EU’s CCD2 Raises Data Bar for Lenders and BNPL Firms

The EU’s revised Consumer Credit Directive, Directive (EU) 2023/2225, replaces the 2008 regime and brings most buy now, pay later products, interest-free credit and loans below €200 inside the consumer-credit rulebook. The European Parliament and Council designed CCD2 to curb irresponsible lending and over-indebtedness. That makes underwriting data quality a regulatory issue: lenders must show that affordability decisions rest on reliable evidence, not merely rapid scoring or a borrower’s self-declaration.

EU member states were required to transpose CCD2 by Nov. 20, 2025, and must apply the new rules from Nov. 20, 2026. Under Article 18, creditors must conduct a thorough creditworthiness assessment using relevant, accurate and proportionate information on income, expenses and other financial circumstances, verify it where appropriate, and retain the data and assessment procedures. Lenders and BNPL providers are consequently upgrading data collection, transaction categorisation, verification and audit trails; social-network data is barred, while credit history alone is insufficient.