The New EU Consumer Credit Directive Through a UX Lens: What Lenders Need to Redesign

From November 20, EU rules will govern not only the terms of a loan but also what customers must see and understand when they apply for one. The new Consumer Credit Directive (CCD2) was needed because many people now take out credit on their phones in a matter of minutes, something the 2008 rules never anticipated. The directive therefore requires key credit information to be easy to take in on a phone screen, rules out treating a pre-ticked box as consent, and lets customers ask for a human to review the decision if an algorithm turns down their application. These requirements can only be met with a well-designed interface, which means banks and other lenders will need UX experts alongside their lawyers.

Someone is buying a new laptop online. At the checkout, an offer appears: they can pay in three interest-free installments. One click, and on the next screen an insurance policy checkbox is already ticked, covering the installments in case the buyer can’t pay. The terms sit in a drop-down text that, naturally, the buyer never opens. They think they’ve simply chosen a way to pay, when in fact they’ve taken out a loan.

From November 20, installment plans like this will also fall under CCD2. Before signing, the customer must receive a standard information sheet with the key figures of the credit on its first page, and the insurance can only be sold to them if they tick the box themselves.

What Changes on November 20

In 2023, the EU adopted Directive (EU) 2023/2225 on credit agreements for consumers, known as the Consumer Credit Directive 2 (CCD2). It replaces the 2008 Consumer Credit Directive, which predates the rise of digital lending. Member states had until November 20, 2025 to transpose the new rules into national law, and must apply them from November 20, 2026. The directive sets full harmonization: member states may depart from it only where the directive itself allows, for example on certain advertising bans. A bank or fintech operating in several countries can therefore build its interfaces on a common foundation and handle only these national variations separately.

The directive’s scope is also wider: the ceiling on the loan amount rises to €100,000, and now covers loans under €200, interest-free credit, and buy-now-pay-later (BNPL) services. Small loans and BNPL bring into scope merchants and fintechs whose payment flows have so far been built mainly for speed.

The Law Prescribes Outcomes, Not Solutions

Most of CCD2’s new requirements don’t say what a screen should look like, but what it has to achieve. Information must be easy to read and suited to the technical constraints of the device it appears on; consent must be a clear, affirmative act; and explanations of the credit and of automated credit decisions must be clear and comprehensible. Whether an interface meets these standards is decided not by the legal text but by what users actually see and understand.

Information must be easy to read and suited to the technical constraints of the device it appears on

A lawyer can tell you what information has to appear on screen and what rights the customer has. But whether the figures can really be taken in at a glance on a phone, or whether a rejected applicant understands the explanation, can only be ensured through design and only verified through user testing.

The Key Figures Go on the First Page

The pre-contractual information sheet has always had a set format, but CCD2 now dictates the order and weight of the information on it. Under the directive, the key elements of the credit must appear prominently on the first part of the sheet, on a single page. If they don’t fit, they may run to two pages at most, but the first seven elements – the lender’s name, the total amount of credit, the duration, the borrowing rate, the annual percentage rate of charge (APR) and total amount payable, the price of the goods for purchase credit, and the cost of late payment – must still appear on page one. According to the directive’s recitals, the aim is that customers can take in the essentials at a glance, even on a mobile phone screen.

Designers must reconcile two requirements here. The directive also states that all information on the sheet must be equally prominent, while the key elements must stand out in the first part. On mobile, this can only be resolved through a deliberate information hierarchy – structure, sequence, and typography – so no single figure looks less important than the others.

The remaining mandatory information – the type of credit, the conditions for changing the interest rate, an example illustrating the APR, any compulsory ancillary services, complaint options, and the full repayment schedule – must follow the first part, clearly separated from it. The schedule must also include the charges for any ancillary services sold with the credit. On mobile this means a long scroll, which has to be structured so that customers always know where they are and what each section contains.

Whether an interface meets these standards is decided not by the legal text but by what users actually see and understand

The directive also requires the information on the sheet to be consistent and displayed appropriately across channels. Any additional information must be provided in a separate document; marketing copy cannot be mixed in with the mandatory information. On request, the customer must also receive a free copy of the draft credit agreement alongside the sheet, provided the lender is willing to conclude it, so the interface needs room for that request too. The recitals also refer to the European Accessibility Act: the information sheet must be accessible to people with disabilities as well.

Credit Advertising Is Covered Too

The requirements start before the application, with advertising. Every credit ad must carry a clearly visible warning that borrowing money costs money. If an ad mentions an interest rate or any cost, it must also set out the key figures in a representative example, legibly and adapted to the technical constraints of the medium. If an ancillary service – insurance, for instance – is a condition of the credit and its cost can’t be determined in advance, that obligation must also be stated prominently. Only the installments and total amount payable, or the price of the goods, may sit behind a click, scroll, or swipe, and only if the interface genuinely cannot display them prominently. These rules apply to an in-app credit offer or a banner just as they do to a TV commercial.

Any message suggesting that credit will improve the customer’s financial situation, or that existing debts hardly matter in the assessment, is prohibited. The directive leaves it to member states whether to ban ads that emphasize how easy or fast it is to get credit. This, one of fintech’s most familiar messages, may therefore be allowed in one country and banned in the next.

Unsolicited credit is banned as well, such as unilaterally raising a credit card limit or sending out a credit card the customer never asked for. If the parties later agree to a significant increase in the credit limit, the lender must first reassess the customer’s creditworthiness based on up-to-date information. So if an app offers a higher limit with a single tap, it must be clear that the customer is the one asking for it, and the new assessment has to be built into the flow.

Consent and Withdrawal

The directive states that a lender may not infer a customer’s consent from default settings such as pre-ticked boxes, either for the credit agreement or for ancillary services. Consent must be a clear, affirmative act expressing a free, specific, informed decision. This directly affects the sale of payment protection insurance and other add-ons, which makes it a revenue issue as well: once the default tick disappears, add-ons have to be presented in a way that shows customers why they might want them.

This ties in with Directive (EU) 2023/2673 on financial services contracts concluded at a distance, which has applied since June 19, 2026 and also covers credit agreements concluded online. It prohibits online interfaces that deceive or manipulate customers, citing as examples giving more prominence to certain choices, repeatedly pushing for a decision through pop-ups, and making it harder to cancel a service than to sign up for it. The same directive introduced the withdrawal button for contracts concluded online, which must stay clearly visible and easy to reach throughout the withdrawal period.

For an application completed in minutes, the timing, channel, and wording of that reminder are part of the journey

CCD2 adds a withdrawal rule of its own, which mainly affects instant loans and BNPL. If less than a day passes between the pre-contractual information and the conclusion of the agreement, the lender must, between 1 and 7 days after signing, send a reminder of the right of withdrawal and how to exercise it, on paper or on another durable medium chosen by the consumer, such as email. For an application completed in minutes, the timing, channel, and wording of that reminder are part of the journey.

Explanation Before the Decision

Under the directive, lenders must give adequate explanations, free of charge and before the agreement is concluded, that allow customers to judge whether the credit and any ancillary services suit their needs and financial situation. The explanation must cover the main features of the credit and how it could affect the customer in practice, for example what happens if they fail to pay or if they pay late. For bundled services, it must also explain whether each component can be canceled separately and what that would mean.

This involves far more than repeating the mandatory figures: the numbers have to be translated into the customer’s own situation. Member states may, where justified, adapt the form and extent of the explanation to the type of credit and the circumstances, but the obligation still applies on digital channels, where there is no adviser to talk the customer through the details. That work falls to the interface and the copy. And if a lender makes a personalized offer based on automated processing, it must tell the customer so clearly and comprehensibly; if the price was personalized the same way, the information sheet has to say so.

Credit Assessment and Rejection

Under the directive, creditworthiness assessments must rely on information about the customer’s income, expenses, and financial situation that is necessary and proportional to the nature, duration, value, and risks of the credit. Special categories of data under the EU’s General Data Protection Regulation (GDPR), such as health data, or social networks as a data source may not be used. The application form has to follow suit and ask only for the data the assessment actually needs. Data protection law already requires lenders to tell applicants what that data will be used for, and the best place to do it is right next to the relevant field.

Most of the design work stems from the rule on automated credit assessment. If the assessment involves automated processing of personal data, the customer can request human intervention from the lender. This covers three rights: the right to a clear and comprehensible explanation of the assessment, including the logic and risks of the automated processing and its significance and effects on the decision; the right to express their own point of view; and the right to request a review of both the assessment and the decision. The rule is not limited to fully automated decisions: it applies as soon as automated processing plays any part in the assessment.

When an application is rejected, the lender must inform the customer without delay and, where appropriate, refer them to easily accessible debt advice services. If the rejection is based on a database check, the lender must disclose the result and the database consulted, immediately and free of charge. If the assessment involved automated processing, it must also tell the customer that they can ask for human review and tell them how to contest the decision. From November, a rejection can no longer be where the application ends. The rejection screen has to lead customers to the explanation, to a way of stating their view, and to a review request, which means designing an entirely new journey, from the screens through to receiving the request.

The explanation is the hardest part. The logic of an algorithmic decision has to be made understandable to someone who has just been turned down and is not necessarily in the most receptive frame of mind. This is a content design task that lawyers, designers, and data scientists who know the credit model have to tackle together. The directive’s recitals also point out that the EU Artificial Intelligence Act (AI Act) classifies AI systems used for credit scoring as high-risk. We have covered the AI Act’s design requirements in a separate article, and how to make AI decisions understandable to users in our piece on explainable AI.

What Can Be Done Before November 20?

With only weeks to go, redesigning the entire application journey is unrealistic for most organizations, but a targeted review is not. The first step is a heuristic evaluation, an expert audit that walks through the journey against the requirements mentioned, from the ad through the application and the information sheet to the rejection or the follow-up reminder, and shows where the current flow falls short of the new rules.

The second step is redesigning the information screens and the explanatory copy; the third is embedding the rules in the design system, the shared set of interface components. If checkboxes are unticked and the mandatory warning and neutral presentation of choices are built in as ready-made components, every new interface complies on these points from the start, with no need to recheck them in every release. Finally, user testing shows whether the interface really delivers what the directive expects: whether customers can take in the essentials at a glance, understand what they are committing to and, if they are turned down, understand why.