Start with a product and jurisdiction inventory
Begin by listing every consumer-credit product, borrower group, creditor, intermediary, merchant and Member State in which regulated activities occur. Include low-value loans, interest-free finance, deferred-payment offers, overdrafts, overrunning and hire-purchase structures if relevant. Record contract amount, term, fees, security, repayment conditions and whether a third party provides credit. A generic label such as personal lending or BNPL is not an adequate scope assessment. Use Article 2 definitions and exclusions, national implementing provisions and the current legal regime to decide which obligations apply. Mark each product in scope, excluded, subject to a limited derogation or requiring further review. Assign the classification to a named owner who can explain the reasoning and preserve its official sources.
Separate EU requirements from binding national measures
Directive (EU) 2023/2225 entered into force in November 2023. Article 48 required Member States to adopt and publish measures by 20 November 2025 and mandates their application from 20 November 2026. As of 12 October 2026, the application date remains ahead. Create a source register with the Directive article, each Member State's implementing instrument, any national choice, competent authority, published guidance, review date and commencement status. A proposal, consultation or draft guidance should not be marked as binding law. If national legislation is incomplete or uncertain for a product, identify the gap and route it for qualified review. A single EU checklist cannot replace an analysis of the law actually governing a specific agreement.
Review advertising and pre-contract information
Map the customer journey from a promotional message to product comparison, application, offer and signing. For each applicable requirement identify the specific legal source, content, timing, delivery medium and responsible entity. Test representative advertising claims, total cost statements, explanations and pre-contract documents where required. Digital journeys need testing for mobile layouts, expired offers, partial applications and amended terms, not simply proofreading of final PDFs. Where a broker or merchant controls the first contact, agree how duties are fulfilled and evidenced. Operational allocation does not automatically transfer a creditor's statutory responsibility. Preserve approved versions, live screenshots or equivalent records and release dates so reviewers can reconstruct the information a consumer actually received.
Test creditworthiness and decision controls
CCD2 includes creditworthiness obligations, particularly under Article 18, for covered agreements. Legal review should identify which assessment duties apply to each product and country, including any permitted national options. Compare the required consumer-protection assessment with the firm's commercial credit-risk model. Document the information used, relevant policy, decisions, manual overrides and exception paths where appropriate under the governing rules. New digital features or alternative data sources may raise additional questions under data-protection and other legislation. Test declined applications and revised credit amounts as well as approved offers. A low portfolio default rate does not prove that every legally required assessment was completed; equally, extensive data collection does not itself establish that the process was lawful.
Prepare contract and servicing changes
Examine agreements and operational procedures for applicable requirements on contractual information, withdrawal, early repayment, open-end credit, statements, notices, financial difficulty and complaint routes. Identify which system and legal entity fulfils each requirement, including outsourced servicing functions. Test customer requests, term changes, early payments, missed instalments and disputed balances. Keep a controlled version of each agreement template, notice and calculation method. An updated contract cannot compensate for incorrect advertising or an inadequate creditworthiness process, so approvals should cover the entire borrower journey. Record how any new legal or national requirement maps to an operational control and the evidence used to test it. Separate internally chosen service improvements from duties actually prescribed by legislation.
Handle pre-existing agreements under Article 47
Article 47 generally preserves Directive 2008/48/EC for agreements already existing on 20 November 2026 until termination, while making specified CCD2 provisions applicable to existing open-end agreements. The listed provisions include Articles 23 and 24, the second sentence of Article 25(1), Article 25(2), and Articles 28 and 39. Maintain separate populations for new originations, closed-end legacy contracts and relevant open-end accounts. Identify each contract's formation date, subsequent variation, product type and national law. Test servicing and customer notices for the correct population. An application begun before the date but concluded afterward may need legal analysis of contract formation. Avoid switching all legacy accounts to a new rule set merely because a deployment has occurred.
Test, approve and monitor the implementation
Before the cutover, run end-to-end test cases for product exclusions, fees, mobile advertising, altered applications, assessment exceptions, contract delivery, overdraft notices, repayments and difficulties. Log failures, accountable owners, corrective actions and retest evidence. Approvals should identify any assumptions or outstanding national interpretations, not simply state CCD2 compliant. Record the effective date and version of each operational change. After 20 November 2026, monitor national authority guidance, legal amendments, complaints, control incidents and changes to financial products or intermediaries. Preserve historical scope decisions and examples from transactions spanning the cutover. A readiness checklist is a governance tool, not a substitute for the underlying law or a country-specific legal opinion.
Frequently asked questions
Does CCD2 replace all other EU lending regulation?
No. Other instruments such as the Mortgage Credit Directive and national sector-specific laws retain separate scope and requirements.
When do CCD2 national rules apply?
Member States must apply implementing measures from 20 November 2026, subject to Article 47 transition rules.
Is EU-level compliance enough for cross-border products?
No. National implementing measures, local activity rules and the actual borrower and contract facts must be assessed.
Primary sources
Directive (EU) 2023/2225 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.
Related research
When the Mortgage Credit Directive Applies Instead of CCD2 ↗