# CCD2: the new EU Consumer Credit Directive and BNPL

> Directive (EU) 2023/2225 from 20.11.2026: BNPL in scope, 50- and 14-day tests, Article 37 creditor admission, no social-media scoring; Germany, NL, Bulgaria.

Author: Gordey Bolotko — Partner, Corporate & Commercial (https://wiki.private.law/en/authors/bolotko)
Last modified: 2026-09-29T00:00:00.000Z
Canonical: https://wiki.private.law/en/ccd2-bnpl-eu
Publisher: wiki.private.law (https://wiki.private.law)
Version: d88ca79dd8d8500b1ef99cc1a2e604a52d4afbbd6320f93e75442adfcee9a1a6
Cite as: CCD2: the new EU Consumer Credit Directive and BNPL. wiki.private.law. https://wiki.private.law/en/ccd2-bnpl-eu. Version d88ca79dd8d8500b1ef99cc1a2e604a52d4afbbd6320f93e75442adfcee9a1a6.
Topics: banking
Jurisdictions: eu, germany, netherlands, bulgaria
Functional tags: license
Product tags: license-lending, license-emi-eu, compliance, banking
Semantic tags: license, license-lending, license-emi-eu, compliance, banking

---

## Concept

Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) is the new EU rulebook for credit that a professional creditor grants to a consumer as a loan, a deferred payment or other similar financial accommodation ([Article 3(3) CCD2](https://eur-lex.europa.eu/eli/dir/2023/2225/oj)). Adopted on 18.10.2023, it repeals the 2008 Consumer Credit Directive ([2008/48/EC](https://eur-lex.europa.eu/eli/dir/2008/48/oj)) and works through national laws, which Member States apply from 20.11.2026 (Article 48(1)).

The reform closes a gap between law and market. The old directive did not cover interest-free credit, credit repayable within three months with insignificant charges, or loans below €200, and most buy now, pay later (BNPL) schemes operated through that gap.

CCD2 brings these products into scope, tightens the rules on selling credit and assessing creditworthiness, and subjects every creditor and credit intermediary to admission, registration and supervision (Article 37). For a non-bank fintech, consumer lending thus requires admission. CCD2's place among other regimes is shown in the [Financial Licences](https://wiki.private.law/en/financial-licenses) hub, and national lending regimes in the lending licence map.

### One path from start to finish

In 2027 a BNPL provider with no banking, payment or e-money licence starts offering shoppers at a large German online store 30 days to pay, interest-free. It could not have been registered before 20.11.2026: the Federal Financial Supervisory Authority (BaFin) accepts applications only from that date and decides within three months of a complete file, and a newcomer gets no transitional period. The transaction then passes through five rules of the directive and German law.

1. A third party grants the credit, so the exclusion for a seller's own deferred payment does not apply and the interest-free agreement falls within CCD2 (Article 2(2)(h)).
2. Before its first loan the provider is entered in BaFin's public register of creditors under the new Sales-Financing Supervision Act (AbsFinAG).
3. Advertising carries the mandatory warning on the cost of credit, and the shopper's consent cannot come from a pre-ticked box (Articles 8 and 15).
4. Before concluding the agreement the provider assesses creditworthiness without social-network data; if the decision is automated, the shopper may demand human intervention (Article 18).
5. The shopper may withdraw from the credit within 14 days, and in arrears the provider shows reasonable forbearance, where appropriate, before enforcement (Articles 26 and 35).
### What defines the model

Three features of the directive shape how the market works with it.

**Credit by substance**

Third-party-financed deferred payment is credit even without interest or fees. Only the seller's own short, free deferral stays outside: up to 50 days, or 14 for a large online seller.

**Admission for every creditor**

Each Member State introduces admission, registration and supervision for creditors and intermediaries. Banks are exempt from admission, payment institutions only for credit lines, e-money institutions for payment-related credit.

**One rulebook, national settings**

A maximum-harmonisation directive: Member States depart from it only through the options it lists. They set cost caps, penalties and the form of admission; a non-bank creditor gets no passport.

### Key parameters

The directive sets the dates, scope and exclusions; national law sets the form of admission, cost caps and penalties.

- Act · Directive (EU) 2023/2225 (CCD2); replaces Directive 2008/48/EC
- Dates · Transposition by 20.11.2025; application and repeal of the old directive from 20.11.2026 (Articles 47–48)
- Existing agreements · Old rules until they end; some new rules apply to open-end agreements
- Scope · Credit up to €100 000, no lower threshold; interest-free BNPL included
- Deferral exclusion · The seller's own free deferral up to 50 days, or 14 days for a large online seller (Article 2(2)(h))
- Admission · Admission, registration and supervision by an independent authority for creditors and intermediaries; banks exempt (Article 37)
- Cost of credit · National measures against excessive cost, such as caps (Article 31); no EU-wide figure
- Passport · None for a non-bank creditor; recognising another state's registration is a national choice

## Dates: transposition, application and existing agreements

The directive was published in the Official Journal on 30.10.2023 and entered into force on 19.11.2023, but two other dates matter to the market. Member States had to adopt and publish their national laws by 20.11.2025 and must apply them from 20.11.2026, the day Directive 2008/48/EC is repealed.

| Date | Event |
| --- | --- |
| 30.01.2026 | The Commission sends letters of formal notice to 23 Member States |
| 22.09.2026 | [Corrigendum](https://eur-lex.europa.eu/eli/dir/2023/2225/corrigendum/2026-09-22/oj) fixing four drafting errors; dates and thresholds unchanged |
| 20.11.2026 | National laws apply; 2008/48/EC repealed; Member States notify the Commission of cost measures and penalties |
| 20.11.2027 | The Commission publishes the national measures under Article 31 |
| 20.11.2029 | European Banking Authority (EBA) report on their effectiveness |

The transition is not retroactive: agreements concluded before 20.11.2026 stay under the national rules implementing Directive 2008/48/EC until they end, outside CCD2 (Articles 2(2)(l) and 47). Open-end products — credit lines, cards, overdrafts — are the exception: from 20.11.2026 they are subject to the new rules on borrowing-rate changes, overdraft statements, overrunning notices, termination and assignment (Articles 23, 24, 25(1) second sentence, 25(2), 28 and 39).

No postponement has been proposed. The EU publications database (Cellar) shows only corrigenda to the directive, and a July 2026 Commission communication ([COM(2026) 615](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52026DC0615)) describes CCD2 as applicable from 20.11.2026.

## What counts as consumer credit now

A credit agreement under CCD2 grants a consumer credit as a deferred payment, a loan or other similar financial accommodation. Agreements for the continuing supply of services or goods paid in instalments while they are provided are excluded; the recitals cite a monthly insurance premium (Article 3(3), recital 24).

Both boundaries of the scope move outwards. The upper limit rises to €100 000 of total credit, from €75 000, and unsecured loans for renovating residential property stay in scope above it (Article 2(2)(c) and 2(3)). The lower threshold is gone: small loans, including short-term high-cost credit below €200, are now covered (recital 15).

| Product | 2008 directive | CCD2 |
| --- | --- | --- |
| Credit below €200 | Out of scope | In scope |
| Interest-free credit without other charges, including BNPL | Out of scope | In scope |
| Credit repayable within three months with insignificant charges | Out of scope | In scope |
| Overdraft repayable within one month | Out of scope | In scope |
| Hire or leasing with an option to buy | Out of scope | In scope |
| Credit from €75 000 to €100 000 | Out of scope | In scope |
| Hire or leasing with no option or obligation to buy | Out of scope | Out of scope (Article 2(2)(g)) |

Almost every old exclusion rested on the credit being small or free. CCD2 largely drops that test: third-party credit stays in scope whatever its price and term, and a small amount, zero interest or a short term only lets a state lighten specific duties (Article 2(8)).

### BNPL and the seller's own deferral: the 50-day and 14-day tests

Recital 16 names BNPL schemes, in which a creditor finances a purchase from a supplier, as new digital tools, often free of interest and charges, that should be in scope. The operative text does this through the one remaining exclusion for deferred payment, Article 2(2)(h): all its conditions must be met, and they are stricter for large online sellers.

| Model | Conditions for exclusion | Result |
| --- | --- | --- |
| The seller itself gives time to pay | No third party offering credit; no interest or other charges, only limited statutory late-payment charges; full payment within 50 days of delivery | Outside CCD2 |
| Large seller (not a small or medium-sized enterprise, SME) selling online at a distance | The same conditions, but 14 days, and no third party offers or purchases the credit | Outside CCD2 |
| A BNPL provider finances the purchase | The exclusion does not apply | In scope, even without interest or charges |

What decides is who extends the credit. Once a third party offers it, the exclusion is lost whatever the price and term; for a large online seller, a third party purchasing the credit has the same effect.

The 2008 directive excluded interest-free credit and credit repayable within three months with insignificant charges outright (Article 2(2)(f) of Directive 2008/48/EC). In [Riverty (C-409/23)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62023CJ0409) on 17.10.2024 the Court of Justice held that default interest and out-of-court collection costs are not "interest" or "other charges" under that exclusion, so interest-free BNPL with late fees could stay outside the old directive unless the creditor anticipated the consumer's default from the outset to gain from it. CCD2 settles the question.

### The light regime and other settings

For narrow groups of products, Member States have options that lighten specific duties or take the product out of the directive.

| Provision | What is allowed | Consequence |
| --- | --- | --- |
| Article 2(8): light regime | Disapplying some advertising, pre-contractual and contractual information duties for credit below €200, interest-free credit and credit repayable within three months with insignificant charges | The rest of CCD2 applies, including the creditworthiness assessment |
| Article 2(5): deferred debit cards | Exempting cards from a credit or payment institution repayable within 40 days, interest-free, with only limited payment-service charges | Germany uses the option; the Netherlands does not and gives such cards a six-month transition |
| Article 2(4): overrunning (tacitly accepted overdraft) | Only a short list of articles applies: overrunning information, unsolicited credit, databases, cost measures, forbearance, debt advice | Creditworthiness assessment unless the state decides otherwise; the APR calculation (Article 30) does not apply |

## Who needs admission or registration

Article 37 is the main institutional change. Each Member State must subject creditors and credit intermediaries to an adequate admission process, registration and supervision by an independent competent authority (Article 37(1)). The directive prescribes no model: admission may be an authorisation process or entry of the non-bank creditor in a register (recital 83). Nor does CCD2 set minimum capital, so the depth of the checks depends on national law.

The exemptions from admission and registration are narrow and tied to existing licences.

| Who | Exemption | Legal basis |
| --- | --- | --- |
| Banks (credit institutions) | In full | Article 37(2)(a) |
| Payment institutions | Only for the service in point 4 of Annex I to the second Payment Services Directive (PSD2): payments covered by a credit line | Article 37(2)(b) |
| E-money institutions | For credit under Article 6(1)(b) of the E-Money Directive (EMD2), related to payment services | Article 37(2)(c) |
| SME sellers | At the state's option: ancillary intermediation, or interest-free deferral for their own goods | Article 37(3); not for large undertakings (recital 84) |

The exemption removes only admission and registration; supervision and the CCD2 conduct rules still apply. The recitals also let Member States keep their own admission process for payment and e-money institutions that lend to consumers (recital 83).

### Payment and e-money institutions: where PSD2 ends

For a fintech with a payment licence, admission turns on two directives. [PSD2](https://eur-lex.europa.eu/eli/dir/2015/2366/oj) lets a payment institution lend only in connection with the services in points 4 or 5 of Annex I, and only if the credit is ancillary and granted exclusively in connection with a payment transaction, is not funded from money received or held for executing payments, and the institution's own funds remain appropriate to the overall credit granted (Article 18(4)).

For credit linked to payments executed under the cross-border provisions (Articles 11(9) and 28), PSD2 adds a repayment period of no more than 12 months, notwithstanding national credit-card rules. PSD2 leaves consumer credit law untouched (Article 18(6)), so a payment institution offering BNPL complies with both directives.

> 🧭 The CCD2 exemption for a payment institution is narrower than its right to lend under PSD2: it covers point 4 of Annex I (the credit line) but not point 5 (issuing payment instruments and acquiring). For an e-money institution the exemption follows the lending permission in its own directive, Article 6(1)(b) of [EMD2](https://eur-lex.europa.eu/eli/dir/2009/110/oj). National law may go further: Germany takes all payment and e-money institutions out of registration, and the Bulgarian bill does so for those lending under Article 21 of the Payment Services and Payment Systems Act.

PSD3, which will replace PSD2 and the E-Money Directive, was still awaiting the Council's first-reading position on 29.09.2026 (indicative Parliament plenary date: 14.12.2026), so PSD2 governs lending by payment institutions when CCD2 starts to apply. The reform is covered in [PSD3 and PSR](https://wiki.private.law/en/psd3-psr), and payment and e-money licences by country in [Financial Licenses by Jurisdiction](https://wiki.private.law/en/fintech-license-map).

### Sellers, intermediaries and platforms

A credit intermediary is a person who, for remuneration in any form, presents or offers credit agreements to consumers, does preparatory work or concludes them on the creditor's behalf; merely introducing a consumer to a creditor is not intermediation (Article 3(12)). For a shop with a third-party BNPL button, remuneration for offering credit makes it an intermediary, subject to admission under Article 37 unless the state has used the SME exemption.

On the same logic, a crowdfunding platform that lends to consumers itself is a creditor, and one that matches professional lenders with consumers is an intermediary (recital 22).

## Selling credit: advertising, information and consent

CCD2 builds its selling rules around one idea: the consumer decides on credit personally and knows its price.

| Rule | Content | Provision |
| --- | --- | --- |
| Advertising | Fair, clear and not misleading; a prominent warning "Caution! Borrowing money costs money" or equivalent wording | Articles 7, 8(1) |
| Banned claims | Credit will improve the consumer's finances; existing debts barely affect approval; credit substitutes for savings | Article 8(7) |
| Optional national bans | Ads stressing ease or speed of credit, discounts conditional on credit, grace periods over three months | Article 8(8) |
| Pre-contractual information | Standard European Consumer Credit Information form (SECCI), key terms on page one; a withdrawal reminder if it arrives less than a day before signing | Article 10 |
| Personalisation | Disclosure when an offer is personalised through automated processing of personal data | Article 13 |
| Packages and consent | Tying banned, bundling allowed; three days to compare insurance; pre-ticked boxes create no consent | Articles 14–15 |
| Unsolicited credit | Banned, including pre-approved cards and unilateral limit increases; point-of-sale credit offers remain allowed | Article 17, recital 51 |

At an online checkout, BNPL may be offered next to other payment methods but not preselected for the shopper. Above the specific bans sits a general standard: creditors and intermediaries act honestly, fairly, transparently and professionally from product design to performance of the contract, and pay for staff assessing creditworthiness may not depend on the number or share of approved applications (Article 32).

## Creditworthiness: which data may be used

Before every credit agreement the creditor carries out a thorough creditworthiness assessment in the consumer's interest and grants credit only if the result indicates that the obligations are likely to be met (Article 18(1) and (6)). The rule is not among the Article 2(8) derogations, so it covers small interest-free BNPL too. The directive also regulates data sources.

| Data source | Allowed | Provision |
| --- | --- | --- |
| Income, expenses and financial circumstances from internal or external sources, including the consumer | Yes, if relevant and accurate | Article 18(3) |
| Credit database | Yes; a state may make the check mandatory, but the assessment may not rest exclusively on credit history | Article 18(11) |
| Special categories of data under Article 9(1) of the General Data Protection Regulation (GDPR), such as health | No | Article 18(3) |
| Social networks | No: they are not an external source, and their data may not be processed in credit databases either | Articles 18(3), 19(5) |

The social-network rule is stricter than often summarised: social networks are excluded as an external source altogether, while the "not exclusively" rule in Article 18(11) concerns credit history.

Automated decisions are allowed with safeguards. The consumer may request human intervention: a clear explanation of the assessment's logic, a chance to state their own view and a review of the decision (Article 18(8)). A rejected applicant is told without delay and, where appropriate, referred to debt advice (Article 18(9)).

Only creditors supervised by the national authority and fully compliant with the GDPR may access credit databases; creditors from other Member States get non-discriminatory access, and consumers are informed within 30 days when arrears are registered (Article 19). A creditor outside supervision, including an unregistered one, therefore has no access to credit histories.

## After signing: withdrawal, early repayment and arrears

The consumer may withdraw from the credit agreement within 14 calendar days without giving reasons. If the contract information was never provided, the right expires 12 months and 14 days after conclusion, unless the consumer was not informed of the right to withdraw. For a linked credit agreement to buy goods with a full-refund return policy longer than 14 days, the withdrawal period extends to match it (Article 26), so for BNPL tied to a purchase a longer store return policy also lengthens the right to withdraw.

### Early repayment

The consumer may repay early at any time, with a reduction in the total cost of credit. Article 29 limits the creditor's compensation.

| Situation | Compensation |
| --- | --- |
| Fixed-rate period, more than a year left | By default no more than 1% of the amount repaid early |
| Fixed-rate period, a year or less left | By default no more than 0.5% |
| Overdraft, repayment under a credit-insurance policy, variable-rate period | None |
| State options | A no-compensation threshold of up to €10 000 per 12 months; or more on proof of a higher loss |
| Ceiling in every case | The interest the consumer would have paid up to the agreed end date |

### Arrears: forbearance and debt advice

Before enforcement proceedings, the creditor must, where appropriate, show reasonable forbearance: extending the term, deferring payments, reducing the borrowing rate, partial forgiveness or debt consolidation (Article 35(1)). Where a state allows extra charges on default, it must cap them (Article 35(4)). Member States also make independent debt advice available, and creditors set up processes to detect consumers in difficulty early (Article 36).

## Cost of credit: caps are national

CCD2 requires every Member State to introduce measures that effectively prevent abuse and excessively high borrowing rates, annual percentage rates of charge (APR) or total costs of credit, such as caps (Article 31(1)). A state may also ban or limit specific charges or fees (Article 31(2)). The directive sets no EU-wide figure, so the numbers are national and built differently: the Netherlands has a single rate cap in force, while the Bulgarian bill combines an APR cap with total-cost limits for small loans.

| Rule | Limit | Status |
| --- | --- | --- |
| Netherlands: [Credit Charges Decree](https://wetten.overheid.nl/BWBR0005233/2024-07-01) | Maximum effective annual rate: the statutory interest rate plus 8 percentage points | In force |
| Bulgaria: [bill, Article 22](https://www.parliament.bg/bg/bills/ID/167544) | APR up to five times the statutory late-payment interest rate | Bill |
| Bulgaria: credit up to three minimum monthly wages | No APR cap; total cost of credit up to the amount of credit | Bill |
| The same, repayable within one month | Total cost up to 20% of principal | Bill |
| The same, repayable in more than one and up to three months | Total cost up to 30% of principal | Bill |

Member States report their measures to the Commission by 20.11.2026, the Commission publishes them by 20.11.2027 and the EBA reports on their effectiveness by 20.11.2029 (Article 31(3)–(4)). Penalties are national too; they must be effective, proportionate and dissuasive, and authorities may publish them (Article 44).

## Transposition on 29.09.2026

On 30.01.2026 the Commission sent [letters of formal notice](https://ec.europa.eu/commission/presscorner/detail/en/inf_26_115) to 23 Member States, including Bulgaria, Germany and the Netherlands, for failing to communicate complete transposition of CCD2; only Denmark, Italy, Hungary and Slovakia were not named. No follow-up has been published: the infringement packages from March to [25.09.2026](https://ec.europa.eu/commission/presscorner/detail/en/inf_26_1834) contain no CCD2 decision, so no reasoned opinion has been announced.

On 29.09.2026 the EU publications database (Cellar) lists national implementing measures from Germany and none from the Netherlands or Bulgaria; a listing alone does not prove complete transposition. The three states show the range of models: Germany chose registration and recognises other states' registrations, the Dutch bill a licence with bans beyond the directive, the Bulgarian bill a register for local companies.

| Parameter | Germany | Netherlands | Bulgaria |
| --- | --- | --- | --- |
| Act | Act of 12.05.2026 (BGBl. 2026 I Nr. 139) | Bill 36924 | Consumer Credit Bill No. 52-602-01-41 |
| Status | Adopted; in force 20.11.2026 | In the House of Representatives; plenary vote, Senate and publication pending | Passed first reading on 23.09.2026 |
| Creditor admission | BaFin registration | Licence from the Authority for the Financial Markets (AFM) under Article 2:60 of the Financial Supervision Act (Wft) | Register of the Commission for Consumer Protection |
| Intermediaries | Licence under § 34k of the Trade Regulation Act | Licence under Article 2:80 Wft; large sellers notified to the AFM | Separate register of the same commission |
| Transition | 12 months for incumbents, to 19.11.2027; none for newcomers | AFM accepts applications in advance; no credit without a licence at entry into force | Law applies to agreements from 20.11.2026 |

The same directive produces three different entry routes, and of the three states only Germany recognises another state's registration.

### Germany: BaFin registration

The [Act of 12.05.2026](https://www.recht.bund.de/eli/bund/bgbl-1/2026/139) was published on 18.05.2026 and enters into force on 20.11.2026, with a few provisions earlier. It creates the AbsFinAG: non-bank creditors granting consumer loans or financing aids, including deferred payment, register with BaFin, which keeps a public creditor register. Banks and financial services institutions under the Banking Act (KWG), payment and e-money institutions under the Payment Services Supervision Act (ZAG) and investment firms are outside the registration duty.

Also exempt are SME merchants granting only interest-free deferral for their own goods, and creditors registered or admitted under Article 37 in another EEA state, within that registration. This recognition is Germany's own choice: the directive itself creates no passport. Where a bank or payment institution pre-agrees to buy a merchant's BNPL receivables and dictates the contract terms, the institution bears the creditor's duties and notifies BaFin of its merchant partners before the first assignment.

> ⚠️ BaFin accepts registration applications only from 20.11.2026 and decides within three months of a complete application. The transition to 19.11.2027 covers only creditors active before 20.11.2026, so a new BNPL provider cannot be registered before the law applies, and operating unregistered risks a fine of up to €500 000. BaFin asks prospective creditors for an informal electronic notice of intent in advance. Registration does not replace a KWG or ZAG licence, such as for factoring, that the buyer of receivables may need.

The Civil Code (§ 506 BGB) mirrors the 50-day and 14-day tests; for a large online seller, no third party may acquire the loan or deferral itself. In [BaFin's reading](https://www.bafin.de/DE/unternehmen-maerkte/erlaubnis-registrierung/absatzfinanzierung/absatzfinanzierung_node.html), the seller must grant the deferral itself "for at least a legal second"; assigning only the payment claim keeps the exclusion, and a large seller comes into scope only if a third party takes over the whole credit contract. This is an administrative view that courts may not share. Germany also wrote "but not from social networks" into its creditworthiness rule (§ 505b BGB).

Credit intermediaries need a licence under § 34k of the Trade Regulation Act (GewO): reliability, orderly finances and an exam at the Chamber of Industry and Commerce (IHK); SME merchants intermediating only their own sales are exempt.

### Transitional rules for intermediaries: § 162 GewO

Holders of a § 34c GewO licence who want to keep intermediating consumer credit must apply for a § 34k licence by 31.05.2027. The old licence continues until the application is decided and lapses on 19.11.2027 at the latest. Intermediaries continuously active since 01.01.2021 are spared the IHK exam. Large (non-SME) merchants that broker credit only to finance their own sales also apply by 31.05.2027 and may keep operating until the decision.

### Netherlands: bill 36924 and the AFM licence

The bill went to the House of Representatives with a [royal message of 01.04.2026](https://zoek.officielebekendmakingen.nl/kst-36924-1.html) and is still there on 29.09.2026: a government note of amendment arrived on 23.09.2026, an amendment by MP Flach on 24.09.2026, and on 28.09.2026 the Finance Committee held its legislative consultation, where motions were tabled. The plenary vote, the Senate stage and publication in the Staatsblad, the official gazette, are still to come ([parliamentary file](https://www.tweedekamer.nl/kamerstukken/wetsvoorstellen/detail?cfg=wetsvoorsteldetails&qry=wetsvoorstel%3A36924)).

The government targets entry into force on 20.11.2026 and considers no later date possible; the AFM accepts licence applications in advance, and providers without the right licence at entry into force may not offer credit ([government reply](https://zoek.officielebekendmakingen.nl/kst-36924-8.html)). According to the [explanatory memorandum](https://zoek.officielebekendmakingen.nl/kst-36924-3.html), the bill is stricter than the directive.

| Bill provision | Content |
| --- | --- |
| Licence for BNPL | The exemption for credit repayable within three months is removed; BNPL providers and deferred-debit card issuers need an AFM licence, cards after six months |
| Merchant intermediaries | A merchant intermediates even without a fee if it gains economically; a large merchant giving no advice needs no licence once notified to the AFM |
| Beyond CCD2 | No €100 000 ceiling; platforms offering their own deferral not exempt; BNPL for minors banned even with parental consent, with age checks |
| Cross-border credit | Under [Article 1:16a Wft](https://zoek.officielebekendmakingen.nl/kst-1270148.pdf), Dutch law governs online credit from other Member States; without a bank or payment passport, a licence is needed |

The government grounds the cross-border rule in its view that Article 37 CCD2 does not allow credit to be offered in the Netherlands without Dutch law applying. The explanatory memorandum estimates that about 64 providers will come under supervision for the first time. The Flach amendment, not yet adopted, would raise the minimum age for BNPL and other deferred-payment credit from 18 to 21; the committee's motions, not yet voted, concern merchants' fees for paying later and the exemption for deferred debit cards.

### Bulgaria: a new Consumer Credit Act

[Council of Ministers bill No. 52-602-01-41](https://www.parliament.bg/bg/bills/ID/167544) was submitted on 11.09.2026 and passed first reading on 23.09.2026; proposals for the second reading run until 09.10.2026, and the law has not been published in the State Gazette. As drafted, it enters into force on 20.11.2026 for agreements concluded from that date, raises the scope ceiling to €100 000 from BGN 147 000 (€75 000) under the current act and expressly names BNPL platforms among the products covered.

Before lending, a non-bank creditor must be entered in a register kept by the Commission for Consumer Protection. The bill's conditions for entry include the following:

- the applicant has a commercial registration under the Bulgarian Commerce Act;
- consumer credit is named in its objects clause;
- its main activity and real place of management are in Bulgaria;
- its managers are of good repute and hold at least a bachelor's degree.
The register does not apply to banks, financial institutions already registered with the Bulgarian National Bank (Article 3a of the Credit Institutions Act), payment and e-money institutions lending under Article 21 of the Payment Services and Payment Systems Act, or SME merchants offering interest-free deferral.

Credit intermediaries go into a separate register of the same commission, while banks, payment and e-money institutions only notify it. The country's regulators are covered in [Bulgaria's Financial Licences](https://wiki.private.law/en/bulgaria-financial-licenses), and the payment and e-money route in [EMI and Payment Institution Licences in Bulgaria](https://wiki.private.law/en/bulgaria-emi-license).

## What it means for a fintech or BNPL provider

The directive gives a non-bank creditor no single point of entry to the EU market. For a provider choosing a base, the directive and the first national laws leave four models that differ in how much credit they permit and where.

| Model | Position under CCD2 | Limits |
| --- | --- | --- |
| Bank | Exempt from admission; any consumer credit | A full banking licence; CCD2 conduct rules and supervision |
| Payment or e-money institution | Exempt for payment-related credit; in Germany, fully outside registration | PSD2 Article 18(4) conditions; for a payment institution the directive covers only Annex I point 4 |
| Registered non-bank creditor | Any consumer credit, including BNPL | Admission in each state unless that state recognises another's registration |
| The seller's own deferral | Outside CCD2 | No third-party creditor, free, up to 50 days; up to 14 for a large online seller |

For a registered creditor the choice of base turns on how states treat foreign registrations: Germany recognises them, the Dutch bill applies Dutch law to any online credit in its market, and the Bulgarian register is designed for a local company with its main activity in the country.

A payment or e-money licence passports under the general rules ([EU Passporting](https://wiki.private.law/en/eu-passporting)), but the credit it permits is ancillary and tied to a payment. Such licences are covered for [Lithuania](https://wiki.private.law/en/emi-license-lithuania) and [Luxembourg](https://wiki.private.law/en/emi-license-luxembourg), and distribution through agents in [Payment Agents and Passporting in the EU/UK](https://wiki.private.law/en/payment-agents-eu).

## Popular but ends badly

A common attempt to stay outside the regime is to present financing as the seller's own deferral.

> ⚠️ The shop formally grants the deferral, while a financier pre-agrees to buy the receivables and sets the terms. For a large online seller, the CCD2 exclusion is lost once a third party offers or purchases the credit. In Germany, where a bank or payment institution pre-agrees the purchase and dictates the terms, the creditor's duties pass to that institution, which notifies BaFin of its merchants; if a third party takes over the whole credit contract, the large seller itself comes into scope. The structure shifts duties to the financier, and the transaction stays regulated.

Three other practices fail on the text of the directive itself.

| Practice | Why it fails |
| --- | --- |
| Scoring on social-media activity | Social networks are excluded as a data source and may not be processed in credit databases (Articles 18(3), 19(5)) |
| Credit pre-selected at checkout | A pre-ticked box creates no consent, and credit without prior request and explicit agreement is banned (Articles 15 and 17) |
| Relying on zero interest and small amounts | The lower threshold and the interest-free exclusion are gone; the Article 2(8) relief does not remove the creditworthiness assessment |

In every case the regulator looks at who actually extends the credit and what data the decision rests on.

> 🍓 CCD2 defines credit by substance: a deferred payment financed by a third party is regulated whatever its price, up to €100 000; only a short free deferral by the seller itself stays outside. For BNPL this means a creditworthiness assessment without social-network data, a ban on unsolicited credit and mandatory admission for creditors without a banking licence, with narrow exemptions for payment and e-money institutions. National law sets the form of admission, cost caps and recognition of foreign registrations, and already diverges.

## Q/A

### Scope and BNPL

### **Is interest-free BNPL covered by CCD2?**

Yes, if a third party finances the purchase. Only the seller's own free deferral stays outside: up to 50 days after delivery, or up to 14 days for a large online seller, provided no third party offers or purchases the credit (Article 2(2)(h)).

### **What happens to agreements concluded before 20.11.2026?**

They stay under the national rules implementing Directive 2008/48/EC until they end. Open-end agreements are the exception: from 20.11.2026 the new rules on rate changes, statements, overrunning, termination and assignment apply to them.

### **Does CCD2 apply to credit above €100 000?**

No, except unsecured loans for renovating residential property. A state may go further: Germany sets no upper limit, and neither does the Dutch bill.

### Admission and registration

### **Does a payment institution offering BNPL need to register?**

Under the directive it is exempt from admission only for a credit line under point 4 of Annex I to PSD2. National law may be wider: Germany takes all payment and e-money institutions out of registration. The credit itself stays within PSD2 Article 18(4).

### **Does a registered creditor get an EU passport?**

No. Germany chooses to recognise registration or admission under Article 37 in another EEA state, while the Dutch bill applies Dutch law to online credit and requires an AFM licence from providers without a bank or payment passport.

### **How much capital does a creditor need under CCD2?**

The directive sets none, and admission may be entry in a register. National law sets the requirements; the Bulgarian bill, for example, requires a local company with its main activity in the country.

### Data and price

### **Can social-media data be used for scoring?**

No. Social networks are not an external source for the creditworthiness assessment, and their data may not be processed in credit databases (Articles 18(3) and 19(5)).

### **Is there an EU-wide interest rate cap?**

No. Article 31 requires national measures against excessive cost, such as caps, but sets no figure. The Netherlands caps the rate at the statutory rate plus 8 percentage points, and the Bulgarian bill caps the APR at five times the statutory late-payment rate.

### **How much can a creditor charge for early repayment?**

Only for a fixed-rate period: by default no more than 1% of the amount repaid, or 0.5% if a year or less remains. A state may allow more on proof of a higher loss, never above the interest up to the agreed end date.

---

## Factual claims

- The reform closes a gap between law and market.
- CCD2 brings these products into scope, tightens the rules on selling credit and assessing creditworthiness, and subjects every creditor and credit intermediary to admission, registration and supervision (Article 37).
- In 2027 a BNPL provider with no banking, payment or e-money licence starts offering shoppers at a large German online store 30 days to pay, interest-free.
- Three features of the directive shape how the market works with it.
- The directive sets the dates, scope and exclusions; national law sets the form of admission, cost caps and penalties.
- The directive was published in the Official Journal on 30.10.2023 and entered into force on 19.11.2023, but two other dates matter to the market.
- The transition is not retroactive: agreements concluded before 20.11.2026 stay under the national rules implementing Directive 2008/48/EC until they end, outside CCD2 (Articles 2(2)(l) and 47).
- A credit agreement under CCD2 grants a consumer credit as a deferred payment, a loan or other similar financial accommodation.

---

Source: wiki.private.law — the private.law legal knowledge base. When quoting, cite the canonical page URL.
Consultation with a lawyer: https://t.me/private_law_bot