A review request needs a real decision pathway
A customer may challenge an automated rejection because income was miscategorised, a credit file is inaccurate or a particular expense was counted twice. An effective human-review process should obtain the customer's explanation, check the evidence and reconsider the outcome under current policy. It is not sufficient for a support agent to read an automated score aloud without the ability to examine the underlying data and escalate or change an erroneous conclusion. Define who can review the decision, what data they can access, how they record reasons and when an applicant receives a response. A review should be distinguished from general complaint handling and from a fresh application made with different information. Retain the original decision as well as the review outcome to preserve a reliable audit trail.
EU CCD2 Article 18(8) rights
Under Article 18(8) of Directive (EU) 2023/2225, where a creditworthiness assessment involves automated processing of personal data, Member States must ensure the consumer can obtain human intervention. The specified rights include a clear explanation of the assessment, including logic, risks, significance and effects of automation; an opportunity to express the consumer's point of view; and a request for review of both the assessment and the granting decision. Article 18(9) covers notice of rejected applications and relevant procedural information. The requirements should be implemented according to operative national measures, generally applying from 20 November 2026, with transitional arrangements. They do not establish a right to automatic approval after a consumer requests reconsideration. Staff should be trained to distinguish an explanation request from a complaint or appeal that requires a reassessment.
Data protection is a separate part of the assessment
Personal data regulation may apply alongside consumer credit legislation. In the EU the GDPR includes provisions addressing certain decisions based solely on automated processing, subject to conditions and exceptions. A bank should not equate every automated workflow with a decision that is solely automated within the meaning of a separate data protection provision. Nor should it assume the presence of a nominal human click cures all data-protection concerns. Review whether the person had meaningful involvement, access to relevant facts and authority to change an outcome. Data minimisation, accuracy, lawful processing and fair use matter even if an automated decision falls outside a particular prohibition. Legal teams should evaluate these rights alongside the CCD2 regime in the relevant Member State.
UK approach and FCA conduct rules
The UK is outside the EU CCD2 transposition framework, and its consumer-credit and data-protection laws must be assessed on their own terms. FCA CONC 5.2A addresses whether the creditworthiness assessment is reasonable, regardless of whether it is carried out by software or an employee. UK GDPR provisions and current domestic implementing arrangements may apply to certain automated decisions and associated safeguards. A firm should determine the legal basis for review, its procedure and customer communication duties rather than promising CCD2 rights as UK statutory entitlements. Nonetheless, an appropriate internal route for correcting inaccurate income, debts or model outputs can reduce the risk of irresponsible lending and customer detriment. Staff must be able to identify when an apparent appeal should instead be handled as a regulated complaint or data dispute.
United States explanations are not the same as EU review
Regulation B section 1002.9 addresses notices of adverse action and the disclosure of specific principal reasons in covered US credit situations. The official interpretation explains that reasons must correspond to factors actually reviewed or scored, including where automatic-denial rules apply. This does not create a uniform federal right identical to CCD2's human-intervention process for all credit products. The Fair Credit Reporting Act may create dispute and notification duties concerning information obtained from consumer reporting agencies. State law and particular products can add other obligations. A US review process should therefore distinguish adverse-action explanation, credit-report dispute, internal appeal and any legally mandated reconsideration pathway. Using one generic global appeal policy can obscure differences in scope, deadlines and disclosures.
Design the review record and quality assurance
A review form should identify the original application and agreement terms, model version, data relied on, stated reasons, consumer challenge, documents received and new findings. The reviewer should assess source accuracy and whether the credit policy was applied consistently, then document whether approval, rejection or further evidence is appropriate. Escalate cases involving suspected discrimination, customer vulnerability, data integrity or legal uncertainty. Notify the consumer as applicable and preserve the sequence of communications. Audit samples should examine how often reviews correct categorisation errors, whether the reviewer has genuine decision authority and whether explanations are understandable. Monitoring outcomes can reveal systematic model faults that require remediation beyond a single application. Review rights and disclosures should be updated when the governing law or model changes.
Frequently asked questions
Does every automated decision require the same human review process?
No. The applicable right depends on the legal regime and the nature of the decision or processing.
Can a creditor rely on an old assessment for any credit limit increase?
Not automatically. Some significant increases require updated assessment and current data.
When do revised CCD2 national measures generally apply?
From 20 November 2026, subject to national commencement and transition.
Primary sources
Directive (EU) 2023/2225 Article 18 ↗FCA Handbook CONC 5.2A ↗CFPB Regulation B section 1002.9 ↗CFPB Regulation Z section 1026.43 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.