Compliance Evidence and Recordkeeping

Define the evidence a control must produce

Credit compliance evidence should connect a legal obligation to a business process and a verifiable result. A policy stating that borrowers receive pre-contract information does not demonstrate that a specific applicant received the correct document in good time. Identify the event being proved, the governing market and legal source, the responsible person, and the record that substantiates the outcome. Examples include an approved advertisement with its representative calculation, a versioned disclosure, a creditworthiness assessment record, or a resolved complaint. The precise duties depend on the applicable national law, creditor type, agreement and period. Do not describe a single universal EU retention schedule as mandated by CCD2. A useful evidence register distinguishes legally compulsory records from additional operational controls adopted to support review.

Map evidence to the lending lifecycle

Evidence arises before, during and after a consumer credit agreement. Before contracting, record the offer parameters, advertising version, information provided, relevant explanation and assessment decisions. During servicing, preserve appropriate notices, payments, changes, hardship arrangements and consumer communications. At the end of the relationship, relevant closure information and any dispute records may still be needed. An evidence matrix should state where each artifact is stored, which controls rely on it and how a reviewer can verify its integrity. Avoid collecting every conceivable document without considering purpose and necessity. Samples need a reliable account or transaction identifier, but access should be limited so audit convenience does not lead to unrestricted browsing of consumer financial records.

Ensure records show what actually happened

A timestamped file proves only that a file existed at a particular moment, not necessarily that it reached the consumer or matched the accepted agreement. Testing should compare source data, generated documents and delivery events. For credit decisions, preserve enough information to understand which model or policy version was applied and how any human intervention affected the result, where relevant. Corrections need their own audit trail so investigators can distinguish a legitimate update from retrospective alteration. When a vendor hosts logs, examine completeness, retention, exportability and the risk that the provider can overwrite history. Operational evidence should represent the consumer-facing sequence rather than an ideal process map.

Balance retention duties and data protection

The GDPR requires personal data to be kept no longer than necessary for its purposes, subject to applicable legal obligations and other justified grounds. An internal decision to retain every credit application forever is not a substitute for a lawful retention assessment. Conversely, premature deletion can undermine statutory recordkeeping, dispute handling or legal defence. Establish retention rules by data category, jurisdiction and purpose, and specify deletion or anonymisation triggers. Article 5 of the GDPR supplies storage-limitation and accuracy principles, while Article 32 addresses appropriate security. Restrict highly sensitive supporting information, including account transaction histories and identity records. Document litigation holds separately instead of silently applying them to every case.

Control evidence libraries and access

An evidence library needs approved naming conventions, roles, version control, secure retrieval and checks that content can be reproduced without alteration. Identify the person who approves a document template and the role authorised to change an actual client record. Separate day-to-day servicing permissions from compliance review access where feasible. Monitor unusual bulk exports, missing records and failed retention jobs. If a service provider stores evidence, contract terms and technical settings should address availability, incident reporting and the exit process. An effective register also identifies external source citations for regulatory requirements so teams know whether a control reflects binding law, regulator guidance or internal policy.

Review coverage and remediate missing proof

A periodic test should start with a sample of concluded and unsuccessful applications, compare the required evidence list to what is retrievable, and identify unexplained gaps. A missing disclosure delivery event may indicate a technical defect rather than simply a filing problem. Investigate root causes and whether affected consumers need corrective action under relevant law. Assign owners and due dates for restoring or replacing a control, but never fabricate records to close an audit finding. Keep exception approvals, scope assessments and closure evidence. For institutions subject to EBA internal-governance guidance, assess relevant expectations in their own regulatory context; those guidelines do not automatically apply in identical form to every small non-bank creditor. For example, when the same disclosure template is used by two products, the evidence map should distinguish their separate offer data and governing rules. A reviewer should be able to reproduce the conclusion without access to an employee’s personal notes. Where a document was not delivered, mark the record as incomplete and escalate rather than treating a system-generated copy as proof of delivery.

Frequently asked questions

Related research

How to Build and Operate a Credit Compliance Program ↗

Managing Credit Compliance Breaches ↗