What a decision file must establish
A creditor's decision record should answer which agreement was proposed, who assessed it, what information was used and how the result followed from the relevant policy and legal obligations. Store the amount, term, payments, interest conditions and decision time alongside the evidence. A generic approved or declined flag leaves unanswered questions about repayment capacity and responsible lending. The file should distinguish applicant declarations, verified figures, vendor data, statistical assumptions and manual adjustments. Where a broker or provider collects information, identify its role and the creditor responsible for the resulting assessment. Record the decision policy and model version in force at that moment. An auditor should be able to reconstruct the decision without depending on the lender's present model or a staff member's memory.
Income, expenditure and debt evidence
Income evidence may consist of declarations, payslips, appropriately accessed bank information or other lawful sources. Expenses and existing debt obligations may be estimated or verified to the extent required by the governing regime and circumstances. Each material amount needs a source, observation date, relevant period and explanation of how it was used. A recurring payment shown in both bureau and bank data should not be counted twice without justification, while a newly opened debt may be absent from older reports. Record discrepancies and how they were resolved. For irregular income, identify the estimation method and any sensitivity assessment. Retain enough material to show the final calculation and why the chosen evidence was adequate, subject to data protection and retention requirements.
FCA recordkeeping and reasonable assessment
FCA CONC 5.2A requires relevant creditors to perform a reasonable creditworthiness assessment. CONC 5.2A.33 addresses keeping records sufficient to demonstrate compliance with the assessment requirements. This includes showing that decisions were reasonable in the circumstances and supported by an appropriate process. A policy name or credit score does not independently establish that income, expenditure and risk were evaluated appropriately. Note whether the assessment considered risk of nonpayment and the risk to the customer of being unable to pay. Proportionality affects the extent of inquiry but does not justify concealing known problems or discarding critical evidence. Store material exception decisions, reviewers and the underlying grounds. Check the current Handbook for the applicable product and any exemptions.
EU CCD2 implementation and audit timing
Directive (EU) 2023/2225 Article 18 establishes creditworthiness assessment expectations and Article 19 addresses database access. Revised national implementation generally applies from 20 November 2026, with relevant transitional rules. The documentation process must identify the operative national provisions and distinguish obligations applying at the time of the loan from measures scheduled to apply later. A standard file may use common fields across Member States, but law on information categories, consumer rights and retention may differ. Record the applicable country, agreement type and regulatory version. Document the timing of any reassessment before a qualifying significant increase. An audit process should not rewrite historic decisions against later standards or assume that the Directive sets one uniform retention period for every category of evidence.
US records and adverse action explanations
US record retention depends on the actual product and legal regime. Regulation B section 1002.12 provides record-retention requirements for relevant applications, while section 1002.9 governs adverse-action notices. Specific principal denial reasons should reflect the factors actually considered or scored rather than an invented after-the-fact explanation. Certain covered mortgages carry further Regulation Z requirements; FCRA obligations may arise when consumer reporting information is used. The lender should classify the action as approval, denial, incomplete application, account adjustment or another defined event before choosing notices and retention rules. Decision logs should preserve facts needed to demonstrate nondiscriminatory evaluation. A vendor's generic reason code should be checked against the actual underwriting inputs and any applicable notice obligation.
Audit trail, privacy and quality control
Record timestamps for each material data extraction, verification, assessment, override and final communication. Store a reproducible model or policy identifier rather than relying on a current configuration that may have changed. Define review access, security and lawful retention so that sensitive financial information is not held indefinitely without purpose. Test samples from approvals, rejections, limit increases, irregular-income applications and cases with conflicting evidence. Reconcile the agreement issued against the agreement assessed. Audit records should show how challenges or corrections were handled while preserving the original decision. Trends in hardship and complaints can reveal weakness, but an outcome alone does not establish whether every historic assessment complied with its governing law. The objective is accountable and intelligible evidence.
Example: reconstructing a contested decline
Assume an applicant is refused a loan after a model treats an internal bank transfer as a recurring debt payment. An effective record shows the source transaction, transformation that classified it, model version, calculated expenditure, assessment result and the actual reason delivered to the customer. When the consumer disputes the result, a reviewer can identify the duplicate, correct the data and consider whether a fresh decision is appropriate. The original record remains intact for audit, while the correction is linked through a dated review event. This matters under regimes requiring accurate adverse-action reasons or appropriate reassessment, but the precise communication and remedy depend on jurisdiction. A summary score without input history would not support meaningful investigation of the disputed payment.
Frequently asked questions
Does a credit score establish compliance?
No. It is one possible input; the creditor must satisfy the applicable assessment and recordkeeping requirements.
Are requirements identical in the EU, UK and US?
No. Scope, triggers, decision rights and notice duties are jurisdiction-specific.
When do revised CCD2 measures generally apply?
From 20 November 2026, subject to national implementation and transition.
Primary sources
Directive (EU) 2023/2225 ↗FCA CONC 5.2A ↗CFPB Regulation B Section 1002.9 ↗CFPB Regulation B Section 1002.12 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.