Fintech lending
Digital lending platforms
"The challenge is to combine digital agility with regulatory compliance: registration, online transparency, automated AI scoring and AML/CFT adapted to the digital channel."
Consumer Credit Compliance for Businesses in Spain: The Regulatory Framework
We advise consumer credit businesses across the whole regulatory cycle: licensing, pre-contractual transparency, APR (TAE), creditworthiness assessment, AML/CFT, debt collection and Bank of Spain supervision.
Free consumer credit consultation
We reply within 24 h
- Withdrawal period
- 14 days
- Key legislation
- Law 16/2011
- New directive (CCD2)
- Dir. 2023/2225
Services
What your consumer credit business needs
Six key areas for operating as a consumer credit business with legal certainty and regulatory compliance.
License
Registration and authorization as a lender
Analysis of the authorization and registration regime before the Bank of Spain or the competent regional authority. Requirements on capital, good repute, governance and documentation.
Learn more →
Bank of SpainRegistrationCapitalGovernance
AML/CFT
Anti-money laundering
Consumer credit businesses are obliged entities: KYC, transaction monitoring, AML manual, internal control body (OCI), training and audits tailored to the sector.
Learn more →
KYCMonitoringSEPBLACObliged entity
Transparency
Pre-contractual and contractual information
Mandatory documentation: FEIN/FIAE, APR (TAE), amortization schedule, right of withdrawal, general terms and conditions and transparency clauses.
Coming soon
FEINAPRWithdrawal
Creditworthiness
Creditworthiness assessment and scoring
The obligation to assess the consumer’s ability to repay before granting credit. Scoring models, data sources and documentation of the process.
Coming soon
ScoringCIRBE
Compliance
Regulatory compliance and complaints
Customer service department, complaints handling, a responsible debt collection protocol and compliance with consumer protection rules.
Learn more →
SACCollections
CCD2
Adapting to the new CCD2 Directive
The new Consumer Credit Directive (CCD2) brings changes to transparency, advertising, AI-based scoring, interest rate caps and digital loans.
Coming soon
Directive 2023/2225Digital
Profiles
Every consumer credit business has its own challenges
Lending fintechs, financial institutions, BNPL platforms or microcredit companies: the regulatory framework varies with the business model.
BNPL
Buy now, pay later
"The BNPL model falls squarely within consumer credit regulation under CCD2: creditworthiness assessment, transparency and limits on advertising."
Microcredit
Small-value loans
"Microcredit is in the regulator’s spotlight: high APRs, aggressive collection practices and enhanced protection for vulnerable consumers."
Traditional institutions
Consumer finance companies and credit establishments
"Established institutions must adapt to CCD2, review their contracts, update their pre-contractual information and strengthen their customer service department (SAC)."
Risks
What happens if you breach consumer credit rules?
Non-compliance can lead to clauses being declared void, Bank of Spain penalties, mass claims and reputational damage.
Unfair terms declared void: courts can declare void any interest, fee or penalty clauses that do not meet the requirements of transparency and fairness.
Bank of Spain penalties: supervised entities that breach transparency, creditworthiness or conduct rules may face serious administrative penalties.
Mass claims: a lack of transparency on APR, fees or tied insurance leads to collective claims that affect operations and reputation.
APR
Usury and nullity
If the APR is deemed usurious (Supreme Court case law), the agreement may be declared void and the interest refunded to the consumer.
AML/CFT
Obliged entity
Consumer credit businesses are AML/CFT obliged entities. Non-compliance can lead to penalties of up to €10 million.
CCD2
New regulation
The new directive extends the obligations: responsible advertising, cost caps, explainable AI scoring and protection of vulnerable consumers.
Is your consumer credit business compliant?
We review your business model, contracts, transparency, scoring, AML/CFT and readiness for CCD2. A complete analysis so you can operate with legal certainty.
Frequently asked questions
Consumer credit businesses: common questions
What is a consumer credit business?
A consumer credit business is any entity that grants loans or financing to individuals for purposes outside their business or profession. This includes traditional consumer finance companies, lending fintechs, BNPL (buy now, pay later) platforms and microcredit companies.
They are governed by Law 16/2011 on Consumer Credit Agreements (which transposed the CCD), the Bank of Spain’s transparency rules and, as obliged entities, Law 10/2010 on AML/CFT.
Do I need a license to grant consumer credit?
It depends on the type of entity and the volume of activity. In Spain, financial credit establishments (EFCs) need authorization from the Bank of Spain. Other entities may need to register in regional registers or meet specific requirements, depending on the autonomous community.
With the transposition of CCD2, the authorization and supervision regime is expected to be harmonized for all lenders, including digital lenders.
What pre-contractual information must I give the consumer?
Pre-contractual transparency obligations
- Standard European Information (FEIN/SECCI) setting out the credit terms.
- APR (TAE, annual percentage rate) calculated using the statutory formula.
- Total amount of credit and total cost to the consumer.
- Amortization schedule with a breakdown of principal and interest.
- Right of withdrawal (14 days) and early repayment terms.
- Information on any tied or bundled insurance.
What is a creditworthiness assessment and why is it mandatory?
The creditworthiness assessment is the lender’s obligation to check that the consumer is able to repay before granting the credit. Failing to do so can lead to the agreement being declared void and to liability for the lender.
CCD2 strengthens this obligation: it requires verifiable data sources, prohibits granting credit if the assessment is negative and, where AI scoring models are used, requires the lender to explain to the consumer the factors that influenced the decision.
What changes with the new CCD2 Directive?
Main changes in CCD2 (Directive 2023/2225)
- Wider scope: it covers credit of any amount and BNPL.
- Responsible advertising: stricter requirements and mandatory warnings.
- Caps on the total cost of credit (at national level).
- Stronger creditworthiness assessment, with obligations on AI and explainability.
- Specific protection for vulnerable consumers.
- Right of withdrawal kept (14 days) and early repayment made easier.
- Supervision and penalties harmonized at EU level.
How does usury affect my credit business?
Spanish Supreme Court case law has established that a consumer loan can be declared usurious when its APR significantly exceeds the market average for similar products. The consequence is that the agreement is void: the consumer only repays the principal borrowed, without interest or fees.
Consumer credit businesses must make sure their interest rates are proportionate and document the economic rationale for the APR they apply.
Are consumer credit businesses AML obliged entities?
Yes. Entities that grant consumer credit are obliged entities under Law 10/2010 on the prevention of money laundering. They must implement a complete AML/CFT system: KYC, monitoring, an AML manual, training, an internal control body (OCI) and audits.
Breaching these obligations can lead to penalties of up to €10 million or 10% of own funds.
What are my obligations on debt collection?
Debt collection practices are regulated and supervised. Consumer credit businesses must apply a responsible collection protocol:
- Do not make calls at inappropriate times or too often.
- Do not use intimidating, misleading or disproportionate practices.
- Inform consumers of their rights and of the restructuring options.
- Document every collection action for traceability.
- Comply with data protection rules (GDPR) throughout the process.
Operational guide
A practical guide for consumer credit businesses
Operating as a consumer credit business means complying with a broad regulatory framework: from authorization to handling defaults, including transparency, creditworthiness and AML/CFT.
Registration and entry requirements
Registration in the Bank of Spain register (EFC) or in the regional register. Requirements on capital, good repute of directors, organizational structure and business plan.
Clear and complete information
The consumer must receive all relevant information before signing: APR, total cost, repayment terms, insurance, right of withdrawal and the consequences of non-payment.
Responsible lending and collection practices
Creditworthiness assessment before lending, non-misleading advertising, responsible collection and accessible customer service. CCD2 raises the required standard of conduct.
Checklist: 10 steps to operate as a consumer credit business
- Determine the type of entity and the applicable authorization regime (EFC, regional register, etc.).
- Obtain the authorization or registration and meet the capital and governance requirements.
- Implement the AML/CFT system: KYC, monitoring, manual, training and internal control body (OCI).
- Design the pre-contractual documentation: FEIN/SECCI, APR, amortization schedule, right of withdrawal.
- Set up a documented and traceable creditworthiness assessment process.
- Review your scoring models: if they use AI, ensure explainability and non-discrimination.
- Draft contracts with clear, balanced clauses that comply with consumer protection law.
- Set up the customer service department (SAC) and the complaints protocol.
- Implement a responsible collection protocol that complies with current rules.
- Plan your adaptation to CCD2: new obligations on advertising, creditworthiness and protection of vulnerable consumers.
If you need regulatory advice for your consumer credit business, see our fintech regulation services or request a free consultation.
Consumer credit in detail
The regulatory anatomy of a consumer credit business
A consumer credit business must manage all of these at once: authorization, transparency, creditworthiness, AML/CFT, conduct and complaints. These are the building blocks we review.
1) AccessLender authorization and registration
The first step is to determine the applicable regime: EFC, regional register or EU passport. Each option has different capital, governance and supervision requirements.
- Type of entity and register
- Minimum capital and solvency
- Good repute and governance
2) TransparencyPre-contractual and contractual information
FEIN/SECCI, APR, total cost, amortization schedule, tied insurance, right of withdrawal. A lack of transparency is the leading cause of litigation.
- Standardized FEIN / SECCI
- APR using the statutory formula
- Right of withdrawal (14 days)
3) CreditworthinessCreditworthiness assessment and scoring
Check the ability to repay before granting the credit. Data sources, CIRBE, scoring models and, under CCD2, explainability of automated decisions.
- Duty to assess before lending
- Explainable AI scoring
- Process documentation
4) ComplianceAML/CFT, customer service and responsible collection
A complete AML/CFT system (as an obliged entity), a customer service department, a complaints protocol and responsible, documented collection practices.
Tip: aggressive debt collection is the main source of penalties and reputational damage in the consumer credit sector.
By modelRegulation by credit model
Personal loan
Law 16/2011 + transparency + creditworthiness assessment + AML/CFT.
BNPL
Covered by CCD2 + transparency at checkout + mandatory scoring.
Microcredit
Usury control + proportionate APR + responsible collection + enhanced AML.
Consumer credit playbook
Key obligations by regulatory area
Authorization
Registration with the Bank of Spain or a regional authority. Minimum capital, governance, business plan.
Registration decision, bylaws, minutes of appointment, capital certificates.
Transparency
FEIN/SECCI, APR, total cost, right of withdrawal, information on tied insurance.
Pre-contractual documentation templates, standard contracts, evidence of delivery to the consumer.
Creditworthiness
Assess the ability to repay before lending. Do not lend if the assessment is negative.
Creditworthiness report, sources consulted (CIRBE, credit bureaus), documented scoring criteria.
AML/CFT
KYC, monitoring, AML manual, training, internal control body (OCI) and audits as an obliged entity.
KYC files, alerts, OCI minutes, training records, audit reports.
Conduct / Collections
Non-misleading advertising, responsible collection, accessible customer service and a complaints protocol.
Collection protocol, complaints log, customer service reports, advertising records.
Regulatory red flags in consumer credit
If you spot any of these situations, act before they turn into a problem.
- An APR significantly above the market average with no documented justification.
- Credit granted with no prior creditworthiness assessment, or only a superficial one.
- Collection practices involving calls at inappropriate times or intimidating language.
- Pre-contractual information that is incomplete or not provided sufficiently in advance.
- No AML/CFT system, or a generic system not tailored to the business model.
Glossary
Key consumer credit concepts
If you run a consumer credit business, these terms come up in contracts, inspections and day-to-day operations.
APRCost
Annual Percentage Rate (TAE)
An indicator of the total cost of credit to the consumer, expressed as an annual percentage. It includes interest, fees and charges. Its calculation follows a statutory formula.
Key point: it must appear in all advertising and pre-contractual documentation.
CCD2Directive
Consumer Credit Directive 2
The new EU consumer credit directive (2023/2225). It widens the scope, strengthens transparency, regulates BNPL and requires explainability in AI scoring.
Estimated transposition: 2025–2026.
FEIN / SECCITransparency
European Standardized Information Sheet
A standardized document that sets out the credit terms in a clear and comparable way. Mandatory before the agreement is signed.
Contents: amount, APR, installments, total cost, right of withdrawal.
ScoringCreditworthiness
Credit assessment model
An automated or semi-automated system that assesses the applicant’s probability of default. Under CCD2, AI-based models must be explainable and non-discriminatory.
Sources: CIRBE, credit bureaus, applicant data.
BNPLModel
Buy now, pay later
A short-term financing model that lets consumers defer payment for a purchase in installments, usually interest-free. Regulated as consumer credit under CCD2.
Impact: creditworthiness assessment required even for small amounts.
UsuryRisk
Disproportionate interest
When the APR of a credit significantly exceeds the market average for similar products, the credit can be declared usurious and the agreement wholly void (1908 Usury Act, Ley de Represión de la Usura).
Consequence: the consumer only repays the principal, without interest.
EFCEntity
Financial Credit Establishment
An entity authorized by the Bank of Spain to grant credit on a professional basis. Subject to prudential supervision, AML/CFT and transparency rules.
Regime: Law 5/2015 and Royal Decree 309/2020.
SACConduct
Customer Service Department
A mandatory department for handling consumer complaints. It must resolve them within the statutory deadlines and document every action.
Mandatory for EFCs and supervised entities.
CIRBEData
Central Credit Register
The Bank of Spain database with information on the credit risks of individuals and companies. A key source for assessing consumer creditworthiness.
Consultation required for significant transactions.
CONSUMER CREDIT COMPLIANCE CONSOLE
Regulatory dashboard: consumer credit businesses
A consumer credit business must comply simultaneously with rules on authorization, transparency, creditworthiness, AML/CFT and conduct. This dashboard sums up the level of requirements by business model.
Regulatory requirements by consumer credit model
The level of supervision and obligations varies with the type of product and the profile of the entity.
Area
Personal loan
BNPL
Microcredit
Authorization
HighEFC / register
MediumNew under CCD2
MediumRegional register
Transparency
HighFEIN + APR
MediumCheckout info
HighAPR + usury
Usury risk
LowMarket APR
LowInterest-free
HighHigh APR
Contact
Book a call
Tell us about your business model and we will explain what you need to operate as a consumer credit business in full compliance.
Consumer credit businesses: the legal framework in Spain and Europe
Consumer credit businesses operate in an increasingly demanding regulatory environment. In Spain, the framework rests on Law 16/2011 of June 24 on Consumer Credit Agreements (which transposed Directive 2008/48/EC), the prudential rules for financial credit establishments (Law 5/2015 and Royal Decree 309/2020), supervision by the Bank of Spain and Law 10/2010 on the prevention of money laundering.
Law 16/2011: obligations for the lender
The Consumer Credit Agreements Law sets out the lender’s core obligations: standardized pre-contractual information (FEIN/SECCI), calculation and disclosure of the APR, assessment of the consumer’s creditworthiness, a 14-day right of withdrawal, early repayment terms and the liability regime. Breaching them can lead to clauses being declared void, administrative penalties and civil liability.
The new CCD2 Directive (2023/2225)
Directive 2023/2225 (CCD2, or Consumer Credit Directive 2) is the biggest reform of consumer credit in Europe since 2008. It widens the scope (it includes BNPL and credit with no amount limit), strengthens creditworthiness assessment (with specific obligations on AI and explainability), introduces caps on the total cost of credit, regulates credit advertising and sets out specific protections for vulnerable consumers. Member States must transpose it between 2025 and 2026.
Supervision and penalty regime
Consumer credit businesses are supervised by the Bank of Spain (in the case of EFCs and credit institutions) and by the regional authorities (for lenders registered at regional level). The penalty regime provides for fines, public reprimands and, in the most serious cases, withdrawal of the authorization. In addition, as AML/CFT obliged entities, penalties for non-compliance can reach €10 million.
Usury and Supreme Court case law
The 1908 Usury Act (Ley de Represión de la Usura) is still in force, and the Supreme Court has repeatedly applied it to consumer credit. When the APR of a revolving credit or a personal loan is markedly above the market average for similar products, the agreement can be declared void as usurious, and the lender must refund all the interest it has charged. Consumer credit businesses must keep their interest rates under constant review and document the economic rationale for the APR they apply.
Related services
Financial regulation
Resources and blog
Official sources
Key legislation, linked to the official text:
- Law 16/2011 of June 24 on Consumer Credit AgreementsBOE · consolidated text
- Law 10/2010 of April 28 on the Prevention of Money Laundering and Terrorist FinancingBOE · consolidated text
- Law 5/2015 of April 27 on the Promotion of Business FinancingBOE · consolidated text
Legislation and links reviewed in .