The New Consumer Credit Directive

What the new Consumer Credit Directive changes

The new Consumer Credit Directive, Directive (EU) 2023/2225 (CCD2), replaces the 2008 Consumer Credit Directive. Member states had to adopt their implementing laws by 20 November 2025 and must apply them from 20 November 2026 (Article 48 CCD2). The consumer credit directive extends EU consumer credit rules to products that were previously exempt, such as small loans, interest-free credit and buy-now-pay-later arrangements, tightens creditworthiness assessments, modernises pre-contractual information for digital channels, requires measures against excessive interest and charges and introduces authorisation and supervision for non-bank creditors and credit intermediaries.

Germany implemented the directive by the Act implementing Directive (EU) 2023/2225 on consumer credit agreements and regulating the promotion of climate-neutral mobility, adopted by the Bundestag on 17 April 2026 (Bundestag, 17 April 2026) and published in the Federal Law Gazette 2026 I No. 139 on 18 May 2026 (BGBl. 2026 I No. 139).

The act amends the consumer credit provisions of the Civil Code (BGB), the Introductory Act to the Civil Code (EGBGB), which contains the information requirements, and other statutes, and creates a new supervisory law for consumer credit in sales financing. As the application date of 20 November 2026 has now arrived, lenders, retailers and fintechs should be operating under the new rules.

Extended scope: buy now, pay later and small loans

The old regime excluded credit agreements below EUR 200, interest-free and charge-free credit, and credit to be repaid within three months with only insignificant charges. These exclusions allowed many buy-now-pay-later (BNPL) models to operate outside consumer credit law. CCD2 removes most of these carve-outs. According to the Bundestag's summary of the German act, the scope now covers small loans up to EUR 200, interest- and fee-free credit, credit with terms of up to three months and BNPL models. The upper threshold rises to EUR 100,000, and certain unsecured loans for renovating residential property are covered above that amount (Article 2 CCD2).

Some exclusions remain. Credit secured by a mortgage or comparable real estate security and credit for acquiring property continue to fall under the Mortgage Credit Directive rules, and member states may exempt deferred debit cards provided by credit or payment institutions that must be repaid within 40 days, are interest-free and carry only limited charges (Article 2(5) CCD2). The Bundestag's reporting indicates that the German legislature used this option for debit card arrangements; providers should check the final wording of the BGB carefully.

Creditworthiness assessment under the consumer credit directive

Before concluding a credit agreement, the creditor must carry out a thorough assessment of the consumer's creditworthiness, in the consumer's interest, to prevent irresponsible lending and over-indebtedness, taking appropriate account of the factors relevant to the consumer's prospects of meeting the obligations (Article 18(1) CCD2). The assessment must be based on relevant and accurate information on income and expenses and other financial and economic circumstances, obtained from the consumer and, where necessary, from databases, and it may not be based on special categories of personal data. Where automated processing is used, consumers have the right to request human intervention, an explanation of the assessment and the possibility to contest it.

The German act aligns the requirements with those already applicable to real estate consumer loans. In principle, credit may be granted only if the assessment shows that the obligations are likely to be met. This has significant consequences for BNPL providers and retailers integrating instant credit at checkout, who need data sources, scoring models and documentation that meet supervisory and civil law standards. A quick check against a credit bureau score may no longer be sufficient where the consumer's income and expenses are relevant to the amount and duration of the credit. Breaches can affect the enforceability of interest and charges and expose lenders to supervisory measures.

Information, advertising and withdrawal rights

CCD2 updates the standard information that must be provided before conclusion of a contract, with a short overview of key features and adaptations for mobile devices, and sets rules on advertising, including standard information and warnings about the cost of credit.

Unsolicited credit and credit offered with pre-ticked boxes are prohibited, and tying practices are restricted. According to the Bundestag, the German act allows text form for general consumer credit agreements, extends lenders' information duties and changes withdrawal rights. A key change for lenders is that the right of withdrawal where information was defective or missing expires no later than 12 months and 14 days after conclusion of the contract, ending the "perpetual withdrawal right" that generated extensive litigation under the old regime.

Excessive interest, forbearance and debt advice

Member states must introduce measures to prevent abuse and ensure that consumers are not charged excessively high borrowing rates, annual percentage rates of charge or total costs of credit. Germany has written into statute objective limits for usurious interest, which were previously determined by case law comparing the agreed rate with market rates.

Lenders must also show reasonable forbearance before initiating enforcement proceedings, for example through rescheduling or partial refinancing, and must refer consumers in difficulty to debt advisory services. A separate German law on free debt advice services passed the Bundestag but, according to the Bundestag's records, did not receive the consent of the Bundesrat in May 2026; its status should be checked before relying on it.

The consumer credit directive and digital lending

The consumer credit directive was written with digital distribution in mind. Much consumer credit is now arranged in apps, at online checkouts and through comparison platforms, and the new rules respond in several ways. Pre-contractual information must work on small screens, with the most important features presented first and further information available in layers. Consent to the credit agreement and to ancillary services must be given actively, and the directive prohibits granting credit without the consumer's prior request and explicit agreement. Creditors using automated creditworthiness assessments must give consumers the right to obtain human intervention, an explanation of the assessment and an opportunity to contest the decision.

These requirements interact with data protection law and with the EU AI Act, which classifies AI systems used to evaluate the creditworthiness of natural persons as high-risk systems, subject to exceptions such as fraud detection. Lenders and BNPL providers should therefore review their scoring models from three angles at once: consumer credit law, the GDPR's rules on automated decision-making and the AI Act's requirements for high-risk systems. Our page on EU AI Act compliance explains the AI side.

Platforms that present credit offers from several lenders, or that integrate a lender's product into their own checkout, should also check whether they act as credit intermediaries under the new rules. Intermediaries face information, conduct and authorisation requirements of their own, and the allocation of responsibilities between platform and lender should be set out clearly in the cooperation agreement, including who carries out the creditworthiness assessment and who handles complaints.

Existing contracts and litigation risk

The new rules apply to agreements concluded from the application date. Lenders should check the transitional provisions in the EGBGB for existing contracts, particularly for open-ended credit lines and overdraft facilities that continue after 20 November 2026 and for contracts amended after that date. Consumer credit has long been a field of mass litigation in Germany, driven by withdrawal rights and information defects. The cap on withdrawal rights should reduce that risk for new contracts, but errors in the implementation of the new information requirements, the creditworthiness assessment or the interest limits may generate new disputes, including collective actions by consumer associations.

Authorisation and supervision of non-bank lenders

CCD2 requires member states to subject creditors that are not credit institutions, and credit intermediaries, to authorisation, registration and supervision. Banks already need a licence under the Banking Act. For retail and sales financing, the German act introduces a new supervisory law for consumer credit in the context of sales financing (Absatzfinanzierungsaufsichtsgesetz).

Merchants and platforms that offer credit themselves, rather than through a partner bank, should check whether they now need an authorisation and what organisational and conduct duties apply. BNPL providers that are licensed as payment or e-money institutions must check how the consumer credit rules interact with their existing licence; our insight on payment services licensing under the ZAG covers the payments side.

For credit purchasers and servicers of consumer loans, the Secondary Credit Market Act continues to apply; see our insight on NPLs and the Secondary Credit Market Act. Leasing contracts with consumers, deferred payment arrangements and other financing aids are also affected because the BGB applies large parts of the consumer credit rules to them.

Implementation checklist

1. Inventory all consumer products with deferred payment or credit features, including partner arrangements with BNPL providers.
2. Update pre-contractual information, contract templates and advertising to the new EGBGB requirements.
3. Redesign creditworthiness assessment processes, data sources, automated decision-making and documentation.
4. Check pricing, including all fees and charges, against the new statutory limits on excessive interest and costs.
5. Adapt collection processes to the forbearance and debt advice referral requirements.
6. Assess authorisation needs under the new supervisory law and existing licences.
7. Train sales staff and customer service on new information, withdrawal and complaint processes, and document the training for supervisory purposes.

Our pages on fintech, payments and crypto assets and retail and consumer goods cover related questions.

How TRW & Co helps

We advise banks, consumer finance companies, BNPL providers, retailers, platforms and fintechs on the new consumer credit directive and its German implementation. We review product structures and partner arrangements, draft pre-contractual information, contract templates and advertising, design compliant creditworthiness assessment and collections processes and assess authorisation requirements under the new supervisory law. We also advise on litigation risks arising from information defects and withdrawal rights. This page is general information, not legal advice. To discuss your products, please contact us.