What ongoing monitoring should establish
Credit compliance monitoring is the recurring review of whether day-to-day lending activity follows applicable legal requirements and internal controls. It differs from writing policies, performing one-off implementation testing or conducting a periodic internal audit. A monitoring programme might examine live credit advertisements, the timing of disclosures, creditworthiness exceptions, arrears treatment or correction of inaccurate borrower information. The appropriate approach depends on a firm's products, jurisdictions, volumes, channels and regulated status. EBA internal-governance guidelines describe expectations for an independent compliance function at institutions within their scope. That does not make every monitoring technique or reporting frequency a universal statutory requirement for non-bank lenders.
Select monitoring themes using risk and evidence
A monitoring plan should be connected to a current regulatory obligation register and risk assessment. Prioritise topics with potential consumer harm, frequent errors, regulatory change, complaints, outsourced complexity or recent control failures. For example, an expansion into buy now pay later could require attention to product classification, affordability checks and how retailers describe credit at checkout. Define which populations will be reviewed and why. Relying only on a random sample may miss rare but serious failures, while reviewing only complaints may miss cases where borrowers never recognise an error. A combined risk-based and representative approach can provide more useful assurance.
Create metrics that reveal actual problems
Useful indicators may include missing pre-contract disclosure events, stale advertising rates, unexplained underwriting overrides, unresolved bureau disputes, arrears status corrections and aged complaints. These measurements need consistent denominators and definitions. A metric showing that all files contain a document does not reveal whether the document was supplied before acceptance or whether its numbers match the final agreement. Monitoring staff should review underlying records and customer-facing evidence rather than relying exclusively on dashboard values. Compare results across products, customer groups, application channels and third-party partners where lawful and useful. Investigate anomalies before interpreting a changing percentage as an improvement or deterioration.
Design sampling and exception handling
Document the purpose, population, sampling method, period, data needed and acceptance criteria of each review. A sample of approved loans alone will not detect all problems in declined applications; a sample from one web channel may miss differences in branch or app flows. Reviewers should be able to obtain source records securely and reproduce how a finding was reached. When a defect is identified, distinguish an isolated processing mistake from a design failure affecting many customers. An exception log should capture severity, owner, affected population, temporary safeguards and target remediation. Testing sensitive borrower records also requires appropriate privacy and access controls.
Escalate findings and verify remediation
Monitoring is ineffective when findings remain in a spreadsheet without accountable action. Agree a route for escalating high-impact issues to the relevant compliance, operational and governance owners. Serious concerns might require pausing an advertisement, stopping a defective automated workflow or assessing customer remediation under applicable law. The initial finding should identify the legal source, factual evidence and the nature of uncertainty. Track corrective actions to completion, then retest the changed process using fresh cases rather than accepting a policy update as sufficient proof. A reviewer must be able to explain whether the root cause has been removed and whether earlier customers remain affected.
Link monitoring to governance and change management
Monitoring results should inform the risk assessment, training, control design and future regulatory-change programme. Periodic reporting can show tested volumes, significant findings, trend analysis, remediation backlog and unresolved legal interpretations. The reporting audience and required degree of independence depend on the institution and national supervisory framework. The EBA Guidelines on Internal Governance under CRD are relevant for in-scope credit institutions, while other creditors may have different requirements. Monitor rule transitions explicitly: existing national consumer-credit rules continue to matter until revised CCD2 measures generally apply from 20 November 2026. Preserve versioned findings so a reviewer can distinguish the standards that applied at the time of each transaction. Monitoring teams should also establish an explicit procedure for reviewing changes to the sampling population. When a product launches in a new jurisdiction, old samples may no longer represent applicable rules or customer journeys. Review the effect of repeated findings on the monitoring plan itself and check whether remediation is producing measurable improvement. Record where evidence was unavailable and whether that gap is a control issue, because an apparent clean result based on incomplete records can be misleading.
Frequently asked questions
Is compliance monitoring the same as internal audit?
No. Monitoring is recurring operational assurance, while independent internal audit may provide separate periodic assurance.
Should monitoring look only at complaints?
No. Complaints are valuable signals but may not reveal undiscovered failures.
Do EBA internal governance guidelines apply to every lender?
No. Their defined institutional scope must be checked.
Primary sources
Consumer Credit Directive (EU) 2023/2225 ↗EBA Guidelines on Internal Governance ↗EBA Guidelines on Loan Origination and Monitoring ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.