity.
When do revised CCD2 implementing provisions generally apply?
From 20 November 2026, with national transitional arrangements.
Primary sources
Directive (EU) 2023/2225 ↗FCA Handbook CONC 5.2A ↗CFPB Regulation B ↗CFPB Regulation Z section 1026.43 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.