What a bureau report can and cannot reveal
A credit reference or consumer reporting agency may hold reported credit accounts, balances, payment history, delinquencies and public-record data where permitted. The information is valuable for assessing existing credit obligations and historical conduct, but it is not a complete household budget. Credit files may exclude some rents, utility payments, informal commitments or accounts with lenders who do not report. A strong score may coexist with constrained repayment capacity, and thin-file applicants may have adequate reliable income. Lenders need to identify the specific information that supports the proposed lending decision rather than use a score as an unexplained substitute for required assessments. The source date and any dispute markers should travel with the data into the decision record.
EU database access under CCD2
Directive (EU) 2023/2225 Article 19 addresses access to databases for creditworthiness assessment, while Article 18 sets the broader assessment framework. Database information should be used consistently with relevant accuracy, data protection and consumer safeguards under the applicable law. The revised implementing measures generally apply from 20 November 2026, subject to national provisions and transitions; requirements governing current loans must be checked under existing national law. Different Member States may have different reporting infrastructures, permitted access channels and dispute procedures. A cross-border creditor should document the lawful basis for each source, the coverage of reported credit products and the mechanism for correcting inaccurate information. Being technically able to request a credit file does not automatically establish a legal right to do so.
UK credit reference data and affordability
FCA CONC 5.2A requires relevant firms to conduct reasonable creditworthiness assessments addressing repayment risk and affordability risk. Credit reference information can assist with debts and repayment patterns, but does not necessarily supply all income and non-discretionary expenditure evidence. FCA guidance makes clear that assessment depth depends on risk and circumstances. The firm should recognise where a bureau report is stale, incomplete or inconsistent with customer information. If a debtor has recently refinanced, the credit file may temporarily show both old and new obligations. The creditor needs controls against false double-counting and unfounded exclusion of genuine liabilities. Retain the source and decision rationale rather than treating a bureau provider's general risk grade as definitive proof of affordability.
US permissible purpose and adverse-action implications
The Fair Credit Reporting Act restricts access to consumer reports to permitted purposes, imposes duties relevant to accuracy and disputes, and can trigger adverse-action notices when report information is used. ECOA and Regulation B separately govern discriminatory credit decision practices and certain adverse-action explanations. A lender should determine which notice provisions apply to the facts rather than conflate a FCRA notice with a Regulation B explanation. Regulation B section 1002.9 requires specific principal reasons for applicable adverse actions. Models based on bureau variables must produce reasons consistent with what actually drove the outcome. A consumer report used for a loan application should not automatically be repurposed for unrelated marketing or another purpose without reviewing the governing rules.
Data quality, disputes and explainability
Bureau records are snapshots of information supplied by reporting entities. A late update can make a cleared debt appear current, and identity matching errors can attribute another person's account to the applicant. Assessment controls need checks for report date, identity confidence, duplicate records, disputes, missing fields and abnormal data. Where inaccuracies are material, establish a route to obtain clarification or additional evidence. Model designers should avoid assuming that an unavailable score means the consumer is unsuitable. Explainability is important when automated underwriting relies on correlated variables that are difficult to connect to actual decision reasons. The compliance team must check whether variables are legally permissible and whether output notices reflect real model behavior.
Bureau data versus open banking evidence
A credit bureau may show credit balances and repayment history; an authorised bank transaction feed may show cash receipts and payments over a different period. Neither should be assumed complete. Transaction data might expose recurring direct debits not reported to a credit bureau, while the bureau might show a card balance but not the customer's current bank statement. Where both sources are used, align dates and reconcile the same obligation across feeds before calculating debt service. A bank transfer to a credit card should not be treated as a second loan repayment merely because a bureau record also contains the card account. Appropriate account mapping, recency tests and exception handling can improve accuracy without indiscriminate collection of more personal information.
Ongoing controls and vendor oversight
Maintain a source register showing bureau provider, permitted purpose, legal basis, fields used, refresh period, retention restrictions, dispute process and effective version. Validate vendor changes before they alter scorecards or reported account mapping. Audit samples should include applicants with limited credit history, mixed credit products and disputes. Where a source is unavailable, document the lawful fallback process rather than silently assigning the worst risk band. Review adverse-action explanations and consumer challenges for signs that the data or model is incorrect. Changes in national CCD2 implementation, FCA guidance, FCRA interpretation and reporting standards are review triggers. Protect source data through access controls, encryption and limited retention appropriate to the governing obligations.
Frequently asked questions
Does one data source establish affordability?
No. The adequacy of the assessment depends on the governing law and the reliability and coverage of all relevant information.
When do CCD2 implementing requirements generally apply?
20 November 2026, subject to national law and transitional provisions.
Are a creditor's data access rights unlimited?
No. Permissible purpose, privacy, accuracy and related restrictions must be assessed.
Primary sources
Directive (EU) 2023/2225 Articles 18–19 ↗FCA CONC 5.2A ↗CFPB Regulation B ↗CFPB Regulation Z 1026.43 ↗US Fair Credit Reporting Act, 15 USC 1681 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.