Preparing for a Consumer Credit Regulatory Review

Define the review scope before gathering files

A consumer-credit regulatory review may examine one product, an authorised institution, an entire lending business or a specific conduct problem. Begin by establishing which national authority has jurisdiction, what legal requirements apply and which period is under examination. Under Directive (EU) 2023/2225 Article 41, Member States designate competent authorities with investigating and enforcement powers, but the practical mechanisms arise through domestic law. The revised Directive generally applies through national measures from 20 November 2026, so a 2026 review may concern current national implementation of Directive 2008/48/EC instead. Separate an internal readiness exercise from a formal supervisory request. Document the mandate, products, countries and expected evidence before circulating an extensive data request.

Build a legal-obligation and evidence map

Map each relevant requirement to the customer experience, the operational control and a retrievable evidence source. Advertising reviews might need dated promotions and rate calculations; pre-contract reviews require the form delivered to each sample customer and evidence of timing. Creditworthiness reviews may need decision inputs, database use, affordability logic and explanations of automated processes. Servicing reviews can involve repayments, arrears, complaints and correction records. Avoid describing an internal checklist as the source of law: cite statutes, national implementing measures and relevant supervisory rules. Name the control owner and system of record. This structure lets reviewers demonstrate what operated during the review period, rather than what a current policy says should happen.

Select representative credit-file samples

A review cannot rely solely on the most straightforward approved applications. Create a sample plan reflecting credit products, channels, jurisdictions, approval outcomes, declined applications, vulnerable customer pathways and relevant exceptions. Where automated pricing or creditworthiness models are used, include versions that operated during the period examined. Record the sampling method and its limitations. Reconcile each case to contractual terms, disclosures, bureau enquiries and customer communications. Some data may be missing because of legitimate retention periods, while other gaps may reveal control weaknesses; do not confuse them. A sample finding should lead to a reasoned assessment of whether other consumers or periods might be affected.

Reconcile policies with real operating evidence

Compare the approved policy against transaction logs, vendor records and customer-facing documents. An accurately worded SECCI template is weak evidence if a checkout workflow delivered it after the agreement was signed. A written complaints policy is insufficient if cases were miscategorised or left unanswered. Version-controlled pricing and disclosure files can help trace discrepancies between promotional examples and actual offers. Check staff permissions, escalation paths, training, exception approvals and system access for the applicable time period. Resolve factual inconsistencies before presenting a conclusion, while preserving original records. A readiness report should disclose unresolved deficiencies rather than certify compliance based on document existence alone.

Organise responses, confidentiality and governance

Set an accountable response coordinator, legal reviewer and data owner for each workstream. Establish secure access to the evidence library and record which versions are shared with external parties. Customer credit files can contain sensitive personal data, so GDPR principles and any applicable secrecy requirements remain relevant during preparation. If the authority asks for information, verify its powers and the scope of the request; do not assume every demand requires providing unrelated personal records. EBA internal governance guidance may inform the practices of institutions within its scope, but should not be attributed indiscriminately to all fintech lenders. Escalate identified material issues through the organisation's actual governance arrangements.

Close gaps and preserve a defensible action trail

Track findings by legal requirement, affected population, severity, owner, due date and evidence of remediation. Distinguish immediate containment from permanent correction and verify effectiveness by repeating the relevant transaction or sampling test. The original assessment, decisions and technical logs should be preserved under lawful retention requirements. If an error has harmed consumers, evaluate restitution, communication and any reporting obligation under the applicable national framework. A compliance review can finish administratively while actions remain open. Keep an up-to-date status register for management and any future supervisory follow-up. Revisit assumptions when CCD2 national implementing measures take effect or an authority publishes new decisions. Before a scheduled external review, rehearse the delivery of a small evidence set through the same approval and secure-transfer process that would be used in practice. Check whether each attachment can be opened, whether its date is unambiguous and whether the described control existed during the period examined. An unexpected result should be recorded as a finding, not quietly excluded from the sample. If the scope includes several national markets, name a separate owner for each legal mapping and retain country-specific explanations. This prevents apparently uniform evidence from obscuring material legal and operational differences.

Frequently asked questions

Related research

How to Build and Operate a Credit Compliance Program ↗

Building a Credit Compliance Evidence Library ↗