Granting credit without sufficient prior analysis is no longer just a commercial risk: it is a breach with contractual, administrative and reputational consequences. We design, audit and document your institution’s creditworthiness assessment procedure, including automated models.
Review of your procedure
We reply in less than 24 h
Six workstreams so that creditworthiness analysis stops being a box-ticking step in the onboarding form and becomes a procedure you can defend before the supervisor, before a judge and before the customer.
We define what information is requested, how it is verified, which thresholds trigger a rejection and how each decision is documented. The result is a written procedure, approved by the management body and traceable transaction by transaction.
Systems that assess the creditworthiness of natural persons are classified as high-risk under the EU Artificial Intelligence Act. We review model governance, technical documentation, bias, explainability and the customer’s right to human intervention.
CIRBE checks, credit bureau files, data provided by the customer and income verification: what can be consulted, on what legal basis and how long the evidence is kept.
For credit lines and cards, the assessment does not end with the initial approval. We design the limit review cycle, alerts when the customer’s profile deteriorates and the criteria for not increasing available credit.
The file is the only thing that exists when a complaint arrives three years later. We define what is kept, in what format, with what timestamping and how it is retrieved to respond to a request for information.
Support with complaints before the customer service department, before the Bank of Spain and in court when the dispute is whether a sufficient creditworthiness analysis was carried out before the credit was granted.
The obligation to analyze the customer’s ability to repay is common to all lenders, but how it is met changes radically depending on the channel, the average amount and the decision speed of the product.
"Credit institutions and financial credit establishments have had written lending policies for years. The challenge is not having them: it is proving that the analyst followed them in the specific transaction now in dispute."
"Approving a loan in ninety seconds is compatible with a sufficient analysis, but it requires the model to be documented and each decision to leave a record of the variables that determined it. Speed does not exempt you from keeping the file."
"The argument that the amount is small no longer works. When the same customer builds up several simultaneous transactions at different merchants, the aggregate risk is no longer small and the analysis has to capture it."
"A comparison site or an agent is not required to assess creditworthiness, but it is required to pass on truthful and complete information. An application filled in badly at source contaminates the lender’s analysis and ends up being a problem for both."
A defensible procedure always goes through the same five stages. Skipping one is what turns a solid file into a file open to challenge.
Income, recurring expenses, existing financial commitments and employment situation. The level of detail should scale with the amount and the term: a microloan does not call for the same as a five-year transaction, but neither allows for gaps.
The customer’s statement is not enough on its own. Checks of the Bank of Spain Central Credit Register (CIRBE) and of credit bureau files and, where appropriate, verification through documents or account aggregation services.
Debt-to-income ratio, disposable income after meeting other commitments and a reasonable stress scenario. If the model is automated, this is where the score and the variables that weighed most in it must be recorded.
The decision must be consistent with the outcome of the analysis. Approving despite an unfavorable result requires an exceptional, documented rationale: this is where most successful complaints are concentrated.
Archiving the evidence for the applicable period and being able to explain to the applicant the reasons for a rejection, especially when it was based on automated processing of their data.
The consequence does not arrive on the day the credit is granted: it arrives two or three years later, when the customer defaults and someone asks what was checked before signing.
Losing the lawsuit for lack of a file: in a claim for non-payment, the absence of documentation on the prior analysis seriously weakens the lender’s position and may lead to a reduction of interest or the partial dismissal of the claim.
Complaints to the customer service department and the supervisor: a pattern of approvals without sufficient analysis is easy to detect through sampling and turns an individual problem into supervisory action across the whole portfolio.
Liability for irresponsible lending: granting credit to someone who foreseeably cannot repay it creates liability toward the customer and, in personal insolvency proceedings, affects how the claim is treated.
Rejecting an application through an automated system without providing meaningful information about the logic involved or the possibility of human intervention exposes the institution to complaints before the data protection authority.
Systems that assess the creditworthiness of natural persons are classified as high-risk under the EU Artificial Intelligence Act, with obligations on risk management, technical documentation, human oversight and record-keeping.
A poorly calibrated lending criterion does not produce a one-off failure: it produces an entire cohort of transactions with the same weakness, which surfaces all at once when the cycle turns.
We review your lending procedure, your data sources and your decision models, and deliver a report setting out the points that would not withstand a complaint or supervisory action.
It is the analysis the lender must carry out, before granting the credit, of the consumer’s ability to meet the obligations they are about to take on. It is not an estimate of the institution’s risk: it is an assessment of whether the customer can pay without compromising their financial situation.
That difference matters. A transaction can be profitable for the lender even with high default rates and still breach the duty to analyze, because the law protects the consumer, not the margin.
The general duty to assess creditworthiness is laid down in Law 16/2011 on Consumer Credit Agreements, and is supplemented by the Bank of Spain’s transparency and responsible lending rules. Real estate credit has its own regime under Law 5/2019.
Two further layers sit on top of that base: data protection, when credit files are consulted or automated models are used, and the new EU Consumer Credit Directive, which strengthens the criteria and how they are documented.
The law requires information that is sufficient and proportionate to the amount and the term. In practice, a complete file usually includes:
No. The applicant’s statement is the starting point, but the lender must cross-check it against independent sources to the extent warranted by the risk of the transaction. A file built solely on self-declaration is the weakest possible position if the transaction ends in a complaint.
The opposite extreme does not work either: asking for disproportionate documentation for a small amount creates commercial friction without adding any real evidentiary value.
When the decision is based solely on automated processing and produces legal effects for the applicant, the safeguards of the General Data Protection Regulation apply: the right to obtain human intervention, to express one’s point of view and to contest the decision.
On top of that comes the EU Artificial Intelligence Act, which classifies systems that assess the creditworthiness of natural persons as high-risk systems, with obligations on risk management, data quality, technical documentation, event logging and effective human oversight. We cover this on our page on the AI Act.
It depends on the product. In a loan with fixed installments and a fixed term, the assessment ends at approval. In revolving credit products (cards and credit lines), the available balance is replenished and the risk changes over time, so the initial analysis stops being representative.
That is why it is advisable to define a limit review cycle, deterioration alerts and express criteria for not increasing available credit. We cover this in detail on our revolving credit page.
The prudent approach is to keep the file for as long as the transaction is outstanding and throughout the limitation period for any claims that may arise from it, aligning it with the retention periods the institution already applies for anti-money laundering purposes.
More important than the period is retrievability: an archive that exists but cannot be reconstructed transaction by transaction within a reasonable time is of no use in responding to a request for information.
A solid lending procedure rests on three pillars: written rules, verified data and retrievable evidence. Without all three, the analysis exists in practice but cannot be proven, which in legal terms is almost the same as not existing.
Debt-to-income thresholds, maximum amounts by profile, automatic rejection criteria and an exceptions regime stating who may authorize them. Approved by the management body and reviewed at least once a year.
Every check of an external file needs a lawful basis and an audit trail. Document which sources are consulted for each type of transaction, how often, and what happens when the information obtained contradicts what the customer declared.
Years later, the file must make it possible to answer three questions: what data was on hand, which rule was applied and who made the decision. If the system does not keep the version of the model in force on that date, the key piece is missing.
If you need to review your institution’s lending procedure, see our fintech regulation services or request a free consultation.
The obligation is stated in one line and carried out through dozens of product, data and technology decisions. These blocks summarize what you need to have in place: information sources, decision model, traceability, applicant rights and allocation by type of entity.
1) SourcesThe usual mix combines declared information, credit bureau files and the supervisor’s central credit register. Each source provides a different piece and none replaces the others.
2) ModelIt does not matter whether the rule is a spreadsheet or a neural network: it must be described, versioned and explainable to a third party who did not build it. Without versioning, reconstructing a decision later is impossible.
3) TraceabilityThe file is the only defense available when the transaction is disputed. It must keep the input data, the result, the model version and the identity of whoever decided or validated.
4) Automated decisionDeciding by algorithm is perfectly legitimate and, done well, more consistent than case-by-case human decisions. What is not optional are the safeguards that come with it: meaningful information about the logic involved, the right to human intervention, the possibility to contest and periodic checks that the system does not discriminate. On top of that comes the high-risk regime of the EU Artificial Intelligence Act for systems that assess the creditworthiness of natural persons.
Obligations mapIts own, non-delegable duty to assess, document and retain. It is answerable for the decision even if the analysis is carried out by a third party.
Answerable for the quality, documentation and explainability of the system it supplies, and must allow the lender to audit it.
Does not assess, but must collect and pass on truthful and complete information. An application inflated at source contaminates the whole analysis.
The analyst records in writing the criterion applied. The risk lies in inconsistency between analysts and in one-line rationales.
The rationale is the rule itself. It requires storing the model version and the decisive variables alongside each result.
Variable by definition. Requires training, periodic calibration and sample-based review of the decisions made.
High by design, but a design error spreads across the entire portfolio at once instead of appearing case by case.
The right to know the reasons for the rejection in understandable terms and to provide additional information.
Enhanced safeguards are added: information about the logic involved, human intervention and the possibility of contesting the decision.
Lending policy, delegated authorities and exceptions log approved by the management body.
All of the above plus risk management of the system, data quality, technical documentation and effective human oversight.
Sample-based file review and comparison with the policy in force on the transaction date.
Independent model validation, bias testing by group and traceability of retraining.
If you recognize any of these situations in your operations, your creditworthiness analysis would probably not withstand a well-argued complaint or a portfolio review.
Terms that come up constantly in lending policies, in supervisory requests for information and in customer complaints. Your sales and risk teams should use them with the same meaning.
The applicant’s ability to meet the credit installments from their disposable income, after deducting their recurring expenses and existing financial commitments.
The Bank of Spain database that records the risks reporting institutions hold with their customers. It is the reference source for finding out an applicant’s aggregate indebtedness.
A numerical result summarizing the estimated risk of an application based on a set of variables. It can be built with classic statistical rules or with machine learning techniques.
The share of the applicant’s income used to pay their financial commitments. It is the most widely used indicator for setting lending thresholds, although it should never be the only criterion.
Files that record information on failures to meet monetary obligations. Checking them and being listed in them are subject to strict requirements of accuracy, prior notice and maximum time limits.
A decision taken without meaningful human involvement that produces legal effects for the data subject. It triggers specific safeguards on information, human intervention and the right to contest.
An approval that departs from the established thresholds and requires express authorization from someone with the power to grant it. The volume of exceptions is a direct indicator of the health of the procedure.
Periodic analysis required for products whose available balance is replenished or whose limit can be increased. The initial assessment stops being representative as the customer’s situation changes.
The body of evidence that makes it possible to reconstruct, years later, what information was on hand, which rule was applied and who decided. It is the only defense available when the transaction is disputed.
REGULATORY CONTROL CENTER · REPAYMENT CAPACITY AND RESPONSIBLE LENDING
The duty to assess is the same, but its intensity must be proportionate to the amount, the term and the reversibility of the transaction. This panel summarizes where the procedure should be strengthened and where excessive requirements only add friction.
An indicative reference for calibrating the lending policy: what depth of analysis suits each combination of product and control.
Tell us what product you offer and how you decide, and we will tell you which parts of your procedure would withstand a complaint and which would not.
The duty to analyze a consumer’s repayment capacity before granting credit does not come from a single law, but from the overlap of three frameworks that have been piling up over the last fifteen years: transparency and banking customer protection, data protection and, more recently, artificial intelligence. Understanding how they fit together is what separates a formally correct procedure from a truly defensible one.
Under Spanish law, the obligation to assess consumer creditworthiness is laid down in Law 16/2011 on Consumer Credit Agreements, and is developed through the transparency rules and the responsible lending practices supervised by the Bank of Spain. Real estate credit has a parallel and stricter regime under Law 5/2019. The EU consumer credit reform strengthens these criteria, broadens the sources that must be consulted and, for the first time, expressly regulates the use of automated models.
Checking credit bureau files, the supervisor’s central credit register or account transactions through aggregation services are all processing of personal data that require a legal basis, information to the data subject and defined retention periods. When a rejection is based solely on automated processing, the applicant has the right to obtain human intervention, to express their point of view and to contest the decision: three safeguards that many institutions have not built into their real customer service workflow.
Systems intended to evaluate the creditworthiness of natural persons or establish their credit score are classified as high-risk systems. This entails obligations on risk management, governance of training data, technical documentation, event logging, transparency toward users, effective human oversight and appropriate levels of accuracy and robustness. For a lending fintech, this layer usually takes the most effort to implement, because it requires documenting what until now was the data team’s tacit knowledge.
In our experience, the problem rarely lies in the absence of a lending policy: it lies in the gap between the written policy and what the system does in production, and in the inability to reconstruct after the fact which version of the model was in force on the day of the transaction. When the complaint arrives, the institution has the policy and has the result, but cannot connect the two. That gap is what we work on first.
Key legislation, linked to the official text:
Legislation and links reviewed in .