New Consumer Credit Directive: A revolution for consumer loans?

On 20 November 2025, the implementation period for the new Consumer Credit Directive (EU) 2023/2225 (Consumer Credit Directive 2023) ends, replacing its predecessor Directive 2008/48/EC (Consumer Credit Directive 2008) – which was implemented nationally in the Austrian Consumer Credit Act.

In our opinion, the approaching end of the implementation period is a good opportunity to take a closer look at the challenges ahead for creditors. Even though the new regulations will not apply before 20 November 2026, and some aspects are already familiar from the previous directive, the devil is in the details.

Creditors should therefore familiarize themselves with the new regulations at an early stage so that they can adapt their lending practices in relation to consumer credits in good time.

Here you can find out everything you need to know about the important changes in a compact format:

Expanded scope of application: Focus on small loans and Buy Now Pay Later (BNPL) models

Compared to the previous directive, the scope of the Consumer Credit Directive 2023 has been significantly expanded. It should be noted here that the lower limit of EUR 200 has been removed, meaning that so-called “small or minor loans” will also be covered in the future. In addition, the upper limit is raised to EUR 100,000 (previously EUR 75,000). However, this is unlikely to result in any changes in Austria. In the course of implementing the Consumer Credit Directive 2008, the Austrian Parliament already decided to make use of its discretion – which will continue to exist in the future – and did not set a national upper limit. We do not expect the national lawmakers to deviate from its (consumer-friendly) approach and stipulate that consumer credits with a total credit amount of more than EUR 100,000 will be excluded from the scope going forward.

Furthermore, the excemption of credit agreements where the credit is granted free of interest and without any other charges and for those that are to be repaid within three months and incur only low costs has also been abolished. However, Member States are free to provide certain simplifications for these types of credit agreements as well as for small loans (e.g., regarding pre-contractual information requirements). It remains to be seen whether Austria will make us of this possibility.

It will also be interesting to see whether the Austrian legislator makes use of the option to exclude the credit card business from the scope of the stricter consumer credit law. In future, credit agreements in the form of debit cards with deferred payment, meaning credit cards that are commonly available on the market, will also fall under the new requirements. Member States have the option to exempt credit agreements in the form of deferred debit cards that

• are provided by a credit or payment institution,
• require repayment within 40 days, and
• are free of interest and with only limited charges for the provision of the payment service.

It is also of essential importance that the “Buy Now, Pay Later” (BNPL) models – which are particularly widespread in online businesses – where the credit agreement (deferral of payment) serves exclusively for the purchase of goods or services, fall within the scope of the Consumer Credit Directive 2023. However, the directive provides for excemptions to these models under certain conditions, which are unfortunately quite complex from the perspective of the legal practitioner. For example, payment deferrals that serve exclusively for the purchase of goods or services are exempt if

• the supplier of goods or provider of services is an SME or a large company that, in simple terms, operates offline and itself grants the consumer a payment deferral,
• the purchase price is to be paid free of interest without any other charges and with only limited charges payable by the consumer for late payments, and
• the payment is to be entirely executed within 50 days of the delivery of the goods or services.

If, on the other hand, the supplier of goods or provider of services is a large company and, to put it simply, operates online (e.g., online sales of goods), payment deferrals are only considered exempt if

• a third party is neither offering nor purchasing credit,
• the payment is to be entirely executed within 14 days of the delivery of the goods or services; and
• the purchase price is to be paid free of interest and without any other charges and with only limited charges payable by the consumer for late payments.

The new provisions therefore affect not only “traditional” creditors such as banks, but also commercial undertakings. Invoice and instalment purchases with terms of several months, as currently offered by large online retailers, will thus become more complex from a legal perspective and require increased compliance efforts.

Crowdfunding is also subject to the provisions of the Consumer Credit Directive 2023 if providers of crowdfunding credit services grant loans directly to consumers or if such providers facilitate the granting of loans between creditors and consumers.

Assessment of creditworthiness: More responsibility, more obligations

Another key point of the upcoming changes is the creditworthiness assesement, which will be tightened. The aim is to prevent irresponsible lending and over-indebtedness among consumers.

Accordingly, creditors will be required to carry out a thorough creditworthiness assessment, based on the model of the Mortgage Credit Directive 2014/17/EU. The assessment procedure must be established in advance and documented accordingly. The assessment shall be carried out on the basis of relevant and accurate information on the consumer’s income and expenses and other financial and economic circumstances which is necessary and proportionate to the nature, duration, value and risks of the credit for the consumer. That information may include evidence of income or other sources of repayment, information on financial assets and liabilities, or information on other financial commitments. The information shall be obtained from relevant internal or external sources, including the consumer and, where necessary, by consulting respective databases. As is already required in connection with credit agreements relating to residential immovable property, the information obtained must be verified by the creditor in an appropriate manner. In addition, the Consumer Credit Directive 2023 stipulates an obligation to document and maintain the information used for the creditworthiness assessment.

If the assessment of creditworthiness involves the use of automated procession of personal data, consumers will be able to demand that the creditors have a natural person intervene on the creditor’s side and review the credit decision. Considering the recitals, AI systems used to assess credit scores, or the creditworthiness of natural persons will probably also be covered. Given that credit decisions are often made automatically in practice using internal and external “scoring” systems, this could result in a significant amount of additional work. Creditors will have to provide at least one qualified person to review the credit decision “manually” if the consumer so requests. Even if this is not explicitly stated in the text of the directive, it can be assumed that the consumer can only request a review if the assessment of creditworthiness is negative and the credit application has therefore been initially rejected.

The Consumer Credit Directive 2023 provides for a significant tightening of the rules in cases where the creditworthiness assessment does not indicate that the obligations resulting from the credit agreement are likely to be met in the manner required under that agreement. A negative credit assessment no longer triggers a warning obligation for the creditor; instead, it results in a prohibition on granting the credit.

Right of withdrawal: “Perpetual withdrawal” only in exceptional cases

The Consumer Credit Directive 2023 allows consumers to withdraw from a credit agreement within 14 days from the day of the conclusion. The provisions on withdrawal largely correspond to those of the Consumer Credit Directive 2008. In this context, however, it is important to note once again the extended scope of the Consumer Credit Directive 2023, which in practice also leads to a significantly broader application of the withdrawal right.

A new provision stipulates that the right of withdrawal expires after 12 months and 14 days after the conclusion of the credit agreement if the consumer has not received the contractual terms and information required by the directive. However, caution is recommended here, as this relief does not apply if the consumer has not been informed of their right of withdrawal. In this case, “perpetual withdrawal” remains a potential risk, especially for creditors who do not recognize that the credit agreement is subject to the provisions of the Consumer Credit Directive 2023 or the upcoming implementation law.

Advertising: Warning and new standards

The Consumer Credit Directive 2023 also brings significant changes with regard to advertising for consumer credits. In future, creditors will be required to provide certain standard information in their advertising – in a clear, concise, and prominent way, using a representative example. It should also be noted that the presentation must be adapted to the technical constraints of the medium used for advertising (e.g. smartphone screens).

Another new feature is that creditors will have a duty to warn. Accordingly, advertising for credit agreements must in future contain a clear and prominent warning to make consumers aware that borrowing money costs money. The wording proposed in the text of the directive is “Caution! Borrowing money costs money”, although an equivalent wording may also be used.

In addition, the Consumer Credit Directive 2023 restricts the content of credit advertising. Advertising for credit products is prohibited if it

• encourages consumers to seek credit by suggesting that credit would improve the financial situation of those consumers;
• specifies that outstanding credit agreements or registered credit in databases have little or no influence on the assessment of a credit application;
• falsely suggests that credit leads to an increase in financial resources, constitutes a substitute for savings or can raise a consumer’s living standards.

Conclusion: A lot of familiar elements, but also many new aspects

In summary, it can be said that with the Consumer Credit Directive 2023, the European legislator is noticeably tightening the reins in the area of consumer credit. The expanded scope, stricter due diligence obligations, and new guidelines for advertising and information make it clear that consumers are to be better protected and risky lending shall be prevented. Even though some areas of regulation are already familiar from the previous directive and the Mortgage Credit Directive, there is still a need for action on the part of credit institutions that should not be underestimated.

Retailers and service providers, especially large online retailers, must also consider whether their existing financing options for consumers will be subject to regulatory requirements in the future. If necessary, they will have to adapt their offerings.

It is therefore advisable to follow the national legislative process in order to be able to make the necessary adjustments within the company in good time.

How can we help you?

With our comprehensive expertise in regulatory risk management, we are happy to support you in preparing early for the new requirements relating to consumer credits, in particular in the design and review of

• credit and advertising documents with regard to the extended information requirements and advertising restrictions,
• existing and planned financing instruments for consumers, including buy-now-pay-later models,
• internal processes and product documentation to ensure compliance with the new creditworthiness assessment requirements, or
• the design and adaptation of contracts and general terms and conditions to minimize legal risks.