Distance Financial Services and the Withdrawal Button

Directive (EU) 2023/2673 of November 22, 2023 amends Directive 2011/83/EU as regards financial services contracts concluded at a distance and repeals Directive 2002/65/EC. This change of architecture is not a technical detail: distance financial contracting no longer has a directive of its own and is integrated into the general consumer rights legislation, as a special regime within it.

What matters for any project is the scope. It does not regulate a product; it regulates a channel. It applies to financial services contracts concluded at a distance, so it covers anyone who sells credit, but also anyone who sells insurance, investment services, payment accounts, e-money products or crypto-asset services, as long as the contract is concluded without the simultaneous physical presence of the parties. In practice, almost the entire sector.

And its approach differs from that of the sector-specific rules you probably already know. It is not concerned with the client’s creditworthiness or with the entity’s requirements: it is concerned with how the screen is built. What information appears and in what order, what can be hidden in a second layer, which design elements are prohibited as manipulative and how the client must be able to exit a contract they have already signed. That is why it is a law implemented by product and technology teams as much as by compliance.

It is worth pausing on what that combination means, because it is awkward and generates many questions. The directive has already applied since June 19, 2026, but Spain has not approved the law that incorporates it into domestic law. For an entity that contracts online, that is no excuse to do nothing: it is precisely a period in which it pays to get ahead of the work.

There are three practical reasons. First, the substantive content of the directive is already published and is not going to change: the withdrawal button, layered information and the ban on dark patterns are known obligations whose implementation takes months of development. Second, the Spanish transposition comes within the same draft bill as the consumer credit reform, whose provisions apply from November 20, 2026: if you wait, you will have both projects on your plate at once. And third, the interface is visible: none of this can be proven after the fact with a document, because any non-compliance is there for anyone who visits your website to see.

The directive inserts into Directive 2011/83/EU an Article 11a requiring traders that offer financial services contracts at a distance through an online interface to ensure that the consumer “can also withdraw from the contract by using a withdrawal function”. The word “also” matters: it does not replace the traditional channels; it is added to them.

The requirements of that function are strictly defined, and it is best to read them as a product specification:

• Unambiguous label. It must be labeled with the words “withdraw from contract here” or an equivalent, unambiguous wording.
• Permanence. It must be available throughout the withdrawal period, not only in the first few days or only if the client goes looking for it.
• Visibility. It must be prominently displayed and easily accessible.
• Complete statement. It must allow the consumer to complete the withdrawal statement with their identification details.
• Explicit confirmation. It requires express confirmation from the consumer; an accidental click is not enough.
• Acknowledgment of receipt. An acknowledgment of receipt must be generated on a durable medium and without delay.

The withdrawal period it refers to is fourteen calendar days as a general rule, and thirty for pension products. The fact that the function must remain live throughout that period forces an architecture decision that many teams have not made: where does the button live? In the client’s private area, in a link in the confirmation email, in both? And above all, how do you prove afterwards that it was available and visible for the full fourteen days?

That last question is what decides whether compliance is real or merely on paper. A button implemented without an availability log cannot be proven, and proof is exactly what you will need the day a client claims they tried to withdraw and could not.

Layering is a reasonable concession to the digital channel: nobody reads twelve screens of legal information on a phone. But it comes with two limits that are often overlooked.

The first is that the top layer has strictly defined content. You do not choose what goes at the top based on what suits you commercially: the five items in the table go in the first layer, and the total price is one of them. A design that shows the monthly installment at the top and the total cost two clicks further down reverses exactly what the law requires.

The second is the single document requirement: it must be possible to view, save and print all the information as one document. In other words, the information may be staged across the navigation, but there must also be a consolidated version that the consumer can take away. That deliverable is the one usually missing from implementations that stopped at the screen redesign.

The directive requires traders to provide “adequate explanations on the proposed financial services contracts”, so that the consumer can assess whether the contract is suited to their needs and financial situation. Those explanations cover the mandatory pre-contractual information, the essential characteristics of the contract and the specific effects that the proposed contract may have on the consumer, including the consequences of default.

And it comes with a rule worth highlighting, because it directly affects the design of digital channels: the consumer must always be able to obtain human intervention at the pre-contractual stage when the trader uses automated tools — chatbots, robo-advice and the like.

For a project built on the premise that the whole funnel is self-service, this is no minor adjustment. It requires an escalation path to a person before the contract is concluded, not just an after-sales service; it must be properly resourced; and it must be genuinely available, not hidden behind four menus. It is an obligation with an operational cost, and you should budget for it.

The rule also ties in with the one introduced by the Consumer Credit Directive for creditworthiness assessments, where the consumer has the right to human intervention, to a meaningful and comprehensible explanation and to request a review of the decision. These are two separate laws pointing in the same direction: automation must not leave the client without someone to talk to. You can see that other front in credit scoring and automated decisions.

The directive prohibits traders from “designing, organizing or operating their online interfaces in a way that deceives or manipulates consumers”, or that “materially distorts or impairs their ability to make free and informed decisions”. And it does not stop at the principle: it identifies specific practices.

• Giving more visual prominence to certain choices. The classic big green button to accept versus the small gray link to decline.
• Repeatedly requesting confirmation through pop-ups. Insisting until the user gives in, a technique known in the industry as nagging.
• Making the cancellation procedure more difficult than signing up. If signing up takes two clicks, canceling cannot take a form, a phone call and a three-day wait.

That third practice is the one most projects will need to review, and not by chance: it links directly to the Article 11a withdrawal button. The law attacks the same problem from two angles — requiring a visible exit and prohibiting making it difficult — which means that a button that is formally in place but buried in the navigation is a breach twice over.

A word of caution on method is also in order for product teams. Many of these patterns were not introduced in bad faith: they came out of A/B tests measuring conversion. The prohibition does not look at intent, so the review cannot be limited to what was designed on purpose: you have to look at the flow as it stands today, with all the optimizations accumulated over time.

The Spanish transposition does not come in a stand-alone law: it travels within the draft Consumer Credit Agreements Bill, whose third final provision transposes Directive (EU) 2023/2673 by amending the consolidated text of the General Law for the Defense of Consumers and Users, approved by Royal Legislative Decree 1/2007.

And the repealing provision of the same draft bill abolishes two laws: Law 16/2011 on Consumer Credit Agreements and the law on the distance marketing of financial services to consumers. In other words, the current regime for distance financial contracting disappears as a separate law and its content is integrated, in updated form, into the general consumer law.

For an entity, this has a practical consequence worth anticipating: manuals, general terms and conditions templates and legal references in your contracts that cite the distance marketing law will become obsolete overnight on the day the law is approved. It is best to have all those references located beforehand, not afterwards.

The combined timeline strengthens the case for not waiting. The distance financial services part has already applied since June 2026; the consumer credit part applies from November 20, 2026. Both arrive in the same law. Anyone who plans the two projects separately will end up competing with themselves for the same product and development teams. The full map is on the CCD2 page.