Define the assessment perimeter before scoring risk
A credit compliance risk assessment identifies where the lender might breach applicable obligations or cause legally relevant consumer harm. Its scope should specify the creditor, products, jurisdictions, distribution channels, lifecycle activities and review period. BNPL, revolving credit, online instalment loans and broker-led lending may expose different compliance risks even under related legislation. A firm should distinguish current national rules from impending changes under Directive (EU) 2023/2225, whose implementing measures generally apply from 20 November 2026. The assessment is not a substitute for determining the actual legal obligations. Begin with the law, business model and operational facts before assigning an inherent risk rating. A single global score without a clear perimeter will hide critical country differences.
Map obligations to failures and consumer outcomes
Translate each legal requirement into a plausible failure event and consequence. An inaccurate APR might distort consumer comparison, a premature acceptance step might bypass required pre-contract information, and a bureau identity mismatch might contribute to an unfair refusal. In servicing, incorrect arrears reporting or mishandled hardship requests could affect consumers and supervisory exposure. Identify which process creates the risk, which system or partner influences it and which obligation is relevant. Distinguish the chance of a failure from its possible severity. The number of complaints is useful evidence but not a complete measure of risk because some consumers do not recognise or report incorrect treatment. Use operational data and sample files.
Score inherent risk using transparent assumptions
An inherent assessment considers risk before the effectiveness of the firm's specific mitigating controls. Possible dimensions include product complexity, volume of customers, vulnerability of the audience, automation, third-party reliance, regulatory change and geographic spread. Weightings and scales are internal methodology choices unless a specific applicable supervisor imposes a rule. Explain why a score was assigned and provide examples of what would change it. A complex automated underwriting model serving several countries can have high inherent risk even when it has not yet generated known complaints. Avoid numerical precision unsupported by evidence. Risk workshops should include product, servicing, technology, legal and compliance perspectives rather than relying only on a single departmental opinion.
Evaluate control design separately from actual operation
A policy may describe a strong control while real applications bypass it. Test both whether the control addresses the relevant failure and whether it operated during the period assessed. A designed rule blocking contract acceptance without delivery of required information should be tested using transaction logs and exceptions, including mobile and interrupted applications. A control requiring monthly bureau reconciliations should be supported by completed sample reconciliations and correction outcomes. Evaluate preventive, detective and corrective controls and identify dependencies on vendors or manual work. Record missing evidence rather than assuming that absence of detected breaches proves effectiveness. Residual risk should follow the observed control performance, not management confidence alone.
Connect risk decisions with ownership and remediation
Assign each material risk an accountable owner, planned treatment, expected completion date and escalation point. Treatment might involve rewriting consumer language, changing a system validation, adding independent sample review or suspending a risky product feature. If the law has already been breached, classify and manage the incident separately; a risk acceptance decision cannot make non-compliance lawful. Management reporting should explain the affected obligations, possible consumer impact, evidence gaps and dependencies. Prioritise action using both legal seriousness and actual exposure. A risk register is useful only if decisions lead to monitored changes in the business and if overdue actions are challenged at an appropriate level.
Refresh assessment results when business conditions change
Risk assessment is an ongoing process, not a one-time document created for a regulator's visit. Reassess after a new country launch, pricing change, outsourcing arrangement, model release, regulatory amendment, significant complaint trend or control failure. Review whether the assumptions behind earlier likelihood and impact ratings remain valid. Compare the register with monitoring findings, incident logs, regulatory correspondence and audit reports. Capture management discussion and the version of the legal framework used for the assessment. Institutions within the EBA loan origination guideline's scope should consider applicable governance expectations, while other creditors should check their own supervisory rules. A risk assessment demonstrates structured judgment, not automatic compliance with every underlying regulation.
Frequently asked questions
Do all non-bank lenders need the same governance structure as banks?
No. Prudential governance rules have defined scope and proportionality; consumer-credit providers must map the requirements that actually apply to them.
Can a compliance policy or risk assessment replace compliance with the law?
No. Internal documents support implementation and evidence but cannot waive statutory consumer protections.
When should credit compliance governance be reviewed?
Review after legal changes, product or model changes, outsourcing, material incidents and supervisory findings.
Primary sources
Directive (EU) 2023/2225 ↗EBA guidelines on internal governance, EBA/GL/2021/05 ↗EBA guidelines on loan origination and monitoring, EBA/GL/2020/06 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.