Build policies from a jurisdiction and product map
A credit compliance policy framework translates applicable laws into clear decisions about products, customers, processes and evidence. Begin with the countries served, the regulated entities involved and the agreement types offered. Then determine which obligations apply to marketing, eligibility checks, creditworthiness, disclosures, contract execution, account servicing, arrears, complaints and recordkeeping. An EU lender should separate currently applicable national consumer-credit law from the revised requirements under Directive (EU) 2023/2225, whose implementing measures generally apply from 20 November 2026. Bank-specific governance guidelines and national licensing conditions may create additional obligations. A generic consumer-credit policy copied between jurisdictions can obscure important legal differences, even if its principles sound reasonable. Record source provisions and owners for each significant rule.
Use a hierarchy from principles to work instructions
A workable hierarchy can include an overarching compliance policy, topic-specific standards, operating procedures, system configurations and supporting evidence. The high-level policy explains governance, authority and escalation. Topic standards identify specific requirements such as when APR information appears in advertisements or when creditworthiness data must be evaluated. Procedures specify how staff or automated systems execute those obligations. Control descriptions connect activity to logs, records or independently reviewable outputs. Avoid reproducing legislation verbatim without stating who must act. A document saying that disclosures will be compliant adds little unless it identifies the approved form, data owner, issue timing and correction process. Keep legal obligations identifiable separately from voluntary internal tolerances.
Set approval authority and change controls
Each policy should name an owner, approving authority, effective date, version, jurisdiction, products covered and next review trigger. Material policy changes may need legal analysis, product owner sign-off, independent compliance challenge and systems testing. Maintain an exceptions process but do not imply that a manager can waive statutory borrower rights. Temporary workarounds should identify the actual legal position, compensating controls, expiry and consumer impact. An underwriting threshold altered by a model owner can affect published creditworthiness procedures, while a new fee may affect marketing, APR calculation, pre-contract information and complaints. Change review should therefore identify linked policies and customer artifacts. Preserve superseded versions where lawful retention and evidence needs justify them.
Write policies for the real lending workflow
Map instructions to the events employees and systems encounter: online application initiated, bureau report obtained, offer repriced, disclosure generated, agreement accepted, missed payment reported and complaint received. State what the operator must verify, what the system must prevent and what happens when information is missing or inconsistent. For automated lending, test actual decision configurations rather than relying only on diagrams. If an application can proceed while a disclosure service is unavailable, a policy requiring delivery before acceptance may not be working. Use realistic exceptions and escalation scenarios to identify gaps. Training should focus on decisions people make rather than asking staff to memorise abstract definitions from the regulatory text.
Align controls with the applicable governance regime
EBA/GL/2020/06 covers loan origination and monitoring for institutions and specified creditors within its scope and addresses internal governance, creditworthiness and credit decision-making. EBA/GL/2021/05 includes relevant internal governance expectations for credit institutions under its scope. These guidelines should not be described as a uniform code applying identically to every non-bank lender. More broadly, consumer-credit obligations, GDPR rules, financial promotion requirements and national supervisory rules must be mapped to their actual legal basis. When a policy cites a guideline, note whether it is binding through the relevant supervisory framework, an applicable expectation or an optional internal reference. That distinction helps auditors assess real gaps rather than treating every recommended practice as a legal violation.
Measure implementation and maintain the framework
An effective framework includes a register of approved policies, linked procedures, control owners, training, monitoring results and corrective actions. Test selected customer journeys and trace outcomes to the rule and evidence that should support them. Look for contradictions: a marketing policy allowing a phrase that the complaints policy describes as misleading, or a retention policy inconsistent with bureau correction procedures. Review after new legislation, court judgments, supervisory publications, product changes and material incidents. Governance reports should show overdue reviews and unresolved policy exceptions instead of measuring success only by the number of signed documents. Preserve a change history so future reviewers can reconstruct what policy was operative when a lending decision was made.
Frequently asked questions
Do all non-bank lenders need the same governance structure as banks?
No. Prudential governance rules have defined scope and proportionality; consumer-credit providers must map the requirements that actually apply to them.
Can a compliance policy or risk assessment replace compliance with the law?
No. Internal documents support implementation and evidence but cannot waive statutory consumer protections.
When should credit compliance governance be reviewed?
Review after legal changes, product or model changes, outsourcing, material incidents and supervisory findings.
Primary sources
Directive (EU) 2023/2225 ↗EBA guidelines on internal governance, EBA/GL/2021/05 ↗EBA guidelines on loan origination and monitoring, EBA/GL/2020/06 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.