Why an approval code is not enough
A creditor may approve an application with one numerical score, but that outcome does not explain the underlying assessment. An audit should be able to reconstruct the credit product, proposed amount, repayment schedule, legal regime and evidence available at the time of decision. Separate the final decision from inputs and assumptions: a verified salary, estimated household cost and bureau-reported repayment obligation have different evidential qualities. Save the decision timestamp and model or policy version. A later account change must not silently overwrite the original evidence. A creditor's responsibility can remain relevant even where an intermediary or vendor collects information or operates the software. The useful question is not whether a file contains numerous documents but whether it demonstrates the legally required analysis for that borrower and commitment. Define essential fields before deploying the workflow.
UK FCA CONC 5.2A recordkeeping duties
FCA CONC 5.2A.33 requires records for relevant regulated credit agreements and significant credit increases sufficient to demonstrate that the necessary creditworthiness assessment was carried out and was reasonable. It also addresses governance and controls. Proportionate assessment under CONC 5.2A.20 does not mean proportionate recordkeeping is optional: the firm needs enough evidence to show the information and judgment were reasonable in the circumstances. Records should identify the income and non-discretionary expenditure method, existing debts, any relevant verification and rationale for overrides. A record is less persuasive if assumptions exist only in undocumented staff knowledge or a vendor dashboard that no longer retains historical outputs. Where the firm relies on statistical estimates, record the benchmark, version and why it was appropriate for the individual's circumstances. Assess exceptions and retention under the full current rules.
EU CCD2 assessment evidence
Directive (EU) 2023/2225 Article 18 addresses assessment before a relevant agreement and the use of adequate and relevant financial information. Article 19 concerns database access. The revised national implementing provisions generally apply from 20 November 2026, with transitional provisions; earlier domestic law remains relevant before commencement. Evidence design should distinguish the current law from a future CCD2 gap-remediation plan. An EU-wide template may capture common fields, but individual Member State legislation can affect the records, consumer rights, permitted data and supervisory expectations. A lender should maintain jurisdiction and law-version fields for every decision, particularly for agreements crossing the changeover date. Avoid assuming the Directive establishes one fixed retention period for every creditworthiness artifact. Assess retention against applicable national credit, privacy and sectoral requirements.
US records and adverse action support
In the United States, recordkeeping is governed by multiple regimes rather than a universal European-style affordability file. Regulation B section 1002.12 sets certain record-retention duties relating to applications, while section 1002.9 governs adverse-action communications. The creditor must be able to explain actual principal reasons for a covered adverse action and support its decision records. Mortgage ability-to-repay requirements under Regulation Z can create additional obligations for covered transactions. FCRA obligations may arise where consumer reports are used. The product and lender category matter. A retention schedule should therefore be mapped to the actual provisions rather than applying a single global period. Store the actual attributes reviewed, not merely a general denial code; compare notices against original scoring and policy decisions where required.
Building a reproducible assessment file
A practical assessment file contains a transaction identifier, customer and creditor references, product version, credit amount, payment terms, applicable jurisdiction, application date, income and expenditure inputs, obligation estimates, bureau or account data references, model or rule version and the final action. Mark each source as declared, estimated or verified and record the dates used. Preserve changes that alter the decision, such as corrected income or debt evidence, without erasing the prior state. Define a route for human review of exceptions and automated assessments where applicable. For third-party decisions, identify which party owns the final assessment obligation. Run reconstruction tests by selecting a historical agreement and reproducing both its original decision and the customer-facing disclosure without using current model defaults.
Retention, privacy and access controls
Creditworthiness files may include bank transactions, salaries, household obligations and sensitive inferences. Permission to collect evidence is not permission to retain or share every data item indefinitely. Apply lawful-processing, necessity, security, access and retention controls under the applicable regime. Where an audit only needs an extracted repayment amount and a verified source marker, assess whether keeping the entire transaction feed remains justified. Define access by role and monitor downloads by vendors and employees. A review request or legal dispute may justify a documented hold without extending routine retention for unrelated records. When de-identifying files for model validation, ensure that source records remain traceable only to the extent legitimately necessary for testing and correction.
Testing audit readiness
An assurance sample should cover approvals, rejections, significant credit increases, missing data, overrides, automated decisions and consumers with irregular incomes. Check that source timestamps precede the decision, that the model version existed at the time and that the agreed repayment amounts match those assessed. Review whether required notices and explanations were actually delivered, and whether appropriate human review was available where law requires it. Test whether a simulated new policy deployment changes old records or creates unreproducible calculations. Capture exceptions, remediation owners and completion evidence. Trends in defaults, complaints or inconsistent treatment can trigger further sampling, but outcome statistics cannot replace review of the decision process. A reliable audit trail links the rule, the individual borrower data, the assessment logic and the resulting decision with evidence that remains intelligible later.
Frequently asked questions
Is a creditworthiness score enough to demonstrate compliance?
No. The decision should be linked to applicable assessment requirements and relevant evidence.
Do EU, UK and US rules require identical processes?
No. The applicable obligations and consumer rights differ by product and jurisdiction.
When do revised CCD2 measures generally apply?
From 20 November 2026, subject to national laws and transitional provisions.
Primary sources
Directive (EU) 2023/2225 ↗FCA Handbook CONC 5.2A ↗CFPB Regulation B 1002.9 ↗CFPB Regulation B 1002.12 ↗CFPB Regulation Z 1026.43 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.