CCD2 Compliance Checklist: 9 Tests for SECCI and Consumer Credit Documents

November 20, 2026 is not merely a date for legal teams. It is a production deadline for every system that turns product terms and customer data into a consumer credit communication.

Under the revised Consumer Credit Directive, Directive (EU) 2023/2225, consumers must receive standardized pre-contractual information through the Standard European Consumer Credit Information form, commonly called the SECCI. The directive also addresses the prominence of key information, legibility on mobile screens, presentation across channels, accessibility, and delivery on a durable medium. Member states are to apply their implementing measures from November 20, 2026. The directive also repeals the previous consumer credit directive from that date, subject to transitional rules for existing agreements.

That combination makes CCD2 a customer-communication management challenge. A lender can approve the right legal wording and still fail operationally if a rate is pulled from the wrong source, a long customer name pushes key information to the wrong page, the mobile version changes the reading order, or the delivered record cannot later be reproduced unchanged.

The leadership question is therefore not, "Have we updated the SECCI template?" It is, "Can we prove that every in-scope customer receives the right information, from the right data, in the right form, through the right channel, under the right national rules?"

This nine-part CCD2 compliance checklist turns that question into production evidence.

Important: CCD2 is a directive implemented through national law. This article provides an operational framework, not legal advice. Confirm scope, content, timing, form, retention, accessibility, and evidence requirements with counsel and the accountable compliance team in every market where you operate.

What CCD2 Changes for Customer Communications

CCD2 expands consumer-credit protections for a digital market that looks very different from 2008. Its scope reaches products and journeys that many organizations previously treated differently, including many small-value, short-term, interest-free, and buy now, pay later arrangements. Exact coverage and available exclusions require analysis of the directive and the applicable national law.

For document and communication teams, five requirements deserve immediate attention:

1. A standardized disclosure: Pre-contractual information is generally provided through the SECCI form on paper or another durable medium chosen by the consumer.
2. Prominent key information: Specified elements belong prominently in the first part of the form on one page. If they cannot fit, that first part may run to two pages at most, while specified core elements remain on page one.
3. Channel-aware presentation: Information must be consistent, clearly legible, and displayed suitably across channels, taking account of the medium's technical constraints and interoperability.
4. Durable delivery: The directive describes a durable medium as supporting future access for an adequate period, unchanged reproduction, readability, and information addressed personally to the consumer.
5. Equal access: The directive connects suitable cross-channel display with equal access and the European Accessibility Act.

These are not isolated formatting requirements. Together, they make the communication pipeline part of the control environment.

The national picture also remains unsettled. On October 1, 2026, the European Commission sent reasoned opinions to 16 member states for failing to communicate complete transposition of CCD2. That does not create a general permission to wait. It means a cross-border program needs a living jurisdiction register and named legal owners rather than one assumed EU-wide configuration. European Commission, October infringements package .

Test 1: Build a Product-and-Jurisdiction Scope Matrix

Begin with obligations, not templates. List every product, legal entity, distribution partner, country, channel, and customer journey that can result in consumer credit.

Include less obvious routes:

• embedded finance at an ecommerce checkout;
• interest-free or low-fee instalment plans;
• credit offered below a previously used value threshold;
• broker and credit-intermediary journeys;
• overdraft and open-end credit communications;
• voice-assisted or branch-assisted completion;
• post-contract changes, arrears, refinancing, and debt-advice notices; and
• products sold by a US-headquartered company to consumers in the EU.

For each row, record the applicable national implementing law, regulator, product owner, legal owner, required form, language, delivery options, effective date, and treatment of existing agreements.

The acceptance test is simple: select any production communication and trace it to one approved scope decision. "We use the EU template" is not enough when national implementation is incomplete or a product sits near a scope boundary.

Test 2: Create One Authoritative Data Contract

A SECCI form is a visible result of many invisible systems. Product configuration may supply the borrowing rate. A pricing engine calculates charges. A credit platform determines the amount and duration. A CRM contributes identity and address data. A schedule engine generates instalments. A document platform assembles the output.

If those systems do not share an approved data contract, the same transaction can produce internally inconsistent communications.

Define, for every regulated field:

• the authoritative source;
• the business definition and calculation method;
• units, currency, rounding, date, and locale rules;
• whether the field is required, conditional, derived, or prohibited;
• freshness and effective-time rules;
• what happens when the value is missing, stale, or contradictory; and
• the accountable business and technical owners.

Then reconcile the same values across the offer screen, SECCI, agreement, repayment schedule, confirmation, portal, call-center view, and later servicing communications.

Do not validate only a normal loan. Test zero and high values, variable rates, long terms, early repayment examples, optional services, fee combinations, joint applicants, long addresses, and every supported currency and locale. The output should either remain consistent or stop safely before delivery.

Test 3: Prove First-Part Prominence With Real Data Extremes

CCD2 does not say that the entire SECCI must fit on one page. It requires specified key elements to appear prominently in the first part on one page, with a limited two-page fallback when all those elements cannot fit and specified information remaining on page one.

That distinction matters. A design can look compliant in a sample file and fail when real data expands.

Run automated and human review against cases such as:

• the longest legal product and entity names;
• maximum-length customer names and addresses;
• currencies and translations that expand text;
• the largest plausible tables, rates, charges, and instalment values;
• optional fields appearing together;
• enlarged text and accessibility settings; and
• print drivers or PDF renderers used in production.

Approve explicit rules for pagination, content priority, line wrapping, table splitting, and overflow. Do not solve overflow by shrinking text until it is technically present but practically unreadable.

The evidence pack should show that mandatory first-part information remains prominent and in the approved order for every boundary case, not only that the template opened successfully.

Test 4: Validate Mobile and Channel Equivalence

The directive calls for information to be clearly legible, adapted to the medium's technical constraints, and displayed suitably across channels. Its recitals explicitly contemplate a consumer seeing essential information on a mobile-phone screen.

Treat each channel as a controlled rendering, not a casual conversion.

Test at least:

• customer portal on common desktop and mobile viewports;
• downloadable document on native and browser PDF viewers;
• email body and attachment;
• printed output where offered;
• assisted branch or contact-center presentation; and
• any message that links the consumer to the disclosure.

Across those routes, verify that information remains complete, ordered, legible, and semantically equivalent. A responsive web card, email summary, and PDF do not need identical layouts, but they must not create contradictory emphasis or omit information needed to understand the offer.

Capture screenshots, output files, reading order, device and browser details, test data, and results. "Responsive" is a design description. Production readiness requires evidence.

Test 5: Test the Durable Medium, Not Just the File

A PDF attachment may be part of a durable-medium solution, but a file format alone does not prove the whole requirement.

Test the end-to-end arrangement against four outcomes described in CCD2's durable-medium recital:

1. Future access: Can the consumer retrieve the information later without depending on a transient session or expiring link?
2. Adequate retention: Does access remain available for the period required by the purpose and applicable national law?
3. Unchanged reproduction: Can the organization and consumer reproduce the exact information originally provided?
4. Readability: Does the retained record remain usable with supported software and assistive technology?

Also verify personal addressing, consumer choice where required, delivery status, bounce or failure handling, archive integrity, permissions, and the relationship between a portal copy and any later template change.

Never regenerate a historical communication from today's template and current data and call it the original. Preserve the delivered artifact or an equivalently immutable record, together with the inputs, rules, and version that produced it.

Test 6: Make Accessibility a Source-Template Control

Accessibility cannot be bolted onto a handful of final PDFs. The directive's channel provisions point toward equal access and the European Accessibility Act, so accessibility belongs in component design, data rules, testing, and release approval.

For representative generated outputs, validate:

• meaningful reading order;
• headings and document structure;
• text alternatives or summaries for meaningful non-text elements;
• table structure and navigation;
• contrast and text sizing;
• keyboard and screen-reader behavior for digital journeys;
• understandable link and control labels;
• language identification; and
• preservation of meaning when content reflows or is enlarged.

Automated checks are useful for coverage, but they do not replace expert and user testing. A checker may detect a missing description; it cannot always determine whether the description is useful or whether the disclosure sequence makes sense without sight.

Build accessibility into the reusable components used by every country and product. That turns remediation from a document-by-document project into a governed production capability.

Test 7: Govern Country and Language Variants

Cross-border lenders often respond to regulatory change by cloning a master template for each country, language, product, and channel. That feels fast until common wording changes and dozens of copies drift apart.

A more controllable model combines:

• shared, approved core components;
• explicit country and product overlays;
• named owners for every local clause;
• translation review by qualified human reviewers;
• effective dates and withdrawal dates;
• dependency analysis before a shared component changes; and
• automated regression across every affected variant.

Machine translation can accelerate a first pass, but it should not be the final authority for regulated financial language. Legal meaning, consumer comprehension, numerical conventions, and local terminology require accountable review.

Keep a jurisdiction register beside the template repository. The Commission's ongoing transposition action makes this particularly important: the legal baseline and the production configuration must be updated together.

Test 8: Make Every Communication Reconstructable

When a consumer, auditor, regulator, or complaints team asks what happened, the organization should be able to reconstruct the communication without guesswork.

For each generated item, retain or reference:

• consumer and agreement identifier, with access controls;
• product, jurisdiction, language, and channel;
• source-system versions or timestamps;
• input data and calculated values used;
• business-rule results;
• template and reusable-component versions;
• approved legal-text version;
• accessibility and regression test status;
• generation, approval, and delivery timestamps;
• delivery result and retry history; and
• any manual edit, override, correction, or reissue.

Version labels alone are weak evidence. The record must connect the approved rule and template to the exact output the consumer received.

Set a release gate: no template, data mapping, calculation, translation, or shared component reaches production until its owner, tests, approval, effective date, and rollback path are recorded.

Test 9: Rehearse Exceptions, Voice Journeys, and Delivery Failure

Production systems fail at their boundaries. CCD2 readiness should therefore be judged by exception behavior, not only the happy path.

Run controlled tests for:

• missing or conflicting mandatory fields;
• unavailable pricing or calculation services;
• a document-generation timeout;
• an inaccessible or malformed output;
• portal, email, or print delivery failure;
• a consumer changing the requested durable medium;
• a correction after a document has been delivered;
• a template recalled after a defect is discovered; and
• a voice-telephony journey.

For qualifying voice journeys, CCD2 requires specified information during the call and the SECCI on a durable medium immediately after conclusion. The handoff between conversation, consent, transaction, document generation, and delivery must therefore be observable and recoverable.

Define when the journey stops, when it may retry, who is alerted, what the consumer sees, which version is preserved, and how a corrected communication is distinguished from the original. A silent fallback to an incomplete document is not resilience.

A CCD2 Go-Live Scorecard for Executives

Executives do not need another percentage-complete dashboard. They need evidence tied to consumer and regulatory outcomes.

Use a scorecard like this:

A workstream is green only when the evidence exists. "Configuration finished" or "legal reviewed the template" should remain amber until the full production path has passed.

Where Perfect Doc Studio Fits

A CCD2 program needs more than a document editor. It needs a controlled connection between source data, business rules, approved content, rendering, delivery, and evidence.

Perfect Doc Studio describes a visual, template-based platform for personalized, multilingual, and omnichannel customer communications. Its financial-services capabilities include loan agreements, payment schedules, borrower disclosures, regulatory notices, and lending communications. Its integration layer accepts structured data, maps and validates fields, applies rules, triggers document creation, and routes output. The platform also documents conditional templates, reusable sections, role-based access, job monitoring, accessibility review, and staged template versioning.

Those capabilities can support the operating model described here. They do not remove the lender's responsibility to interpret national law, approve regulated content, verify calculations, test accessibility, govern delivery, and retain defensible evidence.

The most useful evaluation is a representative proof of concept, not a polished generic demo. Choose one high-volume, high-variation disclosure family. Supply real boundary cases, country and language variants, source-system payloads, mobile and print channels, accessibility requirements, delivery failures, and audit questions. Then score the result against the nine tests.

The Deadline Is a Communication-Control Deadline

CCD2 readiness will not be proven by the existence of a revised template. It will be proven when the organization can generate the right disclosure from authoritative data, keep key information prominent under real-world variation, deliver it accessibly on the consumer's channel and durable medium, and reproduce the exact evidence later.

That is the difference between updating a document and building a compliant communication capability.

Next step: Book a Perfect Doc Studio demonstration and test one SECCI or borrower-disclosure family against the nine production-readiness controls.

Frequently Asked Questions

When does CCD2 apply?

Member states are to apply measures implementing Directive (EU) 2023/2225 from November 20, 2026. Because directives are implemented through national law, organizations should verify the law, regulator guidance, effective dates, and any national options in each market where they operate.

What is the SECCI form?

SECCI stands for Standard European Consumer Credit Information. It is the standardized form used to provide specified pre-contractual information so consumers can understand and compare credit offers. Under CCD2, specified key information must be prominent in the first part of the form.

Does the entire SECCI have to fit on one page?

No. CCD2 requires specified key elements to appear prominently in the first part on one page. If all those elements cannot fit, that first part may use no more than two pages, and specified core elements must remain on the first page. The complete form may contain additional information beyond that first part.

Is a PDF always a durable medium?

Not automatically. The delivery and storage arrangement must be assessed under applicable law. CCD2's recitals describe a durable medium in terms of personal addressing, future access for an adequate period, unchanged reproduction, and readability. A temporary portal view or an expiring link may require additional analysis and controls.

Can document automation make an organization CCD2 compliant?

Document automation can enforce approved data mappings, conditional content, templates, workflows, delivery, and evidence. It cannot decide legal scope, approve national wording, guarantee data accuracy, or replace accessibility and compliance testing. Compliance is an operating outcome produced by people, policy, technology, and evidence together.

Does CCD2 matter to US organizations?

It can. A US-based lender, retailer, platform, or service provider may be affected when its legal entities, products, partnerships, or customer journeys operate within the directive's territorial and national scope. Confirm applicability with qualified counsel rather than relying on headquarters location.

How should nonprofit and mission-led lenders use this checklist?

Credit unions, community-finance organizations, social lenders, and mission-led entities should apply the same discipline where their products fall within national consumer-credit rules. Clear, accessible, and reproducible communications are especially important when serving consumers who may be financially vulnerable. Legal scope and any entity-specific treatment must be confirmed locally.

What should a CCD2 document proof of concept include?

Use representative source payloads, the longest and shortest data values, country and language variants, one- and two-page first-part cases, mobile and print rendering, accessibility scenarios, delivery and archive evidence, failed-data and failed-delivery cases, and a request to reconstruct exactly how one output was produced.