Article 18 and product scope
CCD2 is Directive (EU) 2023/2225, which revises the European consumer-credit framework. Article 18 concerns creditworthiness assessments by creditors and must be read with the Directive's scope, definitions, Article 19 on databases and relevant provisions on automated processing. Not every transaction labelled financing is necessarily treated in the same way. A lender should establish whether the product is within scope, the Member State law governing the credit relationship and the operative legal version. Particular attention is needed for digital instalment finance and products formerly treated differently under older laws. This is not a universally applicable credit-score rule. The creditor needs a traceable decision related to the consumer and the obligations in the proposed agreement.
Assessment before granting credit
Article 18 is directed at assessing whether the consumer is likely to meet obligations under the proposed credit agreement and preventing irresponsible lending. Timing is therefore material. In digital origination the application, provisional decision, final terms, signing and disbursement may occur within seconds but remain distinct events. A firm should document when the required assessment is completed and what terms it covers. A later material change in credit amount or obligations may demand additional consideration. A backend service responding approved does not by itself establish that the assessment has used adequate information. Review exceptions and consumer safeguards in the actual implementing provisions before configuring automated routes for immediate approval.
Information and its quality
CCD2 calls for the assessment to be based on adequate, relevant and accurate information relating to the consumer's income and expenses and other financial and economic circumstances. The precise requirements must be checked in Article 18 and applicable national measures. Data collected for underwriting should be linked to a legitimate assessment purpose, and accuracy concerns or contradictory entries should have documented resolution rules. A bank feed or credit bureau record may improve the evidence base but should not be treated as automatically accurate or automatically necessary. Age of data, irregular income, commitments already undertaken and the proposed repayment pattern are practical review considerations. Record which source supplied each item and whether it was verified or estimated.
Database and automated decision controls
Article 19 addresses access to databases for creditworthiness assessment. Other CCD2 provisions, including those dealing with automated processing, may be relevant to a decision engine. Firms should separately assess access permissions, accuracy, privacy obligations, consumer information and applicable rights in automated-assessment contexts. A creditor using a third-party bureau or machine-learning model remains responsible for checking its applicable duties. Do not assume that every automated recommendation creates identical human-review requirements or that a single explanation template covers every decision. Assessment logs should link inputs, model version, risk outcome, consumer request where relevant and any later reconsideration. Evaluate restrictions on data categories under the operative law rather than collecting all available information.
Transposition and application timetable
Member States were required to adopt and publish measures implementing the revised Directive by 20 November 2025. Those measures generally apply from 20 November 2026, with transition provisions affecting particular agreements. The intervening period matters: adoption of a law is not always the date its relevant substantive obligation begins. Existing national rules may govern agreements concluded earlier. A multinational lender should maintain a country-by-country register identifying the enacted instrument, scope, effective dates, supervisory interpretation and product changes. Internal policies describing CCD2 as already universally applicable in October 2026 risk misrepresenting the legal position. A future-date project plan and the currently applicable decision process should be documented separately.
Evidence and implementation testing
Maintain decision records connecting the proposed agreement to financial inputs, assessments, policy versions, exceptions and communications. Before commencement, test creditworthiness workflows against enacted national rules using realistic cases, including inconsistent information, consumers with variable incomes and significant changes in credit terms. Document vendor responsibilities, access controls, data provenance and retention requirements. Test automated outcomes and circumstances requiring escalation rather than assuming validation of the code proves legal compliance. Obtain national legal review of scope and any transitional requirements, then update staff instructions and assurance sampling after the law takes effect. Monitoring should include signs of consumer repayment difficulty, model drift, complaints and override patterns.
Frequently asked questions
Is a credit score enough?
Not necessarily; relevant legal obligations may require broader evidence and review.
When do new CCD2 national measures apply?
Generally from 20 November 2026, subject to applicable national transitional rules.
Primary sources
Directive (EU) 2023/2225 ↗FCA CONC 5.2A ↗CFPB Regulation B §1002.9 ↗CFPB Regulation Z §1026.43 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.