Member States must apply the new Consumer Credit Directive, (EU) 2023/2225 or “CCD2”, from 20 November 2026 (Art. 48). Under Article 6, the conditions for being granted credit must not discriminate against consumers legally resident in the EU on any ground listed in Article 21 of the EU Charter of Fundamental Rights, including sex, ethnic origin, disability and age. Different conditions of access remain possible where they are “duly justified by objective criteria”.
“…some credit institutions have not assessed the lawfulness of the assessment criteria used in their credit scoring models from the perspective of equality legislation and the prohibition of discrimination.”
Finnish Financial Supervisory Authority (FIN-FSA), thematic review on the assessment of consumers’ creditworthiness, 8 April 2026
The information used to assess creditworthiness must not include special categories of personal data, such as ethnic origin or health (Art. 18(3)). Age is different: most lenders already hold date of birth. This checklist covers where to start, one credit decision at a time.
1. Scope one decision
Pick one decision in one product: approve or decline at application, credit limit, or price tier. Write down the population, the period and what counts as a favourable outcome. A gap measured across a mixed population is hard to explain.
2. Write down why each criterion is there
List the conditions that decide who gets credit and on what terms: score cut-offs, policy rules, affordability buffers and pricing tiers. For each one, record the objective reason for it. Article 6 allows different conditions of access where they are duly justified by objective criteria, so that record is your starting point. You must also document your assessment procedures (Art. 18(4)).
3. Use the characteristics you already hold
Start with age: date of birth gives you age at application, so you can compare age groups now. Some lenders also record sex. Check that using these data for testing has a lawful basis and is covered by your privacy notice.
4. Plan for missing data
For grounds you do not hold, such as ethnic origin or disability, look at complaints, customer research and reviews of the application journey. Inferring ethnic origin, for example from names, is likely to be processing of special category data (GDPR Art. 9(1)). That needs a lawful basis and an Article 9 condition, and probably a data protection impact assessment. Keep any such data out of the creditworthiness assessment itself (Art. 18(3)), and record the method you used and its limits.
5. Agree the comparison and the trigger in advance
Name the reference group, the measure (for example, the approval-rate ratio or the percentage-point gap) and the size of gap that triggers a review. Set a minimum group size too: small groups produce unstable gaps. Agree all of this with risk and compliance before you look at results.
6. Treat a gap as a question, not a verdict
Compare like with like first, for example applicants in the same risk band. A remaining difference can come from applicant mix, policy rules, data quality or manual overrides. Then ask whether the condition driving it is “duly justified by objective criteria” (Art. 6). Investigate before concluding, and record what you checked.
7. Write down what happens next
Record the owner, the action and the date of the next run, and keep the result with your documented assessment procedures. Re-run after material changes to policy, models or data. Where the assessment uses automated processing, consumers can ask for a clear explanation of it and a review of the decision (Art. 18(8)).
Sources
- Directive (EU) 2023/2225 on credit agreements for consumers, Articles 6, 18(3), 18(4), 18(8) and 48
- Charter of Fundamental Rights of the European Union, Article 21
- FIN-FSA, “Thematic review on the assessment of consumers’ creditworthiness” (8 April 2026)
- Regulation (EU) 2016/679 (GDPR), Article 9(1)
National laws implementing the Directive may add requirements or apply from a different date. This checklist is general information, not legal or regulatory advice. Equilens is not affiliated with FIN-FSA or any other authority.