CCD2 requirements: what lenders must change before 20 November 2026

Directive (EU) 2023/2225 has one date that belongs in a build plan. Member States had to adopt the national law by 20 November 2025 and apply it from 20 November 2026, under Article 48. Poland has not adopted it yet, which changes the sequencing of the work rather than its size. Article 42(1) makes the directive fully harmonised and Article 42(2) names the 14 articles where a country may still choose, so the content is knowable today and the variable parts are listed. Here is what has to move in systems, data and process.

What CCD2 catches that the 2008 directive did not

Directive 2008/48/EC is repealed with effect from 20 November 2026 under Article 47. Agreements already running that day stay under the old regime until they end, with one carve-out: Articles 23, 24, 25(1) second sentence, 25(2), 28 and 39 apply to every open-end agreement alive on the date. That is a migration boundary: new rules for origination plus a slice of the revolving book, old terms on the term book behind it.

The lower threshold has gone. Under the 2008 directive, credit below EUR 200 sat outside the scope. Article 2 of CCD2 carries no such floor, and Article 2(8) instead lets a Member State switch off four named provisions for small, interest-free or short-dated credit. The ceiling moved the other way, from EUR 75,000 to EUR 100,000 under Article 2(2)(c).

Deferred payment is where most of the product work sits. Article 2(2)(h) keeps a carve-out and draws it tightly: no third party offering credit, no interest, no charges beyond limited late-payment charges, and settlement within 50 days of delivery. Where the supplier is not an SME and sells at a distance as an information society service, the window closes to 14 days. A three-party buy-now-pay-later arrangement fails the first condition on its face.

The pre-contractual form, and what its first page must carry

One naming point first, because it causes wasted work. CCD2 does not retire the SECCI in favour of a new ECCI. Annex I still carries the Standard European Consumer Credit Information form, and Article 10(2) makes it the vehicle for pre-contractual information. The European Consumer Credit Information form in Annex II is the Article 11 derogation, for the credit types in Article 2(6) and (7).

The shape changed. Article 10(3) fixes 12 elements for the first part of the form, prominently, on one page, and Article 10(4) allows two pages at most where they do not fit, with points (a) to (g) on the first. The first page carries:

• the total amount of credit and the duration of the agreement
• the borrowing rate, or every rate that can apply in different circumstances
• the annual percentage rate of charge and the total amount payable
• the cost of late payment and any default charges
• the number, amount and frequency of payments, with a warning about missing them
• whether a right of withdrawal exists, and the right to repay early

Three further duties land in the same journey. Under Article 10(5)(m) the form has to state where the price was personalised by automated processing, and Article 13 repeats that for any personalised offer. Advertising that indicates a rate or a cost carries a warning under Article 8(1): "Caution! Borrowing money costs money" or equivalent wording. Article 8(7) prohibits three claims outright, among them any suggestion that a database entry has little influence on an application.

Article 10(1) adds a clock that catches short digital journeys. Where the pre-contractual information reaches the consumer less than one day before they are bound, the creditor has to send a reminder of the withdrawal right and how to use it, on a durable medium, between one and seven days after the agreement is concluded. A same-session application therefore carries a scheduled outbound message.

Two interface rules sit beside this. Article 15 bans default options and names pre-ticked boxes, so consent needs a clear affirmative act. Article 17 bans credit granted without a prior request.

Creditworthiness under Article 18, step by step

Article 18 reads as a workflow. It fixes what evidence counts and when lending is allowed, then what has to be recorded and what rights follow the decision. Each of those is separate engineering.

On evidence, Article 18(3) asks for relevant and accurate information on income and expenses, proportionate to the nature, duration, value and risk of the credit, verified where necessary against independently verifiable documentation. It rules out two sources by name: the special categories of data in Article 9(1) of the GDPR, and social networks.

On the gate, Article 18(6) allows the creditor to make the credit available only where the assessment indicates the obligations are likely to be met, and Article 18(11) adds that it may not rest exclusively on credit history. Article 18(7) closes the loop: a creditor cannot later vary the agreement to the consumer's detriment because the assessment was done badly, unless the consumer withheld or falsified information.

The compliant sequence looks like this:

1. Collect income, expenses and commitments, verified against documentation where needed (Article 18(3)).
2. Consult a database under Article 19 where necessary, and keep what it returned.
3. Record the procedure and the information used, and maintain both (Article 18(4)).
4. Apply the gate, and grant only where repayment is likely (Article 18(6)).
5. On a decline, inform the consumer without delay and point them to debt advice (Article 18(9)).
6. Where a database drove the decline, name it and the categories of data used (Article 19(6)).
7. Where automated processing was involved, say so and open the route to human review (Article 18(8)).

Article 18(8) changes a system rather than a screen. The consumer may request human intervention, a clear explanation covering the logic and risks of the automated processing, the chance to express a point of view, and a review of the decision. It has to be producible months later, for one application, against a model version that may have been retired.

The systems work, and the order we would do it in

Most of this lands between the front end and the core, in the layer that holds product data, pricing and the decision. The time goes into the data contract underneath the form, the record the assessment leaves behind, and two pieces of arithmetic with a clock on them. Four pressure points:

• document generation driven by live product and applicant data
• a decision record that outlives the model that produced it
• a human review path with a queue, an owner and a deadline
• withdrawal and early repayment, calculated to the day

Start with scope, because it sizes everything else. Run the current book against the Article 2 exclusions: two or three products usually turn out to hang on a field nobody owns, typically the settlement window on a deferred payment or who funds it.

The form breaks in integration more often than in rendering. Article 10(3) turns the first page into a fixed contract between pricing, product configuration and the document engine, and the APR is the field that drifts. Two services that each compute it, one for the offer and one for the form, agree in testing and separate on the first product with a conditional fee, because Article 3(5) pulls a compulsory ancillary service into the total cost of credit. Compute it once where pricing lives, and pass the assumptions with it.

The decision record is the second failure, and it fails quietly. Reconstructing an assessment from application logs works until the schema changes, or the scorecard is retired, or the bureau response is trimmed for storage. Write an append-only record at decision time: the inputs as received, the model version, the thresholds applied, the database consulted, the outcome. Keep it beside the agreement rather than inside the scoring service, so retiring a model does not take the evidence with it. The human review queue then has a real input.

Then the two clocks. Withdrawal runs 14 calendar days from conclusion, or from receipt of the terms and the Article 21 information if that is later, and the consumer has 30 calendar days from dispatching the notice to repay the capital with interest at the agreed borrowing rate (Article 26(1), (5)). Any ancillary service contract falls away with the credit. Early repayment is separate arithmetic: a reduction in the total cost of credit covering all costs the creditor imposes, against compensation capped at 1% of the amount repaid early and 0.5% where less than one year remains (Article 29).

Last, the country parameters. Article 42(2) lists the 14 articles where a Member State may choose, among them the Article 2 exemptions, the Article 18(11) database rule and the Article 31(2) limits on charges. Those belong in a configuration table keyed by country. Member States notify the Commission of each choice, and the Commission publishes what it receives.

Poland is why the sequencing matters now. The implementing bill, project UC82 from the President of UOKiK, has sat on the Government Legislation Centre register since 7 July 2025. As of 11 September 2026 that register puts the file at the Committee for European Affairs, with nothing recorded at the Council of Ministers or at the Sejm. The Commission sent Poland a letter of formal notice on 30 January 2026, one of 23 Member States that had not communicated complete transposition. Two pieces of the Polish regime already exist and carry over: KNF supervision of lending institutions under Chapter 5ab of the 2011 consumer credit act, and the cap on non-interest credit costs in Article 36a.

One Polish detail belongs in the build plan rather than the legal memo. Under Article 45(1) of the 2011 act, a breach of the named information duties lets the consumer declare it in writing and repay the credit with no interest and no other cost. There, a defect in the document costs the whole margin on the contract, which is why the document layer goes first.

All of it fits in one place. The orchestration layer owns the sequence: build the offer, generate the form, run the assessment, consult the database, write the decision record, branch on the result, and schedule the Article 10(1) reminder. Each external system sits behind a wrapper that hides its schema, so a second market becomes a configuration change. The obligations are sequenced by law, so the order of calls is itself a compliance artefact: assessment before conclusion, form before the binding step, decline notice after the decision. Written in one readable place, an auditor can follow it. This is the same pattern we use for legacy core banking integration.