Credit Compliance vs Credit Risk Management

Different questions, different outcomes

Credit risk management asks whether a borrower is likely to repay and what a failure to repay would cost a lender. It often considers probability of default, exposure, recoveries, concentrations and portfolio performance. Credit compliance asks whether a creditor or intermediary has met the legal rules governing the transaction, including information, assessment, discrimination, contracting and servicing duties where applicable. A lender can make a loan that performs well while still violating a disclosure requirement. It can also follow required customer processes but experience losses when borrowers encounter financial difficulty. Neither strong loan performance nor compliance documentation alone demonstrates the other discipline's success. Teams should maintain separate objectives and trace their overlap explicitly.

What a credit risk framework measures

Credit risk processes may segment borrowers, estimate loss, set lending limits, monitor delinquency, stress assumptions and report concentrations. Credit scoring is one possible input, not a definitive account of the borrower's circumstances. Models require data-quality review, validation and monitoring under applicable firm requirements and supervisory expectations. A portfolio threshold reflects an institution's risk appetite and business strategy. It is not automatically a legal threshold for whether credit may be offered to a consumer. A bank's prudential framework may impose additional risk management duties, but those should not be confused with conduct duties imposed by consumer credit rules. Document model version, use case, key inputs and policy overrides to enable later scrutiny.

Credit compliance protects more than the lender's balance sheet

Consumer-credit regulation can address advertisements, pre-contract information, total cost, creditworthiness, contractual rights, treatment of arrears, credit data and consumer complaints. The applicable duties vary by product and jurisdiction. Compliance controls may ask whether required information appeared at the prescribed stage, whether an explanation was understandable, or whether a consumer could exercise a statutory right. Those questions cannot be answered simply by checking repayment rates. Conversely, a legally correct notice does not demonstrate that the credit portfolio is financially sustainable. Operational evidence should therefore distinguish legal-compliance tests from portfolio or pricing analytics while preserving the connections between decisions and records.

The UK distinction between credit risk and affordability risk

The FCA's CONC 5.2A provides a particularly useful legal illustration. For covered consumer-credit lending, CONC 5.2A.10R requires the firm to consider the risk that a customer does not repay when due, commonly called credit risk, and the risk to the customer of not being able to make repayments, called affordability risk. CONC 5.2A.12R and related provisions address the customer's repayment ability, including the relevant circumstances and sources of payment. The Handbook's application and exceptions must be checked before transferring these duties to a given product. A lender could regard the expected loss as manageable while repayment commitments create unacceptable hardship for a particular consumer. Its commercial willingness to lend is not the same as satisfying the regulated assessment.

EU CCD2 and the transition in 2026

Directive (EU) 2023/2225 includes provisions governing creditworthiness assessment for covered consumer credit. A compliance analysis must assess the Directive's requirements, national implementing rules and the timing of the agreement. On 12 October 2026, the Directive is in force but national measures implementing its substantive framework are required to apply from 20 November 2026, subject to transitional treatment. A firm should not present its CCD2 implementation approach as a statement that all provisions already apply under current national law. The updated framework reinforces the need to treat creditworthiness as a consumer-protection obligation, not merely a decision on whether a lender can tolerate loss. Country-specific application and any permitted options must be researched.

How compliance and risk teams should work together

A useful control architecture separates legal requirements, model design and operational approval. Legal or compliance specialists identify the applicable creditworthiness, data and explanation rules. Risk teams define and test models or policies used to estimate repayment and portfolio performance. Operations staff implement customer journeys, decision records and exception processes. Independent monitoring checks that the controls work in practice. One record may serve several functions, but the reasons for retaining it should be distinguished. Evidence might include assessment inputs, model version, data lineage, applicable policy, override reason, decision date and relevant consumer communication. Retention and access rules must follow applicable law rather than a generic assumed period.

Review emerging model and conduct issues separately

Automated credit decisions can introduce model drift, biased outcomes, poor explanations or data-quality problems. Credit risk monitoring can detect rising defaults but may not identify unlawful discriminatory treatment or deficient adverse-action reasons. Conversely, a model can pass fairness testing while performing poorly as a predictor. In the United States, Regulation B may require specific adverse-action reasons; the actual requirements depend on the covered credit transaction and rule. In the UK, applicable FCA conduct and creditworthiness provisions require their own review. Firms should monitor law and guidance changes, model adjustments, new data sources and substantial changes in approval policy. Keep risk measures and compliance conclusions distinct even when the same dataset informs both.

Frequently asked questions

Related research

the credit compliance fundamentals pillar ↗

Credit Compliance vs Lending Compliance ↗