The new consumer credit framework in Spain: from Law 16/2011 to the CCD2
Consumer credit in Spain is currently governed by Law 16/2011 of June 24 on Consumer Credit Agreements, which transposed Directive 2008/48/EC. That framework is set to be replaced: Directive (EU) 2023/2225, known as the CCD2, repealed the 2008 directive and set November 20, 2026 as the date of application, after a transposition period that expired on November 20, 2025.
The Spanish transposition is set out in the Draft Consumer Credit Agreements Bill, given first-round approval by the Council of Ministers on January 7, 2026 and put out to public consultation until January 30, 2026, accompanied by a draft royal decree that implements the law and amends the legal regime of financial credit establishments.
What the CCD2 extends
The material scope widens considerably compared with Law 16/2011: it now covers deferred payment and BNPL schemes, microloans under €200, overdrafts, leasing with a purchase option and crowdlending transactions. Products that for years were marketed outside the consumer credit regime are now fully within it.
Reserved activity and supervision by the Bank of Spain
The structural change is the reserved activity. The Bank of Spain takes on the authorization, registration and supervision of consumer credit lenders and intermediaries, an area that until now fell outside its perimeter except for entities already regulated. Alongside this, two new types of entity appear: the authorized high-cost lender and the limited-activity financial credit establishment (EFCAL).
Cost limits
The draft bill makes use of the enabling power in Article 31 of the CCD2 and introduces a system of maximum APR (TAE) caps by amount and term tiers, with a transitional cap of 22% until the royal decree setting those tiers enters into force. High-cost credit is subject to a separate and more restrictive regime.
How does this relate to anti-money laundering?
An entity authorized by the Bank of Spain to grant credit is also an obliged entity under Law 10/2010. The authorization application is not settled by capital and articles of association alone: it requires an AML/CFT manual, a risk assessment and an internal control body (OCI) that are operational from day one. It is one of the most frequent grounds for a request for information in license applications.
Directive (EU) 2023/2225
CCD2
Law 16/2011
Bank of Spain
High-cost credit
Microloans
Reserved activity