The new consumer credit law (transposing the CCD2 Directive) creates a reserved activity: only entities authorized and registered with the Bank of Spain will be able to lend professionally. We prepare your regulatory fit, your application and your product so you get there in time.
Free consultation
We reply within 24 h
The draft Consumer Credit Agreements Bill makes consumer lending a reserved activity: only authorized and registered entities will be able to grant consumer credit on a professional basis. Six workstreams to get there in time.
We analyze whether your model falls within the new consumer credit reserved activity or under an exemption (entities already supervised, ancillary credit by SMEs, smaller loans). The result drives everything else: a new authorization, an alternative license or only conduct adjustments.
We prepare the authorization and registration application envisaged in the draft bill: structure, governance, lending policies and evidence. The planned phased timeline (authorization 3 months after entry into force) leaves little room for improvisation.
We compare the future lender authorization with the routes that already exist (EFC, payment institution, bank) to choose the license type that best fits your model and your timeline.
We review pricing, APR (TAE), advertising, pre-contractual information and creditworthiness assessment against the current Consumer Credit Agreements Law (LCCC) and the envisaged caps (maximum APR, overdrafts, fee for claiming overdue amounts).
We design the conduct layer: adequate explanations, warnings in advertising, complaints handling and evidence of what was communicated, when and how.
From the application to day-to-day operations: documented creditworthiness assessments, reporting, training and monitoring of the legislative process so you can adapt to each milestone without surprises.
Lending fintechs, BNPL, microloans or merchants that finance their sales: the reserved activity does not treat everyone the same. Knowing where you stand is half the work.
“Today you lend without a specific license; under the new law you will need authorization and registration with the Bank of Spain. The planned timeline gives only 3 months from entry into force: the gap analysis cannot wait for the final law.”
“CCD2 brings BNPL within the scope of consumer credit. Except for very specific exceptions (smaller amounts, no cost, short terms), professional deferred payment becomes a regulated activity.”
“The draft bill creates a specific category with enhanced transparency and registration. It is not a ban: it is a regime of its own that you need to understand and document properly.”
“The draft bill provides for exemptions for SMEs whose lending is ancillary to their main activity. Confirming whether your financing fits the exemption saves you from building a structure you do not need.”
CCD2 applies from November 20, 2026, and the Spanish draft bill is going through the legislative process. If you wait for publication in the BOE, you will be late for the phased timeline.
A paradigm shift: today, granting consumer credit without taking deposits does not require a specific license in Spain. With the planned reserved activity, lending professionally without authorization will no longer be an option. It is the biggest change in the sector in 15 years.
The legislative status matters: the draft bill was approved in January 2026, and the figures (maximum APR, caps, deadlines) may be adjusted in Parliament (the Cortes). We monitor the legislation: each milestone in the process becomes concrete actions for your entity. (Page updated as of July 2026.)
Cost caps affect pricing: a maximum APR by segment set by regulation, a transitional limit of 22 points for open-ended credit, tacit overdrafts capped at 2.5 times the statutory interest rate and a limited fee for claiming overdue amounts. Your income statement is being designed now.
Granting consumer credit professionally without the envisaged authorization and registration will mean operating in a reserved activity, exposed to penalties and to having to cease the activity.
The draft bill provides for a phased entry into force: the authorization regime after 3 months; the rest of the obligations after 12. A serious application cannot be built in 3 months from scratch.
The Directive’s date of application is fixed even if Spain is late with transposition: advertising warnings, stricter creditworthiness assessments and new information obligations are coming no matter what.
A gap analysis now tells you whether you fall within the reserved activity, whether another license type suits you better and what is missing from your application. Arriving prepared for the phased timeline is much cheaper than rushing later.
It is the key new feature of the draft Consumer Credit Agreements Bill (which transposes the CCD2 Directive): only authorized and registered entities will be able to grant consumer credit on a professional basis in Spain, subject to registration with and supervision by the Bank of Spain.
Today, lending without taking deposits does not require a specific license. Under the new law, that era comes to an end: it is a paradigm shift for all non-bank credit.
According to the draft bill, non-bank lenders that grant consumer credit professionally will need it, including BNPL operators outside the exceptions and those lending into the Spanish market from other countries.
Entities that are already supervised (banks, financial credit establishments) will not need a new authorization, although they will have to adapt their products and conduct. An exemption for SMEs and micro-enterprises is also envisaged where the credit is ancillary to their main activity (a merchant that finances its own sales).
The CCD2 Directive applies from November 20, 2026. In Spain, the draft bill was approved in January 2026 and is still going through the legislative process (status reviewed in July 2026).
The text provides for a phased entry into force: the authorization regime 3 months after the law enters into force and the rest of the obligations after 12 months. That 3-month window is the reason to prepare the application before publication in the BOE.
The final detail will depend on the law and its implementing regulations, but the planned framework points to what is usual for supervised entities: registration with the Bank of Spain, adequate structure and governance, creditworthiness assessment procedures, transparency and information policies, and a stricter regime for high-cost lenders.
Our approach: build the evidence file on that framework now and adjust it as the legislative process settles the details.
CCD2 brings buy now, pay later within the scope of consumer credit. Only specific listed cases are excluded, such as very small loans (under €200), completely free credit or short deferrals (up to 3 months) with minimal costs.
Outside those exceptions, professional BNPL becomes a regulated activity: pre-contractual information, creditworthiness assessment and, under the draft bill, authorization and registration.
It is a specific category envisaged by the draft bill for operators that grant small, high-cost loans to consumers with limited access to traditional credit. They will be subject to special parameters: enhanced transparency, registration and a regime of limits of their own.
If your model may fall into this category, analyze it early: product design and marketing communications change substantially.
The draft bill provides for several limits, still to be confirmed during the legislative process:
In practice: product pricing needs to be stress-tested against these scenarios now.
Operating within a reserved activity without authorization exposes you to penalties, a cease-and-desist order and serious reputational and commercial damage: banks, payment institutions and investors will require registration as a condition for working with you.
In addition, your customer relationships will come under scrutiny: lacking authorization is ammunition in any consumer complaint.
No. As of July 2026, there is a draft bill (given first-round approval in January 2026, with the public consultation closed on January 30) and a draft implementing royal decree. The figures and deadlines cited on this page come from that text and may change during the parliamentary process. We update this page at each relevant milestone.
Yes. CCD2 requires Member States to subject credit intermediaries to an admission, registration and supervision process as well. If your business is intermediating, comparing or referring consumer credit—not granting it—you will have your own regime to comply with, and you should follow the legislative process just as closely.
To decide, no; to fine-tune the final details, yes. The planned 3-month window for the authorization regime makes it unfeasible to build governance, policies and evidence from scratch after publication in the BOE. The efficient approach is to run the gap analysis now and have the application 80% ready, leaving the remaining 20% dependent on the final text.
The financial credit establishment (EFC) is the classic route that already exists for lending with supervised-entity status. Those already operating as an EFC will not need the new authorization (they are already supervised), and new projects will need to compare both routes: scope of activities, requirements and timing. This is exactly the kind of fit decision we work on in the assessment phase.
No. Real estate credit has its own framework (Law 5/2019 and Directive 2014/17). The reserved activity we discuss here is the one for consumer credit. If your entity does both, it will have to comply with both regimes.
Alongside CCD2, Directive (EU) 2023/2673 on distance contracts for financial services applies from June 19, 2026: a withdrawal button in the interface, digital pre-contractual information and limits on dark patterns. If you grant credit online, your sign-up funnel must be reviewed against both laws at the same time.
The reserved activity does not treat all operators the same. This map summarizes the fit envisaged by the draft bill; the cost of preparing depends on your starting point.
No two entities are the same: the effort depends on the gap between how you operate today and what the law will require.
A phased method designed for the draft bill’s phased timeline: reach entry into force with the application 80% complete and close the remaining 20% with the final text.
| Operator | Will it need the new authorization? | What changes for it | Priority |
|---|---|---|---|
| Non-bank lender (fintech lending) | Yes: authorization and registration with the Bank of Spain | Everything: authorization, governance, creditworthiness, caps and conduct | Highest |
| BNPL platform | Yes, unless an exception applies (amounts <€200, free credit, deferral ≤3 months with minimal cost) | Enters the CCD2 scope: information, creditworthiness and authorization | Highest |
| High-cost lender | Yes, with a stricter regime of its own | Enhanced transparency and registration; special cost parameters | Highest |
| Bank or EFC already authorized | No (already supervised) | Product and conduct adaptation: advertising, creditworthiness, caps, information | High |
| Merchant that finances its sales (SME) | Likely exempt if the credit is ancillary to its main activity | Check whether it fits the exemption and document it | Medium |
| Credit intermediary / comparison site | Its own admission and registration regime (CCD2) | Entry in the intermediaries register and information obligations | High |
Indicative map based on the January 2026 draft bill and Directive (EU) 2023/2225; the final fit will depend on the final text of the law and its implementing regulations. Reviewed in July 2026.
The competitive advantage will not be having the authorization—everyone who survives will have it—but obtaining it without stopping the business. That is decided in the months before, not after the BOE.
Fit within the reserved activity, applicable exemptions and comparison of routes (new authorization vs. EFC or another license type). With 80% of the regime already visible in the draft bill, waiting adds no information: it only takes away time.
Governance, lending and creditworthiness policies, transparency, advertising with warnings and pricing stress-tested against the caps. All documented and ready to adjust to the final text.
Filing with the Bank of Spain as soon as the window opens, responding to requests for information and launching ongoing compliance: documented creditworthiness assessments, complaints and reporting.
The starting point is the Consumer Credit Directive (CCD2) and your current compliance with the LCCC: whatever you have properly in place today is an advantage tomorrow.
The transition to the new regime is a project with four stages: fit, route, application and product adaptation. Those who go through them in order reach registration with their business intact; those who improvise have to halt origination.
1) FitThe first question is not “what do they require of me” but “who am I” under the new law. The whole plan follows from that.
2) RouteFor new or growing projects, comparing the future authorization with the classic routes avoids building twice.
3) ApplicationThe application is built on what financial conduct rules already require: proving what you do, how and with what controls.
4) ProductCost caps, advertising warnings, stricter creditworthiness assessments and the online withdrawal button are not paperwork: they redefine pricing, conversion and funnel design. Stress-testing them now avoids discovering in 2027 that the product does not pay off.
Quick decisionReserved activity: authorization and registration with the Bank of Spain. Gap analysis now.
In scope unless a listed exception applies. Review each product against the excluded cases.
No new authorization, but full adaptation of product, advertising and creditworthiness assessment.
A reasoned analysis of whether the activity falls within the reserved activity, an exemption or the regime for entities already supervised.
Fit report against the draft bill and CCD2, and a documented route decision.
Structure, responsible persons and controls proportionate to the lending activity, ready for registration.
Organization chart, appointments, internal policies and approval minutes.
Creditworthiness assessment with relevant data, a documented procedure and traceable decisions, in line with CCD2.
Lending policy, creditworthiness files and a log of automated decisions.
Pricing compatible with the maximum APR, the transitional cap, overdrafts and limited fees; product catalog reviewed.
Portfolio simulations, product sheets and product committee minutes.
Advertising with warnings, Standard European Consumer Credit Information and distance contracting in line with Directive 2023/2673.
Validated advertising materials, information templates and an online flow with a working withdrawal option.
We are already seeing them in the market. None of them is unavoidable.
If you grant consumer credit—or plan to—these terms will shape your next two years: they appear in the draft bill, in CCD2 and in your dealings with the Bank of Spain.
Core principle of the draft bill: professional consumer lending is reserved to authorized and registered entities, under Bank of Spain supervision.
Operators that grant credit without being a bank or an EFC: lending fintechs, consumer finance platforms, BNPL. No specific license today; tomorrow, within the reserved activity.
A category envisaged for small-amount, high-cost loans: enhanced transparency and registration and special parameters, outside the general caps but with a regime of its own.
Deferred payment comes within the CCD2 scope. Only listed cases are left out: amounts under €200, free credit or deferrals of up to 3 months with minimal costs.
The draft bill provides for a maximum APR by type of credit, set by regulation, with a transitional cap of 22 points for open-ended credit until those regulations are adopted.
The standardized pre-contractual form for consumer credit, strengthened by CCD2: what is disclosed, when and how, with evidence of delivery and understanding.
An obligation strengthened by CCD2: assess repayment capacity with relevant and proportionate data, document the procedure and be accountable for automated decisions.
The gateway to the market: registration of authorized lenders, conduct supervision and the penalty regime tied to the reserved activity.
The draft bill provides for different deadlines: the authorization regime 3 months after entry into force and the rest of the obligations after 12. The preparation strategy is designed around that clock.
Download our checklist to position your entity before deciding: license types available before the supervisor, requirements and safeguards compared, stages of the application and common mistakes that delay authorization.
Tell us about your project and we will explain how to prepare your consumer credit lender authorization and be ready in time for the new regime.
Directive (EU) 2023/2225 (CCD2) replaces the 2008 Directive and applies from November 20, 2026. Spain is transposing it through the draft Consumer Credit Agreements Bill (January 2026, still going through the legislative process), which will replace the current Law 16/2011 and introduces the deepest change in the sector: a reserved activity, with authorization and registration with the Bank of Spain, for anyone who grants consumer credit on a professional basis.
The planned regime covers non-bank lenders—lending fintechs, consumer finance platforms and BNPL operators outside the exceptions—including cross-border lending into Spain. Entities that are already supervised (banks and financial credit establishments) do not need a new authorization, although they do need to fully adapt their products and conduct; and an exemption is envisaged for SMEs and micro-enterprises whose lending is ancillary to their main activity. CCD2 also requires an admission and registration regime for credit intermediaries.
The draft bill provides for a maximum APR by credit segment set by implementing regulations, a transitional limit of 22 points of interest for open-ended credit, a cap of 2.5 times the statutory interest rate for tacit overdrafts and a limit on the fee for claiming overdue amounts. High-cost lenders will have special parameters and enhanced transparency. All these figures come from a text still going through the legislative process and may be adjusted before final approval.
The Directive sets November 20, 2026 as its date of application. The draft bill provides for a phased entry into force: the authorization regime 3 months after the law enters into force; the rest of the obligations after 12 months. In parallel, Directive (EU) 2023/2673 on distance contracts for financial services has already applied since June 19, 2026 and has a direct impact on online credit sales.
With 80% of the regime visible, the efficient strategy is to get ahead: analysis of fit and exemptions, choice of route (new authorization or existing license type), building the governance and creditworthiness application, and stress-testing pricing against the caps. This page is reviewed at each milestone of the legislative process (last review: July 2026).