Changes to the Consumer Protection Act and Stricter Creditworthiness Assessment Requirements
Directive (EU) 2023/2225 has introduced a comprehensive reform of EU consumer credit regulation, expanding its scope to include BNPL (Buy Now, Pay Later) models, small loans, and short-term credit, while tightening requirements related to disclosure, marketing, and creditworthiness assessments. In Finland, this has led to a broad reform of the Consumer Protection Act during 2025–2026, increased registration obligations, and stricter regulation particularly concerning small loans and e-commerce payment methods. Key changes related to creditworthiness assessment will enter into force on 20 November 2026, alongside other significant reforms.
Key Changes to the Consumer Protection Act
Expanded registration requirements
According to a supervisory bulletin issued on 23 January 2026 by Finnish Financial Supervisory Authority, new consumer credit providers and intermediaries will come under its supervision. At the same time, the obligation to register as a credit provider will be extended to include certain entities already supervised by the authority that grant consumer credit. Operators intending to continue granting or intermediating consumer credit under Chapter 7 of the Consumer Protection Act after the legislative changes take effect on 20 November 2026 must register in the authority’s register. The authority has accepted registration notifications from credit intermediaries since 20 March 2026 from entities falling within the scope of the new Act on certain consumer credit intermediaries. Applications submitted by 20 May 2026 will be processed before the legislative changes enter into force.
Emphasis on creditworthiness assessment
Creditworthiness assessment is a key obligation in granting consumer credit, and its importance will further increase under the new regulation. The creditor must carry out a careful assessment based on up-to-date and sufficient information regarding the consumer’s ability to repay the credit.
Key findings:
- The positive credit register is used, but its use varies (especially insufficient consideration of existing loans)
- The accuracy of customers’ financial information is not always sufficiently verified
- Affordability assessments do not always consider all relevant expenses or future changes (e.g. interest rates, income stability)
- Documentation deficiencies exist (e.g. retention periods too short)
- Not all actors have assessed their credit decision models from a non-discrimination perspective
The authority requires institutions to correct identified deficiencies and will use the findings to guide future supervision.
In January 2026, the authority published its inspection and thematic review plan, which includes a new review of creditworthiness assessments in 2026 (covering EEA credit institutions and consumer credit providers).
Requirements for creditworthiness assessment
Under the revised Consumer Protection Act, before concluding a credit agreement, the creditor must carefully assess the consumer’s creditworthiness using necessary information about their income, expenses, and financial situation.
Key requirements:
-
Sufficient and reliable information base
- The assessment must be based on up-to-date and verified information
- Information must be obtained from the consumer and key data sources, such as the positive credit register
- Accuracy of information must be appropriately verified
- In certain limited cases (e.g. completely interest-free and cost-free credit), the use of data sources may be more limited, but the assessment must still be sufficient
-
Individual affordability assessment
The assessment must consider:
- Income and its stability
- Actual expenses (e.g. housing costs)
- Existing debts and obligations
- Assets and guarantee liabilities
The assessment must reflect the consumer’s actual repayment capacity and must not be based solely on collateral or statistical assumptions.
-
Positive credit register
The positive credit register is a key data source and, as a rule, an essential part of creditworthiness assessment.
-
Documentation requirement
The creditor must document:
- Data used
- Assessment methods
- Conclusions reached
Documentation must be sufficiently comprehensive and clear so that an authority can review it without additional clarification. All data must be specified, calculations transparent and reproducible, and decisions justified and assessable afterwards.
Automated decision-making and transparency
If decisions are made automatically, the creditor must ensure transparency and understandability of the process.
Purely automated decision-making without appropriate safeguards is not permitted. The General Data Protection Regulation requires that the consumer has the right to:
- Be informed about automated decision-making
- Request a clear explanation of the decision
- Present their own view
- Request a human review of the decision
The Consumer Credit Directive complements and specifies GDPR in the context of creditworthiness assessment by:
- Emphasizing transparency in credit decisions
- Requiring that the consumer is informed about the assessment
- Strengthening the right to justification and understandable explanation
Practical implementation
Step 1: Data collection
- Verification of applicant’s income (salary and benefits)
- Comprehensive mapping of expenses
- Existing debts and financial commitments
- Data from key registers
Step 2: Analysis and credit models
- Calculation of actual disposable income
- Assessment of repayment capacity
- Sensitivity analysis (e.g. rising interest rates, income changes)
Step 3: Decision principle
Credit may only be granted if it is likely, based on the assessment, that the applicant can meet repayment obligations without significantly reducing their standard of living throughout the credit period.
The assessment should not rely on assumptions such as:
- Significant future reduction in consumption
- Refinancing the loan to enable repayment
Step 4: Documentation and controls
Documentation must be:
- Transparent and reproducible
- Assessable afterwards
- Reviewable by authorities without additional clarification
Consequences of inadequate assessment
An inadequate creditworthiness assessment may lead to significant legal consequences. In certain situations, the creditor may lose the right to charge interest or other credit costs, partially or entirely. The application of sanctions depends on the nature of the breach and case-by-case evaluation.
NFR’s supervisory experience supporting creditworthiness processes
Experts at NFR Group assess whether a company’s creditworthiness assessment process meets applicable regulatory requirements, particularly those under Chapter 7 of the Consumer Protection Act (consumer credit) and the Consumer Credit Directive (CCD2). They also support the design, development, and implementation of processes where necessary. The assessment covers procedures, controls, and documentation related to creditworthiness evaluation (especially Section 14 of Chapter 7).
The review also examines terms and contractual documentation of existing credit arrangements and identifies potential update needs ahead of legislative changes entering into force on 20 November 2026 (national implementation of CCD2). At the same time, it ensures that governance documents, policies, and internal control arrangements are consistent and support compliant operations.
The review may also extend to marketing and sales channels to ensure compliance with consumer credit requirements (e.g. Chapter 7 Sections 8–13 of the Consumer Protection Act) and promote responsible lending practices. Additionally, procedures related to partners and third parties—especially credit intermediaries—are assessed considering applicable regulations.
Through this collaboration, companies receive a comprehensive assessment of the compliance and development needs of their creditworthiness and risk assessment models. The work helps prepare for regulatory changes, improves transparency and efficiency, and leverages NFR’s practical supervisory expertise.
Are your creditworthiness assessment processes ready for the 2026 regulatory changes? Contact us to ensure compliance.
