PoPEye — point-of-purchase evidence for the moment of consent.

Directive (EU) 2023/2225 was adopted 18 October 2023, entered into force 19 November 2023. Application is 20 November 2026 (Art. 48). On that date Directive 2008/48/EC (CCD1) is repealed and the new regime is directly enforceable in national courts.

CCD1 carved out short-term, low-value, fee-free credit (CCD1 Art. 2(2)(f)) — the exact shape BNPL took. CCD2 closes the carve-out. Operative scope changes beyond the §02b summary: the lower-threshold carve-out is cumulative (below €200 is in scope unless also non-deferred, interest-free, and fee-free — a test almost no BNPL product passes); the "large online supplier" exemption (Art. 2(2)(h)) is materially narrowed (most merchants who relied on the CCD1 version no longer qualify); leasing with purchase option or acquisition obligation is in (Art. 2(2)(d)); P2P and crowdfunded consumer credit — not in CCD1 at all — are captured.

Article 18 is the centre of gravity. Three rules compound:

1. Assessment is mandatory before every agreement, and before any material change. Not per consumer — per transaction. A repeat BNPL customer buying their second €400 basket that month needs a fresh assessment against that new obligation. The last one does not carry over.
2. It must rest on relevant, sufficient, proportionate information about the consumer's income, expenses, and financial circumstances — verified where necessary through independently verifiable documentation (Art. 18(1)–(2)). "Where necessary" is the proportionality hinge: a documented judgement the creditor has to defend, not a free hand.
3. Behavioural and inferred data cannot be the principal basis. Device signals, checkout behaviour, merchant-risk models, and social-graph proxies can inform a decision; they cannot carry it. The underlying evidence must be actual financial data. Germany's transposition is explicit on this and additionally prohibits social-media data in creditworthiness.

Three consequences flow from the text. A negative assessment means no credit — Art. 18(6) is a prohibition on granting credit the consumer cannot plausibly repay, with creditor liability attached ("we charged a higher APR instead" is not a defence). Automated decisions carry a human-review right layered on top of GDPR Art. 22 and the CJEU Schufa ruling (C-634/21, December 2023) — consumers must be told the decision logic and can demand human intervention. And proportionality cuts both ways: shallow checks are defensible at the shallow end and indefensible at the deeper end, with the burden of explaining why a given depth was adequate on the creditor.

Product implication: Article 18 does not specify a rail. It specifies an outcome. A documented policy mapping product, ticket, duration, and risk signal to required evidence depth is the defensible form — and the artifact a class-action plaintiff will demand in disclosure.

Creditworthiness consent under CCD2 is tighter than the GDPR baseline on four points (Art. 18, read with Arts. 10–12 and the Schufa ruling):

• Specificity. Consent must reference the specific assessment for the specific credit agreement. "I authorise credit checks" is not enough.
• Freely given, unbundled. Consent to creditworthiness cannot be tied to consent to marketing, profiling, or any unrelated processing. The bundled-consent pattern common in BNPL checkout UX is non-compliant as of 20 November 2026.
• Fresh consent per fresh check. Re-assessment on material change requires new consent. A one-time consent does not authorise indefinite bureau or AIS pulls.
• Data minimisation and right to information. The consumer must be told which data was accessed, from which source, and what decision resulted. Only data proportionate to the assessment may be collected.

The artifact that proves compliance is the consent receipt: a signed, timestamped record binding specific consumer, specific creditor, specific transaction, evidence sources, and decision. CCD2 does not mandate a receipt format. It mandates an outcome that a receipt is the only clean way to deliver.

The 14-day consumer withdrawal right carries over from CCD1. Two CCD2 additions matter for merchants: material modification triggers a new SECCI, new consent, and — where it materially changes the consumer's financial obligation — a new creditworthiness assessment (top-ups, limit increases, and restructurings are procedurally new agreements, not amendments); and forbearance is not optional — before enforcement, the creditor must offer reasonable forbearance measures.

CCD2 requires "effective, proportionate, and dissuasive" penalties (Art. 44). National legislatures set the specific amounts. What ships uniformly across the EU:

• Contract voiding and claw-back. Consumers can void non-compliant agreements and recover interest, fees, and default charges. This is the line-item exposure on a BNPL book — not the supervisory fine.
• Collective action under Directive (EU) 2020/1828. Qualified consumer associations can bring representative actions. The German Verbandsklage and the French action de groupe are the most active venues. One class action on systematic consent-bundling or shallow Art. 18 checks lands at multi-million-euro scale and becomes a precedent across the merchant's book.
• Private right of action. Individual consumers can claim damages for improperly assessed credit. The discovery burden — consent records, assessment logs, decision rationales on demand — is the operational part.
• Supervisory penalties. National competent authorities (BaFin, FMA, ACPR, Banca d'Italia) gain explicit CCD2 powers; calibrations are set in national law [NEEDS SOURCE on published CCD2-specific BaFin penalty ranges — CCD1 precedent was €250k–€5M for material violations].
• Cross-authority reporting. Regulators must flag cross-border non-compliance to peer authorities. A merchant in DE and AT cannot contain a problem to one market.

Germany passed transposition on 17 April 2026 (amending BGB and KWG, introducing the Sales Finance Supervision Act; Bundesrat consent expected May 2026). France transposed by Ordonnance of 3 September 2025. Austria's draft is in consultation, Q2 2026 targeted. Italy, Spain, Netherlands, Belgium have drafts in flight.

The directive text sets the floor for pan-European operations. What varies is the implementation layer — registration, supervisory templates, penalty calibrations, exact Art. 18 verification wording — landing on a rolling calendar through Q3 2026, often weeks before application. Waiting for perfect clarity is not a strategy. Directive-level obligations are stable enough to build against today; national additions layer on as configuration.

The consumer-PM buyer. Pay-in-3, Pay-in-4, short-duration deferred payment — the product that built the €191B EU BNPL volume and is on track for €293B by 2030. The CCD1 short-term exemption that made this product lightweight is gone. Every transaction now needs a standardised SECCI before commitment (Directive (EU) 2023/2225, Arts. 10–12), a per-transaction creditworthiness assessment based on verified financial data (Art. 18), specific and unbundled consent, and a signed receipt proving all of it.

What breaks. Contract voiding and claw-back of interest, fees, and default charges on any non-compliant agreement — applied across the book, not per case. Collective actions under Directive (EU) 2020/1828 (German Verbandsklage, French action de groupe) against systematic consent-bundling or shallow Art. 18 checks. Supervisory exposure to BaFin, FMA, ACPR, Banca d'Italia. And — specific to BNPL — a liability-apportionment fight between merchant and BNPL provider that is ambiguous today and adversarial tomorrow: whichever side cannot produce an audit-trailed consent receipt carries the loss.

Why BNPL cannot wait. Volume spikes with seasonal checkout load (peaks above 1,000 TPS for tier-1 merchants). A compliance layer retrofitted mid-peak is a re-platforming project, not a patch. The 20 November 2026 date is fixed. The only question is whether the merchant enters peak with defensible infrastructure or with exposure.

The consumer-finance-PM buyer. Often a different internal owner at the same merchant as BNPL — different budget line, different compliance appetite, different SLA expectations. Same Orchestration Layer backend; different commercial face. The rule is load-bearing: one platform, two tracks — do not collapse into a single "consumer credit" offering.

What changes at this ticket band is the evidence floor. Bureau data alone is rarely enough to defend an Art. 18 assessment on a €3,000 24-month obligation — the directive's proportionality standard ("verified where necessary through independently verifiable documentation") pushes toward independently verifiable income and expense evidence. Policy-triggered AIS for higher-assurance flows is how that surface closes at checkout latency.

What breaks. The exposure profile shifts from volume-class (many small void-and-claw-back events) to ticket-class (fewer, larger, material voiding actions). "We used bureau data" is a weaker Art. 18 defence at €3,000 than at €150. Under Directive 2020/1828, a qualified consumer association can build a representative action on one or two systematically mis-assessed instalment products and apply the precedent across every similar agreement on the book.

Why instalment credit cannot wait. Higher-assurance evidence requires contracted AIS capacity, configured policy thresholds, and SECCI templates calibrated per national transposition — procurement-cycle decisions, not deployment tasks. Starting in Q3 2026 for 20 November 2026 is late.

The lessor buyer. CCD2 Art. 2(2)(d) is the key line: leases without acquisition obligation are out; consumer leases with a purchase option or acquisition obligation are in. Pure operational leasing is not routed through this platform unless local legal review puts it in scope.

The v1 posture is explicit and narrow: its own product mode, SECCI template, and pricing band; AIS-heavy evidence default (bureau-only not permitted at this scale under the v1 policy matrix). Available for design partners and first lessors — deliberately small to prove the product mode works before offering it broadly. Lessors have longer sales cycles and richer affordability-signal expectations than BNPL merchants; leasing carries its own commercial band because the evidence mix and unit economics differ.

What breaks. Same enforcement vectors as instalment credit, compounded by contract length — a voided lease is a multi-year revenue claw-back, not a ticket-level one. Mid-term payment changes and end-of-term purchase-option exercises each trigger the Art. 18 re-assessment rule. A lessor without re-assessment infrastructure at modification events carries cumulative exposure across the book.

Why leasing cannot wait. For design-partner lessors, scoping and evidence-calibration work starts now — leasing ships only if that validation runs parallel to the PSP PoC.

In scope under CCD2, but a different operational shape: continuous obligation rather than per-transaction credit, with re-assessment triggered by material change across the life of the facility. Compliance logic carries over — SECCI, Art. 18, specific consent, receipt — but the surface is a portfolio-review flow, not a checkout flow. Not a v1 commitment. The envelope and receipt schema are designed to absorb revolving as a future product mode without re-architecture.