CCD2

CCD2 is Directive (EU) 2023/2225 of October 18, 2023 on credit agreements for consumers, published in the Official Journal on October 30, 2023. It is a directive, not a regulation, so it works through national law. Under Article 48, Member States had to adopt and publish their implementing rules by November 20, 2025 and must apply them from November 20, 2026. Under Article 47, the old Consumer Credit Directive, 2008/48/EC, is repealed with effect from November 20, 2026, but it continues to apply to credit agreements that exist on that date until they end.

The scope is wider than before. CCD2 excludes credit above EUR 100,000 (Article 2(2)(c)), except unsecured credit above that amount taken to renovate a residential property (Article 2(3)). There is no lower limit. Credit under EUR 200, credit free of interest and other charges, and credit repaid within three months with only insignificant charges are covered, although Member States may switch off a short list of provisions for them (Article 2(8)). Short deferred payments offered by the seller without a third party, free of interest and paid within 50 days of delivery, stay outside (Article 2(2)(h)); for online sellers that are not small or medium-sized enterprises the limit is 14 days.

Most of the directive follows a customer journey. Advertising must carry the warning Caution! Borrowing money costs money or equivalent wording (Article 8(1)). Pre-contractual information goes on the Standard European Consumer Credit Information form, which must be legible and take into account the technical constraints of the medium (Article 10(6)). The lender must assess creditworthiness before the agreement (Article 18) and apply reasonable forbearance before enforcement (Article 35).

Much of CCD2 lands in the product: screens, consents, the decision flow and the data behind them. Requirements for a lending system:

• Advertising content must change without a release. The cost warning has to appear in every piece of advertising, including landing pages and calculators that promote credit, and where an electronic medium cannot show all the standard information clearly, part of it may sit behind a click, scroll or swipe (Article 8(6)).
• The information form is data. It must be readable on a phone screen and consistent across channels, so render it from the offer data, not from a separate document that can drift.
• No pre-ticked boxes. Default options, including pre-ticked boxes, do not count as consent to the credit or to ancillary services (Article 15). Tying is prohibited, bundling is allowed (Article 14(1)), so an add-on must be removable without blocking the application.
• No credit without the customer's request. A pre-approved offer or a limit increase must wait for the customer's explicit agreement (Article 17).
• Personalized prices are flagged. If the price was personalized through automated processing, the pre-contractual information says so (Article 10(3)(m)) and the customer is told clearly (Article 13). Store it as a field on the offer.
• Credit decisions can be reconstructed. The lender documents its assessment procedures and the information used (Article 18(4)). When the assessment uses automated processing, the consumer can ask for human intervention: an explanation, a chance to state their view and a review of the decision (Article 18(8)). That needs a request path in the app, a review queue and a record of who changed what.
• Customers in difficulty are found early. Lenders need processes to detect financial difficulty early (Article 36(2)) and must refer those customers to debt advice (Article 36(3)).

CCD2 also asks Member States to prevent excessively high borrowing rates, APRs or total costs of credit, for example with caps (Article 31(1)), and to report those measures to the Commission by November 20, 2026. The APR formula stays in place: Article 30 refers to Annex III, as described under APR.

As of October 2026, Poland has not published a new act implementing CCD2, and the Consumer Credit Act of May 12, 2011 is still in force. It already caps non-interest costs of credit (Article 36a) and requires a creditworthiness assessment before the agreement (Article 9). How the directive applies in a country without a national act is a legal question for your lawyer. Lenders that operate in several EU countries should expect different national versions of the same rules for some time.

We have not run a CCD2 implementation project, and we do not describe the apps below as CCD2-compliant. They show where requirements of this kind land in a lending app.

In the app we have built for AvaFin Poland since January 2026, AvaFin's central system decides the order of the loan application steps and the app displays them, so changing the order or scope of the steps does not need a new app version. Analytics and crash reporting start only after the app reads the customer's decision from the consent management platform, so without a decision they stay off. Article 15 sets the same rule for credit: a default option is not consent.

In Aasa24, the lending app we have built and developed for Aasa Polska since May 2023, Aasa's team changes calculator parameters, documents and messages in an admin panel, without a new release in the app stores. That is the layer where a changed cost warning or information text would be edited.