CCD2 for Lending Apps: What Changes in Your Loan Application Flow on 20 November 2026

CCD2 is Directive (EU) 2023/2225, published in the Official Journal on 30 October 2023. Member states had until 20 November 2025 to write it into national law and must apply those rules from 20 November 2026 (Article 48).

It is a directive, not a regulation. It does not work on its own: each country writes it into national law, so details differ from market to market.

CCD1 vs CCD2: what moved in the scope

• Upper limit: CCD1 covered credit from EUR 200 to EUR 75,000. CCD2 excludes credit above EUR 100,000 (Article 2(2)(c)), with one exception: unsecured loans above that amount taken to renovate a residential property stay in scope (Article 2(3)).
• Small amounts: CCD2 has no lower limit, so credit under EUR 200 is now covered.
• Interest-free credit: credit granted free of interest and without other charges is in scope.
• Buy now, pay later: credit repaid within three months with only insignificant charges, which describes most BNPL products, is in scope.
• Lighter regime for these categories: for small, interest-free and three-month credit, member states may switch off a limited set of provisions (Article 2(8)), but the products stay inside the directive.

If your product used to sit outside the consumer credit law, for example a micro-loan under EUR 200 or a deferred payment at checkout, it now goes through the same process as an ordinary loan.

CCD2 changes four parts of a loan app: advertising, the application, the credit decision and the handling of customers in difficulty.

The items follow the customer journey from the first ad to repayment trouble. For each one: the article, the change in the app, and where that change lives (content, process, or backend and data).

Advertising and acquisition

• Cost warning (Article 8(1)): advertising must carry the warning "Caution! Borrowing money costs money" or equivalent wording. In specific, justified cases where an electronic medium cannot show the standard information clearly, part of it may be reached by clicking, scrolling or swiping (Article 8(6)). In the app: the warning and a link to the full data in banners, the calculator, landing pages and push notifications. Where it lives: content; the warning text sits in configuration.
• No "credit will fix your finances" (Article 8(7)(a)): advertising may not suggest that credit would improve the consumer's financial situation. In the app: a review of in-app copy and push campaigns. A line like "solve your money problems" has to go. Where it lives: content.

Application

• Pre-contractual information (Article 10, Annex I): the Standard European Consumer Credit Information form must be clearly legible, take into account the technical constraints of the medium and display properly across channels (Article 10(6)). Recital 37 adds that the key elements belong in the first part of the form and that the form should work on mobile phone screens. In the app: the form rendered natively from offer data, not only as a PDF. Where it lives: backend and data.
• Personalized price (Articles 10(3)(m) and 13): if the price was personalized on the basis of automated processing, including profiling, the pre-contractual information must say so, and the consumer must be told clearly. In the app: a "personalized offer" flag stored as a field on the offer, which every screen reads. Where it lives: backend and data.
• Tying banned, bundling allowed (Article 14(1)): you can sell a package, but you cannot make the credit conditional on an extra product. In the app: an add-on such as insurance can be unchecked without blocking the application. Where it lives: process.
• No inferred consent (Article 15): default options, including pre-ticked boxes, do not count as agreement; consent needs a clear affirmative act. In the app: zero pre-ticked checkboxes, including in cross-sell and limit-increase screens. Where it lives: process.
• No unsolicited credit (Article 17): credit cannot be granted without the consumer's prior request and explicit agreement. In the app: a "pre-approved" offer or a limit increase does not start a credit without the customer's action. Where it lives: process.

Decision

• Creditworthiness assessment (Article 18(1)): the creditor must carry out a thorough assessment in the consumer's interest. In the app: every decision can be reconstructed from its input data, the version of the rules or model, and the result. Where it lives: backend and data.
• Automated decisions and human intervention (Article 18(8)): when the assessment uses automated processing of personal data, the consumer can request human intervention. That covers a clear explanation of the assessment with the logic and risks involved, the chance to express their point of view, and a review of the assessment and the decision. In the app: a button that starts the request, a queue for an analyst and a record of who changed the decision and when. A clause in the terms and conditions does not give the customer that button. Where it lives: process, backend and data.

After the contract: customers in difficulty

• Early detection, debt advice and forbearance (Articles 35(1), 36(2) and 36(3)): creditors need processes to spot consumers in financial difficulty early and to refer them to accessible debt advisory services, and they must apply reasonable forbearance, where appropriate, before enforcement. In the app: signals such as late payments or extension requests captured as data, plus an "I need help" path in the app. Where it lives: backend and data, plus process.

Two items on this list are content changes: warnings and copy. Three are process changes: consents, paths and queues. The other five need backend and data work, such as the offer engine and the decision record, two of them together with process changes. Only that last group cannot be added in a week.

What else lands in the same flow

• Directive (EU) 2023/2673 on financial services contracts concluded at a distance applies from 19 June 2026 and requires, among other things, a withdrawal function for contracts concluded through an online interface. Poland has not transposed it yet.
• Under the European Accessibility Act, Directive (EU) 2019/882, accessibility requirements for consumer banking services, including consumer credit, apply from 28 June 2025. In Poland they sit in the act of 26 April 2024 on ensuring compliance with accessibility requirements.
• Credit scoring of natural persons is a high-risk AI system under the EU AI Act. We cover what that means for lending apps in EU AI Act and Credit Scoring.

State as of October 2026: the transposition deadline passed on 20 November 2025, and member states are at very different stages. The status changes quickly, so check it before you plan a release.

Sweden is an example of a country that is ready. Its new Consumer Credit Act (Konsumentkreditlag, SFS 2026:1011) was adopted by the Riksdag on 27 May 2026 and enters into force on 20 November 2026.

Poland is a special case. The timeline so far:

• 7 July 2025: the consumer protection office (UOKiK) publishes the first draft of a new consumer credit act.
• 20-21 January 2026: inter-ministerial consultation meeting on the draft.
• 5 March 2026: a version dated 25 February 2026 appears on the government legislation portal (RCL).
• 18 May 2026: the Prime Minister withdraws the UOKiK President's authorization to lead the work.
• 22 May 2026: the government announces that the draft will be written again from scratch.

The work is now led by the Ministry of Justice together with the Ministry of Finance, and the new act is meant to transpose CCD2 and Directive 2023/2673 at the same time. Poland will not transpose the directive by 20 November 2026 and has told the European Commission so; the aim is to pass the act before the end of the Polish parliament's current term in autumn 2027. At the time of writing, the ministry's draft has not been published; you can follow it in the Council of Ministers' list of legislative work. Until a new act enters into force, the Consumer Credit Act of 12 May 2011 applies in Poland.

What this means for a product team, without legal interpretation: in Poland the date is unknown, and the final shape of the rules will arrive at short notice. If you operate in several EU countries, you will run the same product under different requirements in different markets for a while. That calls for per-market configuration on one codebase. Whether the directive has any direct effect in a country without a national law is a legal question; ask your lawyer.

A backend-driven flow lets you add a consent screen, a message or a path to an analyst without a new app version or store review.

We have not "implemented CCD2" and we do not claim that the apps below are CCD2-compliant. They are lending apps we build and maintain, and their architecture shows where the requirements from the list above would land.

AvaFin is an iOS and Android app built in React Native that we have been building since January 2026.

• AvaFin's central system decides the order of the application steps. After each step the app fetches the current state and works out what to show next, so changing the order or scope of the steps does not need a new app version. That is where a new consent screen, information about a personalized offer or a path to an analyst would go.
• When a change does have to ship in code, a minimum-version threshold in Firebase Remote Config forces the update. Once national rules are announced, old versions do not stay in circulation.
• The first loan after registration and the next loan for a returning customer run on the same engine. A new requirement changes in one place.
• The calculator uses the same pricing engine as the central system, so the amount in the app is the amount in the contract. Advertising, the information form and the contract show the same number.
• Analytics and attribution SDKs are off from the first launch and switch on only after the user decides. In September 2026 we adjusted how Crashlytics and Firebase Analytics start to meet the requirements of the client's legal team. Article 15 applies the same principle to credit consents.

Aasa24 is a mobile lending app with card features, developed since 2023 by a dedicated team.

• Calculator parameters, documents and messages are managed from an admin panel without a new store version, and card features are switched on remotely with flags. The Article 8 warning and new pre-contractual content become a change in the panel.
• Releases ship every 3-4 weeks on average, and production hotfixes ship within days. When a national law lands at short notice, the change goes into the next release or a hotfix instead of waiting for a quarterly cycle.

Pre-contractual content is data and templates, so we test it on edge cases such as empty values or a repeat loan versus a first loan, not only on the happy path. More of this work is described on our fintech software development and mobile app development pages.

A CCD2 readiness check for a loan app covers three areas: content, process, and data and architecture. Answer each question with yes or no; where a question maps to an article, the number is in brackets.

Content

• Can you change the "Borrowing money costs money" warning, and the full advertising data behind a click or scroll, without a new app version? (Article 8(1) and 8(6))
• Is your in-app and push copy free of suggestions that a loan will improve the customer's finances? (Article 8(7)(a))

Process

• Does the backend decide the order of application steps and the scope of fields, so a change skips App Store and Google Play review?
• Is every consent box unchecked by default, including in cross-sell, and can an add-on be removed without blocking the application? (Articles 14 and 15)
• Does every pre-approved offer and limit increase wait for the customer's action before any credit starts? (Article 17)
• Does the customer have a path to a person after an automated decision, handled from a queue that records who changed the decision and when? (Article 18(8))
• Can a customer in difficulty find a path to forbearance and debt advice in the app? (Articles 35 and 36)

Data and architecture

• Does the information form render legibly on a phone from offer data, not only as a PDF? (Article 10(6))
• Do the calculator, the information form and the contract take the price from one engine, and does the offer carry a "personalized" flag? (Articles 10(3)(m) and 13)
• Can you reconstruct a creditworthiness decision: input data, version of the rules or model, result? (Article 18)
• Do products that used to sit outside the law, such as small amounts and deferred payments, go through the same process? (Article 2)
• Can you handle different national requirements through per-market configuration and ship a change in days, not quarters?
• Are analytics SDKs off until the user decides?

If you answered "no" or "I don't know" to more than three questions, let's talk about a review of your application flow.

What is CCD2?

CCD2 is the common name for Directive (EU) 2023/2225 on credit agreements for consumers. It replaces the 2008 Consumer Credit Directive (2008/48/EC), widens its scope and adds new rules on advertising, consent, creditworthiness assessment and automated decisions. Each EU member state has to write it into national law.

When does CCD2 apply?

Member states had to transpose CCD2 by 20 November 2025 and must apply the national rules from 20 November 2026, under Article 48 of the directive. Several countries, Poland among them, will miss that date, so in practice the start depends on when each national law enters into force.

What is the difference between CCD1 and CCD2?

CCD2 covers credit up to EUR 100,000 with no lower limit, including buy now, pay later. It requires an information form that is legible on a phone and a cost warning in advertising. It bans pre-ticked consent, tying and unsolicited credit, and gives consumers a right to human intervention when an automated system assesses their creditworthiness.

Does CCD2 apply to buy now, pay later?

Yes. Interest-free credit without other charges, and credit repaid within three months with only insignificant charges, both fall within CCD2. Member states may switch off a limited set of provisions for these products under Article 2(8), but the products stay inside the directive and its core rules.

Is CCD2 a directive or a regulation?

CCD2 is a directive, so it needs national laws to take effect in each member state. Until a national law enters into force, the existing consumer credit rules of that country still apply. In Poland, that is the Consumer Credit Act of 12 May 2011.

What does CCD2 mean for a mobile lending app?

A mobile lending app needs an information form that is legible on a phone, cost warnings in its messages, no default consents, a flag for personalized offers and a path to human intervention after an automated decision. If the backend drives the application flow, most of these changes ship without a new store version.

Has Poland implemented CCD2?

No. At the time of writing (October 2026), the Ministry of Justice and the Ministry of Finance are preparing a new draft, and the aim is to pass it before the end of the Polish parliament's current term in autumn 2027. Until then, Poland's Consumer Credit Act of 12 May 2011 applies.

Does CCD2 require human review of automated credit decisions?

When a creditworthiness assessment relies on automated processing of personal data, the consumer can ask for human intervention: an explanation of the assessment, a chance to give their view and a review of the decision (Article 18(8)). In a product, that means a request path in the app and a review queue behind it; a line in the terms and conditions does not provide either.