Bringing an existing loan origination system up to CCD2: what actually needs to change

Directive (EU) 2023/2225 replaces the 2008 Consumer Credit Directive. Article 48 carries the date a delivery plan runs on: national measures are adopted by 20 November 2025 and applied from 20 November 2026. Inside an origination stack the directive changes four things: what the system decides, what it generates, what it times, and what it can prove about all three a year later. Our companion article covers the same deadline from the lender's side. This one stays with the code.

What CCD2 changes inside the stack

Six obligations carry most of the engineering. Each lands on a different component and leaves something behind that a supervisor can read.

The product model moves first

CCD2 redraws the boundary of consumer credit. Article 2(2), point (c), excludes credit above EUR 100,000, and Article 2(3) pulls it back in where the credit is unsecured and pays for renovating residential property. The lower boundary is gone: Directive 2008/48/EC excluded anything under EUR 200, and CCD2 sets no floor, which brings small-ticket and interest-free credit into the regime.

The old carve-outs survive on narrow terms. Article 2(2), point (h), leaves merchant deferred payment outside CCD2 only where no third party offers the credit, the price is paid free of interest and without any other charges apart from limited charges for late payment imposed under national law, and payment completes entirely within 50 days of delivery. Where the supplier is not a micro, small or medium-sized enterprise under Recommendation 2003/361/EC and offers information society services for distance selling, the conditions tighten: no third party is offering nor purchasing the credit, and payment completes within 14 days. The purchasing limb is the one to check in code, because a receivables purchase after the sale trips it. Article 2(8) then lets a Member State disapply four provisions and only those four, for credit under EUR 200, interest-free credit and credit repayable within three months on insignificant charges: Article 8(3), points (d), (e) and (f), Article 10(5), Article 11(4) and Article 21(3). Scope and the disapplications are both configuration, per country and per product. So does price: Article 31 has each Member State set its own measures against excessively high rates and costs, such as caps, and a cap compiled into the pricing engine will be wrong in at least one market.

The decision engine and the record it keeps

Article 18 holds most of the work. The assessment runs on relevant and accurate information about the consumer's income, expenses and other financial circumstances, necessary and proportionate to the credit. Two bans are absolute: no special categories of data under Article 9(1) of the GDPR, and social networks are not an external source. Article 19(5) repeats both for data from a credit database. Enforce them at ingestion: a model that never reads a forbidden field still fails if the field reached the decision context.

Article 18(3) also requires the information to be appropriately verified, where necessary against independently verifiable documentation. The directive names no channel for that, so account transaction data pulled through an account information service is one way to meet it. Recital 55 points to the European Banking Authority's Guidelines of 29 May 2020 on loan origination and monitoring for the categories that may be processed.

Then the record. Article 18(4) requires the creditor to document and maintain both the assessment procedures and the information used. No retention period is named, so that decision is yours to defend. The practical test is replay: given an application id, can the system rebuild the decision as it stood, with the same inputs, thresholds and versions.

Article 18(6) is a gate and not a guideline: the creditor may make the credit available only where the assessment indicates the obligations are likely to be met. In an engine that means the manual override path needs a rule behind it rather than a button, and the rule has to be as auditable as the score. Article 18(5) is a data-model change before it is a scoring one: a joint application is assessed on the joint repayment capacity of the consumers, so income, expenses and commitments need a shape that holds more than one applicant.

Three paragraphs reach outside origination. Article 18(11) forbids an assessment based exclusively on credit history. A fresh assessment falls due under Article 18(10) before any significant increase in the total amount of credit, so the limit-increase path in servicing now calls the decision service. And a creditor may not cancel an agreement to the consumer's detriment because the assessment was carried out incorrectly (Article 18(7)), which makes the stored assessment the lender's own defence.

Article 35(1) carries the exception that goes with it: no Article 18 assessment is required when the existing terms are modified as a forbearance measure, provided the total amount payable by the consumer is not significantly increased. A limit-increase path that always calls the decision service will therefore call it where the directive does not ask for it, and a forbearance path that never calls it will be wrong the moment the modification raises what the consumer pays.

Explanation is a service with a queue

Two different duties live in this part of the journey, and the table above names both. Article 12 is pre-contractual: adequate explanations, free of charge, before the agreement is concluded, covering the Article 10, 11 and 38 information, the essential characteristics of the credit and of any ancillary service proposed, the specific effects it may have on the consumer including what happens on default, and, where a bundle is sold, whether each component can be terminated separately. A Member State may adapt how and how far those explanations are given (Article 12(2)). What follows is the other duty, the review path after a decision. A queue that answers Article 18(8) does not discharge Article 12.

Article 18(8) turns explanation into an operational path. Where the assessment involves automated processing of personal data, the consumer may request and obtain human intervention: an explanation of the assessment, including the logic and risks of that processing and its effects on the decision, the right to express a point of view, and the right to a review. The consumer has to be told the right exists.

Article 18(9) sets the rejection path: inform the consumer without delay, refer them to accessible debt advisory services, and where applicable say that the assessment rested on automated processing and how to contest it. Article 19(6) adds three fields when the rejection follows a database consultation: the result, the database consulted and the categories of data taken into account. A bureau wrapper that returns a score and drops the category breakdown cannot produce that message. It is the most common break in a bureau wrapper.

So the explanation needs a case object, a queue, an owner and a service level, generated from the stored decision record. A re-run of the engine reads today's data and returns today's answer. Article 13 and Article 10(5), point (m), use the same pipe: the consumer is told when an offer or price was personalised through automated processing, so the pricing service returns that flag.

Build that logging once. Where the scoring model is an AI system within the meaning of Article 3(1) of the AI Act, and a deterministic scorecard may well not be, it is high-risk under Annex III, point 5(b), and Regulation (EU) 2026/1744 moved Chapter III, Sections 1 to 3 of that act to 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III. Settle at the same time whether you are the provider or the deployer of that model, because the obligations and the logging divide along that line.

Documents, clocks and money

The rest of the work is generation and arithmetic.

The document generator and the clock around it

Article 10(1) requires the pre-contractual information in good time before the consumer is bound by any credit agreement or offer. The same paragraph sets a duty no screen can satisfy: where that information arrives less than one day before the consumer is bound, the creditor sends a reminder of the right of withdrawal and of the procedure for exercising it, between one and seven days after the agreement is concluded. That is a scheduled job with its own retries and evidence, fired by the interval between two stored timestamps.

The form is a rendering problem. Article 10(2) requires the Standard European Consumer Credit Information form with every item on it equally prominent, and Article 10(3) puts 12 named elements in the first part on one page, two pages at most where they will not fit. The display also has to suit the medium under Article 10(6), so one content model, several renderers and a version identifier per generated document is the shape that holds. One field teams miss sits in Article 21(1), point (q): the agreement records the durable medium the consumer chose for five later communications.

Withdrawal and early repayment are arithmetic

Article 26(1) gives 14 calendar days, running from the conclusion of the agreement or from the day the consumer receives the contractual terms and the information required by Articles 20 and 21, whichever is later. The clock starts on a data event, so the system has to record when the consumer received that information. The period stretches to 12 months and 14 days under Article 26(2) where that information never arrived, and that backstop itself falls away where the consumer was never informed of the withdrawal right under Article 21(1), point (p): the window then does not expire at all, so a timer that always closes is wrong. Article 26(3) matches the period to a seller's return policy longer than 14 days on a linked credit agreement, which makes the merchant's return window an input to the lender's timer.

Settlement is fixed arithmetic. The consumer pays the capital and the interest accrued at the agreed borrowing rate, no later than 30 calendar days after dispatching the notification, and the creditor keeps nothing beyond non-refundable charges paid to a public administrative body. Article 21(1), point (p), requires the daily interest amount in the agreement, so that figure is generated at contract time and has to agree with the settlement calculator months later.

Article 29 is the other calculator. Early repayment is available at any time, with a reduction in the total cost of the credit for the remaining duration that counts every cost imposed by the creditor. Compensation is capped at 1% of the amount repaid early, or 0.5% where less than a year remains, and is not due on an overdraft facility or in a period where the borrowing rate is not fixed.

These calculators share one dependency. The annual percentage rate under Article 30 and Annex III, the figures in the form and in the agreement, the early repayment quote and the withdrawal settlement all read one cost model. Where the fee schedule lives in four places the four answers drift, and the drift is what an audit finds. It is the first place to look on a platform like the regulated multi-country consumer credit platform we built.

What we would check first

The order matters more than the list: each step decides what the next is built on.

1. Find every clock. The presentation and conclusion timestamps, the receipt of the terms, the one-day boundary, the reminder window of one to seven days, the 14-day withdrawal period, the 30-day settlement and the 30-day arrears notification under Article 19(7) all run separately. That last one may not be yours: Article 19(7) puts the process duty on database providers and requires Member States to ensure the consumer is informed within 30 days of the registration, so who sends it is a transposition question. Origination systems tend to keep one timestamp per application and derive the rest, and a derived timestamp is not evidence.
2. Collapse every definition of a cost into one table read by the annual percentage rate, the form, the agreement and both settlement paths.
3. Label every attribute the decision consumes with its source and its permission, at ingestion. The bans in Articles 18(3) and 19(5) are enforced there or nowhere.
4. Freeze the shape of the decision record before building anything that explains a decision.
5. Move scope, caps and the Member State options into country configuration, with a test fixture per country. Two rows are knowable today and usually missing. The euro thresholds convert into national currency at the rate prevailing on 19 November 2023, roundable by no more than EUR 10 (Article 4), which is what fixes the local value of the EUR 100,000 ceiling. And Article 18(11) lets a Member State require a database consultation rather than merely permit one, which is a hard dependency in the decision path and not a feature flag.

The failure we expect to find first is a versioning one. Article 2(2), point (l), leaves credit agreements existing on 20 November 2026 under the old rules until they terminate, with one exception that reaches into the book you already run: Articles 23 and 24, Article 25(1) second sentence, Article 25(2) and Articles 28 and 39 apply to every open-end agreement alive on that date. In tickets rather than article numbers, that is notice of any change in the borrowing rate, in good time and carrying the new payment amounts (Article 23); a statement of account at least monthly on an overdraft facility, with the items Article 24(1) lists (Article 24); the overrun terms stated in the current account agreement, and notice without delay of a significant overrun lasting more than a month, with debt advice offered where it is regular (Article 25(1) and (2)); termination free of charge by the consumer at any time with a notice period of no more than a month, two months' notice from the creditor, and reasons given where a drawdown right is stopped (Article 28); and the consumer's defences surviving an assignment, with notice of it unless the original creditor keeps servicing (Article 39). Every item on that list is a retrofit to accounts that exist, not a change to origination. So a lender runs at least two rulebooks at once, keyed by the conclusion date and the product type, and more than two where overrunning (Article 2(4), which applies only a named subset of the directive) or a forbearance arrangement is in the book. A system that treats regulatory behaviour as a global setting cannot express that, and the workaround is a second code path to maintain for years.

One date in the plan is earlier than the legal one. An application that starts before 20 November 2026 and concludes after it is a new agreement, so its form, its assessment record and its reminder job have to be compliant already. Whatever the longest journey in the funnel is, that is how far before 20 November the engineering freeze lands, and every application still open at the switch needs either a compliant re-issue of the pre-contractual information or a hard stop. This is the part of the critical path that is invisible from the legal text, and it is the one question in the subject that only the engineering side can answer.

The test plan follows the same shape. A conformance suite per article rather than per screen. Fixtures per country for the Member State options. Time-travel tests for every clock. A replay test that rebuilds a stored decision and compares it with what was served. Wrap the legacy core and keep the CCD2 logic in the layer above it.

The application date holds even where national law is late. On 30 January 2026 the European Commission sent letters of formal notice to 23 Member States, Poland among them, over incomplete transposition, and Poland then went backwards. The implementing bill (UC82) was referred to the Committee for European Affairs on 22 April 2026; on 18 May the Prime Minister revoked the authorisation of the President of UOKiK to run the legislative work, and on 22 May the Committee withdrew the draft. UOKiK's closing letter to the Committee records that it does not know which body is now competent or what further work is planned. Build to the directive and hold the national options as configuration: with no national text to read, a late act becomes a change of values rather than a change of design.

One line for the funding conversation, because the engineering case usually needs it. Article 44 leaves the amounts to Member States, requires penalties that are effective, proportionate and dissuasive, and lets a competent authority publish any administrative penalty it imposes. In Poland the sanction already in force is sharper than a fine: under Article 45(1) of the 2011 consumer credit act a consumer may repay with no interest and no other cost where the named information duties were breached, so one defective document can remove the whole margin on a contract.