🇪🇺CCD2: the new EU Consumer Credit Directive and BNPL

Concept

Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) is the new EU rulebook for credit that a professional creditor grants to a consumer as a loan, a deferred payment or other similar financial accommodation (Article 3(3) CCD2). Adopted on 18.10.2023, it repeals the 2008 Consumer Credit Directive (2008/48/EC) and works through national laws, which Member States apply from 20.11.2026 (Article 48(1)).

The reform closes a gap between law and market. The old directive did not cover interest-free credit, credit repayable within three months with insignificant charges, or loans below €200, and most buy now, pay later (BNPL) schemes operated through that gap.

CCD2 brings these products into scope, tightens the rules on selling credit and assessing creditworthiness, and subjects every creditor and credit intermediary to admission, registration and supervision (Article 37). For a non-bank fintech, consumer lending thus requires admission. CCD2's place among other regimes is shown in the Financial Licences hub, and national lending regimes in the lending licence map.

One path from start to finish

In 2027 a BNPL provider with no banking, payment or e-money licence starts offering shoppers at a large German online store 30 days to pay, interest-free. It could not have been registered before 20.11.2026: the Federal Financial Supervisory Authority (BaFin) accepts applications only from that date and decides within three months of a complete file, and a newcomer gets no transitional period. The transaction then passes through five rules of the directive and German law.

1. A third party grants the credit, so the exclusion for a seller's own deferred payment does not apply and the interest-free agreement falls within CCD2 (Article 2(2)(h)).
2. Before its first loan the provider is entered in BaFin's public register of creditors under the new Sales-Financing Supervision Act (AbsFinAG).
3. Advertising carries the mandatory warning on the cost of credit, and the shopper's consent cannot come from a pre-ticked box (Articles 8 and 15).
4. Before concluding the agreement the provider assesses creditworthiness without social-network data; if the decision is automated, the shopper may demand human intervention (Article 18).
5. The shopper may withdraw from the credit within 14 days, and in arrears the provider shows reasonable forbearance, where appropriate, before enforcement (Articles 26 and 35).

What defines the model

Three features of the directive shape how the market works with it.

Key parameters

The directive sets the dates, scope and exclusions; national law sets the form of admission, cost caps and penalties.

Dates: transposition, application and existing agreements

The directive was published in the Official Journal on 30.10.2023 and entered into force on 19.11.2023, but two other dates matter to the market. Member States had to adopt and publish their national laws by 20.11.2025 and must apply them from 20.11.2026, the day Directive 2008/48/EC is repealed.

The transition is not retroactive: agreements concluded before 20.11.2026 stay under the national rules implementing Directive 2008/48/EC until they end, outside CCD2 (Articles 2(2)(l) and 47). Open-end products — credit lines, cards, overdrafts — are the exception: from 20.11.2026 they are subject to the new rules on borrowing-rate changes, overdraft statements, overrunning notices, termination and assignment (Articles 23, 24, 25(1) second sentence, 25(2), 28 and 39).

No postponement has been proposed. The EU publications database (Cellar) shows only corrigenda to the directive, and a July 2026 Commission communication (COM(2026) 615) describes CCD2 as applicable from 20.11.2026.

What counts as consumer credit now

A credit agreement under CCD2 grants a consumer credit as a deferred payment, a loan or other similar financial accommodation. Agreements for the continuing supply of services or goods paid in instalments while they are provided are excluded; the recitals cite a monthly insurance premium (Article 3(3), recital 24).

Both boundaries of the scope move outwards. The upper limit rises to €100 000 of total credit, from €75 000, and unsecured loans for renovating residential property stay in scope above it (Article 2(2)(c) and 2(3)). The lower threshold is gone: small loans, including short-term high-cost credit below €200, are now covered (recital 15).

Almost every old exclusion rested on the credit being small or free. CCD2 largely drops that test: third-party credit stays in scope whatever its price and term, and a small amount, zero interest or a short term only lets a state lighten specific duties (Article 2(8)).

BNPL and the seller's own deferral: the 50-day and 14-day tests

Recital 16 names BNPL schemes, in which a creditor finances a purchase from a supplier, as new digital tools, often free of interest and charges, that should be in scope. The operative text does this through the one remaining exclusion for deferred payment, Article 2(2)(h): all its conditions must be met, and they are stricter for large online sellers.

What decides is who extends the credit. Once a third party offers it, the exclusion is lost whatever the price and term; for a large online seller, a third party purchasing the credit has the same effect.

The 2008 directive excluded interest-free credit and credit repayable within three months with insignificant charges outright (Article 2(2)(f) of Directive 2008/48/EC). In Riverty (C-409/23) on 17.10.2024 the Court of Justice held that default interest and out-of-court collection costs are not "interest" or "other charges" under that exclusion, so interest-free BNPL with late fees could stay outside the old directive unless the creditor anticipated the consumer's default from the outset to gain from it. CCD2 settles the question.

The light regime and other settings

For narrow groups of products, Member States have options that lighten specific duties or take the product out of the directive.

Who needs admission or registration

Article 37 is the main institutional change. Each Member State must subject creditors and credit intermediaries to an adequate admission process, registration and supervision by an independent competent authority (Article 37(1)). The directive prescribes no model: admission may be an authorisation process or entry of the non-bank creditor in a register (recital 83). Nor does CCD2 set minimum capital, so the depth of the checks depends on national law.

The exemptions from admission and registration are narrow and tied to existing licences.

The exemption removes only admission and registration; supervision and the CCD2 conduct rules still apply. The recitals also let Member States keep their own admission process for payment and e-money institutions that lend to consumers (recital 83).

Payment and e-money institutions: where PSD2 ends

For a fintech with a payment licence, admission turns on two directives. PSD2 lets a payment institution lend only in connection with the services in points 4 or 5 of Annex I, and only if the credit is ancillary and granted exclusively in connection with a payment transaction, is not funded from money received or held for executing payments, and the institution's own funds remain appropriate to the overall credit granted (Article 18(4)).

For credit linked to payments executed under the cross-border provisions (Articles 11(9) and 28), PSD2 adds a repayment period of no more than 12 months, notwithstanding national credit-card rules. PSD2 leaves consumer credit law untouched (Article 18(6)), so a payment institution offering BNPL complies with both directives.

PSD3, which will replace PSD2 and the E-Money Directive, was still awaiting the Council's first-reading position on 29.09.2026 (indicative Parliament plenary date: 14.12.2026), so PSD2 governs lending by payment institutions when CCD2 starts to apply. The reform is covered in PSD3 and PSR, and payment and e-money licences by country in Financial Licenses by Jurisdiction.

Sellers, intermediaries and platforms

A credit intermediary is a person who, for remuneration in any form, presents or offers credit agreements to consumers, does preparatory work or concludes them on the creditor's behalf; merely introducing a consumer to a creditor is not intermediation (Article 3(12)). For a shop with a third-party BNPL button, remuneration for offering credit makes it an intermediary, subject to admission under Article 37 unless the state has used the SME exemption.

On the same logic, a crowdfunding platform that lends to consumers itself is a creditor, and one that matches professional lenders with consumers is an intermediary (recital 22).

Selling credit: advertising, information and consent

CCD2 builds its selling rules around one idea: the consumer decides on credit personally and knows its price.

At an online checkout, BNPL may be offered next to other payment methods but not preselected for the shopper. Above the specific bans sits a general standard: creditors and intermediaries act honestly, fairly, transparently and professionally from product design to performance of the contract, and pay for staff assessing creditworthiness may not depend on the number or share of approved applications (Article 32).

Creditworthiness: which data may be used

Before every credit agreement the creditor carries out a thorough creditworthiness assessment in the consumer's interest and grants credit only if the result indicates that the obligations are likely to be met (Article 18(1) and (6)). The rule is not among the Article 2(8) derogations, so it covers small interest-free BNPL too. The directive also regulates data sources.

The social-network rule is stricter than often summarised: social networks are excluded as an external source altogether, while the "not exclusively" rule in Article 18(11) concerns credit history.

Automated decisions are allowed with safeguards. The consumer may request human intervention: a clear explanation of the assessment's logic, a chance to state their own view and a review of the decision (Article 18(8)). A rejected applicant is told without delay and, where appropriate, referred to debt advice (Article 18(9)).

Only creditors supervised by the national authority and fully compliant with the GDPR may access credit databases; creditors from other Member States get non-discriminatory access, and consumers are informed within 30 days when arrears are registered (Article 19). A creditor outside supervision, including an unregistered one, therefore has no access to credit histories.

After signing: withdrawal, early repayment and arrears

The consumer may withdraw from the credit agreement within 14 calendar days without giving reasons. If the contract information was never provided, the right expires 12 months and 14 days after conclusion, unless the consumer was not informed of the right to withdraw. For a linked credit agreement to buy goods with a full-refund return policy longer than 14 days, the withdrawal period extends to match it (Article 26), so for BNPL tied to a purchase a longer store return policy also lengthens the right to withdraw.

Early repayment

The consumer may repay early at any time, with a reduction in the total cost of credit. Article 29 limits the creditor's compensation.

Arrears: forbearance and debt advice

Before enforcement proceedings, the creditor must, where appropriate, show reasonable forbearance: extending the term, deferring payments, reducing the borrowing rate, partial forgiveness or debt consolidation (Article 35(1)). Where a state allows extra charges on default, it must cap them (Article 35(4)). Member States also make independent debt advice available, and creditors set up processes to detect consumers in difficulty early (Article 36).

Cost of credit: caps are national

CCD2 requires every Member State to introduce measures that effectively prevent abuse and excessively high borrowing rates, annual percentage rates of charge (APR) or total costs of credit, such as caps (Article 31(1)). A state may also ban or limit specific charges or fees (Article 31(2)). The directive sets no EU-wide figure, so the numbers are national and built differently: the Netherlands has a single rate cap in force, while the Bulgarian bill combines an APR cap with total-cost limits for small loans.

Member States report their measures to the Commission by 20.11.2026, the Commission publishes them by 20.11.2027 and the EBA reports on their effectiveness by 20.11.2029 (Article 31(3)–(4)). Penalties are national too; they must be effective, proportionate and dissuasive, and authorities may publish them (Article 44).

Transposition on 29.09.2026

On 30.01.2026 the Commission sent letters of formal notice to 23 Member States, including Bulgaria, Germany and the Netherlands, for failing to communicate complete transposition of CCD2; only Denmark, Italy, Hungary and Slovakia were not named. No follow-up has been published: the infringement packages from March to 25.09.2026 contain no CCD2 decision, so no reasoned opinion has been announced.

On 29.09.2026 the EU publications database (Cellar) lists national implementing measures from Germany and none from the Netherlands or Bulgaria; a listing alone does not prove complete transposition. The three states show the range of models: Germany chose registration and recognises other states' registrations, the Dutch bill a licence with bans beyond the directive, the Bulgarian bill a register for local companies.

The same directive produces three different entry routes, and of the three states only Germany recognises another state's registration.

Germany: BaFin registration

The Act of 12.05.2026 was published on 18.05.2026 and enters into force on 20.11.2026, with a few provisions earlier. It creates the AbsFinAG: non-bank creditors granting consumer loans or financing aids, including deferred payment, register with BaFin, which keeps a public creditor register. Banks and financial services institutions under the Banking Act (KWG), payment and e-money institutions under the Payment Services Supervision Act (ZAG) and investment firms are outside the registration duty.

Also exempt are SME merchants granting only interest-free deferral for their own goods, and creditors registered or admitted under Article 37 in another EEA state, within that registration. This recognition is Germany's own choice: the directive itself creates no passport. Where a bank or payment institution pre-agrees to buy a merchant's BNPL receivables and dictates the contract terms, the institution bears the creditor's duties and notifies BaFin of its merchant partners before the first assignment.

The Civil Code (§ 506 BGB) mirrors the 50-day and 14-day tests; for a large online seller, no third party may acquire the loan or deferral itself. In BaFin's reading, the seller must grant the deferral itself "for at least a legal second"; assigning only the payment claim keeps the exclusion, and a large seller comes into scope only if a third party takes over the whole credit contract. This is an administrative view that courts may not share. Germany also wrote "but not from social networks" into its creditworthiness rule (§ 505b BGB).

Credit intermediaries need a licence under § 34k of the Trade Regulation Act (GewO): reliability, orderly finances and an exam at the Chamber of Industry and Commerce (IHK); SME merchants intermediating only their own sales are exempt.

Netherlands: bill 36924 and the AFM licence

The bill went to the House of Representatives with a royal message of 01.04.2026 and is still there on 29.09.2026: a government note of amendment arrived on 23.09.2026, an amendment by MP Flach on 24.09.2026, and on 28.09.2026 the Finance Committee held its legislative consultation, where motions were tabled. The plenary vote, the Senate stage and publication in the Staatsblad, the official gazette, are still to come (parliamentary file).

The government targets entry into force on 20.11.2026 and considers no later date possible; the AFM accepts licence applications in advance, and providers without the right licence at entry into force may not offer credit (government reply). According to the explanatory memorandum, the bill is stricter than the directive.

The government grounds the cross-border rule in its view that Article 37 CCD2 does not allow credit to be offered in the Netherlands without Dutch law applying. The explanatory memorandum estimates that about 64 providers will come under supervision for the first time. The Flach amendment, not yet adopted, would raise the minimum age for BNPL and other deferred-payment credit from 18 to 21; the committee's motions, not yet voted, concern merchants' fees for paying later and the exemption for deferred debit cards.

Bulgaria: a new Consumer Credit Act

Council of Ministers bill No. 52-602-01-41 was submitted on 11.09.2026 and passed first reading on 23.09.2026; proposals for the second reading run until 09.10.2026, and the law has not been published in the State Gazette. As drafted, it enters into force on 20.11.2026 for agreements concluded from that date, raises the scope ceiling to €100 000 from BGN 147 000 (€75 000) under the current act and expressly names BNPL platforms among the products covered.

Before lending, a non-bank creditor must be entered in a register kept by the Commission for Consumer Protection. The bill's conditions for entry include the following:

• the applicant has a commercial registration under the Bulgarian Commerce Act;
• consumer credit is named in its objects clause;
• its main activity and real place of management are in Bulgaria;
• its managers are of good repute and hold at least a bachelor's degree.

The register does not apply to banks, financial institutions already registered with the Bulgarian National Bank (Article 3a of the Credit Institutions Act), payment and e-money institutions lending under Article 21 of the Payment Services and Payment Systems Act, or SME merchants offering interest-free deferral.

Credit intermediaries go into a separate register of the same commission, while banks, payment and e-money institutions only notify it. The country's regulators are covered in Bulgaria's Financial Licences, and the payment and e-money route in EMI and Payment Institution Licences in Bulgaria.

What it means for a fintech or BNPL provider

The directive gives a non-bank creditor no single point of entry to the EU market. For a provider choosing a base, the directive and the first national laws leave four models that differ in how much credit they permit and where.

For a registered creditor the choice of base turns on how states treat foreign registrations: Germany recognises them, the Dutch bill applies Dutch law to any online credit in its market, and the Bulgarian register is designed for a local company with its main activity in the country.

A payment or e-money licence passports under the general rules (EU Passporting), but the credit it permits is ancillary and tied to a payment. Such licences are covered for Lithuania and Luxembourg, and distribution through agents in Payment Agents and Passporting in the EU/UK.

Popular but ends badly

A common attempt to stay outside the regime is to present financing as the seller's own deferral.

Three other practices fail on the text of the directive itself.

In every case the regulator looks at who actually extends the credit and what data the decision rests on.