Define the credit compliance programme and its scope
A credit compliance programme is the set of people, rules, decisions and evidence used to keep consumer-credit activities aligned with applicable obligations. It should cover the actual products, licensed entities, customer groups and markets served by the provider. For an EU creditor, duties may arise from national consumer-credit law, data protection legislation and rules specific to banks, intermediaries or payment services. Directive (EU) 2023/2225, known as CCD2, updates the consumer-credit framework, with national implementing measures generally applying from 20 November 2026. This pillar explains how to organise ongoing compliance without treating any single operational model as prescribed for every lender. A small finance provider and a supervised credit institution may need different governance structures.
Assign accountability and write usable policies
Management should know who owns the lending obligations, who operates controls and who independently challenges performance where required. A responsibility map can identify owners for advertising approvals, creditworthiness, disclosures, servicing, complaints and bureau reporting. Policies translate applicable legal rules into decisions that teams can implement: which cases require review, which evidence is recorded, who approves exceptions and when work must stop. Procedures should be specific enough to guide an employee or system configuration, while remaining adaptable to national requirements. The EBA Guidelines on internal governance address expectations for institutions within their scope, and the EBA loan origination guidelines address credit practices for covered institutions. Neither guidance should be portrayed as automatically imposing a universal three-lines structure on every non-bank creditor.
Assess compliance risks throughout the lending lifecycle
A risk assessment should begin with what could happen to a borrower if a required control fails. Advertising can create misleading expectations, inadequate creditworthiness processes can lead to unsuitable lending, and inaccurate account records can cause unjustified arrears treatment. Identify the relevant obligation, potential failure, affected population, probability, severity, existing control and responsible owner. Distinguish legal exposure from operational inconvenience. Compare product types, distribution partners, automated decisions and Member States rather than applying one generic risk score to every market. Regulatory change management belongs within this process: track legislation, transposition, judicial decisions and supervisory guidance, then update affected policies, templates and systems. Before CCD2 takes general effect, current national requirements must still be applied.
Build preventive and detective controls
A control can prevent an error before it affects a consumer, or detect an error after it has occurred. Preventive examples include approved advertising templates, mandatory pre-contract documents before acceptance and authorised access to bureau data. Detective examples include checking APR calculations, sampling credit files, reconciling arrears figures and reviewing complaints for repeated problems. Test controls using actual transaction evidence rather than relying solely on a policy attestation. Establish escalation paths for exceptions and confirm who can pause a defective process. Compliance monitoring tracks whether risks are changing, testing evaluates whether controls worked in selected cases, and internal audit may provide independent assurance depending on the institution's governance requirements. These functions overlap in evidence but should have distinct purposes.
Manage incidents, complaints and regulatory enquiries
When a control fails, record the event, establish the facts, assess affected consumers and determine whether containment or legally required notification is necessary. An operational defect is not automatically a reportable personal-data breach; GDPR Articles 33 and 34 have separate conditions where personal data is involved. Consumer complaints can reveal problems that routine metrics miss, while formal alternative dispute resolution involves its own legal framework. Use root-cause analysis to identify why an error occurred and test that remediation fixes the cause rather than only the immediate record. Supervisory requests must be answered accurately, with respect for the relevant authority's powers and national procedures. CCD2 addresses competent authorities and penalties, but the details of investigations and sanctions depend on applicable domestic law.
Create evidence that demonstrates the programme works
A defensible evidence library connects each obligation to a policy, control owner, execution record, testing result, finding and completed remedy. Retain historical versions of disclosures and marketing material so a reviewer can establish what the customer actually saw at the relevant time. Document credit file samples, exceptions, complaints, management decisions, vendor changes and supervisory correspondence in an access-controlled system. Record retention and privacy obligations should determine what can be stored and for how long, rather than a blanket assumption that every file should be kept indefinitely. A compliance management system can support assignment and reporting, but purchasing software does not demonstrate legal compliance. Review evidence after incidents, system releases, outsourcing changes and new Member State measures.
Operate a repeatable cycle of review and improvement
An effective programme should move repeatedly through mapping obligations, assessing risk, operating controls, measuring results, resolving exceptions and revising policies. Agree a review cadence that reflects product risk and applicable supervision, not a universal period asserted to come from CCD2. Leadership reporting should show open findings, deadlines, affected consumers and evidence that fixes worked. Where credit products or jurisdictions change, determine whether a new legal analysis or additional control is needed. Where internal audit is required or established, its findings should reach the appropriate governing body without being edited by the business process it reviews. The supporting guides in this cluster address governance roles, policy frameworks, risk assessments, testing, breaches, regulatory investigations, enforcement and evidence systems in greater operational detail.
Frequently asked questions
What should a credit compliance programme include?
It should map applicable legal duties to owners, policies, controls, monitoring, training, incident management, consumer remediation and evidence.
Does every non-bank lender need the same governance structure as a bank?
No. Requirements depend on the provider, jurisdiction and applicable supervisory regime. EBA governance guidelines have defined institutional scope.
When do the revised CCD2 measures generally apply?
National implementing measures generally apply from 20 November 2026. Relevant existing domestic consumer-credit law continues to matter before that date.
Primary sources
Consumer Credit Directive (EU) 2023/2225 ↗GDPR Regulation (EU) 2016/679 ↗EBA Guidelines on Internal Governance ↗EBA Guidelines on Loan Origination and Monitoring ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.
Related research
Credit Compliance Governance Explained ↗
Roles and Responsibilities in a Credit Compliance Team ↗
Credit Compliance Risk Assessments ↗