CCD2 Applies From 20 November 2026: Compliance Checklist for EU Lenders and BNPL Firms

The second Consumer Credit Directive, Directive (EU) 2023/2225 (often called CCD2), applies across the EU from 20 November 2026 and replaces Directive 2008/48/EC for agreements made from that date. It brings buy now pay later (BNPL), interest-free credit and loans under EUR 200 into scope, raises the upper limit from EUR 75,000 to EUR 100,000, and requires non-bank lenders and credit intermediaries to be admitted, registered and supervised. Member States had to adopt their national laws by 20 November 2025. On 30 October 2026 the EU register of national measures still listed none for eight Member States, including the Netherlands and Spain.

What CCD2 is and when it applies

A directive sets the result. Each Member State then writes its own law to deliver it, so a lender complies with the national law of each country where it lends, read alongside the Directive. Article 48 required Member States to adopt and publish their laws by 20 November 2025 and to apply them from 20 November 2026. Article 47 repeals Directive 2008/48/EC from the same day.

Agreements that exist on 20 November 2026 stay under the old national rules until they end. The exception is open-end agreements, meaning agreements with no fixed end date. For those, the CCD2 rules on changes in the borrowing rate (Article 23), overdrafts (Article 24), overrunning (part of Article 25), termination (Article 28) and assignment of rights (Article 39) apply from 20 November 2026.

Who is now in scope: BNPL, small loans and larger loans

The biggest change is scope. The 2008 Directive excluded credit under EUR 200, credit over EUR 75,000, and credit that was free of interest and other charges. That last exclusion is why most BNPL sat outside it. CCD2 removes all three. The recitals say BNPL schemes, where a creditor funds a purchase from a separate supplier, are often free of interest and charges and should therefore be included.

The deferred payment exclusion is narrow. It covers a supplier giving its own customer time to pay, with no third party offering credit, no interest or other charges beyond limited late payment charges allowed by national law, and full payment within 50 days of delivery. Large online sellers that are not small or medium-sized enterprises get only 14 days, and only where no third party offers or buys the credit.

Member States have two options to watch. They may disapply a small set of advertising, pre-contract and contract information requirements for credit under EUR 200, interest-free credit and credit repaid within three months with only insignificant charges (Article 2(8)). They may also exempt deferred debit cards from a credit or payment institution, repaid within 40 days and free of interest (Article 2(5)). The first option leaves the creditworthiness rules in place. The second takes those cards out of the Directive altogether.

Creditworthiness: a higher and more specific standard

Article 18 requires a thorough assessment before every agreement, carried out in the consumer's interest to prevent irresponsible lending and over-indebtedness. In practice:

• Use relevant and accurate information on income, expenses and other financial circumstances, proportionate to the nature, duration, value and risks of the credit
• Do not use special category data, such as health data, and do not treat social networks as a source
• Verify the information where necessary through independently verifiable documents
• Document the assessment procedures and keep the information used
• Grant credit only where the result shows the consumer is likely to meet the obligations
• Do not base the assessment only on credit history
• Where the decision is automated, give the consumer the right to human intervention: an explanation, the chance to give their view, and a review
• On rejection, tell the consumer without delay and, where relevant, refer them to debt advice
• Reassess before any significant increase in the credit amount

Advertising, pre-contract information and selling practices

Every credit advertisement must carry a clear and prominent warning: "Caution! Borrowing money costs money", or equivalent wording (Article 8). Where an advertisement shows an interest rate or any cost figure, it must give standard information through a representative example. Advertising must not suggest credit improves the consumer's finances, must not say existing debts have little effect on an application, and must not present credit as a substitute for savings.

Before the consumer is bound, the creditor gives the Standard European Consumer Credit Information form, with a one-page overview at the start that includes the creditor, total credit, duration, borrowing rate, APR and total amount payable, late payment costs, a warning about missed payments, and the withdrawal right. If this information is given less than a day before the consumer is bound, the creditor must send a reminder of the right to withdraw between one and seven days after the agreement.

Other selling rules include adequate explanations before the agreement (Article 12), telling consumers when an offer is personalised by automated processing (Article 13), a ban on tying with bundling still allowed (Article 14), no pre-ticked boxes (Article 15), and a ban on granting credit without the consumer's prior request and explicit agreement (Article 17).

Withdrawal, early repayment and caps on costs

The consumer may withdraw within 14 calendar days without giving a reason. If the consumer never received the contract terms and information, the right ends 12 months and 14 days after the agreement, unless they were not told about the right at all. On withdrawal, the consumer repays the capital and accrued interest within 30 days.

On early repayment, compensation for a fixed-rate period is limited to 1% of the amount repaid where more than a year remains, and 0.5% where a year or less remains (Article 29). Article 31 requires every Member State to introduce measures, such as caps, so consumers cannot be charged excessively high borrowing rates, APRs or total costs. Each country sets its own levels, so pricing must be checked country by country.

Arrears, forbearance and debt advice

Article 35 requires creditors to show reasonable forbearance before enforcement, taking account of the consumer's circumstances. Forbearance must include the option of changing the terms of the agreement, for example extending the term, deferring instalments, lowering the rate, a payment holiday, partial repayments or partial forgiveness. Where a Member State allows extra charges on default, it must cap them.

Article 36 requires creditors to have processes and policies for the early detection of consumers in financial difficulty, and to refer them to easily accessible debt advisory services. For BNPL lenders newly in scope, this is likely to be a new operating requirement.

National transposition status at 30 October 2026

The EU publishes the measures Member States notify on its national transposition page for Directive (EU) 2023/2225. On 30 October 2026 it listed at least one measure for 19 Member States: Austria, Belgium, Croatia, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Malta, Slovakia, Slovenia and Sweden. It listed none for Bulgaria, Cyprus, Luxembourg, the Netherlands, Poland, Portugal, Romania and Spain.

A listing does not by itself show that transposition is complete. Some countries notified existing laws alongside, or instead of, a new act. Before launch in any country, check the national gazette and the competent authority's guidance, and build to the Directive's standards so the change can be made on the day the national law applies.

What changes for a firm applying for a licence

Article 37 requires creditors and credit intermediaries to pass an adequate admission process, to be registered, and to be supervised by an independent competent authority. Three types of creditor are outside the admission and registration requirement: credit institutions, payment institutions for the credit lines PSD2 already allows alongside payment services, and e-money institutions for the payment-related credit the E-Money Directive allows. The recitals add that national admission rules for payment and e-money institutions granting consumer credit still apply. Member States may also exempt small and medium-sized merchants that broker credit, or give interest-free deferred payment, as a sideline.

The Directive contains no passport. Each Member State runs its own admission process, so a lender entering five countries plans for five applications or registrations, unless it lends through a bank or relies on a payment or e-money licence within its limits. A Lithuania payment institution licence or a Netherlands e-money licence covers only the credit those regimes allow.

An application file built for CCD2 should show:

• A creditworthiness policy and procedures, with data sources, verification steps and the human review route for automated decisions
• Staff knowledge and competence arrangements meeting the national minimum (Article 33)
• A remuneration policy that does not reward risk-taking beyond appetite (Article 32)
• Forbearance, arrears and early detection procedures, with debt advice referral
• Advertising approval controls, the information form, contract templates and withdrawal handling
• Complaints handling and access to out-of-court dispute resolution (Article 40)

Our licensing and authorisation team prepares these files country by country.

Compliance checklist for 20 November 2026

UK firms and CCD2

CCD2 does not apply in the UK. Interest-free BNPL lending in the UK has been regulated by the FCA since 15 July 2026, as our guide to buy now pay later regulation in the UK explains. A UK lender offering credit to consumers in the EU must meet the national law of each Member State it lends into. Our consumer credit sector page covers both sides.