Consumer Credit Rules Romania: CCD2, BNPL and What Lenders Must Change (2026)

Consumer credit rules Romania are entering their most significant change in more than a decade as the revised Consumer Credit Directive (Directive (EU) 2023/2225, commonly called CCD2) moves from EU adoption to national application. For banks, non-bank financial institutions (IFNs) and the fast-growing cohort of buy-now-pay-later (BNPL) and e-commerce providers operating in the Romanian market, the new framework expands disclosure obligations, tightens creditworthiness assessment, reshapes advertising and, critically, pulls many previously unregulated BNPL products into the scope of consumer credit. This article sets out a practical compliance playbook: what CCD2 changes, how Romanian transposition is structured, which products are captured, and the operational, contractual and IT changes lenders must make.

It is written for in-house counsel, compliance and risk leads, and product managers who need an actionable roadmap rather than a theoretical overview.

Intro and key takeaways for consumer credit rules Romania

The revised Consumer Credit Directive is the centrepiece of the EU’s modernisation of consumer lending law, replacing the baseline rules established under Directive 2008/48/EC. Romania, as a Member State, is obliged to transpose the directive into national law and apply it to lenders active in its market. The practical effect for firms is substantial: more prescriptive pre-contractual disclosure, a mandatory and more robust creditworthiness assessment, stricter advertising controls, and a decisive extension of scope to cover short-term and interest-free credit products that previously fell outside the regime.

The headline takeaways for executives are straightforward. First, many BNPL and point-of-sale instalment products will become regulated consumer credit, requiring the same consumer protections as traditional loans. Second, disclosure and APR presentation must be standardised and delivered in good time before the consumer is bound. Third, creditworthiness assessment becomes a documented, auditable process rather than a commercial discretion. Fourth, advertising and checkout messaging must carry mandatory information and avoid affordability-distorting claims. Fifth, firms need a cross-functional implementation programme, legal, product, IT, marketing and operations, running now, because retrofitting consumer-credit controls into a frictionless checkout flow is neither quick nor trivial.

What is CCD2 and where is Romania now?

CCD2 in brief, core objectives

CCD2 was adopted as Directive (EU) 2023/2225 of the European Parliament and of the Council on credit agreements for consumers, following the European Commission’s 2021 proposal (COM(2021) 462 final). Its core objectives are to extend consumer protection to credit products that have emerged since 2008, to improve the quality and comparability of information given to borrowers, to reinforce responsible lending through stronger creditworthiness assessment, and to address over-indebtedness. The directive responds directly to the rise of digital lending, instant credit and BNPL, which the original 2008 regime did not anticipate.

EU framework versus Romania’s transposition obligations

Under the EU legislative framework, a directive sets objectives that each Member State must achieve, but leaves the form and method of implementation to national legislatures. Directive (EU) 2023/2225 sets a transposition window within which Member States must adopt and publish national measures, followed by a later date from which the new rules apply to lenders. Romania must enact transposing legislation, typically through primary law or government ordinance, and align the mandates of the National Bank of Romania (BNR) and the National Authority for Consumer Protection (ANPC) with the new requirements.

Firms operating under consumer credit rules Romania should track the Official Gazette (Monitorul Oficial) and any public consultation drafts, because the national text will determine the precise cut-off dates, documentation standards and any national options exercised within the directive’s margins of discretion.

How CCD2 differs from Directive 2008/48/EC, headline changes

The original Consumer Credit Directive (2008/48/EC) excluded a range of products, notably certain interest-free credit, very short-term credit and small-value agreements, from its full protective regime. CCD2 narrows these exclusions, bringing more products within scope. Other headline changes include:

• Expanded scope. Many BNPL and small-value or interest-free arrangements that escaped the 2008 regime are captured.
• Stronger creditworthiness duty. A mandatory, evidence-based assessment with safeguards around automated decision-making and clear record-keeping.
• Enhanced disclosure. More prescriptive pre-contractual information, standardised formats and rules on digital delivery.
• Tighter advertising controls. Restrictions on claims that encourage irresponsible borrowing and mandatory standard information in ads.
• Measures against over-indebtedness. Including expectations around forbearance and support for consumers in financial difficulty.

Expert view: the single most disruptive change for the Romanian market is the extension of scope. Firms whose BNPL products were designed specifically to sit outside consumer credit rules Romania will need to re-engineer both their legal documentation and their customer journeys.

Will BNPL be captured? Product scope and practical examples

BNPL models, merchant-led instalments, third-party financing and short-term credit

BNPL is not a single product but a family of arrangements, and the scoping analysis differs across them. The main models seen in the Romanian market are:

• Merchant-led instalments. The retailer splits the purchase price into several payments, often interest-free, directly with the customer.
• Third-party checkout financing. A BNPL provider pays the merchant and collects instalments from the consumer, usually at the point of sale.
• Short-term deferred payment. “Pay in 30 days” or “pay later” arrangements with no interest if paid within the window, but fees or interest on default.

Under the 2008 regime, several of these structures benefited from exclusions for interest-free or short-duration credit. CCD2’s narrower exclusions mean that the default assumption should flip: a BNPL product is likely in scope unless a specific, documented exemption applies. For deeper product-level analysis, see our forthcoming guide, BNPL regulation Romania, practical guide.

CCD2 coverage tests and examples

Determining whether a particular BNPL product falls within consumer credit rules Romania requires applying the directive’s scoping tests to the commercial substance of the arrangement. The key factors are the value of the credit, its duration, whether the consumer pays any remuneration (interest or fees), and the nature of the contractual relationship. A practical decision-tree runs as follows:

• Is credit granted to a consumer? If the deferral of payment allows the consumer to acquire goods or services now and pay later, a credit relationship exists.
• Does the consumer pay any charge? Interest, fees, or charges triggered by late payment can bring the product into scope even where the “headline” offer is interest-free.
• Does a specific exemption apply? Narrow exemptions may remain for certain short, genuinely cost-free deferrals, but these must be assessed carefully against the national transposition text.
• If in scope, full consumer-credit obligations attach: pre-contractual information, creditworthiness assessment, right of withdrawal and advertising rules.

By way of example, a checkout “pay in 3 instalments, no interest” product offered by a third-party provider who pays the merchant and collects from the consumer should be treated as likely in-scope consumer credit under the revised framework. A genuinely free, short deferral with no fees and no default interest may fall within a residual exemption, but Expert view: firms should not rely on marketing framing alone; the terms that apply on default and the fee structure usually determine the answer, and the final national transposition text should be checked.

Consumer-facing obligations: pre-contractual information, APR and right of withdrawal

Pre-contractual information, required content, format and model wording

Pre-contractual information is the backbone of informed borrowing, and CCD2 makes its content and delivery more prescriptive. Before the consumer is bound by any credit agreement or offer, the lender must provide standardised information in good time, enabling comparison between offers. The required content typically includes the type of credit, the identity of the lender, the total amount of credit, the duration, the borrowing rate, the annual percentage rate of charge (APR), the total amount payable, the number and amount of instalments, any charges, the consequences of missed payments, and the existence of the right of withdrawal.

A pre-contractual information checklist for consumer credit rules Romania should confirm each of the following is present, accurate and legible:

• Identity and contact details of the creditor and any credit intermediary.
• Key financial terms, total credit amount, duration, borrowing rate (fixed or variable), APR and total amount payable.
• Repayment schedule, number, amount and frequency of instalments.
• All charges, including any fees, default interest and costs of ancillary services.
• Consumer rights, right of withdrawal, early repayment, and consequences of default.
• Delivery and retention, provided on a durable medium, in good time before conclusion, and retained as evidence.

Short model wording a firm might adapt for a pre-contract summary: “Before you agree, we will give you standardised information setting out the total cost of this credit, the annual percentage rate of charge (APR), your repayment schedule, all applicable fees, and your right to withdraw within the period set by law. Please read this information carefully and keep a copy.” Any template must be reviewed by a Romanian-qualified lawyer against the final transposition text before use.

APR disclosure and cost-of-credit mechanics

The APR is the single most important comparability figure for consumers, and CCD2 requires it to be calculated using the directive’s standard formula and presented prominently in both pre-contractual information and advertising. For firms, the operational consequence is that APR logic must be updated so that all cost elements captured by the directive’s definition are included in the calculation. Where the arrangement includes fees, even on a nominally interest-free BNPL product, those charges may need to be reflected in the APR. The directive also addresses limits on the cost of credit; whether and how any cap applies in Romania depends on the national transposition and existing domestic rules.

Expert view: firms should map every charge against the APR definition and treat ancillary and relevant fees as candidates for inclusion rather than assuming they sit outside the figure. Any cost-cap mechanics referenced in marketing should be tied to the exact legal definition, not to an internal approximation.

Right of withdrawal, timing, exceptions and notice obligations

CCD2 preserves and reinforces the consumer’s right to withdraw from a credit agreement within a defined period, without giving a reason. Lenders must inform consumers of this right in the pre-contractual information and the agreement, provide a means of exercising it, and handle the financial consequences of withdrawal, typically repayment of principal plus accrued interest, in a transparent way. Product and contract teams must ensure the withdrawal notice is included, the mechanism to exercise it is operationally available, and BNPL checkout flows accommodate the right rather than treating the transaction as final at the point of sale.

Creditworthiness assessment: what lenders and IFNs must change

Minimum assessment elements under CCD2

Responsible lending sits at the heart of the revised directive, and the creditworthiness assessment moves from commercial discretion to a documented legal obligation. Before granting credit, the lender must assess the consumer’s ability to repay on the basis of relevant and accurate information about income, expenses and existing financial commitments. The minimum elements of a compliant assessment include:

• Relevant data. Income, essential expenditure, existing debts and other financial obligations.
• Verification. Information should be verified where appropriate, using reliable sources rather than unchecked self-declaration alone.
• Proportionate database checks. Consultation of relevant credit databases where available and permitted.
• Human oversight. Safeguards around fully automated decisions, with the ability for consumers to request human intervention and an explanation of adverse outcomes.
• Outcome linkage. Credit should only be granted where the assessment indicates the consumer is likely to be able to meet repayments.

For BNPL providers accustomed to near-instant approvals with minimal checks, this is a fundamental change. The European Banking Authority’s guidelines on loan origination and monitoring provide a useful cross-check for building assessment standards that will satisfy Romanian supervisors. For a detailed treatment, see our planned article, Creditworthiness & data protection in lending, Romania.

Data protection intersections, GDPR considerations and consent

A robust creditworthiness assessment necessarily involves processing personal data, which engages the General Data Protection Regulation. Lenders must identify a lawful basis for processing, provide transparency about data sources and use, and apply data minimisation, collecting only what is necessary for the assessment. Where automated decision-making is used, the GDPR’s safeguards on profiling and the right to human intervention operate alongside the directive’s own safeguards on automated creditworthiness decisions. Expert view: firms should align their creditworthiness documentation with their GDPR records of processing so that the same data flows satisfy both regimes, and should avoid over-collecting data in a way that cannot be justified against either the credit assessment purpose or a GDPR lawful basis.

Record-keeping, documentation and audit trails

Because creditworthiness becomes an auditable obligation, documentation is no longer optional. Lenders should be able to reconstruct, for any individual decision, what data was used, from which sources, how it was scored, whether a manual review occurred, and the rationale for approval or refusal. A sound documentation framework for consumer credit rules Romania includes:

• Data source register. A record of each source consulted and its reliability.
• Scoring and policy rules. Version-controlled documentation of the scoring model and lending policy applied.
• Decision rationale. A clear record of the outcome and the reasons, especially for refusals and manual overrides.
• Retention. Storage for the period required under national rules, balanced against GDPR storage-limitation principles.
• Audit access. The ability to produce decision files promptly for internal audit or regulator inquiry.

Advertising, marketing and affordability messaging

Restricted claims and mandatory information in ads

Advertising rules under CCD2 are designed to prevent marketing that encourages irresponsible borrowing. Where an advertisement for credit includes an interest rate or any figure relating to the cost of the credit, it must also include standard information, presented clearly, concisely and prominently, using a representative example. Equally important is what advertisements must not do: they must not create false expectations about affordability or availability, must not suggest in misleading terms that credit will improve the consumer’s financial situation, and must not obscure the cost of borrowing behind promotional framing.

A practical advertising “do and don’t” list for consumer credit rules Romania:

• Do include the APR and a representative example whenever a cost figure appears.
• Do present mandatory information prominently and legibly, not in fine print.
• Do make clear when a product is credit and that eligibility depends on assessment.
• Don’t imply that “pay later” is free if fees or default interest can apply.
• Don’t use urgency or affordability claims that encourage borrowing beyond means.
• Don’t bury the credit nature of a BNPL product behind convenience messaging.

Digital ads, checkout messaging and e-commerce UX

The most sensitive area for BNPL and e-commerce providers is the checkout journey, where credit is offered as a frictionless payment option. CCD2’s requirements must be reconciled with UX design: the mandatory pre-contractual information and representative example cannot be relegated to a secondary screen the consumer never sees. Three compliant examples illustrate the approach:

• Checkout tile: “Pay in 3, this is a credit product. Representative APR shown. Subject to affordability checks.” with a link to full pre-contractual information.
• Banner ad: “Spread the cost from 0%, representative example: borrow RON [X] over [Y] months, APR [Z]%, total payable RON [T].”
• Product page: “Finance available. Credit subject to status and a creditworthiness assessment. See key information before you apply.”

For detailed marketing compliance, our consumer credit advertising compliance guide for Romania will expand these examples with annotated screens.

Operational and IT changes, implementation checklist and timeline

Contracts and T&Cs updates

Credit agreements, BNPL terms and merchant contracts must be revised to reflect CCD2 content requirements, mandatory terms, APR presentation, withdrawal and early-repayment rights, and consequences of default. Merchant agreements for third-party BNPL should allocate responsibility for disclosure and assessment clearly between provider and retailer.

IT and product configuration, pricing, APR calculators and checkout flows

Technology change is often the critical path. Firms must reconfigure product systems so that:

• APR calculators apply the directive’s formula and include all qualifying charges.
• Checkout flows surface pre-contractual information and representative examples before the consumer commits.
• Creditworthiness engines capture, verify and score the required data, with human-review routing and logging.
• Withdrawal and early-repayment functionality is built into servicing systems.
• Audit logging records decision files and disclosure delivery on a durable medium.

Governance, training and remediation plans

CCD2 compliance is a programme, not a single project. Firms should establish clear ownership across legal, product, IT, marketing and operations, with board-level visibility of the implementation status. Staff in sales, underwriting and customer service need training on the new obligations, and a remediation plan should be in place to correct any legacy agreements or marketing that do not meet the new standard once the rules apply.

Sample six-to-nine-month implementation timeline

• Months 1–2: Gap analysis and product-scope mapping; identify in-scope BNPL products.
• Months 2–4: Redraft contracts, disclosure templates and advertising; design APR and creditworthiness logic.
• Months 4–7: Build and test IT changes to checkout, underwriting and servicing.
• Months 7–8: Train staff, run controlled rollout, remediate legacy exposures.
• Months 8–9: Go live before the application date; monitor and refine.

Comparison table, current Romanian practice versus CCD2 obligations

The table below summarises the direction of travel across the main compliance areas. It contrasts common pre-CCD2 practice with the expected requirement under the revised directive and the practical change firms will need to make. Exact national detail should be confirmed against the Romanian transposition text.

What enforcement and penalties to expect in Romania

Likely regulators and enforcement levers

Enforcement of consumer credit rules Romania is shared. The National Authority for Consumer Protection (ANPC) is the principal body for consumer-protection aspects, disclosure, advertising and consumer rights, with powers to investigate complaints, order corrective measures and impose sanctions. The National Bank of Romania (BNR) is responsible for the prudential supervision and licensing of credit institutions and relevant non-bank financial institutions, and for supervisory expectations around lending conduct. Depending on the entity and the breach, the two authorities may act separately or coordinate, and serious misconduct can attract prosecutorial attention. The specific sanctions regime will be set out in the Romanian transposition text and should be confirmed against it once published.

Practical remediation steps if breach occurs

If a compliance failure is identified, firms should act quickly: contain the issue, assess the scope of affected customers and agreements, correct the deficient disclosure, assessment or advertising, and document the remediation. Where consumers have suffered detriment, consider redress. Early, documented engagement with the relevant regulator typically supports a more constructive outcome than a reactive response after enforcement begins.

Practical annex: model pre-contractual disclosure checklist and sample wording

Use this short pre-contract checklist to confirm each disclosure is in place before the consumer is bound:

• Creditor and intermediary identity and contact details are stated.
• Total amount of credit, duration, borrowing rate, APR and total amount payable are shown.
• Repayment schedule, number, amount and frequency of instalments, is set out.
• All fees and charges, including default interest, are disclosed.
• Right of withdrawal and early-repayment rights are explained.
• Information is delivered on a durable medium, in good time, and a copy is retained.

Sample wording: “This is a credit agreement. The total cost of your credit, including the annual percentage rate of charge, is set out in the standardised information provided before you commit. You have a right to withdraw within the period set by law and to repay early. Please read and keep a copy of this information.” A downloadable model template should be reviewed by a Romanian-qualified lawyer against the final transposition text before use.

Conclusion and action plan for consumer credit rules Romania

The transposition of CCD2 marks a structural shift in consumer credit rules Romania, and the firms that treat it as a strategic programme rather than a last-minute compliance exercise will manage the transition with least disruption. BNPL and point-of-sale credit are at the centre of the change, and the direction of travel is clear: more disclosure, genuine creditworthiness assessment, tighter advertising and enforceable consumer rights. Compliance leads should move now on five priorities:

1. Gap analysis against current disclosure, assessment and advertising practice.
2. Product mapping to identify which BNPL and credit products fall in scope.
3. IT and process changes to APR logic, checkout flows and underwriting.
4. Training and governance across legal, product, IT, marketing and operations.
5. Regulator engagement, monitor the transposition text and prepare any required notifications.

Sources

1. EUR-Lex, Directive 2008/48/EC (Consumer Credit Directive)
2. EUR-Lex, Directive (EU) 2023/2225 (revised Consumer Credit Directive, CCD2)
3. EUR-Lex, European Commission proposal for a revised Consumer Credit Directive (COM(2021) 462 final)
4. European Commission, Consumer credit (policy page)
5. National Bank of Romania (BNR)
6. Autoritatea Națională pentru Protecția Consumatorilor (ANPC)
7. European Banking Authority (EBA)