Credit File Reviews and Sampling

Clarify the credit file and why it is reviewed

A credit file review inspects a particular application or account record to see whether relevant lending obligations and controls were met. The file can include the application, creditworthiness information, communications, agreement, fee disclosures and servicing history. Its content varies by product and law. The review should begin by identifying the creditor, country, transaction date and issue being tested. Directive (EU) 2023/2225 addresses creditworthiness and consumer information within its scope, with revised national measures generally applying from 20 November 2026. Other present national rules still govern current transactions. A review should not assume every lending file must contain the same documents or identical internal approval steps.

Build a representative and risk-focused sample

A sample may combine random cases with targeted selections from high-risk segments. Consider declined applications, overridden decisions, short-term loans, vulnerable customers, accounts with arrears, complaints and transactions processed around system changes. Define the population and exclusion criteria before selection, then record how cases were drawn. Purely complaint-based sampling can miss failures affecting consumers who did not complain; purely random sampling may rarely encounter important exceptional journeys. A risk-weighted plan can use both. Do not describe a particular sample size as required by CCD2 or the EBA unless a specific applicable rule actually says so. Document confidence limitations and selection bias.

Check disclosures and decision evidence

Review each selected file against a question-based checklist. Were the correct pre-contract terms and rights supplied at the appropriate stage? Did the creditworthiness assessment use relevant evidence and document its reasoning? Does the amount financed match the agreement and disclosed repayment obligations? Were adverse outcomes or automated decision safeguards handled according to the actual jurisdiction? Compare records from different systems rather than accepting a single dashboard summary. A timestamped event may show that software sent a message, but does not necessarily prove its content or receipt. Mark not applicable cases explicitly and explain when underlying evidence cannot be reconstructed.

Review servicing and later events when relevant

Credit-file reviews can extend beyond origination to payment allocation, account modifications, arrears arrangements, default fees and complaints. A properly assessed initial loan may later be serviced with incorrect charges or misleading account information. Confirm the relevant event date and governing contractual terms. Examine whether hardship or revised repayment arrangements were correctly reflected across account records and bureau reporting. Retain the distinction between a consumer credit legal obligation and a lender's voluntary service standard. Where a file was transferred between servicers, check the source of balances and the responsibility for subsequent communications. Particular products and national laws may require additional checks.

Investigate exceptions and systemic causes

A missing document may result from a genuine disclosure failure, a migration problem or an incomplete archive. Investigate before concluding which occurred. Compare exceptions by channel, branch, product, system version and responsible team. If the same data field is wrong across several samples, consider whether a population-level remediation is necessary. Do not delete the original erroneous record from an investigation file without preserving lawful evidence of what happened. Assess the consumer consequences and refer potential breaches through established governance. A correction to a template does not by itself fix borrowers who already received incorrect information. Decisions should be traceable and proportionate to the confirmed facts.

Protect sample records and communicate findings

Loan files can contain identification details, payment histories and sensitive personal circumstances. Access controls, minimisation, secure transfers and retention limits should apply to reviewers and external assurance providers. Reports should present aggregated findings where case-level detail is unnecessary, while keeping a controlled audit trail for follow-up. Provide the population definition, sample selection, test questions, evidence limitations and individual exceptions that support conclusions. An apparent low error rate cannot guarantee that every file is compliant. Schedule repeat sampling after major rule or technology changes and verify whether previously identified defects have actually ceased. The methodology should remain understandable to internal audit or a supervisor. For example, a lender could draw fifty approved loans, a separate targeted set of rejected applications, and cases with manual overrides. Reviewers should not combine those results into one unexplained compliance percentage because the selection probabilities differ. If a file is incomplete, determine whether the missing data is an archive defect or evidence of a process failure. The outcome should record the distinction and identify whether any consumer-facing correction is necessary.

Frequently asked questions

Related research

credit compliance program pillar ↗

Internal Credit Compliance Audits ↗