Legal scope and the lending decision
A responsible lending process starts by establishing the product, creditor, borrower, jurisdiction and date. An instalment loan, revolving credit facility, overdraft and deferred-payment arrangement can carry different obligations. Creditors should identify the moment at which the legal assessment is required and distinguish an initial agreement from a significant credit increase. A broker's collection of application information does not necessarily transfer the creditor's legal responsibility. Document which entities provide data, perform the assessment and make the decision. The evidence should connect the proposed repayment terms to the borrower's circumstances rather than merely showing an approval code. A consistent audit trail enables legal review when a lending product is changed or distributed across new markets.
Credit risk and affordability
Credit risk considers whether payments are likely to arrive when due. Affordability is concerned with whether the customer can make those payments without unacceptable financial difficulty under the relevant rules. Those outcomes may differ. A consumer can have a strong repayment history and still face severe pressure from necessary living expenses; another can have limited bureau data but enough available income for a small obligation. Under UK FCA CONC 5.2A both repayment risk and affordability risk feature in a creditworthiness assessment. The creditor should not treat an algorithmic score, collateral value or guarantor as an automatic substitute for a review of the customer's own circumstances where the governing regime requires it.
The revised EU consumer credit framework
Directive (EU) 2023/2225 Article 18 establishes a revised creditworthiness framework that connects the assessment to a consumer's ability to meet credit obligations and to the prevention of irresponsible lending. Information concerning income, expenses and other financial or economic circumstances is significant. Article 19 addresses access to databases. Member States were required to transpose the revised Directive by 20 November 2025, while national implementing measures generally apply from 20 November 2026. Those dates must not be collapsed into one. Until commencement, lenders must identify the existing law applicable in each Member State and any transition provisions. The requirements for different products and national implementations may differ, so one EU-labelled decision workflow needs country-specific legal mapping.
UK and US requirements
FCA CONC 5.2A requires reasonable assessments before relevant consumer credit agreements and specified significant increases in credit. The rule addresses income, expenditure, repayment capacity and proportionality. UK rules should not be confused with EU CCD2 implementation. In the United States there is no single federal assessment rule equivalent to CONC 5.2A for every consumer loan. Certain mortgages have ability-to-repay obligations under Regulation Z section 1026.43, while ECOA and Regulation B regulate discrimination and adverse action explanations for relevant credit decisions. State law may add requirements. A cross-border credit system should therefore separate assessment rules from notice duties and recordkeeping, rather than assuming one globally uniform credit score threshold satisfies every standard.
Evidence and decision governance
Records should identify application inputs, information sources, data age, income and expenditure assumptions, existing debts, model version, exceptions and the final decision. Incomplete or contradictory information calls for a defined escalation path. A lender should decide when further verification is necessary in light of the proposed commitment and the governing legal standard. Reviews should test both approvals and declines because credit policies may be legally deficient even when immediate defaults remain low. Store the legal source and policy version applied when the decision was taken. Investigate differences across customer groups under applicable fair-lending and data-protection standards, without collecting prohibited information or presenting model outputs as independent legal findings.
Controls across the lending lifecycle
A policy should identify when a fresh assessment is necessary, including significant increases in an account's credit limit or other regulated changes. Product teams must communicate altered repayment schedules and eligibility criteria to credit decision and disclosure systems. Operational monitoring should include missed-payment trends, complaints, affordability overrides and fairness concerns. A creditor using a vendor decision engine should independently assess its performance, data quality, product scope and contractual responsibilities. Regulatory-change monitoring must distinguish national CCD2 commencement dates from FCA or US amendments. The goal is a reproducible lending decision that can be explained and reviewed, not a folder of collected documents with no demonstrated analysis.
Frequently asked questions
Is a credit score enough?
Not necessarily; relevant legal obligations may require broader evidence and review.
When do new CCD2 national measures apply?
Generally from 20 November 2026, subject to applicable national transitional rules.
Primary sources
Directive (EU) 2023/2225 ↗FCA CONC 5.2A ↗CFPB Regulation B §1002.9 ↗CFPB Regulation Z §1026.43 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.