CCD2, formally Directive (EU) 2023/2225, replaces the original 2008 Consumer Credit Directive and updates the rules for consumer lending across the EU. Member states were supposed to transpose it into national law by 20 November 2025, and the regime becomes binding on all consumer lenders from 20 November 2026. As of May 2026, several countries still don't have a final answer on what their transposition will look like.
Slow transposition is nothing new in the EU (see NIS2), but the share of countries without finalised legislation is unusually high for CCD2.
The frontrunners are the Nordics and the Netherlands. This article looks at how those four countries are tightening consumer protection and what that will mean for the market. We follow the same template for each: who lends and who supervises, the current legal framework and available data sources, the specific problem the country is addressing, and what CCD2 changes, including any new risks it introduces along the way.
One pattern repeats across all four: no credit register in the EU today is enough on its own to support a proper creditworthiness assessment. Something is always missing, typically the realistic structure of recurring household expenses. In practice, the only way to fill that gap is open banking. But access to bank data on its own doesn't solve the problem. A lender also has to know how to recognize those transactions and map them to the categories the regulator actually wants to see.
Netherlands
Who lends and who supervises: Consumer credit in the Netherlands is offered primarily by banks and specialised non-bank consumer lenders. A network of credit intermediaries also operates on the market, but they don't issue credit under their own name. They only connect customers with lenders. All of these players need a license from AFM (Autoriteit Financiële Markten), the main market regulator.
Current framework and data sources: Regulation rests on two pillars. The Wet op het financieel toezicht (Wft) covers the public-law side: who can issue credit, what licensing is required, what capital and other prudential requirements apply. The contractual side (disclosure duties, contract content, withdrawal rights, early repayment) sits in the Civil Code. For credit below a certain threshold, the older Wet op het consumentenkrediet (Wck) still applies in some respects.
The data backbone for creditworthiness assessment is the central credit register BKR (Bureau Krediet Registratie). BKR is something of an exception in the EU because it carries both positive data (active credit agreements and how they're performing) and negative data (arrears and defaults). Credit that hasn't been in scope of regulation so far is largely missing from the register.
What the Netherlands is dealing with: The current rules don't cover BNPL ("buy now, pay later") or most mainstream credit cards. Unregulated BNPL debt disproportionately weighs on younger and lower-income households: roughly 47% of households in the lowest income quintile carry debt, with a median debt-service-to-income ratio of 41%1. That's exactly the segment CCD2's tighter rules are aimed at.
What changes with CCD2: Regulation now extends to segments that were previously out of scope - BNPL, credit cards, and very small loans. BKR reporting expands accordingly - BNPL will report regardless of debt size, and the current €250 threshold for mandatory BKR consultation is being removed. Several specific consumer measures come with the package, including a ban on BNPL for minors and caps on late-payment fees (€20 per reminder, €60 per calendar year).
More important than the scope expansion is that CCD2 stops letting lenders rely on the credit register alone. The register is one input among several; the lender also has to assess income and the structure of expenses. The Netherlands has its own methodology for this, the leennormen: a fixed base of minimum household living costs, recalculated each year by Nibud (Nationaal Instituut voor Budgetvoorlichting), plus a variable component derived from the applicant's income above the minimum wage. That formula sets the maximum monthly installment a borrower can afford.
CCD2 layers several new requirements on top of that logic. The depth of the assessment must be proportional to the size and term of the loan. Income has to be verifiable; a self-declaration won't do. And individual transactions on the applicant's bank statement need to be reviewed, not just averages. In practice, if a lender wants to keep a reasonable time-to-yes, they'll have to pull the applicant's bank data through an AISP (Account Information Service Provider, the open banking entity providing account information services) and process it from there.
The biggest pressure will land on BNPL. A meaningful share of consumers who use deferred payments today may simply not pass the new affordability bar.
Denmark
Who lends and who supervises: Consumer credit is provided mainly by banks and mortgage institutions, with non-bank consumer lenders alongside. The main supervisor is Finanstilsynet (the Danish FSA). For the practical mechanics of creditworthiness assessment, the Forbrugerombudsmanden (the Consumer Ombudsman) is at least as important - it issues the binding methodological guidance.
Current framework and data sources: The market rests on three statutes. The Financial Business Act mainly regulates banks and mortgage providers. The Consumer Loan Companies Act covers other non-bank consumer lenders. And the Consumer Credit Agreements Act is the transposition of CCD1, applying to all consumer credit, including credit with no interest or fees at all.
Denmark has no unified positive credit register. Only negative registries are available, dominated by Experian's RKI, with Debitor Registret and Debitorlisten covering smaller niches. None of them hold active, non-defaulted credit agreements, so without positive data it's effectively impossible to build a clean picture of an applicant's total debt-servicing load. That's precisely why Denmark has developed a strong segment of lenders that lean on open banking, pulling credit and expense data straight from the applicant's bank account.
What Denmark is dealing with: Without a positive register, creditworthiness assessment has historically leaned heavily on the applicant's own declarations. That's risky - borrowers may understate liabilities or overstate income. Denmark already has hard regulatory ceilings (an APR cap of 35% and a 100%-of-principal ceiling on total earnings from a loan, even when the loan defaults), but price caps don't fix a flawed underwriting process.
What changes with CCD2: The Danish transposition moves practice forward on several specific points. A creditworthiness assessment is now mandatory regardless of loan size or monthly installment, and it must be built on verified information rather than self-declarations. The burden of proof that the assessment was done correctly sits with the lender, not the consumer.
Disposable income is calculated on a net basis, not gross: after taxes, social contributions and fixed obligations. This explicitly rules out the previous practice of some BNPL and non-bank lenders working with gross income or unrealistic averages.
Blanket statistical estimates of expenses are no longer acceptable. Finanstilsynet and the Forbrugerombudsmand explicitly state that only conservative estimates grounded in concrete facts about the specific applicant are allowed; the old shortcut of "a household in city Y has average monthly expenses X" doesn't hold for creditworthiness purposes anymore.
Finally, Article 18 of CCD2 raises the bar from "the consumer can pay right now" to "the consumer can pay throughout the life of the loan." For variable income (freelance, gig work), that means averages have to be representative, not cherry-picked from the best months.
The Danish calculation of the disposable margin follows a simple equation: net income minus fixed expenses. Out of what remains, the borrower has to cover groceries, household items, hygiene, clothing, medicines and other health expenses, phone and internet, subscriptions, leisure activities and the occasional replacement of consumer electronics. The lender therefore has to leave a buffer for unforeseen items like a broken phone or laptop.
Fixed expenses cover housing, transport, insurance, other loans and obligations, and child-related costs. For an individual loan, only the applicant's income counts; a partner's income can be included only on joint applications.
Finanstilsynet's guidance on creditworthiness assessment publishes indicative minimums for the disposable margin2:
In rough EUR terms, that's about €970 for a single person, €1,645 for a childless couple, and €2,130 for a couple with one young child.
Sweden
Who lends and who supervises: Consumer credit in Sweden today is provided by banks and non-bank consumer lenders (including BNPL). The main regulator is Finansinspektionen, with Konsumentverket and the Consumer Ombudsman watching the consumer-protection side.
Sweden is in a unique position, though. Within roughly twelve months, four major changes are landing on this market that, taken together, will rewrite the non-bank consumer credit segment. CCD2 is only one of them:
- Elimination of the standalone licensing regime for non-bank consumer lenders. Only two types of provider remain: banks and the newly relevant credit market companies (Swedish kreditmarknadsbolag). The requirements on those who stay in the new regime will be very similar to those imposed on banks, including for BNPL (Klarna has already obtained a credit market company license). This is a step without precedent in the EU. The new framework entered into force on 1 July 2025; existing providers have until 31 July 2026 to either obtain the new license or wind down. Most of the roughly seventy current standalone consumer lenders are expected to leave the market.
- Lower APR cap. The most expensive loans get cheaper for consumers. For lenders, margins shrink, and with CCD2 the cost of creditworthiness assessment goes up as well, so the economics get squeezed from both directions.
- End of tax deductibility for interest on unsecured loans. For institutional lenders, these loans become materially less attractive.
- CCD2 transposition.
All four measures share a single motivation: unsustainable debt among young and low-income consumers has been rising disproportionately, and the regulator wants to stop it. The result will be market consolidation around a smaller set of stronger players and downward pressure on margins, with consumer pricing held flat or lower.
Current framework and data sources: Sweden has one of the strongest positive credit registers in the EU. The dominant operator is UC AB (founded 1977), covering both positive data (active receivables and, on top of that, income data obtained directly from the tax authority) and negative data (typically held for three years after a missed payment). BNPL providers have historically reported into the register only partially; CCD2 changes that, with all lenders moving to full participation.
What changes with CCD2: Scope expands to BNPL, interest-free loans, and small-ticket lending under €200. Creditworthiness assessment now has to combine positive and negative register data, income information, and an expense assessment. In standard banking practice the expense side covers housing, insurance, transport, taxes, and other loans and obligations.
For everyday categories like groceries, hygiene or clothing, Sweden (unlike Denmark) still permits statistical averages, provided the lender accounts for household size and composition and reflects inflation in the figures used. There is no hard floor on the minimum disposable margin equivalent to the Danish one.
Finland
Who lends and who supervises: Finland's market is bank-centric, with roughly 67% of consumer credit volume running through banks. Non-bank consumer lenders sit alongside under lighter requirements. The main regulator is FIN-FSA / Finanssivalvonta (FIVA), with the Consumer Ombudsman (Kuluttaja-asiamies) and the regional authority ESAVI (focused primarily on non-bank lenders) sharing oversight.
Current framework and data sources: Finland introduced an interest-rate cap on consumer credit back in 2019. The current permanent regime, in place since October 2023, sets the maximum rate at the reference rate plus 15 percentage points, with an absolute ceiling of 20%. There is no cap on total cost in Finland (the kind Denmark uses).
The bigger shift on the data side came in April 2024 with the launch of the positive credit register Positiivinen luottotietorekisteri. It is operated by the Finnish tax administration (Vero), not a commercial entity. The register holds mortgages, consumer loans, credit cards, installment sales, student loans and leases, with installment amounts, dates and any restructurings recorded. Despite being primarily positive in nature, it also records arrears longer than 60 days; other negative information sits in a parallel registry. The positive register is directly linked to the income register Tulorekisteri, which has been collecting wage, pension and benefit data since 2019 (capital income and self-employment income aren't included, however).
Reporting and querying are statutory obligations rather than contractual ones. A lender has to query the register before each new loan and each restructuring (portfolio monitoring, by contrast, is not a permissible reason to query), and must take the entire retrieved record into account, both on credit and on income. BNPL providers haven't reported into the register so far; CCD2 changes that.
What Finland is dealing with: Even with one of the better positive registers in the EU, Finland still lacks register-level data on recurring expenses. Quality creditworthiness assessment therefore can't be done without supplementing from other sources, typically open banking. Statistical estimates are allowed in Finland, similar to Sweden, but the register on its own isn't enough.
What changes with CCD2: BNPL and interest-free loans come into scope. For BNPL providers, that means obtaining a FIVA license, complying with the supervisory rules, performing creditworthiness assessment including the mandatory query into the positive register, evaluating the full retrieved record, and reporting any granted loan back into the register.
On top of that, repayment sustainability now needs to be assessed over the entire life of the loan, not only at origination. Case law on how the new-style assessment should look in practice is essentially nonexistent today and will only start to take shape over the coming months.
Conclusion
Across the four countries that are furthest along in CCD2 transposition, the details vary substantially. One adds a hard floor on the disposable margin or explicitly rules out blanket averages on the expense side (Denmark), another resets the non-bank credit segment outright (Sweden), another runs a state-operated positive register in real time (Finland). What CCD2 imposes across all of them is one shared principle: it raises the bar for creditworthiness assessment and shifts it from “right now” to “throughout the life of the loan.”
For every lender, that translates into one very concrete obligation. Even the best credit register in the EU today (Finland's state-run one, Sweden's UC, the Dutch BKR) answers only part of the question: the structure of credit, and often income too. Recurring expenses are not in the registers, and even where statistical averages are permitted, they still need to be grounded in the actual composition of the specific household. Every one of these countries therefore needs the same missing piece of the puzzle: verifiable expense categories built on the consumer's real data.
There is one practical path to filling that gap: connecting to the consumer's bank data through an AISP under open banking. And this is where the part of the CCD2 conversation that often gets skipped begins. Access to bank transactions alone isn't enough. To comply with CCD2, a lender has to be able to recognize and categorize those transactions (which are fixed expenses, which are debt obligations, which are irregular but expected), map them to the categories the regulator demands (Denmark's “housing / transport / insurance / other loans / children,” for example), and feed all of that into a credit decision in real time without materially slowing down the time-to-yes.
The main question for lenders is whether they can pull from that data, quickly and repeatedly, exactly what the regulator now demands: classified transactions, identified fixed obligations, quantified recurring expenses. For firms that already have this layer in place, CCD2 is mostly an extension of existing processes. The rest will either need to invest meaningfully in their data platform or retreat from certain segments. For some non-bank players, that may mean leaving the market entirely.
