Define the control and its legal objective
Credit compliance testing determines whether particular controls work on actual transactions, not merely whether a procedure exists. Begin by mapping the test to an applicable rule, product, customer journey and control owner. A pre-contract disclosure test, for example, might ask whether the correct information was supplied before the consumer became bound, while a creditworthiness test examines assessment evidence and decision rationale. The governing law must be identified by country and agreement date. Directive (EU) 2023/2225 generally applies through national implementing measures from 20 November 2026; this does not displace currently applicable national requirements. Testing standards and organisational structure may also differ between banks and non-bank providers.
Design tests that can distinguish success from failure
Write an objective test procedure before reviewing files. Specify the required outcome, population, sample period, evidence expected and failure conditions. A check that a document exists is weaker than confirming the correct version, its values and the timing of delivery. Similarly, a logged credit decision is not sufficient proof that required input information was considered. Define how testers will handle incomplete records, automated exceptions and situations where the rule does not apply. Avoid treating each failure as a breach without considering the precise legal requirement. A well-designed test distinguishes legal violations, control gaps and documentation weaknesses and permits an independent reviewer to reproduce its conclusions.
Select the scope and evidence with care
Testing may cover origination, advertising, data access, pricing, servicing, arrears and complaints. Select processes according to the risk they create for consumers and the scope of applicable obligations. Evidence might include application timestamps, approved disclosure templates, underwriting records, transaction data, consumer communications and change logs. Protect personal and financial information when sampling. Where vendors host the relevant systems, arrange authorised evidence access and confirm that exported files represent the actual consumer experience. Document gaps explicitly rather than recording an unobservable control as passed. Consider whether the control worked at the relevant transaction date rather than relying on the current configuration alone.
Execute samples and classify exceptions
Apply the same criteria consistently while retaining room to investigate unusual cases. A sample showing a missing APR figure should be assessed against whether the advertisement actually contained the rate or cost information that triggers that disclosure requirement. A delayed complaint response requires verification of the applicable deadline and start date. For automated systems, compare the generated output with input data and the model or rules version operating then. Record both compliant and noncompliant cases to avoid one-sided evidence. When a repeated defect emerges, expand testing or analyse the affected population instead of assuming a small sample proves its total extent.
Assign remediation and retest controls
Separate the immediate consumer impact from the technical root cause. A defect might require a corrected document, repayment adjustment, revised eligibility decision or other response under applicable law. Identify an accountable remediation owner, severity, due date and evidence of closure. Retesting should inspect a new population or relevant corrected transactions, not merely rely on an email saying the code was fixed. Escalate material issues through the organisation's governance arrangements. The compliance function should monitor remediation independently where appropriate; internal audit provides a different level of assurance for organisations subject to that structure. Do not label an unverified remediation closed.
Report useful results and limitations
An effective testing report identifies the legal source, period, population, sample method, number of exceptions, likely consumer consequences and agreed response. Clarify what was not tested and whether the evidence was incomplete. Trend results can reveal recurring disclosure or data-quality defects, but percentages alone may hide serious isolated failures. Compare outcomes with previous remediation and complaint themes. The EBA Guidelines on loan origination and monitoring and its internal governance guidance provide useful institutional context where within scope, not universal statutory testing rules for all creditors. Review the programme after rule changes, product redesigns or significant control incidents to keep tests linked to operational reality. For a concrete example, a creditor may discover that a fee disclosure control passed in desktop testing but failed on a mobile checkout where the required terms were obscured. The compliance reviewer should capture the exact screen, device configuration, loan terms and timing, then establish whether the issue affected additional customers. Similar checks should cover languages, application restarts and changes to pricing. The test conclusion must identify the evidence rather than assume a successful deployment guarantees compliance.
Frequently asked questions
Is compliance testing the same as internal audit?
No. Testing may be an ongoing compliance activity, while internal audit is an independent assurance function where applicable.
Does an approved policy prove a control works?
No. Test actual transactions and records against defined requirements.
Should failed tests be retested after remediation?
Yes. Retesting provides evidence that changes operated as intended.
Primary sources
EBA Guidelines on internal governance under CRD ↗EBA Guidelines on loan origination and monitoring ↗Directive (EU) 2023/2225 on consumer credit ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.