CCD2 requirements: what lenders must change before 20 November 2026

Directive (EU) 2023/2225 has one date that belongs in a build plan. Member States had to adopt the national law by 20 November 2025 and apply it from 20 November 2026, under Article 48. Poland has not adopted it yet, which changes the sequencing of the work rather than its size. Article 42(1) makes the directive fully harmonised and Article 42(2) names the 14 articles where a country may still choose, so the content is knowable today and the variable parts are listed. Here is what has to move in systems, data and process.

What CCD2 catches that the 2008 directive did not

Directive 2008/48/EC is repealed with effect from 20 November 2026 under Article 47. Agreements already running that day stay under the old regime until they end, with one carve-out: Articles 23, 24, 25(1) second sentence, 25(2), 28 and 39 apply to every open-end agreement alive on the date. That is a migration boundary: new rules for origination plus a slice of the revolving book, old terms on the term book behind it.

The lower threshold has gone. Under the 2008 directive, credit below EUR 200 sat outside the scope. Article 2 of CCD2 carries no such floor, and Article 2(8) instead lets a Member State switch off four named provisions for small, interest-free or short-dated credit. The ceiling moved the other way, from EUR 75,000 to EUR 100,000 under Article 2(2)(c).

Deferred payment is where most of the product work sits. Article 2(2)(h) keeps a carve-out and draws it tightly: no third party offering credit, no interest, no charges beyond limited late-payment charges, and settlement within 50 days of delivery. Where the supplier is not an SME and sells at a distance as an information society service, the window closes to 14 days. A three-party buy-now-pay-later arrangement fails the first condition on its face.

The pre-contractual form, and what its first page must carry

One naming point first, because it causes wasted work. CCD2 does not retire the SECCI in favour of a new ECCI. Annex I still carries the Standard European Consumer Credit Information form, and Article 10(2) makes it the vehicle for pre-contractual information. The European Consumer Credit Information form in Annex II is the Article 11 derogation, for the credit types in Article 2(6) and (7).

The shape changed. Article 10(3) fixes 12 elements for the first part of the form, all of them prominently and on one page. In the order the article sets them:

• (a) the identity of the creditor and of any credit intermediary involved
• (b) the total amount of credit
• (c) the duration of the agreement
• (d) the borrowing rate, or every rate that applies in different circumstances
• (e) the annual percentage rate of charge and the total amount payable
• (f) for deferred payment and for linked credit, the goods or services and their cash price
• (g) the cost of late payment: the interest rate applied, how it is adjusted, and any default charges
• (h) the amount, number and frequency of payments, and where relevant the order of allocation
• (i) a warning about the consequences of missing or late payments
• (j) whether a right of withdrawal exists, and the withdrawal period
• (k) the right of early repayment, and any compensation the creditor may claim
• (l) the geographical address, telephone number and email address of the creditor and of any intermediary

Article 10(4) is the page rule. Where all twelve will not fit prominently on one page, the first part may run to two pages at most, and points (a) to (g), down to and including the cost of late payment, have to be on the first. Two of the twelve are the ones a template review misses, because they are not pricing fields: the identity of the creditor and any intermediary in point (a), and the address, telephone number and email address of each in point (l).

Three further duties land in the same journey. Under Article 10(5)(m) the form has to state where the price was personalised by automated processing, and Article 13 repeats that for any personalised offer. Every advert for a credit agreement carries the Article 8(1) warning, "Caution! Borrowing money costs money" or equivalent wording, whether or not it shows a figure. The rate or cost condition belongs to Article 8(2), and what it triggers is the standard information set in Article 8(3): the borrowing rate with any charges inside the total cost, the total amount of credit, the APR, and where applicable the duration, the cash price and any advance payment, the total amount payable and the instalment amount. A brand advert with no numbers in it therefore needs the warning and not the table. Article 8(7) prohibits three claims outright, among them any suggestion that a database entry has little influence on an application.

Article 10(1) adds a clock that catches short digital journeys. Where the pre-contractual information reaches the consumer less than one day before they are bound, the creditor has to send a reminder of the withdrawal right and how to use it, on a durable medium, between one and seven days after the agreement is concluded. A same-session application therefore carries a scheduled outbound message.

Two interface rules sit beside this. Article 15 bans default options and names pre-ticked boxes, so consent needs a clear affirmative act. Article 17 bans credit granted without a prior request.

Creditworthiness under Article 18, step by step

Article 18 reads as a workflow. It fixes what evidence counts and when lending is allowed, then what has to be recorded and what rights follow the decision. Each of those is separate engineering.

On evidence, Article 18(3) asks for relevant and accurate information on income and expenses, proportionate to the nature, duration, value and risk of the credit, verified where necessary against independently verifiable documentation. It rules out two sources by name: the special categories of data in Article 9(1) of the GDPR, and social networks.

On the gate, Article 18(6) allows the creditor to make the credit available only where the assessment indicates the obligations are likely to be met, and Article 18(11) adds that it may not rest exclusively on credit history. Article 18(7) closes the loop: a creditor cannot later vary the agreement to the consumer's detriment because the assessment was done badly, unless the consumer withheld or falsified information.

The compliant sequence looks like this:

1. Collect income, expenses and commitments, verified against documentation where needed (Article 18(3)).
2. Consult a database under Article 19 where necessary, and keep what it returned.
3. Record the procedure and the information used, and maintain both (Article 18(4)).
4. Apply the gate, and grant only where repayment is likely (Article 18(6)).
5. On a decline, inform the consumer without delay and point them to debt advice (Article 18(9)).
6. Where a database drove the decline, name it and the categories of data used (Article 19(6)).
7. Where automated processing was involved, say so and open the route to human review (Article 18(8)).

Article 18(8) changes a system rather than a screen. The consumer may request human intervention, a clear explanation covering the logic and risks of the automated processing, the chance to express a point of view, and a review of the decision. It has to be producible months later, for one application, against a model version that may have been retired.

The systems work, and the order we would do it in

Most of this lands between the front end and the core, in the layer that holds product data, pricing and the decision. The time goes into the data contract underneath the form, the record the assessment leaves behind, and two pieces of arithmetic with a clock on them. Four pressure points:

• document generation driven by live product and applicant data
• a decision record that outlives the model that produced it
• a human review path with a queue, an owner and a deadline
• withdrawal and early repayment, calculated to the day

Start with scope, because it sizes everything else. Run the current book against the Article 2 exclusions: two or three products usually turn out to hang on a field nobody owns, typically the settlement window on a deferred payment or who funds it.

The form breaks in integration more often than in rendering. Article 10(3) turns the first page into a fixed contract between pricing, product configuration and the document engine, and the APR is the field that drifts. Two services that each compute it, one for the offer and one for the form, agree in testing and separate on the first product with a conditional fee, because Article 3(5) pulls a compulsory ancillary service into the total cost of credit. Compute it once where pricing lives, and pass the assumptions with it.

The decision record is the second failure, and it fails quietly. Reconstructing an assessment from application logs works until the schema changes, or the scorecard is retired, or the bureau response is trimmed for storage. Write an append-only record at decision time: the inputs as received, the model version, the thresholds applied, the database consulted, the outcome. Keep it beside the agreement rather than inside the scoring service, so retiring a model does not take the evidence with it. The human review queue then has a real input.

Then the two clocks. Withdrawal runs 14 calendar days from conclusion, or from receipt of the terms and the Article 21 information if that is later, and the consumer has 30 calendar days from dispatching the notice to repay the capital with interest at the agreed borrowing rate (Article 26(1), (5)). Any ancillary service contract falls away with the credit. Early repayment is separate arithmetic: a reduction in the total cost of credit covering all costs the creditor imposes, against compensation capped at 1% of the amount repaid early and 0.5% where less than one year remains (Article 29).

Who may lend at all, and what a breach costs

Two provisions sit outside the build and set its perimeter. Article 37(1) requires every creditor and credit intermediary to be subject to an adequate admission process, to registration and to supervision arrangements set up by an independent competent authority. Credit institutions are outside the admission and registration half, as are payment institutions for the service in point 4 of Annex I to Directive (EU) 2015/2366 and electronic money institutions for the lending in Article 6(1), point (b), of Directive 2009/110/EC (Article 37(2)). Everyone else is applying for a permission, and an authorisation runs in quarters rather than sprints. Article 37(3) is one of the 14 national choices: a Member State may leave out SME suppliers acting as credit intermediaries in an ancillary capacity, or as ancillary creditors granting interest-free deferred payment with only limited late-payment charges. That is the option a three-party deferred-payment programme turns on, and Poland has no answer to it yet.

Article 44 is the line for the board. Penalties for infringing the national transposition have to be effective, proportionate and dissuasive, Member States notify them to the Commission by 20 November 2026, and competent authorities may disclose any administrative penalty they impose to the public. The directive fixes no amounts, so the size of the exposure is a national question, and for a Polish build the answer that matters is already in force: Article 45(1) of the 2011 act, below.

Last, the country parameters. Article 42(2) lists the 14 articles where a Member State may choose, among them the Article 2 exemptions, the Article 18(11) database rule and the Article 31(2) limits on charges. Those belong in a configuration table keyed by country. Member States notify the Commission of each choice, and the Commission publishes what it receives.

Poland is why the sequencing matters now, and in 2026 the Polish file went backwards. The implementing bill, project UC82 from the President of UOKiK, went on the Government Legislation Centre register on 7 July 2025 and was referred to the Committee for European Affairs on 22 April 2026. It was then pulled. On 18 May 2026 the Prime Minister revoked the authorisation for the President of UOKiK to run the legislative work on CCD2 and on the distance financial services directive (letter DP.1104.7.2026), and on 22 May the Committee withdrew the draft from its proceedings (letter DKSUE.9004.1.1.7.2026.BB(4)). UOKiK's closing letter to the Committee states that it does not know which body is now competent or what further work is planned. The register carries nothing on the project after 12 June 2026, when those two letters were filed, and the Polish statute book holds no transposing act as at 16 September 2026. The Commission had already sent Poland a letter of formal notice on 30 January 2026, one of 23 Member States that had not communicated complete transposition. Two pieces of the Polish regime exist today and carry over: KNF supervision of lending institutions under Chapter 5ab of the 2011 consumer credit act, and the cap on non-interest credit costs in Article 36a.

One thing follows for a build plan. There is no Polish text to read for the Article 42(2) choices and no owner to ask, so those parameters stay configuration with no values to load, and the directive is the only thing to build against. The application date does not move with the bill: 20 November 2026 stands whatever Poland does next.

One Polish detail belongs in the build plan rather than the legal memo. Under Article 45(1) of the 2011 act, a breach of the named information duties lets the consumer declare it in writing and repay the credit with no interest and no other cost. There, a defect in the document costs the whole margin on the contract, which is why the document layer goes first.

All of it fits in one place. The orchestration layer owns the sequence: build the offer, generate the form, run the assessment, consult the database, write the decision record, branch on the result, and schedule the Article 10(1) reminder. Each external system sits behind a wrapper that hides its schema, so a second market becomes a configuration change. The obligations are sequenced by law, so the order of calls is itself a compliance artefact: assessment before conclusion, form before the binding step, decline notice after the decision. Written in one readable place, an auditor can follow it. This is the same pattern we use for legacy core banking integration.