Loan management software for the EU Consumer Credit Directive

Keep the inputs used, the scoring or rule outcome, the version of the assessment method applied, and a timestamp for each application. In a self-hosted stack, the Fineract loan record holds the application and approved terms, and the client data and KYC documents section stores supporting documents. Any external decisioning service should either write its output back to the loan record or keep its own log with a reference to the loan ID. Save a copy of the assessment as it stood at approval, so later rule changes do not rewrite history. Ask counsel to confirm which data the revised directive requires and how long each record must be kept.

Record who reviewed the case, when, what information they saw, the decision they reached, and the reason, including any override of the automated outcome. The case workflow in your decisioning layer or front end creates this evidence, so capture it there and link it to the Fineract loan ID. Take reviewer identity from your identity provider so each account maps to a named person. Test the review path before go-live: a reviewer who changes or confirms a decision should always leave a logged reason. Confirm with counsel what level of review the directive requires for each product.

Keep each disclosure template as a versioned document, the borrower-specific values filled in, the channel used, and proof of delivery such as a timestamp, email log or signed acknowledgment. Fineract produces the loan terms and repayment schedule, but the template and delivery log usually sit in your document system or front end, so link them by loan and client ID. Store the exact rendered text shown to the borrower, since a later template edit should not change the record. Confirm with counsel which disclosures apply to each product and the timing rules that govern them.

Record the date and channel each request arrived, the identity check performed, the date the request was accepted, each action taken, and the date the account was closed or refunded. Your servicing or front-end workflow creates these events, while Fineract records the resulting loan transactions, repayments and balance changes. Keep the calculations behind any amount refunded or repaid, so the figures can be reproduced later. Measure elapsed time from the moment the request was received and time-stamp each step. Confirm the withdrawal period, and what event starts it, with counsel before you configure the workflow.

Keep the change request, the reviewer and approver, test results, the release identifier, the deployment time and the rollback plan for every change to products, rules, templates or code. Export or version Fineract product and business rule settings, and keep the Liquibase migration history, which records each applied database change. For the Fineract platform itself, keep the release version you deployed, since the project publishes official releases quarterly. The FTC Safeguards Rule requires covered US institutions to adopt change management procedures, so the same records can serve a US book as well.

Keep authentication events, role changes, views and edits of borrower records, approvals, exports and administrative actions, each tied to a named user and timestamp. Fineract requests carry a tenant identifier header, so record that alongside the user identity at the gateway or application layer. Send logs to central storage that application administrators cannot edit. The FTC Safeguards Rule requires covered US institutions to log the activity of authorized users, and the GDPR's security of processing requirement in Article 32 points the same way for EU personal data. Require multi-factor authentication for staff and admins, and log enrollment and failed attempts.

The retention period comes from the directive as implemented in each member state, combined with your own legal and privacy analysis, so this page does not state a number. Keep evidence at least as long as the loan and any period in which a complaint or claim could arise, then delete or archive it. The GDPR requires that personal data is not kept longer than needed for its purpose, so retention must have an end date, not only a start date. Enforce the schedule with deletion or archiving jobs in the lending system, and apply the same schedule to backups. Ask counsel to confirm the period for each product and country.

Cost follows the written scope, and the main drivers are how many loan products, channels and integrations the directive touches, and how much lending logic must be custom-built instead of configured. Typical line items include:

• Requirements review and gap analysis against the directive text
• Product and workflow configuration, including human review and withdrawal handling
• Creditworthiness record design, disclosure templates and data migration
• Testing, evidence collection and documentation
• Hosting, upgrades, monitoring and support

Ask the quote to separate one-time work from recurring costs such as hosting and support retainers. Ask for each assumption, such as the number of product variants or credit bureau connections, so later changes can be priced. DeployOpen works from a fixed scope with deliverables and timelines agreed in writing before work starts, and it does not publish a price list, so the quote follows from that scope.

Internal staff can prepare much of the readiness work, but rarely all of it alone. Credit and compliance leads must own decisions on review thresholds, disclosure wording, retention periods and withdrawal handling, while engineers configure products and integrations. Apache Fineract is headless, with REST APIs and no user interface of its own, so a front end and its workflows must be chosen and built. The Fineract README warns that a production deployment can be complex, costly and time-consuming, and that the project does not provide a comprehensive production deployment guide. Before committing, name an owner for each control area, confirm who will maintain the configuration after go-live, and decide which skills you must buy in.

Duration depends on scope, and a reliable estimate is not possible until requirements are fixed. The biggest factors are the number of products in scope, whether automated decisioning changes, how much history must be migrated, how many integrations are needed, whether a new front end is required, and how many rounds of legal and compliance review your team needs. Plan backward from the application date in the official text of the directive, and confirm that date with your counsel. Ask the partner for milestones tied to specific deliverables, and list the dependencies on your own reviews and on third-party vendor responses so that delays are visible early.

The directive does not name a platform, so the choice comes from your product and operating needs. Apache Fineract is licensed under Apache-2.0 and covers loan and savings portfolio management, configurable products and business rules, real-time accounting and REST APIs, with PostgreSQL as the recommended database. Its latest stable release, 1.15.0, was published on July 14, 2026. Its platform documentation is the best starting point for checking product configuration options. For Frappe Lending, confirm against its current documentation how it handles the product types, disclosures and record keeping you need, and test both options against the same requirement list before choosing.

Ask for evidence of lending configuration work, not general statements about the platform. Request a walkthrough of a product configured in a sandbox, including its repayment schedule, fee rules and review steps. Ask how the partner records a change to a business rule, who approves it and how the audit trail is kept. Ask which team members will do the work, what similar configuration they have completed and what roles they held. Request a sample test plan for lending rules and the documentation they produce. Where the partner can share references, ask for them, and check that the scope described matches the work you need.

No. DeployOpen plans, implements and documents self-hosted systems and prepares the controls and evidence that a compliance assessment may review. It does not issue audit reports, attestations or certifications, and independent auditors or certification bodies do that work. Interpretation of the directive remains with your legal and compliance team and, where relevant, your supervisor. The same principle applies under the GDPR, where no audit is required and voluntary certification under Article 42 does not reduce the responsibility of the controller or processor. Confirm early which decisions your counsel will sign off and which evidence your assessor will expect.