Identify the authority, mandate and legal basis
A credit provider may receive enquiries from consumer-credit supervisors, data protection authorities, conduct regulators or authorities responsible for banking prudential oversight. The identity of the competent body depends on jurisdiction, entity type and suspected issue. CCD2 Article 41 requires Member States to designate authorities with investigating and enforcement powers, but their practical authority is exercised under applicable national law. The Directive's revised implementing measures generally apply from 20 November 2026. Before responding, confirm the issuing authority, scope, deadline and statutory basis. Do not assume that an informal industry enquiry has the same powers or consequences as a formal compulsory information request.
Establish a controlled response structure
Appoint a contact responsible for coordinating legal, compliance, operations, technology and records teams. Log each request, its recipient, delivery method, response due date and any confidentiality conditions. Where needed, obtain legal advice about procedural rights, legal privilege and disclosure duties in the relevant country. Staff should not destroy or alter potentially relevant records; preservation and retention must be managed lawfully. Define what has been requested rather than supplying broad unrelated personal datasets. A consistent record of communications reduces the risk of contradictory answers, missing attachments and accidental release of protected customer information.
Gather evidence from primary operational systems
Regulatory examinations may focus on sample credit files, agreements, complaints, call records, policy approvals, decision models, audit reports and past corrective actions. Identify authoritative systems and extract versions that actually applied during the review period. Avoid replacing historical disclosures with current templates and representing them as what customers saw. Reconcile totals and dates before providing statistics. When a request asks for a specific customer outcome, trace the relevant transaction through the lending lifecycle and identify any missing records transparently. A response should clearly distinguish verified facts, estimates, assumptions and later remedial measures.
Handle confidentiality, privilege and personal data
An investigation does not remove every privacy, secrecy or procedural safeguard. CCD2 Article 41 addresses professional secrecy for competent authorities, while their operational powers depend on national law. GDPR supervisory authorities have their own investigative and corrective powers under Article 58. The creditor should assess disclosure requests against the actual authority and legal basis, applying secure transfer and appropriate access restrictions. Privilege and confidentiality rules vary between legal systems; do not claim that all internal investigation reports are automatically protected. Record how the information was selected, reviewed and transferred, and who approved the disclosure.
Respond accurately and address emerging findings
Provide clear answers to each question, with dated exhibits and a method for identifying later corrections. If the organisation discovers that an earlier statement was materially wrong, escalate that issue promptly and determine its duty to correct it. Findings about defective marketing, creditworthiness, arrears or bureau reporting may require parallel consumer remediation. Agree an action plan with accountable owners, dates and testing evidence where appropriate. Do not portray discussions with a regulator as a guarantee of approval, and avoid prematurely announcing an enforcement outcome. Keep factual cooperation distinct from legal positions that may require advice.
Close the investigation with governance follow-through
Following an inquiry, preserve the authority's correspondence, final findings, agreed commitments, decision rationale and evidence of completed fixes. Evaluate whether the findings apply beyond the sample reviewed or to other entities sharing a platform. Test controls after corrective work and consider changes to policies, vendor oversight and board reporting. The outcome might be no action, recommendations, directions, sanctions or litigation, depending on the framework. National procedural rights and appeal routes must be checked separately. Monitoring should continue where a remediation deadline or supervisory undertaking remains open, with reliable records available for later review. Prepare for differences between routine supervisory monitoring and an investigation initiated after complaints or suspected misconduct. Requests may arrive in stages, and an apparently narrow sample can expand after the authority reviews the first responses. Maintain an index linking each answer to its source file and version so later follow-up questions can be answered consistently. If a vendor holds relevant records, coordinate preservation and retrieval without assuming that the vendor has authority to decide what the regulator receives. A well-organised submission helps the authority understand the chronology, but it must never conceal known gaps or present provisional findings as established facts.
Frequently asked questions
Which authority investigates a consumer credit provider?
The competent body depends on the country, regulated entity and alleged violation.
Can an authority request historic credit files?
Authorities may have legally defined information and investigation powers, subject to national procedural safeguards.
Does an investigation always end with a penalty?
No. Outcomes depend on the facts and legal framework, and may include no action or corrective measures.
Primary sources
Consumer Credit Directive (EU) 2023/2225 ↗General Data Protection Regulation (EU) 2016/679 ↗EBA Guidelines on Internal Governance ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.